Merge branch 'master' of ssh://git.samba.org/data/git/samba into arc4

124 files changed, 4543 insertions, 4865 deletions

diff --git a/source3/Makefile.in b/source3/Makefile.in
index b8ce0523dd..09c054a1e3 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -127,6 +127,7 @@ LOGFILEBASE = @logfilebase@
 CONFIGFILE = $(CONFIGDIR)/smb.conf
 LMHOSTSFILE = $(CONFIGDIR)/lmhosts
 CTDBDIR = @ctdbdir@
+NCALRPCDIR = @ncalrpcdir@
 
 # This is where smbpasswd et al go
 PRIVATEDIR = @privatedir@
@@ -166,6 +167,7 @@ PATH_FLAGS = -DSMB_PASSWD_FILE=\"$(SMB_PASSWD_FILE)\" \
 	-DLOGFILEBASE=\"$(LOGFILEBASE)\" \
 	-DSHLIBEXT=\"@SHLIBEXT@\" \
 	-DCTDBDIR=\"$(CTDBDIR)\" \
+	-DNCALRPCDIR=\"$(NCALRPCDIR)\" \
 	-DCONFIGDIR=\"$(CONFIGDIR)\" \
 	-DCODEPAGEDIR=\"$(CODEPAGEDIR)\" \
 	-DCACHEDIR=\"$(CACHEDIR)\" \
@@ -621,6 +623,7 @@ VFS_FILEID_OBJ = modules/vfs_fileid.o
 VFS_AIO_FORK_OBJ = modules/vfs_aio_fork.o
 VFS_SYNCOPS_OBJ = modules/vfs_syncops.o
 VFS_ACL_XATTR_OBJ = modules/vfs_acl_xattr.o
+VFS_SMB_TRAFFIC_ANALYZER_OBJ = modules/vfs_smb_traffic_analyzer.o
 
 PLAINTEXT_AUTH_OBJ = auth/pampass.o auth/pass_check.o
 
@@ -635,6 +638,7 @@ AUTH_SERVER_OBJ = auth/auth_server.o
 AUTH_UNIX_OBJ = auth/auth_unix.o
 AUTH_WINBIND_OBJ = auth/auth_winbind.o
 AUTH_SCRIPT_OBJ = auth/auth_script.o
+AUTH_NETLOGOND_OBJ = auth/auth_netlogond.o
 
 AUTH_OBJ = auth/auth.o @AUTH_STATIC@ auth/auth_util.o auth/token_util.o \
 	   auth/auth_compat.o auth/auth_ntlmssp.o \
@@ -738,6 +742,10 @@ TESTPARM_OBJ = utils/testparm.o \
                $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) \
 	       $(LIBSAMBA_OBJ)
 
+TEST_LP_LOAD_OBJ = param/test_lp_load.o \
+		   $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) \
+		   $(POPT_LIB_OBJ) $(LIBSAMBA_OBJ)
+
 PASSWD_UTIL_OBJ = utils/passwd_util.o
 
 SMBPASSWD_OBJ = utils/smbpasswd.o $(PASSWD_UTIL_OBJ) $(PASSCHANGE_OBJ) \
@@ -1070,7 +1078,7 @@ LDBDEL_OBJ = $(LDB_CMDLINE_OBJ) lib/ldb/tools/ldbdel.o
 LDBMODIFY_OBJ = $(LDB_CMDLINE_OBJ) lib/ldb/tools/ldbmodify.o
 
 WINBIND_KRB5_LOCATOR_OBJ1 = nsswitch/winbind_krb5_locator.o
-WINBIND_KRB5_LOCATOR_OBJ = $(WINBIND_KRB5_LOCATOR_OBJ1) $(WBCOMMON_OBJ) $(LIBREPLACE_OBJ)
+WINBIND_KRB5_LOCATOR_OBJ = $(WINBIND_KRB5_LOCATOR_OBJ1) $(LIBREPLACE_OBJ)
 
 POPT_OBJ=../lib/popt/findme.o ../lib/popt/popt.o ../lib/popt/poptconfig.o \
           ../lib/popt/popthelp.o ../lib/popt/poptparse.o
@@ -1138,6 +1146,8 @@ pam_smbpass: SHOWFLAGS bin/pam_smbpass.@SHLIBEXT@
 
 pam_winbind: SHOWFLAGS bin/pam_winbind.@SHLIBEXT@
 
+gpext_modules:: $(GPEXT_MODULES)
+
 torture:: SHOWFLAGS $(TORTURE_PROGS)
 
 smbtorture : SHOWFLAGS bin/smbtorture@EXEEXT@
@@ -1708,6 +1718,7 @@ LIBWBCLIENT_OBJ0 = nsswitch/libwbclient/wbclient.o \
 		  nsswitch/libwbclient/wbc_pwd.o \
 		  nsswitch/libwbclient/wbc_idmap.o \
 		  nsswitch/libwbclient/wbc_sid.o \
+		  nsswitch/libwbclient/wbc_guid.o \
 		  nsswitch/libwbclient/wbc_pam.o
 LIBWBCLIENT_OBJ = $(LIBWBCLIENT_OBJ0) \
 		  $(WBCOMMON_OBJ) \
@@ -2166,15 +2177,15 @@ bin/vlp@EXEEXT@: $(BINARY_PREREQS) $(VLP_OBJ) @LIBTALLOC_SHARED@ @LIBTDB_SHARED@
 		$(LDAP_LIBS) $(KRB5LIBS) $(LIBS) $(LIBTALLOC_LIBS) $(LIBTDB_LIBS) \
 		@SONAMEFLAG@`basename $@`@NSSSONAMEVERSIONSUFFIX@
 
-bin/winbind_krb5_locator.@SHLIBEXT@: $(BINARY_PREREQS) $(WINBIND_KRB5_LOCATOR_OBJ)
+bin/winbind_krb5_locator.@SHLIBEXT@: $(BINARY_PREREQS) $(WINBIND_KRB5_LOCATOR_OBJ) @LIBWBCLIENT_SHARED@
 	@echo "Linking $@"
-	@$(SHLD) $(LDSHFLAGS) -o $@ $(WINBIND_KRB5_LOCATOR_OBJ) \
+	@$(SHLD) $(LDSHFLAGS) -o $@ $(WINBIND_KRB5_LOCATOR_OBJ) $(WINBIND_LIBS) \
 		@SONAMEFLAG@`basename $@`
 
-bin/pam_winbind.@SHLIBEXT@: $(BINARY_PREREQS) $(PAM_WINBIND_OBJ)
+bin/pam_winbind.@SHLIBEXT@: $(BINARY_PREREQS) $(PAM_WINBIND_OBJ) @LIBTALLOC_SHARED@ @LIBWBCLIENT_SHARED@
 	@echo "Linking shared library $@"
 	@$(SHLD) $(LDSHFLAGS) -o $@ $(PAM_WINBIND_OBJ) -lpam @INIPARSERLIBS@ \
-		$(PAM_WINBIND_EXTRA_LIBS) @SONAMEFLAG@`basename $@`
+		$(PAM_WINBIND_EXTRA_LIBS) $(LIBTALLOC_LIBS) $(WINBIND_LIBS) @SONAMEFLAG@`basename $@`
 
 bin/builtin.@SHLIBEXT@: $(BINARY_PREREQS) $(AUTH_BUILTIN_OBJ)
 	@echo "Building plugin $@"
@@ -2188,6 +2199,10 @@ bin/script.@SHLIBEXT@: $(BINARY_PREREQS) $(AUTH_SCRIPT_OBJ)
 	@echo "Building plugin $@"
 	@$(SHLD_MODULE) $(AUTH_SCRIPT_OBJ)
 
+bin/netlogond.@SHLIBEXT@: $(BINARY_PREREQS) $(AUTH_NETLOGOND_OBJ)
+	@echo "Building plugin $@"
+	@$(SHLD_MODULE) $(AUTH_NETLOGOND_OBJ)
+
 bin/smbserver.@SHLIBEXT@: $(BINARY_PREREQS) $(AUTH_SERVER_OBJ)
 	@echo "Building plugin $@"
 	@$(SHLD_MODULE) $(AUTH_SERVER_OBJ)
@@ -2403,6 +2418,10 @@ bin/acl_xattr.@SHLIBEXT@: $(BINARY_PREREQS) $(VFS_ACL_XATTR_OBJ)
 	@echo "Building plugin $@"
 	@$(SHLD_MODULE) $(VFS_ACL_XATTR_OBJ)
 
+bin/smb_traffic_analyzer.@SHLIBEXT@: $(BINARY_PREREQS) $(VFS_SMB_TRAFFIC_ANALYZER_OBJ)
+	@echo "Building plugin $@"
+	@$(SHLD_MODULE) $(VFS_SMB_TRAFFIC_ANALYZER_OBJ)
+
 bin/registry.@SHLIBEXT@: $(BINARY_PREREQS) libgpo/gpext/registry.o
 	@echo "Building plugin $@"
 	@$(SHLD_MODULE) libgpo/gpext/registry.o
@@ -2411,6 +2430,10 @@ bin/scripts.@SHLIBEXT@: $(BINARY_PREREQS) libgpo/gpext/scripts.o
 	@echo "Building plugin $@"
 	@$(SHLD_MODULE) libgpo/gpext/scripts.o
 
+bin/security.@SHLIBEXT@: $(BINARY_PREREQS) libgpo/gpext/security.o
+	@echo "Building plugin $@"
+	@$(SHLD_MODULE) libgpo/gpext/security.o
+
 #########################################################
 ## IdMap NSS plugins
 
@@ -2483,6 +2506,13 @@ bin/rpc_open_tcp@EXEEXT@: $(BINARY_PREREQS) $(RPC_OPEN_TCP_OBJ) @LIBTALLOC_SHARE
 		$(LIBS) $(LIBTALLOC_LIBS) @LIBTDB_SHARED@ $(WINBIND_LIBS) \
 		$(LDAP_LIBS) $(KRB5LIBS) $(NSCD_LIBS)
 
+bin/test_lp_load@EXEEXT@: $(BINARY_PREREQS) $(TEST_LP_LOAD_OBJ) @BUILD_POPT@ @LIBTALLOC_SHARED@ @LIBTDB_SHARED@
+	@echo "Linking $@"
+	@$(CC) $(FLAGS) -o $@ $(TEST_LP_LOAD_OBJ) \
+		$(LDFLAGS) $(DYNEEXP) $(LIBS) \
+		$(LDAP_LIBS) \
+		$(POPT_LIBS) $(LIBTALLOC_LIBS) $(LIBTDB_LIBS)
+
 install:: installservers installbin @INSTALL_CIFSMOUNT@ @INSTALL_CIFSUPCALL@ installman \
 		installscripts installdat installmodules @SWAT_INSTALL_TARGETS@ \
 		@INSTALL_PAM_MODULES@ installlibs
@@ -2533,6 +2563,8 @@ installmodules:: modules installdirs
 	@$(SHELL) $(srcdir)/script/linkmodules.sh $(DESTDIR)$(AUTHLIBDIR) domain.@SHLIBEXT@ trustdomain.@SHLIBEXT@ ntdomain.@SHLIBEXT@
 	@$(SHELL) $(srcdir)/script/linkmodules.sh $(DESTDIR)$(AUTHLIBDIR) builtin.@SHLIBEXT@ guest.@SHLIBEXT@ fixed_challenge.@SHLIBEXT@ name_to_ntstatus.@SHLIBEXT@
 	@$(SHELL) $(srcdir)/script/linkmodules.sh $(DESTDIR)$(NSSINFOLIBDIR) ../idmap/ad.@SHLIBEXT@ rfc2307.@SHLIBEXT@ sfu.@SHLIBEXT@ sfu20.@SHLIBEXT@
+	@$(SHELL) $(srcdir)/script/linkmodules.sh $(DESTDIR)$(NSSINFOLIBDIR) ../idmap/adex.@SHLIBEXT@ adex.@SHLIBEXT@
+	@$(SHELL) $(srcdir)/script/linkmodules.sh $(DESTDIR)$(NSSINFOLIBDIR) ../idmap/hash.@SHLIBEXT@ hash.@SHLIBEXT@
 
 installscripts:: installdirs
 	@$(SHELL) $(srcdir)/script/installscripts.sh $(INSTALLPERMS_BIN) $(DESTDIR)$(BINDIR) $(SCRIPTS)
@@ -2628,6 +2660,10 @@ uninstallpammodules::
 # Toplevel clean files
 TOPFILES=dynconfig.o
 
+cleanlibs::
+	-rm -f ../lib/*/*.o ../lib/*/*/*.o \
+		../libcli/*.o ../libcli/*/*.o
+
 clean:: cleanlibs
 	-rm -f include/build_env.h
 	-rm -f smbd/build_options.c
@@ -2738,6 +2774,10 @@ valgrindtest:: all torture timelimit
 	 VALGRIND="valgrind -q --num-callers=30 --log-file=${selftest_prefix}/valgrind.log" \
 	 PERL="$(PERL)" $(srcdir)/script/tests/selftest.sh ${selftest_prefix} all "${smbtorture4_path}"
 
+# Check for Winbind struct 32/64bit padding
+test_wbpad:
+	@echo "Testing winbind request/response structure for 32/64bit padding"
+	@./script/tests/wb_pad.sh || exit 1;
 
 ##
 ## Examples:
diff --git a/source3/auth/auth_domain.c b/source3/auth/auth_domain.c
index c25e62ab80..f11dbe60ee 100644
--- a/source3/auth/auth_domain.c
+++ b/source3/auth/auth_domain.c
@@ -26,6 +26,71 @@
 extern bool global_machine_password_needs_changing;
 static struct named_mutex *mutex;
 
+/*
+ * Change machine password (called from main loop
+ * idle timeout. Must be done as root.
+ */
+
+void attempt_machine_password_change(void)
+{
+	unsigned char trust_passwd_hash[16];
+	time_t lct;
+	void *lock;
+
+	if (!global_machine_password_needs_changing) {
+		return;
+	}
+
+	if (lp_security() != SEC_DOMAIN) {
+		return;
+	}
+
+	/*
+	 * We're in domain level security, and the code that
+	 * read the machine password flagged that the machine
+	 * password needs changing.
+	 */
+
+	/*
+	 * First, open the machine password file with an exclusive lock.
+	 */
+
+	lock = secrets_get_trust_account_lock(NULL, lp_workgroup());
+
+	if (lock == NULL) {
+		DEBUG(0,("attempt_machine_password_change: unable to lock "
+			"the machine account password for machine %s in "
+			"domain %s.\n",
+			global_myname(), lp_workgroup() ));
+		return;
+	}
+
+	if(!secrets_fetch_trust_account_password(lp_workgroup(),
+			trust_passwd_hash, &lct, NULL)) {
+		DEBUG(0,("attempt_machine_password_change: unable to read the "
+			"machine account password for %s in domain %s.\n",
+			global_myname(), lp_workgroup()));
+		TALLOC_FREE(lock);
+		return;
+	}
+
+	/*
+	 * Make sure someone else hasn't already done this.
+	 */
+
+	if(time(NULL) < lct + lp_machine_password_timeout()) {
+		global_machine_password_needs_changing = false;
+		TALLOC_FREE(lock);
+		return;
+	}
+
+	/* always just contact the PDC here */
+
+	change_trust_account_password( lp_workgroup(), NULL);
+	global_machine_password_needs_changing = false;
+	TALLOC_FREE(lock);
+}
+
 /**
  * Connect to a remote server for (inter)domain security authenticaion.
  *
diff --git a/source3/auth/auth_netlogond.c b/source3/auth/auth_netlogond.c
new file mode 100644
index 0000000000..a57f3b74a3
--- /dev/null
+++ b/source3/auth/auth_netlogond.c
@@ -0,0 +1,321 @@
+/*
+   Unix SMB/CIFS implementation.
+   Authenticate against a netlogon pipe listening on a unix domain socket
+   Copyright (C) Volker Lendecke 2008
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_AUTH
+
+static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
+				   const struct auth_context *auth_context,
+				   const char *ncalrpc_sockname,
+				   uint8_t schannel_key[16],
+				   const auth_usersupplied_info *user_info,
+				   struct netr_SamInfo3 **pinfo3,
+				   NTSTATUS *schannel_bind_result)
+{
+	struct rpc_pipe_client *p;
+	struct cli_pipe_auth_data *auth;
+	struct netr_SamInfo3 *info3 = NULL;
+	NTSTATUS status;
+
+	*schannel_bind_result = NT_STATUS_OK;
+
+	status = rpc_pipe_open_ncalrpc(talloc_tos(), ncalrpc_sockname,
+				       &ndr_table_netlogon.syntax_id, &p);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(10, ("rpc_pipe_open_ncalrpc failed: %s\n",
+			   nt_errstr(status)));
+		return status;
+	}
+
+	status = rpccli_schannel_bind_data(p, lp_workgroup(),
+					   PIPE_AUTH_LEVEL_PRIVACY,
+					   schannel_key, &auth);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(10, ("rpccli_schannel_bind_data failed: %s\n",
+			   nt_errstr(status)));
+		TALLOC_FREE(p);
+		return status;
+	}
+
+	status = rpc_pipe_bind(p, auth);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(10, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
+		TALLOC_FREE(p);
+		*schannel_bind_result = status;
+		return status;
+	}
+
+	/*
+	 * We have to fake a struct dcinfo, so that
+	 * rpccli_netlogon_sam_network_logon_ex can decrypt the session keys.
+	 */
+
+	p->dc = talloc(p, struct dcinfo);
+	if (p->dc == NULL) {
+		DEBUG(0, ("talloc failed\n"));
+		TALLOC_FREE(p);
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	memcpy(p->dc->sess_key, schannel_key, 16);
+
+	status = rpccli_netlogon_sam_network_logon_ex(
+		p, p,
+		user_info->logon_parameters,/* flags such as 'allow
+					     * workstation logon' */
+		global_myname(),            /* server name */
+		user_info->smb_name,        /* user name logging on. */
+		user_info->client_domain,   /* domain name */
+		user_info->wksta_name,      /* workstation name */
+		(uchar *)auth_context->challenge.data, /* 8 byte challenge. */
+		user_info->lm_resp,         /* lanman 24 byte response */
+		user_info->nt_resp,         /* nt 24 byte response */
+		&info3);                    /* info3 out */
+
+	DEBUG(10, ("rpccli_netlogon_sam_network_logon_ex returned %s\n",
+		   nt_errstr(status)));
+
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(p);
+		return status;
+	}
+
+	*pinfo3 = talloc_move(mem_ctx, &info3);
+
+	TALLOC_FREE(p);
+	return NT_STATUS_OK;
+}
+
+static char *mymachinepw(TALLOC_CTX *mem_ctx)
+{
+	fstring pwd;
+	const char *script;
+	char *to_free = NULL;
+	ssize_t nread;
+	int ret, fd;
+
+	script = lp_parm_const_string(
+		GLOBAL_SECTION_SNUM, "auth_netlogond", "machinepwscript",
+		NULL);
+
+	if (script == NULL) {
+		to_free = talloc_asprintf(talloc_tos(), "%s/%s",
+					  get_dyn_SBINDIR(), "mymachinepw");
+		script = to_free;
+	}
+	if (script == NULL) {
+		return NULL;
+	}
+
+	ret = smbrun(script, &fd);
+	DEBUG(ret ? 0 : 3, ("mymachinepw: Running the command `%s' gave %d\n",
+			    script, ret));
+	TALLOC_FREE(to_free);
+
+	if (ret != 0) {
+		return NULL;
+	}
+
+	pwd[sizeof(pwd)-1] = '\0';
+
+	nread = read(fd, pwd, sizeof(pwd)-1);
+	close(fd);
+
+	if (nread <= 0) {
+		DEBUG(3, ("mymachinepwd: Could not read password\n"));
+		return NULL;
+	}
+
+	DEBUG(0, ("pwd: %d [%s]\n", (int)nread, pwd));
+
+	if (pwd[nread-1] == '\n') {
+		pwd[nread-1] = '\0';
+	}
+
+	return talloc_strdup(mem_ctx, pwd);
+}
+
+static NTSTATUS check_netlogond_security(const struct auth_context *auth_context,
+					 void *my_private_data,
+					 TALLOC_CTX *mem_ctx,
+					 const auth_usersupplied_info *user_info,
+					 auth_serversupplied_info **server_info)
+{
+	TALLOC_CTX *frame = talloc_stackframe();
+	struct netr_SamInfo3 *info3 = NULL;
+	struct rpc_pipe_client *p;
+	struct cli_pipe_auth_data *auth;
+	uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
+	char *plaintext_machinepw;
+	uint8_t machine_password[16];
+	uint8_t schannel_key[16];
+	NTSTATUS schannel_bind_result, status;
+	struct named_mutex *mutex;
+	const char *ncalrpcsock;
+
+	ncalrpcsock = lp_parm_const_string(
+		GLOBAL_SECTION_SNUM, "auth_netlogond", "socket", NULL);
+
+	if (ncalrpcsock == NULL) {
+		ncalrpcsock = talloc_asprintf(talloc_tos(), "%s/%s",
+					      get_dyn_NCALRPCDIR(), "DEFAULT");
+	}
+
+	if (ncalrpcsock == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto done;
+	}
+
+	if (!secrets_fetch_local_schannel_key(schannel_key)) {
+		goto new_key;
+	}
+
+	status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
+				    schannel_key, user_info, &info3,
+				    &schannel_bind_result);
+
+	DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));
+
+	if (NT_STATUS_IS_OK(status)) {
+		goto okay;
+	}
+
+	if (NT_STATUS_IS_OK(schannel_bind_result)) {
+		/*
+		 * This is a real failure from the DC
+		 */
+		goto done;
+	}
+
+ new_key:
+
+	mutex = grab_named_mutex(talloc_tos(), "LOCAL_SCHANNEL_KEY", 60);
+	if (mutex == NULL) {
+		DEBUG(10, ("Could not get mutex LOCAL_SCHANNEL_KEY\n"));
+		status = NT_STATUS_ACCESS_DENIED;
+		goto done;
+	}
+
+	DEBUG(10, ("schannel bind failed, setting up new key\n"));
+
+	status = rpc_pipe_open_ncalrpc(talloc_tos(), ncalrpcsock,
+				       &ndr_table_netlogon.syntax_id, &p);
+
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(10, ("rpc_pipe_open_ncalrpc failed: %s\n",
+			   nt_errstr(status)));
+		goto done;
+	}
+
+	status = rpccli_anon_bind_data(p, &auth);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(10, ("rpccli_anon_bind_data failed: %s\n",
+			   nt_errstr(status)));
+		goto done;
+	}
+
+	status = rpc_pipe_bind(p, auth);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(10, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
+		goto done;
+	}
+
+	TALLOC_FREE(auth);
+
+	plaintext_machinepw = mymachinepw(talloc_tos());
+	if (plaintext_machinepw == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto done;
+	}
+
+	E_md4hash(plaintext_machinepw, machine_password);
+
+	TALLOC_FREE(plaintext_machinepw);
+
+	status = rpccli_netlogon_setup_creds(
+		p, global_myname(), lp_workgroup(), global_myname(),
+		global_myname(), machine_password, SEC_CHAN_BDC, &neg_flags);
+
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(10, ("rpccli_netlogon_setup_creds failed: %s\n",
+			   nt_errstr(status)));
+		goto done;
+	}
+
+	memcpy(schannel_key, p->dc->sess_key, 16);
+	secrets_store_local_schannel_key(schannel_key);
+
+	TALLOC_FREE(p);
+
+	/*
+	 * Retry the authentication with the mutex held. This way nobody else
+	 * can step on our toes.
+	 */
+
+	status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
+				    schannel_key, user_info, &info3,
+				    &schannel_bind_result);
+
+	DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));
+
+	if (!NT_STATUS_IS_OK(status)) {
+		goto done;
+	}
+
+ okay:
+
+	status = make_server_info_info3(mem_ctx, user_info->smb_name,
+					user_info->domain, server_info,
+					info3);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(10, ("make_server_info_info3 failed: %s\n",
+			   nt_errstr(status)));
+		TALLOC_FREE(frame);
+		return status;
+	}
+
+	status = NT_STATUS_OK;
+
+ done:
+	TALLOC_FREE(frame);
+	return status;
+}
+
+/* module initialisation */
+static NTSTATUS auth_init_netlogond(struct auth_context *auth_context,
+				    const char *param,
+				    auth_methods **auth_method)
+{
+	if (!make_auth_methods(auth_context, auth_method)) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	(*auth_method)->name = "netlogond";
+	(*auth_method)->auth = check_netlogond_security;
+	return NT_STATUS_OK;
+}
+
+NTSTATUS auth_netlogond_init(void)
+{
+	smb_register_auth(AUTH_INTERFACE_VERSION, "netlogond",
+			  auth_init_netlogond);
+	return NT_STATUS_OK;
+}
diff --git a/source3/autogen.sh b/source3/autogen.sh
index deed774b39..61316a8f70 100755
--- a/source3/autogen.sh
+++ b/source3/autogen.sh
@@ -2,6 +2,18 @@
 
 # Run this script to build samba from GIT.
 
+while true; do
+    case $1 in
+	(--version-file)
+	    VERSION_FILE=$2
+	    shift 2
+	    ;;
+	(*)
+	    break
+	    ;;
+    esac
+done
+
 ## insert all possible names (only works with 
 ## autoconf 2.x)
 TESTAUTOHEADER="autoheader autoheader-2.53 autoheader2.50 autoheader259 autoheader253"
@@ -48,7 +60,7 @@ if test "$AUTOCONFFOUND" = "0" -o "$AUTOHEADERFOUND" = "0"; then
 fi
 
 echo "$0: running script/mkversion.sh"
-./script/mkversion.sh || exit 1
+./script/mkversion.sh $VERSION_FILE || exit 1
 
 rm -rf autom4te*.cache
 rm -f configure include/config.h*
diff --git a/source3/client/client.c b/source3/client/client.c
index 7af7d30108..eb9f31bdf2 100644
--- a/source3/client/client.c
+++ b/source3/client/client.c
@@ -4345,6 +4345,8 @@ cleanup:
 	}
 }
 
+static bool finished;
+
 /****************************************************************************
  Make sure we swallow keepalives during idle time.
 ****************************************************************************/
@@ -4391,6 +4393,8 @@ static void readline_callback(void)
 			DEBUG(0, ("Read from server failed, maybe it closed "
 				  "the connection\n"));
 
+			finished = true;
+			smb_readline_done();
 			if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 				set_smb_read_error(&cli->smb_rw_error,
 						   SMB_READ_EOF);
@@ -4417,9 +4421,17 @@ static void readline_callback(void)
 
 	/* Ping the server to keep the connection alive using SMBecho. */
 	{
+		NTSTATUS status;
 		unsigned char garbage[16];
 		memset(garbage, 0xf0, sizeof(garbage));
-		cli_echo(cli, 1, data_blob_const(garbage, sizeof(garbage)));
+		status = cli_echo(cli, 1, data_blob_const(garbage, sizeof(garbage)));
+
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(0, ("SMBecho failed. Maybe server has closed "
+				"the connection\n"));
+			finished = true;
+			smb_readline_done();
+		}
 	}
 }
 
@@ -4431,7 +4443,7 @@ static int process_stdin(void)
 {
 	int rc = 0;
 
-	while (1) {
+	while (!finished) {
 		TALLOC_CTX *frame = talloc_stackframe();
 		char *tok = NULL;
 		char *the_prompt = NULL;
diff --git a/source3/client/mount.cifs.c b/source3/client/mount.cifs.c
index b7a76c6102..fd8014cf9f 100644
--- a/source3/client/mount.cifs.c
+++ b/source3/client/mount.cifs.c
@@ -79,6 +79,15 @@
 #define MOUNT_PASSWD_SIZE 64
 #define DOMAIN_SIZE 64
 
+/* exit status - bits below are ORed */
+#define EX_USAGE        1       /* incorrect invocation or permission */
+#define EX_SYSERR       2       /* out of memory, cannot fork, ... */
+#define EX_SOFTWARE     4       /* internal mount bug or wrong version */
+#define EX_USER         8       /* user interrupt */
+#define EX_FILEIO      16       /* problems writing, locking, ... mtab/fstab */
+#define EX_FAIL        32       /* mount failure */
+#define EX_SOMEOK      64       /* some mount succeeded */
+
 const char *thisprogram;
 int verboseflag = 0;
 static int got_password = 0;
@@ -174,7 +183,7 @@ static void mount_cifs_usage(void)
 	printf("\n\t%s -V\n",thisprogram);
 
 	SAFE_FREE(mountpassword);
-	exit(1);
+	exit(EX_USAGE);
 }
 
 /* caller frees username if necessary */
@@ -233,7 +242,7 @@ static int open_cred_file(char * file_name)
 				if(length > 4086) {
 					printf("mount.cifs failed due to malformed username in credentials file");
 					memset(line_buf,0,4096);
-					exit(1);
+					exit(EX_USAGE);
 				} else {
 					got_user = 1;
 					user_name = (char *)calloc(1 + length,1);
@@ -257,7 +266,7 @@ static int open_cred_file(char * file_name)
 				if(length > MOUNT_PASSWD_SIZE) {
 					printf("mount.cifs failed: password in credentials file too long\n");
 					memset(line_buf,0, 4096);
-					exit(1);
+					exit(EX_USAGE);
 				} else {
 					if(mountpassword == NULL) {
 						mountpassword = (char *)calloc(MOUNT_PASSWD_SIZE+1,1);
@@ -285,7 +294,7 @@ static int open_cred_file(char * file_name)
                                 }
                                 if(length > DOMAIN_SIZE) {
                                         printf("mount.cifs failed: domain in credentials file too long\n");
-                                        exit(1);
+                                        exit(EX_USAGE);
                                 } else {
                                         if(domain_name == NULL) {
                                                 domain_name = (char *)calloc(DOMAIN_SIZE+1,1);
@@ -318,7 +327,7 @@ static int get_password_from_file(int file_descript, char * filename)
 
 	if (mountpassword == NULL) {
 		printf("malloc failed\n");
-		exit(1);
+		exit(EX_SYSERR);
 	}
 
 	if(filename != NULL) {
@@ -326,7 +335,7 @@ static int get_password_from_file(int file_descript, char * filename)
 		if(file_descript < 0) {
 			printf("mount.cifs failed. %s attempting to open password file %s\n",
 				   strerror(errno),filename);
-			exit(1);
+			exit(EX_SYSERR);
 		}
 	}
 	/* else file already open and fd provided */
@@ -337,7 +346,7 @@ static int get_password_from_file(int file_descript, char * filename)
 			printf("mount.cifs failed. Error %s reading password file\n",strerror(errno));
 			if(filename != NULL)
 				close(file_descript);
-			exit(1);
+			exit(EX_SYSERR);
 		} else if(rc == 0) {
 			if(mountpassword[0] == 0) {
 				if(verboseflag)
@@ -563,7 +572,7 @@ static int parse_options(char ** optionsp, int * filesys_flags)
 
 					if (!(pw = getpwnam(value))) {
 						printf("bad user name \"%s\"\n", value);
-						exit(1);
+						exit(EX_USAGE);
 					}
 					snprintf(user, sizeof(user), "%u", pw->pw_uid);
 				} else {
@@ -579,7 +588,7 @@ static int parse_options(char ** optionsp, int * filesys_flags)
 
 					if (!(gr = getgrnam(value))) {
 						printf("bad group name \"%s\"\n", value);
-						exit(1);
+						exit(EX_USAGE);
 					}
 					snprintf(group, sizeof(group), "%u", gr->gr_gid);
 				} else {
@@ -674,7 +683,7 @@ static int parse_options(char ** optionsp, int * filesys_flags)
 		out = (char *)realloc(out, out_len + word_len + 2);
 		if (out == NULL) {
 			perror("malloc");
-			exit(1);
+			exit(EX_SYSERR);
 		}
 
 		if (out_len) {
@@ -699,7 +708,7 @@ nocopy:
 		out = (char *)realloc(out, out_len + word_len + 6);
 		if (out == NULL) {
 			perror("malloc");
-			exit(1);
+			exit(EX_SYSERR);
 		}
 
 		if (out_len) {
@@ -715,7 +724,7 @@ nocopy:
 		out = (char *)realloc(out, out_len + 1 + word_len + 6);
 		if (out == NULL) {
 		perror("malloc");
-			exit(1);
+			exit(EX_SYSERR);
 		}
 
 		if (out_len) {
@@ -996,12 +1005,12 @@ static struct option longopts[] = {
 };
 
 /* convert a string to uppercase. return false if the string
- * wasn't ASCII or was a NULL ptr */
+ * wasn't ASCII. Return success on a NULL ptr */
 static int
 uppercase_string(char *string)
 {
 	if (!string)
-		return 0;
+		return 1;
 
 	while (*string) {
 		/* check for unicode */
@@ -1050,7 +1059,7 @@ int main(int argc, char ** argv)
 		thisprogram = argv[0];
 	} else {
 		mount_cifs_usage();
-		exit(1);
+		exit(EX_USAGE);
 	}
 
 	if(thisprogram == NULL)
@@ -1067,12 +1076,12 @@ int main(int argc, char ** argv)
 		share_name = strndup(argv[1], MAX_UNC_LEN);
 		if (share_name == NULL) {
 			fprintf(stderr, "%s: %s", argv[0], strerror(ENOMEM));
-			exit(1);
+			exit(EX_SYSERR);
 		}
 		mountpoint = argv[2];
 	} else {
 		mount_cifs_usage();
-		exit(1);
+		exit(EX_USAGE);
 	}
 
 	/* add sharename in opts string as unc= parm */
@@ -1094,7 +1103,7 @@ int main(int argc, char ** argv)
 		case '?':
 		case 'h':	 /* help */
 			mount_cifs_usage ();
-			exit(1);
+			exit(EX_USAGE);
 		case 'n':
 		    ++nomtab;
 		    break;
@@ -1148,14 +1157,14 @@ int main(int argc, char ** argv)
 				uid = strtoul(optarg, &ep, 10);
 				if (*ep) {
 					printf("bad uid value \"%s\"\n", optarg);
-					exit(1);
+					exit(EX_USAGE);
 				}
 			} else {
 				struct passwd *pw;
 
 				if (!(pw = getpwnam(optarg))) {
 					printf("bad user name \"%s\"\n", optarg);
-					exit(1);
+					exit(EX_USAGE);
 				}
 				uid = pw->pw_uid;
 				endpwent();
@@ -1168,14 +1177,14 @@ int main(int argc, char ** argv)
 				gid = strtoul(optarg, &ep, 10);
 				if (*ep) {
 					printf("bad gid value \"%s\"\n", optarg);
-					exit(1);
+					exit(EX_USAGE);
 				}
 			} else {
 				struct group *gr;
 
 				if (!(gr = getgrnam(optarg))) {
 					printf("bad user name \"%s\"\n", optarg);
-					exit(1);
+					exit(EX_USAGE);
 				}
 				gid = gr->gr_gid;
 				endpwent();
@@ -1205,13 +1214,13 @@ int main(int argc, char ** argv)
 		default:
 			printf("unknown mount option %c\n",c);
 			mount_cifs_usage();
-			exit(1);
+			exit(EX_USAGE);
 		}
 	}
 
 	if((argc < 3) || (dev_name == NULL) || (mountpoint == NULL)) {
 		mount_cifs_usage();
-		exit(1);
+		exit(EX_USAGE);
 	}
 
 	if (getenv("PASSWD")) {
@@ -1228,13 +1237,13 @@ int main(int argc, char ** argv)
 	}
 
         if (orgoptions && parse_options(&orgoptions, &flags)) {
-                rc = -1;
+                rc = EX_USAGE;
 		goto mount_exit;
 	}
 	ipaddr = parse_server(&share_name);
 	if((ipaddr == NULL) && (got_ip == 0)) {
 		printf("No ip address specified and hostname not found\n");
-		rc = -1;
+		rc = EX_USAGE;
 		goto mount_exit;
 	}
 	
@@ -1249,19 +1258,19 @@ int main(int argc, char ** argv)
 	}
 	if(chdir(mountpoint)) {
 		printf("mount error: can not change directory into mount target %s\n",mountpoint);
-		rc = -1;
+		rc = EX_USAGE;
 		goto mount_exit;
 	}
 
 	if(stat (".", &statbuf)) {
 		printf("mount error: mount point %s does not exist\n",mountpoint);
-		rc = -1;
+		rc = EX_USAGE;
 		goto mount_exit;
 	}
 
 	if (S_ISDIR(statbuf.st_mode) == 0) {
 		printf("mount error: mount point %s is not a directory\n",mountpoint);
-		rc = -1;
+		rc = EX_USAGE;
 		goto mount_exit;
 	}
 
@@ -1274,7 +1283,7 @@ int main(int argc, char ** argv)
 #endif						
 		} else {
 			printf("mount error: permission denied or not superuser and mount.cifs not installed SUID\n"); 
-			return -1;
+			exit(EX_USAGE);
 		}
 	}
 
@@ -1289,7 +1298,7 @@ int main(int argc, char ** argv)
 		mountpassword = (char *)calloc(MOUNT_PASSWD_SIZE+1,1);
 		if (!tmp_pass || !mountpassword) {
 			printf("Password not entered, exiting\n");
-			return -1;
+			exit(EX_USAGE);
 		}
 		strlcpy(mountpassword, tmp_pass, MOUNT_PASSWD_SIZE+1);
 		got_password = 1;
@@ -1307,7 +1316,7 @@ mount_retry:
 	else {
 		printf("No server share name specified\n");
 		printf("\nMounting the DFS root for server not implemented yet\n");
-                exit(1);
+                exit(EX_USAGE);
 	}
 	if(user_name)
 		optlen += strlen(user_name) + 6;
@@ -1321,7 +1330,7 @@ mount_retry:
 
 	if(options == NULL) {
 		printf("Could not allocate memory for mount options\n");
-		return -1;
+		exit(EX_SYSERR);
 	}
 
 	options[0] = 0;
@@ -1400,8 +1409,7 @@ mount_retry:
 			printf("mount error %d = %s\n",errno,strerror(errno));
 		}
 		printf("Refer to the mount.cifs(8) manual page (e.g.man mount.cifs)\n");
-		rc = -1;
-		goto mount_exit;
+		rc = EX_FAIL;
 	} else {
 		pmntfile = setmntent(MOUNTED, "a+");
 		if(pmntfile) {
@@ -1439,11 +1447,13 @@ mount_retry:
 			rc = addmntent(pmntfile,&mountent);
 			endmntent(pmntfile);
 			SAFE_FREE(mountent.mnt_opts);
+			if (rc)
+				rc = EX_FILEIO;
 		} else {
-		    printf("could not update mount table\n");
+			printf("could not update mount table\n");
+			rc = EX_FILEIO;
 		}
 	}
-	rc = 0;
 mount_exit:
 	if(mountpassword) {
 		int len = strlen(mountpassword);
@@ -1455,5 +1465,5 @@ mount_exit:
 	SAFE_FREE(orgoptions);
 	SAFE_FREE(resolved_path);
 	SAFE_FREE(share_name);
-	return rc;
+	exit(rc);
 }
diff --git a/source3/configure.in b/source3/configure.in
index f23f6b55be..1eba4a0a58 100644
--- a/source3/configure.in
+++ b/source3/configure.in
@@ -128,7 +128,7 @@ fi
 if test "x$debug" = "xyes" ; then
 	CFLAGS="${CFLAGS} -g"
 else
-	CFLAGS="-O"
+	CFLAGS="${CFLAGS} -O"
 fi
 
 m4_include(../lib/socket_wrapper/config.m4)
@@ -404,10 +404,10 @@ AC_SUBST(DYNEXP)
 
 dnl Add modules that have to be built by default here
 dnl These have to be built static:
-default_static_modules="pdb_smbpasswd pdb_tdbsam rpc_lsarpc rpc_samr rpc_winreg rpc_initshutdown rpc_dssetup rpc_wkssvc rpc_svcctl2 rpc_ntsvcs2 rpc_netlogon rpc_netdfs rpc_srvsvc rpc_spoolss rpc_eventlog2 auth_sam auth_unix auth_winbind auth_server auth_domain auth_builtin vfs_default nss_info_template"
+default_static_modules="pdb_smbpasswd pdb_tdbsam rpc_lsarpc rpc_samr rpc_winreg rpc_initshutdown rpc_dssetup rpc_wkssvc rpc_svcctl2 rpc_ntsvcs2 rpc_netlogon rpc_netdfs rpc_srvsvc rpc_spoolss rpc_eventlog2 auth_sam auth_unix auth_winbind auth_server auth_domain auth_builtin auth_netlogond vfs_default nss_info_template"
 
 dnl These are preferably build shared, and static if dlopen() is not available
-default_shared_modules="vfs_recycle vfs_audit vfs_extd_audit vfs_full_audit vfs_netatalk vfs_fake_perms vfs_default_quota vfs_readonly vfs_cap vfs_expand_msdfs vfs_shadow_copy vfs_shadow_copy2 charset_CP850 charset_CP437 auth_script vfs_readahead vfs_xattr_tdb vfs_streams_xattr vfs_acl_xattr"
+default_shared_modules="vfs_recycle vfs_audit vfs_extd_audit vfs_full_audit vfs_netatalk vfs_fake_perms vfs_default_quota vfs_readonly vfs_cap vfs_expand_msdfs vfs_shadow_copy vfs_shadow_copy2 charset_CP850 charset_CP437 auth_script vfs_readahead vfs_xattr_tdb vfs_streams_xattr vfs_acl_xattr vfs_smb_traffic_analyzer"
 
 if test "x$developer" = xyes; then
    default_static_modules="$default_static_modules rpc_rpcecho"
@@ -6077,6 +6077,7 @@ SMB_MODULE(auth_server, \$(AUTH_SERVER_OBJ), "bin/smbserver.$SHLIBEXT", AUTH)
 SMB_MODULE(auth_domain, \$(AUTH_DOMAIN_OBJ), "bin/domain.$SHLIBEXT", AUTH)
 SMB_MODULE(auth_builtin, \$(AUTH_BUILTIN_OBJ), "bin/builtin.$SHLIBEXT", AUTH)
 SMB_MODULE(auth_script, \$(AUTH_SCRIPT_OBJ), "bin/script.$SHLIBEXT", AUTH)
+SMB_MODULE(auth_netlogond, \$(AUTH_NETLOGOND_OBJ), "bin/netlogond.$SHLIBEXT", AUTH)
 SMB_SUBSYSTEM(AUTH,auth/auth.o)
 
