From 3df3bf577d5510f30aceca13b6be29267c1c6380 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Fri, 6 Jun 2008 10:53:00 -0700
Subject: ensure we don't end up with a partially initialised EA structure
 (This used to be commit 388f4fde3655146bf57b4c51c59c39f475aa7fe8)

---
 source4/libcli/raw/raweas.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/source4/libcli/raw/raweas.c b/source4/libcli/raw/raweas.c
index 07b517ade3..6317c49fd7 100644
--- a/source4/libcli/raw/raweas.c
+++ b/source4/libcli/raw/raweas.c
@@ -131,6 +131,8 @@ uint_t ea_pull_struct(const DATA_BLOB *blob,
 	uint8_t nlen;
 	uint16_t vlen;
 
+	ZERO_STRUCTP(ea);
+
 	if (blob->length < 6) {
 		return 0;
 	}
-- 
cgit 


From 8e45338c8d5155376d511dcfda2f6d663de19159 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Fri, 6 Jun 2008 10:54:17 -0700
Subject: handle NULL fields in blob comparison (This used to be commit
 0643b5a2bfc401d8318964241ad522eb427a170e)

---
 source4/torture/gentest.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/source4/torture/gentest.c b/source4/torture/gentest.c
index 60243a5d1b..15cf321965 100644
--- a/source4/torture/gentest.c
+++ b/source4/torture/gentest.c
@@ -1459,7 +1459,9 @@ again:
 } while(0)
 
 #define CHECK_BLOB_EQUAL(field) do { \
-	if (memcmp(parm[0].field.data, parm[1].field.data, parm[0].field.length) != 0 && !ignore_pattern(#field)) { \
+	if (((parm[0].field.data == NULL && parm[1].field.data != NULL) || \
+	    (parm[1].field.data == NULL && parm[0].field.data != NULL) || \
+	    (memcmp(parm[0].field.data, parm[1].field.data, parm[0].field.length) != 0)) && !ignore_pattern(#field)) { \
 		current_op.mismatch = #field; \
 		printf("Mismatch in %s\n", #field); \
 		return false; \
-- 
cgit 


From e97cf207fac5e4101376d2a10dd95a93a9a1e0fb Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Fri, 6 Jun 2008 22:10:30 -0700
Subject: added server side SMB2 signing (This used to be commit
 8e919dcb0826a5b25d037ee6144af5f7cb21f3ae)

---
 source4/libcli/smb2/session.c       |  8 ++--
 source4/libcli/smb2/signing.c       | 74 +++++++++----------------------------
 source4/libcli/smb2/transport.c     | 32 ++++++++++------
 source4/smb_server/smb2/negprot.c   | 13 ++++++-
 source4/smb_server/smb2/receive.c   | 36 ++++++++++++++++++
 source4/smb_server/smb2/sesssetup.c |  9 +++++
 source4/smb_server/smb_server.h     |  2 +
 7 files changed, 103 insertions(+), 71 deletions(-)

diff --git a/source4/libcli/smb2/session.c b/source4/libcli/smb2/session.c
index 54915d8535..42fd4840a1 100644
--- a/source4/libcli/smb2/session.c
+++ b/source4/libcli/smb2/session.c
@@ -188,11 +188,13 @@ static void session_request_handler(struct smb2_request *req)
 	}
 
 	if (session->transport->signing.doing_signing) {
-		c->status = smb2_start_signing(session->transport);
-		if (!NT_STATUS_IS_OK(c->status)) {
-			composite_error(c, c->status);
+		if (session->transport->signing.session_key.length != 16) {
+			DEBUG(2,("Wrong session key length %u for SMB2 signing\n",
+				 (unsigned)session->transport->signing.session_key.length));
+			composite_error(c, NT_STATUS_ACCESS_DENIED);
 			return;
 		}
+		session->transport->signing.signing_started = true;
 	}
 
 	composite_done(c);
diff --git a/source4/libcli/smb2/signing.c b/source4/libcli/smb2/signing.c
index 16c0ff99c1..fb2c22db4e 100644
--- a/source4/libcli/smb2/signing.c
+++ b/source4/libcli/smb2/signing.c
@@ -25,42 +25,14 @@
 #include "libcli/smb2/smb2_calls.h"
 #include "lib/crypto/crypto.h"
 
-/*
-  NOTE: this code does not yet interoperate with the windows SMB2
-  implementation. We are waiting on feedback on the docs to find out
-  why
- */
-
-
-/*
-  setup signing on a transport
- */
-NTSTATUS smb2_start_signing(struct smb2_transport *transport)
-{
-	if (transport->signing.session_key.length != 16) {
-		DEBUG(2,("Wrong session key length %u for SMB2 signing\n",
-			 (unsigned)transport->signing.session_key.length));
-		return NT_STATUS_ACCESS_DENIED;
-	}
-
-	transport->signing.signing_started = true;
-	return NT_STATUS_OK;
-}
-
 /*
   sign an outgoing message
  */
-NTSTATUS smb2_sign_message(struct smb2_request *req)
+NTSTATUS smb2_sign_message(struct smb2_request_buffer *buf, DATA_BLOB session_key)
 {
-	struct smb2_request_buffer *buf = &req->out;
-	uint64_t session_id;
 	struct HMACSHA256Context m;
 	uint8_t res[32];
-
-	if (!req->transport->signing.doing_signing ||
-	    !req->transport->signing.signing_started) {
-		return NT_STATUS_OK;
-	}
+	uint64_t session_id;
 
 	if (buf->size < NBT_HDR_SIZE + SMB2_HDR_SIGNATURE + 16) {
 		/* can't sign non-SMB2 messages */
@@ -74,9 +46,9 @@ NTSTATUS smb2_sign_message(struct smb2_request *req)
 		return NT_STATUS_OK;		
 	}
 
-	if (req->transport->signing.session_key.length != 16) {
+	if (session_key.length != 16) {
 		DEBUG(2,("Wrong session key length %u for SMB2 signing\n",
-			 (unsigned)req->transport->signing.session_key.length));
+			 (unsigned)session_key.length));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -85,7 +57,7 @@ NTSTATUS smb2_sign_message(struct smb2_request *req)
 	SIVAL(buf->hdr, SMB2_HDR_FLAGS, IVAL(buf->hdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_SIGNED);
 
 	ZERO_STRUCT(m);
-	hmac_sha256_init(req->transport->signing.session_key.data, 16, &m);
+	hmac_sha256_init(session_key.data, 16, &m);
 	hmac_sha256_update(buf->buffer+NBT_HDR_SIZE, buf->size-NBT_HDR_SIZE, &m);
 	hmac_sha256_final(res, &m);
 
@@ -93,66 +65,56 @@ NTSTATUS smb2_sign_message(struct smb2_request *req)
 
 	memcpy(buf->hdr + SMB2_HDR_SIGNATURE, res, 16);
 
-	if (DEBUGLVL(5)) {
-		/* check our own signature */
-		smb2_check_signature(req->transport, buf->buffer, buf->size);
-	}
-
 	return NT_STATUS_OK;	
 }
 
 /*
   check an incoming signature
  */
-NTSTATUS smb2_check_signature(struct smb2_transport *transport,
-			      uint8_t *buffer, uint_t length)
+NTSTATUS smb2_check_signature(struct smb2_request_buffer *buf, DATA_BLOB session_key)
 {
 	uint64_t session_id;
 	struct HMACSHA256Context m;
 	uint8_t res[SHA256_DIGEST_LENGTH];
 	uint8_t sig[16];
 
-	if (!transport->signing.signing_started ||
-	    !transport->signing.doing_signing) {
-		return NT_STATUS_OK;
-	}
-
-	if (length < NBT_HDR_SIZE + SMB2_HDR_SIGNATURE + 16) {
+	if (buf->size < NBT_HDR_SIZE + SMB2_HDR_SIGNATURE + 16) {
 		/* can't check non-SMB2 messages */
 		return NT_STATUS_OK;
 	}
 
-	session_id = BVAL(buffer+NBT_HDR_SIZE, SMB2_HDR_SESSION_ID);
+	session_id = BVAL(buf->hdr, SMB2_HDR_SESSION_ID);
 	if (session_id == 0) {
 		/* don't sign messages with a zero session_id. See
 		   MS-SMB2 3.2.4.1.1 */
 		return NT_STATUS_OK;		
 	}
 
-	if (transport->signing.session_key.length == 0) {
+	if (session_key.length == 0) {
 		/* we don't have the session key yet */
 		return NT_STATUS_OK;
 	}
 
-	if (transport->signing.session_key.length != 16) {
+	if (session_key.length != 16) {
 		DEBUG(2,("Wrong session key length %u for SMB2 signing\n",
-			 (unsigned)transport->signing.session_key.length));
+			 (unsigned)session_key.length));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
-	memcpy(sig, buffer+NBT_HDR_SIZE+SMB2_HDR_SIGNATURE, 16);
+	memcpy(sig, buf->hdr+SMB2_HDR_SIGNATURE, 16);
 
-	memset(buffer + NBT_HDR_SIZE + SMB2_HDR_SIGNATURE, 0, 16);
+	memset(buf->hdr + SMB2_HDR_SIGNATURE, 0, 16);
 
 	ZERO_STRUCT(m);
-	hmac_sha256_init(transport->signing.session_key.data, 16, &m);
-	hmac_sha256_update(buffer+NBT_HDR_SIZE, length-NBT_HDR_SIZE, &m);
+	hmac_sha256_init(session_key.data, 16, &m);
+	hmac_sha256_update(buf->hdr, buf->size-NBT_HDR_SIZE, &m);
 	hmac_sha256_final(res, &m);
 
-	memcpy(buffer+NBT_HDR_SIZE+SMB2_HDR_SIGNATURE, sig, 16);
+	memcpy(buf->hdr+SMB2_HDR_SIGNATURE, sig, 16);
 
 	if (memcmp(res, sig, 16) != 0) {
-		DEBUG(0,("Bad SMB2 signature for message of size %u\n", length));
+		DEBUG(0,("Bad SMB2 signature for message of size %u\n", 
+			 (unsigned)buf->size-NBT_HDR_SIZE));
 		dump_data(0, sig, 16);
 		dump_data(0, res, 16);
 		return NT_STATUS_ACCESS_DENIED;
diff --git a/source4/libcli/smb2/transport.c b/source4/libcli/smb2/transport.c
index 561b6e528e..a9a9efb3aa 100644
--- a/source4/libcli/smb2/transport.c
+++ b/source4/libcli/smb2/transport.c
@@ -205,12 +205,6 @@ static NTSTATUS smb2_transport_finish_recv(void *private, DATA_BLOB blob)
 		goto error;
 	}
 
-	status = smb2_check_signature(transport, buffer, len);
-	if (!NT_STATUS_IS_OK(status)) {
-		talloc_free(buffer);
-		return status;
-	}
-	
 	flags	= IVAL(hdr, SMB2_HDR_FLAGS);
 	seqnum	= BVAL(hdr, SMB2_HDR_MESSAGE_ID);
 
@@ -241,6 +235,18 @@ static NTSTATUS smb2_transport_finish_recv(void *private, DATA_BLOB blob)
 	req->in.body_size = req->in.size - (SMB2_HDR_BODY+NBT_HDR_SIZE);
 	req->status       = NT_STATUS(IVAL(hdr, SMB2_HDR_STATUS));
 
+	if (transport->signing.signing_started &&
+	    transport->signing.doing_signing) {
+		status = smb2_check_signature(&req->in, 
+					      transport->signing.session_key);
+		if (!NT_STATUS_IS_OK(status)) {
+			/* the spec says to ignore packets with a bad signature */
+			talloc_free(buffer);
+			return status;
+		}
+	}
+	
+
 	if (NT_STATUS_EQUAL(req->status, STATUS_PENDING)) {
 		if (flags & 0x00000002) {
 			req->cancel.can_cancel = true;
@@ -346,11 +352,15 @@ void smb2_transport_send(struct smb2_request *req)
 		return;
 	}
 
-	status = smb2_sign_message(req);
-	if (!NT_STATUS_IS_OK(status)) {
-		req->state = SMB2_REQUEST_ERROR;
-		req->status = status;
-		return;
+	/* possibly sign the message */
+	if (req->transport->signing.doing_signing &&
+	    req->transport->signing.signing_started) {
+		status = smb2_sign_message(&req->out, req->transport->signing.session_key);
+		if (!NT_STATUS_IS_OK(status)) {
+			req->state = SMB2_REQUEST_ERROR;
+			req->status = status;
+			return;
+		}
 	}
 	
 	blob = data_blob_const(req->out.buffer, req->out.size);
diff --git a/source4/smb_server/smb2/negprot.c b/source4/smb_server/smb2/negprot.c
index 4479ae2da1..2da39001ab 100644
--- a/source4/smb_server/smb2/negprot.c
+++ b/source4/smb_server/smb2/negprot.c
@@ -111,7 +111,18 @@ static NTSTATUS smb2srv_negprot_backend(struct smb2srv_request *req, struct smb2
 	boot_time = timeval_current(); /* TODO: fix me */
 
 	ZERO_STRUCT(io->out);
-	io->out.security_mode      = 0; /* no signing yet */
+	switch (lp_server_signing(req->smb_conn->lp_ctx)) {
+	case SMB_SIGNING_OFF:
+		io->out.security_mode = 0;
+		break;
+	case SMB_SIGNING_SUPPORTED:
+	case SMB_SIGNING_AUTO:
+		io->out.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
+		break;
+	case SMB_SIGNING_REQUIRED:
+		io->out.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED | SMB2_NEGOTIATE_SIGNING_REQUIRED;
+		break;
+	}
 	io->out.dialect_revision   = SMB2_DIALECT_REVISION;
 	io->out.capabilities       = 0;
 	io->out.max_transact_size  = lp_parm_ulong(req->smb_conn->lp_ctx, NULL, 
diff --git a/source4/smb_server/smb2/receive.c b/source4/smb_server/smb2/receive.c
index dea7c9e79e..3def8fe563 100644
--- a/source4/smb_server/smb2/receive.c
+++ b/source4/smb_server/smb2/receive.c
@@ -29,6 +29,8 @@
 #include "lib/stream/packet.h"
 #include "ntvfs/ntvfs.h"
 #include "param/param.h"
+#include "auth/gensec/gensec.h"
+#include "auth/auth.h"
 
 
 /* fill in the bufinfo */
@@ -233,6 +235,20 @@ void smb2srv_send_reply(struct smb2srv_request *req)
 		_smb2_setlen(req->out.buffer, req->out.size - NBT_HDR_SIZE);
 	}
 
+	/* if the request was signed or doing_signing is true, then we
+	   must sign the reply */
+	if (req->session &&
+	    (req->smb_conn->doing_signing ||
+	     (IVAL(req->in.hdr, SMB2_HDR_FLAGS) & SMB2_HDR_FLAG_SIGNED))) {
+		status = smb2_sign_message(&req->out, 
+					   req->session->session_info->session_key);
+		if (!NT_STATUS_IS_OK(status)) {
+			smbsrv_terminate_connection(req->smb_conn, nt_errstr(status));
+			return;
+		}		
+	}
+
+
 	blob = data_blob_const(req->out.buffer, req->out.size);
 	status = packet_send(req->smb_conn->packet, blob);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -275,18 +291,38 @@ static NTSTATUS smb2srv_reply(struct smb2srv_request *req)
 	uint16_t opcode;
 	uint32_t tid;
 	uint64_t uid;
+	uint32_t flags;
 
 	opcode			= SVAL(req->in.hdr, SMB2_HDR_OPCODE);
 	req->chain_offset	= IVAL(req->in.hdr, SMB2_HDR_NEXT_COMMAND);
 	req->seqnum		= BVAL(req->in.hdr, SMB2_HDR_MESSAGE_ID);
 	tid			= IVAL(req->in.hdr, SMB2_HDR_TID);
 	uid			= BVAL(req->in.hdr, SMB2_HDR_SESSION_ID);
+	flags			= IVAL(req->in.hdr, SMB2_HDR_FLAGS);
 
 	req->session	= smbsrv_session_find(req->smb_conn, uid, req->request_time);
 	req->tcon	= smbsrv_smb2_tcon_find(req->session, tid, req->request_time);
 
 	errno = 0;
 
