r24590: Reformatting to coding standards. Added my (C) in places it already should

have been :-).
Jeremy.
(This used to be commit 41611a22ed852bb74e2ef3f45766c0580ffd3a18)

1 files changed, 249 insertions, 172 deletions

diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index e63511c368..4c45806b02 100644
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -6,17 +6,18 @@
    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
    Copyright (C) Luke Howard          2003
    Copyright (C) Volker Lendecke      2007
+   Copyright (C) Jeremy Allison	      2007
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
@@ -35,11 +36,12 @@ uint32 global_client_caps = 0;
   on a logon error possibly map the error to success if "map to guest"
   is set approriately
 */
-static NTSTATUS do_map_to_guest(NTSTATUS status, auth_serversupplied_info **server_info,
+static NTSTATUS do_map_to_guest(NTSTATUS status,
+				auth_serversupplied_info **server_info,
 				const char *user, const char *domain)
 {
 	if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
-		if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER) || 
+		if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER) ||
 		    (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD)) {
 			DEBUG(3,("No such user %s [%s] - using guest account\n",
 				 user, domain));
@@ -49,7 +51,8 @@ static NTSTATUS do_map_to_guest(NTSTATUS status, auth_serversupplied_info **serv
 
 	if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
 		if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD) {
-			DEBUG(3,("Registered username %s for guest access\n",user));
+			DEBUG(3,("Registered username %s for guest access\n",
+				user));
 			status = make_server_info_guest(server_info);
 		}
 	}
@@ -96,8 +99,9 @@ static int push_signature(uint8 **outbuf)
  Start the signing engine if needed. Don't fail signing here.
 ****************************************************************************/
 
-static void sessionsetup_start_signing_engine(const auth_serversupplied_info *server_info,
-					      const uint8 *inbuf)
+static void sessionsetup_start_signing_engine(
+			const auth_serversupplied_info *server_info,
+			const uint8 *inbuf)
 {
 	if (!server_info->guest && !srv_signing_started()) {
 		/* We need to start the signing engine
@@ -106,7 +110,7 @@ static void sessionsetup_start_signing_engine(const auth_serversupplied_info *se
 		 * correct one. Subsequent packets will
 		 * be correct.
 		 */
-			srv_check_sign_mac((char *)inbuf, False);
+		srv_check_sign_mac((char *)inbuf, False);
 	}
 }
 
@@ -140,14 +144,14 @@ static void reply_sesssetup_blob(connection_struct *conn,
 }
 
 /****************************************************************************
- Do a 'guest' logon, getting back the 
+ Do a 'guest' logon, getting back the
 ****************************************************************************/
 
-static NTSTATUS check_guest_password(auth_serversupplied_info **server_info) 
+static NTSTATUS check_guest_password(auth_serversupplied_info **server_info)
 {
 	struct auth_context *auth_context;
 	auth_usersupplied_info *user_info = NULL;
-	
+
 	NTSTATUS nt_status;
 	unsigned char chal[8];
 
@@ -155,7 +159,8 @@ static NTSTATUS check_guest_password(auth_serversupplied_info **server_info)
 
 	DEBUG(3,("Got anonymous request\n"));
 
-	if (!NT_STATUS_IS_OK(nt_status = make_auth_context_fixed(&auth_context, chal))) {
+	if (!NT_STATUS_IS_OK(nt_status = make_auth_context_fixed(&auth_context,
+					chal))) {
 		return nt_status;
 	}
 
@@ -163,8 +168,10 @@ static NTSTATUS check_guest_password(auth_serversupplied_info **server_info)
 		(auth_context->free)(&auth_context);
 		return NT_STATUS_NO_MEMORY;
 	}
-	
-	nt_status = auth_context->check_ntlm_password(auth_context, user_info, server_info);
+
+	nt_status = auth_context->check_ntlm_password(auth_context,
+						user_info,
+						server_info);
 	(auth_context->free)(&auth_context);
 	free_user_info(&user_info);
 	return nt_status;
@@ -204,14 +211,17 @@ static BOOL make_krb5_skew_error(DATA_BLOB *pblob_out)
 
 	kerr = smb_krb5_parse_name(context, host_princ_s, &host_princ);
 	if (kerr) {
-		DEBUG(10,("make_krb5_skew_error: smb_krb5_parse_name failed for name %s: Error %s\n",
+		DEBUG(10,("make_krb5_skew_error: smb_krb5_parse_name failed "
+			"for name %s: Error %s\n",
 			host_princ_s, error_message(kerr) ));
 		goto out;
 	}
-	
-	kerr = smb_krb5_mk_error(context, KRB5KRB_AP_ERR_SKEW, host_princ, &reply);
+
+	kerr = smb_krb5_mk_error(context, KRB5KRB_AP_ERR_SKEW,
+			host_princ, &reply);
 	if (kerr) {
-		DEBUG(10,("make_krb5_skew_error: smb_krb5_mk_error failed: Error %s\n",
+		DEBUG(10,("make_krb5_skew_error: smb_krb5_mk_error "
+			"failed: Error %s\n",
 			error_message(kerr) ));
 		goto out;
 	}
@@ -283,39 +293,46 @@ static void reply_spnego_kerberos(connection_struct *conn,
 		return;
 	}
 
