* fixed conformant arrays in structures

* expanded the rpcecho test

* started adding the NETDFS pipe
(This used to be commit 095ab42cbdd5c1c5ab753e2eb275742ba822c8b9)

20 files changed, 721 insertions, 108 deletions

diff --git a/source4/Makefile.in b/source4/Makefile.in
index 059e4b955f..c29bc5de1e 100644
--- a/source4/Makefile.in
+++ b/source4/Makefile.in
@@ -194,10 +194,11 @@ LIBCLIUTIL_OBJ = libcli/util/asn1.o \
 	     libcli/util/pwd_cache.o libcli/util/clierror.o libcli/util/cliutil.o
 
 LIBRAW_NDR_OBJ = librpc/ndr/ndr.o librpc/ndr/ndr_basic.o librpc/ndr/ndr_sec.o \
-		librpc/ndr/ndr_echo.o librpc/ndr/ndr_misc.o librpc/ndr/ndr_lsa.o
+		librpc/ndr/ndr_echo.o librpc/ndr/ndr_misc.o librpc/ndr/ndr_lsa.o \
+		librpc/ndr/ndr_dfs.o
 
 LIBRAW_RPC_OBJ = librpc/rpc/dcerpc.o librpc/rpc/rpc_echo.o librpc/rpc/rpc_lsa.o \
-		librpc/rpc/dcerpc_smb.o
+		librpc/rpc/dcerpc_smb.o librpc/rpc/rpc_dfs.o
 
 LIBRAW_OBJ = libcli/raw/rawfile.o libcli/raw/smb_signing.o  \
 	     libcli/raw/clisocket.o libcli/raw/clitransport.o \
@@ -529,7 +530,7 @@ SMBTORTURE_RAW_OBJ = torture/raw/qfsinfo.o torture/raw/qfileinfo.o torture/raw/s
 		torture/raw/chkpath.o torture/raw/unlink.o torture/raw/read.o torture/raw/context.o \
 		torture/raw/write.o torture/raw/lock.o torture/raw/rename.o torture/raw/seek.o 
 
-SMBTORTURE_RPC_OBJ = torture/rpc/lsa.o torture/rpc/echo.o
+SMBTORTURE_RPC_OBJ = torture/rpc/lsa.o torture/rpc/echo.o torture/rpc/dfs.o
 
 SMBTORTURE_OBJ1 = torture/torture.o torture/torture_util.o torture/nbio.o torture/scanner.o \
 		torture/utable.o torture/denytest.o torture/mangle_test.o \
@@ -1278,7 +1279,6 @@ headers:
 	$(MAKE) utils/net_proto.h; \
 	$(MAKE) include/tdbsam2_parse_info.h; \
 @STFS_ENABLED@	$(MAKE) ntvfs/tank/vfs_tank_proto.h
-@PCH_AVAILABLE@	$(MAKE) pch
 
 proto: headers 
 
diff --git a/source4/librpc/idl/dfs.idl b/source4/librpc/idl/dfs.idl
new file mode 100644
index 0000000000..d9b20f14c9
--- /dev/null
+++ b/source4/librpc/idl/dfs.idl
@@ -0,0 +1,57 @@
+/*
+  dfs interface definition
+*/
+
+[ uuid(4fc742e0-4a10-11cf-8273-00aa004ae673),
+  version(3.0),
+  pointer_default(unique)
+] interface netdfs
+{
+	/******************/
+	/* Function: 0x00 */
+	void dfs_Exist(
+		[out,ref] uint32 *exist_flag
+		);
+
+
+	/******************/
+	/* Function: 0x01 */
+	NTSTATUS dfs_Add (
+		[in]     unistr *path,
+		[in]     unistr *server,
+		[in]     unistr *share,
+		[in]     unistr *comment,
+		[in]     uint32  flags
+		);
+
+	/******************/
+	/* Function: 0x02 */
+	NTSTATUS dfs_Remove (
+		[in,ref] unistr *path,
+		[in]     unistr *server,
+		[in]     unistr *share
+		);
+
+	/******************/
+	/* Function: 0x03 */
+	NTSTATUS dfs_UNKNOWN3 ();
+
+	/******************/
+	/* Function: 0x04 */
+	NTSTATUS dfs_Info (
+		[in,ref] unistr *path,
+		[in]     unistr *server,
+		[in]     unistr *share,
+		[in]     uint16 level
+		);
+
+
+	/******************/
+	/* Function: 0x05 */
+	NTSTATUS dfs_Enum (
+		[in] unistr *name,
+		[in] uint32 level,
+		[in] uint32 buffer_size,
+		[in,out,ref] uint32 *resume_handle
+		);
+}
diff --git a/source4/librpc/idl/echo.idl b/source4/librpc/idl/echo.idl
index e366d7931a..af6cb567d7 100644
--- a/source4/librpc/idl/echo.idl
+++ b/source4/librpc/idl/echo.idl
@@ -11,7 +11,8 @@ interface rpcecho
 	/* Echo an array of bytes back at the caller */
 	void echo_EchoData(
 		[in] uint32 len,
-		[in,out,ref,size_is(len)] uint8 *data
+		[in] [size_is(len)] uint8 in_data[],
+		[out] [size_is(len)] uint8 out_data[]
 	);
 	/* Sink data to the server */
 	void echo_SinkData(
@@ -23,4 +24,17 @@ interface rpcecho
 		[in] uint32 len,
 		[out,ref,size_is(len)] uint8 *data
 	);
+
+#define long uint32
+
+	typedef struct {
+		long bar;
+		long count;
+		long foo;
+		[size_is(count)] long s[*];
+	} Struct1;
+	
+	void TestCall (
+		[out]        Struct1 **s1
+		);
 }
diff --git a/source4/librpc/idl/lsa.idl b/source4/librpc/idl/lsa.idl
index 38f66f37e6..ce6a151f42 100644
--- a/source4/librpc/idl/lsa.idl
+++ b/source4/librpc/idl/lsa.idl
@@ -334,8 +334,8 @@
 	
 	typedef struct {
 		uint32 count;
+		uint32 unknown;
 		[size_is(count)] lsa_LUIDAttribute set[*];
-		uint32 unknown[1];
 	} lsa_PrivilegeSet;
 	