+	/* supporting signing is mandatory in SMB2, and is per-packet. So we 
+	   should check the signature on any incoming packet that is signed, and 
+	   should give a signed reply to any signed request */
+	if (flags & SMB2_HDR_FLAG_SIGNED) {
+		NTSTATUS status;
+		if (req->session == NULL) {
+			/* we can't check signing with no session */
+			smb2srv_send_error(req, NT_STATUS_ACCESS_DENIED);
+			return NT_STATUS_OK;			
+		}
+		status = smb2_check_signature(&req->in, 
+					      req->session->session_info->session_key);
+		if (!NT_STATUS_IS_OK(status)) {
+			smb2srv_send_error(req, status);
+			return NT_STATUS_OK;			
+		}
+	}
+
 	/* TODO: check the seqnum */
 
 	switch (opcode) {
diff --git a/source4/smb_server/smb2/sesssetup.c b/source4/smb_server/smb2/sesssetup.c
index d386bfc72d..482dd181c2 100644
--- a/source4/smb_server/smb2/sesssetup.c
+++ b/source4/smb_server/smb2/sesssetup.c
@@ -177,6 +177,15 @@ static void smb2srv_sesssetup_backend(struct smb2srv_request *req, union smb_ses
 
 	gensec_update_send(smb_sess->gensec_ctx, io->smb2.in.secblob,
 			   smb2srv_sesssetup_callback, callback_ctx);
+
+	/* note that we ignore SMB2_NEGOTIATE_SIGNING_ENABLED from the client.
+	   This is deliberate as windows does not set it even when it does 
+	   set SMB2_NEGOTIATE_SIGNING_REQUIRED */
+	if ((io->smb2.in.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
+	    lp_server_signing(req->smb_conn->lp_ctx) == SMB_SIGNING_REQUIRED) {
+		req->smb_conn->doing_signing = true;
+	}
+
 	return;
 nomem:
 	status = NT_STATUS_NO_MEMORY;
diff --git a/source4/smb_server/smb_server.h b/source4/smb_server/smb_server.h
index 776fe1b71b..ac3e0f3bd3 100644
--- a/source4/smb_server/smb_server.h
+++ b/source4/smb_server/smb_server.h
@@ -376,6 +376,8 @@ struct smbsrv_connection {
 	struct share_context *share_context;
 
 	struct loadparm_context *lp_ctx;
+
+	bool doing_signing;
 };
 
 struct model_ops;
-- 
cgit 


From e4ad580b99c5b372353c285569204ab94c177748 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Sat, 7 Jun 2008 08:14:25 -0700
Subject: fixed mandatory signing

Metze pointed out that if signing is mandatory in the server then we
need to reject packets without the signed flag if the packet contains
a session id.
(This used to be commit 056f16e664e581bab1c07759e99ad4f6685c58eb)
---
 source4/smb_server/smb2/negprot.c   | 2 ++
 source4/smb_server/smb2/receive.c   | 4 ++++
 source4/smb_server/smb2/sesssetup.c | 3 +--
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/source4/smb_server/smb2/negprot.c b/source4/smb_server/smb2/negprot.c
index 2da39001ab..3e6e2e1a43 100644
--- a/source4/smb_server/smb2/negprot.c
+++ b/source4/smb_server/smb2/negprot.c
@@ -121,6 +121,8 @@ static NTSTATUS smb2srv_negprot_backend(struct smb2srv_request *req, struct smb2
 		break;
 	case SMB_SIGNING_REQUIRED:
 		io->out.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED | SMB2_NEGOTIATE_SIGNING_REQUIRED;
+		/* force signing on immediately */
+		req->smb_conn->doing_signing = true;
 		break;
 	}
 	io->out.dialect_revision   = SMB2_DIALECT_REVISION;
diff --git a/source4/smb_server/smb2/receive.c b/source4/smb_server/smb2/receive.c
index 3def8fe563..2f4e9df2b6 100644
--- a/source4/smb_server/smb2/receive.c
+++ b/source4/smb_server/smb2/receive.c
@@ -321,6 +321,10 @@ static NTSTATUS smb2srv_reply(struct smb2srv_request *req)
 			smb2srv_send_error(req, status);
 			return NT_STATUS_OK;			
 		}
+	} else if (req->smb_conn->doing_signing && req->session != NULL) {
+		/* we require signing and this request was not signed */
+		smb2srv_send_error(req, NT_STATUS_ACCESS_DENIED);
+		return NT_STATUS_OK;					
 	}
 
 	/* TODO: check the seqnum */
diff --git a/source4/smb_server/smb2/sesssetup.c b/source4/smb_server/smb2/sesssetup.c
index 482dd181c2..9fb3220005 100644
--- a/source4/smb_server/smb2/sesssetup.c
+++ b/source4/smb_server/smb2/sesssetup.c
@@ -181,8 +181,7 @@ static void smb2srv_sesssetup_backend(struct smb2srv_request *req, union smb_ses
 	/* note that we ignore SMB2_NEGOTIATE_SIGNING_ENABLED from the client.
 	   This is deliberate as windows does not set it even when it does 
 	   set SMB2_NEGOTIATE_SIGNING_REQUIRED */
-	if ((io->smb2.in.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
-	    lp_server_signing(req->smb_conn->lp_ctx) == SMB_SIGNING_REQUIRED) {
+	if (io->smb2.in.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) {
 		req->smb_conn->doing_signing = true;
 	}
 
-- 
cgit 


From 1c33953ae21384f04de11539afaf9ead5e413b96 Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Sat, 7 Jun 2008 08:30:51 -0700
Subject: make signing per session in the SMB2 client library

Thanks to Metze for spotting this
(This used to be commit e9fd9b821c04d1cb7b574f539dd8169611e662aa)
---
 source4/libcli/smb2/session.c   |  6 +++---
 source4/libcli/smb2/smb2.h      |  2 +-
 source4/libcli/smb2/tcon.c      |  1 +
 source4/libcli/smb2/transport.c | 12 ++++++------
 4 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/source4/libcli/smb2/session.c b/source4/libcli/smb2/session.c
index 42fd4840a1..91616319d5 100644
--- a/source4/libcli/smb2/session.c
+++ b/source4/libcli/smb2/session.c
@@ -164,7 +164,7 @@ static void session_request_handler(struct smb2_request *req)
 
 		session_key_err = gensec_session_key(session->gensec, &session_key);
 		if (NT_STATUS_IS_OK(session_key_err)) {
-			session->transport->signing.session_key = session_key;
+			session->session_key = session_key;
 		}		
 	}
 
@@ -188,9 +188,9 @@ static void session_request_handler(struct smb2_request *req)
 	}
 
 	if (session->transport->signing.doing_signing) {
-		if (session->transport->signing.session_key.length != 16) {
+		if (session->session_key.length != 16) {
 			DEBUG(2,("Wrong session key length %u for SMB2 signing\n",
-				 (unsigned)session->transport->signing.session_key.length));
+				 (unsigned)session->session_key.length));
 			composite_error(c, NT_STATUS_ACCESS_DENIED);
 			return;
 		}
diff --git a/source4/libcli/smb2/smb2.h b/source4/libcli/smb2/smb2.h
index 0903509528..2b468d3dc9 100644
--- a/source4/libcli/smb2/smb2.h
+++ b/source4/libcli/smb2/smb2.h
@@ -30,7 +30,6 @@ struct smb2_handle;
 struct smb2_signing_context {
 	bool doing_signing;
 	bool signing_started;
-	DATA_BLOB session_key;
 };
 
 /*
@@ -98,6 +97,7 @@ struct smb2_session {
 	struct smb2_transport *transport;
 	struct gensec_security *gensec;
 	uint64_t uid;
+	DATA_BLOB session_key;
 };
 
 
diff --git a/source4/libcli/smb2/tcon.c b/source4/libcli/smb2/tcon.c
index db35669d41..ec7152b264 100644
--- a/source4/libcli/smb2/tcon.c
+++ b/source4/libcli/smb2/tcon.c
@@ -57,6 +57,7 @@ struct smb2_request *smb2_tree_connect_send(struct smb2_tree *tree,
 	if (req == NULL) return NULL;
 
 	SBVAL(req->out.hdr,  SMB2_HDR_SESSION_ID, tree->session->uid);
+	req->session = tree->session;
 
 	SSVAL(req->out.body, 0x02, io->in.reserved);
 	status = smb2_push_o16s16_string(&req->out, 0x04, io->in.path);
diff --git a/source4/libcli/smb2/transport.c b/source4/libcli/smb2/transport.c
index a9a9efb3aa..6e0d523e21 100644
--- a/source4/libcli/smb2/transport.c
+++ b/source4/libcli/smb2/transport.c
@@ -235,10 +235,9 @@ static NTSTATUS smb2_transport_finish_recv(void *private, DATA_BLOB blob)
 	req->in.body_size = req->in.size - (SMB2_HDR_BODY+NBT_HDR_SIZE);
 	req->status       = NT_STATUS(IVAL(hdr, SMB2_HDR_STATUS));
 
-	if (transport->signing.signing_started &&
-	    transport->signing.doing_signing) {
+	if (req->session && transport->signing.doing_signing) {
 		status = smb2_check_signature(&req->in, 
-					      transport->signing.session_key);
+					      req->session->session_key);
 		if (!NT_STATUS_IS_OK(status)) {
 			/* the spec says to ignore packets with a bad signature */
 			talloc_free(buffer);
@@ -353,9 +352,10 @@ void smb2_transport_send(struct smb2_request *req)
 	}
 
 	/* possibly sign the message */
-	if (req->transport->signing.doing_signing &&
-	    req->transport->signing.signing_started) {
-		status = smb2_sign_message(&req->out, req->transport->signing.session_key);
+	if (req->transport->signing.doing_signing && 
+	    req->transport->signing.signing_started &&
+	    req->session) {
+		status = smb2_sign_message(&req->out, req->session->session_key);
 		if (!NT_STATUS_IS_OK(status)) {
 			req->state = SMB2_REQUEST_ERROR;
 			req->status = status;
-- 
cgit 


From 3df0fee42d39301d276f4148ab9861514cbe7b6d Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Sat, 7 Jun 2008 11:10:23 -0700
Subject: fixed for per session session_key here too (This used to be commit
 abcbce004c99a2c62aa8c7a7cfc8ac5b5cfeb7dd)

---
 source4/librpc/rpc/dcerpc_smb2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source4/librpc/rpc/dcerpc_smb2.c b/source4/librpc/rpc/dcerpc_smb2.c
index 211015a4cf..4767165fba 100644
--- a/source4/librpc/rpc/dcerpc_smb2.c
+++ b/source4/librpc/rpc/dcerpc_smb2.c
@@ -376,7 +376,7 @@ static NTSTATUS smb2_session_key(struct dcerpc_connection *c, DATA_BLOB *session
 {
 	struct smb2_private *smb = talloc_get_type(c->transport.private_data,
 						   struct smb2_private);
-	*session_key = smb->tree->session->transport->signing.session_key;
+	*session_key = smb->tree->session->session_key;
 	if (session_key->data == NULL) {
 		return NT_STATUS_NO_USER_SESSION_KEY;
 	}
-- 
cgit 


From cad533c68e8100131dca364b76abdedac31f4184 Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Sun, 8 Jun 2008 04:20:26 +0200
Subject: Add more docstrings in tdb. (This used to be commit
 3d798a1440603b7929955f2120f09ba1482885a1)

---
 source4/lib/tdb/tdb.i      |  4 ++++
 source4/lib/tdb/tdb.py     | 14 ++++++++++++++
 source4/lib/tdb/tdb_wrap.c | 10 ++++++++--
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/source4/lib/tdb/tdb.i b/source4/lib/tdb/tdb.i
index 5f23568170..3d8b697732 100644
--- a/source4/lib/tdb/tdb.i
+++ b/source4/lib/tdb/tdb.i
@@ -160,6 +160,8 @@ typedef struct tdb_context {
         tdb(const char *name, int hash_size, int tdb_flags, int flags, mode_t mode) {
             return tdb_open(name, hash_size, tdb_flags, flags, mode);
         }
+        %feature("docstring") error "S.error() -> int\n"
+                                    "Find last error number returned by operation on this TDB.";
         enum TDB_ERROR error();
         ~tdb() { tdb_close($self); }
         %feature("docstring") close "S.close() -> None\n"
@@ -179,6 +181,8 @@ typedef struct tdb_context {
         %feature("docstring") store "S.store(key, value, flag=TDB_REPLACE) -> None\n"
                                         "Store an entry.";
         int store(TDB_DATA key, TDB_DATA dbuf, int flag);
+        %feature("docstring") exists "S.exists(key) -> bool\n"
+                                        "Check whether key exists in this database.";
         int exists(TDB_DATA key);
         %feature("docstring") firstkey "S.firstkey() -> data\n"
                                         "Return the first key in this database.";
diff --git a/source4/lib/tdb/tdb.py b/source4/lib/tdb/tdb.py
index a8c1d06e0d..9f306bab8c 100644
--- a/source4/lib/tdb/tdb.py
+++ b/source4/lib/tdb/tdb.py
@@ -92,6 +92,13 @@ class Tdb(object):
         Open a TDB file.
         """
         _tdb.Tdb_swiginit(self,_tdb.new_Tdb(*args, **kwargs))
+    def error(*args, **kwargs):
+        """
+        S.error() -> int
+        Find last error number returned by operation on this TDB.
+        """
+        return _tdb.Tdb_error(*args, **kwargs)
+
     __swig_destroy__ = _tdb.delete_Tdb
     def close(*args, **kwargs):
         """
@@ -128,6 +135,13 @@ class Tdb(object):
         """
         return _tdb.Tdb_store(*args, **kwargs)
 
+    def exists(*args, **kwargs):
+        """
+        S.exists(key) -> bool
+        Check whether key exists in this database.
+        """
+        return _tdb.Tdb_exists(*args, **kwargs)
+
     def firstkey(*args, **kwargs):
         """
         S.firstkey() -> data
diff --git a/source4/lib/tdb/tdb_wrap.c b/source4/lib/tdb/tdb_wrap.c
index 27da552d33..32665d79fd 100644
--- a/source4/lib/tdb/tdb_wrap.c
+++ b/source4/lib/tdb/tdb_wrap.c
@@ -3628,7 +3628,10 @@ static PyMethodDef SwigMethods[] = {
 		"S.__init__(name,hash_size=0,tdb_flags=TDB_DEFAULT,flags=O_RDWR,mode=0600)\n"
 		"Open a TDB file.\n"
 		""},
-	 { (char *)"Tdb_error", (PyCFunction)_wrap_Tdb_error, METH_O, NULL},
+	 { (char *)"Tdb_error", (PyCFunction)_wrap_Tdb_error, METH_O, (char *)"\n"
+		"S.error() -> int\n"
+		"Find last error number returned by operation on this TDB.\n"
+		""},
 	 { (char *)"delete_Tdb", (PyCFunction)_wrap_delete_Tdb, METH_O, NULL},
 	 { (char *)"Tdb_close", (PyCFunction)_wrap_Tdb_close, METH_O, (char *)"\n"
 		"S.close() -> None\n"
@@ -3651,7 +3654,10 @@ static PyMethodDef SwigMethods[] = {
 		"S.store(key, value, flag=TDB_REPLACE) -> None\n"
 		"Store an entry.\n"
 		""},
-	 { (char *)"Tdb_exists", (PyCFunction) _wrap_Tdb_exists, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"Tdb_exists", (PyCFunction) _wrap_Tdb_exists, METH_VARARGS | METH_KEYWORDS, (char *)"\n"
+		"S.exists(key) -> bool\n"
+		"Check whether key exists in this database.\n"
+		""},
 	 { (char *)"Tdb_firstkey", (PyCFunction)_wrap_Tdb_firstkey, METH_O, (char *)"\n"
 		"S.firstkey() -> data\n"
 		"Return the first key in this database.\n"
-- 
cgit 


From 4a0582438f79347a6233e3e2a30dae692cae655f Mon Sep 17 00:00:00 2001
From: Simo Sorce <idra@samba.org>
Date: Sun, 8 Jun 2008 19:16:26 -0400
Subject: Make it possible to disable gnutls at configure time, until someone
 will finally decide to fix it. (This used to be commit
 0671dce355432a2a4c08ab010831eadd73e4561e)

---
 source4/lib/tls/config.m4 | 61 ++++++++++++++++++++++++++++-------------------
 1 file changed, 36 insertions(+), 25 deletions(-)

diff --git a/source4/lib/tls/config.m4 b/source4/lib/tls/config.m4
index 8b6ad7dcbc..2af9192cca 100644
--- a/source4/lib/tls/config.m4
+++ b/source4/lib/tls/config.m4
@@ -1,33 +1,44 @@
 ###############################
 # start SMB_EXT_LIB_GNUTLS
 # check for gnutls/gnutls.h and -lgnutls
-SMB_EXT_LIB_FROM_PKGCONFIG(GNUTLS, gnutls, 
-						   [SMB_ENABLE_GNUTLS=YES], 
-						   [SMB_ENABLE_GNUTLS=NO])
 
