diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c
index fc7a7549e8e5..ff51307e43a1 100644
--- a/source3/auth/auth_generic.c
+++ b/source3/auth/auth_generic.c
@@ -36,6 +36,7 @@
#include "auth/credentials/credentials.h"
#include "lib/param/loadparm.h"
#include "librpc/gen_ndr/dcerpc.h"
+#include "source3/lib/substitute.h"
static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx,
TALLOC_CTX *mem_ctx,
diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c
index 676aa9d892c4..f2deca09aa68 100644
--- a/source3/auth/auth_ntlmssp.c
+++ b/source3/auth/auth_ntlmssp.c
@@ -25,6 +25,7 @@
#include "auth.h"
#include "libcli/security/security.h"
#include "lib/util/tevent_ntstatus.h"
+#include "source3/lib/substitute.h"
NTSTATUS auth3_generate_session_info(struct auth4_context *auth_context,
TALLOC_CTX *mem_ctx,
diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index dec854d85c34..4527dedc49d9 100644
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -38,6 +38,7 @@
#include "rpc_client/util_netlogon.h"
#include "source4/auth/auth.h"
#include "auth/auth_util.h"
+#include "source3/lib/substitute.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
diff --git a/source3/include/proto.h b/source3/include/proto.h
index c136db63b388..6154b1ab26d4 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -139,39 +139,6 @@ int smbrun_no_sanitize(const char *cmd, int *outfd, char * const *env);
int smbrun(const char *cmd, int *outfd, char * const *env);
int smbrunsecret(const char *cmd, const char *secret);
-/* The following definitions come from lib/substitute.c */
-
-bool set_local_machine_name(const char *local_name, bool perm);
-const char *get_local_machine_name(void);
-bool set_remote_machine_name(const char *remote_name, bool perm);
-const char *get_remote_machine_name(void);
-void sub_set_smb_name(const char *name);
-void set_current_user_info(const char *smb_name, const char *unix_name,
- const char *domain);
-void sub_set_socket_ids(const char *peeraddr, const char *peername,
- const char *sockaddr);
-const char *get_current_username(void);
-void standard_sub_basic(const char *smb_name, const char *domain_name,
- char *str, size_t len);
-char *talloc_sub_basic(TALLOC_CTX *mem_ctx, const char *smb_name,
- const char *domain_name, const char *str);
-char *talloc_sub_specified(TALLOC_CTX *mem_ctx,
- const char *input_string,
- const char *username,
- const char *grpname,
- const char *domain,
- uid_t uid,
- gid_t gid);
-char *talloc_sub_advanced(TALLOC_CTX *mem_ctx,
- const char *servicename, const char *user,
- const char *connectpath, gid_t gid,
- const char *str);
-char *talloc_sub_full(TALLOC_CTX *mem_ctx,
- const char *servicename, const char *user,
- const char *connectpath, gid_t gid,
- const char *smb_name, const char *domain_name,
- const char *str);
-
/* The following definitions come from lib/sysquotas.c */
int sys_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp);
diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c
index b98a0acf1cbd..a941b89f82a6 100644
--- a/source3/lib/substitute.c
+++ b/source3/lib/substitute.c
@@ -20,6 +20,7 @@
#include "includes.h"
+#include "substitute.h"
#include "system/passwd.h"
#include "secrets.h"
#include "auth.h"
diff --git a/source3/lib/substitute.h b/source3/lib/substitute.h
new file mode 100644
index 000000000000..2056d163dd7d
--- /dev/null
+++ b/source3/lib/substitute.h
@@ -0,0 +1,63 @@
+/*
+ Unix SMB/CIFS implementation.
+ string substitution functions
+ Copyright (C) Andrew Tridgell 1992-2000
+ Copyright (C) Gerald Carter 2006
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see .