 	NTSTATUS lsa_EnumPrivsAccount (
diff --git a/source4/librpc/ndr/libndr.h b/source4/librpc/ndr/libndr.h
index da262af00c..287046ad20 100644
--- a/source4/librpc/ndr/libndr.h
+++ b/source4/librpc/ndr/libndr.h
@@ -76,6 +76,12 @@ struct ndr_print {
 #define NDR_PRINT_UNION_DEBUG(type, level, p) ndr_print_union_debug((ndr_print_union_fn_t)ndr_print_ ##type, #p, level, p)
 
 
+enum ndr_err_code {
+	NDR_ERR_CONFORMANT_SIZE,
+	NDR_ERR_ARRAY_SIZE,
+	NDR_ERR_BAD_SWITCH
+};
+
 /*
   flags passed to control parse flow
 */
@@ -91,11 +97,14 @@ struct ndr_print {
                         } while (0)
 
 
-#define NDR_ALLOC(ndr, s) do { \
-	                       (s) = talloc(ndr->mem_ctx, sizeof(*(s))); \
+#define NDR_ALLOC_SIZE(ndr, s, size) do { \
+	                       (s) = talloc(ndr->mem_ctx, size); \
                                if (!(s)) return NT_STATUS_NO_MEMORY; \
                            } while (0)
 
+#define NDR_ALLOC(ndr, s) NDR_ALLOC_SIZE(ndr, s, sizeof(*(s)))
+
+
 #define NDR_ALLOC_N_SIZE(ndr, s, n, elsize) do { \
 				if ((n) == 0) { \
 					(s) = NULL; \
@@ -104,6 +113,7 @@ struct ndr_print {
 					if (!(s)) return NT_STATUS_NO_MEMORY; \
 				} \
                            } while (0)
+
 #define NDR_ALLOC_N(ndr, s, n) NDR_ALLOC_N_SIZE(ndr, s, n, sizeof(*(s)))
 
 /* these are used when generic fn pointers are needed for ndr push/pull fns */
diff --git a/source4/librpc/ndr/ndr.c b/source4/librpc/ndr/ndr.c
index eebc2ac681..307f5988f8 100644
--- a/source4/librpc/ndr/ndr.c
+++ b/source4/librpc/ndr/ndr.c
@@ -192,7 +192,7 @@ NTSTATUS ndr_push_set_offset(struct ndr_push *ndr, uint32 ofs)
 /*
   push a generic array
 */
-NTSTATUS ndr_push_const_array(struct ndr_push *ndr, int ndr_flags, void *base, 
+NTSTATUS ndr_push_array(struct ndr_push *ndr, int ndr_flags, void *base, 
 			      size_t elsize, uint32 count, 
 			      NTSTATUS (*push_fn)(struct ndr_push *, int, void *))
 {
@@ -215,22 +215,11 @@ done:
 }
 
 /*
-  push a generic array
-*/
-NTSTATUS ndr_push_array(struct ndr_push *ndr, int ndr_flags, void *base, 
-			size_t elsize, uint32 count, 
-			NTSTATUS (*push_fn)(struct ndr_push *, int, void *))
-{
-	NDR_CHECK(ndr_push_uint32(ndr, count));
-	return ndr_push_const_array(ndr, ndr_flags, base, elsize, count, push_fn);
-}
-
-/*
   pull a constant sized array
 */
-NTSTATUS ndr_pull_const_array(struct ndr_pull *ndr, int ndr_flags, void *base, 
-			      size_t elsize, uint32 count, 
-			      NTSTATUS (*pull_fn)(struct ndr_pull *, int, void *))
+NTSTATUS ndr_pull_array(struct ndr_pull *ndr, int ndr_flags, void *base, 
+			size_t elsize, uint32 count, 
+			NTSTATUS (*pull_fn)(struct ndr_pull *, int, void *))
 {
 	int i;
 	char *p;
@@ -251,23 +240,6 @@ done:
 	return NT_STATUS_OK;
 }
 
-/*
-  pull a generic array
-*/
-NTSTATUS ndr_pull_array(struct ndr_pull *ndr, int ndr_flags, void *base, 
-			size_t elsize, uint32 count, 
-			NTSTATUS (*pull_fn)(struct ndr_pull *, int, void *))
-{
-	uint32 max_count;
-	NDR_CHECK(ndr_pull_uint32(ndr, &max_count));
-	if (max_count != count) {
-		/* maybe we can cope with this? */
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-	return ndr_pull_const_array(ndr, ndr_flags, base, elsize, count, pull_fn);
-}
-
-
 
