auth/gensec: align common elements between gse_context and gensec_gssapi_state
[gd/samba-autobuild/.git] / source3 / wscript
index d88faa2104494adb99b09ed7eb656bd790f6b2df..1a5a5c4b2390ef421313d217faad24644c8a454f 100644 (file)
@@ -1,10 +1,6 @@
 #! /usr/bin/env python
 
-srcdir = '..'
-blddir = 'bin'
-
-APPNAME='samba'
-VERSION=None
+srcdir=".."
 
 import sys, os
 from optparse import SUPPRESS_HELP
@@ -15,17 +11,9 @@ import build.charset
 import samba_utils, samba_version
 import samba3
 
+Options.default_prefix = '/usr/local/samba'
+
 def set_options(opt):
-    if not os.getenv('TOPLEVEL_BUILD'):
-        opt.BUILTIN_DEFAULT('NONE')
-        opt.PRIVATE_EXTENSION_DEFAULT('s3')
-        opt.RECURSE('../lib/replace')
-        opt.RECURSE('build')
-        opt.RECURSE('selftest')
-        opt.RECURSE('../lib/nss_wrapper')
-        opt.RECURSE('../lib/socket_wrapper')
-        opt.RECURSE('../lib/tevent')
-        opt.RECURSE('../lib/tdb_compat')
 
     opt.add_option('--with-static-modules',
                    help=("Comma-separated list of names of modules to statically link in"),
@@ -40,11 +28,10 @@ def set_options(opt):
     opt.SAMBA3_ADD_OPTION('winbind')
     opt.SAMBA3_ADD_OPTION('swat')
     opt.SAMBA3_ADD_OPTION('ads')
-    opt.SAMBA3_ADD_OPTION('krb5')
+    opt.SAMBA3_ADD_OPTION('mit-krb5-checks', default=False)
     opt.SAMBA3_ADD_OPTION('ldap')
     opt.SAMBA3_ADD_OPTION('cups', with_name="enable", without_name="disable")
     opt.SAMBA3_ADD_OPTION('iprint', with_name="enable", without_name="disable")
-    opt.SAMBA3_ADD_OPTION('merged-build', with_name="enable", without_name="disable")
     opt.SAMBA3_ADD_OPTION('pam')
     opt.SAMBA3_ADD_OPTION('pam_smbpass')
     opt.SAMBA3_ADD_OPTION('quotas')
@@ -75,13 +62,6 @@ def set_options(opt):
 def configure(conf):
     from samba_utils import TO_LIST
 
-    if not conf.env.toplevel_build:
-        version = samba_version.load_version(env=conf.env)
-        conf.DEFINE('CONFIG_H_IS_FROM_SAMBA', 1)
-        conf.DEFINE('_SAMBA_WAF_BUILD_', version.MAJOR)
-        conf.DEFINE('_SAMBA_BUILD_', version.MAJOR, add_to_cflags=True)
-        conf.DEFINE('HAVE_CONFIG_H', 1, add_to_cflags=True)
-
     if Options.options.developer:
         conf.ADD_CFLAGS('-DDEVELOPER -DDEBUG_PASSWORD')
         conf.env.developer = True
@@ -89,30 +69,6 @@ def configure(conf):
     if Options.options.with_swat:
         conf.env['build_swat'] = True
 