-if test x$SMB_ENABLE_GNUTLS = xNO; then
-	AC_CHECK_HEADERS(gnutls/gnutls.h)
-	AC_CHECK_LIB_EXT(gnutls, GNUTLS_LIBS, gnutls_global_init)
-	AC_CHECK_DECL(gnutls_x509_crt_set_version,  
-	              [AC_DEFINE(HAVE_GNUTLS_X509_CRT_SET_VERSION,1,gnutls set_version)], [], [
-	#include <gnutls/gnutls.h>
-	#include <gnutls/x509.h>
-	])
-	if test x"$ac_cv_header_gnutls_gnutls_h" = x"yes" -a x"$ac_cv_lib_ext_gnutls_gnutls_global_init" = x"yes" -a x"$ac_cv_have_decl_gnutls_x509_crt_set_version" = x"yes";then
-		SMB_ENABLE(GNUTLS,YES)
-		AC_CHECK_DECL(gnutls_x509_crt_set_subject_key_id,  
-		              [AC_DEFINE(HAVE_GNUTLS_X509_CRT_SET_SUBJECT_KEY_ID,1,gnutls subject_key)], [], [
-	#include <gnutls/gnutls.h>
-	#include <gnutls/x509.h>
-	])
+use_gnutls=yes
+AC_ARG_ENABLE(gnutls,
+[  --enable-gnutls          Turn on gnutls support (default=yes)],
+    [if test x$enable_gnutls = xno; then
+        use_gnutls=no
+    fi])
+
+
+if test x$use_gnutls = xyes; then
+	SMB_EXT_LIB_FROM_PKGCONFIG(GNUTLS, gnutls, 
+							   [SMB_ENABLE_GNUTLS=YES], 
+							   [SMB_ENABLE_GNUTLS=NO])
+	
+	if test x$SMB_ENABLE_GNUTLS = xNO; then
+		AC_CHECK_HEADERS(gnutls/gnutls.h)
+		AC_CHECK_LIB_EXT(gnutls, GNUTLS_LIBS, gnutls_global_init)
+		AC_CHECK_DECL(gnutls_x509_crt_set_version,  
+		              [AC_DEFINE(HAVE_GNUTLS_X509_CRT_SET_VERSION,1,gnutls set_version)], [], [
+		#include <gnutls/gnutls.h>
+		#include <gnutls/x509.h>
+		])
+		if test x"$ac_cv_header_gnutls_gnutls_h" = x"yes" -a x"$ac_cv_lib_ext_gnutls_gnutls_global_init" = x"yes" -a x"$ac_cv_have_decl_gnutls_x509_crt_set_version" = x"yes";then
+			SMB_ENABLE(GNUTLS,YES)
+			AC_CHECK_DECL(gnutls_x509_crt_set_subject_key_id,  
+			              [AC_DEFINE(HAVE_GNUTLS_X509_CRT_SET_SUBJECT_KEY_ID,1,gnutls subject_key)], [], [
+		#include <gnutls/gnutls.h>
+		#include <gnutls/x509.h>
+		])
+		fi
+		SMB_EXT_LIB(GNUTLS, $GNUTLS_LIBS)
+	fi
+	if test x$SMB_ENABLE_GNUTLS = xYES; then
+		#Some older versions have a different type name
+		AC_CHECK_TYPES([gnutls_datum],,,[#include "gnutls/gnutls.h"])
+		AC_CHECK_TYPES([gnutls_datum_t],,,[#include "gnutls/gnutls.h"])
+		AC_DEFINE(ENABLE_GNUTLS,1,[Whether we have gnutls support (SSL)])
 	fi
-	SMB_EXT_LIB(GNUTLS, $GNUTLS_LIBS)
-fi
-if test x$SMB_ENABLE_GNUTLS = xYES; then
-	#Some older versions have a different type name
-	AC_CHECK_TYPES([gnutls_datum],,,[#include "gnutls/gnutls.h"])
-	AC_CHECK_TYPES([gnutls_datum_t],,,[#include "gnutls/gnutls.h"])
-	AC_DEFINE(ENABLE_GNUTLS,1,[Whether we have gnutls support (SSL)])
 fi
 # end SMB_EXT_LIB_GNUTLS
 ###############################
-- 
cgit 


From b0d43b862ab909c262d2298e0b344c4eecc0efee Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Mon, 9 Jun 2008 10:37:12 +0200
Subject: build/m4: fix warnings with autoconf-2.62 rename SMB_BUILD_ =>
 samba_cv_

AC_CACHE_VAL() variables must contain _cv_ to be cached.

metze
(This used to be commit 0241af873fdefd5856932190ca0019a2d3c05703)
---
 source4/build/m4/check_cc.m4 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/source4/build/m4/check_cc.m4 b/source4/build/m4/check_cc.m4
index 569be38721..51531ca776 100644
--- a/source4/build/m4/check_cc.m4
+++ b/source4/build/m4/check_cc.m4
@@ -30,7 +30,7 @@ fi
 # check if the compiler can handle negative enum values
 # and don't truncate the values to INT_MAX
 # a runtime test is needed here
-AC_CACHE_CHECK([that the C compiler understands negative enum values],SMB_BUILD_CC_NEGATIVE_ENUM_VALUES, [
+AC_CACHE_CHECK([that the C compiler understands negative enum values],samba_cv_CC_NEGATIVE_ENUM_VALUES, [
     AC_TRY_RUN(
 [
 	#include <stdio.h>
@@ -45,8 +45,8 @@ AC_CACHE_CHECK([that the C compiler understands negative enum values],SMB_BUILD_
 		return 0;
 	}
 ],
-	SMB_BUILD_CC_NEGATIVE_ENUM_VALUES=yes,SMB_BUILD_CC_NEGATIVE_ENUM_VALUES=no)])
-if test x"$SMB_BUILD_CC_NEGATIVE_ENUM_VALUES" != x"yes"; then
+	samba_cv_CC_NEGATIVE_ENUM_VALUES=yes,samba_cv_CC_NEGATIVE_ENUM_VALUES=no)])
+if test x"$samba_cv_CC_NEGATIVE_ENUM_VALUES" != x"yes"; then
 	AC_DEFINE(USE_UINT_ENUMS, 1, [Whether the compiler has uint enum support])
 fi
 
-- 
cgit 


From 1b955253ff34f6a8a431899051dd784ace32a9ba Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Mon, 9 Jun 2008 10:38:09 +0200
Subject: libreplace: fix warnings with autoconf-2.62 rename ac_ =>
 libreplace_cv_

AC_CACHE_VAL() variables must contain _cv_ to be cached.

metze
(This used to be commit 67e43860b4973a458676b36785570bb4a66e046a)
---
 source4/lib/replace/win32.m4 | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/source4/lib/replace/win32.m4 b/source4/lib/replace/win32.m4
index 9ac84cdf2a..eb364e2cb9 100644
--- a/source4/lib/replace/win32.m4
+++ b/source4/lib/replace/win32.m4
@@ -2,7 +2,7 @@ AC_CHECK_HEADERS(direct.h windows.h winsock2.h ws2tcpip.h)
 
 #######################################
 # Check for mkdir mode
-AC_CACHE_CHECK( [whether mkdir supports mode], ac_mkdir_has_mode,
+AC_CACHE_CHECK( [whether mkdir supports mode], libreplace_cv_mkdir_has_mode,
 	AC_TRY_COMPILE([
 		#include <stdio.h>
 		#ifdef HAVE_DIRECT_H
@@ -11,10 +11,10 @@ AC_CACHE_CHECK( [whether mkdir supports mode], ac_mkdir_has_mode,
 			mkdir("foo",0777);
 			return 0;
 	],
-    ac_mkdir_has_mode="yes",
-    ac_mkdir_has_mode="no") )
+    libreplace_cv_mkdir_has_mode="yes",
+    libreplace_cv_mkdir_has_mode="no") )
 
-if test "$ac_mkdir_has_mode" = "yes"
+if test "$libreplace_cv_mkdir_has_mode" = "yes"
 then
     AC_DEFINE(HAVE_MKDIR_MODE, 1, [Define if target mkdir supports mode option])
 fi
-- 
cgit 


From d54c171a1a120980f075d05823f2c112e80dd097 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Mon, 9 Jun 2008 10:39:48 +0200
Subject: libreplace: only include AC_USE_SYSTEM_EXTENSIONS fallback if
 required

This fixes ./autogen.sh with autoconf-2.62

metze
(This used to be commit 72bb01dda4d425528e28cd96e249595dc6c1952f)
---
 source4/lib/replace/libreplace.m4 | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/source4/lib/replace/libreplace.m4 b/source4/lib/replace/libreplace.m4
index 6a85ff5a82..71fa041672 100644
--- a/source4/lib/replace/libreplace.m4
+++ b/source4/lib/replace/libreplace.m4
@@ -299,4 +299,5 @@ m4_include(libreplace_cc.m4)
 m4_include(libreplace_ld.m4)
 m4_include(libreplace_network.m4)
 m4_include(libreplace_macros.m4)
-m4_include(autoconf-2.60.m4)
+
+m4_ifndef([AC_USE_SYSTEM_EXTENSIONS],[m4_include(autoconf-2.60.m4)])
-- 
cgit 


From 6dc6d480ab16db99b088976a938371bbbe82770d Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Mon, 9 Jun 2008 10:42:07 +0200
Subject: configure: we require autoconf 2.54

I've tested with autoconf from 2.53 to 2.62.

metze
(This used to be commit 0dbacbf8be0eacaa4db6477873b7512f7261ef4c)
---
 source4/configure.ac | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/source4/configure.ac b/source4/configure.ac
index 73d3ffd4d9..5014a8700a 100644
--- a/source4/configure.ac
+++ b/source4/configure.ac
@@ -1,8 +1,7 @@
 dnl -*- mode: m4-mode -*-
 dnl Process this file with autoconf to produce a configure script.
 
-dnl disabled 2.53 requirement - we do work with 2.52 on suse 7.3 for example
-dnl AC_PREREQ(2.53)
+AC_PREREQ(2.54)
 
 AC_INIT([samba],[4],[samba-technical@samba.org])
 
-- 
cgit 


From 1384f836b601d35f3c499a9e26c3e3b0d12b3ad0 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Thu, 5 Jun 2008 19:13:23 +0000
Subject: heimdal_build: rename config.m{k,4} => internal.m{k,4}

metze
(This used to be commit 33700d4a97e14aab1b45b3ddb8c80c48cd789bc6)
---
 source4/configure.ac              |   2 +-
 source4/heimdal_build/config.m4   | 256 ----------------
 source4/heimdal_build/config.mk   | 624 --------------------------------------
 source4/heimdal_build/internal.m4 | 256 ++++++++++++++++
 source4/heimdal_build/internal.mk | 624 ++++++++++++++++++++++++++++++++++++++
 source4/main.mk                   |   2 +-
 6 files changed, 882 insertions(+), 882 deletions(-)
 delete mode 100644 source4/heimdal_build/config.m4
 delete mode 100644 source4/heimdal_build/config.mk
 create mode 100644 source4/heimdal_build/internal.m4
 create mode 100644 source4/heimdal_build/internal.mk