 /*
   print a generic array
@@ -346,3 +318,22 @@ void ndr_print_union_debug(void (*fn)(struct ndr_print *, const char *, uint16,
 	fn(&ndr, name, level, ptr);
 	talloc_destroy(ndr.mem_ctx);
 }
+
+/*
+  return and possibly log an NDR error
+*/
+NTSTATUS ndr_pull_error(struct ndr_pull *ndr, enum ndr_err_code err, const char *format, ...)
+{
+	char *s=NULL;
+	va_list ap;
+
+	va_start(ap, format);
+	vasprintf(&s, format, ap);
+	va_end(ap);
+
+	DEBUG(3,("ndr_pull_error(%u): %s\n", err, s));
+
+	free(s);
+	/* we should map to different status codes */
+	return NT_STATUS_INVALID_PARAMETER;
+}
diff --git a/source4/librpc/ndr/ndr_basic.c b/source4/librpc/ndr/ndr_basic.c
index f1996b55f7..a643f658c0 100644
--- a/source4/librpc/ndr/ndr_basic.c
+++ b/source4/librpc/ndr/ndr_basic.c
@@ -54,11 +54,7 @@ NTSTATUS ndr_pull_uint16(struct ndr_pull *ndr, uint16 *v)
 {
 	NDR_PULL_ALIGN(ndr, 2);
 	NDR_PULL_NEED_BYTES(ndr, 2);
-	if (ndr->flags & LIBNDR_FLAG_BIGENDIAN) {
-		*v = RSVAL(ndr->data, ndr->offset);
-	} else {
-		*v = SVAL(ndr->data, ndr->offset);
-	}
+	*v = SVAL(ndr->data, ndr->offset);
 	ndr->offset += 2;
 	return NT_STATUS_OK;
 }
@@ -71,11 +67,7 @@ NTSTATUS ndr_pull_uint32(struct ndr_pull *ndr, uint32 *v)
 {
 	NDR_PULL_ALIGN(ndr, 4);
 	NDR_PULL_NEED_BYTES(ndr, 4);
-	if (ndr->flags & LIBNDR_FLAG_BIGENDIAN) {
-		*v = RIVAL(ndr->data, ndr->offset);
-	} else {
-		*v = IVAL(ndr->data, ndr->offset);
-	}
+	*v = IVAL(ndr->data, ndr->offset);
 	ndr->offset += 4;
 	return NT_STATUS_OK;
 }
@@ -87,13 +79,8 @@ NTSTATUS ndr_pull_HYPER_T(struct ndr_pull *ndr, HYPER_T *v)
 {
 	NDR_PULL_ALIGN(ndr, 8);
 	NDR_PULL_NEED_BYTES(ndr, 8);
-	if (ndr->flags & LIBNDR_FLAG_BIGENDIAN) {
-		v->low = RIVAL(ndr->data, ndr->offset);
-		v->high = RIVAL(ndr->data, ndr->offset+4);
-	} else {
-		v->low = IVAL(ndr->data, ndr->offset);
-		v->high = IVAL(ndr->data, ndr->offset+4);
-	}
+	v->low = IVAL(ndr->data, ndr->offset);
+	v->high = IVAL(ndr->data, ndr->offset+4);
 	ndr->offset += 8;
 	return NT_STATUS_OK;
 }
@@ -125,12 +112,7 @@ NTSTATUS ndr_pull_bytes(struct ndr_pull *ndr, char *data, uint32 n)
 */
 NTSTATUS ndr_pull_array_uint8(struct ndr_pull *ndr, char *data, uint32 n)
 {
-	uint32 len;
-	NDR_CHECK(ndr_pull_uint32(ndr, &len));
-	if (len != n) {
-		return NT_STATUS_INVALID_PARAMETER;
-	}	
-	return ndr_pull_bytes(ndr, data, len);
+	return ndr_pull_bytes(ndr, data, n);
 }
 
 
@@ -139,11 +121,7 @@ NTSTATUS ndr_pull_array_uint8(struct ndr_pull *ndr, char *data, uint32 n)
 */
 NTSTATUS ndr_pull_array_uint16(struct ndr_pull *ndr, uint16 *data, uint32 n)
 {
-	uint32 len, i;
-	NDR_CHECK(ndr_pull_uint32(ndr, &len));
-	if (len != n) {
-		return NT_STATUS_INVALID_PARAMETER;
-	}	
+	uint32 i;
 	for (i=0;i<n;i++) {
 		NDR_CHECK(ndr_pull_uint16(ndr, &data[i]));
 	}
@@ -153,7 +131,7 @@ NTSTATUS ndr_pull_array_uint16(struct ndr_pull *ndr, uint16 *data, uint32 n)
 /*
   pull a const array of uint32
 */
-NTSTATUS ndr_pull_const_array_uint32(struct ndr_pull *ndr, uint32 *data, uint32 n)
+NTSTATUS ndr_pull_array_uint32(struct ndr_pull *ndr, uint32 *data, uint32 n)
 {
 	uint32 i;
 	for (i=0;i<n;i++) {
@@ -163,20 +141,6 @@ NTSTATUS ndr_pull_const_array_uint32(struct ndr_pull *ndr, uint32 *data, uint32
 }
 
 /*
-  pull an array of uint32
-*/
-NTSTATUS ndr_pull_array_uint32(struct ndr_pull *ndr, uint32 *data, uint32 n)
-{
-	uint32 len;
-	NDR_CHECK(ndr_pull_uint32(ndr, &len));
-	if (len != n) {
-		return NT_STATUS_INVALID_PARAMETER;
-	}	
-	return ndr_pull_const_array_uint32(ndr, data, n);
-}
-
-
-/*
   parse a GUID
 */
 NTSTATUS ndr_pull_GUID(struct ndr_pull *ndr, int ndr_flags, GUID *guid)
@@ -271,7 +235,6 @@ NTSTATUS ndr_push_bytes(struct ndr_push *ndr, const char *data, uint32 n)
 */
 NTSTATUS ndr_push_array_uint8(struct ndr_push *ndr, const char *data, uint32 n)
 {
-	NDR_CHECK(ndr_push_uint32(ndr, n));
 	return ndr_push_bytes(ndr, data, n);
 }
 