 SMB_MODULE(vfs_default, \$(VFS_DEFAULT_OBJ), "bin/default.$SHLIBEXT", VFS)
@@ -6116,12 +6117,13 @@ SMB_MODULE(vfs_syncops, \$(VFS_SYNCOPS_OBJ), "bin/syncops.$SHLIBEXT", VFS)
 SMB_MODULE(vfs_zfsacl, \$(VFS_ZFSACL_OBJ), "bin/zfsacl.$SHLIBEXT", VFS)
 SMB_MODULE(vfs_notify_fam, \$(VFS_NOTIFY_FAM_OBJ), "bin/notify_fam.$SHLIBEXT", VFS)
 SMB_MODULE(vfs_acl_xattr, \$(VFS_ACL_XATTR_OBJ), "bin/acl_xattr.$SHLIBEXT", VFS)
-
+SMB_MODULE(vfs_smb_traffic_analyzer, \$(VFS_SMB_TRAFFIC_ANALYZER_OBJ), "bin/smb_traffic_analyzer.$SHLIBEXT", VFS)
 
 SMB_SUBSYSTEM(VFS,smbd/vfs.o)
 
 SMB_MODULE(gpext_registry, libgpo/gpext/registry.o, "bin/registry.$SHLIBEXT", GPEXT)
 SMB_MODULE(gpext_scripts, libgpo/gpext/scripts.o, "bin/scripts.$SHLIBEXT", GPEXT)
+SMB_MODULE(gpext_security, libgpo/gpext/security.o, "bin/security.$SHLIBEXT", GPEXT)
 SMB_SUBSYSTEM(GPEXT, libgpo/gpext/gpext.o)
 
 AC_DEFINE_UNQUOTED(STRING_STATIC_MODULES, "$string_static_modules", [String list of builtin modules])
@@ -6276,6 +6278,10 @@ CFLAGS="${CFLAGS} \$(FLAGS)"
 
 if test x$MERGED_BUILD != x1; then
 	CFLAGS="${CFLAGS} -D_SAMBA_BUILD_=3"
+else
+	if test x"$BLDSHARED" = x"true" ; then
+		LDFLAGS="$LDFLAGS -L./bin"
+	fi
 fi
 
 AC_OUTPUT(Makefile
diff --git a/source3/dynconfig.c b/source3/dynconfig.c
index 3a54507599..6125f9944c 100644
--- a/source3/dynconfig.c
+++ b/source3/dynconfig.c
@@ -77,6 +77,7 @@ DEFINE_DYN_CONFIG_PARAM(MODULESDIR)
 DEFINE_DYN_CONFIG_PARAM(SHLIBEXT)
 DEFINE_DYN_CONFIG_PARAM(LOCKDIR)
 DEFINE_DYN_CONFIG_PARAM(PIDDIR)
+DEFINE_DYN_CONFIG_PARAM(NCALRPCDIR)
 DEFINE_DYN_CONFIG_PARAM(SMB_PASSWD_FILE)
 DEFINE_DYN_CONFIG_PARAM(PRIVATE_DIR)
 
diff --git a/source3/groupdb/mapping_tdb.c b/source3/groupdb/mapping_tdb.c
index 7cee53a968..29927eb592 100644
--- a/source3/groupdb/mapping_tdb.c
+++ b/source3/groupdb/mapping_tdb.c
@@ -666,8 +666,7 @@ static NTSTATUS del_aliasmem(const DOM_SID *alias, const DOM_SID *member)
 
 	if (num == 0) {
 		status = dbwrap_delete_bystring(db, key);
-		TALLOC_FREE(sids);
-		goto cancel;
+		goto commit;
 	}
 
 	member_string = talloc_strdup(sids, "");
@@ -693,7 +692,7 @@ static NTSTATUS del_aliasmem(const DOM_SID *alias, const DOM_SID *member)
 
 	status = dbwrap_store_bystring(
 		db, key, string_term_tdb_data(member_string), 0);
-
+ commit:
 	TALLOC_FREE(sids);
 
 	if (!NT_STATUS_IS_OK(status)) {
diff --git a/source3/include/dynconfig.h b/source3/include/dynconfig.h
index 758bde33cc..8267064f23 100644
--- a/source3/include/dynconfig.h
+++ b/source3/include/dynconfig.h
@@ -71,6 +71,10 @@ const char *get_dyn_PIDDIR(void);
 const char *set_dyn_PIDDIR(const char *newpath);
 bool is_default_dyn_PIDDIR(void);
 