diff --git a/source4/configure.ac b/source4/configure.ac
index 5014a8700a..7690e700a5 100644
--- a/source4/configure.ac
+++ b/source4/configure.ac
@@ -13,7 +13,7 @@ AC_DEFINE(CONFIG_H_IS_FROM_SAMBA,1,[Marker for samba's config.h])
 m4_include(build/m4/env.m4)
 m4_include(lib/replace/samba.m4)
 m4_include(lib/smbreadline/readline.m4)
-m4_include(heimdal_build/config.m4)
+m4_include(heimdal_build/internal.m4)
 m4_include(lib/util/fault.m4)
 m4_include(lib/util/signal.m4)
 m4_include(lib/util/util.m4)
diff --git a/source4/heimdal_build/config.m4 b/source4/heimdal_build/config.m4
deleted file mode 100644
index 18ecbb75cd..0000000000
--- a/source4/heimdal_build/config.m4
+++ /dev/null
@@ -1,256 +0,0 @@
-m4_define([upcase],`echo $1 | tr abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ`)dnl
-
-dnl love_FIND_FUNC(func, includes, arguments)
-dnl kind of like AC_CHECK_FUNC, but with headerfiles
-AC_DEFUN([love_FIND_FUNC], [
-
-AC_MSG_CHECKING([for $1])
-AC_CACHE_VAL(ac_cv_love_func_$1,
-[
-AC_LINK_IFELSE([AC_LANG_PROGRAM([[$2]],[[$1($3)]])],
-[eval "ac_cv_love_func_$1=yes"],[eval "ac_cv_love_func_$1=no"])])
-
-eval "ac_res=\$ac_cv_love_func_$1"
-
-if false; then
-	AC_CHECK_FUNCS($1)
-fi
-# $1
-eval "ac_tr_func=HAVE_[]upcase($1)"
-
-case "$ac_res" in
-	yes)
-	AC_DEFINE_UNQUOTED($ac_tr_func)
-	AC_MSG_RESULT([yes])
-	;;
-	no)
-	AC_MSG_RESULT([no])
-	;;
-esac
-
-
-])
-
-dnl Not all systems have err.h, so we provide a replacement. Heimdal
-dnl unconditionally #includes <err.h>, so we need to create an err.h,
-dnl but we can't just have a static one because we don't want to use
-dnl it on systems that have a real err.h. If the system has a real
-dnl err.h, we should use that (eg. on Darwin, the declarations get
-dnl linker attributes added, so we can't guarantee that our local
-dnl declarations will be correct). Phew!
-AC_CHECK_HEADERS([err.h], [],
-	[ cp heimdal/lib/roken/err.hin heimdal_build/err.h ])
-
-AC_CHECK_HEADERS([				\
-	crypt.h					\
-	curses.h				\
-	errno.h					\
-	inttypes.h				\
-	netdb.h					\
-	signal.h				\
-	sys/bswap.h				\
-	sys/file.h				\
-	sys/stropts.h				\
-	sys/timeb.h				\
-	sys/times.h				\
-	sys/uio.h				\
-	sys/un.h				\
-	sys/utsname.h				\
-	term.h					\
-	termcap.h				\
-	time.h					\
-	timezone.h				\
-	ttyname.h				\
-	netinet/in.h				\
-	netinet/in6.h				\
-	netinet6/in6.h
-])
-
-AC_CHECK_FUNCS([				\
-	atexit					\
-	cgetent					\
-	getprogname				\
-	inet_aton				\
-	gethostname				\
-	getnameinfo				\
-	iruserok				\
-	putenv					\
-	rcmd					\
-	readv					\
-	sendmsg					\
-	setitimer				\
-	socket					\
-	strlwr					\
-	strncasecmp				\
-	strptime				\
-	strsep					\
-	strsep_copy				\
-	strtok_r				\
-	strupr					\
-	swab					\
-	umask					\
-	uname					\
-	unsetenv				\
-	closefrom				\
-	hstrerror				\
-	err					\
-	warn					\
-	errx					\
-	warnx					\
-	flock					\
-	getipnodebyname				\
-	getipnodebyaddr				\
-	freehostent				\
-	writev
-])
-
-love_FIND_FUNC(bswap16, [#ifdef HAVE_SYS_BSWAP_H
-#include <sys/bswap.h>
-#endif], 0)
-
-love_FIND_FUNC(bswap32, [#ifdef HAVE_SYS_BSWAP_H
-#include <sys/bswap.h>
-#endif], 0)
-
-AC_DEFUN([AC_KRB_STRUCT_WINSIZE], [
-AC_MSG_CHECKING(for struct winsize)
-AC_CACHE_VAL(ac_cv_struct_winsize, [
-ac_cv_struct_winsize=no
-for i in sys/termios.h sys/ioctl.h; do
-AC_EGREP_HEADER(
-struct[[ 	]]*winsize,dnl
-$i, ac_cv_struct_winsize=yes; break)dnl
-done
-])
-if test "$ac_cv_struct_winsize" = "yes"; then
-  AC_DEFINE(HAVE_STRUCT_WINSIZE, 1, [define if struct winsize is declared in sys/termios.h])
-fi
-AC_MSG_RESULT($ac_cv_struct_winsize)
-AC_EGREP_HEADER(ws_xpixel, termios.h, 
-	AC_DEFINE(HAVE_WS_XPIXEL, 1, [define if struct winsize has ws_xpixel]))
-AC_EGREP_HEADER(ws_ypixel, termios.h, 
-	AC_DEFINE(HAVE_WS_YPIXEL, 1, [define if struct winsize has ws_ypixel]))
-])
-
-AC_KRB_STRUCT_WINSIZE
-
-AC_TYPE_SIGNAL
-if test "$ac_cv_type_signal" = "void" ; then
-	AC_DEFINE(VOID_RETSIGTYPE, 1, [Define if signal handlers return void.])
-fi
-AC_SUBST(VOID_RETSIGTYPE)
-
-
-m4_include(heimdal/cf/check-var.m4)
-
-rk_CHECK_VAR(h_errno, 
-[#ifdef HAVE_SYS_TYPES_H
-#include <sys/types.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif])
-
-m4_include(heimdal/cf/find-func.m4)
-m4_include(heimdal/cf/find-func-no-libs.m4)
-m4_include(heimdal/cf/find-func-no-libs2.m4)
-m4_include(heimdal/cf/resolv.m4)
-
-smb_save_LIBS=$LIBS
-RESOLV_LIBS=""
-LIBS=""
-
-dnl  This fills in the global LIBS...
-rk_RESOLV
-
-dnl AC_CHECK_LIB_EXT(resolv, RESOLV_LIBS, res_search)
-	SMB_ENABLE(RESOLV,YES)
-
-if test x"$LIBS" != "x"; then
-	RESOLV_LIBS=$LIBS
-fi
-
-LIBS=$smb_save_LIBS
-
-SMB_EXT_LIB(RESOLV,[${RESOLV_LIBS}],[${RESOLV_CFLAGS}],[${RESOLV_CPPFLAGS}],[${RESOLV_LDFLAGS}])
-
-
-# these are disabled unless heimdal is found below
-SMB_ENABLE(KERBEROS_LIB, NO)
-SMB_ENABLE(asn1_compile, NO)
-SMB_ENABLE(compile_et, NO)
-
-#
-# We need bison -y and flex in new versions
-# Otherwise we get random runtime failures
-#
-LEX_YACC_COMBINATIONS=""
-LEX_YACC_COMBINATIONS="$LEX_YACC_COMBINATIONS flex-2.5.33:bison-2.3"
-
-AC_PROG_LEX
-LEX_BASENAME=`basename "$LEX"`
-if test x"$LEX_BASENAME" = x"flex"; then
-	# "flex 2.5.33"
-	FLEX_VERSION=`$LEX --version | cut -d ' ' -f2`
-	AC_MSG_CHECKING(flex version)
-	AC_MSG_RESULT($FLEX_VERSION)
-	FLEX_MAJOR=`echo $FLEX_VERSION | cut -d '.' -f1`
-	FLEX_MINOR=`echo $FLEX_VERSION | cut -d '.' -f2`
-	FLEX_RELEASE=`echo $FLEX_VERSION | cut -d '.' -f3`
-
-	LEX_VERSION="flex-$FLEX_MAJOR.$FLEX_MINOR.$FLEX_RELEASE"
-fi
-
-AC_PROG_YACC
-YACC_BASENAME=`basename "$YACC"`
-if test x"$YACC_BASENAME" = x"bison -y"; then
-	# bison (GNU Bison) 2.3
-	BISON_VERSION=`$YACC --version | head -1 | cut -d ' ' -f4`
-	AC_MSG_CHECKING(bison version)
-	AC_MSG_RESULT($BISON_VERSION)
-	BISON_MAJOR=`echo $BISON_VERSION | cut -d '.' -f1`
-	BISON_MINOR=`echo $BISON_VERSION | cut -d '.' -f2`
-
-	YACC_VERSION="bison-$BISON_MAJOR.$BISON_MINOR"
-fi
-
-AC_MSG_CHECKING(working LEX YACC combination)
-LEX_YACC="no"
-if test x"$LEX_VERSION" != x"" -a x"$YACC_VERSION" != x""; then
-	V="$LEX_VERSION:$YACC_VERSION"
-	for C in $LEX_YACC_COMBINATIONS; do
-		if test x"$V" = x"$C"; then
-			LEX_YACC=$V
-			break;
-		fi
-	done
-fi
-if test x"$LEX_YACC" = x"no"; then
-	LEX=false
-	YACC=false
-fi
-AC_MSG_RESULT($LEX_YACC)
-
-# Portions of heimdal kerberos are unpacked into source/heimdal
-# of the samba source tree.  
-
-# if we ever get to using a host kerberos, we might add conditionals here
-AC_DEFINE(HAVE_KRB5,1,[Whether kerberos is available])
-HAVE_KRB5=YES
-SMB_ENABLE(KERBEROS_LIB, YES)
-SMB_ENABLE(asn1_compile, YES)
-SMB_ENABLE(compile_et, YES)
-
-# only add closefrom if needed
-SMB_ENABLE(HEIMDAL_ROKEN_CLOSEFROM, NO)
-if test t$ac_cv_func_closefrom != tyes; then
-	SMB_ENABLE(HEIMDAL_ROKEN_CLOSEFROM, YES)
-fi
-
-# only add getprogname if needed
-SMB_ENABLE(HEIMDAL_ROKEN_GETPROGNAME, NO)
-SMB_ENABLE(HEIMDAL_ROKEN_GETPROGNAME_H, NO)
-if test t$ac_cv_func_getprogname != tyes; then
-	SMB_ENABLE(HEIMDAL_ROKEN_GETPROGNAME, YES)
-	SMB_ENABLE(HEIMDAL_ROKEN_GETPROGNAME_H, YES)
-fi
diff --git a/source4/heimdal_build/config.mk b/source4/heimdal_build/config.mk
deleted file mode 100644
index 17fc8c93ec..0000000000
--- a/source4/heimdal_build/config.mk
+++ /dev/null
@@ -1,624 +0,0 @@
-heimdalbuildsrcdir = $(heimdalsrcdir)/../heimdal_build
-
-#######################
-# Start SUBSYSTEM HEIMDAL_KDC
-[SUBSYSTEM::HEIMDAL_KDC]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/kdc
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_KRB5 HEIMDAL_HDB HEIMDAL_HEIM_ASN1 HEIMDAL_DIGEST_ASN1 HEIMDAL_KX509_ASN1
-PUBLIC_DEPENDENCIES = HEIMDAL_NTLM HEIMDAL_HCRYPTO
-# End SUBSYSTEM HEIMDAL_KDC
-#######################
-
-
-HEIMDAL_KDC_OBJ_FILES = \
-	$(heimdalsrcdir)/kdc/default_config.o \
-	$(heimdalsrcdir)/kdc/kerberos5.o \
-	$(heimdalsrcdir)/kdc/krb5tgs.o \
-	$(heimdalsrcdir)/kdc/pkinit.o \
-	$(heimdalsrcdir)/kdc/log.o \
-	$(heimdalsrcdir)/kdc/misc.o \
-	$(heimdalsrcdir)/kdc/524.o \
-	$(heimdalsrcdir)/kdc/kerberos4.o \
-	$(heimdalsrcdir)/kdc/kaserver.o \
-	$(heimdalsrcdir)/kdc/digest.o \
-	$(heimdalsrcdir)/kdc/process.o \
-	$(heimdalsrcdir)/kdc/windc.o \
-	$(heimdalsrcdir)/kdc/kx509.o
-
-[SUBSYSTEM::HEIMDAL_NTLM]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/ntlm
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_HCRYPTO HEIMDAL_KRB5
-
-HEIMDAL_NTLM_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/ntlm/ntlm.o
-
-[SUBSYSTEM::HEIMDAL_HDB_KEYS]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/hdb
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_HCRYPTO HEIMDAL_KRB5 \
-					   HEIMDAL_HDB_ASN1
-
-HEIMDAL_HDB_KEYS_OBJ_FILES = $(heimdalsrcdir)/lib/hdb/keys.o
-
-#######################
-# Start SUBSYSTEM HEIMDAL_HDB
-[SUBSYSTEM::HEIMDAL_HDB]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/hdb
-PRIVATE_DEPENDENCIES = HDB_LDB HEIMDAL_KRB5 HEIMDAL_HDB_KEYS HEIMDAL_ROKEN HEIMDAL_HCRYPTO HEIMDAL_COM_ERR HEIMDAL_HDB_ASN1
-# End SUBSYSTEM HEIMDAL_HDB
-#######################
-
-HEIMDAL_HDB_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/hdb/db.o \
-	$(heimdalsrcdir)/lib/hdb/dbinfo.o \
-	$(heimdalsrcdir)/lib/hdb/hdb.o \
-	$(heimdalsrcdir)/lib/hdb/ext.o \
-	$(heimdalsrcdir)/lib/hdb/keytab.o \
-	$(heimdalsrcdir)/lib/hdb/mkey.o \
-	$(heimdalsrcdir)/lib/hdb/ndbm.o \
-	$(heimdalsrcdir)/lib/hdb/hdb_err.o
-
-#######################
-# Start SUBSYSTEM HEIMDAL_GSSAPI
-[SUBSYSTEM::HEIMDAL_GSSAPI]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/gssapi -I$(heimdalsrcdir)/lib/gssapi/gssapi -I$(heimdalsrcdir)/lib/gssapi/spnego -I$(heimdalsrcdir)/lib/gssapi/krb5 -I$(heimdalsrcdir)/lib/gssapi/mech
-PRIVATE_DEPENDENCIES = HEIMDAL_HCRYPTO HEIMDAL_HEIM_ASN1 HEIMDAL_SPNEGO_ASN1
-PUBLIC_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_KRB5
-# End SUBSYSTEM HEIMDAL_GSSAPI
-#######################
-
-HEIMDAL_GSSAPI_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/gssapi/mech/context.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_krb5.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_mech_switch.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_process_context_token.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_buffer_set.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_add_cred.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_add_oid_set_member.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_compare_name.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_release_oid_set.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_create_empty_oid_set.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_decapsulate_token.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_cred_by_oid.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_canonicalize_name.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_sec_context_by_oid.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_names_for_mech.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_mechs_for_name.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_wrap_size_limit.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_names.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_verify.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_display_name.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_duplicate_oid.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_display_status.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_release_buffer.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_release_oid.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_test_oid_set_member.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_release_cred.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_set_sec_context_option.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_export_name.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_seal.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_acquire_cred.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_unseal.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_verify_mic.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_accept_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_cred_by_mech.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_indicate_mechs.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_delete_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_sign.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_utils.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_init_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_oid_equal.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_oid_to_str.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_context_time.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_encapsulate_token.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_get_mic.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_import_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_cred.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_wrap.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_import_name.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_duplicate_name.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_unwrap.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_export_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_context.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_release_name.o \
-	$(heimdalsrcdir)/lib/gssapi/mech/gss_set_cred_option.o \
-	$(heimdalsrcdir)/lib/gssapi/asn1_GSSAPIContextToken.o \
-	$(heimdalsrcdir)/lib/gssapi/spnego/init_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/spnego/external.o \
-	$(heimdalsrcdir)/lib/gssapi/spnego/compat.o \
-	$(heimdalsrcdir)/lib/gssapi/spnego/context_stubs.o \
-	$(heimdalsrcdir)/lib/gssapi/spnego/cred_stubs.o \