diff --git a/source4/librpc/ndr/ndr_dfs.c b/source4/librpc/ndr/ndr_dfs.c
new file mode 100644
index 0000000000..e561bdadca
--- /dev/null
+++ b/source4/librpc/ndr/ndr_dfs.c
@@ -0,0 +1,126 @@
+/* parser auto-generated by pidl */
+
+#include "includes.h"
+
+NTSTATUS ndr_push_dfs_Exist(struct ndr_push *ndr, struct dfs_Exist *r)
+{
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_Exist(struct ndr_pull *ndr, struct dfs_Exist *r)
+{
+	NDR_CHECK(ndr_pull_uint32(ndr, r->out.exist_flag));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_push_dfs_Add(struct ndr_push *ndr, struct dfs_Add *r)
+{
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.path));
+	if (r->in.path) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.path));
+	}
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.server));
+	if (r->in.server) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.server));
+	}
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.share));
+	if (r->in.share) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.share));
+	}
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.comment));
+	if (r->in.comment) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.comment));
+	}
+	NDR_CHECK(ndr_push_uint32(ndr, r->in.flags));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_Add(struct ndr_pull *ndr, struct dfs_Add *r)
+{
+	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_push_dfs_Remove(struct ndr_push *ndr, struct dfs_Remove *r)
+{
+	NDR_CHECK(ndr_push_unistr(ndr, r->in.path));
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.server));
+	if (r->in.server) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.server));
+	}
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.share));
+	if (r->in.share) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.share));
+	}
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_Remove(struct ndr_pull *ndr, struct dfs_Remove *r)
+{
+	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_push_dfs_UNKNOWN3(struct ndr_push *ndr, struct dfs_UNKNOWN3 *r)
+{
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_UNKNOWN3(struct ndr_pull *ndr, struct dfs_UNKNOWN3 *r)
+{
+	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_push_dfs_Info(struct ndr_push *ndr, struct dfs_Info *r)
+{
+	NDR_CHECK(ndr_push_unistr(ndr, r->in.path));
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.server));
+	if (r->in.server) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.server));
+	}
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.share));
+	if (r->in.share) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.share));
+	}
+	NDR_CHECK(ndr_push_uint16(ndr, r->in.level));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_Info(struct ndr_pull *ndr, struct dfs_Info *r)
+{
+	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_push_dfs_Enum(struct ndr_push *ndr, struct dfs_Enum *r)
+{
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.name));
+	if (r->in.name) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.name));
+	}
+	NDR_CHECK(ndr_push_uint32(ndr, r->in.level));
+	NDR_CHECK(ndr_push_uint32(ndr, r->in.buffer_size));
+	NDR_CHECK(ndr_push_uint32(ndr, *r->in.resume_handle));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_Enum(struct ndr_pull *ndr, struct dfs_Enum *r)
+{
+	NDR_CHECK(ndr_pull_uint32(ndr, r->out.resume_handle));
+	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
+
+	return NT_STATUS_OK;
+}
+
diff --git a/source4/librpc/ndr/ndr_dfs.h b/source4/librpc/ndr/ndr_dfs.h
new file mode 100644
index 0000000000..a1e0c2ef17
--- /dev/null
+++ b/source4/librpc/ndr/ndr_dfs.h
@@ -0,0 +1,85 @@
+/* header auto-generated by pidl */
+
+struct dfs_Exist {
+	struct {
+	} in;
+
+	struct {
+		uint32 *exist_flag;
+	} out;
+
+};
+
+struct dfs_Add {
+	struct {
+		const char *path;
+		const char *server;
+		const char *share;
+		const char *comment;
+		uint32 flags;
+	} in;
+
+	struct {
+		NTSTATUS result;
+	} out;
+
+};
+
+struct dfs_Remove {
+	struct {
+		const char *path;
+		const char *server;
+		const char *share;
+	} in;
+
+	struct {
+		NTSTATUS result;
+	} out;
+
+};
+
+struct dfs_UNKNOWN3 {
+	struct {
+	} in;
+
+	struct {
+		NTSTATUS result;
+	} out;
+
+};
+
+struct dfs_Info {
+	struct {
+		const char *path;
+		const char *server;
+		const char *share;
+		uint16 level;
+	} in;
+
+	struct {
+		NTSTATUS result;
+	} out;
+
+};
+
+struct dfs_Enum {
+	struct {
+		const char *name;
+		uint32 level;
+		uint32 buffer_size;
+		uint32 *resume_handle;
+	} in;
+
+	struct {
+		uint32 *resume_handle;
+		NTSTATUS result;
+	} out;
+
+};
+
+#define DCERPC_DFS_EXIST 0
+#define DCERPC_DFS_ADD 1
+#define DCERPC_DFS_REMOVE 2
+#define DCERPC_DFS_UNKNOWN3 3
+#define DCERPC_DFS_INFO 4
+#define DCERPC_DFS_ENUM 5
diff --git a/source4/librpc/ndr/ndr_echo.c b/source4/librpc/ndr/ndr_echo.c
index afe7f0c873..fb186e1ce9 100644
--- a/source4/librpc/ndr/ndr_echo.c
+++ b/source4/librpc/ndr/ndr_echo.c
@@ -19,8 +19,9 @@ NTSTATUS ndr_pull_echo_AddOne(struct ndr_pull *ndr, struct echo_AddOne *r)
 NTSTATUS ndr_push_echo_EchoData(struct ndr_push *ndr, struct echo_EchoData *r)
 {
 	NDR_CHECK(ndr_push_uint32(ndr, r->in.len));
-	if (r->in.data) {
-		NDR_CHECK(ndr_push_array_uint8(ndr, r->in.data, r->in.len));
+	if (r->in.in_data) {
+		NDR_CHECK(ndr_push_uint32(ndr, r->in.len));
+		NDR_CHECK(ndr_push_array_uint8(ndr, r->in.in_data, r->in.len));
 	}
 
 	return NT_STATUS_OK;
@@ -28,8 +29,16 @@ NTSTATUS ndr_push_echo_EchoData(struct ndr_push *ndr, struct echo_EchoData *r)
 
 NTSTATUS ndr_pull_echo_EchoData(struct ndr_pull *ndr, struct echo_EchoData *r)
 {
-	if (r->out.data) {
-		NDR_CHECK(ndr_pull_array_uint8(ndr, r->out.data, r->in.len));
+	if (r->out.out_data) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->in.len > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->in.len);
+		}
+	}
+		NDR_ALLOC_N_SIZE(ndr, r->out.out_data, r->in.len, sizeof(r->out.out_data[0]));
+		NDR_CHECK(ndr_pull_array_uint8(ndr, r->out.out_data, r->in.len));
 	}
 
 	return NT_STATUS_OK;
@@ -39,6 +48,7 @@ NTSTATUS ndr_push_echo_SinkData(struct ndr_push *ndr, struct echo_SinkData *r)
 {
 	NDR_CHECK(ndr_push_uint32(ndr, r->in.len));
 	if (r->in.data) {
+		NDR_CHECK(ndr_push_uint32(ndr, r->in.len));
 		NDR_CHECK(ndr_push_array_uint8(ndr, r->in.data, r->in.len));
 	}
 