+const char *get_dyn_NCALRPCDIR(void);
+const char *set_dyn_NCALRPCDIR(const char *newpath);
+bool is_default_dyn_NCALRPCDIR(void);
+
 const char *get_dyn_SMB_PASSWD_FILE(void);
 const char *set_dyn_SMB_PASSWD_FILE(const char *newpath);
 bool is_default_dyn_SMB_PASSWD_FILE(void);
diff --git a/source3/include/libmsrpc.h b/source3/include/libmsrpc.h
deleted file mode 100644
index 3f2a7260ca..0000000000
--- a/source3/include/libmsrpc.h
+++ /dev/null
@@ -1,3045 +0,0 @@
-/* 
- *  Unix SMB/CIFS implementation.
- *  MS-RPC client library API definitions/prototypes
- *
- *  Copyright (C) Chris Nicholls              2005.
- *  
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *  
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *  
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#ifndef LIBMSRPC_H
-#define LIBMSRPC_H
-
-
-#include "includes.h"
-#include "libsmbclient.h"
-#include "libsmb_internal.h"
-
-/*server capability levels*/
-#define SRV_WIN_NT4     1
-#define SRV_WIN_2K      2
-#define SRV_WIN_2K_SP3  3
-#define SRV_WIN_2K3     4
-
-/**@defgroup handle Server Handle*/
-/**@defgroup Library_Functions Library/Utility Functions*/
-/**@defgroup lsa_defs LSA Definitions*/
-/**@defgroup LSA_Functions LSA Functions*/
-/**@defgroup reg_defs Registry Definitions*/
-/**@defgroup Reg_Functions Registry Functions*/
-/**@defgroup sam_defs SAM Definitions*/
-/**@defgroup SAM_Functions SAM Functions*/
-/**@defgroup svc_defs Service Control Definitions*/
-/**@defgroup SCM_Functions Service Control Functions*/
-
-/**Operation was unsuccessful*/
-#define CAC_FAILURE           0
-/**Operation was successful*/
-#define CAC_SUCCESS           1
-/**Operation was only partially successful
- *  an example of this is if you try to lookup a list of accounts to SIDs and not all accounts can be resolved*/
-#define CAC_PARTIAL_SUCCESS   2
-
-/**@ingroup CAC_errors Use this to see if the last operation failed - useful for enumeration functions that use multiple calls*/
-#define CAC_OP_FAILED(status) !NT_STATUS_IS_OK(status) && \
-                              NT_STATUS_V(status) != NT_STATUS_V(STATUS_SOME_UNMAPPED) && \
-                              NT_STATUS_V(status) != NT_STATUS_V(STATUS_NO_MORE_FILES) && \
-                              NT_STATUS_V(status) != NT_STATUS_V(NT_STATUS_NO_MORE_ENTRIES) && \
-                              NT_STATUS_V(status) != NT_STATUS_V(NT_STATUS_NONE_MAPPED) && \
-                              NT_STATUS_V(status) != NT_STATUS_V(NT_STATUS_GUIDS_EXHAUSTED)
-
-
-/**Privilege string constants*/
-#define CAC_SE_CREATE_TOKEN            "SeCreateTokenPrivilege"
-#define CAC_SE_ASSIGN_PRIMARY_TOKEN    "SeAssignPrimaryTokenPrivilege"
-#define CAC_SE_LOCK_MEMORY             "SeLockMemoryPrivilege"
-#define CAC_SE_INCREASE_QUOTA          "SeIncreaseQuotaPrivilege"
-#define CAC_SE_MACHINE_ACCOUNT         "SeMachineAccountPrivilege"
-#define CAC_SE_TCB                     "SeTcbPrivilege"
-#define CAC_SE_SECURITY                "SeSecurityPrivilege"
-#define CAC_SE_TAKE_OWNERSHIP          "SeTakeOwnershipPrivilege"
-#define CAC_SE_LOAD_DRIVER             "SeLoadDriverPrivilege"
-#define CAC_SE_SYSTEM_PROFILE          "SeSystemProfilePrivilege"
-#define CAC_SE_SYSTEM_TIME             "SeSystemtimePrivilege"
-#define CAC_SE_PROFILE_SINGLE_PROC     "SeProfileSingleProcessPrivilege"
-#define CAC_SE_INCREASE_BASE_PRIORITY  "SeIncreaseBasePriorityPrivilege"
-#define CAC_SE_CREATE_PAGEFILE         "SeCreatePagefilePrivilege"
-#define CAC_SE_CREATE_PERMANENT        "SeCreatePermanentPrivilege"
-#define CAC_SE_BACKUP                  "SeBackupPrivilege"
-#define CAC_SE_RESTORE                 "SeRestorePrivilege"
-#define CAC_SE_SHUTDOWN                "SeShutdownPrivilege"
-#define CAC_SE_DEBUG                   "SeDebugPrivilege"
-#define CAC_SE_AUDIT                   "SeAuditPrivilege"
-#define CAC_SE_SYSTEM_ENV              "SeSystemEnvironmentPrivilege"
-#define CAC_SE_CHANGE_NOTIFY           "SeChangeNotifyPrivilege"
-#define CAC_SE_REMOTE_SHUTDOWN         "SeRemoteShutdownPrivilege"
-#define CAC_SE_UNDOCK                  "SeUndockPrivilege"
-#define CAC_SE_SYNC_AGENT              "SeSyncAgentPrivilege"
-#define CAC_SE_ENABLE_DELEGATION       "SeEnableDelegationPrivilege"
-#define CAC_SE_MANAGE_VOLUME           "SeManageVolumePrivilege"
-#define CAC_SE_IMPERSONATE             "SeImpersonatePrivilege"
-#define CAC_SE_CREATE_GLOBAL           "SeCreateGlobalPrivilege"
-#define CAC_SE_PRINT_OPERATOR          "SePrintOperatorPrivilege"
-#define CAC_SE_NETWORK_LOGON           "SeNetworkLogonRight"
-#define CAC_SE_INTERACTIVE_LOGON       "SeInteractiveLogonRight"
-#define CAC_SE_BATCH_LOGON             "SeBatchLogonRight"
-#define CAC_SE_SERVICE_LOGON           "SeServiceLogonRight"
-#define CAC_SE_ADD_USERS               "SeAddUsersPrivilege"
-#define CAC_SE_DISK_OPERATOR           "SeDiskOperatorPrivilege"
-
-/**
- * @addtogroup lsa_defs
- * @{
- */
-/**used to specify what data to retrieve using cac_LsaQueryTrustedDomainInformation*/
-#define CAC_INFO_TRUSTED_DOMAIN_NAME         0x1
-#define CAC_INFO_TRUSTED_DOMAIN_POSIX_OFFSET 0x3
-#define CAC_INFO_TRUSTED_DOMAIN_PASSWORD     0x4
-
-/**Used when requesting machine domain information*/
-#define CAC_DOMAIN_INFO 0x0003
-
-/**Used when requesting machine local information*/
-#define CAC_LOCAL_INFO  0x0005
-
-/**Stores information about a SID*/
-typedef struct _CACSIDINFO {
-   /**The actual SID*/
-   DOM_SID sid;
-   
-   /**The name of the object which maps to this SID*/
-   char *name;
-
-   /**The domain the SID belongs to*/
-   char *domain;
-} CacSidInfo;
-/* @} */
-
-/**
- * @addtogroup reg_defs
- * @{
- */
-/**Null terminated string*/
-typedef char*  REG_SZ_DATA;
-
-/**Null terminated string with windows environment variables that should be expanded*/
-typedef char*  REG_EXPAND_SZ_DATA;
-
-/**Binary data of some kind*/
-typedef struct _REGBINARYDATA {
-   uint32 data_length;
-   uint8 * data;
-} REG_BINARY_DATA;
-   
-/**32-bit (little endian) number*/
-typedef uint32 REG_DWORD_DATA;
-
-/**32-bit big endian number*/
-typedef uint32 REG_DWORD_BE_DATA;
-
-/**array of strings*/
-typedef struct _REGMULTISZDATA {
-   uint32 num_strings;
-
-   char **strings;
-} REG_MULTI_SZ_DATA;
-
-typedef union _REGVALUEDATA {
-   REG_SZ_DATA          reg_sz;
-   REG_EXPAND_SZ_DATA   reg_expand_sz;
-   REG_BINARY_DATA      reg_binary;
-   REG_DWORD_DATA       reg_dword;
-   REG_DWORD_BE_DATA    reg_dword_be;
-   REG_MULTI_SZ_DATA    reg_multi_sz;
-} REG_VALUE_DATA;
-/**@}*/
-
-/**
- * @addtogroup sam_defs
- * @{
- */
-
-#define CAC_USER_RID  0x1
-#define CAC_GROUP_RID 0x2
-
-typedef struct _CACLOOKUPRIDSRECORD {
-   char *name;
-   uint32 rid;
-
-   /**If found, this will be one of:
-    * - CAC_USER_RID
-    * - CAC_GROUP_RID
-    */
-   uint32 type;
-   
-   /*if the name or RID was looked up, then found = True*/
-   bool found;
-} CacLookupRidsRecord;
-
-typedef struct _CACUSERINFO {
-   /**Last logon time*/
-   time_t logon_time;
-
-   /**Last logoff time*/
-   time_t logoff_time;
-
-   /**Last kickoff time*/
-   time_t kickoff_time;
-
-   /**Last password set time*/
-   time_t pass_last_set_time;
-
-   /**Time password can change*/
-   time_t pass_can_change_time;
-
-   /**Time password must change*/
-   time_t pass_must_change_time;
-
-   /**LM user password*/
-   uint8 lm_password[8];
-
-   /**NT user password*/
-   uint8 nt_password[8];
-
-   /**User's RID*/
-   uint32 rid;
-
-   /**RID of primary group*/
-   uint32 group_rid;
-
-   /**User's ACB mask*/
-   uint32 acb_mask;
-
-   /**Bad password count*/
-   uint16 bad_passwd_count;
-
-   /**Number of logons*/
-   uint16 logon_count;
-
-   /**Change password at next logon?*/
-   bool pass_must_change;
-
-   /**Username*/
-   char *username;
-
-   /**User's full name*/
-   char *full_name;
-
-   /**User's home directory*/
-   char *home_dir;
-
-   /**Home directory drive*/
-   char *home_drive;
-
-   /**Logon script*/
-   char *logon_script;
-
-   /**Path to profile*/
-   char *profile_path;
-
-   /**Account description*/
-   char *description;
-
-   /**Login from workstations*/
-   char *workstations;
-
-   char *dial;
-
-   /**Possible logon hours*/
-   LOGON_HRS *logon_hours;
-
-} CacUserInfo;
-
-typedef struct _CACGROUPINFO {
-   /**Group name*/
-   char *name;
-
-   /**Description*/
-   char *description;
- 
-   /**Number of members*/
-   uint32 num_members;
-} CacGroupInfo, CacAliasInfo;
-
-/**Represents a period (duration) of time*/
-typedef struct _CACTIME {
-   /**Number of days*/
-   uint32 days;
-
-   /**Number of hours*/
-   uint32 hours;
-
-   /**Number of minutes*/
-   uint32 minutes;
-
-   /**number of seconds*/
-   uint32 seconds;
-} CacTime;
-
-
-typedef struct _CACDOMINFO {
-   /**The server role. Should be one of:
-    *   ROLE_STANDALONE
-    *   ROLE_DOMAIN_MEMBER
-    *   ROLE_DOMAIN_BDC
-    *   ROLE_DOMAIN_PDC
-    *   see include/smb.h
-    */
-   uint32 server_role;
-
-   /**Number of domain users*/
-   uint32 num_users;
-
-   /**Number of domain groups*/
-   uint32 num_domain_groups;
-   
-   /**Number of local groups*/
-   uint32 num_local_groups;
-
-   /**Comment*/
-   char *comment;
-
-   /**Domain name*/
-   char *domain_name;
-
-   /**Server name*/
-   char *server_name;
-
-   /**Minimum password length*/
-   uint16 min_pass_length;
-
-   /**How many previous passwords to remember - ie, password cannot be the same as N previous passwords*/
-   uint16 pass_history;
-
-   /**How long (from now) before passwords expire*/
-   CacTime expire;
-
-   /**How long (from now) before passwords can be changed*/
-   CacTime min_pass_age;
-
-   /**How long users are locked out for too many bad password attempts*/
-   CacTime lockout_duration;
-
-   /**How long before lockouts are reset*/
-   CacTime lockout_reset;
-
-   /**How many bad password attempts before lockout occurs*/
-   uint16 num_bad_attempts;
-} CacDomainInfo;
-
-/**@}*/ /*sam_defs*/
-
-/**@addtogroup svc_defs
- * @{
- */
-typedef struct _CACSERVICE {
-   /**The service name*/
-   char *service_name;
-
-   /**The display name of the service*/
-   char *display_name;
-   
-   /**Current status of the service - see include/rpc_svcctl.h for SERVICE_STATUS definition*/
-   SERVICE_STATUS status;
-} CacService;
-
-typedef struct __CACSERVICECONFIG {
-   /**The service type*/
-   uint32 type;
-
-   /**The start type. Should be one of:
-    * - SVCCTL_BOOT_START
-    * - SVCCTL_SYSTEM_START
-    * - SVCCTL_AUTO_START
-    * - SVCCTL_DEMAND_START
-    */
-   uint32 start_type;
-
-   uint32 error_control;
-
-   /**Path to executable*/
-   char *exe_path;
-
-   /***/
-   char *load_order_group;
-
-   uint32 tag_id;
-
-   /**Any dependencies for the service*/
-   char *dependencies;
-
-   /**Run as...*/
-   char *start_name;
-
-   /**Service display name*/
-   char *display_name;
-   
-} CacServiceConfig;
-/**@}*/ /*svc_defs*/
-
-#include "libmsrpc_internal.h"
-
-/**
- * @addtogroup handle
- * @{
- */
-
-/**
- * Server handle used to keep track of client/server/pipe information. Use cac_NewServerHandle() to allocate. 
- * Initiliaze as many values as possible before calling cac_Connect(). 
- * 
- * @note When allocating memory for the fields, use SMB_MALLOC() (or equivalent) instead of talloc() (or equivalent) -  
- * If memory is not allocated for a field, cac_Connect will allocate sizeof(fstring) bytes for it.
- * 
- * @note It may be wise to allocate large buffers for these fields and strcpy data into them.
- *
- * @see cac_NewServerHandle()
- * @see cac_FreeHandle()
- */
-typedef struct _CACSERVERHANDLE {
-   /** debug level
-    */
-   int debug;
-
-   /** netbios name used to make connections
-    */
-   char *netbios_name;
-
-   /** domain name used to make connections
-    */
-   char *domain;
-
-   /** username used to make connections
-    */
-   char *username;
-
-   /** user's password plain text string
-    */
-   char *password;
-
-   /** name or IP address of server we are currently working with
-    */
-   char *server;
-
-   /**stores the latest NTSTATUS code
-    */
-   NTSTATUS status;
-   
-   /** internal. do not modify!
-    */
-   struct CacServerHandleInternal _internal;
-
-} CacServerHandle;
-
-/*@}*/
-
-/**internal function. do not call this function*/
-SMBCSRV *cac_GetServer(CacServerHandle *hnd);
-
-
-/** @addtogroup Library_Functions
- * @{
- */
-/**
- * Initializes the library - do not need to call this function.  Open's smb.conf as well as initializes logging.
- * @param debug Debug level for library to use
- */
-
-void cac_Init(int debug);
-
-/**
- * Creates an un-initialized CacServerHandle
- * @param allocate_fields If True, the function will allocate sizeof(fstring) bytes for all char * fields in the handle
- * @return - un-initialized server handle
- *         - NULL if no memory could be allocated
- */
-CacServerHandle * cac_NewServerHandle(bool allocate_fields);
-
-/**
- * Specifies the smbc_get_auth_data_fn to use if you do not want to use the default.
- * @param hnd non-NULL server handle
- * @param auth_fn  auth_data_fn to set in server handle
- */
-
-void cac_SetAuthDataFn(CacServerHandle *hnd, smbc_get_auth_data_fn auth_fn);
-
-/** Use your own libsmbclient context - not necessary. 
- * @note You must still call cac_Connect() after specifying your own libsmbclient context
- * @param hnd Initialized, but not connected CacServerHandle
- * @param ctx The libsmbclient context you would like to use.
- */
-void cac_SetSmbcContext(CacServerHandle *hnd, SMBCCTX *ctx);
-
-/** Connects to a specified server.  If there is already a connection to a different server, 
- *    it will be cleaned up before connecting to the new server.
- * @param hnd   Pre-initialized CacServerHandle
- * @param srv   (Optional) Name or IP of the server to connect to.  If NULL, server from the CacServerHandle will be used.
- *
- * @return CAC_FAILURE if the operation could not be completed successfully (hnd->status will also be set with a NTSTATUS code)
- * @return CAC_SUCCESS if the operation succeeded
- */            
-int cac_Connect(CacServerHandle *hnd, const char *srv);
-
-
-/**
- * Cleans up any data used by the CacServerHandle. If the libsmbclient context was set using cac_SetSmbcContext(), it will not be free'd. 
- * @param hnd the CacServerHandle to destroy
- */
-void cac_FreeHandle(CacServerHandle * hnd);
-
-/**
- * Initializes a CacTime structure based on an NTTIME structure
- *  If the function fails, then the CacTime structure will be zero'd out
- */
-void cac_InitCacTime(CacTime *cactime, NTTIME nttime);
-
-/**
- * Called by cac_NewServerHandle() if allocate_fields = True. You can call this if you want to, allocates sizeof(fstring) char's for every char * field
- * @param hnd Uninitialized server handle
- * @return CAC_FAILURE Memory could not be allocated
- * @return CAC_SUCCESS Memory was allocated
- */
-int cac_InitHandleMem(CacServerHandle *hnd);
-
-/**
- * Default smbc_get_auth_data_fn for libmsrpc. This function is called when libmsrpc needs to get more information about the 
- * client (username/password, workgroup). 
- * This function provides simple prompts to the user to enter the information. This description his here so you know how to re-define this function.
- * @see cac_SetAuthDataFn()
- * @param pServer Name/IP of the server to connect to. 
- * @param pShare Share name to connect to
- * @param pWorkgroup libmsrpc passes in the workgroup/domain name from hnd->domain. It can be modified in the function.
- * @param maxLenWorkgroup The maximum length of a string pWogroup can hold.
- * @param pUsername libmsrpc passes in the username from hnd->username. It can be modified in the function.
- * @param maxLenUsername The maximum length of a string pUsername can hold.
- * @param pPassword libmsrpc pass in the password from hnd->password. It can be modified in the function.
- * @param maxLenPassword The maximum length  of a string pPassword can hold.
- */
-void cac_GetAuthDataFn(const char * pServer,
-                 const char * pShare,
-                 char * pWorkgroup,
-                 int maxLenWorkgroup,
-                 char * pUsername,
-                 int maxLenUsername,
-                 char * pPassword,
-                 int maxLenPassword);
-
-
-/**@}*/
-
-/*****************
- * LSA Functions *
- *****************/
-
-/** @addtogroup LSA_Functions
- * @{
- */
-
-struct LsaOpenPolicy {
-   /**Inputs*/
-   struct {
-      /**Access Mask. Refer to Security Access Masks in include/rpc_secdes.h*/
-      uint32 access;
-
-      /**Use security quality of service? (True/False)*/
-      bool security_qos;
-   } in;
-
-   /**Outputs*/
-   struct {
-      /**Handle to the open policy (needed for all other operations)*/
-      POLICY_HND *pol;
-   } out;
-};
-
-/** 
- * Opens a policy handle on a remote machine.
- * @param hnd fully initialized CacServerHandle for remote machine
- * @param mem_ctx Talloc context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE if the policy could not be opened. hnd->status set with appropriate NTSTATUS
- * @return CAC_SUCCESS if the policy could be opened, the policy handle can be found
- */
-int cac_LsaOpenPolicy(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaOpenPolicy *op);
-
-
-/** 
- * Closes an  LSA policy handle (Retrieved using cac_LsaOpenPolicy).
- *   If successful, the handle will be closed on the server, and memory for pol will be freed
- * @param hnd - An initialized and connected server handle
- * @param mem_ctx Talloc context for memory allocation
- * @param pol - the policy handle to close
- * @return CAC_FAILURE could not close the policy handle, hnd->status is set to the appropriate NTSTATUS error code
- * @return CAC_SUCCESS the policy handle was closed 
- */
-int cac_LsaClosePolicy(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *pol);
-
-
-struct LsaGetNamesFromSids {
-   struct {
-      /**handle to and open LSA policy*/
-      POLICY_HND *pol;
-      
-      /**the number of SIDs to lookup*/
-      uint32 num_sids;
-      
-      /**array of SIDs to lookup*/
-      DOM_SID *sids;
-   } in;
-
-   struct {
-      /**The number of names returned (in case of CAC_PARTIAL_SUCCESS)*/
-      uint32 num_found;
-
-      /**array of SID info each index is one sid */
-      CacSidInfo *sids;
-
-      /**in case of partial success, an array of SIDs that could not be looked up (NULL if all sids were looked up)*/
-      DOM_SID *unknown;
-   } out;
-};
-
-/** 
- * Looks up the names for a list of SIDS
- * @param hnd initialized and connected server handle
- * @param mem_ctx Talloc context for memory allocation
- * @param op  input and output parameters 
- * @return CAC_FAILURE none of the SIDs could be looked up hnd->status is set with appropriate NTSTATUS error code
- * @return CAC_SUCCESS all of the SIDs were translated and a list of names has been output
- * @return CAC_PARTIAL_SUCCESS not all of the SIDs were translated, as a result the number of returned names is less than the original list of SIDs
- */
-int cac_LsaGetNamesFromSids(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaGetNamesFromSids *op);
-
-struct LsaGetSidsFromNames {
-   struct {
-      /**handle to an open LSA policy*/
-      POLICY_HND *pol;
-
-      /**number of SIDs to lookup*/
-      uint32 num_names;
-
-      /**array of strings listing the names*/
-      char **names;
-   } in;
-
-   struct {
-      /**The number of SIDs returned (in case of partial success*/
-      uint32 num_found;
-
-      /**array of SID info for the looked up names*/
-      CacSidInfo *sids;
-
-      /**in case of partial success, the names that were not looked up*/
-      char **unknown;
-   } out;
-};
-
-/** 
- * Looks up the SIDs for a list of names
- * @param hnd initialized and connected server handle
- * @param mem_ctx Talloc context for memory allocation
- * @param op  input and output parameters 
- * @return CAC_FAILURE none of the SIDs could be looked up hnd->status is set with appropriate NTSTATUS error code
- * @return CAC_SUCCESS all of the SIDs were translated and a list of names has been output
- * @return CAC_PARTIAL_SUCCESS not all of the SIDs were translated, as a result the number of returned names is less than the original list of SIDs
- */
-int cac_LsaGetSidsFromNames(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaGetSidsFromNames *op);
-
-struct LsaFetchSid {
-   struct {
-      /**handle to an open LSA policy*/
-      POLICY_HND *pol;
-
-      /**can be CAC_LOCAL_INFO, CAC_DOMAIN_INFO, or (CAC_LOCAL_INFO | CAC_DOMAIN_INFO)*/
-      uint16 info_class;
-   } in;
-
-   struct {
-      /**the machine's local SID and domain name (NULL if not asked for)*/
-      CacSidInfo *local_sid;
-
-      /**the machine's domain SID and name (NULL if not asked for)*/
-      CacSidInfo *domain_sid;
-      
-   } out;
-};
-
-/** 
- * Looks up the domain or local sid of a machine with an open LSA policy handle
- * @param hnd initialized and connected server handle
- * @param mem_ctx Talloc context for memory allocation
- * @param op input and output parameters
- * @return CAC_FAILURE if the SID could not be fetched
- * @return CAC_SUCCESS if the SID was fetched
- * @return CAC_PARTIAL_SUCCESS if you asked for both local and domain sids but only one was returned
- */
-int cac_LsaFetchSid(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaFetchSid *op);
-
-struct LsaQueryInfoPolicy {
-   struct {
-      /**Open LSA policy handle on remote server*/
-      POLICY_HND *pol;
-   } in;
-
-   struct {
-      /**remote server's domain name*/
-      char *domain_name;
-
-      /**remote server's dns name*/
-      char *dns_name;
-
-      /**remote server's forest name*/
-      char *forest_name;
-
-      /**remote server's domain guid*/
-      struct GUID *domain_guid;
-
-      /**remote server's domain SID*/
-      DOM_SID *domain_sid;
-   } out;
-};
-
-/** 
- * Retrieves information about the LSA machine/domain
- * @param hnd initialized and connected server handle
- * @param mem_ctx Talloc context for memory allocation
- * @param op input and output parameters
- *           Note: for pre-Windows 2000 machines, only op->out.SID and op->out.domain will be set. @see cac_LsaFetchSid
- * @return - CAC_FAILURE if the operation was not successful. hnd->status will be set with an accurate NT_STATUS code
- * @return CAC_SUCCESS the operation was successful.
- */
-int cac_LsaQueryInfoPolicy(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaQueryInfoPolicy *op);
-
-struct LsaEnumSids {
-   struct {
-      /**Open LSA Policy handle*/
-      POLICY_HND *pol;
-
-      /**The prefered maximum number of SIDs returned per call*/
-      uint32 pref_max_sids;
-   } in;
-
-   struct {
-      /**used to keep track of how many sids have been retrieved over multiple calls
-       *  should be set to zero via ZERO_STRUCT() befrore the first call. Use the same struct LsaEnumSids for multiple calls*/
-      uint32 resume_idx;
-
-      /**The number of sids returned this call*/
-      uint32 num_sids;
-
-      /**Array of sids returned*/
-      DOM_SID *sids;
-
-   } out;
-};
-
-/** 
- * Enumerates the SIDs in the LSA.  Can be enumerated in blocks by calling the function multiple times.
- *  Example: while(cac_LsaEnumSids(hnd, mem_ctx, op) { ... }
- * @param hnd - An initialized and connected server handle
- * @param mem_ctx Talloc context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE there was an error during operations OR there are no more results
- * @return CAC_SUCCESS the operation completed and results were returned
- */
-int cac_LsaEnumSids(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaEnumSids *op);
-
-struct LsaEnumAccountRights {
-   struct {
-      /**Open LSA Policy handle*/
-      POLICY_HND *pol;
-
-      /**(Optional) SID of the account - must supply either sid or name*/
-      DOM_SID *sid;
-
-      /**(Optional) name of the account - must supply either sid or name*/
-      char *name;
-   } in;
-
-   struct {
-      /**Count of rights for this account*/
-      uint32 num_privs;
-
-      /**array of privilege names*/
-      char **priv_names;
-   } out;
-};
-
-/** 
- * Enumerates rights assigned to a given account. Takes a SID instead of account handle as input
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE the rights could not be retrieved. hnd->status is set with NT_STATUS code
- * @return CAC_SUCCESS the operation was successful. 
- */
-
-int cac_LsaEnumAccountRights(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaEnumAccountRights *op);
-
-struct LsaEnumTrustedDomains {
-   struct {
-      /**Open LSA policy handle*/
-      POLICY_HND *pol;
-   } in;
-
-   struct {
-      /**used to keep track of how many domains have been retrieved over multiple calls
-       *  should be set to zero via ZERO_STRUCT() before the first call. Use the same struct LsaEnumSids for multiple calls*/
-      uint32 resume_idx;
-      
-      /**The number of domains returned by the remote server this call*/
-      uint32 num_domains;
-
-      /**array of trusted domain names returned by the remote server*/
-      char **domain_names;
-
-      /**array of trusted domain sids returned by the remote server*/
-      DOM_SID *domain_sids;
-   } out;
-};
-     
-/** 
- * Enumerates the trusted domains in the LSA.  
- * @param hnd - An initialized and connected server handle
- * @param mem_ctx Talloc context for memory allocation
- * @param op - initialized parameters
- * @return CAC_FAILURE there was an error during operations OR there are no more results
- * @return CAC_SUCCESS the operation completed and results were returned
- */
-int cac_LsaEnumTrustedDomains(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaEnumTrustedDomains *op);
-
-struct LsaOpenTrustedDomain {
-   struct {
-      /**an open LSA policy handle*/
-      POLICY_HND *pol;
-
-      /**SID of the trusted domain to open*/
-      DOM_SID *domain_sid;
-
-      /**Desired access on the open domain*/
-      uint32 access;
-   } in;
-
-   struct {
-      /**A handle to the policy that is opened*/
-      POLICY_HND *domain_pol;
-   } out;
-};
-
-/** 
- * Opens a trusted domain by SID.
- * @param hnd An initialized and connected server handle
- * @param mem_ctx Talloc context for memory allocation
- * @param op initialized I/O parameters
- * @return CAC_FAILURE a handle to the domain could not be opened. hnd->status is set with approriate NT_STATUS code
- * @return CAC_SUCCESS the domain was opened successfully
- */
-int cac_LsaOpenTrustedDomain(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaOpenTrustedDomain *op);
-
-struct LsaQueryTrustedDomainInfo {
-   struct {
-      /**Open LSA policy handle*/
-      POLICY_HND *pol;
-
-      /**Info class of returned data*/
-      uint16 info_class;
-
-      /**(Optional)SID of trusted domain to query (must specify either SID or name of trusted domain)*/
-      DOM_SID *domain_sid;
-
-      /**(Optional)Name of trusted domain to query (must specify either SID or name of trusted domain)*/
-      char *domain_name;
-   } in;
-
-   struct {
-      /**information about the trusted domain*/
-      LSA_TRUSTED_DOMAIN_INFO *info;
-   } out;
-};
-
-/** 
- * Retrieves information a trusted domain.
- * @param hnd An initialized and connected server handle
- * @param mem_ctx Talloc context for memory allocation
- * @param op initialized I/O parameters
- * @return CAC_FAILURE a handle to the domain could not be opened. hnd->status is set with approriate NT_STATUS code
- * @return CAC_SUCCESS the domain was opened successfully
- */
-
-int cac_LsaQueryTrustedDomainInfo(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaQueryTrustedDomainInfo *op);
-
-struct LsaEnumPrivileges {
-   struct {
-      /**An open LSA policy handle*/
-      POLICY_HND *pol;
-
-      /**The _preferred_ maxinum number of privileges returned per call*/
-      uint32 pref_max_privs;
-   } in;
-
-   struct {
-      /**Used to keep track of how many privileges have been retrieved over multiple calls. Do not modify this value between calls*/
-      uint32 resume_idx;
-
-      /**The number of privileges returned this call*/
-      uint32 num_privs;
-
-      /**Array of privilege names*/
-      char **priv_names;
-
-      /**Array of high bits for privilege LUID*/
-      uint32 *high_bits;
-
-      /**Array of low bits for privilege LUID*/
-      uint32 *low_bits;
-   } out; 
-};
-
-/** 
- * Enumerates the Privileges supported by the LSA.  Can be enumerated in blocks by calling the function multiple times.
- *  Example: while(cac_LsaEnumPrivileges(hnd, mem_ctx, op) { ... }
- * @param hnd An initialized and connected server handle
- * @param mem_ctx Talloc context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE there was an error during operations OR there are no more results
- * @return CAC_SUCCESS the operation completed and results were returned
- * @see CAC_OP_FAILED()
- */
-int cac_LsaEnumPrivileges(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaEnumPrivileges *op);
-
-struct LsaOpenAccount {
-   struct {
-      /**An open LSA policy handle*/
-      POLICY_HND *pol;
-
-      /**(Optional) account SID - must supply either sid or name*/
-      DOM_SID *sid;
-
-      /**(Optional) account name - must supply either sid or name*/
-      char *name;
-
-      /**desired access for the handle*/
-      uint32 access;
-   } in;
-
-   struct {
-      /**A handle to the opened user*/
-      POLICY_HND *user;
-   } out;
-};
-
-/** 
- * Opens a handle to an account in the LSA
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE the account could not be opened. hnd->status has appropriate NT_STATUS code
- * @return CAC_SUCCESS the account was opened
- */
-int cac_LsaOpenAccount(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaOpenAccount *op);
-
-struct LsaAddPrivileges {
-   struct {
-      /**An open LSA policy handle*/
-      POLICY_HND *pol;
-
-      /**(Optional) The user's SID (must specify at least sid or name)*/
-      DOM_SID *sid;
-
-      /**(Optional) The user's name (must specify at least sid or name)*/
-      char *name;
-
-      /**The privilege names of the privileges to add for the account*/
-      char **priv_names;
-      
-      /**The number of privileges in the priv_names array*/
-      uint32 num_privs;
-
-   } in;
-};
-
-/** 
- * Adds Privileges an account.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE the privileges could not be set. hnd->status has appropriate NT_STATUS code
- * @return CAC_SUCCESS the privileges were set.
- */
-int cac_LsaAddPrivileges(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaAddPrivileges *op);
-
-struct LsaRemovePrivileges {
-   struct {
-      /**An open handle to the LSA*/
-      POLICY_HND *pol;
-
-      /**(Optional) The account SID (must specify at least sid or name)*/
-      DOM_SID *sid;
-
-      /**(Optional) The account name (must specify at least sid or name)*/
-      char *name;
-
-      /**The privilege names of the privileges to remove from the account*/
-      char **priv_names;
-
-      /**The number of privileges in the priv_names array*/
-      uint32 num_privs;
-
-   } in;
-
-};
-
-/** 
- * Removes a _specific_ set of privileges from an account
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE the privileges could not be removed. hnd->status is set with NT_STATUS code
- * @return CAC_SUCCESS the privileges were removed 
- */
-int cac_LsaRemovePrivileges(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaRemovePrivileges *op);
-
-struct LsaClearPrivileges {
-   struct {
-      /**An open handle to the LSA*/
-      POLICY_HND *pol;
-
-      /**(Optional) The user's SID (must specify at least sid or name)*/
-      DOM_SID *sid;
-
-      /**(Optional) The user's name (must specify at least sid or name)*/
-      char *name;
-   } in;
-
-};
-
-/** 
- * Removes ALL privileges from an account
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE the operation was not successful, hnd->status set with NT_STATUS code
- * @return CAC_SUCCESS the opeartion was successful.
- */
-int cac_LsaClearPrivileges(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaClearPrivileges *op);
-
-/** 
- * Sets an accounts priviliges. Removes all privileges and then adds specified privileges.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters 
- * @return CAC_FAILURE The operation could not complete successfully
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_LsaSetPrivileges(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaAddPrivileges *op);
-
-struct LsaGetSecurityObject {
-   struct {
-      /**Open LSA policy handle*/
-      POLICY_HND *pol;
-   } in;
-
-   struct {
-      /**Returned security descriptor information*/
-      SEC_DESC_BUF *sec;
-   } out;
-};
-
-/**
- * Retrieves Security Descriptor information about the LSA
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters 
- * @return CAC_FAILURE The operation could not complete successfully
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_LsaGetSecurityObject(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaGetSecurityObject *op);
-
-
-/**@}*/ /*LSA_Functions*/
-      
-/**********************
- * Registry Functions *
- *********************/
-
-/**@addtogroup Reg_Functions
- * @{
- */
-
-struct RegConnect {
-   struct {
-      /** must be one of : 
-       *    HKEY_CLASSES_ROOT, 
-       *    HKEY_LOCAL_MACHINE, 
-       *    HKEY_USERS, 
-       *    HKEY_PERFORMANCE_DATA,
-       */
-      int root;
-
-      /**desired access on the root key
-       * combination of: 
-       * REG_KEY_READ,
-       * REG_KEY_WRITE,
-       * REG_KEY_EXECUTE,
-       * REG_KEY_ALL,
-       * found in include/rpc_secdes.h*/
-      uint32 access;
-   } in;
-
-   struct {
-      POLICY_HND *key;
-   } out;
-};
-
-/** 
- * Opens a handle to the registry on the server
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters 
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_RegConnect(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegConnect *op);
-
-/**
- * Closes an open registry handle
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param key The Key/Handle to close 
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_RegClose(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *key);
-
-struct RegOpenKey {
-   struct {
-      /**(Optional)parent key. 
-       * If this is NULL, then cac_RegOpenKey() will attempt to connect to the registry, name MUST start with something like:<br>
-       *  HKEY_LOCAL_MACHINE\  or an abbreviation like HKCR\
-       *
-       *  supported root names:
-       *   - HKEY_LOCAL_MACHINE\ or HKLM\
-       *   - HKEY_CLASSES_ROOT\ or HKCR\
-       *   - HKEY_USERS\ or HKU\
-       *   - HKEY_PERFORMANCE_DATA or HKPD\
-       */
-      POLICY_HND *parent_key;
-
-      /**name/path of key*/
-      char *name;
-
-      /**desired access on this key*/
-      uint32 access;
-   } in;
-
-   struct {
-      POLICY_HND *key;
-   } out;
-};
-      
-/**
- * Opens a registry key
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_RegOpenKey(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegOpenKey *op);
-
-struct RegEnumKeys {
-   struct {
-      /**enumerate subkeys of this key*/
-      POLICY_HND *key;
-
-      /**maximum number of keys to enumerate each call*/
-      uint32 max_keys;
-   } in;
-
-   struct {
-      /**keeps track of the index to resume enumerating*/
-      uint32 resume_idx;
-
-      /**the number of keys returned this call*/
-      uint32 num_keys;
-
-      /**array of key names*/
-      char **key_names;
-
-      /**class names of the keys*/
-      char **class_names;
-
-      /**last modification time of the key*/
-      time_t *mod_times;
-   } out;
-};
-
-/**
- * Enumerates Subkeys of a given key. Can be run in a loop. Example: while(cac_RegEnumKeys(hnd, mem_ctx, op)) { ... }
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @see CAC_OP_FAILED()
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_RegEnumKeys(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegEnumKeys *op);
-
-
-struct RegCreateKey {
-   struct {
-      /**create a subkey of parent_key*/
-      POLICY_HND *parent_key;
-
-      /**name of the key to create*/
-      char *key_name;
-
-      /**class of the key*/
-      char *class_name;
-
-      /**Access mask to open the key with. See REG_KEY_* in include/rpc_secdes.h*/
-      uint32 access;
-   } in;
-
-   struct {
-      /**Open handle to the key*/
-      POLICY_HND *key;
-   } out;
-};
-
-/**
- * Creates a registry key, if the key already exists, it will be opened __Creating keys is not currently working__.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parmeters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_RegCreateKey(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegCreateKey *op);
-
-struct RegDeleteKey {
-   struct {
-      /**handle to open registry key*/
-      POLICY_HND *parent_key;
-
-      /**name of the key to delete*/
-      char *name;
-
-      /**delete recursively. WARNING: this might not always work as planned*/
-      bool recursive;
-   } in;
-
-};
-
-/**
- * Deletes a subkey of an open key. Note: if you run this with op->in.recursive == True, and the operation fails, it may leave the key in an inconsistent state.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_RegDeleteKey(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegDeleteKey *op);
-
-struct RegDeleteValue {
-   struct {
-      /**handle to open registry key*/
-      POLICY_HND *parent_key;
-
-      /**name of the value to delete*/
-      char *name;
-   } in;
-};
-
-/**
- * Deletes a registry value.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_RegDeleteValue(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegDeleteValue *op);
-
-struct RegQueryKeyInfo {
-   struct {
-      /**Open handle to the key to query*/
-      POLICY_HND *key;
-   } in;
-
-   struct {
-      /**name of the key class*/
-      char *class_name;
-
-      /**number of subkeys of the key*/
-      uint32 num_subkeys;
-
-      /**length (in characters) of the longest subkey name*/
-      uint32 longest_subkey;
-
-      /**length (in characters) of the longest class name*/
-      uint32 longest_class;
-
-      /**number of values in this key*/
-      uint32 num_values;
-
-      /**length (in characters) of the longest value name*/
-      uint32 longest_value_name;
-
-      /**length (in bytes) of the biggest value data*/
-      uint32 longest_value_data;
-
-      /**size (in bytes) of the security descriptor*/
-      uint32 security_desc_size;
-
-      /**time of the last write*/
-      time_t last_write_time;
-   } out;
-};
-
-/**
- * Retrieves information about an open key
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_RegQueryKeyInfo(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegQueryKeyInfo *op);
-
-struct RegSaveKey {
-   struct {
-      /**Open key to be saved*/
-      POLICY_HND *key;
-
-      /**The path (on the remote computer) to save the file to*/
-      char *filename;
-   } in;
-};
-
-/**
- * Saves a key to a file on the remote machine __Not currently working__.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_RegSaveKey(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegSaveKey *op);
-
-struct RegQueryValue {
-   struct {
-      /**handle to open registry key*/
-      POLICY_HND *key;
-
-      /**name of the value to query*/
-      char *val_name;
-   } in;
-
-   struct {
-      /**Value type.
-       * One of:
-       *  - REG_DWORD (equivalent to REG_DWORD_LE)
-       *  - REG_DWORD_BE
-       *  - REG_SZ
-       *  - REG_EXPAND_SZ
-       *  - REG_MULTI_SZ
-       *  - REG_BINARY
-       */
-      uint32 type;
-
-      /**The value*/
-      REG_VALUE_DATA *data;
-   } out;
-};
-
-/**
- * Retrieves a value (type and data) _not currently working_.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_RegQueryValue(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegQueryValue *op);
-
-struct RegEnumValues {
-   struct {
-      /**handle to open key*/
-      POLICY_HND *key;
-
-      /**max number of values returned per call*/
-      uint32 max_values;
-
-   } in;
-
-   struct {
-      /**keeps track of the index to resume from - used over multiple calls*/
-      uint32 resume_idx;
-
-      /**the number of values that were returned this call*/
-      uint32 num_values;
-
-      /**Array of value types. A type can be one of:
-       *  - REG_DWORD (equivalent to REG_DWORD_LE)
-       *  - REG_DWORD_BE
-       *  - REG_SZ
-       *  - REG_EXPAND_SZ
-       *  - REG_MULTI_SZ
-       *  - REG_BINARY
-       */
-      uint32 *types;
-
-      /**array of strings storing the names of the values*/
-      char **value_names;
-
-      /**array of pointers to the value data returned*/
-      REG_VALUE_DATA **values;
-   } out;
-};
-
-/**
- * Enumerates a number of Registry values in an open registry key.
- * Can be run in a loop. Example: while(cac_RegEnumValues(hnd, mem_ctx, op)) { ... }
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @see CAC_OP_FAILED()
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_RegEnumValues(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegEnumValues *op);
-
-struct RegSetValue {
-   struct {
-      /**Handle to open registry key*/
-      POLICY_HND *key;
-
-      /**Name of the value*/
-      char *val_name;
-
-      /**Value type.
-       * One of:
-       *  - REG_DWORD (equivalent to REG_DWORD_LE)
-       *  - REG_DWORD_BE
-       *  - REG_SZ
-       *  - REG_EXPAND_SZ
-       *  - REG_MULTI_SZ
-       *  - REG_BINARY
-       */
-      uint32 type;
-
-      /**the value*/
-      REG_VALUE_DATA value;
-   } in;
-};
-
-/**
- * Sets or creates value (type and data).
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_RegSetValue(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegSetValue *op);
-
-struct RegGetVersion {
-   struct {
-      /**open registry key*/
-      POLICY_HND *key;
-   } in;
-
-   struct {
-      /**version number*/
-      uint32 version;
-   } out;
-};
-
-/**
- * Retrieves the registry version number
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_RegGetVersion(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegGetVersion *op);
-
-struct RegGetKeySecurity {
-   struct {
-      /**Handle to key to query*/
-      POLICY_HND *key;
-
-      /**Info that you want. Should be a combination of (1 or more or'd):
-       * - OWNER_SECURITY_INFORMATION
-       * - GROUP_SECURITY_INFORMATION
-       * - DACL_SECURITY_INFORMATION
-       * - SACL_SECURITY_INFORMATION
-       * - UNPROTECTED_SACL_SECURITY_INFORMATION
-       * - UNPROTECTED_DACL_SECURITY_INFORMATION
-       * - PROTECTED_SACL_SECURITY_INFORMATION
-       * - PROTECTED_DACL_SECURITY_INFORMATION
-       *
-       * or use:
-       * - ALL_SECURITY_INFORMATION
-       *
-       * all definitions from include/rpc_secdes.h
-       */
-      uint32 info_type;
-   } in;
-
-   struct {
-      /**size of the data returned*/
-      uint32 size;
-
-      /**Security descriptor*/
-      SEC_DESC *descriptor;
-   } out;
-};
-
-/**
- * Retrieves a key security descriptor.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_RegGetKeySecurity(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegGetKeySecurity *op);
-
-struct RegSetKeySecurity {
-   struct {
-      /**Handle to key to query*/
-      POLICY_HND *key;
-
-      /**Info that you want. Should be a combination of (1 or more or'd):
-       * - OWNER_SECURITY_INFORMATION
-       * - GROUP_SECURITY_INFORMATION
-       * - DACL_SECURITY_INFORMATION
-       * - SACL_SECURITY_INFORMATION
-       * - UNPROTECTED_SACL_SECURITY_INFORMATION
-       * - UNPROTECTED_DACL_SECURITY_INFORMATION
-       * - PROTECTED_SACL_SECURITY_INFORMATION
-       * - PROTECTED_DACL_SECURITY_INFORMATION
-       *
-       * or use:
-       * - ALL_SECURITY_INFORMATION
-       *
-       * all definitions from include/rpc_secdes.h
-       */
-      uint32 info_type;
-      
-      /**size of the descriptor*/
-      size_t size;
-
-      /**Security descriptor*/
-      SEC_DESC *descriptor;
-   } in;
-};
-
-/**
- * Sets the key security descriptor.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_RegSetKeySecurity(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct RegSetKeySecurity *op);
-
-/**@}*/ /*Reg_Functions*/
-
-struct Shutdown {
-   struct {
-      /**the message to display (can be NULL)*/
-      char *message;
-
-      /**timeout in seconds*/
-      uint32 timeout;
-
-      /**False = shutdown, True = reboot*/
-      bool reboot;
-      
-      /**force the*/
-      bool force;
-
-      /*FIXME: make this useful*/
-      uint32 reason;
-   } in;
-};
-
-
-/**
- * Shutdown the server _not currently working_. 
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_Shutdown(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct Shutdown *op);
-
-/**
- * Attempt to abort initiated shutdown on the server _not currently working_. 
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_AbortShutdown(CacServerHandle *hnd, TALLOC_CTX *mem_ctx);
-
-/*****************
- * SAM Functions *
- *****************/
-
-/**@addtogroup SAM_Functions
- * @{
- */
-struct SamConnect {
-   struct {
-      /**Access mask to open with
-       * see generic access masks in include/smb.h*/
-      uint32 access;
-   } in;
-
-   struct {
-      POLICY_HND *sam;
-   } out;
-};
-
-/** 
- * Connects to the SAM. This can be skipped by just calling cac_SamOpenDomain()
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_SamConnect(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamConnect *op);
-
-
-/** 
- * Closes any (SAM, domain, user, group, etc.) SAM handle. 
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param sam Handle to close
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_SamClose(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *sam);
-
-struct SamOpenDomain {
-   struct {
-      /**The desired access. See generic access masks - include/smb.h*/
-      uint32 access;
-
-      /**(Optional) An open handle to the SAM. If it is NULL, the function will connect to the SAM with the access mask above*/
-      POLICY_HND *sam;
-
-      /**(Optional) The SID of the domain to open. 
-       *  If this this is NULL, the function will attempt to open the domain specified in hnd->domain */
-      DOM_SID *sid;
-   } in;
-
-   struct {
-      /**handle to the open domain*/
-      POLICY_HND *dom_hnd;
-
-      /**Handle to the open SAM*/
-      POLICY_HND *sam;
-   } out;
-};
-
-/** 
- * Opens a handle to a domain. This must be called before any other SAM functions 
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamOpenDomain(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamOpenDomain *op);
-
-struct SamCreateUser {
-   struct {
-      /**Open domain handle*/
-      POLICY_HND *dom_hnd;
-
-      /**Username*/
-      char *name;
-
-      /**See Allowable account control bits in include/smb.h*/
-      uint32 acb_mask;
-   } in;
-
-   struct {
-      /**handle to the user*/
-      POLICY_HND *user_hnd;
-
-      /**rid of the user*/
-      uint32 rid;
-   } out;
-};
-
-/** 
- * Creates a new domain user, if the account already exists it will _not_ be opened and hnd->status will be NT_STATUS_USER_EXISTS
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_SamCreateUser(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamCreateUser *op);
-
-struct SamOpenUser {
-   struct {
-      /**Handle to open SAM connection*/
-      POLICY_HND *dom_hnd;
-
-      /**desired access - see generic access masks in include/smb.h*/
-      uint32 access;
-
-      /**RID of the user*/
-      uint32 rid;
-
-      /**(Optional) name of the user - must supply either RID or user name*/
-      char *name;
-   } in;
-
-   struct {
-      /**Handle to the user*/
-      POLICY_HND *user_hnd;
-   } out;    
-};
-
-/** 
- * Opens a domain user.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamOpenUser(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamOpenUser *op);
-
-/** 
- * Deletes a domain user.  
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param user_hnd Open handle to the user
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamDeleteUser(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *user_hnd);
-
-
-struct SamEnumUsers {
-   struct {
-      /**Open handle to a domain*/
-      POLICY_HND *dom_hnd;
-
-      /**Enumerate users with specific ACB. If 0, all users will be enumerated*/
-      uint32 acb_mask;
-   } in;
-
-   struct {
-      /**where to resume from. Used over multiple calls*/
-      uint32 resume_idx;
-
-      /**the number of users returned this call*/
-      uint32 num_users;
-
-      /**Array storing the rids of the returned users*/
-      uint32 *rids;
-
-      /**Array storing the names of all the users returned*/
-      char **names;
-
-      bool done;
-   } out;
-};
-
-/** 
- * Enumerates domain users. Can be used as a loop condition. Example: while(cac_SamEnumUsers(hnd, mem_ctx, op)) { ... }
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamEnumUsers(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamEnumUsers *op);
-
-struct SamGetNamesFromRids {
-   struct {
-      /**An open handle to the domain SAM from cac_SamOpenDomain()*/
-      POLICY_HND *dom_hnd;
-
-      /**Number of RIDs to resolve*/
-      uint32 num_rids;
-
-      /**Array of RIDs to resolve*/
-      uint32 *rids;
-   } in;
-
-   struct {
-      /**the number of names returned - if this is 0, the map is NULL*/
-      uint32 num_names;
-
-      /**array contiaing the Names and RIDs*/
-      CacLookupRidsRecord *map;
-   } out;
-};
-
-/** 
- * Returns a list of names which map to a list of RIDs.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamGetNamesFromRids(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetNamesFromRids *op);
-
-struct SamGetRidsFromNames {
-   struct {
-      /**An open handle to the domain SAM from cac_SamOpenDomain()*/
-      POLICY_HND *dom_hnd;
-
-      /**Number of names to resolve*/
-      uint32 num_names;
-
-      /**Array of names to resolve*/
-      char **names;
-   } in;
-
-   struct {
-      /**the number of names returned - if this is 0, then map is NULL*/
-      uint32 num_rids;
-
-      /**array contiaing the Names and RIDs*/
-      CacLookupRidsRecord *map;
-   } out;
-};
-
-/** 
- * Returns a list of RIDs which map to a list of names.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamGetRidsFromNames(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetRidsFromNames *op);
-
-struct SamGetGroupsForUser {
-   struct {
-      /**An open handle to the user*/
-      POLICY_HND *user_hnd;
-   } in;
-
-   struct {
-      /**The number of groups the user is a member of*/
-      uint32 num_groups;
-
-      /**The RIDs of the groups*/
-      uint32 *rids;
-
-      /**The attributes of the groups*/ 
-      uint32 *attributes;
-   } out;
-};
-/** 
- * Retrieves a list of groups that a user is a member of.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamGetGroupsForUser(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetGroupsForUser *op);
-
-struct SamOpenGroup {
-   struct {
-      /**Open handle to the domain SAM*/
-      POLICY_HND *dom_hnd;
-
-      /**Desired access to open the group with. See Generic access masks in include/smb.h*/
-      uint32 access;
-
-      /**rid of the group*/
-      uint32 rid;
-   } in;
-
-   struct {
-      /**Handle to the group*/
-      POLICY_HND *group_hnd;
-   } out;
-};
-
-/** 
- * Opens a domain group.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamOpenGroup(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamOpenGroup *op);
-
-struct SamCreateGroup {
-   struct {
-      /**Open handle to the domain SAM*/
-      POLICY_HND *dom_hnd;
-
-      /**Desired access to open the group with. See Generic access masks in include/smb.h*/
-      uint32 access;
-
-      /**The name of the group*/
-      char *name;
-   } in;
-
-   struct {
-      /**Handle to the group*/
-      POLICY_HND *group_hnd;
-   } out;
-};
-
-/** 
- * Creates a group. If the group already exists it will not be opened.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamCreateGroup(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamCreateGroup *op);
-
-/** 
- * Deletes a domain group.  
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param group_hnd Open handle to the group.
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamDeleteGroup(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *group_hnd);
-
-struct SamGetGroupMembers {
-   struct {
-      /**Open handle to a group*/
-      POLICY_HND *group_hnd;
-   } in;
-
-   struct {
-      /**The number of members in the group*/
-      uint32 num_members;
-
-      /**An array storing the RIDs of the users*/
-      uint32 *rids;
-
-      /**The attributes*/
-      uint32 *attributes;
-   } out;
-};
-
-/** 
- * Retrives a list of users in a group.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamGetGroupMembers(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetGroupMembers *op);
-
-struct SamAddGroupMember {
-   struct {
-      /**Open handle to a group*/
-      POLICY_HND *group_hnd;
-
-      /**RID of new member*/
-      uint32 rid;
-   } in;
-};
-
-/** 
- * Adds a user to a group.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamAddGroupMember(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamAddGroupMember *op);
-
-struct SamRemoveGroupMember {
-   struct {
-      /**Open handle to a group*/
-      POLICY_HND *group_hnd;
-
-      /**RID of member to remove*/
-      uint32 rid;
-   } in;
-};
-
-/** 
- * Removes a user from a group.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamRemoveGroupMember(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamRemoveGroupMember *op);
-
-/**
- * Removes all the members of a group - warning: if this function fails is is possible that some but not all members were removed
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param group_hnd Open handle to the group to clear
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamClearGroupMembers(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *group_hnd);
-
-struct SamSetGroupMembers {
-   struct {
-      /**Open handle to the group*/
-      POLICY_HND *group_hnd;
-
-      /**Number of members in the group - if this is 0, all members of the group will be removed*/
-      uint32 num_members;
-
-      /**The RIDs of the users to add*/
-      uint32 *rids;
-   } in;
-};
-
-/**
- * Clears the members of a group and adds a list of members to the group
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamSetGroupMembers(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamSetGroupMembers *op);
-
-struct SamEnumGroups {
-   struct {
-      /**Open handle to a domain*/
-      POLICY_HND *dom_hnd;
-   } in;
-
-   struct {
-      /**Where to resume from _do not_ modify this value. Used over multiple calls.*/
-      uint32 resume_idx;
-
-      /**the number of users returned this call*/
-      uint32 num_groups;
-
-      /**Array storing the rids of the returned groups*/
-      uint32 *rids;
-
-      /**Array storing the names of all the groups returned*/
-      char **names;
-
-      /**Array storing the descriptions of all the groups returned*/
-      char **descriptions;
-
-      bool done;
-   } out;
-};
-
-/** 
- * Enumerates domain groups. Can be used as a loop condition. Example: while(cac_SamEnumGroups(hnd, mem_ctx, op)) { ... }
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamEnumGroups(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamEnumGroups *op);
-
-struct SamEnumAliases {
-   struct {
-      /**Open handle to a domain*/
-      POLICY_HND *dom_hnd;
-   } in;
-
-   struct {
-      /**where to resume from. Used over multiple calls*/
-      uint32 resume_idx;
-
-      /**the number of users returned this call*/
-      uint32 num_aliases;
-
-      /**Array storing the rids of the returned groups*/
-      uint32 *rids;
-
-      /**Array storing the names of all the groups returned*/
-      char **names;
-
-      /**Array storing the descriptions of all the groups returned*/
-      char **descriptions;
-
-      bool done;
-   } out;
-};
-
-/** 
- * Enumerates domain aliases. Can be used as a loop condition. Example: while(cac_SamEnumAliases(hnd, mem_ctx, op)) { ... }
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamEnumAliases(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamEnumAliases *op);
-
-struct SamCreateAlias {
-   struct {
-      /**Open handle to the domain SAM*/
-      POLICY_HND *dom_hnd;
-
-      /**The name of the alias*/
-      char *name;
-   } in;
-
-   struct {
-      /**Handle to the group*/
-      POLICY_HND *alias_hnd;
-   } out;
-};
-
-/** 
- * Creates an alias. If the alias already exists it will not be opened.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_SamCreateAlias(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamCreateAlias *op);
-
-struct SamOpenAlias {
-   struct {
-      /**Open handle to the domain SAM*/
-      POLICY_HND *dom_hnd;
-
-      /**Desired access to open the group with. See Generic access masks in include/smb.h*/
-      uint32 access;
-
-      /**rid of the alias*/
-      uint32 rid;
-   } in;
-
-   struct {
-      /**Handle to the alias*/
-      POLICY_HND *alias_hnd;
-   } out;
-};
-
-/** 
- * Opens a handle to an alias.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamOpenAlias(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamOpenAlias *op);
-
-/** 
- * Deletes an alias.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param alias_hnd Open handle to the alias
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamDeleteAlias(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *alias_hnd);
-
-struct SamAddAliasMember {
-   struct {
-      /**Open handle to a alias*/
-      POLICY_HND *alias_hnd;
-
-      /**SID of new member*/
-      DOM_SID *sid;
-   } in;
-};
-
-/** 
- * Adds an account to an alias.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamAddAliasMember(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamAddAliasMember *op);
-
-struct SamRemoveAliasMember {
-   struct {
-      /**Open handle to the alias*/
-      POLICY_HND *alias_hnd;
-
-      /**The SID of the member*/
-      DOM_SID *sid;
-   } in;
-};
-
-/** 
- * Removes an account from an alias.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamRemoveAliasMember(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamRemoveAliasMember *op);
-
-struct SamGetAliasMembers {
-   struct {
-      /**Open handle to the alias*/
-      POLICY_HND *alias_hnd;
-   } in;
-
-   struct {
-      /**The number of members*/
-      uint32 num_members;
-
-      /**An array storing the SIDs of the accounts*/
-      DOM_SID *sids;
-   } out;
-};
-
-/** 
- * Retrieves a list of all accounts in an alias.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamGetAliasMembers(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetAliasMembers *op);
-
-/**
- * Removes all the members of an alias  - warning: if this function fails is is possible that some but not all members were removed
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param alias_hnd Handle to the alias to clear
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_SamClearAliasMembers(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *alias_hnd);
-
-struct SamSetAliasMembers {
-   struct {
-      /**Open handle to the group*/
-      POLICY_HND *alias_hnd;
-
-      /**Number of members in the group - if this is 0, all members of the group will be removed*/
-      uint32 num_members;
-
-      /**The SIDs of the accounts to add*/
-      DOM_SID *sids;
-   } in;
-};
-
-/**
- * Clears the members of an alias and adds a list of members to the alias
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamSetAliasMembers(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamSetAliasMembers *op);
-
-
-struct SamUserChangePasswd {
-   struct {
-      /**The username*/
-      char *username;
-
-      /**The current password*/
-      char *password;
-
-      /**The new password*/
-      char *new_password;
-   } in;
-};
-/**Used by a user to change their password*/
-int cac_SamUserChangePasswd(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamUserChangePasswd *op);
-
-/**
- * Enables a user
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param user_hnd Open handle to the user to enable
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamEnableUser(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *user_hnd);
-
-/**
- * Disables a user
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param user_hnd Open handle to the user to disables
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamDisableUser(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *user_hnd);
-
-struct SamSetPassword {
-   struct {
-      /**Open handle to a user*/
-      POLICY_HND *user_hnd;
-
-      /**The new password*/
-      char *password;
-   } in;
-};
-
-/**
- * Sets a user's password
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_SamSetPassword(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamSetPassword *op);
-
-struct SamGetUserInfo {
-   struct {
-      /**Open Handle to a user*/
-      POLICY_HND *user_hnd;
-   } in;
-
-   struct {
-      CacUserInfo *info;
-   } out;
-};
-
-/**
- * Retrieves user information using a CacUserInfo structure. If you would like to use a SAM_USERINFO_CTR directly, use cac_SamGetUserInfoCtr()
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @see cac_SamGetUserInfoCtr()
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamGetUserInfo(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetUserInfo *op);
-
-struct SamSetUserInfo {
-   struct {
-      /**Open handle to a user*/
-      POLICY_HND *user_hnd;
-
-      /**Structure containing the data you would like to set*/
-      CacUserInfo *info;
-   } in;
-};
-
-/**
- * Sets the user info using a CacUserInfo structure. If you would like to use a SAM_USERINFO_CTR directly use cac_SamSetUserInfoCtr().
- * @note All fields in the CacUserInfo structure will be set. Best to call cac_GetUserInfo() modify fields that you want, and then call cac_SetUserInfo().
- * @note When calling this, you _must_ set the user's password.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @see cac_SamSetUserInfoCtr()
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamSetUserInfo(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamSetUserInfo *op);
-
-struct SamGetUserInfoCtr {
-   struct {
-      /**Open handle to a user*/
-      POLICY_HND *user_hnd;
-
-      /**What USER_INFO structure you want. See include/rpc_samr.h*/
-      uint16 info_class;
-   } in;
-
-   struct {
-      /**returned user info*/
-      SAM_USERINFO_CTR *ctr;
-   } out;
-};
-
-/**
- * Retrieves user information using a SAM_USERINFO_CTR structure. If you don't want to use this structure, user SamGetUserInfo()
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @see cac_SamGetUserInfo()
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamGetUserInfoCtr(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetUserInfoCtr *op);
-
-struct SamSetUserInfoCtr {
-   struct {
-      /**Open handle to a user*/
-      POLICY_HND *user_hnd;
-
-      /**user info - make sure ctr->switch_value is set properly*/
-      SAM_USERINFO_CTR *ctr;
-   } in;
-};
-
-/**
- * Sets the user info using a SAM_USERINFO_CTR structure. If you don't want to use this structure, use cac_SamSetUserInfo()
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @see cac_SamSetUserInfo()
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_SamSetUserInfoCtr(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamSetUserInfoCtr *op);
-
-struct SamRenameUser {
-   struct {
-      /**Open handle to user*/
-      POLICY_HND *user_hnd;
-
-      /**New user name*/
-      char *new_name;
-   } in;
-};
-
-/**
- * Changes the name of a user.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamRenameUser(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamRenameUser *op);
-
-struct SamGetGroupInfo {
-   struct {
-      /**Open handle to a group*/
-      POLICY_HND *group_hnd;
-   } in;
-
-   struct {
-      /**Returned info about the group*/
-      CacGroupInfo *info;
-   } out;
-};
-
-/**
- * Retrieves information about a group.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamGetGroupInfo(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetGroupInfo *op);
-
-struct SamSetGroupInfo {
-   struct {
-      /**Open handle to a group*/
-      POLICY_HND *group_hnd;
-
-      /**group info*/
-      CacGroupInfo *info;
-   } in;
-};
-
-/**
- * Sets information about a group.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamSetGroupInfo(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamSetGroupInfo *op);
-
-struct SamRenameGroup {
-   struct {
-      /**Open handle to a group*/
-      POLICY_HND *group_hnd;
-
-      /**New name*/
-      char *new_name;
-   } in;
-};
-
-/**
- * Changes the name of a group
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-
-int cac_SamRenameGroup(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamRenameGroup *op);
-
-struct SamGetAliasInfo {
-   struct {
-      /**Open handle to an alias*/
-      POLICY_HND *alias_hnd;
-   } in;
-
-   struct {
-      /**Returned alias info*/
-      CacAliasInfo *info;
-   } out;
-};
-
-/**
- * Retrieves information about an alias.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamGetAliasInfo(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetAliasInfo *op);
-
-struct SamSetAliasInfo {
-   struct {
-      /**Open handle to an alias*/
-      POLICY_HND *alias_hnd;
-      
-      /**Returned alias info*/
-      CacAliasInfo *info;
-   } in;
-};
-
-/**
- * Sets information about an alias.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE The operation could not complete successfully. hnd->status is set with appropriate NTSTATUS code
- * @return CAC_SUCCESS The operation completed successfully
- */
-int cac_SamSetAliasInfo(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamSetAliasInfo *op);
-
-struct SamGetDomainInfo {
-   struct {
-      /**Open handle to the domain SAM*/
-      POLICY_HND *dom_hnd;
-   } in;
-
-   struct {
-      /**Returned domain info*/
-      CacDomainInfo *info;
-   } out;
-};
-
-/**
- * Gets domain information in the form of a CacDomainInfo structure. 
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @see SamGetDomainInfoCtr()
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- * @return CAC_PARTIAL_SUCCESS - This function makes 3 rpc calls, if one or two fail and the rest succeed, 
- *                                  not all fields in the CacDomainInfo structure will be filled
- */
-int cac_SamGetDomainInfo(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetDomainInfo *op);
-
-struct SamGetDomainInfoCtr {
-   struct {
-      /**Open handle to domain*/
-      POLICY_HND *dom_hnd;
-
-      /**What info level you want*/
-      uint16 info_class;
-   } in;
-
-   struct {
-      SAM_UNK_CTR *info;
-   } out;
-};
-
-/**
- * Gets domain information in the form of a SAM_UNK_CTR structure. 
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @see SamGetDomainInfo()
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SamGetDomainInfoCtr(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetDomainInfoCtr *op);
-
-struct SamGetDisplayInfo {
-   struct {
-      /**Open handle to domain*/
-      POLICY_HND *dom_hnd;
-
-      /**What type of data*/
-      uint16 info_class;
-
-      /**(Optional)If 0, max_entries and max_size will be filled in by the function*/
-      uint32 max_entries;
-      
-      /**(Optional)If 0, max_entries and max_size will be filled in by the function*/
-      uint32 max_size;
-   } in;
-
-   struct {
-      /**Do not modify this value, use the same value between multiple calls (ie in while loop)*/
-      uint32 resume_idx;
-
-      /**Number of entries returned*/
-      uint32 num_entries;
-
-      /**Returned display info*/
-      SAM_DISPINFO_CTR ctr;
-
-      /**Internal value. Do not modify.*/
-      uint32 loop_count;
-
-      bool done;
-   } out;
-};
-
-/**
- * Gets dislpay information using a SAM_DISPINFO_CTR.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SamGetDisplayInfo(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetDisplayInfo *op);
-
-struct SamLookupDomain {
-   struct {
-      /**Open handle to the sam (opened with cac_SamConnect() or cac_SamOpenDomain()*/
-      POLICY_HND *sam;
-
-      /**Name of the domain to lookup*/
-      char *name;
-   } in;
-
-   struct {
-      /**SID of the domain*/
-      DOM_SID *sid;
-   } out;
-};
-
-/**
- * Looks up a Domain SID given it's name.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SamLookupDomain(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamLookupDomain *op);
-
-struct SamGetSecurityObject {
-   struct {
-      /**An open handle (SAM, domain or user)*/
-      POLICY_HND *pol;
-   } in;
-
-   struct {
-      SEC_DESC_BUF *sec;
-   } out;
-};
-
-/**
- * Retrievies Security descriptor information for a SAM/Domain/user
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SamGetSecurityObject(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamGetSecurityObject *op);
-
-struct SamFlush {
-   struct {
-      /**Open handle to the domain SAM*/
-      POLICY_HND *dom_hnd;
-
-      /**(Optional)Domain SID. If NULL, the domain in hnd->domain will be opened*/
-      DOM_SID *sid;
-
-      /**(Optional)Desired access to re-open the domain with. If 0, MAXIMUM_ALLOWED_ACCESS is used.*/
-      uint32 access;
-   } in;
-};
-
-/**
- * Closes the domain handle, then re-opens it - effectively flushing any changes made.
- * WARNING: if this fails you will no longer have an open handle to the domain SAM.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SamFlush(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SamFlush *op);
-
-/**@}*/ /*SAM_Functions*/
-
-/**@addtogroup SCM_Functions
- * @{
- */
-
-struct SvcOpenScm {
-   struct {
-      /**Desired access to open the Handle with. See SC_RIGHT_MGR_* or SC_MANAGER_* in include/rpc_secdes.h*/
-      uint32 access;
-   } in;
-
-   struct {
-      /**Handle to the SCM*/
-      POLICY_HND *scm_hnd;
-   } out;
-};
-
-/**
- * Opens a handle to the SCM on the remote machine.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SvcOpenScm(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcOpenScm *op);
-
-/**
- * Closes an Svc handle (SCM or Service)
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param scm_hnd The handle to close
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SvcClose(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *scm_hnd);
-
-struct SvcEnumServices {
-   struct {
-      /**Open handle to the SCM*/
-      POLICY_HND *scm_hnd;
-
-      /**(Optional)Type of service to enumerate. Possible values:
-       *  - SVCCTL_TYPE_WIN32
-       *  - SVCCTL_TYPE_DRIVER
-       *  If this is 0, (SVCCTL_TYPE_DRIVER | SVCCTL_TYPE_WIN32) is assumed.
-       */
-      uint32 type;
-
-      /**(Optional)State of service to enumerate. Possible values:
-       *  - SVCCTL_STATE_ACTIVE
-       *  - SVCCTL_STATE_INACTIVE
-       *  - SVCCTL_STATE_ALL
-       *  If this is 0, SVCCTL_STATE_ALL is assumed.
-       */
-      uint32 state;
-   } in;
-   
-   struct {
-      /**Number of services returned*/
-      uint32 num_services;
-
-      /**Array of service structures*/
-      CacService *services;
-   } out;
-};
-
-/**
- * Enumerates services on the remote machine.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SvcEnumServices(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcEnumServices *op);
-
-struct SvcOpenService {
-   struct {
-      /**Handle to the Service Control Manager*/
-      POLICY_HND *scm_hnd;
-
-      /**Access mask to open service with see SERVICE_* or SC_RIGHT_SVC_* in include/rpc_secdes.h*/
-      uint32 access;
-
-      /**The name of the service. _not_ the display name*/
-      char *name;
-   } in;
-
-   struct {
-      /**Handle to the open service*/
-      POLICY_HND *svc_hnd;
-   } out;
-};
-
-/**
- * Opens a handle to a service.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-
-int cac_SvcOpenService(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcOpenService *op);
-
-struct SvcGetStatus {
-   struct {
-      /**Open handle to the service to query*/
-      POLICY_HND *svc_hnd;
-   } in;
-
-   struct {
-      /**The status of the service. See include/rpc_svcctl.h for SERVICE_STATUS definition.*/
-      SERVICE_STATUS status;
-   } out;
-};
-
-/**
- * Retrieves the status of a service.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SvcGetStatus(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcGetStatus *op);
-
-struct SvcStartService {
-   struct {
-      /**open handle to the service*/
-      POLICY_HND *svc_hnd;
-
-      /**Array of parameters to start the service with. Can be NULL if num_parms is 0*/
-      char **parms;
-
-      /**Number of parameters in the parms array*/
-      uint32 num_parms;
-
-      /**Number of seconds to wait for the service to actually start. If this is 0, then the status will not be checked after the initial call*/
-      uint32 timeout;
-   } in;
-};
-
-/**
- * Attempts to start a service.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-
-int cac_SvcStartService(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcStartService *op);
-
-struct SvcControlService {
-   struct {
-      /**Open handle to the service to control*/
-      POLICY_HND *svc_hnd;
-
-      /**The control operation to perform. Possible values (from include/rpc_svcctl.h):
-       * - SVCCTL_CONTROL_STOP
-       * - SVCCTL_CONTROL_PAUSE
-       * - SVCCTL_CONTROL_CONTINUE
-       * - SVCCTL_CONTROL_SHUTDOWN
-       */
-      uint32 control;
-   } in;
-
-   struct {
-      /**The returned status of the service, _immediately_ after the call*/
-      SERVICE_STATUS *status;
-   } out;
-};
-
-/**
- * Performs a control operation on a service and _immediately_ returns.
- * @see cac_SvcStopService()
- * @see cac_SvcPauseService()
- * @see cac_SvcContinueService()
- * @see cac_SvcShutdownService()
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SvcControlService(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcControlService *op);
-
-struct SvcStopService {
-   struct {
-      /**Open handle to the service*/
-      POLICY_HND *svc_hnd;
-
-      /**Number of seconds to wait for the service to actually start. 
-       * If this is 0, then the status will not be checked after the initial call and CAC_SUCCESS might be returned if the status isn't actually started
-       */
-      uint32 timeout;
-   } in;
-
-   struct {
-      /**Status of the service after the operation*/
-      SERVICE_STATUS status;
-   } out;
-};
-
-/**
- * Attempts to stop a service.
- * @see cacSvcControlService()
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE - the operation was not successful. If hnd->status is NT_STATUS_OK, then a timeout occured.
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SvcStopService(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcStopService *op);
-
-struct SvcPauseService {
-   struct {
-      /**Open handle to the service*/
-      POLICY_HND *svc_hnd;
-
-      /**Number of seconds to wait for the service to actually start. 
-       * If this is 0, then the status will not be checked after the initial call and CAC_SUCCESS might be returned if the status isn't actually started
-       */
-      uint32 timeout;
-   } in;
-
-   struct {
-      /**Status of the service after the operation*/
-      SERVICE_STATUS status;
-   } out;
-};
-
-/**
- * Attempts to pause a service.
- * @see cacSvcControlService()
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE - the operation was not successful. If hnd->status is NT_STATUS_OK, then a timeout occured.
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SvcPauseService(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcPauseService *op);
-
-struct SvcContinueService {
-   struct {
-      /**Open handle to the service*/
-      POLICY_HND *svc_hnd;
-
-      /**Number of seconds to wait for the service to actually start. 
-       * If this is 0, then the status will not be checked after the initial call and CAC_SUCCESS might be returned if the status isn't actually started
-       */
-      uint32 timeout;
-   } in;
-
-   struct {
-      /**Status of the service after the operation*/
-      SERVICE_STATUS status;
-   } out;
-};
-
-/**
- * Attempts to continue a paused service.
- * @see cacSvcControlService()
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE - the operation was not successful. If hnd->status is NT_STATUS_OK, then a timeout occured.
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SvcContinueService(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcContinueService *op);
-
-struct SvcGetDisplayName {
-   struct {
-      /**Open handle to the service*/
-      POLICY_HND *svc_hnd;
-   } in;
-
-   struct {
-      /**The returned display name of the service*/
-      char *display_name;
-   } out;
-};
-
-/**
- * Retrieves the display name of a service _not currently working_
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SvcGetDisplayName(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcGetDisplayName *op);
-
-struct SvcGetServiceConfig {
-   struct {
-      /**Open handle to the service*/
-      POLICY_HND *svc_hnd;
-   } in;
-
-   struct {
-      /**Returned Configuration information*/
-      CacServiceConfig config;
-   } out;
-};
-
-/**
- * Retrieves configuration information about a service.
- * @param hnd Initialized and connected server handle
- * @param mem_ctx Context for memory allocation
- * @param op Initialized Parameters
- * @return CAC_FAILURE - the operation was not successful hnd->status is set appropriately
- * @return CAC_SUCCESS - the operation was successful
- */
-int cac_SvcGetServiceConfig(CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct SvcGetServiceConfig *op);
-
-/**@}*/ /*SCM_Functions*/
-
-struct rpc_pipe_client *cac_GetPipe(CacServerHandle *hnd, int pi_idx);
-
-#endif /* LIBMSRPC_H */
-
-
diff --git a/source3/include/libmsrpc_internal.h b/source3/include/libmsrpc_internal.h
deleted file mode 100644
index 623c43f9c3..0000000000
--- a/source3/include/libmsrpc_internal.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/* 
- *  Unix SMB/CIFS implementation.
- *  MS-RPC client internal definitions
- *  Copyright (C) Chris Nicholls              2005.
- *  
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 3 of the License, or
- *  (at your option) any later version.
- *  
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *  
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#ifndef LIBMSRPC_INTERNAL_H
-#define LIBMSRPC_INTERNAL_H
-
-#include "libmsrpc.h"
-
-/*definitions*/
-
-struct CacServerHandleInternal {
-   /*stores the os type of the server*/
-   uint16 srv_level;
-
-   /*stores the initialized/active pipes*/
-   bool pipes[PI_MAX_PIPES];
-
-   /*underlying smbc context*/
-   SMBCCTX *ctx;
-
-   /*did the user supply this SMBCCTX?*/
-   bool user_supplied_ctx;
-};
-
-/*used to get a struct rpc_pipe_client* to be passed into rpccli* calls*/
-
-/*nessecary prototypes*/
-bool rid_in_list(uint32 rid, uint32 *list, uint32 list_len);
-
-int cac_ParseRegPath(char *path, uint32 *reg_type, char **key_name);
-
-REG_VALUE_DATA *cac_MakeRegValueData(TALLOC_CTX *mem_ctx, uint32 data_type, REGVAL_BUFFER buf);
-
-RPC_DATA_BLOB *cac_MakeRpcDataBlob(TALLOC_CTX *mem_ctx, uint32 data_type, REG_VALUE_DATA data);
-
-SAM_USERINFO_CTR *cac_MakeUserInfoCtr(TALLOC_CTX *mem_ctx, CacUserInfo *info);
-
-CacUserInfo *cac_MakeUserInfo(TALLOC_CTX *mem_ctx, SAM_USERINFO_CTR *ctr);
-CacGroupInfo *cac_MakeGroupInfo(TALLOC_CTX *mem_ctx, GROUP_INFO_CTR *ctr);
-GROUP_INFO_CTR *cac_MakeGroupInfoCtr(TALLOC_CTX *mem_ctx, CacGroupInfo *info);
-CacAliasInfo *cac_MakeAliasInfo(TALLOC_CTX *mem_ctx, ALIAS_INFO_CTR ctr);
-ALIAS_INFO_CTR *cac_MakeAliasInfoCtr(TALLOC_CTX *mem_ctx, CacAliasInfo *info);
-CacDomainInfo *cac_MakeDomainInfo(TALLOC_CTX *mem_ctx, SAM_UNK_INFO_1 *info1, SAM_UNK_INFO_2 *info2, SAM_UNK_INFO_12 *info12);
-CacService *cac_MakeServiceArray(TALLOC_CTX *mem_ctx, ENUM_SERVICES_STATUS *svc, uint32 num_services);
-int cac_InitCacServiceConfig(TALLOC_CTX *mem_ctx, SERVICE_CONFIG *src, CacServiceConfig *dest);
-
-/*moved to libmsrpc.h*/
-/*struct rpc_pipe_client *cac_GetPipe(CacServerHandle *hnd, int pi_idx);*/
-
-SMBCSRV *smbc_attr_server(SMBCCTX *context,
-                          const char *server, const char *share, 
-                          fstring workgroup,
-                          fstring username, fstring password,
-                          POLICY_HND *pol);
-
-
-#endif /* LIBMSRPC_INTERNAL_H */
diff --git a/source3/include/nameserv.h b/source3/include/nameserv.h
index 4377e3330a..a7d46e72d8 100644
--- a/source3/include/nameserv.h
+++ b/source3/include/nameserv.h
@@ -539,17 +539,6 @@ struct packet_struct
 	} packet;
 };
 