-	$(heimdalsrcdir)/lib/gssapi/spnego/accept_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/copy_ccache.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/delete_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/init_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/context_time.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/init.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/address_to_krb5addr.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/get_mic.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_context.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/add_cred.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_cred.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_cred_by_oid.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_cred_by_mech.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_mechs_for_name.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_names_for_mech.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/indicate_mechs.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_sec_context_by_oid.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/export_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/import_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/duplicate_name.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/import_name.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/compare_name.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/export_name.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/canonicalize_name.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/unwrap.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/wrap.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/release_name.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/cfx.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/8003.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/arcfour.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/encapsulate.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/display_name.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/sequence.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/display_status.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/release_buffer.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/external.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/compat.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/acquire_cred.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/release_cred.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/set_cred_option.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/decapsulate.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/verify_mic.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/accept_sec_context.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/set_sec_context_option.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/process_context_token.o \
-	$(heimdalsrcdir)/lib/gssapi/krb5/prf.o
-
-
-#######################
-# Start SUBSYSTEM HEIMDAL_KRB5
-[SUBSYSTEM::HEIMDAL_KRB5]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/krb5 -I$(heimdalsrcdir)/lib/asn1 -I$(heimdalsrcdir)/lib/com_err 
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_PKINIT_ASN1 HEIMDAL_WIND
-PUBLIC_DEPENDENCIES = HEIMDAL_KRB5_ASN1 HEIMDAL_GLUE HEIMDAL_HX509 HEIMDAL_HCRYPTO
-# End SUBSYSTEM HEIMDAL_KRB5
-#######################
-
-HEIMDAL_KRB5_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/krb5/acache.o \
-	$(heimdalsrcdir)/lib/krb5/add_et_list.o \
-	$(heimdalsrcdir)/lib/krb5/addr_families.o \
-	$(heimdalsrcdir)/lib/krb5/appdefault.o \
-	$(heimdalsrcdir)/lib/krb5/asn1_glue.o \
-	$(heimdalsrcdir)/lib/krb5/auth_context.o \
-	$(heimdalsrcdir)/lib/krb5/build_ap_req.o \
-	$(heimdalsrcdir)/lib/krb5/build_auth.o \
-	$(heimdalsrcdir)/lib/krb5/cache.o \
-	$(heimdalsrcdir)/lib/krb5/changepw.o \
-	$(heimdalsrcdir)/lib/krb5/codec.o \
-	$(heimdalsrcdir)/lib/krb5/config_file.o \
-	$(heimdalsrcdir)/lib/krb5/config_file_netinfo.o \
-	$(heimdalsrcdir)/lib/krb5/constants.o \
-	$(heimdalsrcdir)/lib/krb5/context.o \
-	$(heimdalsrcdir)/lib/krb5/convert_creds.o \
-	$(heimdalsrcdir)/lib/krb5/copy_host_realm.o \
-	$(heimdalsrcdir)/lib/krb5/crc.o \
-	$(heimdalsrcdir)/lib/krb5/creds.o \
-	$(heimdalsrcdir)/lib/krb5/crypto.o \
-	$(heimdalsrcdir)/lib/krb5/data.o \
-	$(heimdalsrcdir)/lib/krb5/eai_to_heim_errno.o \
-	$(heimdalsrcdir)/lib/krb5/error_string.o \
-	$(heimdalsrcdir)/lib/krb5/expand_hostname.o \
-	$(heimdalsrcdir)/lib/krb5/fcache.o \
-	$(heimdalsrcdir)/lib/krb5/free.o \
-	$(heimdalsrcdir)/lib/krb5/free_host_realm.o \
-	$(heimdalsrcdir)/lib/krb5/generate_seq_number.o \
-	$(heimdalsrcdir)/lib/krb5/generate_subkey.o \
-	$(heimdalsrcdir)/lib/krb5/get_cred.o \
-	$(heimdalsrcdir)/lib/krb5/get_default_principal.o \
-	$(heimdalsrcdir)/lib/krb5/get_default_realm.o \
-	$(heimdalsrcdir)/lib/krb5/get_for_creds.o \
-	$(heimdalsrcdir)/lib/krb5/get_host_realm.o \
-	$(heimdalsrcdir)/lib/krb5/get_in_tkt.o \
-	$(heimdalsrcdir)/lib/krb5/get_in_tkt_with_keytab.o \
-	$(heimdalsrcdir)/lib/krb5/get_port.o \
-	$(heimdalsrcdir)/lib/krb5/init_creds.o \
-	$(heimdalsrcdir)/lib/krb5/init_creds_pw.o \
-	$(heimdalsrcdir)/lib/krb5/kcm.o \
-	$(heimdalsrcdir)/lib/krb5/keyblock.o \
-	$(heimdalsrcdir)/lib/krb5/keytab.o \
-	$(heimdalsrcdir)/lib/krb5/keytab_any.o \
-	$(heimdalsrcdir)/lib/krb5/keytab_file.o \
-	$(heimdalsrcdir)/lib/krb5/keytab_memory.o \
-	$(heimdalsrcdir)/lib/krb5/keytab_keyfile.o \
-	$(heimdalsrcdir)/lib/krb5/keytab_krb4.o \
-	$(heimdalsrcdir)/lib/krb5/krbhst.o \
-	$(heimdalsrcdir)/lib/krb5/log.o \
-	$(heimdalsrcdir)/lib/krb5/mcache.o \
-	$(heimdalsrcdir)/lib/krb5/misc.o \
-	$(heimdalsrcdir)/lib/krb5/mk_error.o \
-	$(heimdalsrcdir)/lib/krb5/mk_priv.o \
-	$(heimdalsrcdir)/lib/krb5/mk_rep.o \
-	$(heimdalsrcdir)/lib/krb5/mk_req.o \
-	$(heimdalsrcdir)/lib/krb5/mk_req_ext.o \
-	$(heimdalsrcdir)/lib/krb5/mit_glue.o \
-	$(heimdalsrcdir)/lib/krb5/n-fold.o \
-	$(heimdalsrcdir)/lib/krb5/padata.o \
-	$(heimdalsrcdir)/lib/krb5/pkinit.o \
-	$(heimdalsrcdir)/lib/krb5/plugin.o \
-	$(heimdalsrcdir)/lib/krb5/principal.o \
-	$(heimdalsrcdir)/lib/krb5/pac.o \
-	$(heimdalsrcdir)/lib/krb5/prompter_posix.o \
-	$(heimdalsrcdir)/lib/krb5/rd_cred.o \
-	$(heimdalsrcdir)/lib/krb5/rd_error.o \
-	$(heimdalsrcdir)/lib/krb5/rd_priv.o \
-	$(heimdalsrcdir)/lib/krb5/rd_rep.o \
-	$(heimdalsrcdir)/lib/krb5/rd_req.o \
-	$(heimdalsrcdir)/lib/krb5/replay.o \
-	$(heimdalsrcdir)/lib/krb5/send_to_kdc.o \
-	$(heimdalsrcdir)/lib/krb5/set_default_realm.o \
-	$(heimdalsrcdir)/lib/krb5/store.o \
-	$(heimdalsrcdir)/lib/krb5/store_emem.o \
-	$(heimdalsrcdir)/lib/krb5/store_fd.o \
-	$(heimdalsrcdir)/lib/krb5/store_mem.o \
-	$(heimdalsrcdir)/lib/krb5/ticket.o \
-	$(heimdalsrcdir)/lib/krb5/time.o \
-	$(heimdalsrcdir)/lib/krb5/transited.o \
-	$(heimdalsrcdir)/lib/krb5/v4_glue.o \
-	$(heimdalsrcdir)/lib/krb5/version.o \
-	$(heimdalsrcdir)/lib/krb5/warn.o \
-	$(heimdalsrcdir)/lib/krb5/krb5_err.o \
-	$(heimdalsrcdir)/lib/krb5/heim_err.o \
-	$(heimdalsrcdir)/lib/krb5/k524_err.o \
-	$(heimdalsrcdir)/lib/krb5/krb_err.o
-
-#######################
-# Start SUBSYSTEM HEIMDAL_HEIM_ASN1
-[SUBSYSTEM::HEIMDAL_HEIM_ASN1]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/asn1
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_COM_ERR
-# End SUBSYSTEM HEIMDAL_KRB5
-#######################
-
-HEIMDAL_HEIM_ASN1_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/asn1/der_get.o \
-	$(heimdalsrcdir)/lib/asn1/der_put.o \
-	$(heimdalsrcdir)/lib/asn1/der_free.o \
-	$(heimdalsrcdir)/lib/asn1/der_format.o \
-	$(heimdalsrcdir)/lib/asn1/der_length.o \
-	$(heimdalsrcdir)/lib/asn1/der_copy.o \
-	$(heimdalsrcdir)/lib/asn1/der_cmp.o \
-	$(heimdalsrcdir)/lib/asn1/extra.o \
-	$(heimdalsrcdir)/lib/asn1/timegm.o \
-	$(heimdalsrcdir)/lib/asn1/asn1_err.o
-
-#######################
-# Start SUBSYSTEM HEIMDAL_HCRYPTO_IMATH
-[SUBSYSTEM::HEIMDAL_HCRYPTO_IMATH]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/hcrypto/imath 
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN 
-# End SUBSYSTEM HEIMDAL_HCRYPTO_IMATH
-#######################
-
-HEIMDAL_HCRYPTO_IMATH_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/hcrypto/imath/imath.o \
-	$(heimdalsrcdir)/lib/hcrypto/imath/iprime.o
-
-[SUBSYSTEM::HEIMDAL_HCRYPTO]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/hcrypto -I$(heimdalsrcdir)/lib
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_HEIM_ASN1 HEIMDAL_HCRYPTO_IMATH HEIMDAL_RFC2459_ASN1
-# End SUBSYSTEM HEIMDAL_HCRYPTO
-#######################
-
-HEIMDAL_HCRYPTO_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/hcrypto/aes.o \
-	$(heimdalsrcdir)/lib/hcrypto/bn.o \
-	$(heimdalsrcdir)/lib/hcrypto/dh.o \
-	$(heimdalsrcdir)/lib/hcrypto/dh-imath.o \
-	$(heimdalsrcdir)/lib/hcrypto/des.o \
-	$(heimdalsrcdir)/lib/hcrypto/dsa.o \
-	$(heimdalsrcdir)/lib/hcrypto/engine.o \
-	$(heimdalsrcdir)/lib/hcrypto/md2.o \
-	$(heimdalsrcdir)/lib/hcrypto/md4.o \
-	$(heimdalsrcdir)/lib/hcrypto/md5.o \
-	$(heimdalsrcdir)/lib/hcrypto/rsa.o \
-	$(heimdalsrcdir)/lib/hcrypto/rsa-imath.o \
-	$(heimdalsrcdir)/lib/hcrypto/rc2.o \
-	$(heimdalsrcdir)/lib/hcrypto/rc4.o \
-	$(heimdalsrcdir)/lib/hcrypto/rijndael-alg-fst.o \
-	$(heimdalsrcdir)/lib/hcrypto/rnd_keys.o \
-	$(heimdalsrcdir)/lib/hcrypto/sha.o \
-	$(heimdalsrcdir)/lib/hcrypto/sha256.o \
-	$(heimdalsrcdir)/lib/hcrypto/ui.o \
-	$(heimdalsrcdir)/lib/hcrypto/evp.o \
-	$(heimdalsrcdir)/lib/hcrypto/pkcs5.o \
-	$(heimdalsrcdir)/lib/hcrypto/pkcs12.o \
-	$(heimdalsrcdir)/lib/hcrypto/rand.o \
-	$(heimdalsrcdir)/lib/hcrypto/rand-egd.o \
-	$(heimdalsrcdir)/lib/hcrypto/rand-unix.o \
-	$(heimdalsrcdir)/lib/hcrypto/rand-fortuna.o \
-	$(heimdalsrcdir)/lib/hcrypto/rand-timer.o \
-	$(heimdalsrcdir)/lib/hcrypto/hmac.o \
-	$(heimdalsrcdir)/lib/hcrypto/camellia.o \
-	$(heimdalsrcdir)/lib/hcrypto/camellia-ntt.o
-
-#######################
-# Start SUBSYSTEM HEIMDAL_HX509
-[SUBSYSTEM::HEIMDAL_HX509]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/hx509 
-PRIVATE_DEPENDENCIES = \
-	HEIMDAL_ROKEN HEIMDAL_COM_ERR \
-	HEIMDAL_HEIM_ASN1 HEIMDAL_HCRYPTO \
-	HEIMDAL_CMS_ASN1 HEIMDAL_RFC2459_ASN1 \
-	HEIMDAL_OCSP_ASN1 HEIMDAL_PKCS8_ASN1 \
-	HEIMDAL_PKCS9_ASN1 HEIMDAL_PKCS12_ASN1 \
-	HEIMDAL_PKINIT_ASN1 HEIMDAL_PKCS10_ASN1 \
-	HEIMDAL_WIND
-# End SUBSYSTEM HEIMDAL_HX509
-#######################
-
-HEIMDAL_HX509_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/hx509/ca.o \
-	$(heimdalsrcdir)/lib/hx509/cert.o \
-	$(heimdalsrcdir)/lib/hx509/cms.o \
-	$(heimdalsrcdir)/lib/hx509/collector.o \
-	$(heimdalsrcdir)/lib/hx509/crypto.o \
-	$(heimdalsrcdir)/lib/hx509/error.o \
-	$(heimdalsrcdir)/lib/hx509/env.o \
-	$(heimdalsrcdir)/lib/hx509/file.o \
-	$(heimdalsrcdir)/lib/hx509/keyset.o \
-	$(heimdalsrcdir)/lib/hx509/ks_dir.o \
-	$(heimdalsrcdir)/lib/hx509/ks_file.o \
-	$(heimdalsrcdir)/lib/hx509/ks_keychain.o \
-	$(heimdalsrcdir)/lib/hx509/ks_mem.o \
-	$(heimdalsrcdir)/lib/hx509/ks_null.o \
-	$(heimdalsrcdir)/lib/hx509/ks_p11.o \
-	$(heimdalsrcdir)/lib/hx509/ks_p12.o \
-	$(heimdalsrcdir)/lib/hx509/lock.o \
-	$(heimdalsrcdir)/lib/hx509/name.o \
-	$(heimdalsrcdir)/lib/hx509/peer.o \
-	$(heimdalsrcdir)/lib/hx509/print.o \
-	$(heimdalsrcdir)/lib/hx509/req.o \
-	$(heimdalsrcdir)/lib/hx509/revoke.o \
-	$(heimdalsrcdir)/lib/hx509/hx509_err.o
-
-#######################
-# Start SUBSYSTEM HEIMDAL_WIND
-[SUBSYSTEM::HEIMDAL_WIND]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/wind 
-PRIVATE_DEPENDENCIES = \
-	HEIMDAL_ROKEN HEIMDAL_COM_ERR
-
-HEIMDAL_WIND_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/wind/wind_err.o \
-	$(heimdalsrcdir)/lib/wind/stringprep.o \
-	$(heimdalsrcdir)/lib/wind/errorlist.o \
-	$(heimdalsrcdir)/lib/wind/errorlist_table.o \
-	$(heimdalsrcdir)/lib/wind/normalize.o \
-	$(heimdalsrcdir)/lib/wind/normalize_table.o \
-	$(heimdalsrcdir)/lib/wind/combining.o \
-	$(heimdalsrcdir)/lib/wind/combining_table.o \
-	$(heimdalsrcdir)/lib/wind/utf8.o \
-	$(heimdalsrcdir)/lib/wind/bidi.o \
-	$(heimdalsrcdir)/lib/wind/bidi_table.o \
-	$(heimdalsrcdir)/lib/wind/ldap.o \
-	$(heimdalsrcdir)/lib/wind/map.o \
-	$(heimdalsrcdir)/lib/wind/map_table.o
-# End SUBSYSTEM HEIMDAL_WIND
-#######################
-
-[SUBSYSTEM::HEIMDAL_ROKEN_GETPROGNAME]
-
-HEIMDAL_ROKEN_GETPROGNAME_OBJ_FILES = $(heimdalsrcdir)/lib/roken/getprogname.o
-$(HEIMDAL_ROKEN_GETPROGNAME_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken  -I$(socketwrappersrcdir)
-
-[SUBSYSTEM::HEIMDAL_ROKEN_CLOSEFROM] 
-
-HEIMDAL_ROKEN_CLOSEFROM_OBJ_FILES = $(heimdalsrcdir)/lib/roken/closefrom.o
-$(HEIMDAL_ROKEN_CLOSEFROM_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken  -I$(socketwrappersrcdir)
-
-[SUBSYSTEM::HEIMDAL_ROKEN_GETPROGNAME_H] 
-
-HEIMDAL_ROKEN_GETPROGNAME_H_OBJ_FILES = $(heimdalsrcdir)/lib/roken/getprogname.ho
-$(HEIMDAL_ROKEN_GETPROGNAME_H_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken  -I$(socketwrappersrcdir)
-
-#######################
-# Start SUBSYSTEM HEIMDAL_ROKEN
-[SUBSYSTEM::HEIMDAL_ROKEN]
-CFLAGS =  -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken -I$(socketwrappersrcdir)
-PUBLIC_DEPENDENCIES = \
-			HEIMDAL_ROKEN_GETPROGNAME \
-			HEIMDAL_ROKEN_CLOSEFROM \
-			RESOLV \
-			LIBREPLACE_NETWORK
-# End SUBSYSTEM HEIMDAL_ROKEN
-#######################
-
-HEIMDAL_ROKEN_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/roken/base64.o \
-	$(heimdalsrcdir)/lib/roken/hex.o \
-	$(heimdalsrcdir)/lib/roken/bswap.o \
-	$(heimdalsrcdir)/lib/roken/dumpdata.o \
-	$(heimdalsrcdir)/lib/roken/emalloc.o \
-	$(heimdalsrcdir)/lib/roken/ecalloc.o \
-	$(heimdalsrcdir)/lib/roken/get_window_size.o \
-	$(heimdalsrcdir)/lib/roken/h_errno.o \
-	$(heimdalsrcdir)/lib/roken/issuid.o \
-	$(heimdalsrcdir)/lib/roken/net_read.o \
-	$(heimdalsrcdir)/lib/roken/net_write.o \
-	$(heimdalsrcdir)/lib/roken/socket.o \
-	$(heimdalsrcdir)/lib/roken/parse_time.o \
-	$(heimdalsrcdir)/lib/roken/parse_units.o \
-	$(heimdalsrcdir)/lib/roken/resolve.o \
-	$(heimdalsrcdir)/lib/roken/roken_gethostby.o \
-	$(heimdalsrcdir)/lib/roken/signal.o \
-	$(heimdalsrcdir)/lib/roken/vis.o \
-	$(heimdalsrcdir)/lib/roken/strlwr.o \
-	$(heimdalsrcdir)/lib/roken/strsep_copy.o \
-	$(heimdalsrcdir)/lib/roken/strsep.o \
-	$(heimdalsrcdir)/lib/roken/strupr.o \
-	$(heimdalsrcdir)/lib/roken/strpool.o \
-	$(heimdalsrcdir)/lib/roken/estrdup.o \
-	$(heimdalsrcdir)/lib/roken/erealloc.o \
-	$(heimdalsrcdir)/lib/roken/simple_exec.o \
-	$(heimdalsrcdir)/lib/roken/strcollect.o \
-	$(heimdalsrcdir)/lib/roken/rtbl.o \
-	$(heimdalbuildsrcdir)/replace.o
-
-#######################
-# Start SUBSYSTEM HEIMDAL_GLUE
-[SUBSYSTEM::HEIMDAL_GLUE]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/krb5 -I$(heimdalsrcdir)/lib/asn1 -I$(heimdalsrcdir)/lib/com_err 
-PUBLIC_DEPENDENCIES = LIBNETIF LIBSAMBA-HOSTCONFIG