@@ -61,9 +71,72 @@ NTSTATUS ndr_push_echo_SourceData(struct ndr_push *ndr, struct echo_SourceData *
 NTSTATUS ndr_pull_echo_SourceData(struct ndr_pull *ndr, struct echo_SourceData *r)
 {
 	if (r->out.data) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->in.len > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->in.len);
+		}
+	}
 		NDR_CHECK(ndr_pull_array_uint8(ndr, r->out.data, r->in.len));
 	}
 
 	return NT_STATUS_OK;
 }
 
+static NTSTATUS ndr_pull_Struct1(struct ndr_pull *ndr, int ndr_flags, struct Struct1 *r)
+{
+	uint32 _conformant_size;
+	NDR_CHECK(ndr_pull_uint32(ndr, &_conformant_size));
+	NDR_CHECK(ndr_pull_align(ndr, 4));
+	if (!(ndr_flags & NDR_SCALARS)) goto buffers;
+	NDR_CHECK(ndr_pull_uint32(ndr, &r->bar));
+	NDR_CHECK(ndr_pull_uint32(ndr, &r->count));
+	NDR_CHECK(ndr_pull_uint32(ndr, &r->foo));
+buffers:
+	if (!(ndr_flags & NDR_BUFFERS)) goto done;
+	if (r->count > _conformant_size) {
+		return ndr_pull_error(ndr, NDR_ERR_CONFORMANT_SIZE, "Bad conformant size %u should be %u", _conformant_size, r->count);
+	}
+		NDR_ALLOC_N_SIZE(ndr, r->s, _conformant_size, sizeof(r->s[0]));
+		NDR_CHECK(ndr_pull_array_uint32(ndr, r->s, r->count));
+done:
+	return NT_STATUS_OK;
+}
+
+void ndr_print_Struct1(struct ndr_print *ndr, const char *name, struct Struct1 *r)
+{
+	ndr_print_struct(ndr, name, "Struct1");
+	ndr->depth++;
+	ndr_print_uint32(ndr, "bar", r->bar);
+	ndr_print_uint32(ndr, "count", r->count);
+	ndr_print_uint32(ndr, "foo", r->foo);
+	ndr_print_ptr(ndr, "s", r->s);
+	ndr->depth++;
+		ndr_print_array_uint32(ndr, "s", r->s, r->count);
+	ndr->depth--;
+	ndr->depth--;
+}
+
+NTSTATUS ndr_push_TestCall(struct ndr_push *ndr, struct TestCall *r)
+{
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_TestCall(struct ndr_pull *ndr, struct TestCall *r)
+{
+	uint32 _ptr_s1;
+	NDR_CHECK(ndr_pull_uint32(ndr, &_ptr_s1));
+	if (_ptr_s1) {
+		NDR_ALLOC(ndr, r->out.s1);
+	} else {
+		r->out.s1 = NULL;
+	}
+	if (r->out.s1) {
+		NDR_CHECK(ndr_pull_Struct1(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.s1));
+	}
+
+	return NT_STATUS_OK;
+}
+
diff --git a/source4/librpc/ndr/ndr_echo.h b/source4/librpc/ndr/ndr_echo.h
index ed187fd4d6..b2c6774c09 100644
--- a/source4/librpc/ndr/ndr_echo.h
+++ b/source4/librpc/ndr/ndr_echo.h
@@ -14,11 +14,11 @@ struct echo_AddOne {
 struct echo_EchoData {
 	struct {
 		uint32 len;
-		uint8 *data;
+		uint8 *in_data;
 	} in;
 
 	struct {
-		uint8 *data;
+		uint8 *out_data;
 	} out;
 
 };
@@ -45,7 +45,25 @@ struct echo_SourceData {
 
 };
 
+struct Struct1 {
+	uint32 bar;
+	uint32 count;
+	uint32 foo;
+	uint32 *s;
+};
+
+struct TestCall {
+	struct {
+	} in;
+
+	struct {
+		struct Struct1 **s1;
+	} out;
+
+};
+
 #define DCERPC_ECHO_ADDONE 0
 #define DCERPC_ECHO_ECHODATA 1
 #define DCERPC_ECHO_SINKDATA 2
 #define DCERPC_ECHO_SOURCEDATA 3
+#define DCERPC_TESTCALL 4
diff --git a/source4/librpc/ndr/ndr_lsa.c b/source4/librpc/ndr/ndr_lsa.c
index e62107a3e8..a1f01e0278 100644
--- a/source4/librpc/ndr/ndr_lsa.c
+++ b/source4/librpc/ndr/ndr_lsa.c
@@ -123,6 +123,13 @@ static NTSTATUS ndr_pull_lsa_PrivArray(struct ndr_pull *ndr, int ndr_flags, stru
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->privs) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->privs, r->count, sizeof(r->privs[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->privs, sizeof(r->privs[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_PrivEntry));
 	}
@@ -354,12 +361,17 @@ void ndr_print_lsa_AuditLogInfo(struct ndr_print *ndr, const char *name, struct
 
 static NTSTATUS ndr_pull_lsa_AuditSettings(struct ndr_pull *ndr, int ndr_flags, struct lsa_AuditSettings *r)
 {
+	uint32 _conformant_size;
+	NDR_CHECK(ndr_pull_uint32(ndr, &_conformant_size));
 	NDR_CHECK(ndr_pull_align(ndr, 4));
 	if (!(ndr_flags & NDR_SCALARS)) goto buffers;
 	NDR_CHECK(ndr_pull_uint32(ndr, &r->count));
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
-		NDR_ALLOC_N_SIZE(ndr, r->settings, r->count, sizeof(r->settings[0]));
+	if (r->count > _conformant_size) {
+		return ndr_pull_error(ndr, NDR_ERR_CONFORMANT_SIZE, "Bad conformant size %u should be %u", _conformant_size, r->count);
+	}
+		NDR_ALLOC_N_SIZE(ndr, r->settings, _conformant_size, sizeof(r->settings[0]));
 		NDR_CHECK(ndr_pull_array_uint32(ndr, r->settings, r->count));
 done:
 	return NT_STATUS_OK;
@@ -699,7 +711,7 @@ static NTSTATUS ndr_pull_lsa_PolicyInformation(struct ndr_pull *ndr, int ndr_fla
 	break;
 