-	ret = ads_verify_ticket(mem_ctx, lp_realm(), 0, &ticket, 
-				&client, &pac_data, &ap_rep, 
+	ret = ads_verify_ticket(mem_ctx, lp_realm(), 0, &ticket,
+				&client, &pac_data, &ap_rep,
 				&session_key, True);
 
 	data_blob_free(&ticket);
 
 	if (!NT_STATUS_IS_OK(ret)) {
 #if 0
-		/* Experiment that failed. See "only happens with a KDC" comment below. */
+		/* Experiment that failed.
+		 * See "only happens with a KDC" comment below. */
 
 		if (NT_STATUS_EQUAL(ret, NT_STATUS_TIME_DIFFERENCE_AT_DC)) {
 
 			/*
-			 * Windows in this case returns NT_STATUS_MORE_PROCESSING_REQUIRED
-			 * with a negTokenTarg blob containing an krb5_error struct ASN1 encoded
-			 * containing KRB5KRB_AP_ERR_SKEW. The client then fixes its
-			 * clock and continues rather than giving an error. JRA.
+			 * Windows in this case returns
+			 * NT_STATUS_MORE_PROCESSING_REQUIRED
+			 * with a negTokenTarg blob containing an krb5_error
+			 * struct ASN1 encoded containing KRB5KRB_AP_ERR_SKEW.
+			 * The client then fixes its clock and continues rather
+			 * than giving an error. JRA.
 			 * -- Looks like this only happens with a KDC. JRA.
 			 */
 
 			BOOL ok = make_krb5_skew_error(&ap_rep);
 			if (!ok) {
 				talloc_destroy(mem_ctx);
-				return ERROR_NT(nt_status_squash(NT_STATUS_LOGON_FAILURE));
+				return ERROR_NT(nt_status_squash(
+						NT_STATUS_LOGON_FAILURE));
 			}
-			ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep, TOK_ID_KRB_ERROR);
-			response = spnego_gen_auth_response(&ap_rep_wrapped, ret, OID_KERBEROS5_OLD);
-			reply_sesssetup_blob(conn, inbuf, outbuf, response, NT_STATUS_MORE_PROCESSING_REQUIRED);
+			ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep,
+					TOK_ID_KRB_ERROR);
+			response = spnego_gen_auth_response(&ap_rep_wrapped,
+					ret, OID_KERBEROS5_OLD);
+			reply_sesssetup_blob(conn, inbuf, outbuf, response,
+					NT_STATUS_MORE_PROCESSING_REQUIRED);
 
 			/*
-			 * In this one case we don't invalidate the intermediate vuid.
-			 * as we're expecting the client to re-use it for the next
-			 * sessionsetupX packet. JRA.
+			 * In this one case we don't invalidate the
+			 * intermediate vuid as we're expecting the client
+			 * to re-use it for the next sessionsetupX packet. JRA.
 			 */
 
 			*p_invalidate_vuid = False;
@@ -331,7 +348,8 @@ static void reply_spnego_kerberos(connection_struct *conn,
 			ret = NT_STATUS_LOGON_FAILURE;
 		}
 #endif
-		DEBUG(1,("Failed to verify incoming ticket with error %s!\n", nt_errstr(ret)));	
+		DEBUG(1,("Failed to verify incoming ticket with error %s!\n",
+				nt_errstr(ret)));
 		talloc_destroy(mem_ctx);
 		reply_nterror(req, nt_status_squash(ret));
 		return;
@@ -380,8 +398,9 @@ static void reply_spnego_kerberos(connection_struct *conn,
 	domain = p+1;
 
 	if (logon_info && logon_info->info3.hdr_logon_dom.uni_str_len) {
-
-		unistr2_to_ascii(netbios_domain_name, &logon_info->info3.uni_logon_dom, -1);
+		unistr2_to_ascii(netbios_domain_name,
+				&logon_info->info3.uni_logon_dom,
+				-1);
 		domain = netbios_domain_name;
 		DEBUG(10, ("Mapped to [%s] (using PAC)\n", domain));
 
@@ -422,7 +441,7 @@ static void reply_spnego_kerberos(connection_struct *conn,
 	}
 
 	fstr_sprintf(user, "%s%c%s", domain, *lp_winbind_separator(), client);
-	
+
 	/* lookup the passwd struct, create a new user if necessary */
 
 	username_was_mapped = map_username( user );
@@ -435,7 +454,8 @@ static void reply_spnego_kerberos(connection_struct *conn,
 		/* do this before an eventual mappign to guest occurs */
 		ret = smb_pam_accountcheck(pw->pw_name);
 		if (  !NT_STATUS_IS_OK(ret)) {
-			DEBUG(1, ("PAM account restriction prevents user login\n"));
+			DEBUG(1,("PAM account restriction "
+				"prevents user login\n"));
 			data_blob_free(&ap_rep);
 			data_blob_free(&session_key);
 			TALLOC_FREE(mem_ctx);
@@ -447,19 +467,20 @@ static void reply_spnego_kerberos(connection_struct *conn,
 	if (!pw) {
 
 		/* this was originally the behavior of Samba 2.2, if a user
-		   did not have a local uid but has been authenticated, then 
+		   did not have a local uid but has been authenticated, then
 		   map them to a guest account */
 