-    if not conf.env.toplevel_build:
-        conf.RECURSE('../lib/replace')
-        conf.RECURSE('build')
-        conf.RECURSE('../lib/ccan')
-        conf.RECURSE('../lib/tdb_compat')
-        conf.RECURSE('../lib/talloc')
-        conf.RECURSE('../lib/tevent')
-        conf.RECURSE('../lib/popt')
-        conf.RECURSE('../lib/nss_wrapper')
-        conf.RECURSE('../lib/socket_wrapper')
-        conf.RECURSE('../lib/zlib')
-        conf.RECURSE('../libcli/smbreadline')
-        conf.RECURSE('../lib/util')
-
-        conf.ADD_EXTRA_INCLUDES('''#source3 #source3/include #lib/replace #lib''')
-        if not conf.env.USING_SYSTEM_TDB:
-            conf.ADD_EXTRA_INCLUDES('#lib/tdb_compat')
-        if not conf.env.USING_SYSTEM_TEVENT:
-            conf.ADD_EXTRA_INCLUDES('#lib/tevent')
-        if not conf.env.USING_SYSTEM_TALLOC:
-            conf.ADD_EXTRA_INCLUDES('#lib/talloc')
-        if not conf.env.USING_SYSTEM_POPT:
-            conf.ADD_EXTRA_INCLUDES('#lib/popt')
-
     conf.ADD_LDFLAGS("-Wl,--export-dynamic", testflags=True)
 
     conf.CHECK_HEADERS('execinfo.h libexc.h libunwind.h netdb.h')
@@ -126,7 +82,7 @@ def configure(conf):
     conf.CHECK_FUNCS('initgroups select poll rdchk getgrnam getgrent pathconf')
     conf.CHECK_FUNCS('setpriv setgidx setuidx setgroups sysconf stat64 fstat64')
     conf.CHECK_FUNCS('lstat64 fopen64 atexit grantpt lseek64 ftruncate64 fallocate fallocate64 posix_fallocate posix_fallocate64')
-    conf.CHECK_FUNCS('fseek64 fseeko64 ftell64 ftello64 setluid')
+    conf.CHECK_FUNCS('fseeko fseek64 fseeko64 ftell64 ftello64 setluid')
     conf.CHECK_FUNCS('getpwnam', headers='sys/types.h pwd.h')
     conf.CHECK_FUNCS('opendir64 readdir64 seekdir64 telldir64 rewinddir64 closedir64')
     conf.CHECK_FUNCS('fdopendir fdopendir64')
@@ -161,8 +117,9 @@ long ret = splice(0,0,1,0,400,0);
     # Check for inotify support
     conf.CHECK_HEADERS('linux/inotify.h asm/unistd.h sys/inotify.h')
     conf.CHECK_FUNCS('inotify_init')
-    if "HAVE_LINUX_INOTIFY_H" in conf.env and "HAVE_INOTIFY_INIT" in conf.env:
-        conf.DEFINE('HAVE_INOTIFY', 1)
+    if "HAVE_INOTIFY_INIT" in conf.env:
+        if "HAVE_LINUX_INOTIFY_H" in conf.env or "HAVE_SYS_INOTIFY_H" in conf.env:
+            conf.DEFINE('HAVE_INOTIFY', 1)
 
     # Check for kernel change notify support
     conf.CHECK_CODE('''
@@ -278,7 +235,7 @@ extattr_get_link extattr_list_fd extattr_list_file extattr_list_link
 extattr_set_fd extattr_set_file extattr_set_link _facl __facl _fchdir
 __fchdir fchmod fchown _fcntl __fcntl fcvt fcvtl fdatasync
 fdelproplist fgetea fgetproplist fgetxattr flistea flistxattr fopen64
-_fork __fork fremoveea fremovexattr fseek64 fseeko64 fsetea
+_fork __fork fremoveea fremovexattr fseeko fseek64 fseeko64 fsetea
 fsetproplist fsetxattr _fstat __fstat fstat64 _fstat64 __fstat64 fsync
 ftell64 ftello64 ftruncate64 futimens futimes __fxstat getauthuid
 getcwd _getcwd __getcwd getdents __getdents getdents64 getdirentries
@@ -299,7 +256,7 @@ seekdir64 select setea setenv setgidx setgroups setlocale setluid
 setmntent setpgid setpriv setproplist setsid setuidx
 setxattr shmget shm_open sigaction sigblock sigprocmask sigset
 sizeof_proplist_entry _stat __stat stat64 _stat64 __stat64 statvfs
-strcasecmp strchr strpbrk strsignal strtol strupr sysconf sysctlbyname
+strcasecmp strchr strpbrk strsignal strtol strupr sysconf sysctl sysctlbyname
 __sys_llseek syslog _telldir __telldir telldir64 textdomain timegm
 utimensat vsyslog _write __write __xstat
 ''')
@@ -308,7 +265,6 @@ utimensat vsyslog _write __write __xstat
 