-/* NETLOGON opcodes */
-
-#define QUERYFORPDC	 7 /* Query for PDC. */
-#define SAM_UAS_CHANGE  10 /* Announce change to UAS or SAM. */
-#define QUERYFORPDC_R	12 /* Response to Query for PDC. */
-#define SAMLOGON	18
-#define SAMLOGON_R	19
-#define SAMLOGON_UNK_R	21
-#define SAMLOGON_AD_UNK_R 23
-#define SAMLOGON_AD_R   25
-
 /* Ids for netbios packet types. */
 
 #define ANN_HostAnnouncement         1
diff --git a/source3/include/printing.h b/source3/include/printing.h
index 04e30a011b..d91917b528 100644
--- a/source3/include/printing.h
+++ b/source3/include/printing.h
@@ -77,7 +77,7 @@ extern struct printif	iprint_printif;
 #define NEXT_JOBID(j) ((j+1) % PRINT_MAX_JOBID > 0 ? (j+1) % PRINT_MAX_JOBID : 1)
 
 #define MAX_CACHE_VALID_TIME 3600
-#define CUPS_DEFAULT_TIMEOUT 30
+#define CUPS_DEFAULT_CONNECTION_TIMEOUT 30
 
 #ifndef PRINT_SPOOL_PREFIX
 #define PRINT_SPOOL_PREFIX "smbprn."
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 198248c517..3df87a6c34 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -43,7 +43,10 @@ bool password_ok(const char *smb_name, DATA_BLOB password_blob);
 
 /* The following definitions come from auth/auth_domain.c  */
 
-NTSTATUS auth_domain_init(void) ;
+void attempt_machine_password_change(void);
+NTSTATUS auth_domain_init(void);
+
+NTSTATUS auth_netlogond_init(void);
 
 /* The following definitions come from auth/auth_ntlmssp.c  */
 
@@ -489,7 +492,7 @@ TALLOC_CTX *debug_ctx(void);
 /* The following definitions come from lib/display_sec.c  */
 
 char *get_sec_mask_str(TALLOC_CTX *ctx, uint32 type);
-void display_sec_access(SEC_ACCESS *info);
+void display_sec_access(uint32_t *info);
 void display_sec_ace_flags(uint8_t flags);
 void display_sec_ace(SEC_ACE *ace);
 void display_sec_acl(SEC_ACL *sec_acl);
@@ -507,6 +510,7 @@ void display_set_stderr(void);
 /* The following definitions come from lib/errmap_unix.c  */
 
 NTSTATUS map_nt_error_from_unix(int unix_error);
+int map_errno_from_nt_status(NTSTATUS status);
 
 /* The following definitions come from lib/events.c  */
 
@@ -702,6 +706,7 @@ bool privilege_set_to_se_priv( SE_PRIV *mask, struct lsa_PrivilegeSet *privset )
 
 /* The following definitions come from lib/readline.c  */
 
+void smb_readline_done(void);
 char *smb_readline(const char *prompt, void (*callback)(void),
 		   char **(completion_fn)(const char *text, int start, int end));
 const char *smb_readline_get_line_buffer(void);
@@ -766,7 +771,6 @@ NTSTATUS sec_desc_mod_sid(SEC_DESC *sd, DOM_SID *sid, uint32 mask);
 NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, size_t *sd_size);
 SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr, 
 				      bool child_container);
-void init_sec_access(uint32 *t, uint32 mask);
 
 /* The following definitions come from lib/select.c  */
 
@@ -1421,6 +1425,7 @@ WERROR registry_push_value(TALLOC_CTX *mem_ctx,
 /* The following definitions come from lib/util_seaccess.c  */
 
 void se_map_generic(uint32 *access_mask, const struct generic_mapping *mapping);
+void security_acl_map_generic(struct security_acl *sa, const struct generic_mapping *mapping);
 void se_map_standard(uint32 *access_mask, struct standard_mapping *mapping);
 bool se_access_check(const SEC_DESC *sd, const NT_USER_TOKEN *token,
 		     uint32 acc_desired, uint32 *acc_granted, 
@@ -5819,7 +5824,7 @@ const char **lp_svcctl_list(void);
 char *lp_cups_options(int );
 char *lp_cups_server(void);
 char *lp_iprint_server(void);
-int lp_cups_timeout(void);
+int lp_cups_connection_timeout(void);
 const char *lp_ctdbd_socket(void);
 const char **lp_cluster_addresses(void);
 bool lp_clustering(void);
@@ -5985,7 +5990,7 @@ bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal);
 struct parm_struct *lp_get_parameter(const char *param_name);
 struct parm_struct *lp_next_parameter(int snum, int *i, int allparameters);
 bool lp_snum_ok(int iService);
-void lp_add_one_printer(char *name, char *comment);
+void lp_add_one_printer(const char *name, const char *comment, void *pdata);
 bool lp_loaded(void);
 void lp_killunused(bool (*snumused) (int));
 void lp_kill_all_services(void);
@@ -6414,6 +6419,8 @@ bool secrets_restore_schannel_session_info(TALLOC_CTX *mem_ctx,
 				struct dcinfo **ppdc);
 bool secrets_store_generic(const char *owner, const char *key, const char *secret);
 char *secrets_fetch_generic(const char *owner, const char *key);
+bool secrets_store_local_schannel_key(uint8_t schannel_key[16]);
+bool secrets_fetch_local_schannel_key(uint8_t schannel_key[16]);
 
 /* The following definitions come from passdb/util_builtin.c  */
 
@@ -6556,11 +6563,15 @@ char* get_server_name( Printer_entry *printer );
 
 /* The following definitions come from printing/pcap.c  */
 
+bool pcap_cache_add_specific(struct pcap_cache **ppcache, const char *name, const char *comment);
+void pcap_cache_destroy_specific(struct pcap_cache **ppcache);
 bool pcap_cache_add(const char *name, const char *comment);
 bool pcap_cache_loaded(void);
+void pcap_cache_replace(const struct pcap_cache *cache);
 void pcap_cache_reload(void);
 bool pcap_printername_ok(const char *printername);
-void pcap_printer_fn(void (*fn)(char *, char *));
+void pcap_printer_fn_specific(const struct pcap_cache *, void (*fn)(const char *, const char *, void *), void *);
+void pcap_printer_fn(void (*fn)(const char *, const char *, void *), void *);
 
 /* The following definitions come from printing/print_aix.c  */
 
@@ -9545,7 +9556,6 @@ NTSTATUS open_fake_file(connection_struct *conn,
 				const char *fname,
 				uint32 access_mask,
 				files_struct **result);
-void destroy_fake_file_handle(struct fake_file_handle **fh);
 NTSTATUS close_fake_file(files_struct *fsp);
 
 /* The following definitions come from smbd/file_access.c  */
@@ -9911,14 +9921,17 @@ void reply_pipe_close(connection_struct *conn, struct smb_request *req);
 
 /* The following definitions come from smbd/posix_acls.c  */
 
-NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, SEC_DESC *psd);
+NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd);
 SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl);
 NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
 			   SEC_DESC **ppdesc);
 NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
 			  uint32_t security_info, SEC_DESC **ppdesc);
 int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_t gid);
-NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd);
+NTSTATUS append_parent_acl(files_struct *fsp,
+				const SEC_DESC *pcsd,
+				SEC_DESC **pp_new_sd);
+NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd);
 int get_acl_group_bits( connection_struct *conn, const char *fname, mode_t *mode );
 int chmod_acl(connection_struct *conn, const char *name, mode_t mode);
 int inherit_access_posix_acl(connection_struct *conn, const char *inherit_from_dir,
diff --git a/source3/include/rpc_secdes.h b/source3/include/rpc_secdes.h
index 83103b7386..71fba41fe9 100644
--- a/source3/include/rpc_secdes.h
+++ b/source3/include/rpc_secdes.h
@@ -70,9 +70,6 @@
 					PROTECTED_SACL_SECURITY_INFORMATION|\
 					PROTECTED_DACL_SECURITY_INFORMATION)
 
-/* SEC_ACCESS */
-typedef uint32 SEC_ACCESS;
-
 /* SEC_ACE */
 typedef struct security_ace SEC_ACE;
 #define  SEC_ACE_HEADER_SIZE (2 * sizeof(uint8) + sizeof(uint16) + sizeof(uint32))
diff --git a/source3/include/secrets.h b/source3/include/secrets.h
index d9f457558b..3c8e2ccf81 100644
--- a/source3/include/secrets.h
+++ b/source3/include/secrets.h
@@ -45,6 +45,8 @@
 
 #define SECRETS_LDAP_BIND_PW "SECRETS/LDAP_BIND_PW"
 
+#define SECRETS_LOCAL_SCHANNEL_KEY "SECRETS/LOCAL_SCHANNEL_KEY"
+
 /* Authenticated user info is stored in secrets.tdb under these keys */
 
 #define SECRETS_AUTH_USER      "SECRETS/AUTH_USER"
diff --git a/source3/include/smb.h b/source3/include/smb.h
index c8c4f8c3cc..ef98b5e1b5 100644
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -391,6 +391,7 @@ struct idle_event;
 struct share_mode_entry;
 struct uuid;
 struct named_mutex;
+struct pcap_cache;
 
 struct vfs_fsp_data {
     struct vfs_fsp_data *next;
diff --git a/source3/include/smb_macros.h b/source3/include/smb_macros.h
index 20e2a9a443..d2e0aa95ac 100644
--- a/source3/include/smb_macros.h
+++ b/source3/include/smb_macros.h
@@ -75,22 +75,6 @@
 				return ERROR_NT(NT_STATUS_INVALID_HANDLE); \
 			} while(0)
 
-/* you must add the following extern declaration to files using this macro
- * (do not add it to the macro as that causes nested extern declaration warnings)
- * extern struct current_user current_user;
- */
-#define CHECK_FSP(fsp,conn) do {\
-			if (!(fsp) || !(conn)) \
-				return ERROR_NT(NT_STATUS_INVALID_HANDLE); \
-			else if (((conn) != (fsp)->conn) || current_user.vuid != (fsp)->vuid) \
-				return ERROR_NT(NT_STATUS_INVALID_HANDLE); \
-			else if ((fsp)->is_directory) \
-				return ERROR_NT(NT_STATUS_INVALID_DEVICE_REQUEST); \
-			else if ((fsp)->fh->fd == -1) \
-				return ERROR_NT(NT_STATUS_ACCESS_DENIED); \
-			(fsp)->num_smb_operations++;\
-			} while(0)
-
 #define CHECK_READ(fsp,inbuf) (((fsp)->fh->fd != -1) && ((fsp)->can_read || \
 			((SVAL((inbuf),smb_flg2) & FLAGS2_READ_PERMIT_EXECUTE) && \
 			 (fsp->access_mask & FILE_EXECUTE))))
diff --git a/source3/include/vfs.h b/source3/include/vfs.h
index 9b72f69328..a3d38f6a25 100644
--- a/source3/include/vfs.h
+++ b/source3/include/vfs.h
@@ -108,8 +108,9 @@
 /* Leave at 22 - not yet released. Remove parameter fd from close_fn. - obnox */
 /* Changed to version 23 - remove set_nt_acl call. This can only be done via an
    open handle. JRA. */
+/* Changed to version 24 - make security descriptor const in fset_nt_acl. JRA. */
 
-#define SMB_VFS_INTERFACE_VERSION 23
+#define SMB_VFS_INTERFACE_VERSION 24
 
 
 /* to bug old modules which are trying to compile with the old functions */
@@ -365,7 +366,7 @@ struct vfs_ops {
 		NTSTATUS (*fset_nt_acl)(struct vfs_handle_struct *handle,
 					struct files_struct *fsp,
 					uint32 security_info_sent,
-					struct security_descriptor *psd);
+					const struct security_descriptor *psd);
 
 		/* POSIX ACL operations. */
 
diff --git a/source3/lib/async_sock.c b/source3/lib/async_sock.c
index 1a4c27ba20..ffba6de832 100644
--- a/source3/lib/async_sock.c
+++ b/source3/lib/async_sock.c
@@ -658,12 +658,13 @@ struct async_req *async_connect(TALLOC_CTX *mem_ctx, struct event_context *ev,
 
 	state->fde = event_add_fd(ev, state, fd,
 				  EVENT_FD_READ | EVENT_FD_WRITE,
-				  async_connect_callback, state);
+				  async_connect_callback, result);
 	if (state->fde == NULL) {
 		sys_fcntl_long(fd, F_SETFL, p->old_sockflags);
 		TALLOC_FREE(result);
 		return NULL;
 	}
+	result->private_data = state;
 
 	state->param.param_connect.fd = fd;
 	state->param.param_connect.address = address;
diff --git a/source3/lib/ctdbd_conn.c b/source3/lib/ctdbd_conn.c
index 1ae23bcf82..5075476e94 100644
--- a/source3/lib/ctdbd_conn.c
+++ b/source3/lib/ctdbd_conn.c
@@ -260,7 +260,7 @@ static struct messaging_rec *ctdb_pull_messaging_rec(TALLOC_CTX *mem_ctx,
 	blob = data_blob_const(msg->data, msg->datalen);
 
 	ndr_err = ndr_pull_struct_blob(
-		&blob, result, result,
+		&blob, result, NULL, result,
 		(ndr_pull_flags_fn_t)ndr_pull_messaging_rec);
 
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -636,7 +636,7 @@ NTSTATUS ctdbd_messaging_send(struct ctdbd_connection *conn,
 	}
 
 	ndr_err = ndr_push_struct_blob(
-		&blob, mem_ctx, msg,
+		&blob, mem_ctx, NULL, msg,
 		(ndr_push_flags_fn_t)ndr_push_messaging_rec);
 
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
diff --git a/source3/lib/dbwrap_ctdb.c b/source3/lib/dbwrap_ctdb.c
index 63a5ce4de6..2818634b14 100644
--- a/source3/lib/dbwrap_ctdb.c
+++ b/source3/lib/dbwrap_ctdb.c
@@ -405,8 +405,9 @@ static struct db_record *db_ctdb_fetch_locked_transaction(struct db_ctdb_ctx *ct
 	return result;
 }
 
-static int db_ctdb_record_destructor(struct db_record *rec)
+static int db_ctdb_record_destructor(struct db_record **recp)
 {
+	struct db_record *rec = talloc_get_type_abort(*recp, struct db_record);
 	struct db_ctdb_transaction_handle *h = talloc_get_type_abort(
 		rec->private_data, struct db_ctdb_transaction_handle);
 	int ret = h->ctx->db->transaction_commit(h->ctx->db);
@@ -424,7 +425,7 @@ static struct db_record *db_ctdb_fetch_locked_persistent(struct db_ctdb_ctx *ctx
 							 TDB_DATA key)
 {
 	int res;
-	struct db_record *rec;
+	struct db_record *rec, **recp;
 
 	res = db_ctdb_transaction_start(ctx->db);
 	if (res == -1) {
@@ -438,7 +439,14 @@ static struct db_record *db_ctdb_fetch_locked_persistent(struct db_ctdb_ctx *ctx
 	}
 
 	/* destroy this transaction when we release the lock */
-	talloc_set_destructor((struct db_record *)talloc_new(rec), db_ctdb_record_destructor);
+	recp = talloc(rec, struct db_record *);
+	if (recp == NULL) {
+		ctx->db->transaction_cancel(ctx->db);
+		talloc_free(rec);
+		return NULL;
+	}
+	*recp = rec;
+	talloc_set_destructor(recp, db_ctdb_record_destructor);
 	return rec;
 }
 
diff --git a/source3/lib/debug.c b/source3/lib/debug.c
index d835ea7c17..d91b55dd23 100644
--- a/source3/lib/debug.c
+++ b/source3/lib/debug.c
@@ -578,7 +578,9 @@ void setup_logging(const char *pname, bool interactive)
 	stdout_logging = False;
 	if (dbf) {
 		x_fflush(dbf);
-		(void) x_fclose(dbf);
+                if (dbf != x_stdout) {
+                        (void) x_fclose(dbf);
+                }
 	}
 
 	dbf = NULL;
diff --git a/source3/lib/display_sec.c b/source3/lib/display_sec.c
index 67392e4568..5427a8173e 100644
--- a/source3/lib/display_sec.c
+++ b/source3/lib/display_sec.c
@@ -118,7 +118,7 @@ char *get_sec_mask_str(TALLOC_CTX *ctx, uint32 type)
 /****************************************************************************
  display sec_access structure
  ****************************************************************************/
-void display_sec_access(SEC_ACCESS *info)
+void display_sec_access(uint32_t *info)
 {
 	char *mask_str = get_sec_mask_str(NULL, *info);
 	printf("\t\tPermissions: 0x%x: %s\n", *info, mask_str ? mask_str : "");
diff --git a/source3/lib/dummysmbd.c b/source3/lib/dummysmbd.c
index dbe886e3d1..5c624bdebf 100644
--- a/source3/lib/dummysmbd.c
+++ b/source3/lib/dummysmbd.c
@@ -51,3 +51,18 @@ NTSTATUS can_delete_directory(struct connection_struct *conn,
 {
 	return NT_STATUS_OK;
 }
+
+bool change_to_root_user(void)
+{
+	return false;
+}
+
+struct event_context *smbd_event_context(void)
+{
+	return NULL;
+}
+
+struct messaging_context *smbd_messaging_context(void)
+{
+	return NULL;
+}
diff --git a/source3/lib/errmap_unix.c b/source3/lib/errmap_unix.c
index 2cd2386c5c..9adb237096 100644
--- a/source3/lib/errmap_unix.c
+++ b/source3/lib/errmap_unix.c
@@ -128,3 +128,139 @@ NTSTATUS map_nt_error_from_unix(int unix_error)
 	/* Default return */
 	return NT_STATUS_ACCESS_DENIED;
 }
+
+/* Return a UNIX errno from a NT status code */
+static const struct {
+	NTSTATUS status;
+	int error;
+} nt_errno_map[] = {
+        {NT_STATUS_ACCESS_VIOLATION, EACCES},
+        {NT_STATUS_INVALID_HANDLE, EBADF},
+        {NT_STATUS_ACCESS_DENIED, EACCES},
+        {NT_STATUS_OBJECT_NAME_NOT_FOUND, ENOENT},
+        {NT_STATUS_OBJECT_PATH_NOT_FOUND, ENOENT},
+        {NT_STATUS_SHARING_VIOLATION, EBUSY},
+        {NT_STATUS_OBJECT_PATH_INVALID, ENOTDIR},
+        {NT_STATUS_OBJECT_NAME_COLLISION, EEXIST},
+        {NT_STATUS_PATH_NOT_COVERED, ENOENT},
+	{NT_STATUS_UNSUCCESSFUL, EINVAL},
+	{NT_STATUS_NOT_IMPLEMENTED, ENOSYS},
+	{NT_STATUS_IN_PAGE_ERROR, EFAULT}, 
+	{NT_STATUS_BAD_NETWORK_NAME, ENOENT},
+#ifdef EDQUOT
+	{NT_STATUS_PAGEFILE_QUOTA, EDQUOT},
+	{NT_STATUS_QUOTA_EXCEEDED, EDQUOT},
+	{NT_STATUS_REGISTRY_QUOTA_LIMIT, EDQUOT},
+	{NT_STATUS_LICENSE_QUOTA_EXCEEDED, EDQUOT},
+#endif
+#ifdef ETIME
+	{NT_STATUS_TIMER_NOT_CANCELED, ETIME},
+#endif
+	{NT_STATUS_INVALID_PARAMETER, EINVAL},
+	{NT_STATUS_NO_SUCH_DEVICE, ENODEV},
+	{NT_STATUS_NO_SUCH_FILE, ENOENT},
+#ifdef ENODATA
+	{NT_STATUS_END_OF_FILE, ENODATA}, 
+#endif
+#ifdef ENOMEDIUM
+	{NT_STATUS_NO_MEDIA_IN_DEVICE, ENOMEDIUM}, 
+	{NT_STATUS_NO_MEDIA, ENOMEDIUM},
+#endif
+	{NT_STATUS_NONEXISTENT_SECTOR, ESPIPE}, 
+        {NT_STATUS_NO_MEMORY, ENOMEM},
+	{NT_STATUS_CONFLICTING_ADDRESSES, EADDRINUSE},
+	{NT_STATUS_NOT_MAPPED_VIEW, EINVAL},
+	{NT_STATUS_UNABLE_TO_FREE_VM, EADDRINUSE},
+	{NT_STATUS_ACCESS_DENIED, EACCES}, 
+	{NT_STATUS_BUFFER_TOO_SMALL, ENOBUFS},
+	{NT_STATUS_WRONG_PASSWORD, EACCES},
+	{NT_STATUS_LOGON_FAILURE, EACCES},
+	{NT_STATUS_INVALID_WORKSTATION, EACCES},
+	{NT_STATUS_INVALID_LOGON_HOURS, EACCES},
+	{NT_STATUS_PASSWORD_EXPIRED, EACCES},
+	{NT_STATUS_ACCOUNT_DISABLED, EACCES},
+	{NT_STATUS_DISK_FULL, ENOSPC},
+	{NT_STATUS_INVALID_PIPE_STATE, EPIPE},
+	{NT_STATUS_PIPE_BUSY, EPIPE},
+	{NT_STATUS_PIPE_DISCONNECTED, EPIPE},
+	{NT_STATUS_PIPE_NOT_AVAILABLE, ENOSYS},
+	{NT_STATUS_FILE_IS_A_DIRECTORY, EISDIR},
+	{NT_STATUS_NOT_SUPPORTED, ENOSYS},
+	{NT_STATUS_NOT_A_DIRECTORY, ENOTDIR},
+	{NT_STATUS_DIRECTORY_NOT_EMPTY, ENOTEMPTY},
+	{NT_STATUS_NETWORK_UNREACHABLE, ENETUNREACH},
+	{NT_STATUS_HOST_UNREACHABLE, EHOSTUNREACH},
+	{NT_STATUS_CONNECTION_ABORTED, ECONNABORTED},
+	{NT_STATUS_CONNECTION_REFUSED, ECONNREFUSED},
+	{NT_STATUS_TOO_MANY_LINKS, EMLINK},
+	{NT_STATUS_NETWORK_BUSY, EBUSY},
+	{NT_STATUS_DEVICE_DOES_NOT_EXIST, ENODEV},
+#ifdef ELIBACC
+	{NT_STATUS_DLL_NOT_FOUND, ELIBACC},
+#endif
+	{NT_STATUS_PIPE_BROKEN, EPIPE},
+	{NT_STATUS_REMOTE_NOT_LISTENING, ECONNREFUSED},
+	{NT_STATUS_NETWORK_ACCESS_DENIED, EACCES},
+	{NT_STATUS_TOO_MANY_OPENED_FILES, EMFILE},
+#ifdef EPROTO
+	{NT_STATUS_DEVICE_PROTOCOL_ERROR, EPROTO},
+#endif
+	{NT_STATUS_FLOAT_OVERFLOW, ERANGE},
+	{NT_STATUS_FLOAT_UNDERFLOW, ERANGE},
+	{NT_STATUS_INTEGER_OVERFLOW, ERANGE},
+	{NT_STATUS_MEDIA_WRITE_PROTECTED, EROFS},
+	{NT_STATUS_PIPE_CONNECTED, EISCONN},
+	{NT_STATUS_MEMORY_NOT_ALLOCATED, EFAULT},
+	{NT_STATUS_FLOAT_INEXACT_RESULT, ERANGE},
+	{NT_STATUS_ILL_FORMED_PASSWORD, EACCES},
+	{NT_STATUS_PASSWORD_RESTRICTION, EACCES},
+	{NT_STATUS_ACCOUNT_RESTRICTION, EACCES},
+	{NT_STATUS_PORT_CONNECTION_REFUSED, ECONNREFUSED},
+	{NT_STATUS_NAME_TOO_LONG, ENAMETOOLONG},
+	{NT_STATUS_REMOTE_DISCONNECT, ESHUTDOWN},
+	{NT_STATUS_CONNECTION_DISCONNECTED, ECONNABORTED},
+	{NT_STATUS_CONNECTION_RESET, ENETRESET},
+#ifdef ENOTUNIQ
+	{NT_STATUS_IP_ADDRESS_CONFLICT1, ENOTUNIQ},
+	{NT_STATUS_IP_ADDRESS_CONFLICT2, ENOTUNIQ},
+#endif
+	{NT_STATUS_PORT_MESSAGE_TOO_LONG, EMSGSIZE},
+	{NT_STATUS_PROTOCOL_UNREACHABLE, ENOPROTOOPT},
+	{NT_STATUS_ADDRESS_ALREADY_EXISTS, EADDRINUSE},
+	{NT_STATUS_PORT_UNREACHABLE, EHOSTUNREACH},
+	{NT_STATUS_IO_TIMEOUT, ETIMEDOUT},
+	{NT_STATUS_RETRY, EAGAIN},
+#ifdef ENOTUNIQ
+	{NT_STATUS_DUPLICATE_NAME, ENOTUNIQ},
+#endif
+#ifdef ECOMM
+	{NT_STATUS_NET_WRITE_FAULT, ECOMM},
+#endif
+#ifdef EXDEV
+	{NT_STATUS_NOT_SAME_DEVICE, EXDEV},
+#endif
+	{NT_STATUS(0), 0}
+};
+
+int map_errno_from_nt_status(NTSTATUS status)
+{
+	int i;
+	DEBUG(10,("map_errno_from_nt_status: 32 bit codes: code=%08x\n",
+		NT_STATUS_V(status)));
+
+	/* Status codes without this bit set are not errors */
+
+	if (!(NT_STATUS_V(status) & 0xc0000000)) {
+		return 0;
+	}
+
+	for (i=0;nt_errno_map[i].error;i++) {
+		if (NT_STATUS_V(nt_errno_map[i].status) ==
+			    NT_STATUS_V(status)) {
+			return nt_errno_map[i].error;
+		}
+	}
+
+	/* for all other cases - a default code */
+	return EINVAL;
+}
diff --git a/source3/lib/ldb/common/ldb.c b/source3/lib/ldb/common/ldb.c
index 743711b967..c8aa6afdfc 100644
--- a/source3/lib/ldb/common/ldb.c
+++ b/source3/lib/ldb/common/ldb.c
@@ -787,6 +787,7 @@ int ldb_search(struct ldb_context *ldb,
 done:
 	if (ret != LDB_SUCCESS) {
 		talloc_free(res);
+		res = NULL;
 	}
 
 	*_res = res;
diff --git a/source3/lib/netapi/file.c b/source3/lib/netapi/file.c
index 036af32f38..0d66be0eb1 100644
--- a/source3/lib/netapi/file.c
+++ b/source3/lib/netapi/file.c
@@ -47,7 +47,8 @@ WERROR NetFileClose_r(struct libnetapi_ctx *ctx,
 					    r->in.server_name,
 					    r->in.fileid,
 					    &werr);
-	if (!W_ERROR_IS_OK(werr)) {
+	if (!NT_STATUS_IS_OK(status)) {
+		werr = ntstatus_to_werror(status);
 		goto done;
 	}
 
diff --git a/source3/lib/netapi/getdc.c b/source3/lib/netapi/getdc.c
index 07a6544af1..76c0d0be2a 100644
--- a/source3/lib/netapi/getdc.c
+++ b/source3/lib/netapi/getdc.c
@@ -58,6 +58,10 @@ WERROR NetGetDCName_r(struct libnetapi_ctx *ctx,
 				       r->in.domain_name,
 				       (const char **)r->out.buffer,
 				       &werr);
+
+	if (!NT_STATUS_IS_OK(status)) {
+		werr = ntstatus_to_werror(status);
+	}
  done:
 
 	return werr;
diff --git a/source3/lib/netapi/share.c b/source3/lib/netapi/share.c
index 1d0e1810f1..e6aed36064 100644
--- a/source3/lib/netapi/share.c
+++ b/source3/lib/netapi/share.c
@@ -271,7 +271,8 @@ WERROR NetShareDel_r(struct libnetapi_ctx *ctx,
 					   r->in.net_name,
 					   r->in.reserved,
 					   &werr);
-	if (!W_ERROR_IS_OK(werr)) {
+	if (!NT_STATUS_IS_OK(status)) {
+		werr = ntstatus_to_werror(status);
 		goto done;
 	}
 
diff --git a/source3/lib/netapi/user.c b/source3/lib/netapi/user.c
index 7d0c47f331..fcb87b77be 100644
--- a/source3/lib/netapi/user.c
+++ b/source3/lib/netapi/user.c
@@ -108,18 +108,18 @@ static void convert_USER_INFO_X_to_samr_user_info21(struct USER_INFO_X *infoX,
 			      infoX->usriX_workstations,
 			      infoX->usriX_usr_comment,
 			      &zero_parameters,
-			      0,
+			      infoX->usriX_user_id,
 			      infoX->usriX_primary_group_id,
 			      infoX->usriX_flags,
 			      fields_present,
 			      zero_logon_hours,
-			      0,
-			      0,
+			      infoX->usriX_bad_pw_count,
+			      infoX->usriX_num_logons,
 			      infoX->usriX_country_code,
+			      infoX->usriX_code_page,
 			      0,
 			      0,
-			      0,
-			      0);
+			      infoX->usriX_password_expired);
 }
 
 /****************************************************************
@@ -132,6 +132,7 @@ static NTSTATUS construct_USER_INFO_X(uint32_t level,
 	struct USER_INFO_0 *u0 = NULL;
 	struct USER_INFO_1 *u1 = NULL;
 	struct USER_INFO_2 *u2 = NULL;
+	struct USER_INFO_3 *u3 = NULL;
 	struct USER_INFO_1003 *u1003 = NULL;
 	struct USER_INFO_1006 *u1006 = NULL;
 	struct USER_INFO_1007 *u1007 = NULL;
@@ -193,6 +194,37 @@ static NTSTATUS construct_USER_INFO_X(uint32_t level,
 			uX->usriX_country_code	= u2->usri2_country_code;
 			uX->usriX_code_page	= u2->usri2_code_page;
 			break;
+		case 3:
+			u3 = (struct USER_INFO_3 *)buffer;
+			uX->usriX_name		= u3->usri3_name;
+			uX->usriX_password_age	= u3->usri3_password_age;
+			uX->usriX_priv		= u3->usri3_priv;
+			uX->usriX_home_dir	= u3->usri3_home_dir;
+			uX->usriX_comment	= u3->usri3_comment;
+			uX->usriX_flags		= u3->usri3_flags;
+			uX->usriX_script_path	= u3->usri3_script_path;
+			uX->usriX_auth_flags	= u3->usri3_auth_flags;
+			uX->usriX_full_name	= u3->usri3_full_name;
+			uX->usriX_usr_comment	= u3->usri3_usr_comment;
+			uX->usriX_parms		= u3->usri3_parms;
+			uX->usriX_workstations	= u3->usri3_workstations;
+			uX->usriX_last_logon	= u3->usri3_last_logon;
+			uX->usriX_last_logoff	= u3->usri3_last_logoff;
+			uX->usriX_acct_expires	= u3->usri3_acct_expires;
+			uX->usriX_max_storage	= u3->usri3_max_storage;
+			uX->usriX_units_per_week= u3->usri3_units_per_week;
+			uX->usriX_logon_hours	= u3->usri3_logon_hours;
+			uX->usriX_bad_pw_count	= u3->usri3_bad_pw_count;
+			uX->usriX_num_logons	= u3->usri3_num_logons;
+			uX->usriX_logon_server	= u3->usri3_logon_server;
+			uX->usriX_country_code	= u3->usri3_country_code;
+			uX->usriX_code_page	= u3->usri3_code_page;
+			uX->usriX_user_id	= u3->usri3_user_id;
+			uX->usriX_primary_group_id = u3->usri3_primary_group_id;
+			uX->usriX_profile	= u3->usri3_profile;
+			uX->usriX_home_dir_drive = u3->usri3_home_dir_drive;
+			uX->usriX_password_expired = u3->usri3_password_expired;
+			break;
 		case 1003:
 			u1003 = (struct USER_INFO_1003 *)buffer;
 			uX->usriX_password	= u1003->usri1003_password;
@@ -237,7 +269,6 @@ static NTSTATUS construct_USER_INFO_X(uint32_t level,
 			u1053 = (struct USER_INFO_1053 *)buffer;
 			uX->usriX_home_dir_drive = u1053->usri1053_home_dir_drive;
 			break;
-		case 3:
 		case 4:
 		default:
 			return NT_STATUS_INVALID_INFO_CLASS;
@@ -1753,9 +1784,17 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
 			user_mask = SAMR_USER_ACCESS_SET_ATTRIBUTES |
 				    SAMR_USER_ACCESS_GET_GROUPS;
 			break;
+		case 3:
+			user_mask = STD_RIGHT_READ_CONTROL_ACCESS |
+				    STD_RIGHT_WRITE_DAC_ACCESS |
+				    SAMR_USER_ACCESS_GET_GROUPS |
+				    SAMR_USER_ACCESS_SET_PASSWORD |
+				    SAMR_USER_ACCESS_SET_ATTRIBUTES |
+				    SAMR_USER_ACCESS_GET_ATTRIBUTES |
+				    SAMR_USER_ACCESS_SET_LOC_COM;
+			break;
 		case 1:
 		case 2:
-		case 3:
 		case 4:
 		case 21:
 		case 22:
diff --git a/source3/lib/readline.c b/source3/lib/readline.c
index 254f55c86a..cafb5a9f62 100644
--- a/source3/lib/readline.c
+++ b/source3/lib/readline.c
@@ -45,6 +45,24 @@
 #  define RL_COMPLETION_CAST
 #endif /* HAVE_NEW_LIBREADLINE */
 
+static bool smb_rl_done;
+
+#if HAVE_LIBREADLINE
+/*
+ * MacOS/X does not have rl_done in readline.h, but
+ * readline.so has it
+ */
+extern int rl_done;
+#endif
+
+void smb_readline_done(void)
+{
+	smb_rl_done = true;
+#if HAVE_LIBREADLINE
+	rl_done = 1;
+#endif
+}
+
 /****************************************************************************
  Display the prompt and wait for input. Call callback() regularly
 ****************************************************************************/
@@ -69,7 +87,7 @@ static char *smb_readline_replacement(const char *prompt, void (*callback)(void)
 		return NULL;
 	}
 
-	while (1) {
+	while (!smb_rl_done) {
 		timeout.tv_sec = 5;
 		timeout.tv_usec = 0;
 
@@ -87,6 +105,7 @@ static char *smb_readline_replacement(const char *prompt, void (*callback)(void)
 			callback();
 		}
 	}
+	return NULL;
 }
 
 /****************************************************************************
diff --git a/source3/lib/secace.c b/source3/lib/secace.c
index 8760a6109a..9f5a0c02ba 100644
--- a/source3/lib/secace.c
+++ b/source3/lib/secace.c
@@ -55,7 +55,7 @@ void sec_ace_copy(SEC_ACE *ace_dest, SEC_ACE *ace_src)
 ********************************************************************/
 
 void init_sec_ace(SEC_ACE *t, const DOM_SID *sid, enum security_ace_type type,
-		  uint32 mask, uint8 flag)
+		  uint32_t mask, uint8 flag)
 {
 	t->type = type;
 	t->flags = flag;
diff --git a/source3/lib/secdesc.c b/source3/lib/secdesc.c
index 4965200bc1..52ff067d6a 100644
--- a/source3/lib/secdesc.c
+++ b/source3/lib/secdesc.c
@@ -512,7 +512,7 @@ SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr,
 		if (!inherit)
 			continue;
 
-		init_sec_access(&new_ace->access_mask, ace->access_mask);
+		new_ace->access_mask = ace->access_mask;
 		init_sec_ace(new_ace, &ace->trustee, ace->type,
 			     new_ace->access_mask, new_flags);
 
@@ -546,14 +546,3 @@ SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr,
 
 	return sdb;
 }
-
-/*******************************************************************
- Sets up a SEC_ACCESS structure.
-********************************************************************/
-
-void init_sec_access(uint32 *t, uint32 mask)
-{
-	*t = mask;
-}
-
-
diff --git a/source3/lib/sharesec.c b/source3/lib/sharesec.c
index 33f66ca47f..298655e181 100644
--- a/source3/lib/sharesec.c
+++ b/source3/lib/sharesec.c
@@ -124,7 +124,7 @@ static bool share_info_db_init(void)
 
 SEC_DESC *get_share_security_default( TALLOC_CTX *ctx, size_t *psize, uint32 def_access)
 {
-	SEC_ACCESS sa;
+	uint32_t sa;
 	SEC_ACE ace;
 	SEC_ACL *psa = NULL;
 	SEC_DESC *psd = NULL;
@@ -132,7 +132,7 @@ SEC_DESC *get_share_security_default( TALLOC_CTX *ctx, size_t *psize, uint32 def
 
 	se_map_generic(&spec_access, &file_generic_mapping);
 
-	init_sec_access(&sa, def_access | spec_access );
+	sa = (def_access | spec_access );
 	init_sec_ace(&ace, &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, sa, 0);
 
 	if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 1, &ace)) != NULL) {
@@ -332,7 +332,7 @@ bool parse_usershare_acl(TALLOC_CTX *ctx, const char *acl_str, SEC_DESC **ppsd)
 	}
 
 	for (i = 0; i < num_aces; i++) {
-		SEC_ACCESS sa;
+		uint32_t sa;
 		uint32 g_access;
 		uint32 s_access;
 		DOM_SID sid;
@@ -380,7 +380,7 @@ bool parse_usershare_acl(TALLOC_CTX *ctx, const char *acl_str, SEC_DESC **ppsd)
 		pacl++; /* Go past any ',' */
 
 		se_map_generic(&s_access, &file_generic_mapping);
-		init_sec_access(&sa, g_access | s_access );
+		sa = (g_access | s_access);
 		init_sec_ace(&ace_list[i], &sid, type, sa, 0);
 	}
 
diff --git a/source3/lib/util_seaccess.c b/source3/lib/util_seaccess.c
index 87e70bb95b..7e461556b3 100644
--- a/source3/lib/util_seaccess.c
+++ b/source3/lib/util_seaccess.c
@@ -30,7 +30,7 @@ extern NT_USER_TOKEN anonymous_token;
 static uint32 check_ace(SEC_ACE *ace, const NT_USER_TOKEN *token, uint32 acc_desired, 
 			NTSTATUS *status)
 {
-	uint32 mask = ace->access_mask;
+	uint32_t mask = ace->access_mask;
 
 	/*
 	 * Inherit only is ignored.
@@ -176,6 +176,24 @@ void se_map_generic(uint32 *access_mask, const struct generic_mapping *mapping)
 	}
 }
 
+/* Map generic access rights to object specific rights for all the ACE's
+ * in a security_acl.
+ */
+
+void security_acl_map_generic(struct security_acl *sa,
+				const struct generic_mapping *mapping)
+{
+	unsigned int i;
+
+	if (!sa) {
+		return;
+	}
+
+	for (i = 0; i < sa->num_aces; i++) {
+		se_map_generic(&sa->aces[i].access_mask, mapping);
+	}
+}
+
 /* Map standard access rights to object specific rights.  This technique is
    used to give meaning to assigning read, write, execute and all access to
    objects.  Each type of object has its own mapping of standard to object
@@ -328,7 +346,6 @@ NTSTATUS samr_make_sam_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
 	DOM_SID act_sid;
 
 	SEC_ACE ace[3];
-	SEC_ACCESS mask;
 
 	SEC_ACL *psa = NULL;
 
@@ -339,13 +356,14 @@ NTSTATUS samr_make_sam_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
 	sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
 
 	/*basic access for every one*/
-	init_sec_access(&mask, GENERIC_RIGHTS_SAM_EXECUTE | GENERIC_RIGHTS_SAM_READ);
-	init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
+		GENERIC_RIGHTS_SAM_EXECUTE | GENERIC_RIGHTS_SAM_READ, 0);
 