-# End SUBSYSTEM HEIMDAL_GLUE
-#######################
-
-HEIMDAL_GLUE_OBJ_FILES = $(heimdalbuildsrcdir)/glue.o
-
-#######################
-# Start SUBSYSTEM HEIMDAL_COM_ERR
-[SUBSYSTEM::HEIMDAL_COM_ERR]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/com_err
-PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN
-# End SUBSYSTEM HEIMDAL_COM_ERR
-#######################
-
-HEIMDAL_COM_ERR_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/com_err/com_err.o \
-	$(heimdalsrcdir)/lib/com_err/error.o
-
-#######################
-# Start SUBSYSTEM HEIMDAL_ASN1_COMPILE_LEX
-[SUBSYSTEM::HEIMDAL_ASN1_COMPILE_LEX]
-# End SUBSYSTEM HEIMDAL_ASN1_COMPILE_LEX
-#######################
-
-HEIMDAL_ASN1_COMPILE_LEX_OBJ_FILES = $(heimdalsrcdir)/lib/asn1/lex.ho 
-$(HEIMDAL_ASN1_COMPILE_LEX_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/asn1 -I$(heimdalsrcdir)/lib/roken -I$(socketwrappersrcdir)
-
-#######################
-# Start BINARY asn1_compile
-[BINARY::asn1_compile]
-USE_HOSTCC = YES
-PRIVATE_DEPENDENCIES = HEIMDAL_ASN1_COMPILE_LEX HEIMDAL_ROKEN_GETPROGNAME_H LIBREPLACE_NETWORK
-
-ASN1C = $(builddir)/bin/asn1_compile
-
-asn1_compile_OBJ_FILES = \
-	$(heimdalsrcdir)/lib/asn1/main.ho \
-	$(heimdalsrcdir)/lib/asn1/gen.ho \
-	$(heimdalsrcdir)/lib/asn1/gen_copy.ho \
-	$(heimdalsrcdir)/lib/asn1/gen_decode.ho \
-	$(heimdalsrcdir)/lib/asn1/gen_encode.ho \
-	$(heimdalsrcdir)/lib/asn1/gen_free.ho \
-	$(heimdalsrcdir)/lib/asn1/gen_glue.ho \
-	$(heimdalsrcdir)/lib/asn1/gen_length.ho \
-	$(heimdalsrcdir)/lib/asn1/gen_seq.ho \
-	$(heimdalsrcdir)/lib/asn1/hash.ho \
-	$(heimdalsrcdir)/lib/asn1/parse.ho \
-	$(heimdalsrcdir)/lib/roken/emalloc.ho \
-	$(heimdalsrcdir)/lib/roken/getarg.ho \
-	$(heimdalsrcdir)/lib/roken/setprogname.ho \
-	$(heimdalsrcdir)/lib/roken/strupr.ho \
-	$(heimdalsrcdir)/lib/roken/get_window_size.ho \
-	$(heimdalsrcdir)/lib/roken/estrdup.ho \
-	$(heimdalsrcdir)/lib/roken/ecalloc.ho \
-	$(heimdalsrcdir)/lib/asn1/symbol.ho \
-	$(heimdalsrcdir)/lib/vers/print_version.ho \
-	$(socketwrappersrcdir)/socket_wrapper.ho \
-	$(heimdalbuildsrcdir)/replace.ho
-
-$(asn1_compile_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken -I$(heimdalsrcdir)/lib/asn1
-
-# End BINARY asn1_compile
-#######################
-
-#######################
-# Start SUBSYSTEM HEIMDAL_COM_ERR_COMPILE_LEX
-[SUBSYSTEM::HEIMDAL_COM_ERR_COMPILE_LEX]
-CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/com_err -I$(heimdalsrcdir)/lib/roken  -I$(socketwrappersrcdir)
-# End SUBSYSTEM HEIMDAL_COM_ERR_COMPILE_LEX
-#######################
-
-HEIMDAL_COM_ERR_COMPILE_LEX_OBJ_FILES = $(heimdalsrcdir)/lib/com_err/lex.ho 
-
-#######################
-# Start BINARY compile_et
-[BINARY::compile_et]
-USE_HOSTCC = YES
-PRIVATE_DEPENDENCIES = HEIMDAL_COM_ERR_COMPILE_LEX HEIMDAL_ROKEN_GETPROGNAME_H LIBREPLACE_NETWORK
-# End BINARY compile_et
-#######################
-
-ET_COMPILER = $(builddir)/bin/compile_et
-
-compile_et_OBJ_FILES = $(heimdalsrcdir)/lib/vers/print_version.ho \
-	$(heimdalsrcdir)/lib/com_err/parse.ho \
-	$(heimdalsrcdir)/lib/com_err/compile_et.ho \
-	$(heimdalsrcdir)/lib/roken/getarg.ho \
-	$(heimdalsrcdir)/lib/roken/get_window_size.ho \
-	$(heimdalsrcdir)/lib/roken/strupr.ho \
-	$(heimdalsrcdir)/lib/roken/setprogname.ho \
-	$(socketwrappersrcdir)/socket_wrapper.ho \
-	$(heimdalbuildsrcdir)/replace.ho
-
-$(compile_et_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken
-
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/hdb/hdb.asn1 hdb_asn1 \$\(heimdalsrcdir\)/lib/hdb |
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/gssapi/spnego/spnego.asn1 spnego_asn1 \$\(heimdalsrcdir\)/lib/gssapi --sequence=MechTypeList |
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/gssapi/mech/gssapi.asn1 gssapi_asn1 \$\(heimdalsrcdir\)/lib/gssapi|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/k5.asn1 krb5_asn1 \$\(heimdalsrcdir\)/lib/asn1 --encode-rfc1510-bit-string --sequence=KRB5SignedPathPrincipals --sequence=AuthorizationData --sequence=METHOD-DATA|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/digest.asn1 digest_asn1 \$\(heimdalsrcdir\)/lib/asn1|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/pkcs8.asn1 pkcs8_asn1 \$\(heimdalsrcdir\)/lib/asn1|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/pkcs9.asn1 pkcs9_asn1 \$\(heimdalsrcdir\)/lib/asn1|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/pkcs12.asn1 pkcs12_asn1 \$\(heimdalsrcdir\)/lib/asn1|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/rfc2459.asn1 rfc2459_asn1 \$\(heimdalsrcdir\)/lib/asn1 --preserve-binary=TBSCertificate --preserve-binary=TBSCRLCertList --preserve-binary=Name --sequence=GeneralNames --sequence=Extensions --sequence=CRLDistributionPoints|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/pkinit.asn1 pkinit_asn1 \$\(heimdalsrcdir\)/lib/asn1|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/CMS.asn1 cms_asn1 \$\(heimdalsrcdir\)/lib/asn1|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/hx509/ocsp.asn1 ocsp_asn1 \$\(heimdalsrcdir\)/lib/hx509 --preserve-binary=OCSPTBSRequest --preserve-binary=OCSPResponseData|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/kx509.asn1 kx509_asn1 \$\(heimdalsrcdir\)/lib/asn1|
-mkinclude perl_path_wrapper.sh asn1_deps.pl lib/hx509/pkcs10.asn1 pkcs10_asn1 \$\(heimdalsrcdir\)/lib/hx509 --preserve-binary=CertificationRequestInfo|
-
-#
-# Ensure to update ./static_deps.mk when you add a new entry here!
-#
-mkinclude perl_path_wrapper.sh et_deps.pl lib/asn1/asn1_err.et \$\(heimdalsrcdir\)/lib/asn1|
-mkinclude perl_path_wrapper.sh et_deps.pl lib/hdb/hdb_err.et \$\(heimdalsrcdir\)/lib/hdb|
-mkinclude perl_path_wrapper.sh et_deps.pl lib/krb5/heim_err.et \$\(heimdalsrcdir\)/lib/krb5|
-mkinclude perl_path_wrapper.sh et_deps.pl lib/krb5/k524_err.et \$\(heimdalsrcdir\)/lib/krb5|
-mkinclude perl_path_wrapper.sh et_deps.pl lib/krb5/krb_err.et \$\(heimdalsrcdir\)/lib/krb5|
-mkinclude perl_path_wrapper.sh et_deps.pl lib/krb5/krb5_err.et \$\(heimdalsrcdir\)/lib/krb5|
-mkinclude perl_path_wrapper.sh et_deps.pl lib/gssapi/krb5/gkrb5_err.et \$\(heimdalsrcdir\)/lib/gssapi|
-mkinclude perl_path_wrapper.sh et_deps.pl lib/hx509/hx509_err.et \$\(heimdalsrcdir\)/lib/hx509|
-mkinclude perl_path_wrapper.sh et_deps.pl lib/wind/wind_err.et \$\(heimdalsrcdir\)/lib/wind|
-
-clean::	
-	@-rm -f bin/compile_et bin/asn1_compile
-
-#######################
-# Start SUBSYSTEM HEIMDAL
-[SUBSYSTEM::HEIMDAL]
-CFLAGS = -I$(heimdalbuildsrcdir)
-PUBLIC_DEPENDENCIES = \
-		HEIMDAL_GSSAPI HEIMDAL_KRB5
-# End SUBSYSTEM HEIMDAL
-#######################
-
-HEIMDAL_OBJ_FILES = $(heimdalsrcdir)/lib/vers/print_version.o
-
-#######################
-# Start BINARY compile_et
-[BINARY::samba4kinit]
-PRIVATE_DEPENDENCIES = HEIMDAL_KRB5 HEIMDAL_NTLM
-# End BINARY compile_et
-#######################
-
-samba4kinit_OBJ_FILES = $(heimdalsrcdir)/kuser/kinit.o \
-	$(heimdalsrcdir)/lib/vers/print_version.o \
-	$(heimdalsrcdir)/lib/roken/setprogname.o \
-	$(heimdalsrcdir)/lib/roken/getarg.o 
-
-$(samba4kinit_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken
-
-dist:: $(heimdalsrcdir)/lib/asn1/lex.c $(heimdalsrcdir)/lib/com_err/lex.c \
-	$(heimdalsrcdir)/lib/asn1/parse.c $(heimdalsrcdir)/lib/com_err/parse.c
diff --git a/source4/heimdal_build/internal.m4 b/source4/heimdal_build/internal.m4
new file mode 100644
index 0000000000..18ecbb75cd
--- /dev/null
+++ b/source4/heimdal_build/internal.m4
@@ -0,0 +1,256 @@
+m4_define([upcase],`echo $1 | tr abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ`)dnl
+
+dnl love_FIND_FUNC(func, includes, arguments)
+dnl kind of like AC_CHECK_FUNC, but with headerfiles
+AC_DEFUN([love_FIND_FUNC], [
+
+AC_MSG_CHECKING([for $1])
+AC_CACHE_VAL(ac_cv_love_func_$1,
+[
+AC_LINK_IFELSE([AC_LANG_PROGRAM([[$2]],[[$1($3)]])],
+[eval "ac_cv_love_func_$1=yes"],[eval "ac_cv_love_func_$1=no"])])
+
+eval "ac_res=\$ac_cv_love_func_$1"
+
+if false; then
+	AC_CHECK_FUNCS($1)
+fi
+# $1
+eval "ac_tr_func=HAVE_[]upcase($1)"
+
+case "$ac_res" in
+	yes)
+	AC_DEFINE_UNQUOTED($ac_tr_func)
+	AC_MSG_RESULT([yes])
+	;;
+	no)
+	AC_MSG_RESULT([no])
+	;;
+esac
+
+
+])
+
+dnl Not all systems have err.h, so we provide a replacement. Heimdal
+dnl unconditionally #includes <err.h>, so we need to create an err.h,
+dnl but we can't just have a static one because we don't want to use
+dnl it on systems that have a real err.h. If the system has a real
+dnl err.h, we should use that (eg. on Darwin, the declarations get
+dnl linker attributes added, so we can't guarantee that our local
+dnl declarations will be correct). Phew!
+AC_CHECK_HEADERS([err.h], [],
+	[ cp heimdal/lib/roken/err.hin heimdal_build/err.h ])
+
+AC_CHECK_HEADERS([				\
+	crypt.h					\
+	curses.h				\
+	errno.h					\
+	inttypes.h				\
+	netdb.h					\
+	signal.h				\
+	sys/bswap.h				\
+	sys/file.h				\
+	sys/stropts.h				\
+	sys/timeb.h				\
+	sys/times.h				\
+	sys/uio.h				\
+	sys/un.h				\
+	sys/utsname.h				\
+	term.h					\
+	termcap.h				\
+	time.h					\
+	timezone.h				\
+	ttyname.h				\
+	netinet/in.h				\
+	netinet/in6.h				\
+	netinet6/in6.h
+])
+
+AC_CHECK_FUNCS([				\
+	atexit					\
+	cgetent					\
+	getprogname				\
+	inet_aton				\
+	gethostname				\
+	getnameinfo				\
+	iruserok				\
+	putenv					\
+	rcmd					\
+	readv					\
+	sendmsg					\
+	setitimer				\
+	socket					\
+	strlwr					\
+	strncasecmp				\
+	strptime				\
+	strsep					\
+	strsep_copy				\
+	strtok_r				\
+	strupr					\
+	swab					\
+	umask					\
+	uname					\
+	unsetenv				\
+	closefrom				\
+	hstrerror				\
+	err					\
+	warn					\
+	errx					\
+	warnx					\
+	flock					\
+	getipnodebyname				\
+	getipnodebyaddr				\
+	freehostent				\
+	writev
+])
+
+love_FIND_FUNC(bswap16, [#ifdef HAVE_SYS_BSWAP_H
+#include <sys/bswap.h>
+#endif], 0)
+
+love_FIND_FUNC(bswap32, [#ifdef HAVE_SYS_BSWAP_H
+#include <sys/bswap.h>
+#endif], 0)
+
+AC_DEFUN([AC_KRB_STRUCT_WINSIZE], [
+AC_MSG_CHECKING(for struct winsize)
+AC_CACHE_VAL(ac_cv_struct_winsize, [
+ac_cv_struct_winsize=no
+for i in sys/termios.h sys/ioctl.h; do
+AC_EGREP_HEADER(
+struct[[ 	]]*winsize,dnl
+$i, ac_cv_struct_winsize=yes; break)dnl
+done
+])
+if test "$ac_cv_struct_winsize" = "yes"; then
+  AC_DEFINE(HAVE_STRUCT_WINSIZE, 1, [define if struct winsize is declared in sys/termios.h])
+fi
+AC_MSG_RESULT($ac_cv_struct_winsize)
+AC_EGREP_HEADER(ws_xpixel, termios.h, 
+	AC_DEFINE(HAVE_WS_XPIXEL, 1, [define if struct winsize has ws_xpixel]))
+AC_EGREP_HEADER(ws_ypixel, termios.h, 
+	AC_DEFINE(HAVE_WS_YPIXEL, 1, [define if struct winsize has ws_ypixel]))
+])
+
+AC_KRB_STRUCT_WINSIZE
+
+AC_TYPE_SIGNAL
+if test "$ac_cv_type_signal" = "void" ; then
+	AC_DEFINE(VOID_RETSIGTYPE, 1, [Define if signal handlers return void.])
+fi
+AC_SUBST(VOID_RETSIGTYPE)
+
+
+m4_include(heimdal/cf/check-var.m4)
+
+rk_CHECK_VAR(h_errno, 
+[#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif])
+
+m4_include(heimdal/cf/find-func.m4)
+m4_include(heimdal/cf/find-func-no-libs.m4)
+m4_include(heimdal/cf/find-func-no-libs2.m4)
+m4_include(heimdal/cf/resolv.m4)
+
+smb_save_LIBS=$LIBS
+RESOLV_LIBS=""
+LIBS=""
+
+dnl  This fills in the global LIBS...
+rk_RESOLV
+
+dnl AC_CHECK_LIB_EXT(resolv, RESOLV_LIBS, res_search)
+	SMB_ENABLE(RESOLV,YES)
+
+if test x"$LIBS" != "x"; then
+	RESOLV_LIBS=$LIBS
+fi
+
+LIBS=$smb_save_LIBS
+
+SMB_EXT_LIB(RESOLV,[${RESOLV_LIBS}],[${RESOLV_CFLAGS}],[${RESOLV_CPPFLAGS}],[${RESOLV_LDFLAGS}])
+
+
+# these are disabled unless heimdal is found below
+SMB_ENABLE(KERBEROS_LIB, NO)
+SMB_ENABLE(asn1_compile, NO)
+SMB_ENABLE(compile_et, NO)
+
+#
+# We need bison -y and flex in new versions
+# Otherwise we get random runtime failures
+#
+LEX_YACC_COMBINATIONS=""
+LEX_YACC_COMBINATIONS="$LEX_YACC_COMBINATIONS flex-2.5.33:bison-2.3"
+
+AC_PROG_LEX
+LEX_BASENAME=`basename "$LEX"`
+if test x"$LEX_BASENAME" = x"flex"; then
+	# "flex 2.5.33"
+	FLEX_VERSION=`$LEX --version | cut -d ' ' -f2`
+	AC_MSG_CHECKING(flex version)
+	AC_MSG_RESULT($FLEX_VERSION)
+	FLEX_MAJOR=`echo $FLEX_VERSION | cut -d '.' -f1`
+	FLEX_MINOR=`echo $FLEX_VERSION | cut -d '.' -f2`
+	FLEX_RELEASE=`echo $FLEX_VERSION | cut -d '.' -f3`
+
+	LEX_VERSION="flex-$FLEX_MAJOR.$FLEX_MINOR.$FLEX_RELEASE"
+fi
+
+AC_PROG_YACC
+YACC_BASENAME=`basename "$YACC"`
+if test x"$YACC_BASENAME" = x"bison -y"; then
+	# bison (GNU Bison) 2.3
+	BISON_VERSION=`$YACC --version | head -1 | cut -d ' ' -f4`
+	AC_MSG_CHECKING(bison version)
+	AC_MSG_RESULT($BISON_VERSION)
+	BISON_MAJOR=`echo $BISON_VERSION | cut -d '.' -f1`
+	BISON_MINOR=`echo $BISON_VERSION | cut -d '.' -f2`
+
+	YACC_VERSION="bison-$BISON_MAJOR.$BISON_MINOR"
+fi
+
+AC_MSG_CHECKING(working LEX YACC combination)
+LEX_YACC="no"
+if test x"$LEX_VERSION" != x"" -a x"$YACC_VERSION" != x""; then
+	V="$LEX_VERSION:$YACC_VERSION"
+	for C in $LEX_YACC_COMBINATIONS; do
+		if test x"$V" = x"$C"; then
+			LEX_YACC=$V
+			break;
+		fi
+	done
+fi
+if test x"$LEX_YACC" = x"no"; then
+	LEX=false
+	YACC=false
+fi
+AC_MSG_RESULT($LEX_YACC)
+
+# Portions of heimdal kerberos are unpacked into source/heimdal
+# of the samba source tree.  
+
+# if we ever get to using a host kerberos, we might add conditionals here
+AC_DEFINE(HAVE_KRB5,1,[Whether kerberos is available])
+HAVE_KRB5=YES
+SMB_ENABLE(KERBEROS_LIB, YES)
+SMB_ENABLE(asn1_compile, YES)
+SMB_ENABLE(compile_et, YES)
+
+# only add closefrom if needed
+SMB_ENABLE(HEIMDAL_ROKEN_CLOSEFROM, NO)
+if test t$ac_cv_func_closefrom != tyes; then
+	SMB_ENABLE(HEIMDAL_ROKEN_CLOSEFROM, YES)
+fi
+
+# only add getprogname if needed
+SMB_ENABLE(HEIMDAL_ROKEN_GETPROGNAME, NO)
+SMB_ENABLE(HEIMDAL_ROKEN_GETPROGNAME_H, NO)
+if test t$ac_cv_func_getprogname != tyes; then
+	SMB_ENABLE(HEIMDAL_ROKEN_GETPROGNAME, YES)
+	SMB_ENABLE(HEIMDAL_ROKEN_GETPROGNAME_H, YES)
+fi
diff --git a/source4/heimdal_build/internal.mk b/source4/heimdal_build/internal.mk
new file mode 100644
index 0000000000..17fc8c93ec
--- /dev/null
+++ b/source4/heimdal_build/internal.mk
@@ -0,0 +1,624 @@
+heimdalbuildsrcdir = $(heimdalsrcdir)/../heimdal_build
+
+#######################
+# Start SUBSYSTEM HEIMDAL_KDC
+[SUBSYSTEM::HEIMDAL_KDC]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/kdc
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_KRB5 HEIMDAL_HDB HEIMDAL_HEIM_ASN1 HEIMDAL_DIGEST_ASN1 HEIMDAL_KX509_ASN1