     # FIXME: these should be tests for features, but the old build system just
     # checks for OSes.
-    import sys
     host_os = sys.platform
     Logs.info("building on %s" % host_os)
 
@@ -329,7 +285,7 @@ utimensat vsyslog _write __write __xstat
         conf.ADD_CFLAGS('-fno-common')
     elif (host_os.rfind('freebsd') > -1):
         if conf.CHECK_HEADERS('sunacl.h'):
-            conf.define('HAVE_FREEBSD_SUNACL_H', '1')
+            conf.DEFINE('HAVE_FREEBSD_SUNACL_H', '1')
             conf.CHECK_FUNCS_IN('acl', 'sunacl')
         conf.DEFINE('STAT_ST_BLOCKSIZE', '512')
     elif (host_os.rfind('netbsd') > -1):
@@ -382,50 +338,30 @@ return acl_get_perm_np(permset_d, perm);
 
     if conf.CONFIG_SET('HAVE_FALLOCATE'):
         conf.CHECK_CODE('''
-               #if defined(HAVE_UNISTD_H)
-               #include <unistd.h>
-               #endif
-               #include <sys/types.h>
-               #define _GNU_SOURCE
-               #include <fcntl.h>
-               #if defined(HAVE_LINUX_FALLOC_H)
-               #include <linux/falloc.h>
-               #endif
                int ret = fallocate(0, FALLOC_FL_KEEP_SIZE, 0, 10);''',
                'HAVE_LINUX_FALLOCATE',
-               msg="Checking whether the Linux 'fallocate' function is available")
+               msg="Checking whether the Linux 'fallocate' function is available",
+               headers='unistd.h sys/types.h fcntl.h linux/falloc.h')
     if conf.CONFIG_SET('HAVE_FALLOCATE64'):
         conf.CHECK_CODE('''
-               #if defined(HAVE_UNISTD_H)
-               #include <unistd.h>
-               #endif
-               #include <sys/types.h>
-               #define _GNU_SOURCE
-               #include <fcntl.h>
-               #if defined(HAVE_LINUX_FALLOC_H)
-               #include <linux/falloc.h>
-               #endif
                int ret = fallocate64(0, FALLOC_FL_KEEP_SIZE, 0, 10);''',
                'HAVE_LINUX_FALLOCATE64',
-               msg="Checking whether the Linux 'fallocate64' function is available")
+               msg="Checking whether the Linux 'fallocate64' function is available",
+               headers='unistd.h sys/types.h fcntl.h linux/falloc.h')
     conf.CHECK_CODE('''
-               #if defined(HAVE_UNISTD_H)
-               #include <unistd.h>
-               #endif
-               #include <fcntl.h>
                ssize_t err = readahead(0,0,0x80000);''',
                'HAVE_LINUX_READAHEAD',
-               msg="Checking whether Linux readahead is available")
+               msg="Checking whether Linux readahead is available",
+               headers='unistd.h fcntl.h')
     conf.CHECK_DECLS('readahead', headers='fcntl.h', always=True)
 
     conf.CHECK_CODE('''
-               #include <sys/types.h>
-               #include <sys/socket.h>],
                struct ucred cred;
                socklen_t cred_len;
                int ret = getsockopt(0, SOL_SOCKET, SO_PEERCRED, &cred, &cred_len);''',
                'HAVE_PEERCRED',
-               msg="Checking whether we can use SO_PEERCRED to get socket credentials")
+               msg="Checking whether we can use SO_PEERCRED to get socket credentials",
+               headers='sys/types.h sys/socket.h')
 