 	/*full access for builtin aliases Administrators and Account Operators*/
-	init_sec_access(&mask, GENERIC_RIGHTS_SAM_ALL_ACCESS);
-	init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
-	init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[1], &adm_sid,
+		SEC_ACE_TYPE_ACCESS_ALLOWED, GENERIC_RIGHTS_SAM_ALL_ACCESS, 0);
+	init_sec_ace(&ace[2], &act_sid,
+		SEC_ACE_TYPE_ACCESS_ALLOWED, GENERIC_RIGHTS_SAM_ALL_ACCESS, 0);
 
 	if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
 		return NT_STATUS_NO_MEMORY;
diff --git a/source3/libaddns/dnsmarshall.c b/source3/libaddns/dnsmarshall.c
index 8c3389eb9b..5530290c57 100644
--- a/source3/libaddns/dnsmarshall.c
+++ b/source3/libaddns/dnsmarshall.c
@@ -252,6 +252,7 @@ void dns_unmarshall_domain_name(TALLOC_CTX *mem_ctx,
 
 	if (!(name = talloc(mem_ctx, struct dns_domain_name))) {
 		buf->error = ERROR_DNS_NO_MEMORY;
+		return;
 	}
 
 	dns_unmarshall_label(name, 0, buf, &name->pLabelList);
diff --git a/source3/libaddns/dnsrecord.c b/source3/libaddns/dnsrecord.c
index 500cbd6681..559c2644d4 100644
--- a/source3/libaddns/dnsrecord.c
+++ b/source3/libaddns/dnsrecord.c
@@ -378,10 +378,10 @@ DNS_ERROR dns_create_update_request(TALLOC_CTX *mem_ctx,
 	if (!ERR_DNS_IS_OK(err)) return err;
 
 	/*
-	 * The zone must be used at all
+	 * Use the same prereq as WinXP -- No CNAME records for this host.
 	 */
 
-	err = dns_create_rrec(req, domainname, QTYPE_ANY, DNS_CLASS_ANY,
+	err = dns_create_rrec(req, hostname, QTYPE_CNAME, DNS_CLASS_NONE,
 			      0, 0, NULL, &rec);
 	if (!ERR_DNS_IS_OK(err)) goto error;
 
diff --git a/source3/libads/cldap.c b/source3/libads/cldap.c
index edabbed0e9..c37220c903 100644
--- a/source3/libads/cldap.c
+++ b/source3/libads/cldap.c
@@ -283,7 +283,7 @@ bool ads_cldap_netlogon_5(TALLOC_CTX *mem_ctx,
 		return false;
 	}
 
-	*reply5 = reply->nt5_ex;
+	*reply5 = reply->data.nt5_ex;
 
 	return true;
 }
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index bfcfcf30b9..40f052281d 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -2828,6 +2828,7 @@ ADS_STATUS ads_domain_func_level(ADS_STRUCT *ads, uint32 *val)
 		if ( (ads_s = ads_init( ads->server.realm, ads->server.workgroup, 
 			ads->server.ldap_server )) == NULL )
 		{
+			status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
 			goto done;
 		}
 		ads_s->auth.flags = ADS_AUTH_ANON_BIND;
diff --git a/source3/libads/util.c b/source3/libads/util.c
index 72f5dee80c..d23c36f326 100644
--- a/source3/libads/util.c
+++ b/source3/libads/util.c
@@ -86,6 +86,8 @@ ADS_STATUS ads_guess_service_principal(ADS_STRUCT *ads,
 		server_realm = SMB_STRDUP(ads->config.realm);
 
 		if (!server || !server_realm) {
+			SAFE_FREE(server);
+			SAFE_FREE(server_realm);
 			return ADS_ERROR(LDAP_NO_MEMORY);
 		}
 
diff --git a/source3/libgpo/gpext/scripts.c b/source3/libgpo/gpext/scripts.c
index c07407c3f0..02c3abaa1e 100644
--- a/source3/libgpo/gpext/scripts.c
+++ b/source3/libgpo/gpext/scripts.c
@@ -93,7 +93,7 @@ static NTSTATUS generate_gp_registry_entry(TALLOC_CTX *mem_ctx,
 	data->type = data_type;
 	switch (data->type) {
 		case REG_QWORD:
-			data->v.qword = (uint64_t)data_p;
+			data->v.qword = *(uint64_t *)data_p;
 			break;
 		case REG_SZ:
 			data->v.sz.str = talloc_strdup(mem_ctx, (char *)data_p);
diff --git a/source3/libgpo/gpext/security.c b/source3/libgpo/gpext/security.c
new file mode 100644
index 0000000000..1d746da37f
--- /dev/null
+++ b/source3/libgpo/gpext/security.c
@@ -0,0 +1,267 @@
+/*
+ *  Unix SMB/CIFS implementation.
+ *  Group Policy Support
+ *  Copyright (C) Guenther Deschner 2005-2008
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "includes.h"
+#include "libgpo/gpo_ini.h"
+
+#define GP_EXT_NAME "security"
+
+#define GPTTMPL_UNIX_PATH  "Microsoft/Windows NT/SecEdit/GptTmpl.inf"
+
+#define GPTTMPL_SECTION_UNICODE			"Unicode"
+#define GPTTMPL_SECTION_VERSION			"Version"
+
+#define GPTTMPL_SECTION_REGISTRY_VALUES		"Registry Values"
+#define GPTTMPL_SECTION_SYSTEM_ACCESS		"System Access"
+#define GPTTMPL_SECTION_KERBEROS_POLICY		"Kerberos Policy"
+#define GPTTMPL_SECTION_EVENT_AUDIT		"Event Audit"
+#define GPTTMPL_SECTION_PRIVILEGE_RIGHTS	"Privilege Rights"
+#define GPTTMPL_SECTION_APPLICATION_LOG		"Application Log"
+#define GPTTMPL_SECTION_SECURITY_LOG		"Security Log"
+#define GPTTMPL_SECTION_SYSTEM_LOG		"System Log"
+#define GPTTMPL_SECTION_GROUP_MEMBERSHIP	"Group Membership"
+#define GPTTMPL_SECTION_FILE_SECURITY		"File Security"
+#define GPTTMPL_SECTION_SERVICE_GENERAL_SETTING "Service General Setting"
+
+static TALLOC_CTX *ctx = NULL;
+
+struct gpttmpl_table {
+	const char *section;
+	const char *parameter;
+	enum winreg_Type type;
+};
+
+/****************************************************************
+ parse the Version section from gpttmpl file
+****************************************************************/
+
+#define GPTTMPL_PARAMETER_REVISION "Revision"
+#define GPTTMPL_PARAMETER_SIGNATURE "signature"
+#define GPTTMPL_VALUE_CHICAGO "$CHICAGO$" /* whatever this is good for... */
+#define GPTTMPL_PARAMETER_UNICODE "Unicode"
+
+static NTSTATUS gpttmpl_parse_header(dictionary *dict,
+				     uint32_t *version_out)
+{
+	const char *signature = NULL;
+	uint32_t version;
+
+	if (!dict) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if ((signature = iniparser_getstring(dict, GPTTMPL_SECTION_VERSION
+			":"GPTTMPL_PARAMETER_SIGNATURE, NULL)) == NULL) {
+		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	}
+
+	if (!strequal(signature, GPTTMPL_VALUE_CHICAGO)) {
+		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	}
+
+	if ((version = iniparser_getint(dict, GPTTMPL_SECTION_VERSION
+			":"GPTTMPL_PARAMETER_REVISION, Undefined)) == Undefined) {
+		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	}
+
+	if (version_out) {
+		*version_out = version;
+	}
+
+	/* treat that as boolean */
+	if ((!iniparser_getboolean(dict, GPTTMPL_SECTION_UNICODE
+			":"GPTTMPL_PARAMETER_UNICODE, Undefined)) == Undefined) {
+		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	}
+
+	return NT_STATUS_OK;
+}
+
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS gpttmpl_init_context(TALLOC_CTX *mem_ctx,
+				     uint32_t flags,
+				     const char *unix_path,
+				     struct gp_inifile_context **ini_ctx)
+{
+	NTSTATUS status;
+	uint32_t version;
+	struct gp_inifile_context *tmp_ctx = NULL;
+
+	status = gp_inifile_init_context(mem_ctx, flags, unix_path,
+					 GPTTMPL_UNIX_PATH, &tmp_ctx);
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	status = gpttmpl_parse_header(tmp_ctx->dict, &version);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1,("gpttmpl_init_context: failed: %s\n",
+			nt_errstr(status)));
+		TALLOC_FREE(tmp_ctx);
+		return status;
+	}
+
+	*ini_ctx = tmp_ctx;
+
+	return NT_STATUS_OK;
+}
+
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS gpttmpl_process(struct gp_inifile_context *ini_ctx,
+				struct registry_key *root_key,
+				uint32_t flags)
+{
+	return NT_STATUS_OK;
+}
+
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS security_process_group_policy(ADS_STRUCT *ads,
+					      TALLOC_CTX *mem_ctx,
+					      uint32_t flags,
+					      struct registry_key *root_key,
+					      const struct nt_user_token *token,
+					      struct GROUP_POLICY_OBJECT *gpo,
+					      const char *extension_guid,
+					      const char *snapin_guid)
+{
+	NTSTATUS status;
+	char *unix_path = NULL;
+	struct gp_inifile_context *ini_ctx = NULL;
+
+	debug_gpext_header(0, "security_process_group_policy", flags, gpo,
+			   extension_guid, snapin_guid);
+
+	/* this handler processes the gpttmpl files and merge output to the
+	 * registry */
+
+	status = gpo_get_unix_path(mem_ctx, gpo, &unix_path);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto out;
+	}
+
+	status = gpttmpl_init_context(mem_ctx, flags, unix_path, &ini_ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto out;
+	}
+
+	status = gpttmpl_process(ini_ctx, root_key, flags);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto out;
+	}
+
+ out:
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0,("security_process_group_policy: %s\n",
+			nt_errstr(status)));
+	}
+	TALLOC_FREE(ini_ctx);
+
+	return status;
+}
+
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS security_get_reg_config(TALLOC_CTX *mem_ctx,
+					struct gp_extension_reg_info **reg_info)
+{
+	NTSTATUS status;
+	struct gp_extension_reg_info *info = NULL;
+
+	struct gp_extension_reg_table table[] = {
+		/* FIXME: how can we store the "(Default)" value ??? */
+		/* { "", REG_SZ, "Security" }, */
+		{ "ProcessGroupPolicy", REG_SZ, "security_process_group_policy" },
+		{ "NoUserPolicy", REG_DWORD, "1" },
+		{ "ExtensionDebugLevel", REG_DWORD, "1" },
+		{ NULL, REG_NONE, NULL }
+	};
+
+	info = TALLOC_ZERO_P(mem_ctx, struct gp_extension_reg_info);
+	NT_STATUS_HAVE_NO_MEMORY(info);
+
+	status = gp_ext_info_add_entry(mem_ctx, GP_EXT_NAME,
+				       GP_EXT_GUID_SECURITY,
+				       table, info);
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	*reg_info = info;
+
+	return NT_STATUS_OK;
+}
+
+
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS security_initialize(TALLOC_CTX *mem_ctx)
+{
+	return NT_STATUS_OK;
+}
+
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS security_shutdown(void)
+{
+	NTSTATUS status;
+
+	status = unregister_gp_extension(GP_EXT_NAME);
+	if (NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	TALLOC_FREE(ctx);
+
+	return NT_STATUS_OK;
+}
+
+/****************************************************************
+****************************************************************/
+
+static struct gp_extension_methods security_methods = {
+	.initialize		= security_initialize,
+	.process_group_policy	= security_process_group_policy,
+	.get_reg_config		= security_get_reg_config,
+	.shutdown		= security_shutdown
+};
+
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS gpext_security_init(void)
+{
+	NTSTATUS status;
+
+	ctx = talloc_init("gpext_security_init");
+	NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+	status = register_gp_extension(ctx, SMB_GPEXT_INTERFACE_VERSION,
+				       GP_EXT_NAME, GP_EXT_GUID_SECURITY,
+				       &security_methods);
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(ctx);
+	}
+
+	return status;
+}
diff --git a/source3/libgpo/gpo_reg.c b/source3/libgpo/gpo_reg.c
index 920deeb189..d49315021e 100644
--- a/source3/libgpo/gpo_reg.c
+++ b/source3/libgpo/gpo_reg.c
@@ -689,25 +689,25 @@ static WERROR gp_reg_generate_sd(TALLOC_CTX *mem_ctx,
 				 size_t *sd_size)
 {
 	SEC_ACE ace[6];
-	SEC_ACCESS mask;
+	uint32_t mask;
 
 	SEC_ACL *acl = NULL;
 
 	uint8_t inherit_flags;
 
-	init_sec_access(&mask, REG_KEY_ALL);
+	mask = REG_KEY_ALL;
 	init_sec_ace(&ace[0],
 		     &global_sid_System,
 		     SEC_ACE_TYPE_ACCESS_ALLOWED,
 		     mask, 0);
 
-	init_sec_access(&mask, REG_KEY_ALL);
+	mask = REG_KEY_ALL;
 	init_sec_ace(&ace[1],
 		     &global_sid_Builtin_Administrators,
 		     SEC_ACE_TYPE_ACCESS_ALLOWED,
 		     mask, 0);
 
-	init_sec_access(&mask, REG_KEY_READ);
+	mask = REG_KEY_READ;
 	init_sec_ace(&ace[2],
 		     sid ? sid : &global_sid_Authenticated_Users,
 		     SEC_ACE_TYPE_ACCESS_ALLOWED,
@@ -717,19 +717,19 @@ static WERROR gp_reg_generate_sd(TALLOC_CTX *mem_ctx,
 			SEC_ACE_FLAG_CONTAINER_INHERIT |
 			SEC_ACE_FLAG_INHERIT_ONLY;
 
-	init_sec_access(&mask, REG_KEY_ALL);
+	mask = REG_KEY_ALL;
 	init_sec_ace(&ace[3],
 		     &global_sid_System,
 		     SEC_ACE_TYPE_ACCESS_ALLOWED,
 		     mask, inherit_flags);
 
-	init_sec_access(&mask, REG_KEY_ALL);
+	mask = REG_KEY_ALL;
 	init_sec_ace(&ace[4],
 		     &global_sid_Builtin_Administrators,
 		     SEC_ACE_TYPE_ACCESS_ALLOWED,
 		     mask, inherit_flags);
 
-	init_sec_access(&mask, REG_KEY_READ);
+	mask = REG_KEY_READ;
 	init_sec_ace(&ace[5],
 		     sid ? sid : &global_sid_Authenticated_Users,
 		     SEC_ACE_TYPE_ACCESS_ALLOWED,
diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
index a39dee676f..ab8af0be6b 100644
--- a/source3/libnet/libnet_join.c
+++ b/source3/libnet/libnet_join.c
@@ -357,10 +357,15 @@ static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
 	strupper_m(spn);
 	spn_array[0] = spn;
 
-	if (name_to_fqdn(my_fqdn, r->in.machine_name) &&
-	    !strequal(my_fqdn, r->in.machine_name)) {
+	if (!name_to_fqdn(my_fqdn, r->in.machine_name)
+	    || (strchr(my_fqdn, '.') == NULL)) {
+		fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
+			     r->out.dns_domain_name);
+	}
+
+	strlower_m(my_fqdn);
 
-		strlower_m(my_fqdn);
+	if (!strequal(my_fqdn, r->in.machine_name)) {
 		spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
 		if (!spn) {
 			return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
diff --git a/source3/libnet/libnet_proto.h b/source3/libnet/libnet_proto.h
index 43046a44c0..69a16c1c7d 100644
--- a/source3/libnet/libnet_proto.h
+++ b/source3/libnet/libnet_proto.h
@@ -53,7 +53,7 @@ krb5_error_code libnet_keytab_add(struct libnet_keytab_context *ctx);
 
 struct libnet_keytab_entry *libnet_keytab_search(struct libnet_keytab_context *ctx,
 						 const char *principal, int kvno,
-						 const const krb5_enctype enctype,
+						 const krb5_enctype enctype,
 						 TALLOC_CTX *mem_ctx);
 #endif
 
diff --git a/source3/librpc/gen_ndr/nbt.h b/source3/librpc/gen_ndr/nbt.h
index 264b00b84f..4b872d7936 100644
--- a/source3/librpc/gen_ndr/nbt.h
+++ b/source3/librpc/gen_ndr/nbt.h
@@ -391,7 +391,7 @@ struct nbt_dgram_packet {
 }/* [public,flag(LIBNDR_FLAG_NOALIGN|LIBNDR_FLAG_BIGENDIAN|LIBNDR_PRINT_ARRAY_HEX)] */;
 
 struct nbt_sockaddr {
-	uint32_t sa_family;
+	uint32_t sockaddr_family;
 	const char * pdc_ip;/* [flag(LIBNDR_FLAG_BIGENDIAN)] */
 	DATA_BLOB remaining;/* [flag(LIBNDR_FLAG_REMAINING)] */
 }/* [gensize,public] */;
diff --git a/source3/librpc/gen_ndr/ndr_nbt.c b/source3/librpc/gen_ndr/ndr_nbt.c
index 84cfabda57..c02b539da5 100644
--- a/source3/librpc/gen_ndr/ndr_nbt.c
+++ b/source3/librpc/gen_ndr/ndr_nbt.c
@@ -1531,7 +1531,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_nbt_sockaddr(struct ndr_push *ndr, int ndr_f
 {
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_push_align(ndr, 4));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->sa_family));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->sockaddr_family));
 		{
 			uint32_t _flags_save_ipv4address = ndr->flags;
 			ndr_set_flags(&ndr->flags, LIBNDR_FLAG_BIGENDIAN);
@@ -1554,7 +1554,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_nbt_sockaddr(struct ndr_pull *ndr, int ndr_f
 {
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_pull_align(ndr, 4));
-		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->sa_family));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->sockaddr_family));
 		{
 			uint32_t _flags_save_ipv4address = ndr->flags;
 			ndr_set_flags(&ndr->flags, LIBNDR_FLAG_BIGENDIAN);
@@ -1577,7 +1577,7 @@ _PUBLIC_ void ndr_print_nbt_sockaddr(struct ndr_print *ndr, const char *name, co
 {
 	ndr_print_struct(ndr, name, "nbt_sockaddr");
 	ndr->depth++;
-	ndr_print_uint32(ndr, "sa_family", r->sa_family);
+	ndr_print_uint32(ndr, "sockaddr_family", r->sockaddr_family);
 	ndr_print_ipv4address(ndr, "pdc_ip", r->pdc_ip);
 	ndr_print_DATA_BLOB(ndr, "remaining", r->remaining);
 	ndr->depth--;
diff --git a/source3/librpc/idl/nbt.idl b/source3/librpc/idl/nbt.idl
index 82571d96e6..f3590fcf2b 100644
--- a/source3/librpc/idl/nbt.idl
+++ b/source3/librpc/idl/nbt.idl
@@ -339,7 +339,7 @@ interface nbt
 	 */
 
 	typedef [public,gensize] struct {
-		uint32			sa_family;
+		uint32			sockaddr_family;
 		[flag(NDR_BIG_ENDIAN)]	ipv4address pdc_ip;
 		[flag(NDR_REMAINING)]	DATA_BLOB remaining;
 	} nbt_sockaddr;
diff --git a/source3/libsmb/async_smb.c b/source3/libsmb/async_smb.c
index fb35ecbe1f..68495076b6 100644
--- a/source3/libsmb/async_smb.c
+++ b/source3/libsmb/async_smb.c
@@ -924,7 +924,7 @@ static void cli_state_handler(struct event_context *event_ctx,
 		}
 		cli->evt_inbuf = tmp;
 
-		res = recv(cli->fd, cli->evt_inbuf + old_size, available, 0);
+		res = sys_recv(cli->fd, cli->evt_inbuf + old_size, available, 0);
 		if (res == -1) {
 			DEBUG(10, ("recv failed: %s\n", strerror(errno)));
 			status = map_nt_error_from_unix(errno);
@@ -970,7 +970,7 @@ static void cli_state_handler(struct event_context *event_ctx,
 			return;
 		}
 
-		sent = send(cli->fd, req->outbuf + req->sent,
+		sent = sys_send(cli->fd, req->outbuf + req->sent,
 			    to_send - req->sent, 0);
 
 		if (sent < 0) {
diff --git a/source3/libsmb/clidgram.c b/source3/libsmb/clidgram.c
index e8799bce47..611ae0870c 100644
--- a/source3/libsmb/clidgram.c
+++ b/source3/libsmb/clidgram.c
@@ -279,8 +279,8 @@ bool receive_getdc_response(TALLOC_CTX *mem_ctx,
 	/* do we still need this ? */
 	*nt_version = r.ntver;
 
-	returned_domain = r.nt5_ex.domain;
-	returned_dc = r.nt5_ex.pdc_name;
+	returned_domain = r.data.nt5_ex.domain;
+	returned_dc = r.data.nt5_ex.pdc_name;
 
 	if (!strequal(returned_domain, domain_name)) {
 		DEBUG(3, ("GetDC: Expected domain %s, got %s\n",
diff --git a/source3/libsmb/clierror.c b/source3/libsmb/clierror.c
index 36746419f7..54f8a7a43c 100644
--- a/source3/libsmb/clierror.c
+++ b/source3/libsmb/clierror.c
@@ -236,142 +236,6 @@ void cli_dos_error(struct cli_state *cli, uint8 *eclass, uint32 *ecode)
 	*ecode  = SVAL(cli->inbuf,smb_err);
 }
 
-/* Return a UNIX errno from a NT status code */
-static const struct {
-	NTSTATUS status;
-	int error;
-} nt_errno_map[] = {
-        {NT_STATUS_ACCESS_VIOLATION, EACCES},
-        {NT_STATUS_INVALID_HANDLE, EBADF},
-        {NT_STATUS_ACCESS_DENIED, EACCES},
-        {NT_STATUS_OBJECT_NAME_NOT_FOUND, ENOENT},
-        {NT_STATUS_OBJECT_PATH_NOT_FOUND, ENOENT},
-        {NT_STATUS_SHARING_VIOLATION, EBUSY},
-        {NT_STATUS_OBJECT_PATH_INVALID, ENOTDIR},
-        {NT_STATUS_OBJECT_NAME_COLLISION, EEXIST},
-        {NT_STATUS_PATH_NOT_COVERED, ENOENT},
-	{NT_STATUS_UNSUCCESSFUL, EINVAL},
-	{NT_STATUS_NOT_IMPLEMENTED, ENOSYS},
-	{NT_STATUS_IN_PAGE_ERROR, EFAULT}, 
-	{NT_STATUS_BAD_NETWORK_NAME, ENOENT},
-#ifdef EDQUOT
-	{NT_STATUS_PAGEFILE_QUOTA, EDQUOT},
-	{NT_STATUS_QUOTA_EXCEEDED, EDQUOT},
-	{NT_STATUS_REGISTRY_QUOTA_LIMIT, EDQUOT},
-	{NT_STATUS_LICENSE_QUOTA_EXCEEDED, EDQUOT},
-#endif
-#ifdef ETIME
-	{NT_STATUS_TIMER_NOT_CANCELED, ETIME},
-#endif
-	{NT_STATUS_INVALID_PARAMETER, EINVAL},
-	{NT_STATUS_NO_SUCH_DEVICE, ENODEV},
-	{NT_STATUS_NO_SUCH_FILE, ENOENT},
-#ifdef ENODATA
-	{NT_STATUS_END_OF_FILE, ENODATA}, 
-#endif
-#ifdef ENOMEDIUM
-	{NT_STATUS_NO_MEDIA_IN_DEVICE, ENOMEDIUM}, 
-	{NT_STATUS_NO_MEDIA, ENOMEDIUM},
-#endif
-	{NT_STATUS_NONEXISTENT_SECTOR, ESPIPE}, 
-        {NT_STATUS_NO_MEMORY, ENOMEM},
-	{NT_STATUS_CONFLICTING_ADDRESSES, EADDRINUSE},
-	{NT_STATUS_NOT_MAPPED_VIEW, EINVAL},
-	{NT_STATUS_UNABLE_TO_FREE_VM, EADDRINUSE},
-	{NT_STATUS_ACCESS_DENIED, EACCES}, 
-	{NT_STATUS_BUFFER_TOO_SMALL, ENOBUFS},
-	{NT_STATUS_WRONG_PASSWORD, EACCES},
-	{NT_STATUS_LOGON_FAILURE, EACCES},
-	{NT_STATUS_INVALID_WORKSTATION, EACCES},
-	{NT_STATUS_INVALID_LOGON_HOURS, EACCES},
-	{NT_STATUS_PASSWORD_EXPIRED, EACCES},
-	{NT_STATUS_ACCOUNT_DISABLED, EACCES},
-	{NT_STATUS_DISK_FULL, ENOSPC},
-	{NT_STATUS_INVALID_PIPE_STATE, EPIPE},
-	{NT_STATUS_PIPE_BUSY, EPIPE},
-	{NT_STATUS_PIPE_DISCONNECTED, EPIPE},
-	{NT_STATUS_PIPE_NOT_AVAILABLE, ENOSYS},
-	{NT_STATUS_FILE_IS_A_DIRECTORY, EISDIR},
-	{NT_STATUS_NOT_SUPPORTED, ENOSYS},
-	{NT_STATUS_NOT_A_DIRECTORY, ENOTDIR},
-	{NT_STATUS_DIRECTORY_NOT_EMPTY, ENOTEMPTY},
-	{NT_STATUS_NETWORK_UNREACHABLE, ENETUNREACH},
-	{NT_STATUS_HOST_UNREACHABLE, EHOSTUNREACH},
-	{NT_STATUS_CONNECTION_ABORTED, ECONNABORTED},
-	{NT_STATUS_CONNECTION_REFUSED, ECONNREFUSED},
-	{NT_STATUS_TOO_MANY_LINKS, EMLINK},
-	{NT_STATUS_NETWORK_BUSY, EBUSY},
-	{NT_STATUS_DEVICE_DOES_NOT_EXIST, ENODEV},
-#ifdef ELIBACC
-	{NT_STATUS_DLL_NOT_FOUND, ELIBACC},
-#endif
-	{NT_STATUS_PIPE_BROKEN, EPIPE},
-	{NT_STATUS_REMOTE_NOT_LISTENING, ECONNREFUSED},
-	{NT_STATUS_NETWORK_ACCESS_DENIED, EACCES},
-	{NT_STATUS_TOO_MANY_OPENED_FILES, EMFILE},
-#ifdef EPROTO
-	{NT_STATUS_DEVICE_PROTOCOL_ERROR, EPROTO},
-#endif
-	{NT_STATUS_FLOAT_OVERFLOW, ERANGE},
-	{NT_STATUS_FLOAT_UNDERFLOW, ERANGE},
-	{NT_STATUS_INTEGER_OVERFLOW, ERANGE},
-	{NT_STATUS_MEDIA_WRITE_PROTECTED, EROFS},
-	{NT_STATUS_PIPE_CONNECTED, EISCONN},
-	{NT_STATUS_MEMORY_NOT_ALLOCATED, EFAULT},
-	{NT_STATUS_FLOAT_INEXACT_RESULT, ERANGE},
-	{NT_STATUS_ILL_FORMED_PASSWORD, EACCES},
-	{NT_STATUS_PASSWORD_RESTRICTION, EACCES},
-	{NT_STATUS_ACCOUNT_RESTRICTION, EACCES},
-	{NT_STATUS_PORT_CONNECTION_REFUSED, ECONNREFUSED},
-	{NT_STATUS_NAME_TOO_LONG, ENAMETOOLONG},
-	{NT_STATUS_REMOTE_DISCONNECT, ESHUTDOWN},
-	{NT_STATUS_CONNECTION_DISCONNECTED, ECONNABORTED},
-	{NT_STATUS_CONNECTION_RESET, ENETRESET},
-#ifdef ENOTUNIQ
-	{NT_STATUS_IP_ADDRESS_CONFLICT1, ENOTUNIQ},
-	{NT_STATUS_IP_ADDRESS_CONFLICT2, ENOTUNIQ},
-#endif
-	{NT_STATUS_PORT_MESSAGE_TOO_LONG, EMSGSIZE},
-	{NT_STATUS_PROTOCOL_UNREACHABLE, ENOPROTOOPT},
-	{NT_STATUS_ADDRESS_ALREADY_EXISTS, EADDRINUSE},
-	{NT_STATUS_PORT_UNREACHABLE, EHOSTUNREACH},
-	{NT_STATUS_IO_TIMEOUT, ETIMEDOUT},
-	{NT_STATUS_RETRY, EAGAIN},
-#ifdef ENOTUNIQ
-	{NT_STATUS_DUPLICATE_NAME, ENOTUNIQ},
-#endif
-#ifdef ECOMM
-	{NT_STATUS_NET_WRITE_FAULT, ECOMM},
-#endif
-#ifdef EXDEV
-	{NT_STATUS_NOT_SAME_DEVICE, EXDEV},
-#endif
-	{NT_STATUS(0), 0}
-};
-
-/****************************************************************************
- The following mappings need tidying up and moving into libsmb/errormap.c...
-****************************************************************************/
-
-static int cli_errno_from_nt(NTSTATUS status)
-{
-	int i;
-        DEBUG(10,("cli_errno_from_nt: 32 bit codes: code=%08x\n", NT_STATUS_V(status)));
-
-        /* Status codes without this bit set are not errors */
-
-        if (!(NT_STATUS_V(status) & 0xc0000000)) {
-                return 0;
-	}
-
-	for (i=0;nt_errno_map[i].error;i++) {
-		if (NT_STATUS_V(nt_errno_map[i].status) ==
-		    NT_STATUS_V(status)) return nt_errno_map[i].error;
-	}
-
-        /* for all other cases - a default code */
-        return EINVAL;
-}
 
 /* Return a UNIX errno appropriate for the error received in the last
    packet. */
@@ -382,7 +246,7 @@ int cli_errno(struct cli_state *cli)
 
 	if (cli_is_nt_error(cli)) {
 		status = cli_nt_error(cli);
-		return cli_errno_from_nt(status);
+		return map_errno_from_nt_status(status);
 	}
 
         if (cli_is_dos_error(cli)) {
@@ -391,7 +255,7 @@ int cli_errno(struct cli_state *cli)
 
                 cli_dos_error(cli, &eclass, &ecode);
 		status = dos_to_ntstatus(eclass, ecode);
-		return cli_errno_from_nt(status);
+		return map_errno_from_nt_status(status);
         }
 
         /*
diff --git a/source3/libsmb/cliquota.c b/source3/libsmb/cliquota.c
index f369d28dff..dcdfec241d 100644
--- a/source3/libsmb/cliquota.c
+++ b/source3/libsmb/cliquota.c
@@ -2,17 +2,17 @@
    Unix SMB/CIFS implementation.
    client quota functions
    Copyright (C) Stefan (metze) Metzmacher	2003
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
@@ -25,7 +25,7 @@ bool cli_get_quota_handle(struct cli_state *cli, int *quota_fnum)
 		 0x00000016, DESIRED_ACCESS_PIPE,
 		 0x00000000, FILE_SHARE_READ|FILE_SHARE_WRITE,
 		 FILE_OPEN, 0x00000000, 0x03);
-		 
+
 	if (*quota_fnum == (-1)) {
 		return False;
 	}
@@ -37,7 +37,7 @@ void free_ntquota_list(SMB_NTQUOTA_LIST **qt_list)
 {
 	if (!qt_list)
 		return;
-		
+
 	if ((*qt_list)->mem_ctx)
 		talloc_destroy((*qt_list)->mem_ctx);
 
@@ -60,7 +60,7 @@ static bool parse_user_quota_record(const char *rdata, unsigned int rdata_count,
 	if (rdata_count < 40) {
 		return False;
 	}
-		
+
 	/* offset to next quota record.
 	 * 4 bytes IVAL(rdata,0)
 	 * unused here...
@@ -116,7 +116,7 @@ static bool parse_user_quota_record(const char *rdata, unsigned int rdata_count,
 		return False;
 	}
 #endif /* LARGE_SMB_OFF_T */
-	
+
 	sid_parse(rdata+40,sid_len,&qt.sid);
 
 	qt.qtype = SMB_USER_QUOTA_TYPE;
@@ -149,13 +149,13 @@ bool cli_get_user_quota(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_STRUC
 	SIVAL(params, 4,0x00000024);
 	SIVAL(params, 8,0x00000000);
 	SIVAL(params,12,0x00000024);
-	
+
 	sid_len = ndr_size_dom_sid(&pqt->sid, 0);
 	data_len = sid_len+8;
 	SIVAL(data, 0, 0x00000000);
 	SIVAL(data, 4, sid_len);
 	sid_linearize(data+8, sid_len, &pqt->sid);
-	
+
 	if (!cli_send_nt_trans(cli, 
 			       NT_TRANSACT_GET_USER_QUOTA, 
 			       0, 
@@ -204,7 +204,7 @@ bool cli_set_user_quota(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_STRUC
 	unsigned int rparam_count=0, rdata_count=0;
 	unsigned int sid_len;	
 	memset(data,'\0',112);
-	
+
 	if (!cli||!pqt) {
 		smb_panic("cli_set_user_quota() called with NULL Pointer!");
 	}
@@ -221,7 +221,7 @@ bool cli_set_user_quota(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_STRUC
 	SBIG_UINT(data,24,pqt->softlim);
 	SBIG_UINT(data,32,pqt->hardlim);
 	sid_linearize(data+40, sid_len, &pqt->sid);
-	
+
 	if (!cli_send_nt_trans(cli, 
 			       NT_TRANSACT_SET_USER_QUOTA, 
 			       0, 
@@ -278,7 +278,7 @@ bool cli_list_user_quota(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_LIST
 	SIVAL(params, 4,0x00000000);
 	SIVAL(params, 8,0x00000000);
 	SIVAL(params,12,0x00000000);
-	
+
 	if (!cli_send_nt_trans(cli, 
 			       NT_TRANSACT_GET_USER_QUOTA, 
 			       0, 
@@ -353,7 +353,7 @@ bool cli_list_user_quota(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_LIST
 			DEBUG(1,("Failed to send NT_TRANSACT_GET_USER_QUOTA\n"));
 			goto cleanup;
 		}
-		
+
 		SAFE_FREE(rparam);
 		SAFE_FREE(rdata);
 		if (!cli_receive_nt_trans(cli,
@@ -369,7 +369,7 @@ bool cli_list_user_quota(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_LIST
 		} else {
 			ret = True;
 		}
-	
+
 		if (rdata_count == 0) {
 			break;	
 		}
@@ -389,26 +389,26 @@ bool cli_list_user_quota(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_LIST
 				talloc_destroy(mem_ctx);
 				goto cleanup;
 			}
-	
+
 			if ((tmp_list_ent->quotas=TALLOC_ZERO_P(mem_ctx,SMB_NTQUOTA_STRUCT))==NULL) {
 				DEBUG(0,("TALLOC_ZERO() failed\n"));
 				talloc_destroy(mem_ctx);
 				goto cleanup;
 			}
-	
+
 			memcpy(tmp_list_ent->quotas,&qt,sizeof(qt));
 			tmp_list_ent->mem_ctx = mem_ctx;		
-	
+
 			DLIST_ADD((*pqt_list),tmp_list_ent);
 		}
 	}
 
- 
+
 	ret = True;
  cleanup:
 	SAFE_FREE(rparam);
 	SAFE_FREE(rdata);
- 
+
 	return ret;
 }
 
@@ -427,9 +427,9 @@ bool cli_get_fs_quota_info(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_ST
 	}
 
 	setup = TRANSACT2_QFSINFO;
-	
+
 	SSVAL(param,0,SMB_FS_QUOTA_INFORMATION);
-	
+
 	if (!cli_send_trans(cli, SMBtrans2, 
 		    NULL, 
 		    0, 0,
@@ -438,7 +438,7 @@ bool cli_get_fs_quota_info(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_ST
 		    NULL, 0, 560)) {
 		goto cleanup;
 	}
-	
+
 	if (!cli_receive_trans(cli, SMBtrans2,
                               &rparam, &rparam_count,
                               &rdata, &rdata_count)) {
@@ -455,7 +455,7 @@ bool cli_get_fs_quota_info(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_ST
 	if (rdata_count < 48) {
 		goto cleanup;
 	}
-	
+
 	/* unknown_1 24 NULL bytes in pdata*/
 
 	/* the soft quotas 8 bytes (SMB_BIG_UINT)*/
@@ -541,7 +541,7 @@ bool cli_set_fs_quota_info(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_ST
 		    data, 48, 0)) {
 		goto cleanup;
 	}
-	
+
 	if (!cli_receive_trans(cli, SMBtrans2,
                               &rparam, &rparam_count,
                               &rdata, &rdata_count)) {
@@ -604,7 +604,7 @@ void dump_ntquota(SMB_NTQUOTA_STRUCT *qt, bool _verbose, bool _numeric, void (*_
 		case SMB_USER_QUOTA_TYPE:
 			{
 				fstring username_str = {0};
-				
+
 				if (_sidtostring) {
 					_sidtostring(username_str,&qt->sid,_numeric);
 				} else {
diff --git a/source3/libsmb/dsgetdcname.c b/source3/libsmb/dsgetdcname.c
index a543e073bc..08ab8cad14 100644
--- a/source3/libsmb/dsgetdcname.c
+++ b/source3/libsmb/dsgetdcname.c
@@ -35,7 +35,7 @@ struct ip_service_name {
 static NTSTATUS make_dc_info_from_cldap_reply(TALLOC_CTX *mem_ctx,
 					      uint32_t flags,
 					      struct sockaddr_storage *ss,
-					      struct netlogon_samlogon_response *r,
+					      struct NETLOGON_SAM_LOGON_RESPONSE_EX *r,
 					      struct netr_DsRGetDCNameInfo **info);
 
 /****************************************************************
@@ -200,7 +200,7 @@ static NTSTATUS store_cldap_reply(TALLOC_CTX *mem_ctx,
 
 	/* FIXME */
 	r->sockaddr_size = 0x10; /* the w32 winsock addr size */
-	r->sockaddr.sa_family = 2; /* AF_INET */
+	r->sockaddr.sockaddr_family = 2; /* AF_INET */
 	r->sockaddr.pdc_ip = talloc_strdup(mem_ctx, addr);
 
 	ndr_err = ndr_push_struct_blob(&blob, mem_ctx, NULL, r,
@@ -228,6 +228,8 @@ static NTSTATUS store_cldap_reply(TALLOC_CTX *mem_ctx,
 		}
 	}
 
+	status = NT_STATUS_OK;
+
  done:
 	data_blob_free(&blob);
 
@@ -272,12 +274,12 @@ static uint32_t get_cldap_reply_server_flags(struct netlogon_samlogon_response *
 		case 3:
 		case 18:
 		case 19:
-			return r->nt5.server_type;
+			return r->data.nt5.server_type;
 		case 4:
 		case 5:
 		case 6:
 		case 7:
-			return r->nt5_ex.server_type;
+			return r->data.nt5_ex.server_type;
 		case 8:
 		case 9:
 		case 10:
@@ -286,7 +288,7 @@ static uint32_t get_cldap_reply_server_flags(struct netlogon_samlogon_response *
 		case 13:
 		case 14:
 		case 15:
-			return r->nt5_ex.server_type;
+			return r->data.nt5_ex.server_type;
 		case 20:
 		case 21:
 		case 22:
@@ -296,11 +298,11 @@ static uint32_t get_cldap_reply_server_flags(struct netlogon_samlogon_response *
 		case 26:
 		case 27:
 		case 28:
-			return r->nt5_ex.server_type;
+			return r->data.nt5_ex.server_type;
 		case 29:
 		case 30:
 		case 31:
-			return r->nt5_ex.server_type;
+			return r->data.nt5_ex.server_type;
 		default:
 			return 0;
 	}
@@ -358,7 +360,6 @@ static NTSTATUS dsgetdcname_cache_fetch(TALLOC_CTX *mem_ctx,
 	DATA_BLOB blob;
 	enum ndr_err_code ndr_err;
 	struct netr_DsRGetDCNameInfo *info;
-	struct netlogon_samlogon_response p;
 	struct NETLOGON_SAM_LOGON_RESPONSE_EX r;
 	NTSTATUS status;
 
@@ -389,10 +390,8 @@ static NTSTATUS dsgetdcname_cache_fetch(TALLOC_CTX *mem_ctx,
 		return ndr_map_error2ntstatus(ndr_err);
 	}
 
-	p.nt5_ex = r;
-
 	status = make_dc_info_from_cldap_reply(mem_ctx, flags, NULL,
-					       &p, &info);
+					       &r, &info);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -787,7 +786,7 @@ static void map_dc_and_domain_names(uint32_t flags,
 static NTSTATUS make_dc_info_from_cldap_reply(TALLOC_CTX *mem_ctx,
 					      uint32_t flags,
 					      struct sockaddr_storage *ss,
-					      struct netlogon_samlogon_response *r,
+					      struct NETLOGON_SAM_LOGON_RESPONSE_EX *r,
 					      struct netr_DsRGetDCNameInfo **info)
 {
 	const char *dc_hostname = NULL;
@@ -808,163 +807,28 @@ static NTSTATUS make_dc_info_from_cldap_reply(TALLOC_CTX *mem_ctx,
 		dc_address_type = DS_ADDRESS_TYPE_INET;
 	}
 