 	default:
-		return NT_STATUS_INVALID_LEVEL;
+		return ndr_pull_error(ndr, NDR_ERR_BAD_SWITCH, "Bad switch value %u in ", *level);
 	}
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
@@ -753,7 +765,7 @@ buffers:
 	break;
 
 	default:
-		return NT_STATUS_INVALID_LEVEL;
+		return ndr_pull_error(ndr, NDR_ERR_BAD_SWITCH, "Bad switch value %u in ", *level);
 	}
 done:
 	return NT_STATUS_OK;
@@ -836,7 +848,7 @@ NTSTATUS ndr_pull_lsa_QueryInfoPolicy(struct ndr_pull *ndr, struct lsa_QueryInfo
 	if (r->out.info) {
 	{ uint16 _level;
 	NDR_CHECK(ndr_pull_lsa_PolicyInformation(ndr, NDR_SCALARS|NDR_BUFFERS, &_level, r->out.info));
-	if (_level != r->in.level) return NT_STATUS_INVALID_LEVEL;
+	if (_level != r->in.level) return ndr_pull_error(ndr, NDR_ERR_BAD_SWITCH, "Bad switch value %u in info");
 	}
 	}
 	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
@@ -939,6 +951,7 @@ static NTSTATUS ndr_push_lsa_SidArray(struct ndr_push *ndr, int ndr_flags, struc
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->sids) {
+		NDR_CHECK(ndr_push_uint32(ndr, r->num_sids));
 		NDR_CHECK(ndr_push_array(ndr, ndr_flags, r->sids, sizeof(r->sids[0]), r->num_sids, (ndr_push_flags_fn_t)ndr_push_lsa_SidPtr));
 	}
 done:
@@ -960,6 +973,13 @@ static NTSTATUS ndr_pull_lsa_SidArray(struct ndr_pull *ndr, int ndr_flags, struc
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->sids) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->num_sids > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->num_sids);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->sids, r->num_sids, sizeof(r->sids[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->sids, sizeof(r->sids[0]), r->num_sids, (ndr_pull_flags_fn_t)ndr_pull_lsa_SidPtr));
 	}
@@ -1063,6 +1083,13 @@ static NTSTATUS ndr_pull_lsa_DomainList(struct ndr_pull *ndr, int ndr_flags, str
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->domains) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->domains, r->count, sizeof(r->domains[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->domains, sizeof(r->domains[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_DomainInformation));
 	}
@@ -1147,6 +1174,7 @@ static NTSTATUS ndr_push_lsa_TransSidArray(struct ndr_push *ndr, int ndr_flags,
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->sids) {
+		NDR_CHECK(ndr_push_uint32(ndr, r->count));
 		NDR_CHECK(ndr_push_array(ndr, ndr_flags, r->sids, sizeof(r->sids[0]), r->count, (ndr_push_flags_fn_t)ndr_push_lsa_TranslatedSid));
 	}
 done:
@@ -1168,6 +1196,13 @@ static NTSTATUS ndr_pull_lsa_TransSidArray(struct ndr_pull *ndr, int ndr_flags,
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->sids) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->sids, r->count, sizeof(r->sids[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->sids, sizeof(r->sids[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_TranslatedSid));
 	}
@@ -1241,6 +1276,13 @@ static NTSTATUS ndr_pull_lsa_RefDomainList(struct ndr_pull *ndr, int ndr_flags,
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->domains) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->domains, r->count, sizeof(r->domains[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->domains, sizeof(r->domains[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_TrustInformation));
 	}
@@ -1269,6 +1311,7 @@ NTSTATUS ndr_push_lsa_LookupNames(struct ndr_push *ndr, struct lsa_LookupNames *
 	NDR_CHECK(ndr_push_uint32(ndr, r->in.num_names));
 	if (r->in.names) {
 		int ndr_flags = NDR_SCALARS|NDR_BUFFERS;
+		NDR_CHECK(ndr_push_uint32(ndr, r->in.num_names));
 		NDR_CHECK(ndr_push_array(ndr, ndr_flags, r->in.names, sizeof(r->in.names[0]), r->in.num_names, (ndr_push_flags_fn_t)ndr_push_lsa_Name));
 	}
 	NDR_CHECK(ndr_push_lsa_TransSidArray(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.sids));
@@ -1344,6 +1387,7 @@ static NTSTATUS ndr_push_lsa_TransNameArray(struct ndr_push *ndr, int ndr_flags,
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->names) {
+		NDR_CHECK(ndr_push_uint32(ndr, r->count));
 		NDR_CHECK(ndr_push_array(ndr, ndr_flags, r->names, sizeof(r->names[0]), r->count, (ndr_push_flags_fn_t)ndr_push_lsa_TranslatedName));
 	}
 done:
@@ -1365,6 +1409,13 @@ static NTSTATUS ndr_pull_lsa_TransNameArray(struct ndr_pull *ndr, int ndr_flags,
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->names) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->names, r->count, sizeof(r->names[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->names, sizeof(r->names[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_TranslatedName));
 	}
@@ -1491,14 +1542,19 @@ void ndr_print_lsa_LUIDAttribute(struct ndr_print *ndr, const char *name, struct
 