     conf.CHECK_CODE('''
                #if defined(HAVE_LONGLONG) && (defined(HAVE_OFF64_T) || (defined(SIZEOF_OFF_T) && (SIZEOF_OFF_T == 8)))
@@ -552,7 +488,7 @@ msg.msg_acctrightslen = sizeof(fd);
             # gssapi_krb5 and other libraries to its --libs output. That breaks the use
             # of an in-tree heimdal kerberos
            conf.check_cfg(path=conf.env.CUPS_CONFIG, args="--cflags --ldflags",
-                           package="", uselib_store="cups")
+                           package="", uselib_store="CUPS")
         conf.CHECK_HEADERS('cups/cups.h cups/language.h', lib='cups')
         conf.CHECK_FUNCS_IN('httpConnect httpConnectEncrypt', 'cups')
         if conf.CONFIG_SET('HAVE_CUPS_CUPS_H') and conf.CONFIG_SET('HAVE_CUPS_LANGUAGE_H'):
@@ -614,12 +550,12 @@ msg.msg_acctrightslen = sizeof(fd);
 
     # Check for kerberos
     have_gssapi=False
-    if Options.options.with_krb5 and not conf.env.toplevel_build:
+    if Options.options.with_mit_krb5_checks and conf.env.developer:
         Logs.info("Looking for kerberos features")
         conf.find_program('krb5-config', var='KRB5_CONFIG')
         if conf.env.KRB5_CONFIG:
             conf.check_cfg(path="krb5-config", args="--cflags --libs",
-                       package="gssapi", uselib_store="krb5")
+                       package="gssapi", uselib_store="KRB5")
         conf.CHECK_HEADERS('krb5.h krb5/locate_plugin.h', lib='krb5')
         conf.CHECK_HEADERS('gssapi.h gssapi/gssapi_generic.h gssapi/gssapi.h gssapi/gssapi_ext.h gssapi/gssapi_krb5.h com_err.h', lib='krb5')
 
@@ -628,27 +564,28 @@ msg.msg_acctrightslen = sizeof(fd);
 