-	switch (r->ntver & 0x0000001f) {
-		case 0:
-		case 1:
-		case 16:
-		case 17:
-			if (!ss) {
-				dc_address	= r->nt4.server;
-				dc_address_type	= DS_ADDRESS_TYPE_NETBIOS;
-			}
-
-			map_dc_and_domain_names(flags,
-						r->nt4.server,
-						r->nt4.domain,
-						NULL,
-						NULL,
-						&dc_flags,
-						&dc_hostname,
-						&dc_domain_name);
-
-			if (flags & DS_PDC_REQUIRED) {
-				dc_flags = NBT_SERVER_WRITABLE | NBT_SERVER_PDC;
-			}
-			break;
-		case 2:
-		case 3:
-		case 18:
-		case 19:
-			if (!ss) {
-				dc_address	= r->nt5.pdc_ip;
-				dc_address_type	= DS_ADDRESS_TYPE_INET;
-			}
-
-			map_dc_and_domain_names(flags,
-						r->nt5.pdc_name,
-						r->nt5.domain_name,
-						r->nt5.pdc_dns_name,
-						r->nt5.dns_domain,
-						&dc_flags,
-						&dc_hostname,
-						&dc_domain_name);
-
-			dc_flags	|= r->nt5.server_type;
-			dc_forest	= r->nt5.forest;
-			dc_domain_guid	= &r->nt5.domain_uuid;
-
-			break;
-		case 4:
-		case 5:
-		case 6:
-		case 7:
-			if (!ss) {
-				dc_address	= r->nt5_ex.pdc_name;
-				dc_address_type	= DS_ADDRESS_TYPE_NETBIOS;
-			}
-
-			map_dc_and_domain_names(flags,
-						r->nt5_ex.pdc_name,
-						r->nt5_ex.domain,
-						r->nt5_ex.pdc_dns_name,
-						r->nt5_ex.dns_domain,
-						&dc_flags,
-						&dc_hostname,
-						&dc_domain_name);
-
-			dc_flags	|= r->nt5_ex.server_type;
-			dc_forest	= r->nt5_ex.forest;
-			dc_domain_guid	= &r->nt5_ex.domain_uuid;
-			dc_server_site	= r->nt5_ex.server_site;
-			dc_client_site	= r->nt5_ex.client_site;
-
-			break;
-		case 8:
-		case 9:
-		case 10:
-		case 11:
-		case 12:
-		case 13:
-		case 14:
-		case 15:
-			if (!ss) {
-				dc_address	= r->nt5_ex.sockaddr.pdc_ip;
-				dc_address_type	= DS_ADDRESS_TYPE_INET;
-			}
-
-			map_dc_and_domain_names(flags,
-						r->nt5_ex.pdc_name,
-						r->nt5_ex.domain,
-						r->nt5_ex.pdc_dns_name,
-						r->nt5_ex.dns_domain,
-						&dc_flags,
-						&dc_hostname,
-						&dc_domain_name);
-
-			dc_flags	|= r->nt5_ex.server_type;
-			dc_forest	= r->nt5_ex.forest;
-			dc_domain_guid	= &r->nt5_ex.domain_uuid;
-			dc_server_site	= r->nt5_ex.server_site;
-			dc_client_site	= r->nt5_ex.client_site;
-
-			break;
-		case 20:
-		case 21:
-		case 22:
-		case 23:
-		case 24:
-		case 25:
-		case 26:
-		case 27:
-		case 28:
-			if (!ss) {
-				dc_address	= r->nt5_ex.pdc_name;
-				dc_address_type	= DS_ADDRESS_TYPE_NETBIOS;
-			}
+	if (!ss && r->sockaddr.pdc_ip) {
+		dc_address	= r->sockaddr.pdc_ip;
+		dc_address_type	= DS_ADDRESS_TYPE_INET;
+	} else {
+		dc_address      = r->pdc_name;
+		dc_address_type = DS_ADDRESS_TYPE_NETBIOS;
+	}
 
-			map_dc_and_domain_names(flags,
-						r->nt5_ex.pdc_name,
-						r->nt5_ex.domain,
-						r->nt5_ex.pdc_dns_name,
-						r->nt5_ex.dns_domain,
-						&dc_flags,
-						&dc_hostname,
-						&dc_domain_name);
-
-			dc_flags	|= r->nt5_ex.server_type;
-			dc_forest	= r->nt5_ex.forest;
-			dc_domain_guid	= &r->nt5_ex.domain_uuid;
-			dc_server_site	= r->nt5_ex.server_site;
-			dc_client_site	= r->nt5_ex.client_site;
-
-			break;
-		case 29:
-		case 30:
-		case 31:
-			if (!ss) {
-				dc_address	= r->nt5_ex.sockaddr.pdc_ip;
-				dc_address_type	= DS_ADDRESS_TYPE_INET;
-			}
+	map_dc_and_domain_names(flags,
+				r->pdc_name,
+				r->domain,
+				r->pdc_dns_name,
+				r->dns_domain,
+				&dc_flags,
+				&dc_hostname,
+				&dc_domain_name);
 
-			map_dc_and_domain_names(flags,
-						r->nt5_ex.pdc_name,
-						r->nt5_ex.domain,
-						r->nt5_ex.pdc_dns_name,
-						r->nt5_ex.dns_domain,
-						&dc_flags,
-						&dc_hostname,
-						&dc_domain_name);
-
-			dc_flags	|= r->nt5_ex.server_type;
-			dc_forest	= r->nt5_ex.forest;
-			dc_domain_guid	= &r->nt5_ex.domain_uuid;
-			dc_server_site	= r->nt5_ex.server_site;
-			dc_client_site	= r->nt5_ex.client_site;
-
-			break;
-		default:
-			return NT_STATUS_INVALID_PARAMETER;
-	}
+	dc_flags	|= r->server_type;
+	dc_forest	= r->forest;
+	dc_domain_guid	= &r->domain_uuid;
+	dc_server_site	= r->server_site;
+	dc_client_site	= r->client_site;
 
 	return make_domain_controller_info(mem_ctx,
 					   dc_hostname,
@@ -1051,10 +915,10 @@ static NTSTATUS process_dc_dns(TALLOC_CTX *mem_ctx,
 	}
 
 	status = make_dc_info_from_cldap_reply(mem_ctx, flags, &dclist[i].ss,
-					       r, info);
+					       &r->data.nt5_ex, info);
 	if (NT_STATUS_IS_OK(status)) {
 		return store_cldap_reply(mem_ctx, flags, &dclist[i].ss,
-					 nt_version, &r->nt5_ex);
+					 nt_version, &r->data.nt5_ex);
 	}
 
 	return status;
@@ -1173,7 +1037,7 @@ static NTSTATUS process_dc_netbios(TALLOC_CTX *mem_ctx,
 			logon1.domain = talloc_strdup_upper(mem_ctx, domain_name);
 			NT_STATUS_HAVE_NO_MEMORY(logon1.domain);
 
-			r->nt4 = logon1;
+			r->data.nt4 = logon1;
 			r->ntver = nt_version;
 
 			namecache_store(tmp_dc_name, NBT_NAME_SERVER, 1, &ip_list);
@@ -1187,10 +1051,10 @@ static NTSTATUS process_dc_netbios(TALLOC_CTX *mem_ctx,
  make_reply:
 
 	status = make_dc_info_from_cldap_reply(mem_ctx, flags, &dclist[i].ss,
-					       r, info);
+					       &r->data.nt5_ex, info);
 	if (NT_STATUS_IS_OK(status) && store_cache) {
 		return store_cldap_reply(mem_ctx, flags, &dclist[i].ss,
-					 nt_version, &r->nt5_ex);
+					 nt_version, &r->data.nt5_ex);
 	}
 
 	return status;
diff --git a/source3/libsmb/libsmb_xattr.c b/source3/libsmb/libsmb_xattr.c
index f1b3d1415e..ea2c46953c 100644
--- a/source3/libsmb/libsmb_xattr.c
+++ b/source3/libsmb/libsmb_xattr.c
@@ -266,7 +266,7 @@ parse_ace(struct cli_state *ipc_cli,
         unsigned int aflags;
         unsigned int amask;
 	DOM_SID sid;
-	SEC_ACCESS mask;
+	uint32_t mask;
 	const struct perm_value *v;
         struct perm_value {
                 const char *perm;
diff --git a/source3/m4/check_path.m4 b/source3/m4/check_path.m4
index 7aa8c213e0..40a97d3674 100644
--- a/source3/m4/check_path.m4
+++ b/source3/m4/check_path.m4
@@ -18,6 +18,7 @@ AC_PREFIX_DEFAULT(/usr/local/samba)
 rootsbindir="\${SBINDIR}"
 lockdir="\${VARDIR}/locks"
 piddir="\${VARDIR}/locks"
+ncalrpcdir="\${VARDIR}/ncalrpc"
 test "${mandir}" || mandir="\${prefix}/man"
 logfilebase="\${VARDIR}"
 privatedir="\${prefix}/private"
@@ -46,6 +47,7 @@ AC_ARG_WITH(fhs,
     codepagedir="\${MODULESDIR}"
     statedir="\${VARDIR}/lib/samba"
     cachedir="\${VARDIR}/lib/samba"
+    ncalrpcdir="\${VARDIR}/ncalrpc"
     AC_DEFINE(FHS_COMPATIBLE, 1, [Whether to use fully FHS-compatible paths])
     ;;
   esac])
@@ -115,6 +117,22 @@ AC_ARG_WITH(piddir,
   esac])
 
 #################################################
+# set ncalrpc directory location
+AC_ARG_WITH(ncalprcdir,
+[AS_HELP_STRING([--with-ncalprcdir=DIR], [Where to put ncalrpc sockets ($ac_default_prefix/var/ncalrpc)])],
+[ case "$withval" in
+  yes|no)
+  #
+  # Just in case anybody calls it without argument
+  #
+    AC_MSG_WARN([--with-ncalrpcdir called without argument - will use default])
+  ;;
+  * )
+    ncalrpcdir="$withval"
+    ;;
+  esac])
+
+#################################################
 # set SWAT directory location
 AC_ARG_WITH(swatdir,
 [AS_HELP_STRING([--with-swatdir=DIR], [Where to put SWAT files ($ac_default_prefix/swat)])],
@@ -227,6 +245,7 @@ AC_ARG_WITH(mandir,
 AC_SUBST(configdir)
 AC_SUBST(lockdir)
 AC_SUBST(piddir)
+AC_SUBST(ncalrpcdir)
 AC_SUBST(logfilebase)
 AC_SUBST(ctdbdir)
 AC_SUBST(privatedir)
diff --git a/source3/modules/nfs4_acls.c b/source3/modules/nfs4_acls.c
index 9e28db8b39..f411176590 100644
--- a/source3/modules/nfs4_acls.c
+++ b/source3/modules/nfs4_acls.c
@@ -44,10 +44,6 @@ typedef struct _SMB_ACL4_INT_T
 	SMB_ACE4_INT_T	*last;
 } SMB_ACL4_INT_T;
 
-extern int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_t gid);
-extern NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp,
-	uint32 security_info_sent, SEC_DESC *psd);
-
 static SMB_ACL4_INT_T *get_validated_aclint(SMB4ACL_T *acl)
 {
 	SMB_ACL4_INT_T *aclint = (SMB_ACL4_INT_T *)acl;
@@ -225,7 +221,7 @@ static bool smbacl4_nfs42win(TALLOC_CTX *mem_ctx, SMB4ACL_T *acl, /* in */
 	}
 
 	for (aceint=aclint->first; aceint!=NULL; aceint=(SMB_ACE4_INT_T *)aceint->next) {
-		SEC_ACCESS mask;
+		uint32_t mask;
 		DOM_SID sid;
 		SMB_ACE4PROP_T	*ace = &aceint->prop;
 
@@ -260,7 +256,7 @@ static bool smbacl4_nfs42win(TALLOC_CTX *mem_ctx, SMB4ACL_T *acl, /* in */
 		DEBUG(10, ("mapped %d to %s\n", ace->who.id,
 			   sid_string_dbg(&sid)));
 
-		init_sec_access(&mask, ace->aceMask);
+		mask = ace->aceMask;
 		init_sec_ace(&nt_ace_list[good_aces++], &sid,
 			ace->aceType, mask,
 			ace->aceFlags & 0xf);
@@ -518,7 +514,7 @@ static bool smbacl4_fill_ace4(
 	smbacl4_vfs_params *params,
 	uid_t ownerUID,
 	gid_t ownerGID,
-	SEC_ACE *ace_nt, /* input */
+	const SEC_ACE *ace_nt, /* input */
 	SMB_ACE4PROP_T *ace_v4 /* output */
 )
 {
@@ -650,7 +646,7 @@ static int smbacl4_MergeIgnoreReject(
 
 static SMB4ACL_T *smbacl4_win2nfs4(
 	const char *filename,
-	SEC_ACL *dacl,
+	const SEC_ACL *dacl,
 	smbacl4_vfs_params *pparams,
 	uid_t ownerUID,
 	gid_t ownerGID
@@ -694,7 +690,7 @@ static SMB4ACL_T *smbacl4_win2nfs4(
 
 NTSTATUS smb_set_nt_acl_nfs4(files_struct *fsp,
 	uint32 security_info_sent,
-	SEC_DESC *psd,
+	const SEC_DESC *psd,
 	set_nfs4acl_native_fn_t set_nfs4_native)
 {
 	smbacl4_vfs_params params;
diff --git a/source3/modules/vfs_acl_xattr.c b/source3/modules/vfs_acl_xattr.c
index a2f3477b76..241751c6a6 100644
--- a/source3/modules/vfs_acl_xattr.c
+++ b/source3/modules/vfs_acl_xattr.c
@@ -89,7 +89,7 @@ static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
 	uint8_t *val = NULL;
 	uint8_t *tmp;
 	ssize_t sizeret;
-	int saved_errno;
+	int saved_errno = 0;
 
 	ZERO_STRUCTP(pblob);
 
@@ -133,26 +133,6 @@ static NTSTATUS get_acl_blob(TALLOC_CTX *ctx,
 	return NT_STATUS_OK;
 }
 
-static int mkdir_acl_xattr(vfs_handle_struct *handle,  const char *path, mode_t mode)
-{
-	return SMB_VFS_NEXT_MKDIR(handle, path, mode);
-}
-
-static int rmdir_acl_xattr(vfs_handle_struct *handle,  const char *path)
-{
-	return SMB_VFS_NEXT_RMDIR(handle, path);
-}
-
-static int open_acl_xattr(vfs_handle_struct *handle,  const char *fname, files_struct *fsp, int flags, mode_t mode)
-{
-	return SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
-}
-
-static int unlink_acl_xattr(vfs_handle_struct *handle,  const char *fname)
-{
-	return SMB_VFS_NEXT_UNLINK(handle, fname);
-}
-
 static NTSTATUS get_nt_acl_xattr_internal(vfs_handle_struct *handle,
 					files_struct *fsp,
 					const char *name,
@@ -198,6 +178,42 @@ static NTSTATUS get_nt_acl_xattr_internal(vfs_handle_struct *handle,
 	return status;
 }
 
+static int mkdir_acl_xattr(vfs_handle_struct *handle,  const char *path, mode_t mode)
+{
+	return SMB_VFS_NEXT_MKDIR(handle, path, mode);
+}
+
+/*********************************************************************
+ * Currently this only works for existing files. Need to work on
+ * inheritance for new files.
+*********************************************************************/
+
+static int open_acl_xattr(vfs_handle_struct *handle,  const char *fname, files_struct *fsp, int flags, mode_t mode)
+{
+	uint32_t access_granted = 0;
+	SEC_DESC *pdesc = NULL;
+	NTSTATUS status = get_nt_acl_xattr_internal(handle,
+					NULL,
+					fname,
+					(OWNER_SECURITY_INFORMATION |
+					 GROUP_SECURITY_INFORMATION |
+					 DACL_SECURITY_INFORMATION),
+					&pdesc);
+        if (NT_STATUS_IS_OK(status)) {
+		/* See if we can access it. */
+		if (!se_access_check(pdesc,
+					handle->conn->server_info->ptok,
+					fsp->access_mask,
+					&access_granted,
+					&status)) {
+			errno = map_errno_from_nt_status(status);
+			return -1;
+		}
+        }
+
+	return SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
+}
+
 static NTSTATUS fget_nt_acl_xattr(vfs_handle_struct *handle, files_struct *fsp,
         uint32 security_info, SEC_DESC **ppdesc)
 {
@@ -222,7 +238,7 @@ static NTSTATUS get_nt_acl_xattr(vfs_handle_struct *handle,
 			security_info, ppdesc);
 }
 
-static NTSTATUS create_acl_blob(SEC_DESC *psd, DATA_BLOB *pblob)
+static NTSTATUS create_acl_blob(const SEC_DESC *psd, DATA_BLOB *pblob)
 {
 	struct xattr_NTACL xacl;
 	struct security_descriptor_timestamp sd_ts;
@@ -241,7 +257,7 @@ static NTSTATUS create_acl_blob(SEC_DESC *psd, DATA_BLOB *pblob)
 
 	xacl.version = 2;
 	xacl.info.sd_ts = &sd_ts;
-	xacl.info.sd_ts->sd = psd;
+	xacl.info.sd_ts->sd = CONST_DISCARD(SEC_DESC *, psd);
 	unix_timespec_to_nt_time(&xacl.info.sd_ts->last_changed, curr);
 
 	ndr_err = ndr_push_struct_blob(
@@ -261,7 +277,7 @@ static NTSTATUS store_acl_blob(files_struct *fsp,
 				DATA_BLOB *pblob)
 {
 	int ret;
-	int saved_errno;
+	int saved_errno = 0;
 
 	DEBUG(10,("store_acl_blob: storing blob length %u on file %s\n",
 			(unsigned int)pblob->length, fsp->fsp_name));
@@ -291,7 +307,7 @@ static NTSTATUS store_acl_blob(files_struct *fsp,
 }
 
 static NTSTATUS fset_nt_acl_xattr(vfs_handle_struct *handle, files_struct *fsp,
-        uint32 security_info_sent, SEC_DESC *psd)
+        uint32 security_info_sent, const SEC_DESC *psd)
 {
 	NTSTATUS status;
 	DATA_BLOB blob;
@@ -301,6 +317,22 @@ static NTSTATUS fset_nt_acl_xattr(vfs_handle_struct *handle, files_struct *fsp,
 		return status;
 	}
 
+	if ((security_info_sent & DACL_SECURITY_INFORMATION) &&
+			psd->dacl != NULL &&
+			(psd->type & (SE_DESC_DACL_AUTO_INHERITED|
+				SE_DESC_DACL_AUTO_INHERIT_REQ))==
+				(SE_DESC_DACL_AUTO_INHERITED|
+				SE_DESC_DACL_AUTO_INHERIT_REQ) ) {
+		SEC_DESC *new_psd = NULL;
+		status = append_parent_acl(fsp, psd, &new_psd);
+		if (!NT_STATUS_IS_OK(status)) {
+			/* Lower level acl set succeeded,
+			 * so still return OK. */
+			return NT_STATUS_OK;
+		}
+		psd = new_psd;
+	}
+
 	create_acl_blob(psd, &blob);
 	store_acl_blob(fsp, &blob);
 
@@ -312,9 +344,7 @@ static NTSTATUS fset_nt_acl_xattr(vfs_handle_struct *handle, files_struct *fsp,
 static vfs_op_tuple skel_op_tuples[] =
 {
 	{SMB_VFS_OP(mkdir_acl_xattr), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_TRANSPARENT},
-	{SMB_VFS_OP(rmdir_acl_xattr), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_TRANSPARENT},
 	{SMB_VFS_OP(open_acl_xattr),  SMB_VFS_OP_OPEN,  SMB_VFS_LAYER_TRANSPARENT},
-	{SMB_VFS_OP(unlink_acl_xattr),SMB_VFS_OP_UNLINK,SMB_VFS_LAYER_TRANSPARENT},
 
         /* NT File ACL operations */
 
diff --git a/source3/modules/vfs_afsacl.c b/source3/modules/vfs_afsacl.c
index 9409f3fa20..8c89d2fd9f 100644
--- a/source3/modules/vfs_afsacl.c
+++ b/source3/modules/vfs_afsacl.c
@@ -592,7 +592,6 @@ static size_t afs_to_nt_acl_common(struct afs_acl *afs_acl,
 {
 	SEC_ACE *nt_ace_list;
 	DOM_SID owner_sid, group_sid;
-	SEC_ACCESS mask;
 	SEC_ACL *psa = NULL;
 	int good_aces;
 	size_t sd_size;
@@ -616,7 +615,7 @@ static size_t afs_to_nt_acl_common(struct afs_acl *afs_acl,
 	good_aces = 0;
 
 	while (afs_ace != NULL) {
-		uint32 nt_rights;
+		uint32_t nt_rights;
 		uint8 flag = SEC_ACE_FLAG_OBJECT_INHERIT |
 			SEC_ACE_FLAG_CONTAINER_INHERIT;
 
@@ -633,9 +632,8 @@ static size_t afs_to_nt_acl_common(struct afs_acl *afs_acl,
 		else
 			nt_rights = afs_to_nt_file_rights(afs_ace->rights);
 
-		init_sec_access(&mask, nt_rights);
 		init_sec_ace(&nt_ace_list[good_aces++], &(afs_ace->sid),
-			     SEC_ACE_TYPE_ACCESS_ALLOWED, mask, flag);
+			     SEC_ACE_TYPE_ACCESS_ALLOWED, nt_rights, flag);
 		afs_ace = afs_ace->next;
 	}
 
@@ -717,12 +715,12 @@ static bool mappable_sid(const DOM_SID *sid)
 
 static bool nt_to_afs_acl(const char *filename,
 			  uint32 security_info_sent,
-			  struct security_descriptor *psd,
+			  const struct security_descriptor *psd,
 			  uint32 (*nt_to_afs_rights)(const char *filename,
 						     const SEC_ACE *ace),
 			  struct afs_acl *afs_acl)
 {
-	SEC_ACL *dacl;
+	const SEC_ACL *dacl;
 	int i;
 
 	/* Currently we *only* look at the dacl */
@@ -737,7 +735,7 @@ static bool nt_to_afs_acl(const char *filename,
 	dacl = psd->dacl;
 
 	for (i = 0; i < dacl->num_aces; i++) {
-		SEC_ACE *ace = &(dacl->aces[i]);
+		const SEC_ACE *ace = &(dacl->aces[i]);
 		const char *dom_name, *name;
 		enum lsa_SidType name_type;
 		char *p;
@@ -887,7 +885,7 @@ static void merge_unknown_aces(struct afs_acl *src, struct afs_acl *dst)
 
 static NTSTATUS afs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 			   uint32 security_info_sent,
-			   struct security_descriptor *psd)
+			   const struct security_descriptor *psd)
 {
 	struct afs_acl old_afs_acl, new_afs_acl;
 	struct afs_acl dir_acl, file_acl;
@@ -1040,7 +1038,7 @@ static NTSTATUS afsacl_get_nt_acl(struct vfs_handle_struct *handle,
 NTSTATUS afsacl_fset_nt_acl(vfs_handle_struct *handle,
 			 files_struct *fsp,
 			 uint32 security_info_sent,
-			 SEC_DESC *psd)
+			 const SEC_DESC *psd)
 {
 	return afs_set_nt_acl(handle, fsp, security_info_sent, psd);
 }
diff --git a/source3/modules/vfs_aixacl2.c b/source3/modules/vfs_aixacl2.c
index 23c4d88134..a078b9f9f6 100644
--- a/source3/modules/vfs_aixacl2.c
+++ b/source3/modules/vfs_aixacl2.c
@@ -371,7 +371,7 @@ static bool aixjfs2_process_smbacl(files_struct *fsp, SMB4ACL_T *smbacl)
 	return True;
 }
 
-static NTSTATUS aixjfs2_set_nt_acl_common(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd)
+static NTSTATUS aixjfs2_set_nt_acl_common(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd)
 {
 	acl_type_t	acl_type_info;
 	NTSTATUS	result = NT_STATUS_ACCESS_DENIED;
@@ -395,7 +395,7 @@ static NTSTATUS aixjfs2_set_nt_acl_common(files_struct *fsp, uint32 security_inf
 	return result;
 }
 
-NTSTATUS aixjfs2_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd)
+NTSTATUS aixjfs2_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd)
 {
 	return aixjfs2_set_nt_acl_common(fsp, security_info_sent, psd);
 }
diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c
index 381aa18561..372cdf2d53 100644
--- a/source3/modules/vfs_default.c
+++ b/source3/modules/vfs_default.c
@@ -1036,7 +1036,7 @@ static NTSTATUS vfswrap_get_nt_acl(vfs_handle_struct *handle,
 	return result;
 }
 
-static NTSTATUS vfswrap_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd)
+static NTSTATUS vfswrap_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd)
 {
 	NTSTATUS result;
 
diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c
index 1224ec3edb..9fadcd9e0c 100644
--- a/source3/modules/vfs_full_audit.c
+++ b/source3/modules/vfs_full_audit.c
@@ -202,7 +202,7 @@ static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
 			       SEC_DESC **ppdesc);
 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 			      uint32 security_info_sent,
-			      SEC_DESC *psd);
+			      const SEC_DESC *psd);
 static int smb_full_audit_chmod_acl(vfs_handle_struct *handle,
 			   const char *path, mode_t mode);
 static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp,
@@ -1582,7 +1582,7 @@ static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
 
 static NTSTATUS smb_full_audit_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 			      uint32 security_info_sent,
-			      SEC_DESC *psd)
+			      const SEC_DESC *psd)
 {
 	NTSTATUS result;
 
diff --git a/source3/modules/vfs_gpfs.c b/source3/modules/vfs_gpfs.c
index 39d2bb6c38..fa0b4e97a5 100644
--- a/source3/modules/vfs_gpfs.c
+++ b/source3/modules/vfs_gpfs.c
@@ -179,7 +179,7 @@ static int gpfs_get_nfs4_acl(const char *fname, SMB4ACL_T **ppacl)
 			   "who: %d\n", gace->aceType, gace->aceIFlags,
 			   gace->aceFlags, gace->aceMask, gace->aceWho));
 
-		memset(&smbace, 0, sizeof(SMB4ACE_T));
+		ZERO_STRUCT(smbace);
 		if (gace->aceIFlags & ACE4_IFLAG_SPECIAL_ID) {
 			smbace.flags |= SMB_ACE4_ID_SPECIAL;
 			switch (gace->aceWho) {
@@ -365,7 +365,7 @@ static bool gpfsacl_process_smbacl(files_struct *fsp, SMB4ACL_T *smbacl)
 	return True;
 }
 
-static NTSTATUS gpfsacl_set_nt_acl_internal(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd)
+static NTSTATUS gpfsacl_set_nt_acl_internal(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd)
 {
 	struct gpfs_acl *acl;
 	NTSTATUS result = NT_STATUS_ACCESS_DENIED;
@@ -386,7 +386,7 @@ static NTSTATUS gpfsacl_set_nt_acl_internal(files_struct *fsp, uint32 security_i
 	return result;
 }
 
-static NTSTATUS gpfsacl_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd)
+static NTSTATUS gpfsacl_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd)
 {
 	return gpfsacl_set_nt_acl_internal(fsp, security_info_sent, psd);
 }
@@ -739,7 +739,7 @@ static int gpfsacl_emu_chmod(const char *path, mode_t mode)
 		if (haveAllowEntry[i]==True)
 			continue;
 		
-		memset(&ace, 0, sizeof(SMB_ACE4PROP_T));
+		ZERO_STRUCT(ace);
 		ace.aceType = SMB_ACE4_ACCESS_ALLOWED_ACE_TYPE;
 		ace.flags |= SMB_ACE4_ID_SPECIAL;
 		ace.who.special_id = i;
@@ -761,7 +761,7 @@ static int gpfsacl_emu_chmod(const char *path, mode_t mode)
 	}
 	
 	/* don't add complementary DENY ACEs here */
-	memset(&fake_fsp, 0, sizeof(struct files_struct));
+	ZERO_STRUCT(fake_fsp);
 	fake_fsp.fsp_name = (char *)path; /* no file_new is needed here */
 	
 	/* put the acl */
diff --git a/source3/modules/vfs_smb_traffic_analyzer.c b/source3/modules/vfs_smb_traffic_analyzer.c
new file mode 100644
index 0000000000..9b4c1b3e25
--- /dev/null
+++ b/source3/modules/vfs_smb_traffic_analyzer.c
@@ -0,0 +1,406 @@
+/*
+ * traffic-analyzer VFS module. Measure the smb traffic users create
+ * on the net.
+ *
+ * Copyright (C) Holger Hetterich, 2008
+ * Copyright (C) Jeremy Allison, 2008
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "includes.h"
+
+/* abstraction for the send_over_network function */
+
+enum sock_type {INTERNET_SOCKET = 0, UNIX_DOMAIN_SOCKET};
+
+#define LOCAL_PATHNAME "/var/tmp/stadsocket"
+
+static int vfs_smb_traffic_analyzer_debug_level = DBGC_VFS;
+
+static enum sock_type smb_traffic_analyzer_connMode(vfs_handle_struct *handle)
+{
+	connection_struct *conn = handle->conn;
+        const char *Mode;
+        Mode=lp_parm_const_string(SNUM(conn), "smb_traffic_analyzer","mode", \
+			"internet_socket");
+	if (strstr(Mode,"unix_domain_socket")) {
+		return UNIX_DOMAIN_SOCKET;
+	} else {
+		return INTERNET_SOCKET;
+	}
+}
+
+/* Connect to an internet socket */
+
+static int smb_traffic_analyzer_connect_inet_socket(vfs_handle_struct *handle,
+					const char *name, uint16_t port)
+{
+	/* Create a streaming Socket */
+	int sockfd = -1;
+	struct addrinfo hints;
+	struct addrinfo *ailist = NULL;
+	struct addrinfo *res = NULL;
+	int ret;
+
+	ZERO_STRUCT(hints);
+	/* By default make sure it supports TCP. */
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_flags = AI_ADDRCONFIG;
+
+	ret = getaddrinfo(name,
+			NULL,
+			&hints,
+			&ailist);
+
+        if (ret) {
+		DEBUG(3,("smb_traffic_analyzer_connect_inet_socket: "
+			"getaddrinfo failed for name %s [%s]\n",
+                        name,
+                        gai_strerror(ret) ));
+		return -1;
+        }
+
+	DEBUG(3,("smb_traffic_analyzer: Internet socket mode. Hostname: %s,"
+		"Port: %i\n", name, port));
+
+	for (res = ailist; res; res = res->ai_next) {
+		struct sockaddr_storage ss;
+
+		if (!res->ai_addr || res->ai_addrlen == 0) {
+			continue;
+		}
+
+		ZERO_STRUCT(ss);
+		memcpy(&ss, res->ai_addr, res->ai_addrlen);
+
+		sockfd = open_socket_out(SOCK_STREAM, &ss, port, 10000);
+		if (sockfd != -1) {
+			break;
+		}
+	}
+
+	if (ailist) {
+		freeaddrinfo(ailist);
+	}
+
+        if (sockfd == -1) {
+		DEBUG(1, ("smb_traffic_analyzer: unable to create "
+			"socket, error is %s",
+			strerror(errno)));
+		return -1;
+	}
+
+	return sockfd;
+}
+
+/* Connect to a unix domain socket */
+
+static int smb_traffic_analyzer_connect_unix_socket(vfs_handle_struct *handle,
+						const char *name)
+{
+	/* Create the socket to stad */
+	int len, sock;
+	struct sockaddr_un remote;
+
+	DEBUG(7, ("smb_traffic_analyzer_connect_unix_socket: "
+			"Unix domain socket mode. Using %s\n",
+			name ));
+
+	if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
+		DEBUG(1, ("smb_traffic_analyzer_connect_unix_socket: "
+			"Couldn't create socket, "
+			"make sure stad is running!\n"));
+	}
+	remote.sun_family = AF_UNIX;
+	strlcpy(remote.sun_path, name,
+		    sizeof(remote.sun_path));
+	len=strlen(remote.sun_path) + sizeof(remote.sun_family);
+	if (connect(sock, (struct sockaddr *)&remote, len) == -1 ) {
+		DEBUG(1, ("smb_traffic_analyzer_connect_unix_socket: "
+			"Could not connect to "
+			"socket, make sure\nstad is running!\n"));
+		close(sock);
+		return -1;
+	}
+	return sock;
+}
+
+/* Private data allowing shared connection sockets. */
+
+struct refcounted_sock {
+	struct refcounted_sock *next, *prev;
+	char *name;
+	uint16_t port;
+	int sock;
+	unsigned int ref_count;
+};
+
+/* Send data over a socket */
+
+static void smb_traffic_analyzer_send_data(vfs_handle_struct *handle,
+					ssize_t result,
+					const char *file_name,
+					bool Write)
+{
+	struct refcounted_sock *rf_sock = NULL;
+	struct timeval tv;
+	time_t tv_sec;
+	struct tm *tm = NULL;
+	int seconds;
+	char *str = NULL;
+	size_t len;
+
+	SMB_VFS_HANDLE_GET_DATA(handle, rf_sock, struct refcounted_sock, return);
+
+	if (rf_sock == NULL || rf_sock->sock == -1) {
+		DEBUG(1, ("smb_traffic_analyzer_send_data: socket is "
+			"closed\n"));
+		return;
+	}
+
+	GetTimeOfDay(&tv);
+	tv_sec = convert_timespec_to_time_t(convert_timeval_to_timespec(tv));
+	tm = localtime(&tv_sec);
+	if (!tm) {
+		return;
+	}
+	seconds=(float) (tv.tv_usec / 1000);
+
+	str = talloc_asprintf(talloc_tos(),
+			"V1,%u,\"%s\",\"%s\",\"%c\",\"%s\",\"%s\","
+			"\"%04d-%02d-%02d %02d:%02d:%02d.%03d\"\n",
+			(unsigned int)result,
+			handle->conn->server_info->sanitized_username,
+			pdb_get_domain(handle->conn->server_info->sam_account),
+			Write ? 'W' : 'R',
+			handle->conn->connectpath,
+			file_name,
+			tm->tm_year+1900,
+			tm->tm_mon+1,
+			tm->tm_mday,
+			tm->tm_hour,
+			tm->tm_min,
+			tm->tm_sec,
+			(int)seconds);
+
+	if (!str) {
+		return;
+	}
+
+	len = strlen(str);
+
+	DEBUG(10, ("smb_traffic_analyzer_send_data_socket: sending %s\n",
+			str));
+	if (write_data(rf_sock->sock, str, len) != len) {
+		DEBUG(1, ("smb_traffic_analyzer_send_data_socket: "
+			"error sending data to socket!\n"));
+		return ;
+	}
+}
+
+static struct refcounted_sock *sock_list;
+
+static void smb_traffic_analyzer_free_data(void **pptr)
+{
+	struct refcounted_sock *rf_sock = *(struct refcounted_sock **)pptr;
+	if (rf_sock == NULL) {
+		return;
+	}
+	rf_sock->ref_count--;
+	if (rf_sock->ref_count != 0) {
+		return;
+	}
+	if (rf_sock->sock != -1) {
+		close(rf_sock->sock);
+	}
+	DLIST_REMOVE(sock_list, rf_sock);
+	TALLOC_FREE(rf_sock);
+}
+
+static int smb_traffic_analyzer_connect(struct vfs_handle_struct *handle,
+                         const char *service,
+                         const char *user)
+{
+	connection_struct *conn = handle->conn;
+	enum sock_type st = smb_traffic_analyzer_connMode(handle);
+	struct refcounted_sock *rf_sock = NULL;
+	const char *name = (st == UNIX_DOMAIN_SOCKET) ? LOCAL_PATHNAME :
+				lp_parm_const_string(SNUM(conn),
+					"smb_traffic_analyzer",
+				"host", "localhost");
+	uint16_t port = (st == UNIX_DOMAIN_SOCKET) ? 0 :
+				atoi( lp_parm_const_string(SNUM(conn),
+				"smb_traffic_analyzer", "port", "9430"));
+
+	/* Are we already connected ? */
+	for (rf_sock = sock_list; rf_sock; rf_sock = rf_sock->next) {
+		if (port == rf_sock->port &&
+				(strcmp(name, rf_sock->name) == 0)) {
+			break;
+		}
+	}
+
+	/* If we're connected already, just increase the
+ 	 * reference count. */
+	if (rf_sock) {
+		rf_sock->ref_count++;
+	} else {
+		/* New connection. */
+		rf_sock = TALLOC_ZERO_P(NULL, struct refcounted_sock);
+		if (rf_sock == NULL) {
+			errno = ENOMEM;
+			return -1;
+		}
+		rf_sock->name = talloc_strdup(rf_sock, name);
+		if (rf_sock->name == NULL) {
+			TALLOC_FREE(rf_sock);
+			errno = ENOMEM;
+			return -1;
+		}
+		rf_sock->port = port;
+		rf_sock->ref_count = 1;
+
+		if (st == UNIX_DOMAIN_SOCKET) {
+			rf_sock->sock = smb_traffic_analyzer_connect_unix_socket(handle,
+							name);
+		} else {
+
+			rf_sock->sock = smb_traffic_analyzer_connect_inet_socket(handle,
+							name,
+							port);
+		}
+		if (rf_sock->sock == -1) {
+			TALLOC_FREE(rf_sock);
+			return -1;
+		}
+		DLIST_ADD(sock_list, rf_sock);
+	}
+
+	/* Store the private data. */
+	SMB_VFS_HANDLE_SET_DATA(handle, rf_sock, smb_traffic_analyzer_free_data,
+				struct refcounted_sock, return -1);
+	return SMB_VFS_NEXT_CONNECT(handle, service, user);
+}
+
+/* VFS Functions: write, read, pread, pwrite for now */
+
+static ssize_t smb_traffic_analyzer_read(vfs_handle_struct *handle, \
+				files_struct *fsp, void *data, size_t n)
+{
+	ssize_t result;
+
+	result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
+	DEBUG(10, ("smb_traffic_analyzer_read: READ: %s\n", fsp->fsp_name ));
+
+	smb_traffic_analyzer_send_data(handle,
+			result,
+			fsp->fsp_name,
+			false);
+	return result;
+}
+
+
+static ssize_t smb_traffic_analyzer_pread(vfs_handle_struct *handle, \
+		files_struct *fsp, void *data, size_t n, SMB_OFF_T offset)
+{
+	ssize_t result;
+
+	result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
+
+	DEBUG(10, ("smb_traffic_analyzer_pread: PREAD: %s\n", fsp->fsp_name ));
+
+	smb_traffic_analyzer_send_data(handle,
+			result,
+			fsp->fsp_name,
+			false);
+
+	return result;
+}
+
+static ssize_t smb_traffic_analyzer_write(vfs_handle_struct *handle, \
+			files_struct *fsp, const void *data, size_t n)
+{
+	ssize_t result;
+
+	result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
+
+	DEBUG(10, ("smb_traffic_analyzer_write: WRITE: %s\n", fsp->fsp_name ));
+
+	smb_traffic_analyzer_send_data(handle,
+			result,
+			fsp->fsp_name,
+			true);
+	return result;
+}
+
+static ssize_t smb_traffic_analyzer_pwrite(vfs_handle_struct *handle, \
+	     files_struct *fsp, const void *data, size_t n, SMB_OFF_T offset)
+{
+	ssize_t result;
+
+	result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
+
+	DEBUG(10, ("smb_traffic_analyzer_pwrite: PWRITE: %s\n", fsp->fsp_name ));
+
+	smb_traffic_analyzer_send_data(handle,
+			result,
+			fsp->fsp_name,
+			true);
+	return result;
+}
+
+/* VFS operations we use */
+
+static vfs_op_tuple smb_traffic_analyzer_tuples[] = {
+
+        {SMB_VFS_OP(smb_traffic_analyzer_connect), SMB_VFS_OP_CONNECT,
+         SMB_VFS_LAYER_LOGGER},
+	{SMB_VFS_OP(smb_traffic_analyzer_read),	SMB_VFS_OP_READ,
+	 SMB_VFS_LAYER_LOGGER},
+	{SMB_VFS_OP(smb_traffic_analyzer_pread), SMB_VFS_OP_PREAD,
+	 SMB_VFS_LAYER_LOGGER},
+	{SMB_VFS_OP(smb_traffic_analyzer_write), SMB_VFS_OP_WRITE,
+	 SMB_VFS_LAYER_LOGGER},
+	{SMB_VFS_OP(smb_traffic_analyzer_pwrite), SMB_VFS_OP_PWRITE,
+	 SMB_VFS_LAYER_LOGGER},
+       	{SMB_VFS_OP(NULL),SMB_VFS_OP_NOOP,SMB_VFS_LAYER_NOOP}
+};
+
+/* Module initialization */
+
+NTSTATUS vfs_smb_traffic_analyzer_init(void)
+{
+	NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION, \
+		"smb_traffic_analyzer",	smb_traffic_analyzer_tuples);
+
+	if (!NT_STATUS_IS_OK(ret)) {
+		return ret;
+	}
+
+	vfs_smb_traffic_analyzer_debug_level =
+		debug_add_class("smb_traffic_analyzer");
+
+	if (vfs_smb_traffic_analyzer_debug_level == -1) {
+		vfs_smb_traffic_analyzer_debug_level = DBGC_VFS;
+		DEBUG(1, ("smb_traffic_analyzer_init: Couldn't register custom"
+			 "debugging class!\n"));
+	} else {
+		DEBUG(3, ("smb_traffic_analyzer_init: Debug class number of"
+			"'smb_traffic_analyzer': %d\n", \
+			vfs_smb_traffic_analyzer_debug_level));
+	}
+
+	return ret;
+}
diff --git a/source3/modules/vfs_zfsacl.c b/source3/modules/vfs_zfsacl.c
index e933e47317..3688b2386e 100644
--- a/source3/modules/vfs_zfsacl.c
+++ b/source3/modules/vfs_zfsacl.c
@@ -166,7 +166,7 @@ static bool zfs_process_smbacl(files_struct *fsp, SMB4ACL_T *smbacl)
  */
 static NTSTATUS zfs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 			   uint32 security_info_sent,
-			   struct security_descriptor *psd)
+			   const struct security_descriptor *psd)
 {
 	return smb_set_nt_acl_nfs4(fsp, security_info_sent, psd,
 			zfs_process_smbacl);
@@ -207,7 +207,7 @@ static NTSTATUS zfsacl_get_nt_acl(struct vfs_handle_struct *handle,
 static NTSTATUS zfsacl_fset_nt_acl(vfs_handle_struct *handle,
 			 files_struct *fsp,
 			 uint32 security_info_sent,
-			 SEC_DESC *psd)
+			 const SEC_DESC *psd)
 {
 	return zfs_set_nt_acl(handle, fsp, security_info_sent, psd);
 }
diff --git a/source3/nmbd/nmbd_processlogon.c b/source3/nmbd/nmbd_processlogon.c
index 474ae1ca18..814eaf7ca8 100644
--- a/source3/nmbd/nmbd_processlogon.c
+++ b/source3/nmbd/nmbd_processlogon.c
@@ -178,7 +178,7 @@ logons are not enabled.\n", inet_ntoa(p->ip) ));
 				break;
 			}
 