-		if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID){ 
+		if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID){
 			map_domainuser_to_guest = True;
 			fstrcpy(user,lp_guestaccount());
 			pw = smb_getpwnam( mem_ctx, user, real_username, True );
-		} 
+		}
 
 		/* extra sanity check that the guest account is valid */
 
 		if ( !pw ) {
-			DEBUG(1,("Username %s is invalid on this system\n", user));
+			DEBUG(1,("Username %s is invalid on this system\n",
+				user));
 			SAFE_FREE(client);
 			data_blob_free(&ap_rep);
 			data_blob_free(&session_key);
@@ -471,17 +492,17 @@ static void reply_spnego_kerberos(connection_struct *conn,
 	}
 
 	/* setup the string used by %U */
-	
+
 	sub_set_smb_name( real_username );
 	reload_services(True);
 
 	if ( map_domainuser_to_guest ) {
 		make_server_info_guest(&server_info);
 	} else if (logon_info) {
-		/* pass the unmapped username here since map_username() 
+		/* pass the unmapped username here since map_username()
 		   will be called again from inside make_server_info_info3() */
-		
-		ret = make_server_info_info3(mem_ctx, client, domain, 
+
+		ret = make_server_info_info3(mem_ctx, client, domain,
 					     &server_info, &logon_info->info3);
 		if ( !NT_STATUS_IS_OK(ret) ) {
 			DEBUG(1,("make_server_info_info3 failed: %s!\n",
@@ -513,15 +534,16 @@ static void reply_spnego_kerberos(connection_struct *conn,
 		 * %D. */
 
 		if (server_info->sam_account != NULL) {
-			pdb_set_domain(server_info->sam_account, domain, PDB_SET);
+			pdb_set_domain(server_info->sam_account,
+					domain, PDB_SET);
 		}
 	}
 
 	server_info->was_mapped |= username_was_mapped;
-	
+
 	/* we need to build the token for the user. make_server_info_guest()
 	   already does this */
-	
+
 	if ( !server_info->ptok ) {
 		ret = create_local_token( server_info );
 		if ( !NT_STATUS_IS_OK(ret) ) {
@@ -562,11 +584,11 @@ static void reply_spnego_kerberos(connection_struct *conn,
 		reload_services( True );
 
 		SSVAL(req->outbuf, smb_vwv3, 0);
-			
+
 		if (server_info->guest) {
 			SSVAL(req->outbuf,smb_vwv2,1);
 		}
-		
+
 		SSVAL(req->outbuf, smb_uid, sess_vuid);
 
 		sessionsetup_start_signing_engine(server_info, req->inbuf);
@@ -576,11 +598,13 @@ static void reply_spnego_kerberos(connection_struct *conn,
 
         /* wrap that up in a nice GSS-API wrapping */
 	if (NT_STATUS_IS_OK(ret)) {
-		ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep, TOK_ID_KRB_AP_REP);
+		ap_rep_wrapped = spnego_gen_krb5_wrap(ap_rep,
+				TOK_ID_KRB_AP_REP);
 	} else {
 		ap_rep_wrapped = data_blob_null;
 	}
-	response = spnego_gen_auth_response(&ap_rep_wrapped, ret, OID_KERBEROS5_OLD);
+	response = spnego_gen_auth_response(&ap_rep_wrapped, ret,
+			OID_KERBEROS5_OLD);
 	reply_sesssetup_blob(conn, req, response, ret);
 
 	data_blob_free(&ap_rep);
@@ -612,10 +636,10 @@ static void reply_spnego_ntlmssp(connection_struct *conn,
 	if (NT_STATUS_IS_OK(nt_status)) {
 		server_info = (*auth_ntlmssp_state)->server_info;
 	} else {
-		nt_status = do_map_to_guest(nt_status, 
-					    &server_info, 
-					    (*auth_ntlmssp_state)->ntlmssp_state->user, 
-					    (*auth_ntlmssp_state)->ntlmssp_state->domain);
+		nt_status = do_map_to_guest(nt_status,
+			    &server_info,
+			    (*auth_ntlmssp_state)->ntlmssp_state->user,
+			    (*auth_ntlmssp_state)->ntlmssp_state->domain);
 	}
 
 	reply_outbuf(req, 4, 0);
@@ -624,7 +648,10 @@ static void reply_spnego_ntlmssp(connection_struct *conn,
 
 	if (NT_STATUS_IS_OK(nt_status)) {
 		DATA_BLOB nullblob = data_blob_null;
-		DATA_BLOB session_key = data_blob((*auth_ntlmssp_state)->ntlmssp_state->session_key.data, (*auth_ntlmssp_state)->ntlmssp_state->session_key.length);
+		DATA_BLOB session_key =
+			data_blob(
+			(*auth_ntlmssp_state)->ntlmssp_state->session_key.data,
+			(*auth_ntlmssp_state)->ntlmssp_state->session_key.length);
 
 		if (!is_partial_auth_vuid(vuid)) {
 			data_blob_free(&session_key);
@@ -661,7 +688,8 @@ static void reply_spnego_ntlmssp(connection_struct *conn,
   out:
 
 	if (wrap) {
-		response = spnego_gen_auth_response(ntlmssp_blob, nt_status, OID_NTLMSSP);
+		response = spnego_gen_auth_response(ntlmssp_blob,
+				nt_status, OID_NTLMSSP);
 	} else {
 		response = *ntlmssp_blob;
 	}
@@ -688,7 +716,8 @@ static void reply_spnego_ntlmssp(connection_struct *conn,
  Is this a krb5 mechanism ?
 ****************************************************************************/
 
-NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in, DATA_BLOB *pblob_out, BOOL *p_is_krb5)
+NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in, DATA_BLOB *pblob_out,
+		BOOL *p_is_krb5)
 {
 	char *OIDs[ASN1_MAX_OIDS];
 	int i;
@@ -701,22 +730,22 @@ NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in, DATA_BLOB *pblob_out, BOOL *
 	}
 
 	/* only look at the first OID for determining the mechToken --
-	   accoirding to RFC2478, we should choose the one we want 
-	   and renegotiate, but i smell a client bug here..  
-	   
-	   Problem observed when connecting to a member (samba box) 
-	   of an AD domain as a user in a Samba domain.  Samba member 
-	   server sent back krb5/mskrb5/ntlmssp as mechtypes, but the 
-	   client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an 
+	   according to RFC2478, we should choose the one we want
+	   and renegotiate, but i smell a client bug here..
+
+	   Problem observed when connecting to a member (samba box)
+	   of an AD domain as a user in a Samba domain.  Samba member
+	   server sent back krb5/mskrb5/ntlmssp as mechtypes, but the
+	   client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an
 	   NTLMSSP mechtoken.                 --jerry              */
 
-#ifdef HAVE_KRB5	
+#ifdef HAVE_KRB5
 	if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 ||
 	    strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
 		*p_is_krb5 = True;
 	}
 #endif
-		
+
 	for (i=0;OIDs[i];i++) {
 		DEBUG(5,("parse_spnego_mechanisms: Got OID %s\n", OIDs[i]));
 		free(OIDs[i]);
@@ -739,7 +768,8 @@ static void reply_spnego_negotiate(connection_struct *conn,
 	BOOL got_kerberos_mechanism = False;
 	NTSTATUS status;
 
-	status = parse_spnego_mechanisms(blob1, &secblob, &got_kerberos_mechanism);
+	status = parse_spnego_mechanisms(blob1, &secblob,
+			&got_kerberos_mechanism);
 	if (!NT_STATUS_IS_OK(status)) {
 		/* Kill the intermediate vuid */
 		invalidate_vuid(vuid);
@@ -747,10 +777,12 @@ static void reply_spnego_negotiate(connection_struct *conn,
 		return;
 	}
 
-	DEBUG(3,("reply_spnego_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
+	DEBUG(3,("reply_spnego_negotiate: Got secblob of size %lu\n",
+				(unsigned long)secblob.length));
 
 #ifdef HAVE_KRB5
-	if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
+	if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) ||
+				lp_use_kerberos_keytab()) ) {
 		BOOL destroy_vuid = True;
 		reply_spnego_kerberos(conn, req, &secblob, vuid,
 				      &destroy_vuid);
@@ -775,7 +807,7 @@ static void reply_spnego_negotiate(connection_struct *conn,
 		return;
 	}
 
-	status = auth_ntlmssp_update(*auth_ntlmssp_state, 
+	status = auth_ntlmssp_update(*auth_ntlmssp_state,
 					secblob, &chal);
 
 	data_blob_free(&secblob);
@@ -820,11 +852,14 @@ static void reply_spnego_auth(connection_struct *conn,
 		/* Might be a second negTokenTarg packet */
 
 		BOOL got_krb5_mechanism = False;
-		status = parse_spnego_mechanisms(auth, &secblob, &got_krb5_mechanism);
+		status = parse_spnego_mechanisms(auth, &secblob,
+				&got_krb5_mechanism);
 		if (NT_STATUS_IS_OK(status)) {
-			DEBUG(3,("reply_spnego_auth: Got secblob of size %lu\n", (unsigned long)secblob.length));
+			DEBUG(3,("reply_spnego_auth: Got secblob of size %lu\n",
+					(unsigned long)secblob.length));
 #ifdef HAVE_KRB5
-			if ( got_krb5_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
+			if ( got_krb5_mechanism && ((lp_security()==SEC_ADS) ||
+						lp_use_kerberos_keytab()) ) {
 				BOOL destroy_vuid = True;
 				reply_spnego_kerberos(conn, req, &secblob,
 						      vuid, &destroy_vuid);
@@ -842,7 +877,7 @@ static void reply_spnego_auth(connection_struct *conn,
 
 	/* If we get here it wasn't a negTokenTarg auth packet. */
 	data_blob_free(&secblob);
-	
+
 	if (!*auth_ntlmssp_state) {
 		/* Kill the intermediate vuid */
 		invalidate_vuid(vuid);
@@ -852,8 +887,8 @@ static void reply_spnego_auth(connection_struct *conn,
 				      NT_STATUS_INVALID_PARAMETER));
 		return;
 	}
-	
-	status = auth_ntlmssp_update(*auth_ntlmssp_state, 
+
+	status = auth_ntlmssp_update(*auth_ntlmssp_state,
 					auth, &auth_reply);
 
 	data_blob_free(&auth);
@@ -861,7 +896,7 @@ static void reply_spnego_auth(connection_struct *conn,
 	reply_spnego_ntlmssp(conn, req, vuid,
 			     auth_ntlmssp_state,
 			     &auth_reply, status, True);
-		
+
 	data_blob_free(&auth_reply);
 