         conf.CHECK_FUNCS_IN('_et_list', 'com_err')
         conf.CHECK_FUNCS_IN('krb5_encrypt_data', 'k5crypto')
-        conf.CHECK_FUNCS_IN('crypto', 'des_set_key')
+       conf.CHECK_FUNCS_IN('des_set_key','crypto')
         conf.CHECK_FUNCS_IN('copy_Authenticator', 'asn1')
         conf.CHECK_FUNCS_IN('roken_getaddrinfo_hostspec', 'roken')
         if conf.CHECK_FUNCS_IN('gss_display_status', 'gssapi') or \
            conf.CHECK_FUNCS_IN('gss_display_status', 'gssapi_krb5'):
             have_gssapi=True
-        conf.CHECK_FUNCS_IN('gss_wrap_iov gss_krb5_import_cred gss_get_name_attribute gss_mech_krb5 gss_oid_equal gss_inquire_sec_context_by_oid', 'gssapi gssapi_krb5 krb5')
+        conf.CHECK_FUNCS_IN('''gss_wrap_iov gss_krb5_import_cred gss_get_name_attribute gss_mech_krb5 gss_oid_equal
+gss_inquire_sec_context_by_oid gsskrb5_extract_authz_data_from_sec_context''', 'gssapi gssapi_krb5 krb5')
         conf.CHECK_FUNCS_IN('krb5_mk_req_extended krb5_kt_compare', 'krb5')
         conf.CHECK_FUNCS('''
-krb5_set_real_time krb5_set_default_in_tkt_etypes krb5_set_default_tgs_enctypes
+krb5_set_default_in_tkt_etypes krb5_set_default_tgs_enctypes
 krb5_set_default_tgs_ktypes krb5_principal2salt krb5_use_enctype
 krb5_string_to_key krb5_get_pw_salt krb5_string_to_key_salt krb5_auth_con_setkey
 krb5_auth_con_setuseruserkey krb5_locate_kdc krb5_get_permitted_enctypes
 krb5_get_default_in_tkt_etypes krb5_free_data_contents
 krb5_principal_get_comp_string krb5_free_unparsed_name
 krb5_free_keytab_entry_contents krb5_kt_free_entry krb5_krbhst_init
-krb5_krbhst_get_addrinfo krb5_c_enctype_compare krb5_enctypes_compatible_keys
+krb5_krbhst_get_addrinfo krb5_c_enctype_compare
 krb5_crypto_init krb5_crypto_destroy krb5_decode_ap_req free_AP_REQ
-krb5_verify_checksum krb5_c_verify_checksum krb5_principal_compare_any_realm
+krb5_c_verify_checksum krb5_principal_compare_any_realm
 krb5_parse_name_norealm krb5_princ_size krb5_get_init_creds_opt_set_pac_request
-krb5_get_renewed_creds krb5_get_kdc_cred krb5_free_error_contents
+krb5_get_renewed_creds krb5_free_error_contents
 initialize_krb5_error_table krb5_get_init_creds_opt_alloc
 krb5_get_init_creds_opt_free krb5_get_init_creds_opt_get_error
 krb5_enctype_to_string krb5_fwd_tgt_creds krb5_auth_con_set_req_cksumtype
@@ -662,6 +599,9 @@ krb5_get_credentials_for_user krb5_get_host_realm krb5_free_host_realm''',
         conf.CHECK_VARIABLE('KV5M_KEYTAB', headers='krb5.h')
         conf.CHECK_VARIABLE('KRB5_KU_OTHER_CKSUM', headers='krb5.h')
         conf.CHECK_VARIABLE('KRB5_KEYUSAGE_APP_DATA_CKSUM', headers='krb5.h')
+       conf.CHECK_VARIABLE('ENCTYPE_AES128_CTS_HMAC_SHA1_96', headers='krb5.h')
+       conf.CHECK_VARIABLE('ENCTYPE_AES256_CTS_HMAC_SHA1_96', headers='krb5.h')
+       conf.CHECK_DECLS('KRB5_PDU_NONE', reverse=True, headers='krb5.h')
         conf.CHECK_STRUCTURE_MEMBER('krb5_keytab_entry', 'key', headers='krb5.h',
                                     define='HAVE_KRB5_KEYTAB_ENTRY_KEY')
         conf.CHECK_STRUCTURE_MEMBER('krb5_keytab_entry', 'keyblock', headers='krb5.h',
@@ -758,14 +698,6 @@ int main(void) {
                         headers='krb5.h', lib='krb5',
                         addmain=False,
                         msg="Checking whether krb5_principal_get_realm is defined")
-        if conf.CHECK_CODE('''krb5_verify_checksum(0, 0, 0, 0, 0, 0, 0);''',
-                        'KRB5_VERIFY_CHECKSUM_ARGS',
-                        headers='krb5.h', lib='krb5',
-                       msg="Checking whether krb5_verify_checksum takes 7 arguments"):
-            conf.DEFINE('KRB5_VERIFY_CHECKSUM_ARGS', '7')
-       else:
-            conf.DEFINE('KRB5_VERIFY_CHECKSUM_ARGS', '6')
-
        conf.CHECK_CODE('''
 krb5_enctype enctype;
 enctype = ENCTYPE_ARCFOUR_HMAC_MD5;
@@ -807,12 +739,6 @@ return krb5_kt_resolve(context, "WRFILE:api", &keytab);
         'HAVE_KRB5_DEPRECATED_WITH_IDENTIFIER', addmain=False,
         link=False,
         msg="Checking for KRB5_DEPRECATED define taking an identifier")
-    elif not conf.env.toplevel_build:
-        conf.SET_TARGET_TYPE('krb5', 'EMPTY')
-        conf.SET_TARGET_TYPE('gssapi', 'EMPTY')
-        conf.SET_TARGET_TYPE('gssapi_krb5', 'EMPTY')
-        conf.SET_TARGET_TYPE('com_err', 'EMPTY')
-        conf.SET_TARGET_TYPE('k5crypto', 'EMPTY')
 