-		case QUERYFORPDC:
+		case LOGON_PRIMARY_QUERY:
 			{
 				fstring mach_str, getdc_str;
 				fstring source_name;
@@ -253,7 +253,7 @@ logons are not enabled.\n", inet_ntoa(p->ip) ));
 
 				/* Construct reply. */
 				q = outbuf;
-				SSVAL(q, 0, QUERYFORPDC_R);
+				SSVAL(q, 0, NETLOGON_RESPONSE_FROM_PDC);
 				q += 2;
 
 				fstrcpy(reply_name,my_name);
@@ -292,7 +292,7 @@ logons are not enabled.\n", inet_ntoa(p->ip) ));
 				DEBUG(5,("process_logon_packet: GETDC request from %s at IP %s, \
 reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 					mach_str,inet_ntoa(p->ip), reply_name, lp_workgroup(),
-					QUERYFORPDC_R, (uint32)ntversion, (uint32)lmnttoken,
+					NETLOGON_RESPONSE_FROM_PDC, (uint32)ntversion, (uint32)lmnttoken,
 					(uint32)lm20token ));
 
 				dump_data(4, (uint8 *)outbuf, PTR_DIFF(q, outbuf));
@@ -309,7 +309,7 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 				return;
 			}
 
-		case SAMLOGON:
+		case LOGON_SAM_LOGON_REQUEST:
 
 			{
 				fstring getdc_str;
@@ -351,7 +351,7 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 				domainsidsize = IVAL(q, 0);
 				q += 4;
 
-				DEBUG(5,("process_logon_packet: SAMLOGON sidsize %d, len = %d\n", domainsidsize, len));
+				DEBUG(5,("process_logon_packet: LOGON_SAM_LOGON_REQUEST sidsize %d, len = %d\n", domainsidsize, len));
 
 				if (domainsidsize < (len - PTR_DIFF(q, buf)) && (domainsidsize != 0)) {
 					q += domainsidsize;
@@ -383,7 +383,7 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 				lm20token = SVAL(q, 6);
 				q += 8;
 
-				DEBUG(3,("process_logon_packet: SAMLOGON sidsize %d ntv %d\n", domainsidsize, ntversion));
+				DEBUG(3,("process_logon_packet: LOGON_SAM_LOGON_REQUEST sidsize %d ntv %d\n", domainsidsize, ntversion));
 
 				/*
 				 * we respond regadless of whether the machine is in our password 
@@ -392,14 +392,14 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 				 */
 				pull_ucs2_fstring(ascuser, uniuser);
 				pull_ucs2_fstring(asccomp, unicomp);
-				DEBUG(5,("process_logon_packet: SAMLOGON user %s\n", ascuser));
+				DEBUG(5,("process_logon_packet: LOGON_SAM_LOGON_REQUEST user %s\n", ascuser));
 
 				fstrcpy(reply_name, "\\\\"); /* Here it wants \\LOGONSERVER. */
 				fstrcat(reply_name, my_name);
 
-				DEBUG(5,("process_logon_packet: SAMLOGON request from %s(%s) for %s, returning logon svr %s domain %s code %x token=%x\n",
+				DEBUG(5,("process_logon_packet: LOGON_SAM_LOGON_REQUEST request from %s(%s) for %s, returning logon svr %s domain %s code %x token=%x\n",
 					asccomp,inet_ntoa(p->ip), ascuser, reply_name, lp_workgroup(),
-				SAMLOGON_R ,lmnttoken));
+				LOGON_SAM_LOGON_RESPONSE ,lmnttoken));
 
 				/* Construct reply. */
 
@@ -408,9 +408,9 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 				/* never, at least for now */
 				if ((ntversion < 11) || (SEC_ADS != lp_security()) || (ROLE_DOMAIN_PDC != lp_server_role())) {
 					if (SVAL(uniuser, 0) == 0) {
-						SSVAL(q, 0, SAMLOGON_UNK_R);	/* user unknown */
+						SSVAL(q, 0, LOGON_SAM_LOGON_USER_UNKNOWN);	/* user unknown */
 					} else {
-						SSVAL(q, 0, SAMLOGON_R);
+						SSVAL(q, 0, LOGON_SAM_LOGON_RESPONSE);
 					}
 
 					q += 2;
@@ -453,9 +453,9 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 						return;
 					}
 					if (SVAL(uniuser, 0) == 0) {
-						SIVAL(q, 0, SAMLOGON_AD_UNK_R);	/* user unknown */
+						SIVAL(q, 0, LOGON_SAM_LOGON_USER_UNKNOWN_EX);	/* user unknown */
 					} else {
-						SIVAL(q, 0, SAMLOGON_AD_R);
+						SIVAL(q, 0, LOGON_SAM_LOGON_RESPONSE_EX);
 					}
 					q += 4;
 
@@ -684,8 +684,8 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 		/* Announce change to UAS or SAM.  Send by the domain controller when a
 		replication event is required. */
 
-		case SAM_UAS_CHANGE:
-			DEBUG(5, ("Got SAM_UAS_CHANGE\n"));
+		case NETLOGON_ANNOUNCE_UAS:
+			DEBUG(5, ("Got NETLOGON_ANNOUNCE_UAS\n"));
 			break;
 
 		default:
diff --git a/source3/nsswitch/libwbclient/wbc_guid.c b/source3/nsswitch/libwbclient/wbc_guid.c
new file mode 100644
index 0000000000..0cb33e9868
--- /dev/null
+++ b/source3/nsswitch/libwbclient/wbc_guid.c
@@ -0,0 +1,118 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Winbind client API
+
+   Copyright (C) Gerald (Jerry) Carter 2007
+
+
+   This library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 3 of the License, or (at your option) any later version.
+
+   This library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Library General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/* Required Headers */
+
+#include "libwbclient.h"
+
+/** @brief Convert a binary GUID to a character string
+ *
+ * @param guid           Binary Guid
+ * @param **guid_string  Resulting character string
+ *
+ * @return #wbcErr
+ **/
+
+wbcErr wbcGuidToString(const struct wbcGuid *guid,
+		       char **guid_string)
+{
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+
+	if (!guid) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	*guid_string = talloc_asprintf(NULL,
+				       "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
+				       guid->time_low, guid->time_mid,
+				       guid->time_hi_and_version,
+				       guid->clock_seq[0],
+				       guid->clock_seq[1],
+				       guid->node[0], guid->node[1],
+				       guid->node[2], guid->node[3],
+				       guid->node[4], guid->node[5]);
+	BAIL_ON_PTR_ERROR((*guid_string), wbc_status);
+
+	wbc_status = WBC_ERR_SUCCESS;
+
+done:
+	return wbc_status;
+}
+
+/** @brief Convert a character string to a binary GUID
+ *
+ * @param *str          Character string
+ * @param guid          Resulting binary GUID
+ *
+ * @return #wbcErr
+ **/
+
+wbcErr wbcStringToGuid(const char *str,
+		       struct wbcGuid *guid)
+{
+	uint32_t time_low;
+	uint32_t time_mid, time_hi_and_version;
+	uint32_t clock_seq[2];
+	uint32_t node[6];
+	int i;
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+
+	if (!guid) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	if (!str) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	if (11 == sscanf(str, "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
+			 &time_low, &time_mid, &time_hi_and_version,
+			 &clock_seq[0], &clock_seq[1],
+			 &node[0], &node[1], &node[2], &node[3], &node[4], &node[5])) {
+	        wbc_status = WBC_ERR_SUCCESS;
+	} else if (11 == sscanf(str, "{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}",
+				&time_low, &time_mid, &time_hi_and_version,
+				&clock_seq[0], &clock_seq[1],
+				&node[0], &node[1], &node[2], &node[3], &node[4], &node[5])) {
+	        wbc_status = WBC_ERR_SUCCESS;
+	}
+
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+	guid->time_low = time_low;
+	guid->time_mid = time_mid;
+	guid->time_hi_and_version = time_hi_and_version;
+	guid->clock_seq[0] = clock_seq[0];
+	guid->clock_seq[1] = clock_seq[1];
+
+	for (i=0;i<6;i++) {
+		guid->node[i] = node[i];
+	}
+
+	wbc_status = WBC_ERR_SUCCESS;
+
+done:
+	return wbc_status;
+}
diff --git a/source3/nsswitch/libwbclient/wbc_idmap.c b/source3/nsswitch/libwbclient/wbc_idmap.c
index e32d66cd71..1615fd33ee 100644
--- a/source3/nsswitch/libwbclient/wbc_idmap.c
+++ b/source3/nsswitch/libwbclient/wbc_idmap.c
@@ -394,7 +394,7 @@ wbcErr wbcSetUidHwm(uid_t uid_hwm)
 
 /** @brief Set the highwater mark for allocated gids.
  *
- * @param uid_hwm      The new gid highwater mark value
+ * @param gid_hwm      The new gid highwater mark value
  *
  * @return #wbcErr
  **/
diff --git a/source3/nsswitch/libwbclient/wbc_pam.c b/source3/nsswitch/libwbclient/wbc_pam.c
index 20b42b6efb..713ba2e65b 100644
--- a/source3/nsswitch/libwbclient/wbc_pam.c
+++ b/source3/nsswitch/libwbclient/wbc_pam.c
@@ -4,6 +4,7 @@
    Winbind client API
 
    Copyright (C) Gerald (Jerry) Carter 2007
+   Copyright (C) Guenther Deschner 2008
 
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
@@ -260,6 +261,50 @@ done:
 	return wbc_status;
 }
 
+static wbcErr wbc_create_logon_info(TALLOC_CTX *mem_ctx,
+				    const struct winbindd_response *resp,
+				    struct wbcLogonUserInfo **_i)
+{
+	wbcErr wbc_status = WBC_ERR_SUCCESS;
+	struct wbcLogonUserInfo *i;
+
+	i = talloc_zero(mem_ctx, struct wbcLogonUserInfo);
+	BAIL_ON_PTR_ERROR(i, wbc_status);
+
+	wbc_status = wbc_create_auth_info(i, resp, &i->info);
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+	if (resp->data.auth.krb5ccname) {
+		wbc_status = wbcAddNamedBlob(&i->num_blobs,
+					     &i->blobs,
+					     "krb5ccname",
+					     0,
+					     (uint8_t *)resp->data.auth.krb5ccname,
+					     strlen(resp->data.auth.krb5ccname)+1);
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	if (resp->data.auth.unix_username) {
+		wbc_status = wbcAddNamedBlob(&i->num_blobs,
+					     &i->blobs,
+					     "unix_username",
+					     0,
+					     (uint8_t *)resp->data.auth.unix_username,
+					     strlen(resp->data.auth.unix_username)+1);
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	*_i = i;
+	i = NULL;
+done:
+	if (!WBC_ERROR_IS_OK(wbc_status) && i) {
+		wbcFreeMemory(i->blobs);
+	}
+
+	talloc_free(i);
+	return wbc_status;
+}
+
 /** @brief Authenticate with more detailed information
  *
  * @param params       Input parameters, WBC_AUTH_USER_LEVEL_HASH
@@ -331,6 +376,7 @@ wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
 				params->account_name,
 				sizeof(request.data.auth.user)-1);
 		}
+
 		strncpy(request.data.auth.pass,
 			params->password.plaintext,
 			sizeof(request.data.auth.pass)-1);
@@ -416,6 +462,10 @@ wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
 		BAIL_ON_WBC_ERROR(wbc_status);
 	}
 
+	if (params->flags) {
+		request.flags |= params->flags;
+	}
+
 	wbc_status = wbcRequestResponse(cmd,
 					&request,
 					&response);
@@ -497,6 +547,101 @@ wbcErr wbcCheckTrustCredentials(const char *domain,
 	return wbc_status;
 }
 
+/** @brief Trigger an extended logoff notification to Winbind for a specific user
+ *
+ * @param params      A wbcLogoffUserParams structure
+ * @param error       User output details on error
+ *
+ * @return #wbcErr
+ *
+ **/
+
+wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
+		       struct wbcAuthErrorInfo **error)
+{
+	struct winbindd_request request;
+	struct winbindd_response response;
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	int i;
+
+	/* validate input */
+
+	if (!params || !params->username) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	if ((params->num_blobs > 0) && (params->blobs == NULL)) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	if ((params->num_blobs == 0) && (params->blobs != NULL)) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	ZERO_STRUCT(request);
+	ZERO_STRUCT(response);
+
+	strncpy(request.data.logoff.user, params->username,
+		sizeof(request.data.logoff.user)-1);
+
+	for (i=0; i<params->num_blobs; i++) {
+
+		if (strcasecmp(params->blobs[i].name, "ccfilename") == 0) {
+			if (params->blobs[i].blob.data) {
+				strncpy(request.data.logoff.krb5ccname,
+					(const char *)params->blobs[i].blob.data,
+					sizeof(request.data.logoff.krb5ccname) - 1);
+			}
+			continue;
+		}
+
+		if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
+			if (params->blobs[i].blob.data) {
+				memcpy(&request.data.logoff.uid,
+					params->blobs[i].blob.data,
+					MIN(params->blobs[i].blob.length,
+					    sizeof(request.data.logoff.uid)));
+			}
+			continue;
+		}
+
+		if (strcasecmp(params->blobs[i].name, "flags") == 0) {
+			if (params->blobs[i].blob.data) {
+				memcpy(&request.flags,
+					params->blobs[i].blob.data,
+					MIN(params->blobs[i].blob.length,
+					    sizeof(request.flags)));
+			}
+			continue;
+		}
+	}
+
+	/* Send request */
+
+	wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
+					&request,
+					&response);
+
+	/* Take the response above and return it to the caller */
+	if (response.data.auth.nt_status != 0) {
+		if (error) {
+			wbc_status = wbc_create_error_info(NULL,
+							   &response,
+							   error);
+			BAIL_ON_WBC_ERROR(wbc_status);
+		}
+
+		wbc_status = WBC_ERR_AUTH_ERROR;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+ done:
+	return wbc_status;
+}
+
 /** @brief Trigger a logoff notification to Winbind for a specific user
  *
  * @param username    Name of user to remove from Winbind's list of
@@ -794,3 +939,159 @@ wbcErr wbcChangeUserPassword(const char *username,
 done:
 	return wbc_status;
 }
+
+/** @brief Logon a User
+ *
+ * @param[in]  params      Pointer to a wbcLogonUserParams structure
+ * @param[out] info        Pointer to a pointer to a wbcLogonUserInfo structure
+ * @param[out] error       Pointer to a pointer to a wbcAuthErrorInfo structure
+ * @param[out] policy      Pointer to a pointer to a wbcUserPasswordPolicyInfo structure
+ *
+ * @return #wbcErr
+ *
+ **/
+
+wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
+		    struct wbcLogonUserInfo **info,
+		    struct wbcAuthErrorInfo **error,
+		    struct wbcUserPasswordPolicyInfo **policy)
+{
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	int cmd = 0;
+	struct winbindd_request request;
+	struct winbindd_response response;
+	uint32_t i;
+
+	ZERO_STRUCT(request);
+	ZERO_STRUCT(response);
+
+	if (info) {
+		*info = NULL;
+	}
+	if (error) {
+		*error = NULL;
+	}
+	if (policy) {
+		*policy = NULL;
+	}
+
+	if (!params) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	if (!params->username) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	if ((params->num_blobs > 0) && (params->blobs == NULL)) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	if ((params->num_blobs == 0) && (params->blobs != NULL)) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	/* Initialize request */
+
+	cmd = WINBINDD_PAM_AUTH;
+	request.flags = WBFLAG_PAM_INFO3_TEXT |
+			WBFLAG_PAM_USER_SESSION_KEY |
+			WBFLAG_PAM_LMKEY;
+
+	if (!params->password) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	strncpy(request.data.auth.user,
+		params->username,
+		sizeof(request.data.auth.user)-1);
+
+	strncpy(request.data.auth.pass,
+		params->password,
+		sizeof(request.data.auth.pass)-1);
+
+	for (i=0; i<params->num_blobs; i++) {
+
+		if (strcasecmp(params->blobs[i].name, "krb5_cc_type") == 0) {
+			if (params->blobs[i].blob.data) {
+				strncpy(request.data.auth.krb5_cc_type,
+					(const char *)params->blobs[i].blob.data,
+					sizeof(request.data.auth.krb5_cc_type) - 1);
+			}
+			continue;
+		}
+
+		if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
+			if (params->blobs[i].blob.data) {
+				memcpy(&request.data.auth.uid,
+					params->blobs[i].blob.data,
+					MIN(sizeof(request.data.auth.uid),
+					    params->blobs[i].blob.length));
+			}
+			continue;
+		}
+
+		if (strcasecmp(params->blobs[i].name, "flags") == 0) {
+			if (params->blobs[i].blob.data) {
+				uint32_t flags;
+				memcpy(&flags,
+					params->blobs[i].blob.data,
+					MIN(sizeof(flags),
+					    params->blobs[i].blob.length));
+				request.flags |= flags;
+			}
+			continue;
+		}
+
+		if (strcasecmp(params->blobs[i].name, "membership_of") == 0) {
+			if (params->blobs[i].blob.data &&
+			    params->blobs[i].blob.data[0] > 0) {
+				strncpy(request.data.auth.require_membership_of_sid,
+					(const char *)params->blobs[i].blob.data,
+					sizeof(request.data.auth.require_membership_of_sid) - 1);
+			}
+			continue;
+		}
+	}
+
+	wbc_status = wbcRequestResponse(cmd,
+					&request,
+					&response);
+
+	if (response.data.auth.nt_status != 0) {
+		if (error) {
+			wbc_status = wbc_create_error_info(NULL,
+							   &response,
+							   error);
+			BAIL_ON_WBC_ERROR(wbc_status);
+		}
+
+		wbc_status = WBC_ERR_AUTH_ERROR;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+	if (info) {
+		wbc_status = wbc_create_logon_info(NULL,
+						   &response,
+						   info);
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	if (policy) {
+		wbc_status = wbc_create_password_policy_info(NULL,
+							     &response,
+							     policy);
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+done:
+	if (response.extra_data.data)
+		free(response.extra_data.data);
+
+	return wbc_status;
+}
diff --git a/source3/nsswitch/libwbclient/wbc_pwd.c b/source3/nsswitch/libwbclient/wbc_pwd.c
index b5f167369c..0d17b312ef 100644
--- a/source3/nsswitch/libwbclient/wbc_pwd.c
+++ b/source3/nsswitch/libwbclient/wbc_pwd.c
@@ -380,7 +380,7 @@ wbcErr wbcGetgrent(struct group **grp)
  *
  * @param *account       The given user name
  * @param *num_groups    Number of elements returned in the groups array
- * @param **groups       Pointer to resulting gid_t array.
+ * @param **_groups      Pointer to resulting gid_t array.
  *
  * @return #wbcErr
  **/
diff --git a/source3/nsswitch/libwbclient/wbc_sid.c b/source3/nsswitch/libwbclient/wbc_sid.c
index f4ffa4e5ca..4cfdd792b5 100644
--- a/source3/nsswitch/libwbclient/wbc_sid.c
+++ b/source3/nsswitch/libwbclient/wbc_sid.c
@@ -223,9 +223,9 @@ wbcErr wbcLookupName(const char *domain,
 /** @brief Convert a SID to a domain and name
  *
  * @param *sid        Pointer to the domain SID to be resolved
- * @param domain      Resolved Domain name (possibly "")
- * @param name        Resolved User or group name
- * @param *name_type  Pointet to the resolved SID type
+ * @param pdomain     Resolved Domain name (possibly "")
+ * @param pname       Resolved User or group name
+ * @param *pname_type Pointet to the resolved SID type
  *
  * @return #wbcErr
  *
diff --git a/source3/nsswitch/libwbclient/wbc_util.c b/source3/nsswitch/libwbclient/wbc_util.c
index 24568f9101..b4868748ae 100644
--- a/source3/nsswitch/libwbclient/wbc_util.c
+++ b/source3/nsswitch/libwbclient/wbc_util.c
@@ -496,7 +496,7 @@ wbcErr wbcListTrusts(struct wbcDomainInfo **domains, size_t *num_domains)
 /** @brief Enumerate the domain trusts known by Winbind
  *
  * @param domain        Name of the domain to query for a DC
- * @flags               Bit flags used to control the domain location query
+ * @param flags         Bit flags used to control the domain location query
  * @param *dc_info      Pointer to the returned domain controller information
  *
  * @return #wbcErr
@@ -550,3 +550,187 @@ done:
 
 	return wbc_status;
 }
+
+static wbcErr wbc_create_domain_controller_info_ex(TALLOC_CTX *mem_ctx,
+						   const struct winbindd_response *resp,
+						   struct wbcDomainControllerInfoEx **_i)
+{
+	wbcErr wbc_status = WBC_ERR_SUCCESS;
+	struct wbcDomainControllerInfoEx *i;
+	struct wbcGuid guid;
+
+	i = talloc(mem_ctx, struct wbcDomainControllerInfoEx);
+	BAIL_ON_PTR_ERROR(i, wbc_status);
+
+	i->dc_unc = talloc_strdup(i, resp->data.dsgetdcname.dc_unc);
+	BAIL_ON_PTR_ERROR(i->dc_unc, wbc_status);
+
+	i->dc_address = talloc_strdup(i, resp->data.dsgetdcname.dc_address);
+	BAIL_ON_PTR_ERROR(i->dc_address, wbc_status);
+
+	i->dc_address_type = resp->data.dsgetdcname.dc_address_type;
+
+	wbc_status = wbcStringToGuid(resp->data.dsgetdcname.domain_guid, &guid);
+	if (WBC_ERROR_IS_OK(wbc_status)) {
+		i->domain_guid = talloc(i, struct wbcGuid);
+		BAIL_ON_PTR_ERROR(i->domain_guid, wbc_status);
+
+		*i->domain_guid = guid;
+	} else {
+		i->domain_guid = NULL;
+	}
+
+	i->domain_name = talloc_strdup(i, resp->data.dsgetdcname.domain_name);
+	BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
+
+	if (resp->data.dsgetdcname.forest_name[0] != '\0') {
+		i->forest_name = talloc_strdup(i,
+			resp->data.dsgetdcname.forest_name);
+		BAIL_ON_PTR_ERROR(i->forest_name, wbc_status);
+	} else {
+		i->forest_name = NULL;
+	}
+
+	i->dc_flags = resp->data.dsgetdcname.dc_flags;
+
+	if (resp->data.dsgetdcname.dc_site_name[0] != '\0') {
+		i->dc_site_name = talloc_strdup(i,
+			resp->data.dsgetdcname.dc_site_name);
+		BAIL_ON_PTR_ERROR(i->dc_site_name, wbc_status);
+	} else {
+		i->dc_site_name = NULL;
+	}
+
+	if (resp->data.dsgetdcname.client_site_name[0] != '\0') {
+		i->client_site_name = talloc_strdup(i,
+			resp->data.dsgetdcname.client_site_name);
+		BAIL_ON_PTR_ERROR(i->client_site_name, wbc_status);
+	} else {
+		i->client_site_name = NULL;
+	}
+
+	*_i = i;
+	i = NULL;
+
+done:
+	talloc_free(i);
+	return wbc_status;
+}
+
+/** @brief Get extended domain controller information
+ *
+ * @param domain        Name of the domain to query for a DC
+ * @param guid          Guid of the domain to query for a DC
+ * @param site          Site of the domain to query for a DC
+ * @param flags         Bit flags used to control the domain location query
+ * @param *dc_info      Pointer to the returned extended domain controller information
+ *
+ * @return #wbcErr
+ *
+ **/
+
+wbcErr wbcLookupDomainControllerEx(const char *domain,
+				   struct wbcGuid *guid,
+				   const char *site,
+				   uint32_t flags,
+				   struct wbcDomainControllerInfoEx **dc_info)
+{
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	struct winbindd_request request;
+	struct winbindd_response response;
+
+	/* validate input params */
+
+	if (!domain || !dc_info) {
+		wbc_status = WBC_ERR_INVALID_PARAM;
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	ZERO_STRUCT(request);
+	ZERO_STRUCT(response);
+
+	request.data.dsgetdcname.flags = flags;
+
+	strncpy(request.data.dsgetdcname.domain_name, domain,
+		sizeof(request.data.dsgetdcname.domain_name)-1);
+
+	if (site) {
+		strncpy(request.data.dsgetdcname.site_name, site,
+			sizeof(request.data.dsgetdcname.site_name)-1);
+	}
+
+	if (guid) {
+		char *str = NULL;
+
+		wbc_status = wbcGuidToString(guid, &str);
+		BAIL_ON_WBC_ERROR(wbc_status);
+
+		strncpy(request.data.dsgetdcname.domain_guid, str,
+			sizeof(request.data.dsgetdcname.domain_guid)-1);
+
+		wbcFreeMemory(str);
+	}
+
+	/* Send request */
+
+	wbc_status = wbcRequestResponse(WINBINDD_DSGETDCNAME,
+					&request,
+					&response);
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+	if (dc_info) {
+		wbc_status = wbc_create_domain_controller_info_ex(NULL,
+								  &response,
+								  dc_info);
+		BAIL_ON_WBC_ERROR(wbc_status);
+	}
+
+	wbc_status = WBC_ERR_SUCCESS;
+done:
+	return wbc_status;
+}
+
+/** @brief Initialize a named blob and add to list of blobs
+ *
+ * @param[in,out] num_blobs     Pointer to the number of blobs
+ * @param[in,out] blobs         Pointer to an array of blobs
+ * @param[in]     name          Name of the new named blob
+ * @param[in]     flags         Flags of the new named blob
+ * @param[in]     data          Blob data of new blob
+ * @param[in]     length        Blob data length of new blob
+ *
+ * @return #wbcErr
+ *
+ **/
+
+wbcErr wbcAddNamedBlob(size_t *num_blobs,
+		       struct wbcNamedBlob **blobs,
+		       const char *name,
+		       uint32_t flags,
+		       uint8_t *data,
+		       size_t length)
+{
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	struct wbcNamedBlob blob;
+
+	*blobs = talloc_realloc(NULL, *blobs, struct wbcNamedBlob,
+				*(num_blobs)+1);
+	BAIL_ON_PTR_ERROR(*blobs, wbc_status);
+
+	blob.name		= talloc_strdup(*blobs, name);
+	BAIL_ON_PTR_ERROR(blob.name, wbc_status);
+	blob.flags		= flags;
+	blob.blob.length	= length;
+	blob.blob.data		= (uint8_t *)talloc_memdup(*blobs, data, length);
+	BAIL_ON_PTR_ERROR(blob.blob.data, wbc_status);
+
+	(*(blobs))[*num_blobs] = blob;
+	*(num_blobs) += 1;
+
+	wbc_status = WBC_ERR_SUCCESS;
+done:
+	if (!WBC_ERROR_IS_OK(wbc_status) && blobs) {
+		wbcFreeMemory(*blobs);
+	}
+	return wbc_status;
+}
diff --git a/source3/nsswitch/libwbclient/wbclient.h b/source3/nsswitch/libwbclient/wbclient.h
index cae3feec5b..00a3c98966 100644
--- a/source3/nsswitch/libwbclient/wbclient.h
+++ b/source3/nsswitch/libwbclient/wbclient.h
@@ -137,6 +137,19 @@ struct wbcSidWithAttr {
 #define WBC_SID_ATTR_GROUP_LOGON_ID 		0xC0000000
 
 /**
+ *  @brief Windows GUID
+ *
+ **/
+
+struct wbcGuid {
+	uint32_t time_low;
+	uint16_t time_mid;
+	uint16_t time_hi_and_version;
+	uint8_t clock_seq[2];
+	uint8_t node[6];
+};
+
+/**
  * @brief Domain Information
  **/
 
@@ -206,6 +219,36 @@ struct wbcAuthUserParams {
 };
 
 /**
+ * @brief Generic Blob
+ **/
+
+struct wbcBlob {
+	uint8_t *data;
+	size_t length;
+};
+
+/**
+ * @brief Named Blob
+ **/
+
+struct wbcNamedBlob {
+	const char *name;
+	uint32_t flags;
+	struct wbcBlob blob;
+};
+
+/**
+ * @brief Logon User Parameters
+ **/
+
+struct wbcLogonUserParams {
+	const char *username;
+	const char *password;
+	size_t num_blobs;
+	struct wbcNamedBlob *blobs;
+};
+
+/**
  * @brief ChangePassword Parameters
  **/
 
@@ -297,6 +340,18 @@ struct wbcAuthUserInfo {
 	struct wbcSidWithAttr *sids;
 };
 
+/**
+ * @brief Logon User Information
+ *
+ * Some of the strings are maybe NULL
+ **/
+
+struct wbcLogonUserInfo {
+	struct wbcAuthUserInfo *info;
+	size_t num_blobs;
+	struct wbcNamedBlob *blobs;
+};
+
 /* wbcAuthUserInfo->user_flags */
 
 #define WBC_AUTH_USER_INFO_GUEST			0x00000001
@@ -372,6 +427,16 @@ enum wbcPasswordChangeRejectReason {
 	WBC_PWD_CHANGE_REJECT_COMPLEXITY=5
 };
 
+/**
+ * @brief Logoff User Parameters
+ **/
+
+struct wbcLogoffUserParams {
+	const char *username;
+	size_t num_blobs;
+	struct wbcNamedBlob *blobs;
+};
+
 /*
  * DomainControllerInfo struct
  */
@@ -379,7 +444,20 @@ struct wbcDomainControllerInfo {
 	char *dc_name;
 };
 
-
+/*
+ * DomainControllerInfoEx struct
+ */
+struct wbcDomainControllerInfoEx {
+	const char *dc_unc;
+	const char *dc_address;
+	uint16_t dc_address_type;
+	struct wbcGuid *domain_guid;
+	const char *domain_name;
+	const char *forest_name;
+	uint32_t dc_flags;
+	const char *dc_site_name;
+	const char *client_site_name;
+};
 
 /*
  * Memory Management
@@ -398,6 +476,16 @@ wbcErr wbcSidToString(const struct wbcDomainSid *sid,
 wbcErr wbcStringToSid(const char *sid_string,
 		      struct wbcDomainSid *sid);
 
+/*
+ * Utility functions for dealing with GUIDs
+ */
+
+wbcErr wbcGuidToString(const struct wbcGuid *guid,
+		       char **guid_string);
+
+wbcErr wbcStringToGuid(const char *guid_string,
+		       struct wbcGuid *guid);
+
 wbcErr wbcPing(void);
 
 wbcErr wbcLibraryDetails(struct wbcLibraryDetails **details);
@@ -531,6 +619,12 @@ wbcErr wbcLookupDomainController(const char *domain,
 				 uint32_t flags,
 				 struct wbcDomainControllerInfo **dc_info);
 
+wbcErr wbcLookupDomainControllerEx(const char *domain,
+				   struct wbcGuid *guid,
+				   const char *site,
+				   uint32_t flags,
+				   struct wbcDomainControllerInfoEx **dc_info);
+
 /*
  * Athenticate functions
  */
@@ -542,10 +636,18 @@ wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
 			     struct wbcAuthUserInfo **info,
 			     struct wbcAuthErrorInfo **error);
 
+wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
+		    struct wbcLogonUserInfo **info,
+		    struct wbcAuthErrorInfo **error,
+		    struct wbcUserPasswordPolicyInfo **policy);
+
 wbcErr wbcLogoffUser(const char *username,
 		     uid_t uid,
 		     const char *ccfilename);
 
+wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
+		       struct wbcAuthErrorInfo **error);
+
 wbcErr wbcChangeUserPassword(const char *username,
 			     const char *old_password,
 			     const char *new_password);
@@ -566,6 +668,14 @@ wbcErr wbcResolveWinsByIP(const char *ip, char **name);
  */
 wbcErr wbcCheckTrustCredentials(const char *domain,
 				struct wbcAuthErrorInfo **error);
-
+/*
+ * Helper functions
+ */
+wbcErr wbcAddNamedBlob(size_t *num_blobs,
+		       struct wbcNamedBlob **blobs,
+		       const char *name,
+		       uint32_t flags,
+		       uint8_t *data,
+		       size_t length);
 
 #endif      /* _WBCLIENT_H */
diff --git a/source3/nsswitch/pam_winbind.c b/source3/nsswitch/pam_winbind.c
index beb0d47baa..8d8868d0ef 100644
--- a/source3/nsswitch/pam_winbind.c
+++ b/source3/nsswitch/pam_winbind.c
@@ -12,6 +12,42 @@
 
 #include "pam_winbind.h"
 
+static int wbc_error_to_pam_error(wbcErr status)
+{
+	switch (status) {
+		case WBC_ERR_SUCCESS:
+			return PAM_SUCCESS;
+		case WBC_ERR_NOT_IMPLEMENTED:
+			return PAM_SERVICE_ERR;
+		case WBC_ERR_UNKNOWN_FAILURE:
+			break;
+		case WBC_ERR_NO_MEMORY:
+			return PAM_BUF_ERR;
+		case WBC_ERR_INVALID_SID:
+		case WBC_ERR_INVALID_PARAM:
+			break;
+		case WBC_ERR_WINBIND_NOT_AVAILABLE:
+			return PAM_AUTHINFO_UNAVAIL;
+		case WBC_ERR_DOMAIN_NOT_FOUND:
+			return PAM_AUTHINFO_UNAVAIL;
+		case WBC_ERR_INVALID_RESPONSE:
+			return PAM_BUF_ERR;
+		case WBC_ERR_NSS_ERROR:
+			return PAM_USER_UNKNOWN;
+		case WBC_ERR_AUTH_ERROR:
+			return PAM_AUTH_ERR;
+		case WBC_ERR_UNKNOWN_USER:
+			return PAM_USER_UNKNOWN;
+		case WBC_ERR_UNKNOWN_GROUP:
+			return PAM_USER_UNKNOWN;
+		case WBC_ERR_PWD_CHANGE_FAILED:
+			break;
+	}
+
+	/* be paranoid */
+	return PAM_AUTH_ERR;
+}
+
 static const char *_pam_error_code_str(int err)
 {
 	switch (err) {
@@ -401,6 +437,10 @@ static int _pam_parse(const pam_handle_t *pamh,
 		ctrl |= WINBIND_WARN_PWD_EXPIRE;
 	}
 
+	if (iniparser_getboolean(d, "global:mkhomedir", false)) {
+		ctrl |= WINBIND_MKHOMEDIR;
+	}
+
 config_from_pam:
 	/* step through arguments */
 	for (i=argc,v=argv; i-- > 0; ++v) {
@@ -433,6 +473,8 @@ config_from_pam:
 			ctrl |= WINBIND_KRB5_CCACHE_TYPE;
 		else if (!strcasecmp(*v, "cached_login"))
 			ctrl |= WINBIND_CACHED_LOGIN;
+		else if (!strcasecmp(*v, "mkhomedir"))
+			ctrl |= WINBIND_MKHOMEDIR;
 		else {
 			__pam_log(pamh, ctrl, LOG_ERR,
 				 "pam_parse: unknown option: %s", *v);
@@ -452,13 +494,17 @@ config_from_pam:
 	return ctrl;
 };
 
-static void _pam_winbind_free_context(struct pwb_context *ctx)
+static int _pam_winbind_free_context(struct pwb_context *ctx)
 {
+	if (!ctx) {
+		return 0;
+	}
+
 	if (ctx->dict) {
 		iniparser_freedict(ctx->dict);
 	}
 
-	SAFE_FREE(ctx);
+	return 0;
 }
 
 static int _pam_winbind_init_context(pam_handle_t *pamh,
@@ -469,12 +515,12 @@ static int _pam_winbind_init_context(pam_handle_t *pamh,
 {
 	struct pwb_context *r = NULL;
 
-	r = (struct pwb_context *)malloc(sizeof(struct pwb_context));
+	r = TALLOC_ZERO_P(NULL, struct pwb_context);
 	if (!r) {
 		return PAM_BUF_ERR;
 	}
 
-	ZERO_STRUCTP(r);
+	talloc_set_destructor(r, _pam_winbind_free_context);
 
 	r->pamh = pamh;
 	r->flags = flags;
@@ -482,7 +528,7 @@ static int _pam_winbind_init_context(pam_handle_t *pamh,
 	r->argv = argv;
 	r->ctrl = _pam_parse(pamh, flags, argc, argv, &r->dict);
 	if (r->ctrl == -1) {
-		_pam_winbind_free_context(r);
+		TALLOC_FREE(r);
 		return PAM_SYSTEM_ERR;
 	}
 
@@ -502,7 +548,7 @@ static void _pam_winbind_cleanup_func(pam_handle_t *pamh,
 			       "(error_status = %d)", pamh, data,
 			       error_status);
 	}
-	SAFE_FREE(data);
+	TALLOC_FREE(data);
 }
 
 
@@ -644,80 +690,11 @@ static int _make_remark_format(struct pwb_context *ctx, int type, const char *fo
 	return ret;
 }
 
-static int pam_winbind_request(struct pwb_context *ctx,
-			       enum winbindd_cmd req_type,
-			       struct winbindd_request *request,
-			       struct winbindd_response *response)
-{
-	/* Fill in request and send down pipe */
-	winbindd_init_request(request, req_type);
-
-	if (winbind_write_sock(request, sizeof(*request), 0, 0) == -1) {
-		_pam_log(ctx, LOG_ERR,
-			 "pam_winbind_request: write to socket failed!");
-		winbind_close_sock();
-		return PAM_SERVICE_ERR;
-	}
-
-	/* Wait for reply */
-	if (winbindd_read_reply(response) == -1) {
-		_pam_log(ctx, LOG_ERR,
-			 "pam_winbind_request: read from socket failed!");
-		winbind_close_sock();
-		return PAM_SERVICE_ERR;
-	}
-
-	/* We are done with the socket - close it and avoid mischeif */
-	winbind_close_sock();
-
-	/* Copy reply data from socket */
-	if (response->result == WINBINDD_OK) {
-		return PAM_SUCCESS;
-	}
-
-	/* no need to check for pam_error codes for getpwnam() */
-	switch (req_type) {
-
-		case WINBINDD_GETPWNAM:
-		case WINBINDD_LOOKUPNAME:
-			if (strlen(response->data.auth.nt_status_string) > 0) {
-				_pam_log(ctx, LOG_ERR,
-					 "request failed, NT error was %s",
-					 response->data.auth.nt_status_string);
-			} else {
-				_pam_log(ctx, LOG_ERR, "request failed");
-			}
-			return PAM_USER_UNKNOWN;
-		default:
-			break;
-	}
-
-	if (response->data.auth.pam_error != PAM_SUCCESS) {
-		_pam_log(ctx, LOG_ERR,
-			 "request failed: %s, "
-			 "PAM error was %s (%d), NT error was %s",
-			 response->data.auth.error_string,
-			 pam_strerror(ctx->pamh, response->data.auth.pam_error),
-			 response->data.auth.pam_error,
-			 response->data.auth.nt_status_string);
-		return response->data.auth.pam_error;
-	}
-
-	_pam_log(ctx, LOG_ERR, "request failed, but PAM error 0!");
-
-	return PAM_SERVICE_ERR;
-}
-
 static int pam_winbind_request_log(struct pwb_context *ctx,
-				   enum winbindd_cmd req_type,
-				   struct winbindd_request *request,
-				   struct winbindd_response *response,
-				   const char *user)
+				   int retval,
+				   const char *user,
+				   const char *fn)
 {
-	int retval;
-
-	retval = pam_winbind_request(ctx, req_type, request, response);
-
 	switch (retval) {
 	case PAM_AUTH_ERR:
 		/* incorrect password */
@@ -749,33 +726,65 @@ static int pam_winbind_request_log(struct pwb_context *ctx,
 		return retval;
 	case PAM_SUCCESS:
 		/* Otherwise, the authentication looked good */
-		switch (req_type) {
-			case WINBINDD_INFO:
-				break;
-			case WINBINDD_PAM_AUTH:
-				_pam_log(ctx, LOG_NOTICE,
-					 "user '%s' granted access", user);
-				break;
-			case WINBINDD_PAM_CHAUTHTOK:
-				_pam_log(ctx, LOG_NOTICE,
-					 "user '%s' password changed", user);
-				break;
-			default:
-				_pam_log(ctx, LOG_NOTICE,
-					 "user '%s' OK", user);
-				break;
+		if (strcmp(fn, "wbcLogonUser") == 0) {
+			_pam_log(ctx, LOG_NOTICE,
+				 "user '%s' granted access", user);
+		} else {
+			_pam_log(ctx, LOG_NOTICE,
+				 "user '%s' OK", user);
 		}
-
 		return retval;
 	default:
 		/* we don't know anything about this return value */
 		_pam_log(ctx, LOG_ERR,
-			 "internal module error (retval = %d, user = '%s')",
-			 retval, user);
+			 "internal module error (retval = %s(%d), user = '%s')",
+			_pam_error_code_str(retval), retval, user);
 		return retval;
 	}
 }
 