+PUBLIC_DEPENDENCIES = HEIMDAL_NTLM HEIMDAL_HCRYPTO
+# End SUBSYSTEM HEIMDAL_KDC
+#######################
+
+
+HEIMDAL_KDC_OBJ_FILES = \
+	$(heimdalsrcdir)/kdc/default_config.o \
+	$(heimdalsrcdir)/kdc/kerberos5.o \
+	$(heimdalsrcdir)/kdc/krb5tgs.o \
+	$(heimdalsrcdir)/kdc/pkinit.o \
+	$(heimdalsrcdir)/kdc/log.o \
+	$(heimdalsrcdir)/kdc/misc.o \
+	$(heimdalsrcdir)/kdc/524.o \
+	$(heimdalsrcdir)/kdc/kerberos4.o \
+	$(heimdalsrcdir)/kdc/kaserver.o \
+	$(heimdalsrcdir)/kdc/digest.o \
+	$(heimdalsrcdir)/kdc/process.o \
+	$(heimdalsrcdir)/kdc/windc.o \
+	$(heimdalsrcdir)/kdc/kx509.o
+
+[SUBSYSTEM::HEIMDAL_NTLM]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/ntlm
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_HCRYPTO HEIMDAL_KRB5
+
+HEIMDAL_NTLM_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/ntlm/ntlm.o
+
+[SUBSYSTEM::HEIMDAL_HDB_KEYS]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/hdb
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_HCRYPTO HEIMDAL_KRB5 \
+					   HEIMDAL_HDB_ASN1
+
+HEIMDAL_HDB_KEYS_OBJ_FILES = $(heimdalsrcdir)/lib/hdb/keys.o
+
+#######################
+# Start SUBSYSTEM HEIMDAL_HDB
+[SUBSYSTEM::HEIMDAL_HDB]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/hdb
+PRIVATE_DEPENDENCIES = HDB_LDB HEIMDAL_KRB5 HEIMDAL_HDB_KEYS HEIMDAL_ROKEN HEIMDAL_HCRYPTO HEIMDAL_COM_ERR HEIMDAL_HDB_ASN1
+# End SUBSYSTEM HEIMDAL_HDB
+#######################
+
+HEIMDAL_HDB_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/hdb/db.o \
+	$(heimdalsrcdir)/lib/hdb/dbinfo.o \
+	$(heimdalsrcdir)/lib/hdb/hdb.o \
+	$(heimdalsrcdir)/lib/hdb/ext.o \
+	$(heimdalsrcdir)/lib/hdb/keytab.o \
+	$(heimdalsrcdir)/lib/hdb/mkey.o \
+	$(heimdalsrcdir)/lib/hdb/ndbm.o \
+	$(heimdalsrcdir)/lib/hdb/hdb_err.o
+
+#######################
+# Start SUBSYSTEM HEIMDAL_GSSAPI
+[SUBSYSTEM::HEIMDAL_GSSAPI]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/gssapi -I$(heimdalsrcdir)/lib/gssapi/gssapi -I$(heimdalsrcdir)/lib/gssapi/spnego -I$(heimdalsrcdir)/lib/gssapi/krb5 -I$(heimdalsrcdir)/lib/gssapi/mech
+PRIVATE_DEPENDENCIES = HEIMDAL_HCRYPTO HEIMDAL_HEIM_ASN1 HEIMDAL_SPNEGO_ASN1
+PUBLIC_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_KRB5
+# End SUBSYSTEM HEIMDAL_GSSAPI
+#######################
+
+HEIMDAL_GSSAPI_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/gssapi/mech/context.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_krb5.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_mech_switch.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_process_context_token.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_buffer_set.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_add_cred.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_add_oid_set_member.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_compare_name.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_release_oid_set.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_create_empty_oid_set.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_decapsulate_token.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_cred_by_oid.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_canonicalize_name.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_sec_context_by_oid.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_names_for_mech.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_mechs_for_name.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_wrap_size_limit.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_names.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_verify.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_display_name.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_duplicate_oid.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_display_status.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_release_buffer.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_release_oid.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_test_oid_set_member.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_release_cred.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_set_sec_context_option.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_export_name.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_seal.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_acquire_cred.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_unseal.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_verify_mic.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_accept_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_cred_by_mech.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_indicate_mechs.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_delete_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_sign.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_utils.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_init_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_oid_equal.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_oid_to_str.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_context_time.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_encapsulate_token.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_get_mic.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_import_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_cred.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_wrap.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_import_name.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_duplicate_name.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_unwrap.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_export_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_inquire_context.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_release_name.o \
+	$(heimdalsrcdir)/lib/gssapi/mech/gss_set_cred_option.o \
+	$(heimdalsrcdir)/lib/gssapi/asn1_GSSAPIContextToken.o \
+	$(heimdalsrcdir)/lib/gssapi/spnego/init_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/spnego/external.o \
+	$(heimdalsrcdir)/lib/gssapi/spnego/compat.o \
+	$(heimdalsrcdir)/lib/gssapi/spnego/context_stubs.o \
+	$(heimdalsrcdir)/lib/gssapi/spnego/cred_stubs.o \
+	$(heimdalsrcdir)/lib/gssapi/spnego/accept_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/copy_ccache.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/delete_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/init_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/context_time.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/init.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/address_to_krb5addr.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/get_mic.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_context.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/add_cred.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_cred.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_cred_by_oid.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_cred_by_mech.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_mechs_for_name.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_names_for_mech.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/indicate_mechs.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/inquire_sec_context_by_oid.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/export_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/import_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/duplicate_name.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/import_name.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/compare_name.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/export_name.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/canonicalize_name.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/unwrap.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/wrap.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/release_name.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/cfx.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/8003.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/arcfour.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/encapsulate.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/display_name.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/sequence.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/display_status.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/release_buffer.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/external.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/compat.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/acquire_cred.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/release_cred.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/set_cred_option.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/decapsulate.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/verify_mic.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/accept_sec_context.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/set_sec_context_option.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/process_context_token.o \
+	$(heimdalsrcdir)/lib/gssapi/krb5/prf.o
+
+
+#######################
+# Start SUBSYSTEM HEIMDAL_KRB5
+[SUBSYSTEM::HEIMDAL_KRB5]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/krb5 -I$(heimdalsrcdir)/lib/asn1 -I$(heimdalsrcdir)/lib/com_err 
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_PKINIT_ASN1 HEIMDAL_WIND
+PUBLIC_DEPENDENCIES = HEIMDAL_KRB5_ASN1 HEIMDAL_GLUE HEIMDAL_HX509 HEIMDAL_HCRYPTO
+# End SUBSYSTEM HEIMDAL_KRB5
+#######################
+
+HEIMDAL_KRB5_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/krb5/acache.o \
+	$(heimdalsrcdir)/lib/krb5/add_et_list.o \
+	$(heimdalsrcdir)/lib/krb5/addr_families.o \
+	$(heimdalsrcdir)/lib/krb5/appdefault.o \
+	$(heimdalsrcdir)/lib/krb5/asn1_glue.o \
+	$(heimdalsrcdir)/lib/krb5/auth_context.o \
+	$(heimdalsrcdir)/lib/krb5/build_ap_req.o \
+	$(heimdalsrcdir)/lib/krb5/build_auth.o \
+	$(heimdalsrcdir)/lib/krb5/cache.o \
+	$(heimdalsrcdir)/lib/krb5/changepw.o \
+	$(heimdalsrcdir)/lib/krb5/codec.o \
+	$(heimdalsrcdir)/lib/krb5/config_file.o \
+	$(heimdalsrcdir)/lib/krb5/config_file_netinfo.o \
+	$(heimdalsrcdir)/lib/krb5/constants.o \
+	$(heimdalsrcdir)/lib/krb5/context.o \
+	$(heimdalsrcdir)/lib/krb5/convert_creds.o \
+	$(heimdalsrcdir)/lib/krb5/copy_host_realm.o \
+	$(heimdalsrcdir)/lib/krb5/crc.o \
+	$(heimdalsrcdir)/lib/krb5/creds.o \
+	$(heimdalsrcdir)/lib/krb5/crypto.o \
+	$(heimdalsrcdir)/lib/krb5/data.o \
+	$(heimdalsrcdir)/lib/krb5/eai_to_heim_errno.o \
+	$(heimdalsrcdir)/lib/krb5/error_string.o \
+	$(heimdalsrcdir)/lib/krb5/expand_hostname.o \
+	$(heimdalsrcdir)/lib/krb5/fcache.o \
+	$(heimdalsrcdir)/lib/krb5/free.o \
+	$(heimdalsrcdir)/lib/krb5/free_host_realm.o \
+	$(heimdalsrcdir)/lib/krb5/generate_seq_number.o \
+	$(heimdalsrcdir)/lib/krb5/generate_subkey.o \
+	$(heimdalsrcdir)/lib/krb5/get_cred.o \
+	$(heimdalsrcdir)/lib/krb5/get_default_principal.o \
+	$(heimdalsrcdir)/lib/krb5/get_default_realm.o \
+	$(heimdalsrcdir)/lib/krb5/get_for_creds.o \
+	$(heimdalsrcdir)/lib/krb5/get_host_realm.o \
+	$(heimdalsrcdir)/lib/krb5/get_in_tkt.o \
+	$(heimdalsrcdir)/lib/krb5/get_in_tkt_with_keytab.o \
+	$(heimdalsrcdir)/lib/krb5/get_port.o \
+	$(heimdalsrcdir)/lib/krb5/init_creds.o \
+	$(heimdalsrcdir)/lib/krb5/init_creds_pw.o \
+	$(heimdalsrcdir)/lib/krb5/kcm.o \
+	$(heimdalsrcdir)/lib/krb5/keyblock.o \
+	$(heimdalsrcdir)/lib/krb5/keytab.o \
+	$(heimdalsrcdir)/lib/krb5/keytab_any.o \
+	$(heimdalsrcdir)/lib/krb5/keytab_file.o \
+	$(heimdalsrcdir)/lib/krb5/keytab_memory.o \
+	$(heimdalsrcdir)/lib/krb5/keytab_keyfile.o \
+	$(heimdalsrcdir)/lib/krb5/keytab_krb4.o \
+	$(heimdalsrcdir)/lib/krb5/krbhst.o \
+	$(heimdalsrcdir)/lib/krb5/log.o \
+	$(heimdalsrcdir)/lib/krb5/mcache.o \
+	$(heimdalsrcdir)/lib/krb5/misc.o \
+	$(heimdalsrcdir)/lib/krb5/mk_error.o \
+	$(heimdalsrcdir)/lib/krb5/mk_priv.o \
+	$(heimdalsrcdir)/lib/krb5/mk_rep.o \
+	$(heimdalsrcdir)/lib/krb5/mk_req.o \
+	$(heimdalsrcdir)/lib/krb5/mk_req_ext.o \
+	$(heimdalsrcdir)/lib/krb5/mit_glue.o \
+	$(heimdalsrcdir)/lib/krb5/n-fold.o \
+	$(heimdalsrcdir)/lib/krb5/padata.o \
+	$(heimdalsrcdir)/lib/krb5/pkinit.o \
+	$(heimdalsrcdir)/lib/krb5/plugin.o \
+	$(heimdalsrcdir)/lib/krb5/principal.o \
+	$(heimdalsrcdir)/lib/krb5/pac.o \
+	$(heimdalsrcdir)/lib/krb5/prompter_posix.o \
+	$(heimdalsrcdir)/lib/krb5/rd_cred.o \
+	$(heimdalsrcdir)/lib/krb5/rd_error.o \
+	$(heimdalsrcdir)/lib/krb5/rd_priv.o \
+	$(heimdalsrcdir)/lib/krb5/rd_rep.o \
+	$(heimdalsrcdir)/lib/krb5/rd_req.o \
+	$(heimdalsrcdir)/lib/krb5/replay.o \
+	$(heimdalsrcdir)/lib/krb5/send_to_kdc.o \
+	$(heimdalsrcdir)/lib/krb5/set_default_realm.o \
+	$(heimdalsrcdir)/lib/krb5/store.o \
+	$(heimdalsrcdir)/lib/krb5/store_emem.o \
+	$(heimdalsrcdir)/lib/krb5/store_fd.o \
+	$(heimdalsrcdir)/lib/krb5/store_mem.o \
+	$(heimdalsrcdir)/lib/krb5/ticket.o \
+	$(heimdalsrcdir)/lib/krb5/time.o \
+	$(heimdalsrcdir)/lib/krb5/transited.o \
+	$(heimdalsrcdir)/lib/krb5/v4_glue.o \
+	$(heimdalsrcdir)/lib/krb5/version.o \
+	$(heimdalsrcdir)/lib/krb5/warn.o \
+	$(heimdalsrcdir)/lib/krb5/krb5_err.o \
+	$(heimdalsrcdir)/lib/krb5/heim_err.o \
+	$(heimdalsrcdir)/lib/krb5/k524_err.o \
+	$(heimdalsrcdir)/lib/krb5/krb_err.o
+
+#######################
+# Start SUBSYSTEM HEIMDAL_HEIM_ASN1
+[SUBSYSTEM::HEIMDAL_HEIM_ASN1]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/asn1
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_COM_ERR
+# End SUBSYSTEM HEIMDAL_KRB5
+#######################
+
+HEIMDAL_HEIM_ASN1_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/asn1/der_get.o \
+	$(heimdalsrcdir)/lib/asn1/der_put.o \
+	$(heimdalsrcdir)/lib/asn1/der_free.o \
+	$(heimdalsrcdir)/lib/asn1/der_format.o \
+	$(heimdalsrcdir)/lib/asn1/der_length.o \
+	$(heimdalsrcdir)/lib/asn1/der_copy.o \
+	$(heimdalsrcdir)/lib/asn1/der_cmp.o \
+	$(heimdalsrcdir)/lib/asn1/extra.o \
+	$(heimdalsrcdir)/lib/asn1/timegm.o \
+	$(heimdalsrcdir)/lib/asn1/asn1_err.o
+
+#######################
+# Start SUBSYSTEM HEIMDAL_HCRYPTO_IMATH
+[SUBSYSTEM::HEIMDAL_HCRYPTO_IMATH]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/hcrypto/imath 
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN 
+# End SUBSYSTEM HEIMDAL_HCRYPTO_IMATH