+*/
+
+#ifndef SUBSTITUTE_H
+#define SUBSTITUTE_H
+
+bool set_local_machine_name(const char *local_name, bool perm);
+const char *get_local_machine_name(void);
+bool set_remote_machine_name(const char *remote_name, bool perm);
+const char *get_remote_machine_name(void);
+void sub_set_socket_ids(const char *peeraddr, const char *peername,
+ const char *sockaddr);
+void set_current_user_info(const char *smb_name,
+ const char *unix_name,
+ const char *domain);
+const char *get_current_username(void);
+void standard_sub_basic(const char *smb_name,
+ const char *domain_name,
+ char *str,
+ size_t len);
+char *talloc_sub_basic(TALLOC_CTX *mem_ctx,
+ const char *smb_name,
+ const char *domain_name,
+ const char *str);
+char *talloc_sub_specified(TALLOC_CTX *mem_ctx,
+ const char *input_string,
+ const char *username,
+ const char *grpname,
+ const char *domain,
+ uid_t uid,
+ gid_t gid);
+char *talloc_sub_advanced(TALLOC_CTX *ctx,
+ const char *servicename,
+ const char *user,
+ const char *connectpath,
+ gid_t gid,
+ const char *str);
+char *talloc_sub_full(TALLOC_CTX *ctx,
+ const char *servicename,
+ const char *user,
+ const char *connectpath,
+ gid_t gid,
+ const char *smb_name,
+ const char *domain_name,
+ const char *str);
+#endif
diff --git a/source3/modules/vfs_expand_msdfs.c b/source3/modules/vfs_expand_msdfs.c
index 34e7051dca5f..fe3c6f47462c 100644
--- a/source3/modules/vfs_expand_msdfs.c
+++ b/source3/modules/vfs_expand_msdfs.c
@@ -25,6 +25,7 @@
#include "auth.h"
#include "../lib/tsocket/tsocket.h"
#include "msdfs.h"
+#include "source3/lib/substitute.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_VFS
diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c
index 2c07eab69ca4..5903849931ee 100644
--- a/source3/modules/vfs_full_audit.c
+++ b/source3/modules/vfs_full_audit.c
@@ -73,6 +73,7 @@
#include "passdb/machine_sid.h"
#include "lib/util/tevent_ntstatus.h"
#include "lib/util/string_wrappers.h"
+#include "source3/lib/substitute.h"
static int vfs_full_audit_debug_level = DBGC_VFS;
diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c
index 6e6579431103..b794ebc2d8c1 100644
--- a/source3/modules/vfs_recycle.c
+++ b/source3/modules/vfs_recycle.c
@@ -27,6 +27,7 @@
#include "system/filesys.h"
#include "../librpc/gen_ndr/ndr_netlogon.h"
#include "auth.h"
+#include "source3/lib/substitute.h"
#define ALLOC_CHECK(ptr, label) do { if ((ptr) == NULL) { DEBUG(0, ("recycle.bin: out of memory!\n")); errno = ENOMEM; goto label; } } while(0)
diff --git a/source3/modules/vfs_unityed_media.c b/source3/modules/vfs_unityed_media.c
index 62a1456b9963..fbd4d968172a 100644
--- a/source3/modules/vfs_unityed_media.c
+++ b/source3/modules/vfs_unityed_media.c
@@ -62,6 +62,7 @@
#include "../lib/tsocket/tsocket.h"
#include "lib/util/smb_strtox.h"
#include
+#include "source3/lib/substitute.h"
#define UM_PARAM_TYPE_NAME "unityed_media"
diff --git a/source3/modules/vfs_virusfilter_utils.c b/source3/modules/vfs_virusfilter_utils.c
index c7f8089ffc73..b8b44eb203b9 100644
--- a/source3/modules/vfs_virusfilter_utils.c
+++ b/source3/modules/vfs_virusfilter_utils.c
@@ -25,6 +25,7 @@ struct iovec;
#include "lib/util/iov_buf.h"
#include
#include "lib/tsocket/tsocket.h"
+#include "source3/lib/substitute.h"
int virusfilter_debug_class = DBGC_VFS;
diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c
index 44121e9915ca..7470897587ea 100644
--- a/source3/nmbd/nmbd.c
+++ b/source3/nmbd/nmbd.c
@@ -29,6 +29,7 @@
#include "util_cluster.h"
#include "lib/gencache.h"
#include "lib/global_contexts.h"
+#include "source3/lib/substitute.h"
int ClientNMB = -1;
int ClientDGRAM = -1;
diff --git a/source3/nmbd/nmbd_synclists.c b/source3/nmbd/nmbd_synclists.c
index a65cbb87e0e2..d291927fbc88 100644
--- a/source3/nmbd/nmbd_synclists.c
+++ b/source3/nmbd/nmbd_synclists.c
@@ -33,6 +33,7 @@
#include "libsmb/clirap.h"
#include "../libcli/smb/smbXcli_base.h"
#include "lib/util/string_wrappers.h"
+#include "source3/lib/substitute.h"
struct sync_record {
struct sync_record *next, *prev;
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 62878c213d3a..a08a9a067488 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -76,6 +76,7 @@
#include "lib/crypto/gnutls_helpers.h"
#include "lib/util/string_wrappers.h"
#include "auth/credentials/credentials.h"
+#include "source3/lib/substitute.h"
#ifdef HAVE_SYS_SYSCTL_H
#include
diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index 068c5a5ea70c..863f260ea902 100644
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -33,6 +33,7 @@
#include "auth/credentials/credentials.h"
#include "lib/param/param.h"
#include "lib/util/string_wrappers.h"
+#include "source3/lib/substitute.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_PASSDB
diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c
index e6d8a84c60fa..93da28b19414 100644
--- a/source3/passdb/pdb_ldap.c
+++ b/source3/passdb/pdb_ldap.c
@@ -56,6 +56,7 @@
#include "lib/util_sid_passdb.h"
#include "lib/util/smb_strtox.h"
#include "lib/util/string_wrappers.h"
+#include "source3/lib/substitute.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_PASSDB
diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c