 	/* and tell smbd that we have already replied to this packet */
@@ -905,11 +940,13 @@ static struct pending_auth_data *get_pending_auth_data(uint16 smbpid)
 }
 
 /****************************************************************************
- Check the size of an SPNEGO blob. If we need more return NT_STATUS_MORE_PROCESSING_REQUIRED,
- else return NT_STATUS_OK. Don't allow the blob to be more than 64k.
+ Check the size of an SPNEGO blob. If we need more return
+ NT_STATUS_MORE_PROCESSING_REQUIRED, else return NT_STATUS_OK. Don't allow
+ the blob to be more than 64k.
 ****************************************************************************/
 
-static NTSTATUS check_spnego_blob_complete(uint16 smbpid, uint16 vuid, DATA_BLOB *pblob)
+static NTSTATUS check_spnego_blob_complete(uint16 smbpid, uint16 vuid,
+		DATA_BLOB *pblob)
 {
 	struct pending_auth_data *pad = NULL;
 	ASN1_DATA data;
@@ -932,7 +969,8 @@ static NTSTATUS check_spnego_blob_complete(uint16 smbpid, uint16 vuid, DATA_BLOB
 
 		/* Integer wrap paranoia.... */
 
-		if (pad->partial_data.length + copy_len < pad->partial_data.length ||
+		if (pad->partial_data.length + copy_len <
+				pad->partial_data.length ||
 		    pad->partial_data.length + copy_len < copy_len) {
 
 			DEBUG(2,("check_spnego_blob_complete: integer wrap "
@@ -1039,7 +1077,8 @@ static NTSTATUS check_spnego_blob_complete(uint16 smbpid, uint16 vuid, DATA_BLOB
 
 	/* Refuse the blob if it's bigger than 64k. */
 	if (needed_len > 65536) {
-		DEBUG(2,("check_spnego_blob_complete: needed_len too large (%u)\n",
+		DEBUG(2,("check_spnego_blob_complete: needed_len "
+			"too large (%u)\n",
 			(unsigned int)needed_len ));
 		return NT_STATUS_INVALID_PARAMETER;
 	}
@@ -1092,7 +1131,7 @@ static void reply_sesssetup_and_X_spnego(connection_struct *conn,
 		}
 
 	}
-		
+
 	p = (uint8 *)smb_buf(req->inbuf);
 
 	if (data_blob_len == 0) {
@@ -1116,7 +1155,7 @@ static void reply_sesssetup_and_X_spnego(connection_struct *conn,
 			      sizeof(native_lanman), STR_TERMINATE);
 	p2 += srvstr_pull_buf(req->inbuf, smb_flag2, primary_domain, p2,
 			      sizeof(primary_domain), STR_TERMINATE);
-	DEBUG(3,("NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n", 
+	DEBUG(3,("NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n",
 		native_os, native_lanman, primary_domain));
 
 	if ( ra_type == RA_WIN2K ) {
@@ -1124,24 +1163,25 @@ static void reply_sesssetup_and_X_spnego(connection_struct *conn,
 
 		if ( !strlen(native_os) && !strlen(native_lanman) )
 			set_remote_arch(RA_VISTA);
-		
-		/* Windows 2003 doesn't set the native lanman string, 
+
+		/* Windows 2003 doesn't set the native lanman string,
 		   but does set primary domain which is a bug I think */
-			   
+
 		if ( !strlen(native_lanman) ) {
 			ra_lanman_string( primary_domain );
 		} else {
 			ra_lanman_string( native_lanman );
 		}
 	}
-		
+
 	/* Did we get a valid vuid ? */
 	if (!is_partial_auth_vuid(vuid)) {
 		/* No, then try and see if this is an intermediate sessionsetup
 		 * for a large SPNEGO packet. */
 		struct pending_auth_data *pad = get_pending_auth_data(smbpid);
 		if (pad) {
-			DEBUG(10,("reply_sesssetup_and_X_spnego: found pending vuid %u\n",
+			DEBUG(10,("reply_sesssetup_and_X_spnego: found "
+				"pending vuid %u\n",
 				(unsigned int)pad->vuid ));
 			vuid = pad->vuid;
 		}
@@ -1172,7 +1212,8 @@ static void reply_sesssetup_and_X_spnego(connection_struct *conn,
 
 	status = check_spnego_blob_complete(smbpid, vuid, &blob1);
 	if (!NT_STATUS_IS_OK(status)) {
-		if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+		if (!NT_STATUS_EQUAL(status,
+				NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 			/* Real error - kill the intermediate vuid */
 			invalidate_vuid(vuid);
 		}
@@ -1217,9 +1258,9 @@ static void reply_sesssetup_and_X_spnego(connection_struct *conn,
 
 		status = auth_ntlmssp_update(vuser->auth_ntlmssp_state,
 						blob1, &chal);
-		
+
 		data_blob_free(&blob1);
-		
+
 		reply_spnego_ntlmssp(conn, req, vuid,
 				     &vuser->auth_ntlmssp_state,
 				     &chal, status, False);
@@ -1267,7 +1308,8 @@ static int shutdown_other_smbds(struct db_record *rec,
 