     if Options.options.with_ads:
         use_ads=True
@@ -823,6 +749,33 @@ return krb5_kt_resolve(context, "WRFILE:api", &keytab);
         if not conf.CONFIG_SET('HAVE_KRB5_MK_REQ_EXTENDED'):
             Logs.warn("krb5_mk_req_extended not found in -lkrb5")
             use_ads=False
+        if not conf.CONFIG_SET('HAVE_KRB5_C_ENCTYPE_COMPARE'):
+            Logs.warn("krb5_c_enctype_compare not found in -lkrb5")
+            use_ads=False
+        if not conf.CONFIG_SET('HAVE_KRB5_GET_HOST_REALM'):
+            Logs.warn("krb5_get_host_realm not found in -lkrb5")
+            use_ads=False
+        if not conf.CONFIG_SET('HAVE_KRB5_FREE_HOST_REALM'):
+            Logs.warn("krb5_free_host_realm not found in -lkrb5")
+            use_ads=False
+        if not conf.CONFIG_SET('HAVE_KRB5_FWD_TGT_CREDS'):
+            Logs.warn("krb5_fwd_tgt_creds found in -lkrb5")
+            use_ads=False
+        if not conf.CONFIG_SET('HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC'):
+            Logs.warn("krb5_get_init_creds_opt_alloc not found in -lkrb5")
+            use_ads=False
+        if not conf.CONFIG_SET('KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT'):
+            Logs.warn("krb5_get_init_creds_opt_free was not found or was too old in -lkrb5")
+            use_ads=False
+        if not conf.CONFIG_SET('HAVE_KRB5_GET_RENEWED_CREDS'):
+            Logs.warn("krb5_get_renewed_creds not found in -lkrb5")
+            use_ads=False
+        if not conf.CONFIG_SET('HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM'):
+            Logs.warn("krb5_principal_compare_any_realm not found in -lkrb5")
+            use_ads=False
+        if not conf.CONFIG_SET('HAVE_KRB5_STRING_TO_KEY'):
+            Logs.warn("krb5_string_to_key not found in -lkrb5")
+            use_ads=False
         if not conf.CONFIG_SET('HAVE_KRB5_PRINCIPAL2SALT') and \
            not conf.CONFIG_SET('HAVE_KRB5_GET_PW_SALT'):
             Logs.warn("no CREATE_KEY_FUNCTIONS detected")
@@ -835,9 +788,8 @@ return krb5_kt_resolve(context, "WRFILE:api", &keytab);
            not conf.CONFIG_SET('HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS'):
             Logs.warn("no KT_FREE_FUNCTION detected")
             use_ads=False
-        if not conf.CONFIG_SET('HAVE_KRB5_C_VERIFY_CHECKSUM') and \
-           not conf.CONFIG_SET('HAVE_KRB5_VERIFY_CHECKSUM'):
-            Logs.warn("no KRB5_VERIFY_CHECKSUM_FUNCTION detected")
+        if not conf.CONFIG_SET('HAVE_KRB5_C_VERIFY_CHECKSUM'):
+            Logs.warn("krb5_c_verify_checksum_compare not found in -lkrb5")
             use_ads=False
         if not conf.CONFIG_SET('KRB5_TICKET_HAS_KEYINFO'):
             # We only need the following functions if we can't get the enctype
@@ -848,6 +800,17 @@ return krb5_kt_resolve(context, "WRFILE:api", &keytab);
             if not conf.CONFIG_SET('HAVE_KRB5_DECODE_AP_REQ'):
                 Logs.warn("no KRB5_AP_REQ_DECODING_FUNCTION detected")
                 use_ads=False
+
+        # We don't actually use
+        # gsskrb5_extract_authz_data_from_sec_context, but it is a
+        # clue that this Heimdal, which does the PAC processing we
+        # need on the standard gss_inquire_sec_context_by_oid
+        if not conf.CONFIG_SET('HAVE_GSS_GET_NAME_ATTRIBUTE') and \
+            not (conf.CONFIG_SET('HAVE_GSSKRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT') and \
+                     conf.CONFIG_SET('HAVE_GSS_INQUIRE_SEC_CONTEXT_BY_OID')):
+            Logs.warn("need eiterh gss_get_name_attribute or gsskrb5_extract_authz_data_from_sec_context and gss_inquire_sec_context_by_oid in -lgssapi for PAC support")
+            use_ads=False
+
         if use_ads:
             conf.DEFINE('WITH_ADS', '1')
             conf.DEFINE('HAVE_KRB5', '1')
@@ -1130,14 +1093,11 @@ exit(1);
                                define='HAVE_STRUCT_STAT_ST_BIRTHTIMENSEC')
 