 static NTSTATUS ndr_pull_lsa_PrivilegeSet(struct ndr_pull *ndr, int ndr_flags, struct lsa_PrivilegeSet *r)
 {
+	uint32 _conformant_size;
+	NDR_CHECK(ndr_pull_uint32(ndr, &_conformant_size));
 	NDR_CHECK(ndr_pull_align(ndr, 4));
 	if (!(ndr_flags & NDR_SCALARS)) goto buffers;
 	NDR_CHECK(ndr_pull_uint32(ndr, &r->count));
+	NDR_CHECK(ndr_pull_uint32(ndr, &r->unknown));
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
-		NDR_ALLOC_N_SIZE(ndr, r->set, r->count, sizeof(r->set[0]));
+	if (r->count > _conformant_size) {
+		return ndr_pull_error(ndr, NDR_ERR_CONFORMANT_SIZE, "Bad conformant size %u should be %u", _conformant_size, r->count);
+	}
+		NDR_ALLOC_N_SIZE(ndr, r->set, _conformant_size, sizeof(r->set[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->set, sizeof(r->set[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_LUIDAttribute));
-		NDR_CHECK(ndr_pull_const_array_uint32(ndr, r->unknown, 1));
 done:
 	return NT_STATUS_OK;
 }
@@ -1508,14 +1564,11 @@ void ndr_print_lsa_PrivilegeSet(struct ndr_print *ndr, const char *name, struct
 	ndr_print_struct(ndr, name, "lsa_PrivilegeSet");
 	ndr->depth++;
 	ndr_print_uint32(ndr, "count", r->count);
+	ndr_print_uint32(ndr, "unknown", r->unknown);
 	ndr_print_ptr(ndr, "set", r->set);
 	ndr->depth++;
 		ndr_print_array(ndr, "set", r->set, sizeof(r->set[0]), r->count, (ndr_print_fn_t)ndr_print_lsa_LUIDAttribute);
 	ndr->depth--;
-	ndr_print_ptr(ndr, "unknown", r->unknown);
-	ndr->depth++;
-		ndr_print_array_uint32(ndr, "unknown", r->unknown, 1);
-	ndr->depth--;
 	ndr->depth--;
 }
 
@@ -1805,6 +1858,13 @@ static NTSTATUS ndr_pull_lsa_RightSet(struct ndr_pull *ndr, int ndr_flags, struc
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->names) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->names, r->count, sizeof(r->names[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->names, sizeof(r->names[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_Name));
 	}
diff --git a/source4/librpc/ndr/ndr_lsa.h b/source4/librpc/ndr/ndr_lsa.h
index b502064bbf..7cc0d0f3da 100644
--- a/source4/librpc/ndr/ndr_lsa.h
+++ b/source4/librpc/ndr/ndr_lsa.h
@@ -405,8 +405,8 @@ struct lsa_LUIDAttribute {
 
 struct lsa_PrivilegeSet {
 	uint32 count;
+	uint32 unknown;
 	struct lsa_LUIDAttribute *set;
-	uint32 unknown[1];
 };
 
 struct lsa_EnumPrivsAccount {
diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index 3018b8621b..82c07dd197 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -792,6 +792,8 @@ NTSTATUS dcerpc_ndr_request(struct dcerpc_pipe *p,
 		goto failed;
 	}
 
+	dump_data(10, pull->data, pull->data_size);
+
 	/* pull the structure from the blob */
 	status = ndr_pull(pull, struct_ptr);
 	if (!NT_STATUS_IS_OK(status)) {
diff --git a/source4/librpc/rpc/rpc_dfs.c b/source4/librpc/rpc/rpc_dfs.c
new file mode 100644
index 0000000000..1e827bda07
--- /dev/null
+++ b/source4/librpc/rpc/rpc_dfs.c
@@ -0,0 +1,82 @@
+/* dcerpc client calls auto-generated by pidl */
+
+#include "includes.h"
+
+
+NTSTATUS dcerpc_dfs_Exist(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, struct dfs_Exist *r)
+{
+	return dcerpc_ndr_request(p, DCERPC_DFS_EXIST, mem_ctx,
+				  (ndr_push_fn_t) ndr_push_dfs_Exist,
+				  (ndr_pull_fn_t) ndr_pull_dfs_Exist,
+				  r);
+}
+
+NTSTATUS dcerpc_dfs_Add(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, struct dfs_Add *r)
+{
+	NTSTATUS status;
+	status = dcerpc_ndr_request(p, DCERPC_DFS_ADD, mem_ctx,
+				    (ndr_push_fn_t) ndr_push_dfs_Add,
+				    (ndr_pull_fn_t) ndr_pull_dfs_Add,
+				    r);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	
+	return r->out.result;
+}
+
+NTSTATUS dcerpc_dfs_Remove(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, struct dfs_Remove *r)
+{
+	NTSTATUS status;
+	status = dcerpc_ndr_request(p, DCERPC_DFS_REMOVE, mem_ctx,
+				    (ndr_push_fn_t) ndr_push_dfs_Remove,
+				    (ndr_pull_fn_t) ndr_pull_dfs_Remove,
+				    r);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	
+	return r->out.result;
+}
+
+NTSTATUS dcerpc_dfs_UNKNOWN3(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, struct dfs_UNKNOWN3 *r)
+{
+	NTSTATUS status;
+	status = dcerpc_ndr_request(p, DCERPC_DFS_UNKNOWN3, mem_ctx,
+				    (ndr_push_fn_t) ndr_push_dfs_UNKNOWN3,
+				    (ndr_pull_fn_t) ndr_pull_dfs_UNKNOWN3,
+				    r);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	
+	return r->out.result;
+}
+
+NTSTATUS dcerpc_dfs_Info(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, struct dfs_Info *r)
+{
+	NTSTATUS status;
+	status = dcerpc_ndr_request(p, DCERPC_DFS_INFO, mem_ctx,
+				    (ndr_push_fn_t) ndr_push_dfs_Info,
+				    (ndr_pull_fn_t) ndr_pull_dfs_Info,
+				    r);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	
+	return r->out.result;
+}
+
+NTSTATUS dcerpc_dfs_Enum(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, struct dfs_Enum *r)
+{
+	NTSTATUS status;
+	status = dcerpc_ndr_request(p, DCERPC_DFS_ENUM, mem_ctx,
+				    (ndr_push_fn_t) ndr_push_dfs_Enum,
+				    (ndr_pull_fn_t) ndr_pull_dfs_Enum,
+				    r);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	
+	return r->out.result;
+}
diff --git a/source4/librpc/rpc/rpc_echo.c b/source4/librpc/rpc/rpc_echo.c
index e5cbb913a1..b7e3bf4e7c 100644
--- a/source4/librpc/rpc/rpc_echo.c
+++ b/source4/librpc/rpc/rpc_echo.c
@@ -34,3 +34,11 @@ NTSTATUS dcerpc_echo_SourceData(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, stru
 				  (ndr_pull_fn_t) ndr_pull_echo_SourceData,
 				  r);
 }
+
+NTSTATUS dcerpc_TestCall(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, struct TestCall *r)
+{
+	return dcerpc_ndr_request(p, DCERPC_TESTCALL, mem_ctx,
+				  (ndr_push_fn_t) ndr_push_TestCall,
+				  (ndr_pull_fn_t) ndr_pull_TestCall,
+				  r);
+}
diff --git a/source4/torture/rpc/dfs.c b/source4/torture/rpc/dfs.c
new file mode 100644
index 0000000000..3f8d789fe8
--- /dev/null
+++ b/source4/torture/rpc/dfs.c
@@ -0,0 +1,90 @@
+/* 
+   Unix SMB/CIFS implementation.
+   test suite for lsa dfs operations
+
+   Copyright (C) Andrew Tridgell 2003
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+
+
+static BOOL test_Exist(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
+{
+	NTSTATUS status;
+	struct dfs_Exist r;
+	uint32 exist = 0;
+
+	r.out.exist_flag = &exist;
+
+	status = dcerpc_dfs_Exist(p, mem_ctx, &r);
+	if (!NT_STATUS_IS_OK(status)) {
+		printf("Exist failed - %s\n", nt_errstr(status));
+		return False;
+	}
+
+	printf("exist=%d\n", exist);
+
+	return True;
+}
+
+static BOOL test_Enum(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
+{
+	NTSTATUS status;
+	struct dfs_Enum r;
+	uint32 resume_handle = 0;
+
+	r.in.name = "";
+	r.in.level = 1;
+	r.in.buffer_size = 20000;
+	r.in.resume_handle = &resume_handle;
+	r.out.resume_handle = &resume_handle;
+
+	status = dcerpc_dfs_Enum(p, mem_ctx, &r);
+	if (!NT_STATUS_IS_OK(status)) {
+		printf("Enum failed - %s\n", nt_errstr(status));
+		return False;
+	}
+
+	return True;
+}
+
+BOOL torture_rpc_dfs(int dummy)
+{
+        NTSTATUS status;
+        struct dcerpc_pipe *p;
+	TALLOC_CTX *mem_ctx;
+	BOOL ret = True;
+
+	mem_ctx = talloc_init("torture_rpc_dfs");
+
+	status = torture_rpc_connection(&p, "netdfs");
+	if (!NT_STATUS_IS_OK(status)) {
+		return False;
+	}
+	
+	if (!test_Exist(p, mem_ctx)) {
+		ret = False;
+	}
+
+	if (!test_Enum(p, mem_ctx)) {
+		ret = False;
+	}
+
+        torture_rpc_close(p);
+
+	return ret;
+}
diff --git a/source4/torture/rpc/echo.c b/source4/torture/rpc/echo.c
index ebf82c692e..b8c2437e4b 100644
--- a/source4/torture/rpc/echo.c
+++ b/source4/torture/rpc/echo.c
@@ -68,8 +68,7 @@ static BOOL test_echodata(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
 	}
 	