 static void setup_new_vc_session(void)
 {
-	DEBUG(2,("setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.\n"));
+	DEBUG(2,("setup_new_vc_session: New VC == 0, if NT4.x "
+		"compatible we would close all old resources.\n"));
 #if 0
 	conn_close_all();
 	invalidate_all_vuids();
@@ -1284,7 +1326,7 @@ static void setup_new_vc_session(void)
 void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 {
 	int sess_vuid;
-	int   smb_bufsize;    
+	int smb_bufsize;
 	DATA_BLOB lm_resp;
 	DATA_BLOB nt_resp;
 	DATA_BLOB plaintext_password;
@@ -1305,8 +1347,6 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 
 	DATA_BLOB session_key;
 
-	
-
 	START_PROFILE(SMBsesssetupX);
 
 	ZERO_STRUCT(lm_resp);
@@ -1326,6 +1366,7 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 				 "negotiated.\n"));
 			reply_nterror(req, nt_status_squash(
 					      NT_STATUS_LOGON_FAILURE));
+			END_PROFILE(SMBsesssetupX);
 			return;
 		}
 
@@ -1334,7 +1375,7 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 		}
 
 		reply_sesssetup_and_X_spnego(conn, req);
-
+		END_PROFILE(SMBsesssetupX);
 		return;
 	}
 
@@ -1343,7 +1384,8 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 	if (Protocol < PROTOCOL_NT1) {
 		uint16 passlen1 = SVAL(req->inbuf,smb_vwv7);
 
-		/* Never do NT status codes with protocols before NT1 as we don't get client caps. */
+		/* Never do NT status codes with protocols before NT1 as we
+		 * don't get client caps. */
 		remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
 
 		if ((passlen1 > MAX_PASS_LEN)
@@ -1351,6 +1393,7 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 					      smb_buf(req->inbuf)))) {
 			reply_nterror(req, nt_status_squash(
 					      NT_STATUS_INVALID_PARAMETER));
+			END_PROFILE(SMBsesssetupX);
 			return;
 		}
 
@@ -1375,49 +1418,55 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 		char *p = smb_buf(req->inbuf);
 		char *save_p = smb_buf(req->inbuf);
 		uint16 byte_count;
-			
+
 
 		if(global_client_caps == 0) {
 			global_client_caps = IVAL(req->inbuf,smb_vwv11);
-		
+
 			if (!(global_client_caps & CAP_STATUS32)) {
-				remove_from_common_flags2(FLAGS2_32_BIT_ERROR_CODES);
+				remove_from_common_flags2(
+						FLAGS2_32_BIT_ERROR_CODES);
 			}
 
-			/* client_caps is used as final determination if client is NT or Win95. 
-			   This is needed to return the correct error codes in some
-			   circumstances.
+			/* client_caps is used as final determination if
+			 * client is NT or Win95. This is needed to return
+			 * the correct error codes in some circumstances.
 			*/
-		
-			if(ra_type == RA_WINNT || ra_type == RA_WIN2K || ra_type == RA_WIN95) {
-				if(!(global_client_caps & (CAP_NT_SMBS | CAP_STATUS32))) {
+
+			if(ra_type == RA_WINNT || ra_type == RA_WIN2K ||
+					ra_type == RA_WIN95) {
+				if(!(global_client_caps & (CAP_NT_SMBS|
+							CAP_STATUS32))) {
 					set_remote_arch( RA_WIN95);
 				}
 			}
 		}
 
 		if (!doencrypt) {
-			/* both Win95 and WinNT stuff up the password lengths for
-			   non-encrypting systems. Uggh. 
-			   
-			   if passlen1==24 its a win95 system, and its setting the
-			   password length incorrectly. Luckily it still works with the
-			   default code because Win95 will null terminate the password
-			   anyway 
-			   
-			   if passlen1>0 and passlen2>0 then maybe its a NT box and its
-			   setting passlen2 to some random value which really stuffs
-			   things up. we need to fix that one.  */
-			
-			if (passlen1 > 0 && passlen2 > 0 && passlen2 != 24 && passlen2 != 1)
+			/* both Win95 and WinNT stuff up the password
+			 * lengths for non-encrypting systems. Uggh.
+
+			   if passlen1==24 its a win95 system, and its setting
+			   the password length incorrectly. Luckily it still
+			   works with the default code because Win95 will null
+			   terminate the password anyway
+
+			   if passlen1>0 and passlen2>0 then maybe its a NT box
+			   and its setting passlen2 to some random value which
+			   really stuffs things up. we need to fix that one.  */
+
+			if (passlen1 > 0 && passlen2 > 0 && passlen2 != 24 &&
+					passlen2 != 1) {
 				passlen2 = 0;
+			}
 		}
-		
+
 		/* check for nasty tricks */
 		if (passlen1 > MAX_PASS_LEN
 		    || passlen1 > smb_bufrem(req->inbuf, p)) {
 			reply_nterror(req, nt_status_squash(
 					      NT_STATUS_INVALID_PARAMETER));
+			END_PROFILE(SMBsesssetupX);
 			return;
 		}
 