     conf.CHECK_CODE('''
-#if defined(HAVE_UNISTD_H)
-#include <unistd.h>
-#endif
-#include <fcntl.h>],
 ssize_t err = posix_fadvise(0,0,0x80000,POSIX_FADV_WILLNEED);
 ''',
                'HAVE_POSIX_FADVISE',
-               msg='Checking whether posix_fadvise is available')
+               msg='Checking whether posix_fadvise is available',
+               headers='unistd.h fcntl.h')
 
     for v in ['_SC_NGROUPS_MAX', '_SC_NPROC_ONLN', '_SC_NPROCESSORS_ONLN', '_SC_PAGESIZE' ]:
         conf.CHECK_CODE('''
@@ -1431,11 +1391,6 @@ main() {
         msg="getcwd takes a NULL argument")
 
 
-    conf.CHECK_CODE('''enum TDB_ERROR err = TDB_ERR_NESTING''',
-                   'HAVE_TDB_ERR_NESTING',
-                   headers='tdb.h',
-                   msg='Checking whether we have TDB_ERR_NESTING')
-
     # UnixWare 7.x has its getspnam in -lgen
     conf.CHECK_FUNCS_IN('getspnam', 'gen')
     conf.CHECK_FUNCS_IN('getspnam', 'security')
@@ -1623,6 +1578,35 @@ main() {
                 includes=includes,
                 msg='Checking for ctdb ipv6 support')
 
+        if have_cluster_support:
+            conf.CHECK_CODE('''
+                #define NO_CONFIG_H
+                #include "replace.h"
+                #include "system/wait.h"
+                #include "system/network.h"
+                #include <talloc.h>
+                #include <tdb.h>
+                #include <ctdb.h>
+                #include <ctdb_private.h>
+
+                int main(void)
+                {
+                    int i = (int)CTDB_CONTROL_CHECK_SRVIDS;
+                    return 0;
+                }
+                ''',
+                'HAVE_CTDB_CONTROL_CHECK_SRVIDS_DECL',
+                addmain=False,
+                includes=includes,
+               msg='Checking for CHECK_SRVIDS control')
+
+            if not conf.CONFIG_SET('HAVE_CTDB_CONTROL_CHECK_SRVIDS_DECL'):
+                if not Options.options.enable_old_ctdb:
+                    have_cluster_support = False
+                    ctdb_broken = "CHECK_SRVIDS control missing"
+                else:
+                    Logs.warn("ignoring missing CHECK_SRVIDS control (--enable-old-ctdb)")
+
     if have_cluster_support:
         Logs.info("building with cluster support")
         conf.DEFINE('CLUSTER_SUPPORT', 1);
@@ -1691,6 +1675,9 @@ main() {
     if conf.CHECK_HEADERS('gpfs_gpl.h'):
         conf.DEFINE('HAVE_GPFS', '1')
 