+#######################
+
+HEIMDAL_HCRYPTO_IMATH_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/hcrypto/imath/imath.o \
+	$(heimdalsrcdir)/lib/hcrypto/imath/iprime.o
+
+[SUBSYSTEM::HEIMDAL_HCRYPTO]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/hcrypto -I$(heimdalsrcdir)/lib
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN HEIMDAL_HEIM_ASN1 HEIMDAL_HCRYPTO_IMATH HEIMDAL_RFC2459_ASN1
+# End SUBSYSTEM HEIMDAL_HCRYPTO
+#######################
+
+HEIMDAL_HCRYPTO_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/hcrypto/aes.o \
+	$(heimdalsrcdir)/lib/hcrypto/bn.o \
+	$(heimdalsrcdir)/lib/hcrypto/dh.o \
+	$(heimdalsrcdir)/lib/hcrypto/dh-imath.o \
+	$(heimdalsrcdir)/lib/hcrypto/des.o \
+	$(heimdalsrcdir)/lib/hcrypto/dsa.o \
+	$(heimdalsrcdir)/lib/hcrypto/engine.o \
+	$(heimdalsrcdir)/lib/hcrypto/md2.o \
+	$(heimdalsrcdir)/lib/hcrypto/md4.o \
+	$(heimdalsrcdir)/lib/hcrypto/md5.o \
+	$(heimdalsrcdir)/lib/hcrypto/rsa.o \
+	$(heimdalsrcdir)/lib/hcrypto/rsa-imath.o \
+	$(heimdalsrcdir)/lib/hcrypto/rc2.o \
+	$(heimdalsrcdir)/lib/hcrypto/rc4.o \
+	$(heimdalsrcdir)/lib/hcrypto/rijndael-alg-fst.o \
+	$(heimdalsrcdir)/lib/hcrypto/rnd_keys.o \
+	$(heimdalsrcdir)/lib/hcrypto/sha.o \
+	$(heimdalsrcdir)/lib/hcrypto/sha256.o \
+	$(heimdalsrcdir)/lib/hcrypto/ui.o \
+	$(heimdalsrcdir)/lib/hcrypto/evp.o \
+	$(heimdalsrcdir)/lib/hcrypto/pkcs5.o \
+	$(heimdalsrcdir)/lib/hcrypto/pkcs12.o \
+	$(heimdalsrcdir)/lib/hcrypto/rand.o \
+	$(heimdalsrcdir)/lib/hcrypto/rand-egd.o \
+	$(heimdalsrcdir)/lib/hcrypto/rand-unix.o \
+	$(heimdalsrcdir)/lib/hcrypto/rand-fortuna.o \
+	$(heimdalsrcdir)/lib/hcrypto/rand-timer.o \
+	$(heimdalsrcdir)/lib/hcrypto/hmac.o \
+	$(heimdalsrcdir)/lib/hcrypto/camellia.o \
+	$(heimdalsrcdir)/lib/hcrypto/camellia-ntt.o
+
+#######################
+# Start SUBSYSTEM HEIMDAL_HX509
+[SUBSYSTEM::HEIMDAL_HX509]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/hx509 
+PRIVATE_DEPENDENCIES = \
+	HEIMDAL_ROKEN HEIMDAL_COM_ERR \
+	HEIMDAL_HEIM_ASN1 HEIMDAL_HCRYPTO \
+	HEIMDAL_CMS_ASN1 HEIMDAL_RFC2459_ASN1 \
+	HEIMDAL_OCSP_ASN1 HEIMDAL_PKCS8_ASN1 \
+	HEIMDAL_PKCS9_ASN1 HEIMDAL_PKCS12_ASN1 \
+	HEIMDAL_PKINIT_ASN1 HEIMDAL_PKCS10_ASN1 \
+	HEIMDAL_WIND
+# End SUBSYSTEM HEIMDAL_HX509
+#######################
+
+HEIMDAL_HX509_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/hx509/ca.o \
+	$(heimdalsrcdir)/lib/hx509/cert.o \
+	$(heimdalsrcdir)/lib/hx509/cms.o \
+	$(heimdalsrcdir)/lib/hx509/collector.o \
+	$(heimdalsrcdir)/lib/hx509/crypto.o \
+	$(heimdalsrcdir)/lib/hx509/error.o \
+	$(heimdalsrcdir)/lib/hx509/env.o \
+	$(heimdalsrcdir)/lib/hx509/file.o \
+	$(heimdalsrcdir)/lib/hx509/keyset.o \
+	$(heimdalsrcdir)/lib/hx509/ks_dir.o \
+	$(heimdalsrcdir)/lib/hx509/ks_file.o \
+	$(heimdalsrcdir)/lib/hx509/ks_keychain.o \
+	$(heimdalsrcdir)/lib/hx509/ks_mem.o \
+	$(heimdalsrcdir)/lib/hx509/ks_null.o \
+	$(heimdalsrcdir)/lib/hx509/ks_p11.o \
+	$(heimdalsrcdir)/lib/hx509/ks_p12.o \
+	$(heimdalsrcdir)/lib/hx509/lock.o \
+	$(heimdalsrcdir)/lib/hx509/name.o \
+	$(heimdalsrcdir)/lib/hx509/peer.o \
+	$(heimdalsrcdir)/lib/hx509/print.o \
+	$(heimdalsrcdir)/lib/hx509/req.o \
+	$(heimdalsrcdir)/lib/hx509/revoke.o \
+	$(heimdalsrcdir)/lib/hx509/hx509_err.o
+
+#######################
+# Start SUBSYSTEM HEIMDAL_WIND
+[SUBSYSTEM::HEIMDAL_WIND]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/wind 
+PRIVATE_DEPENDENCIES = \
+	HEIMDAL_ROKEN HEIMDAL_COM_ERR
+
+HEIMDAL_WIND_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/wind/wind_err.o \
+	$(heimdalsrcdir)/lib/wind/stringprep.o \
+	$(heimdalsrcdir)/lib/wind/errorlist.o \
+	$(heimdalsrcdir)/lib/wind/errorlist_table.o \
+	$(heimdalsrcdir)/lib/wind/normalize.o \
+	$(heimdalsrcdir)/lib/wind/normalize_table.o \
+	$(heimdalsrcdir)/lib/wind/combining.o \
+	$(heimdalsrcdir)/lib/wind/combining_table.o \
+	$(heimdalsrcdir)/lib/wind/utf8.o \
+	$(heimdalsrcdir)/lib/wind/bidi.o \
+	$(heimdalsrcdir)/lib/wind/bidi_table.o \
+	$(heimdalsrcdir)/lib/wind/ldap.o \
+	$(heimdalsrcdir)/lib/wind/map.o \
+	$(heimdalsrcdir)/lib/wind/map_table.o
+# End SUBSYSTEM HEIMDAL_WIND
+#######################
+
+[SUBSYSTEM::HEIMDAL_ROKEN_GETPROGNAME]
+
+HEIMDAL_ROKEN_GETPROGNAME_OBJ_FILES = $(heimdalsrcdir)/lib/roken/getprogname.o
+$(HEIMDAL_ROKEN_GETPROGNAME_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken  -I$(socketwrappersrcdir)
+
+[SUBSYSTEM::HEIMDAL_ROKEN_CLOSEFROM] 
+
+HEIMDAL_ROKEN_CLOSEFROM_OBJ_FILES = $(heimdalsrcdir)/lib/roken/closefrom.o
+$(HEIMDAL_ROKEN_CLOSEFROM_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken  -I$(socketwrappersrcdir)
+
+[SUBSYSTEM::HEIMDAL_ROKEN_GETPROGNAME_H] 
+
+HEIMDAL_ROKEN_GETPROGNAME_H_OBJ_FILES = $(heimdalsrcdir)/lib/roken/getprogname.ho
+$(HEIMDAL_ROKEN_GETPROGNAME_H_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken  -I$(socketwrappersrcdir)
+
+#######################
+# Start SUBSYSTEM HEIMDAL_ROKEN
+[SUBSYSTEM::HEIMDAL_ROKEN]
+CFLAGS =  -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken -I$(socketwrappersrcdir)
+PUBLIC_DEPENDENCIES = \
+			HEIMDAL_ROKEN_GETPROGNAME \
+			HEIMDAL_ROKEN_CLOSEFROM \
+			RESOLV \
+			LIBREPLACE_NETWORK
+# End SUBSYSTEM HEIMDAL_ROKEN
+#######################
+
+HEIMDAL_ROKEN_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/roken/base64.o \
+	$(heimdalsrcdir)/lib/roken/hex.o \
+	$(heimdalsrcdir)/lib/roken/bswap.o \
+	$(heimdalsrcdir)/lib/roken/dumpdata.o \
+	$(heimdalsrcdir)/lib/roken/emalloc.o \
+	$(heimdalsrcdir)/lib/roken/ecalloc.o \
+	$(heimdalsrcdir)/lib/roken/get_window_size.o \
+	$(heimdalsrcdir)/lib/roken/h_errno.o \
+	$(heimdalsrcdir)/lib/roken/issuid.o \
+	$(heimdalsrcdir)/lib/roken/net_read.o \
+	$(heimdalsrcdir)/lib/roken/net_write.o \
+	$(heimdalsrcdir)/lib/roken/socket.o \
+	$(heimdalsrcdir)/lib/roken/parse_time.o \
+	$(heimdalsrcdir)/lib/roken/parse_units.o \
+	$(heimdalsrcdir)/lib/roken/resolve.o \
+	$(heimdalsrcdir)/lib/roken/roken_gethostby.o \
+	$(heimdalsrcdir)/lib/roken/signal.o \
+	$(heimdalsrcdir)/lib/roken/vis.o \
+	$(heimdalsrcdir)/lib/roken/strlwr.o \
+	$(heimdalsrcdir)/lib/roken/strsep_copy.o \
+	$(heimdalsrcdir)/lib/roken/strsep.o \
+	$(heimdalsrcdir)/lib/roken/strupr.o \
+	$(heimdalsrcdir)/lib/roken/strpool.o \
+	$(heimdalsrcdir)/lib/roken/estrdup.o \
+	$(heimdalsrcdir)/lib/roken/erealloc.o \
+	$(heimdalsrcdir)/lib/roken/simple_exec.o \
+	$(heimdalsrcdir)/lib/roken/strcollect.o \
+	$(heimdalsrcdir)/lib/roken/rtbl.o \
+	$(heimdalbuildsrcdir)/replace.o
+
+#######################
+# Start SUBSYSTEM HEIMDAL_GLUE
+[SUBSYSTEM::HEIMDAL_GLUE]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/krb5 -I$(heimdalsrcdir)/lib/asn1 -I$(heimdalsrcdir)/lib/com_err 
+PUBLIC_DEPENDENCIES = LIBNETIF LIBSAMBA-HOSTCONFIG
+# End SUBSYSTEM HEIMDAL_GLUE
+#######################
+
+HEIMDAL_GLUE_OBJ_FILES = $(heimdalbuildsrcdir)/glue.o
+
+#######################
+# Start SUBSYSTEM HEIMDAL_COM_ERR
+[SUBSYSTEM::HEIMDAL_COM_ERR]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/com_err
+PRIVATE_DEPENDENCIES = HEIMDAL_ROKEN
+# End SUBSYSTEM HEIMDAL_COM_ERR
+#######################
+
+HEIMDAL_COM_ERR_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/com_err/com_err.o \
+	$(heimdalsrcdir)/lib/com_err/error.o
+
+#######################
+# Start SUBSYSTEM HEIMDAL_ASN1_COMPILE_LEX
+[SUBSYSTEM::HEIMDAL_ASN1_COMPILE_LEX]
+# End SUBSYSTEM HEIMDAL_ASN1_COMPILE_LEX
+#######################
+
+HEIMDAL_ASN1_COMPILE_LEX_OBJ_FILES = $(heimdalsrcdir)/lib/asn1/lex.ho 
+$(HEIMDAL_ASN1_COMPILE_LEX_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/asn1 -I$(heimdalsrcdir)/lib/roken -I$(socketwrappersrcdir)
+
+#######################
+# Start BINARY asn1_compile
+[BINARY::asn1_compile]
+USE_HOSTCC = YES
+PRIVATE_DEPENDENCIES = HEIMDAL_ASN1_COMPILE_LEX HEIMDAL_ROKEN_GETPROGNAME_H LIBREPLACE_NETWORK
+
+ASN1C = $(builddir)/bin/asn1_compile
+
+asn1_compile_OBJ_FILES = \
+	$(heimdalsrcdir)/lib/asn1/main.ho \
+	$(heimdalsrcdir)/lib/asn1/gen.ho \
+	$(heimdalsrcdir)/lib/asn1/gen_copy.ho \
+	$(heimdalsrcdir)/lib/asn1/gen_decode.ho \
+	$(heimdalsrcdir)/lib/asn1/gen_encode.ho \
+	$(heimdalsrcdir)/lib/asn1/gen_free.ho \
+	$(heimdalsrcdir)/lib/asn1/gen_glue.ho \
+	$(heimdalsrcdir)/lib/asn1/gen_length.ho \
+	$(heimdalsrcdir)/lib/asn1/gen_seq.ho \
+	$(heimdalsrcdir)/lib/asn1/hash.ho \
+	$(heimdalsrcdir)/lib/asn1/parse.ho \
+	$(heimdalsrcdir)/lib/roken/emalloc.ho \
+	$(heimdalsrcdir)/lib/roken/getarg.ho \
+	$(heimdalsrcdir)/lib/roken/setprogname.ho \
+	$(heimdalsrcdir)/lib/roken/strupr.ho \
+	$(heimdalsrcdir)/lib/roken/get_window_size.ho \
+	$(heimdalsrcdir)/lib/roken/estrdup.ho \
+	$(heimdalsrcdir)/lib/roken/ecalloc.ho \
+	$(heimdalsrcdir)/lib/asn1/symbol.ho \
+	$(heimdalsrcdir)/lib/vers/print_version.ho \
+	$(socketwrappersrcdir)/socket_wrapper.ho \
+	$(heimdalbuildsrcdir)/replace.ho
+
+$(asn1_compile_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken -I$(heimdalsrcdir)/lib/asn1
+
+# End BINARY asn1_compile
+#######################
+
+#######################
+# Start SUBSYSTEM HEIMDAL_COM_ERR_COMPILE_LEX
+[SUBSYSTEM::HEIMDAL_COM_ERR_COMPILE_LEX]
+CFLAGS = -I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/com_err -I$(heimdalsrcdir)/lib/roken  -I$(socketwrappersrcdir)
+# End SUBSYSTEM HEIMDAL_COM_ERR_COMPILE_LEX
+#######################
+
+HEIMDAL_COM_ERR_COMPILE_LEX_OBJ_FILES = $(heimdalsrcdir)/lib/com_err/lex.ho 
+
+#######################
+# Start BINARY compile_et
+[BINARY::compile_et]
+USE_HOSTCC = YES
+PRIVATE_DEPENDENCIES = HEIMDAL_COM_ERR_COMPILE_LEX HEIMDAL_ROKEN_GETPROGNAME_H LIBREPLACE_NETWORK
+# End BINARY compile_et
+#######################
+
+ET_COMPILER = $(builddir)/bin/compile_et
+
+compile_et_OBJ_FILES = $(heimdalsrcdir)/lib/vers/print_version.ho \
+	$(heimdalsrcdir)/lib/com_err/parse.ho \
+	$(heimdalsrcdir)/lib/com_err/compile_et.ho \
+	$(heimdalsrcdir)/lib/roken/getarg.ho \
+	$(heimdalsrcdir)/lib/roken/get_window_size.ho \
+	$(heimdalsrcdir)/lib/roken/strupr.ho \
+	$(heimdalsrcdir)/lib/roken/setprogname.ho \
+	$(socketwrappersrcdir)/socket_wrapper.ho \
+	$(heimdalbuildsrcdir)/replace.ho
+
+$(compile_et_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken
+
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/hdb/hdb.asn1 hdb_asn1 \$\(heimdalsrcdir\)/lib/hdb |
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/gssapi/spnego/spnego.asn1 spnego_asn1 \$\(heimdalsrcdir\)/lib/gssapi --sequence=MechTypeList |
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/gssapi/mech/gssapi.asn1 gssapi_asn1 \$\(heimdalsrcdir\)/lib/gssapi|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/k5.asn1 krb5_asn1 \$\(heimdalsrcdir\)/lib/asn1 --encode-rfc1510-bit-string --sequence=KRB5SignedPathPrincipals --sequence=AuthorizationData --sequence=METHOD-DATA|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/digest.asn1 digest_asn1 \$\(heimdalsrcdir\)/lib/asn1|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/pkcs8.asn1 pkcs8_asn1 \$\(heimdalsrcdir\)/lib/asn1|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/pkcs9.asn1 pkcs9_asn1 \$\(heimdalsrcdir\)/lib/asn1|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/pkcs12.asn1 pkcs12_asn1 \$\(heimdalsrcdir\)/lib/asn1|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/rfc2459.asn1 rfc2459_asn1 \$\(heimdalsrcdir\)/lib/asn1 --preserve-binary=TBSCertificate --preserve-binary=TBSCRLCertList --preserve-binary=Name --sequence=GeneralNames --sequence=Extensions --sequence=CRLDistributionPoints|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/pkinit.asn1 pkinit_asn1 \$\(heimdalsrcdir\)/lib/asn1|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/CMS.asn1 cms_asn1 \$\(heimdalsrcdir\)/lib/asn1|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/hx509/ocsp.asn1 ocsp_asn1 \$\(heimdalsrcdir\)/lib/hx509 --preserve-binary=OCSPTBSRequest --preserve-binary=OCSPResponseData|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/asn1/kx509.asn1 kx509_asn1 \$\(heimdalsrcdir\)/lib/asn1|
+mkinclude perl_path_wrapper.sh asn1_deps.pl lib/hx509/pkcs10.asn1 pkcs10_asn1 \$\(heimdalsrcdir\)/lib/hx509 --preserve-binary=CertificationRequestInfo|
+
+#
+# Ensure to update ./static_deps.mk when you add a new entry here!
+#
+mkinclude perl_path_wrapper.sh et_deps.pl lib/asn1/asn1_err.et \$\(heimdalsrcdir\)/lib/asn1|
+mkinclude perl_path_wrapper.sh et_deps.pl lib/hdb/hdb_err.et \$\(heimdalsrcdir\)/lib/hdb|
+mkinclude perl_path_wrapper.sh et_deps.pl lib/krb5/heim_err.et \$\(heimdalsrcdir\)/lib/krb5|
+mkinclude perl_path_wrapper.sh et_deps.pl lib/krb5/k524_err.et \$\(heimdalsrcdir\)/lib/krb5|
+mkinclude perl_path_wrapper.sh et_deps.pl lib/krb5/krb_err.et \$\(heimdalsrcdir\)/lib/krb5|
+mkinclude perl_path_wrapper.sh et_deps.pl lib/krb5/krb5_err.et \$\(heimdalsrcdir\)/lib/krb5|
+mkinclude perl_path_wrapper.sh et_deps.pl lib/gssapi/krb5/gkrb5_err.et \$\(heimdalsrcdir\)/lib/gssapi|
+mkinclude perl_path_wrapper.sh et_deps.pl lib/hx509/hx509_err.et \$\(heimdalsrcdir\)/lib/hx509|
+mkinclude perl_path_wrapper.sh et_deps.pl lib/wind/wind_err.et \$\(heimdalsrcdir\)/lib/wind|
+
+clean::	
+	@-rm -f bin/compile_et bin/asn1_compile
+
+#######################
+# Start SUBSYSTEM HEIMDAL
+[SUBSYSTEM::HEIMDAL]
+CFLAGS = -I$(heimdalbuildsrcdir)
+PUBLIC_DEPENDENCIES = \
+		HEIMDAL_GSSAPI HEIMDAL_KRB5
+# End SUBSYSTEM HEIMDAL
+#######################
+
+HEIMDAL_OBJ_FILES = $(heimdalsrcdir)/lib/vers/print_version.o
+
+#######################
+# Start BINARY compile_et
+[BINARY::samba4kinit]
+PRIVATE_DEPENDENCIES = HEIMDAL_KRB5 HEIMDAL_NTLM
+# End BINARY compile_et
+#######################
+
+samba4kinit_OBJ_FILES = $(heimdalsrcdir)/kuser/kinit.o \
+	$(heimdalsrcdir)/lib/vers/print_version.o \
+	$(heimdalsrcdir)/lib/roken/setprogname.o \
+	$(heimdalsrcdir)/lib/roken/getarg.o 
+
+$(samba4kinit_OBJ_FILES): CFLAGS+=-I$(heimdalbuildsrcdir) -I$(heimdalsrcdir)/lib/roken
+
+dist:: $(heimdalsrcdir)/lib/asn1/lex.c $(heimdalsrcdir)/lib/com_err/lex.c \
+	$(heimdalsrcdir)/lib/asn1/parse.c $(heimdalsrcdir)/lib/com_err/parse.c
diff --git a/source4/main.mk b/source4/main.mk
index 3f3aea87e6..f0ce9685f9 100644
--- a/source4/main.mk
+++ b/source4/main.mk
@@ -1,5 +1,5 @@
 mkinclude dynconfig/config.mk
-mkinclude heimdal_build/config.mk
+mkinclude heimdal_build/internal.mk
 mkinclude config.mk
 mkinclude dsdb/config.mk
 mkinclude smbd/config.mk
-- 
cgit