@@ -1425,11 +1474,12 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 		    || passlen2 > smb_bufrem(req->inbuf, p+passlen1)) {
 			reply_nterror(req, nt_status_squash(
 					      NT_STATUS_INVALID_PARAMETER));
+			END_PROFILE(SMBsesssetupX);
 			return;
 		}
 
 		/* Save the lanman2 password and the NT md4 password. */
-		
+
 		if ((doencrypt) && (passlen1 != 0) && (passlen1 != 24)) {
 			doencrypt = False;
 		}
@@ -1442,9 +1492,12 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 			BOOL unic= smb_flag2 & FLAGS2_UNICODE_STRINGS;
 
 #if 0
-			/* This was the previous fix. Not sure if it's still valid. JRA. */
-			if ((ra_type == RA_WINNT) && (passlen2 == 0) && unic && passlen1) {
-				/* NT4.0 stuffs up plaintext unicode password lengths... */
+			/* This was the previous fix. Not sure if it's still
+			 * valid. JRA. */
+			if ((ra_type == RA_WINNT) && (passlen2 == 0)
+					&& unic && passlen1) {
+				/* NT4.0 stuffs up plaintext unicode password
+				 * lengths... */
 				srvstr_pull(inbuf, pass, smb_buf(inbuf) + 1,
 					sizeof(pass), passlen1, STR_TERMINATE);
 #endif
@@ -1462,7 +1515,7 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 			}
 			plaintext_password = data_blob(pass, strlen(pass)+1);
 		}
-		
+
 		p += passlen1 + passlen2;
 		p += srvstr_pull_buf(req->inbuf, req->flags2, user, p,
 				     sizeof(user), STR_TERMINATE);
@@ -1474,23 +1527,26 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 				     native_lanman, p, sizeof(native_lanman),
 				     STR_TERMINATE);
 
-		/* not documented or decoded by Ethereal but there is one more string 
-		   in the extra bytes which is the same as the PrimaryDomain when using 
-		   extended security.  Windows NT 4 and 2003 use this string to store 
-		   the native lanman string. Windows 9x does not include a string here 
-		   at all so we have to check if we have any extra bytes left */
-		
+		/* not documented or decoded by Ethereal but there is one more
+		 * string in the extra bytes which is the same as the
+		 * PrimaryDomain when using extended security.  Windows NT 4
+		 * and 2003 use this string to store the native lanman string.
+		 * Windows 9x does not include a string here at all so we have
+		 * to check if we have any extra bytes left */
+
 		byte_count = SVAL(req->inbuf, smb_vwv13);
-		if ( PTR_DIFF(p, save_p) < byte_count)
+		if ( PTR_DIFF(p, save_p) < byte_count) {
 			p += srvstr_pull_buf(req->inbuf, req->flags2,
 					     primary_domain, p,
 					     sizeof(primary_domain),
 					     STR_TERMINATE);
-		else 
+		} else {
 			fstrcpy( primary_domain, "null" );
+		}
 
-		DEBUG(3,("Domain=[%s]  NativeOS=[%s] NativeLanMan=[%s] PrimaryDomain=[%s]\n",
-			 domain, native_os, native_lanman, primary_domain));
+		DEBUG(3,("Domain=[%s]  NativeOS=[%s] NativeLanMan=[%s] "
+			"PrimaryDomain=[%s]\n",
+			domain, native_os, native_lanman, primary_domain));
 
 		if ( ra_type == RA_WIN2K ) {
 			if ( strlen(native_lanman) == 0 )
@@ -1505,16 +1561,21 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 		setup_new_vc_session();
 	}
 
-	DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n", domain, user, get_remote_machine_name()));
+	DEBUG(3,("sesssetupX:name=[%s]\\[%s]@[%s]\n",
+				domain, user, get_remote_machine_name()));
 
 	if (*user) {
 		if (global_spnego_negotiated) {
-			
-			/* This has to be here, because this is a perfectly valid behaviour for guest logons :-( */
-			
-			DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt at 'normal' session setup after negotiating spnego.\n"));
+
+			/* This has to be here, because this is a perfectly
+			 * valid behaviour for guest logons :-( */
+
+			DEBUG(0,("reply_sesssetup_and_X:  Rejecting attempt "
+				"at 'normal' session setup after "
+				"negotiating spnego.\n"));
 			reply_nterror(req, nt_status_squash(
 					      NT_STATUS_LOGON_FAILURE));
+			END_PROFILE(SMBsesssetupX);
 			return;
 		}
 		fstrcpy(sub_user, user);
@@ -1525,7 +1586,7 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 	sub_set_smb_name(sub_user);
 
 	reload_services(True);
-	
+
 	if (lp_security() == SEC_SHARE) {
 		/* in share level we should ignore any passwords */
 
@@ -1539,67 +1600,79 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 		/* Then force it to null for the benfit of the code below */
 		*user = 0;
 	}
-	
+
 	if (!*user) {
 
 		nt_status = check_guest_password(&server_info);
 