 	r.in.len = len;
-	r.in.data = data_in;
-	r.out.data = data_out;
+	r.in.in_data = data_in;
 
 	status = dcerpc_echo_EchoData(p, mem_ctx, &r);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -77,9 +76,18 @@ static BOOL test_echodata(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
 		return False;
 	}
 
-	if (memcmp(data_in, data_out, len) != 0) {
-		printf("Bad data returned for len %d!\n", len);
-		return False;
+	data_out = r.out.out_data;
+
+	for (i=0;i<len;i++) {
+		if (data_in[i] != data_out[i]) {
+			printf("Bad data returned for len %d at offset %d\n", 
+			       len, i);
+			printf("in:\n");
+			dump_data(0, data_in, MIN(len, 16));
+			printf("out:\n");
+			dump_data(0, data_out, MIN(len, 16));
+			return False;
+		}
 	}
 
 
@@ -154,6 +162,27 @@ static BOOL test_sinkdata(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
 	return True;
 }
 
+
+/*
+  test the testcall interface
+*/
+static BOOL test_testcall(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
+{
+	NTSTATUS status;
+	struct TestCall r;
+
+	printf("\nTesting TestCall\n");
+	status = dcerpc_TestCall(p, mem_ctx, &r);
+	if (!NT_STATUS_IS_OK(status)) {
+		printf("TestCall failed - %s\n", nt_errstr(status));
+		return False;
+	}
+
+	NDR_PRINT_DEBUG(Struct1, r.out.s1);	
+
+	return True;
+}
+
 BOOL torture_rpc_echo(int dummy)
 {
         NTSTATUS status;
@@ -184,6 +213,10 @@ BOOL torture_rpc_echo(int dummy)
 		ret = False;
 	}
 
+	if (!test_testcall(p, mem_ctx)) {
+		ret = False;
+	}
+
 	printf("\n");
 	
         torture_rpc_close(p);
diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c
index 9d0177edfa..10a2545b96 100644
--- a/source4/torture/rpc/lsa.c
+++ b/source4/torture/rpc/lsa.c
@@ -288,8 +288,8 @@ static BOOL test_EnumPrivsAccount(struct dcerpc_pipe *p,
 		return False;
 	}
 
-	printf("received %d privileges with unknown=0x%x\n", 
-	       r.out.privs?r.out.privs->count:0, r.out.unknown);
+	printf("received %d privileges\n", 
+	       r.out.privs?r.out.privs->count:0);
 
 	if (r.out.privs) {
 		int i;
diff --git a/source4/torture/torture.c b/source4/torture/torture.c
index d88a58032f..967631c66b 100644
--- a/source4/torture/torture.c
+++ b/source4/torture/torture.c
@@ -3986,6 +3986,7 @@ static struct {
 	{"SCAN-SMB", torture_smb_scan, 0},
         {"RPC-LSA", torture_rpc_lsa, 0},
         {"RPC-ECHO", torture_rpc_echo, 0},
+        {"RPC-DFS", torture_rpc_dfs, 0},
 	{NULL, NULL, 0}};