+    # Note that all charset 'modules' must actually be static, due to dependency loop issues 
+    # if we include the module loader in iconv
+
     default_static_modules=TO_LIST('''pdb_smbpasswd pdb_tdbsam pdb_wbc_sam
                                       auth_sam auth_unix auth_winbind auth_wbc auth_server
                                       auth_domain auth_builtin vfs_default
@@ -1699,19 +1686,20 @@ main() {
 
     default_shared_modules=TO_LIST('''vfs_recycle vfs_audit vfs_extd_audit vfs_full_audit vfs_netatalk
                                       vfs_fake_perms vfs_default_quota vfs_readonly vfs_cap
-                                      vfs_expand_msdfs vfs_shadow_copy vfs_shadow_copy2 charset_CP850
-                                      charset_CP437 auth_script vfs_readahead vfs_xattr_tdb
+                                      vfs_expand_msdfs vfs_shadow_copy vfs_shadow_copy2 
+                                      auth_script vfs_readahead vfs_xattr_tdb
                                       vfs_streams_xattr vfs_streams_depot vfs_acl_xattr vfs_acl_tdb
                                       vfs_smb_traffic_analyzer vfs_preopen vfs_catia vfs_scannedonly
                                       vfs_crossrename vfs_linux_xfs_sgid
                                       vfs_time_audit idmap_autorid''')
 
     if Options.options.developer:
-        default_static_modules.extend(TO_LIST('pdb_ads auth_netlogond'))
-        default_shared_modules.extend(TO_LIST('charset_weird perfcount_test'))
+        default_static_modules.extend(TO_LIST('pdb_ads auth_netlogond charset_weird'))
+        default_shared_modules.extend(TO_LIST('perfcount_test'))
+        default_shared_modules.extend(TO_LIST('vfs_skel_opaque vfs_skel_transparent vfs_shadow_copy_test'))
+        default_shared_modules.extend(TO_LIST('auth_skel pdb_test'))
 
-    if conf.env.toplevel_build:
-        default_static_modules.extend(TO_LIST('pdb_samba4 auth_samba4'))
+    default_static_modules.extend(TO_LIST('pdb_samba4 auth_samba4 vfs_dfs_samba4'))
 
     if Options.options.with_acl_support and conf.CONFIG_SET('HAVE_POSIX_ACLS'):
         default_static_modules.extend(TO_LIST('vfs_posixacl'))
@@ -1728,11 +1716,14 @@ main() {
     if conf.CONFIG_SET('HAVE_AIO') and (conf.CONFIG_SET('HAVE_MSGHDR_MSG_CONTROL') or conf.CONFIG_SET('HAVE_MSGHDR_MSG_ACCTRIGHTS')):
        default_shared_modules.extend(TO_LIST('vfs_aio_fork'))
 
+    if conf.CONFIG_SET('HAVE_AIO') and Options.options.with_pthreadpool:
+       default_shared_modules.extend(TO_LIST('vfs_aio_pthread'))
+
     if conf.CONFIG_SET('HAVE_LDAP'):
         default_static_modules.extend(TO_LIST('pdb_ldap idmap_ldap'))
 
     if conf.CONFIG_SET('DARWINOS'):
-       default_shared_modules.extend(TO_LIST('charset_macosxfs'))
+       default_static_modules.extend(TO_LIST('charset_macosxfs'))
 
     if conf.CONFIG_SET('HAVE_GPFS'):
        default_shared_modules.extend(TO_LIST('vfs_gpfs vfs_gpfs_hsm_notify'))
@@ -1792,7 +1783,7 @@ main() {
             conf.DEFINE('static_init_%s' % p, '{}')
         if p in shared_list:
             for entry in shared_list[p]:
-                conf.DEFINE('%s_init' % entry, 'init_samba_module')
+                conf.DEFINE('%s_init' % entry, 'samba_init_module')
                 conf.env[shared_env].append('%s' % entry)
 
     conf.SAMBA_CONFIG_H('include/config.h')
@@ -1805,12 +1796,3 @@ def ctags(ctx):
     print("Running: %s" % cmd)
     os.system(cmd)
 
-if not os.getenv('TOPLEVEL_BUILD'):
-    def wildcard_cmd(cmd):
-        '''called on a unknown command'''
-        from samba_wildcard import run_named_build_task
-        run_named_build_task(cmd)
-    def main():
-        from samba_wildcard import wildcard_main
-        wildcard_main(wildcard_cmd)
-    Scripting.main = main