 	} else if (doencrypt) {
 		if (!negprot_global_auth_context) {
-			DEBUG(0, ("reply_sesssetup_and_X:  Attempted encrypted session setup without negprot denied!\n"));
+			DEBUG(0, ("reply_sesssetup_and_X:  Attempted encrypted "
+				"session setup without negprot denied!\n"));
 			reply_nterror(req, nt_status_squash(
 					      NT_STATUS_LOGON_FAILURE));
+			END_PROFILE(SMBsesssetupX);
 			return;
 		}
-		nt_status = make_user_info_for_reply_enc(&user_info, user, domain,
-		                                         lm_resp, nt_resp);
+		nt_status = make_user_info_for_reply_enc(&user_info, user,
+						domain,
+						lm_resp, nt_resp);
 		if (NT_STATUS_IS_OK(nt_status)) {
-			nt_status = negprot_global_auth_context->check_ntlm_password(negprot_global_auth_context, 
-										     user_info, 
-										     &server_info);
+			nt_status = negprot_global_auth_context->check_ntlm_password(
+					negprot_global_auth_context,
+					user_info,
+					&server_info);
 		}
 	} else {
 		struct auth_context *plaintext_auth_context = NULL;
 		const uint8 *chal;
 
-		nt_status = make_auth_context_subsystem(&plaintext_auth_context);
+		nt_status = make_auth_context_subsystem(
+				&plaintext_auth_context);
 
 		if (NT_STATUS_IS_OK(nt_status)) {
-			chal = plaintext_auth_context->get_ntlm_challenge(plaintext_auth_context);
-			
-			if (!make_user_info_for_reply(&user_info, 
+			chal = plaintext_auth_context->get_ntlm_challenge(
+					plaintext_auth_context);
+
+			if (!make_user_info_for_reply(&user_info,
 						      user, domain, chal,
 						      plaintext_password)) {
 				nt_status = NT_STATUS_NO_MEMORY;
 			}
-		
+
 			if (NT_STATUS_IS_OK(nt_status)) {
-				nt_status = plaintext_auth_context->check_ntlm_password(plaintext_auth_context, 
-											user_info, 
-											&server_info); 
-				
-				(plaintext_auth_context->free)(&plaintext_auth_context);
+				nt_status = plaintext_auth_context->check_ntlm_password(
+						plaintext_auth_context,
+						user_info,
+						&server_info);
+
+				(plaintext_auth_context->free)(
+						&plaintext_auth_context);
 			}
 		}
 	}
 
 	free_user_info(&user_info);
-	
+
 	if (!NT_STATUS_IS_OK(nt_status)) {
-		nt_status = do_map_to_guest(nt_status, &server_info, user, domain);
+		nt_status = do_map_to_guest(nt_status, &server_info,
+				user, domain);
 	}
-	
+
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		data_blob_free(&nt_resp);
 		data_blob_free(&lm_resp);
 		data_blob_clear_free(&plaintext_password);
 		reply_nterror(req, nt_status_squash(nt_status));
+		END_PROFILE(SMBsesssetupX);
 		return;
 	}
 
-	/* Ensure we can't possible take a code path leading to a null defref. */
+	/* Ensure we can't possible take a code path leading to a
+	 * null defref. */
 	if (!server_info) {
 		reply_nterror(req, nt_status_squash(NT_STATUS_LOGON_FAILURE));
+		END_PROFILE(SMBsesssetupX);
 		return;
 	}
 
@@ -1611,24 +1684,26 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 		data_blob_free(&lm_resp);
 		data_blob_clear_free(&plaintext_password);
 		reply_nterror(req, nt_status_squash(nt_status));
+		END_PROFILE(SMBsesssetupX);
 		return;
 	}
 
 	if (server_info->user_session_key.data) {
-		session_key = data_blob(server_info->user_session_key.data, server_info->user_session_key.length);
+		session_key = data_blob(server_info->user_session_key.data,
+				server_info->user_session_key.length);
 	} else {
 		session_key = data_blob_null;
 	}
 
 	data_blob_clear_free(&plaintext_password);
-	
+
 	/* it's ok - setup a reply */
 	reply_outbuf(req, 3, 0);
 	if (Protocol >= PROTOCOL_NT1) {
 		push_signature(&req->outbuf);
 		/* perhaps grab OS version here?? */
 	}
-	
+
 	if (server_info->guest) {
 		SSVAL(req->outbuf,smb_vwv2,1);
 	}
@@ -1647,6 +1722,7 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 			data_blob_free(&nt_resp);
 			data_blob_free(&lm_resp);
 			data_blob_free(&session_key);
+			END_PROFILE(SMBsesssetupX);
 			reply_nterror(req, nt_status_squash(
 					      NT_STATUS_LOGON_FAILURE));
 		}
@@ -1662,6 +1738,7 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 			data_blob_free(&session_key);
 			reply_nterror(req, nt_status_squash(
 					      NT_STATUS_LOGON_FAILURE));
+			END_PROFILE(SMBsesssetupX);
 			return;
 		}
 
@@ -1673,15 +1750,15 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 
 	data_blob_free(&nt_resp);
 	data_blob_free(&lm_resp);
-	
+
 	SSVAL(req->outbuf,smb_uid,sess_vuid);
 	SSVAL(req->inbuf,smb_uid,sess_vuid);
-	
+
 	if (!done_sesssetup)
 		max_send = MIN(max_send,smb_bufsize);
-	
+
 	done_sesssetup = True;
-	
+
 	END_PROFILE(SMBsesssetupX);
 	chain_reply_new(req);
 	return;