index 743c311bbd5f..8798a4cf34a3 100644
--- a/source3/printing/print_generic.c
+++ b/source3/printing/print_generic.c
@@ -20,6 +20,7 @@
#include "includes.h"
#include "printing.h"
#include "smbd/proto.h"
+#include "source3/lib/substitute.h"
extern userdom_struct current_user_info;
diff --git a/source3/printing/printing.c b/source3/printing/printing.c
index 499334df03f0..67d798fbb214 100644
--- a/source3/printing/printing.c
+++ b/source3/printing/printing.c
@@ -40,6 +40,7 @@
#include "lib/util/string_wrappers.h"
#include "lib/global_contexts.h"
#include "source3/printing/rap_jobid.h"
+#include "source3/lib/substitute.h"
extern userdom_struct current_user_info;
diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c
index 8d341b616b1c..8d71b5252ab2 100644
--- a/source3/rpc_server/lsa/srv_lsa_nt.c
+++ b/source3/rpc_server/lsa/srv_lsa_nt.c
@@ -53,6 +53,7 @@
#include "librpc/rpc/dcesrv_core.h"
#include "librpc/rpc/dcerpc_helper.h"
#include "lib/param/loadparm.h"
+#include "source3/lib/substitute.h"
#include "lib/crypto/gnutls_helpers.h"
#include
diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
index 70105894f53b..ac5d22ce74d8 100644
--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
@@ -50,6 +50,7 @@
#include "lib/param/param.h"
#include "libsmb/dsgetdcname.h"
#include "lib/util/util_str_escape.h"
+#include "source3/lib/substitute.h"
extern userdom_struct current_user_info;
diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
index 8576e9d2ce24..fc27a459634b 100644
--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
@@ -42,6 +42,7 @@
#include "messages.h"
#include "serverid.h"
#include "lib/global_contexts.h"
+#include "source3/lib/substitute.h"
extern const struct generic_mapping file_generic_mapping;
diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index f1c8ea0c2ed4..cf3b7c91c221 100644
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -29,6 +29,7 @@
#include "smbd/globals.h"
#include "smbprofile.h"
#include "rpc_server/srv_pipe_hnd.h"
+#include "source3/lib/substitute.h"
#define NERR_notsupported 50
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 9194113e7686..eb8148753b90 100644
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -45,6 +45,7 @@
#include "rpc_server/rpc_ncacn_np.h"
#include "lib/util/string_wrappers.h"
#include "source3/printing/rap_jobid.h"
+#include "source3/lib/substitute.h"
#ifdef CHECK_TYPES
#undef CHECK_TYPES
diff --git a/source3/smbd/message.c b/source3/smbd/message.c
index b97289468893..7185bec1289e 100644
--- a/source3/smbd/message.c
+++ b/source3/smbd/message.c
@@ -27,6 +27,7 @@
#include "smbd/smbd.h"
#include "smbd/globals.h"
#include "smbprofile.h"
+#include "source3/lib/substitute.h"
extern userdom_struct current_user_info;
diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c
index 995ed815d908..fd002e98071e 100644
--- a/source3/smbd/msdfs.c
+++ b/source3/smbd/msdfs.c
@@ -34,6 +34,7 @@
#include "librpc/gen_ndr/ndr_dfsblobs.h"
#include "lib/tsocket/tsocket.h"
#include "lib/global_contexts.h"
+#include "source3/lib/substitute.h"
/**********************************************************************
Parse a DFS pathname of the form \hostname\service\reqpath
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 03409742752d..5015c143a042 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -46,6 +46,7 @@
#include "libcli/smb/smbXcli_base.h"
#include "lib/util/time_basic.h"
#include "smb1_utils.h"
+#include "source3/lib/substitute.h"
/* Internal message queue for deferred opens. */
struct pending_message_list {
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 042e7f2329eb..f85d1122a076 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -50,6 +50,7 @@
#include "libcli/smb/smb2_posix.h"
#include "lib/util/string_wrappers.h"
#include "source3/printing/rap_jobid.h"
+#include "source3/lib/substitute.h"
/****************************************************************************
Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
diff --git a/source3/smbd/server.c b/source3/smbd/server.c
index d7f5b4b73c0f..d02ff1bd8834 100644
--- a/source3/smbd/server.c
+++ b/source3/smbd/server.c
@@ -60,6 +60,7 @@
#include "rpc_server/fssd.h"
#include "rpc_server/mdssd.h"
#include "lib/global_contexts.h"
+#include "source3/lib/substitute.h"
#ifdef CLUSTER_SUPPORT
#include "ctdb_protocol.h"
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index afdea38b0161..ef7c14d92d0e 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -34,6 +34,7 @@
#include "lib/afs/afs_funcs.h"
#include "lib/util_path.h"
#include "lib/util/string_wrappers.h"
+#include "source3/lib/substitute.h"
bool canonicalize_connect_path(connection_struct *conn)
{
diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index 2bd527ce80e4..1705b8920b6c 100644
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -34,6 +34,7 @@
#include "auth/gensec/gensec.h"
#include "../libcli/smb/smb_signing.h"
#include "lib/util/string_wrappers.h"
+#include "source3/lib/substitute.h"
/****************************************************************************
Add the standard 'Samba' signature to the end of the session setup.
diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c
index debe4fc6385c..c44c4bd8c694 100644
--- a/source3/smbd/share_access.c
+++ b/source3/smbd/share_access.c
@@ -23,6 +23,7 @@
#include "../libcli/security/security.h"
#include "passdb/lookup_sid.h"
#include "auth.h"
+#include "source3/lib/substitute.h"
/*
* We dropped NIS support in 2021, but need to keep configs working.
diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index f359db0729d8..f6b376e5a07a 100644
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -33,6 +33,7 @@
#include "lib/util/iov_buf.h"
#include "auth.h"
#include "libcli/smb/smbXcli_base.h"
+#include "source3/lib/substitute.h"
#if defined(LINUX)
/* SIOCOUTQ TIOCOUTQ are the same */
diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c
index 38049e8535f2..14b806bc007d 100644
--- a/source3/smbd/smb2_sesssetup.c
+++ b/source3/smbd/smb2_sesssetup.c
@@ -28,6 +28,7 @@
#include "../lib/tsocket/tsocket.h"
#include "../libcli/security/security.h"
#include "../lib/util/tevent_ntstatus.h"
+#include "source3/lib/substitute.h"
#include "lib/crypto/gnutls_helpers.h"
#include
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index cd6b61429c54..a86ac3228e35 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -45,6 +45,7 @@
#include "smb1_utils.h"
#include "libcli/smb/smb2_posix.h"
#include "lib/util/string_wrappers.h"
+#include "source3/lib/substitute.h"
#define DIR_ENTRY_SAFETY_MARGIN 4096
diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c
index b0d7f21c200f..52918c4f1819 100644
--- a/source3/smbd/uid.c
+++ b/source3/smbd/uid.c
@@ -26,6 +26,7 @@
#include "passdb/lookup_sid.h"
#include "auth.h"
#include "../auth/auth_util.h"
+#include "source3/lib/substitute.h"
/* what user is current? */
extern struct current_user current_user;
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 197e1990e16f..4a886614ae12 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -51,6 +51,7 @@
#include "lib/param/param.h"
#include "auth/gensec/gensec.h"
#include "lib/util/string_wrappers.h"
+#include "source3/lib/substitute.h"
#include
#include
diff --git a/source3/utils/net_sam.c b/source3/utils/net_sam.c
index 6a2c6c861f9e..17cc47b2ddd1 100644
--- a/source3/utils/net_sam.c
+++ b/source3/utils/net_sam.c
@@ -33,6 +33,7 @@
#include "idmap.h"
#include "lib/util/smb_strtox.h"
#include "lib/util/string_wrappers.h"
+#include "source3/lib/substitute.h"
/*
* Set a user's data
diff --git a/source3/winbindd/wb_getpwsid.c b/source3/winbindd/wb_getpwsid.c
index fb0351ec2010..7f168bdda7a5 100644
--- a/source3/winbindd/wb_getpwsid.c
+++ b/source3/winbindd/wb_getpwsid.c
@@ -22,6 +22,7 @@
#include "librpc/gen_ndr/ndr_winbind_c.h"
#include "../libcli/security/security.h"
#include "lib/util/string_wrappers.h"
+#include "source3/lib/substitute.h"
struct wb_getpwsid_state {
struct tevent_context *ev;
diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c
index 2205eebd163a..9dd7315cf9dc 100644
--- a/source3/winbindd/winbindd.c
+++ b/source3/winbindd/winbindd.c
@@ -51,6 +51,7 @@
#include "lib/gencache.h"
#include "rpc_server/rpc_config.h"
#include "lib/global_contexts.h"
+#include "source3/lib/substitute.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_WINBIND