+static int wbc_auth_error_to_pam_error(struct pwb_context *ctx,
+				       struct wbcAuthErrorInfo *e,
+				       wbcErr status,
+				       const char *username,
+				       const char *fn)
+{
+	int ret = PAM_AUTH_ERR;
+
+	if (WBC_ERROR_IS_OK(status)) {
+		_pam_log_debug(ctx, LOG_DEBUG, "request %s succeeded",
+			fn);
+		ret = PAM_SUCCESS;
+		return pam_winbind_request_log(ctx, ret, username, fn);
+	}
+
+	if (e) {
+		if (e->pam_error != PAM_SUCCESS) {
+			_pam_log(ctx, LOG_ERR,
+				 "request %s failed: %s, "
+				 "PAM error: %s (%d), NTSTATUS: %s, "
+				 "Error message was: %s",
+				 fn,
+				 wbcErrorString(status),
+				 _pam_error_code_str(e->pam_error),
+				 e->pam_error,
+				 e->nt_string,
+				 e->display_string);
+			ret = e->pam_error;
+			return pam_winbind_request_log(ctx, ret, username, fn);
+		}
+
+		_pam_log(ctx, LOG_ERR, "request %s failed, but PAM error 0!", fn);
+
+		ret = PAM_SERVICE_ERR;
+		return pam_winbind_request_log(ctx, ret, username, fn);
+	}
+
+	ret = wbc_error_to_pam_error(status);
+	return pam_winbind_request_log(ctx, ret, username, fn);
+}
+
+
 /**
  * send a password expiry message if required
  *
@@ -848,29 +857,34 @@ static bool _pam_send_password_expiry_message(struct pwb_context *ctx,
  */
 
 static void _pam_warn_password_expiry(struct pwb_context *ctx,
-				      const struct winbindd_response *response,
+				      const struct wbcAuthUserInfo *info,
+				      const struct wbcUserPasswordPolicyInfo *policy,
 				      int warn_pwd_expire,
 				      bool *already_expired)
 {
 	time_t now = time(NULL);
 	time_t next_change = 0;
 
+	if (!info || !policy) {
+		return;
+	}
+
 	if (already_expired) {
 		*already_expired = false;
 	}
 
-	/* accounts with ACB_PWNOEXP set never receive a warning */
-	if (response->data.auth.info3.acct_flags & ACB_PWNOEXP) {
+	/* accounts with WBC_ACB_PWNOEXP set never receive a warning */
+	if (info->acct_flags & WBC_ACB_PWNOEXP) {
 		return;
 	}
 
 	/* no point in sending a warning if this is a grace logon */
-	if (PAM_WB_GRACE_LOGON(response->data.auth.info3.user_flgs)) {
+	if (PAM_WB_GRACE_LOGON(info->user_flags)) {
 		return;
 	}
 
 	/* check if the info3 must change timestamp has been set */
-	next_change = response->data.auth.info3.pass_must_change_time;
+	next_change = info->pass_must_change_time;
 
 	if (_pam_send_password_expiry_message(ctx, next_change, now,
 					      warn_pwd_expire,
@@ -881,12 +895,11 @@ static void _pam_warn_password_expiry(struct pwb_context *ctx,
 	/* now check for the global password policy */
 	/* good catch from Ralf Haferkamp: an expiry of "never" is translated
 	 * to -1 */
-	if (response->data.auth.policy.expire <= 0) {
+	if (policy->expire <= 0) {
 		return;
 	}
 
-	next_change = response->data.auth.info3.pass_last_set_time +
-		      response->data.auth.policy.expire;
+	next_change = info->pass_last_set_time + policy->expire;
 
 	if (_pam_send_password_expiry_message(ctx, next_change, now,
 					      warn_pwd_expire,
@@ -944,33 +957,33 @@ static bool winbind_name_to_sid_string(struct pwb_context *ctx,
 				       int sid_list_buffer_size)
 {
 	const char* sid_string;
-	struct winbindd_response sid_response;
 
 	/* lookup name? */
 	if (IS_SID_STRING(name)) {
 		sid_string = name;
 	} else {
-		struct winbindd_request sid_request;
-
-		ZERO_STRUCT(sid_request);
-		ZERO_STRUCT(sid_response);
+		wbcErr wbc_status;
+		struct wbcDomainSid sid;
+		enum wbcSidType type;
+		char *sid_str;
 
 		_pam_log_debug(ctx, LOG_DEBUG,
 			       "no sid given, looking up: %s\n", name);
 
-		/* fortunatly winbindd can handle non-separated names */
-		strncpy(sid_request.data.name.name, name,
-			sizeof(sid_request.data.name.name) - 1);
-
-		if (pam_winbind_request_log(ctx, WINBINDD_LOOKUPNAME,
-					    &sid_request, &sid_response,
-					    user)) {
+		wbc_status = wbcLookupName("", name, &sid, &type);
+		if (!WBC_ERROR_IS_OK(wbc_status)) {
 			_pam_log(ctx, LOG_INFO,
 				 "could not lookup name: %s\n", name);
 			return false;
 		}
 
-		sid_string = sid_response.data.sid.sid;
+		wbc_status = wbcSidToString(&sid, &sid_str);
+		if (!WBC_ERROR_IS_OK(wbc_status)) {
+			return false;
+		}
+
+		wbcFreeMemory(sid_str);
+		sid_string = sid_str;
 	}
 
 	if (!safe_append_string(sid_list_buffer, sid_string,
@@ -1055,15 +1068,28 @@ out:
  */
 
 static void _pam_setup_krb5_env(struct pwb_context *ctx,
-				const char *krb5ccname)
+				struct wbcLogonUserInfo *info)
 {
 	char var[PATH_MAX];
 	int ret;
+	uint32_t i;
+	const char *krb5ccname = NULL;
 
 	if (off(ctx->ctrl, WINBIND_KRB5_AUTH)) {
 		return;
 	}
 
+	if (!info) {
+		return;
+	}
+
+	for (i=0; i < info->num_blobs; i++) {
+		if (strcasecmp(info->blobs[i].name, "krb5ccname") == 0) {
+			krb5ccname = (const char *)info->blobs[i].blob.data;
+			break;
+		}
+	}
+
 	if (!krb5ccname || (strlen(krb5ccname) == 0)) {
 		return;
 	}
@@ -1084,6 +1110,41 @@ static void _pam_setup_krb5_env(struct pwb_context *ctx,
 }
 
 /**
+ * Copy unix username if available (further processed in PAM).
+ *
+ * @param ctx PAM winbind context
+ * @param user_ret A pointer that holds a pointer to a string
+ * @param unix_username A username
+ *
+ * @return void.
+ */
+
+static void _pam_setup_unix_username(struct pwb_context *ctx,
+				     char **user_ret,
+				     struct wbcLogonUserInfo *info)
+{
+	const char *unix_username = NULL;
+	uint32_t i;
+
+	if (!user_ret || !info) {
+		return;
+	}
+
+	for (i=0; i < info->num_blobs; i++) {
+		if (strcasecmp(info->blobs[i].name, "unix_username") == 0) {
+			unix_username = (const char *)info->blobs[i].blob.data;
+			break;
+		}
+	}
+
+	if (!unix_username || !unix_username[0]) {
+		return;
+	}
+
+	*user_ret = strdup(unix_username);
+}
+
+/**
  * Set string into the PAM stack.
  *
  * @param ctx PAM winbind context.
@@ -1104,14 +1165,13 @@ static void _pam_set_data_string(struct pwb_context *ctx,
 		return;
 	}
 
-	ret = pam_set_data(ctx->pamh, data_name, (void *)strdup(value),
+	ret = pam_set_data(ctx->pamh, data_name, talloc_strdup(NULL, value),
 			   _pam_winbind_cleanup_func);
 	if (ret) {
 		_pam_log_debug(ctx, LOG_DEBUG,
 			       "Could not set data %s: %s\n",
 			       data_name, pam_strerror(ctx->pamh, ret));
 	}
-
 }
 
 /**
@@ -1125,16 +1185,16 @@ static void _pam_set_data_string(struct pwb_context *ctx,
  */
 
 static void _pam_set_data_info3(struct pwb_context *ctx,
-				struct winbindd_response *response)
+				const struct wbcAuthUserInfo *info)
 {
 	_pam_set_data_string(ctx, PAM_WINBIND_HOMEDIR,
-			     response->data.auth.info3.home_dir);
+			     info->home_directory);
 	_pam_set_data_string(ctx, PAM_WINBIND_LOGONSCRIPT,
-			     response->data.auth.info3.logon_script);
+			     info->logon_script);
 	_pam_set_data_string(ctx, PAM_WINBIND_LOGONSERVER,
-			     response->data.auth.info3.logon_srv);
+			     info->logon_server);
 	_pam_set_data_string(ctx, PAM_WINBIND_PROFILEPATH,
-			     response->data.auth.info3.profile_path);
+			     info->profile_path);
 }
 
 /**
@@ -1216,80 +1276,235 @@ static void _pam_warn_krb5_failure(struct pwb_context *ctx,
 	}
 }
 
+static bool _pam_check_remark_auth_err(struct pwb_context *ctx,
+				       const struct wbcAuthErrorInfo *e,
+				       const char *nt_status_string,
+				       int *pam_error)
+{
+	const char *ntstatus = NULL;
+	const char *error_string = NULL;
+
+	if (!e || !pam_error) {
+		return false;
+	}
+
+	ntstatus = e->nt_string;
+	if (!ntstatus) {
+		return false;
+	}
+
+	if (strcasecmp(ntstatus, nt_status_string) == 0) {
+
+		error_string = _get_ntstatus_error_string(nt_status_string);
+		if (error_string) {
+			_make_remark(ctx, PAM_ERROR_MSG, error_string);
+			*pam_error = e->pam_error;
+			return true;
+		}
+
+		if (e->display_string) {
+			_make_remark(ctx, PAM_ERROR_MSG, e->display_string);
+			*pam_error = e->pam_error;
+			return true;
+		}
+
+		_make_remark(ctx, PAM_ERROR_MSG, nt_status_string);
+		*pam_error = e->pam_error;
+
+		return true;
+	}
+
+	return false;
+};
+
 /**
  * Compose Password Restriction String for a PAM_ERROR_MSG conversation.
  *
- * @param response The struct winbindd_response.
+ * @param i The wbcUserPasswordPolicyInfo struct.
  *
- * @return string (caller needs to free).
+ * @return string (caller needs to talloc_free).
  */
 
-static char *_pam_compose_pwd_restriction_string(struct winbindd_response *response)
+static char *_pam_compose_pwd_restriction_string(struct pwb_context *ctx,
+						 struct wbcUserPasswordPolicyInfo *i)
 {
 	char *str = NULL;
-	size_t offset = 0, ret = 0, str_size = 1024;
 
-	str = (char *)malloc(str_size);
-	if (!str) {
-		return NULL;
+	if (!i) {
+		goto failed;
 	}
 
-	memset(str, '\0', str_size);
-
-	offset = snprintf(str, str_size, "Your password ");
-	if (offset == -1) {
+	str = talloc_asprintf(ctx, "Your password ");
+	if (!str) {
 		goto failed;
 	}
 
-	if (response->data.auth.policy.min_length_password > 0) {
-		ret = snprintf(str+offset, str_size-offset,
+	if (i->min_length_password > 0) {
+		str = talloc_asprintf_append(str,
 			       "must be at least %d characters; ",
-			       response->data.auth.policy.min_length_password);
-		if (ret == -1) {
+			       i->min_length_password);
+		if (!str) {
 			goto failed;
 		}
-		offset += ret;
 	}
 
-	if (response->data.auth.policy.password_history > 0) {
-		ret = snprintf(str+offset, str_size-offset,
+	if (i->password_history > 0) {
+		str = talloc_asprintf_append(str,
 			       "cannot repeat any of your previous %d "
 			       "passwords; ",
-			       response->data.auth.policy.password_history);
-		if (ret == -1) {
+			       i->password_history);
+		if (!str) {
 			goto failed;
 		}
-		offset += ret;
 	}
 
-	if (response->data.auth.policy.password_properties &
-	    DOMAIN_PASSWORD_COMPLEX) {
-		ret = snprintf(str+offset, str_size-offset,
+	if (i->password_properties & WBC_DOMAIN_PASSWORD_COMPLEX) {
+		str = talloc_asprintf_append(str,
 			       "must contain capitals, numerals "
 			       "or punctuation; "
 			       "and cannot contain your account "
 			       "or full name; ");
-		if (ret == -1) {
+		if (!str) {
 			goto failed;
 		}
-		offset += ret;
 	}
 
-	ret = snprintf(str+offset, str_size-offset,
+	str = talloc_asprintf_append(str,
 		       "Please type a different password. "
 		       "Type a password which meets these requirements in "
 		       "both text boxes.");
-	if (ret == -1) {
+	if (!str) {
 		goto failed;
 	}
 
 	return str;
 
  failed:
- 	SAFE_FREE(str);
+	TALLOC_FREE(str);
 	return NULL;
 }
 
+static int _pam_create_homedir(struct pwb_context *ctx,
+			       const char *dirname,
+			       mode_t mode)
+{
+	struct stat sbuf;
+
+	if (stat(dirname, &sbuf) == 0) {
+		return PAM_SUCCESS;
+	}
+
+	if (mkdir(dirname, mode) != 0) {
+
+		_make_remark_format(ctx, PAM_TEXT_INFO,
+				    "Creating directory: %s failed: %s",
+				    dirname, strerror(errno));
+		_pam_log(ctx, LOG_ERR, "could not create dir: %s (%s)",
+		 dirname, strerror(errno));
+		 return PAM_PERM_DENIED;
+	}
+
+	return PAM_SUCCESS;
+}
+
+static int _pam_chown_homedir(struct pwb_context *ctx,
+			      const char *dirname,
+			      uid_t uid,
+			      gid_t gid)
+{
+	if (chown(dirname, uid, gid) != 0) {
+		_pam_log(ctx, LOG_ERR, "failed to chown user homedir: %s (%s)",
+			 dirname, strerror(errno));
+		return PAM_PERM_DENIED;
+	}
+
+	return PAM_SUCCESS;
+}
+
+static int _pam_mkhomedir(struct pwb_context *ctx)
+{
+	struct passwd *pwd = NULL;
+	char *token = NULL;
+	char *create_dir = NULL;
+	char *user_dir = NULL;
+	int ret;
+	const char *username;
+	mode_t mode = 0700;
+	char *safe_ptr = NULL;
+	char *p = NULL;
+
+	/* Get the username */
+	ret = pam_get_user(ctx->pamh, &username, NULL);
+	if ((ret != PAM_SUCCESS) || (!username)) {
+		_pam_log_debug(ctx, LOG_DEBUG, "can not get the username");
+		return PAM_SERVICE_ERR;
+	}
+
+	pwd = getpwnam(username);
+	if (pwd == NULL) {
+		_pam_log_debug(ctx, LOG_DEBUG, "can not get the username");
+		return PAM_USER_UNKNOWN;
+	}
+	_pam_log_debug(ctx, LOG_DEBUG, "homedir is: %s", pwd->pw_dir);
+
+	ret = _pam_create_homedir(ctx, pwd->pw_dir, 0700);
+	if (ret == PAM_SUCCESS) {
+		ret = _pam_chown_homedir(ctx, pwd->pw_dir,
+					 pwd->pw_uid,
+					 pwd->pw_gid);
+	}
+
+	if (ret == PAM_SUCCESS) {
+		return ret;
+	}
+
+	/* maybe we need to create parent dirs */
+	create_dir = talloc_strdup(ctx, "/");
+	if (!create_dir) {
+		return PAM_BUF_ERR;
+	}
+
+	/* find final directory */
+	user_dir = strrchr(pwd->pw_dir, '/');
+	if (!user_dir) {
+		return PAM_BUF_ERR;
+	}
+	user_dir++;
+
+	_pam_log(ctx, LOG_DEBUG, "final directory: %s", user_dir);
+
+	p = pwd->pw_dir;
+
+	while ((token = strtok_r(p, "/", &safe_ptr)) != NULL) {
+
+		mode = 0755;
+
+		p = NULL;
+
+		_pam_log_debug(ctx, LOG_DEBUG, "token is %s", token);
+
+		create_dir = talloc_asprintf_append(create_dir, "%s/", token);
+		if (!create_dir) {
+			return PAM_BUF_ERR;
+		}
+		_pam_log_debug(ctx, LOG_DEBUG, "current_dir is %s", create_dir);
+
+		if (strcmp(token, user_dir) == 0) {
+			_pam_log_debug(ctx, LOG_DEBUG, "assuming last directory: %s", token);
+			mode = 0700;
+		}
+
+		ret = _pam_create_homedir(ctx, create_dir, mode);
+		if (ret) {
+			return ret;
+		}
+	}
+
+	return _pam_chown_homedir(ctx, create_dir,
+				  pwd->pw_uid,
+				  pwd->pw_gid);
+}
+
 /* talk to winbindd */
 static int winbind_auth_request(struct pwb_context *ctx,
 				const char *user,
@@ -1297,37 +1512,52 @@ static int winbind_auth_request(struct pwb_context *ctx,
 				const char *member,
 				const char *cctype,
 				const int warn_pwd_expire,
-				struct winbindd_response *p_response,
+				struct wbcAuthErrorInfo **p_error,
+				struct wbcLogonUserInfo **p_info,
+				struct wbcUserPasswordPolicyInfo **p_policy,
 				time_t *pwd_last_set,
 				char **user_ret)
 {
-	struct winbindd_request request;
-	struct winbindd_response response;
-	int ret;
-	bool already_expired = false;
+	wbcErr wbc_status;
+
+	struct wbcLogonUserParams logon;
+	char membership_of[1024];
+	uid_t user_uid = -1;
+	uint32_t flags = WBFLAG_PAM_INFO3_TEXT |
+			 WBFLAG_PAM_GET_PWD_POLICY;
 
-	ZERO_STRUCT(request);
-	ZERO_STRUCT(response);
+	struct wbcLogonUserInfo *info = NULL;
+	struct wbcAuthUserInfo *user_info = NULL;
+	struct wbcAuthErrorInfo *error = NULL;
+	struct wbcUserPasswordPolicyInfo *policy = NULL;
+
+	int ret = PAM_AUTH_ERR;
+	int i;
+	const char *codes[] = {
+		"NT_STATUS_PASSWORD_EXPIRED",
+		"NT_STATUS_PASSWORD_MUST_CHANGE",
+		"NT_STATUS_INVALID_WORKSTATION",
+		"NT_STATUS_INVALID_LOGON_HOURS",
+		"NT_STATUS_ACCOUNT_EXPIRED",
+		"NT_STATUS_ACCOUNT_DISABLED",
+		"NT_STATUS_ACCOUNT_LOCKED_OUT",
+		"NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT",
+		"NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT",
+		"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT",
+		"NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
+		"NT_STATUS_NO_LOGON_SERVERS",
+		"NT_STATUS_WRONG_PASSWORD",
+		"NT_STATUS_ACCESS_DENIED"
+	};
 
 	if (pwd_last_set) {
 		*pwd_last_set = 0;
 	}
 
-	strncpy(request.data.auth.user, user,
-		sizeof(request.data.auth.user)-1);
-
-	strncpy(request.data.auth.pass, pass,
-		sizeof(request.data.auth.pass)-1);
-
-	request.data.auth.krb5_cc_type[0] = '\0';
-	request.data.auth.uid = -1;
-
-	request.flags = WBFLAG_PAM_INFO3_TEXT | WBFLAG_PAM_GET_PWD_POLICY;
-
 	/* Krb5 auth always has to go against the KDC of the user's realm */
 
 	if (ctx->ctrl & WINBIND_KRB5_AUTH) {
-		request.flags |= WBFLAG_PAM_CONTACT_TRUSTDOM;
+		flags		|= WBFLAG_PAM_CONTACT_TRUSTDOM;
 	}
 
 	if (ctx->ctrl & (WINBIND_KRB5_AUTH|WINBIND_CACHED_LOGIN)) {
@@ -1337,7 +1567,7 @@ static int winbind_auth_request(struct pwb_context *ctx,
 		if (pwd == NULL) {
 			return PAM_USER_UNKNOWN;
 		}
-		request.data.auth.uid = pwd->pw_uid;
+		user_uid	= pwd->pw_uid;
 	}
 
 	if (ctx->ctrl & WINBIND_KRB5_AUTH) {
@@ -1345,38 +1575,34 @@ static int winbind_auth_request(struct pwb_context *ctx,
 		_pam_log_debug(ctx, LOG_DEBUG,
 			       "enabling krb5 login flag\n");
 
-		request.flags |= WBFLAG_PAM_KRB5 |
-				 WBFLAG_PAM_FALLBACK_AFTER_KRB5;
+		flags		|= WBFLAG_PAM_KRB5 |
+				   WBFLAG_PAM_FALLBACK_AFTER_KRB5;
 	}
 
 	if (ctx->ctrl & WINBIND_CACHED_LOGIN) {
 		_pam_log_debug(ctx, LOG_DEBUG,
 			       "enabling cached login flag\n");
-		request.flags |= WBFLAG_PAM_CACHED_LOGIN;
+		flags		|= WBFLAG_PAM_CACHED_LOGIN;
 	}
 
 	if (user_ret) {
 		*user_ret = NULL;
-		request.flags |= WBFLAG_PAM_UNIX_NAME;
+		flags		|= WBFLAG_PAM_UNIX_NAME;
 	}
 
 	if (cctype != NULL) {
-		strncpy(request.data.auth.krb5_cc_type, cctype,
-			sizeof(request.data.auth.krb5_cc_type) - 1);
 		_pam_log_debug(ctx, LOG_DEBUG,
 			       "enabling request for a %s krb5 ccache\n",
 			       cctype);
 	}
 
-	request.data.auth.require_membership_of_sid[0] = '\0';
-
 	if (member != NULL) {
 
-		if (!winbind_name_list_to_sid_string_list(ctx, user,
-			member,
-			request.data.auth.require_membership_of_sid,
-			sizeof(request.data.auth.require_membership_of_sid))) {
+		ZERO_STRUCT(membership_of);
 
+		if (!winbind_name_list_to_sid_string_list(ctx, user, member,
+							  membership_of,
+							  sizeof(membership_of))) {
 			_pam_log_debug(ctx, LOG_ERR,
 				       "failed to serialize membership of sid "
 				       "\"%s\"\n", member);
@@ -1384,60 +1610,100 @@ static int winbind_auth_request(struct pwb_context *ctx,
 		}
 	}
 
-	ret = pam_winbind_request_log(ctx, WINBINDD_PAM_AUTH,
-				      &request, &response, user);
+	ZERO_STRUCT(logon);
 
-	if (pwd_last_set) {
-		*pwd_last_set = response.data.auth.info3.pass_last_set_time;
+	logon.username			= user;
+	logon.password			= pass;
+
+	wbc_status = wbcAddNamedBlob(&logon.num_blobs,
+				     &logon.blobs,
+				     "krb5_cc_type",
+				     0,
+				     (uint8_t *)cctype,
+				     strlen(cctype)+1);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		goto done;
+	}
+
+	wbc_status = wbcAddNamedBlob(&logon.num_blobs,
+				     &logon.blobs,
+				     "flags",
+				     0,
+				     (uint8_t *)&flags,
+				     sizeof(flags));
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		goto done;
+	}
+
+	wbc_status = wbcAddNamedBlob(&logon.num_blobs,
+				     &logon.blobs,
+				     "user_uid",
+				     0,
+				     (uint8_t *)&user_uid,
+				     sizeof(user_uid));
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		goto done;
+	}
+
+	wbc_status = wbcAddNamedBlob(&logon.num_blobs,
+				     &logon.blobs,
+				     "membership_of",
+				     0,
+				     (uint8_t *)membership_of,
+				     sizeof(membership_of));
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		goto done;
 	}
 
-	if (p_response) {
-		/* We want to process the response in the caller. */
-		*p_response = response;
+	wbc_status = wbcLogonUser(&logon, &info, &error, &policy);
+	ret = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
+					  user, "wbcLogonUser");
+	wbcFreeMemory(logon.blobs);
+	logon.blobs = NULL;
+
+	if (info && info->info) {
+		user_info = info->info;
+	}
+
+	if (pwd_last_set && user_info) {
+		*pwd_last_set = user_info->pass_last_set_time;
+	}
+
+	if (p_info && info) {
+		*p_info = info;
+	}
+
+	if (p_policy && policy) {
+		*p_policy = policy;
+	}
+
+	if (p_error && error) {
+		/* We want to process the error in the caller. */
+		*p_error = error;
 		return ret;
 	}
 
-	if (ret) {
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_PASSWORD_EXPIRED");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_PASSWORD_MUST_CHANGE");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_INVALID_WORKSTATION");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_INVALID_LOGON_HOURS");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_ACCOUNT_EXPIRED");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_ACCOUNT_DISABLED");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_ACCOUNT_LOCKED_OUT");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_NO_LOGON_SERVERS");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_WRONG_PASSWORD");
-		PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-						 "NT_STATUS_ACCESS_DENIED");
+	for (i=0; i<ARRAY_SIZE(codes); i++) {
+		int _ret = ret;
+		if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
+			ret = _ret;
+			goto done;
+		}
 	}
 
-	if (ret == PAM_SUCCESS) {
+	if ((ret == PAM_SUCCESS) && user_info && policy && info) {
+
+		bool already_expired = false;
 
 		/* warn a user if the password is about to expire soon */
-		_pam_warn_password_expiry(ctx, &response,
+		_pam_warn_password_expiry(ctx, user_info, policy,
 					  warn_pwd_expire,
 					  &already_expired);
 
 		if (already_expired == true) {
-			SMB_TIME_T last_set;
-			last_set = response.data.auth.info3.pass_last_set_time;
+
+			SMB_TIME_T last_set = user_info->pass_last_set_time;
+
 			_pam_log_debug(ctx, LOG_DEBUG,
 				       "Password has expired "
 				       "(Password was last set: %lld, "
@@ -1445,33 +1711,44 @@ static int winbind_auth_request(struct pwb_context *ctx,
 				       "%lld (now it's: %lu))\n",
 				       (long long int)last_set,
 				       (long long int)last_set +
-				       response.data.auth.policy.expire,
+				       policy->expire,
 				       time(NULL));
 
 			return PAM_AUTHTOK_EXPIRED;
 		}
 
 		/* inform about logon type */
-		_pam_warn_logon_type(ctx, user,
-				     response.data.auth.info3.user_flgs);
+		_pam_warn_logon_type(ctx, user, user_info->user_flags);
 
 		/* inform about krb5 failures */
-		_pam_warn_krb5_failure(ctx, user,
-				       response.data.auth.info3.user_flgs);
+		_pam_warn_krb5_failure(ctx, user, user_info->user_flags);
 
 		/* set some info3 info for other modules in the stack */
-		_pam_set_data_info3(ctx, &response);
+		_pam_set_data_info3(ctx, user_info);
 
 		/* put krb5ccname into env */
-		_pam_setup_krb5_env(ctx, response.data.auth.krb5ccname);
+		_pam_setup_krb5_env(ctx, info);
 
 		/* If winbindd returned a username, return the pointer to it
 		 * here. */
-		if (user_ret && response.data.auth.unix_username[0]) {
-			/* We have to trust it's a null terminated string. */
-			*user_ret = strndup(response.data.auth.unix_username,
-				    sizeof(response.data.auth.unix_username) - 1);
-		}
+		_pam_setup_unix_username(ctx, user_ret, info);
+	}
+
+ done:
+	if (logon.blobs) {
+		wbcFreeMemory(logon.blobs);
+	}
+	if (info && info->blobs) {
+		wbcFreeMemory(info->blobs);
+	}
+	if (error && !p_error) {
+		wbcFreeMemory(error);
+	}
+	if (info && !p_info) {
+		wbcFreeMemory(info);
+	}
+	if (policy && !p_policy) {
+		wbcFreeMemory(policy);
 	}
 
 	return ret;
@@ -1484,99 +1761,95 @@ static int winbind_chauthtok_request(struct pwb_context *ctx,
 				     const char *newpass,
 				     time_t pwd_last_set)
 {
-	struct winbindd_request request;
-	struct winbindd_response response;
-	int ret;
+	wbcErr wbc_status;
+	struct wbcChangePasswordParams params;
+	struct wbcAuthErrorInfo *error = NULL;
+	struct wbcUserPasswordPolicyInfo *policy = NULL;
+	enum wbcPasswordChangeRejectReason reject_reason = -1;
+	uint32_t flags = 0;
 
-	ZERO_STRUCT(request);
-	ZERO_STRUCT(response);
+	int i;
+	const char *codes[] = {
+		"NT_STATUS_BACKUP_CONTROLLER",
+		"NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
+		"NT_STATUS_NO_LOGON_SERVERS",
+		"NT_STATUS_ACCESS_DENIED",
+		"NT_STATUS_PWD_TOO_SHORT", /* TODO: tell the min pwd length ? */
+		"NT_STATUS_PWD_TOO_RECENT", /* TODO: tell the minage ? */
+		"NT_STATUS_PWD_HISTORY_CONFLICT" /* TODO: tell the history length ? */
+	};
+	int ret = PAM_AUTH_ERR;
+
+	ZERO_STRUCT(params);
 
-	if (request.data.chauthtok.user == NULL) {
-		return -2;
+	if (ctx->ctrl & WINBIND_KRB5_AUTH) {
+		flags |= WBFLAG_PAM_KRB5 |
+			 WBFLAG_PAM_CONTACT_TRUSTDOM;
 	}
 
-	strncpy(request.data.chauthtok.user, user,
-		sizeof(request.data.chauthtok.user) - 1);
-
-	if (oldpass != NULL) {
-		strncpy(request.data.chauthtok.oldpass, oldpass,
-			sizeof(request.data.chauthtok.oldpass) - 1);
-	} else {
-		request.data.chauthtok.oldpass[0] = '\0';
+	if (ctx->ctrl & WINBIND_CACHED_LOGIN) {
+		flags |= WBFLAG_PAM_CACHED_LOGIN;
 	}
 
-	if (newpass != NULL) {
-		strncpy(request.data.chauthtok.newpass, newpass,
-			sizeof(request.data.chauthtok.newpass) - 1);
-	} else {
-		request.data.chauthtok.newpass[0] = '\0';
-	}
+	params.account_name		= user;
+	params.level			= WBC_AUTH_USER_LEVEL_PLAIN;
+	params.old_password.plaintext	= oldpass;
+	params.new_password.plaintext	= newpass;
+	params.flags			= flags;
 
-	if (ctx->ctrl & WINBIND_KRB5_AUTH) {
-		request.flags = WBFLAG_PAM_KRB5 |
-				WBFLAG_PAM_CONTACT_TRUSTDOM;
-	}
+	wbc_status = wbcChangeUserPasswordEx(&params, &error, &reject_reason, &policy);
+	ret = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
+					  user, "wbcChangeUserPasswordEx");
 
-	if (ctx->ctrl & WINBIND_CACHED_LOGIN) {
-		request.flags |= WBFLAG_PAM_CACHED_LOGIN;
+	if (WBC_ERROR_IS_OK(wbc_status)) {
+		_pam_log(ctx, LOG_NOTICE,
+			 "user '%s' password changed", user);
+		return PAM_SUCCESS;
 	}
 
-	ret = pam_winbind_request_log(ctx, WINBINDD_PAM_CHAUTHTOK,
-				      &request, &response, user);
-
-	if (ret == PAM_SUCCESS) {
+	if (!error) {
+		wbcFreeMemory(policy);
 		return ret;
 	}
 
-	PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-					 "NT_STATUS_BACKUP_CONTROLLER");
-	PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-					 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND");
-	PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-					 "NT_STATUS_NO_LOGON_SERVERS");
-	PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-					 "NT_STATUS_ACCESS_DENIED");
-
-	/* TODO: tell the min pwd length ? */
-	PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-					 "NT_STATUS_PWD_TOO_SHORT");
-
-	/* TODO: tell the minage ? */
-	PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-					 "NT_STATUS_PWD_TOO_RECENT");
-
-	/* TODO: tell the history length ? */
-	PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx, response,
-					 "NT_STATUS_PWD_HISTORY_CONFLICT");
+	for (i=0; i<ARRAY_SIZE(codes); i++) {
+		int _ret = ret;
+		if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
+			ret = _ret;
+			goto done;
+		}
+	}
 
-	if (!strcasecmp(response.data.auth.nt_status_string,
+	if (!strcasecmp(error->nt_string,
 			"NT_STATUS_PASSWORD_RESTRICTION")) {
 
 		char *pwd_restriction_string = NULL;
-		SMB_TIME_T min_pwd_age;
-		uint32_t reject_reason = response.data.auth.reject_reason;
-		min_pwd_age = response.data.auth.policy.min_passwordage;
+		SMB_TIME_T min_pwd_age = 0;
+
+		if (policy) {
+			min_pwd_age	= policy->min_passwordage;
+		}
 
 		/* FIXME: avoid to send multiple PAM messages after another */
 		switch (reject_reason) {
 			case -1:
 				break;
-			case SAMR_REJECT_OTHER:
+			case WBC_PWD_CHANGE_REJECT_OTHER:
 				if ((min_pwd_age > 0) &&
 				    (pwd_last_set + min_pwd_age > time(NULL))) {
 					PAM_WB_REMARK_DIRECT(ctx,
 					     "NT_STATUS_PWD_TOO_RECENT");
 				}
 				break;
-			case SAMR_REJECT_TOO_SHORT:
+			case WBC_PWD_CHANGE_REJECT_TOO_SHORT:
 				PAM_WB_REMARK_DIRECT(ctx,
 					"NT_STATUS_PWD_TOO_SHORT");
 				break;
-			case SAMR_REJECT_IN_HISTORY:
+			case WBC_PWD_CHANGE_REJECT_IN_HISTORY:
 				PAM_WB_REMARK_DIRECT(ctx,
 					"NT_STATUS_PWD_HISTORY_CONFLICT");
 				break;
-			case SAMR_REJECT_COMPLEXITY:
+			case WBC_PWD_CHANGE_REJECT_COMPLEXITY:
 				_make_remark(ctx, PAM_ERROR_MSG,
 					     "Password does not meet "
 					     "complexity requirements");
@@ -1590,13 +1863,16 @@ static int winbind_chauthtok_request(struct pwb_context *ctx,
 		}
 
 		pwd_restriction_string =
-			_pam_compose_pwd_restriction_string(&response);
+			_pam_compose_pwd_restriction_string(ctx, policy);
 		if (pwd_restriction_string) {
 			_make_remark(ctx, PAM_ERROR_MSG,
 				     pwd_restriction_string);
-			SAFE_FREE(pwd_restriction_string);
+			TALLOC_FREE(pwd_restriction_string);
 		}
 	}
+ done:
+	wbcFreeMemory(error);
+	wbcFreeMemory(policy);
 
 	return ret;
 }
@@ -1616,29 +1892,26 @@ static int valid_user(struct pwb_context *ctx,
 	 * sure it's really a winbind user, this is important when stacking PAM
 	 * modules in the 'account' or 'password' facility. */
 
+	wbcErr wbc_status;
 	struct passwd *pwd = NULL;
-	struct winbindd_request request;
-	struct winbindd_response response;
-	int ret;
-
-	ZERO_STRUCT(request);
-	ZERO_STRUCT(response);
+	struct passwd *wb_pwd = NULL;
 
 	pwd = getpwnam(user);
 	if (pwd == NULL) {
 		return 1;
 	}
 
-	strncpy(request.data.username, user,
-		sizeof(request.data.username) - 1);
-
-	ret = pam_winbind_request_log(ctx, WINBINDD_GETPWNAM,
-				      &request, &response, user);
+	wbc_status = wbcGetpwnam(user, &wb_pwd);
+	wbcFreeMemory(wb_pwd);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		_pam_log(ctx, LOG_DEBUG, "valid_user: wbcGetpwnam gave %s\n",
+			wbcErrorString(wbc_status));
+	}
 
-	switch (ret) {
-		case PAM_USER_UNKNOWN:
+	switch (wbc_status) {
+		case WBC_ERR_UNKNOWN_USER:
 			return 1;
-		case PAM_SUCCESS:
+		case WBC_ERR_SUCCESS:
 			return 0;
 		default:
 			break;
@@ -1846,12 +2119,13 @@ static const char *get_conf_item_string(struct pwb_context *ctx,
 	if (ctx->dict) {
 		char *key = NULL;
 
-		if (!asprintf(&key, "global:%s", item)) {
+		key = talloc_asprintf(ctx, "global:%s", item);
+		if (!key) {
 			goto out;
 		}
 
 		parm_opt = iniparser_getstr(ctx->dict, key);
-		SAFE_FREE(key);
+		TALLOC_FREE(key);
 
 		_pam_log_debug(ctx, LOG_INFO, "CONFIG file: %s '%s'\n",
 			       item, parm_opt);
@@ -1893,12 +2167,13 @@ static int get_config_item_int(struct pwb_context *ctx,
 	if (ctx->dict) {
 		char *key = NULL;
 
-		if (!asprintf(&key, "global:%s", item)) {
+		key = talloc_asprintf(ctx, "global:%s", item);
+		if (!key) {
 			goto out;
 		}
 
 		parm_opt = iniparser_getint(ctx->dict, key, -1);
-		SAFE_FREE(key);
+		TALLOC_FREE(key);
 
 		_pam_log_debug(ctx, LOG_INFO,
 			       "CONFIG file: %s '%d'\n",
@@ -1948,20 +2223,25 @@ static int get_warn_pwd_expire_from_config(struct pwb_context *ctx)
 
 static char winbind_get_separator(struct pwb_context *ctx)
 {
-	struct winbindd_request request;
-	struct winbindd_response response;
+	wbcErr wbc_status;
+	static struct wbcInterfaceDetails *details = NULL;
 
-	ZERO_STRUCT(request);
-	ZERO_STRUCT(response);
+	wbc_status = wbcInterfaceDetails(&details);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		_pam_log(ctx, LOG_ERR,
+			 "Could not retrieve winbind interface details: %s",
+			 wbcErrorString(wbc_status));
+		return '\0';
+	}
 
-	if (pam_winbind_request_log(ctx, WINBINDD_INFO,
-				    &request, &response, NULL)) {
+	if (!details) {
 		return '\0';
 	}
 
-	return response.data.info.winbind_separator;
+	return details->winbind_separator;
 }
 
+
 /**
  * Convert a upn to a name.
  *
@@ -1974,12 +2254,12 @@ static char winbind_get_separator(struct pwb_context *ctx)
 static char* winbind_upn_to_username(struct pwb_context *ctx,
 				     const char *upn)
 {
-	struct winbindd_request req;
-	struct winbindd_response resp;
-	int retval;
-	char *account_name;
-	int account_name_len;
 	char sep;
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	struct wbcDomainSid sid;
+	enum wbcSidType type;
+	char *domain;
+	char *name;
 
 	/* This cannot work when the winbind separator = @ */
 
@@ -1990,35 +2270,19 @@ static char* winbind_upn_to_username(struct pwb_context *ctx,
 
 	/* Convert the UPN to a SID */
 
-	ZERO_STRUCT(req);
-	ZERO_STRUCT(resp);
-
-	strncpy(req.data.name.dom_name, "",
-		sizeof(req.data.name.dom_name) - 1);
-	strncpy(req.data.name.name, upn,
-		sizeof(req.data.name.name) - 1);
-	retval = pam_winbind_request_log(ctx, WINBINDD_LOOKUPNAME,
-					 &req, &resp, upn);
-	if (retval != PAM_SUCCESS) {
+	wbc_status = wbcLookupName("", upn, &sid, &type);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
 		return NULL;
 	}
 
 	/* Convert the the SID back to the sAMAccountName */
 
-	ZERO_STRUCT(req);
-	strncpy(req.data.sid, resp.data.sid.sid, sizeof(req.data.sid)-1);
-	ZERO_STRUCT(resp);
-	retval =  pam_winbind_request_log(ctx, WINBINDD_LOOKUPSID,
-					  &req, &resp, upn);
-	if (retval != PAM_SUCCESS) {
+	wbc_status = wbcLookupSid(&sid, &domain, &name, &type);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
 		return NULL;
 	}
 
-	account_name_len = asprintf(&account_name, "%s\\%s",
-				    resp.data.name.dom_name,
-				    resp.data.name.name);
-
-	return account_name;
+	return talloc_asprintf(ctx, "%s\\%s", domain, name);
 }
 
 PAM_EXTERN
@@ -2087,7 +2351,7 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
 							 real_username);
 		if (samaccountname) {
 			free(real_username);
-			real_username = samaccountname;
+			real_username = strdup(samaccountname);
 		}
 	}
 
@@ -2119,7 +2383,8 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
 
 	/* Now use the username to look up password */
 	retval = winbind_auth_request(ctx, real_username, password,
-				      member, cctype, warn_pwd_expire, NULL,
+				      member, cctype, warn_pwd_expire,
+				      NULL, NULL, NULL,
 				      NULL, &username_ret);
 
 	if (retval == PAM_NEW_AUTHTOK_REQD ||
@@ -2127,7 +2392,8 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
 
 		char *new_authtok_required_during_auth = NULL;
 
-		if (!asprintf(&new_authtok_required, "%d", retval)) {
+		new_authtok_required = talloc_asprintf(NULL, "%d", retval);
+		if (!new_authtok_required) {
 			retval = PAM_BUF_ERR;
 			goto out;
 		}
@@ -2138,7 +2404,8 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags,
 
 		retval = PAM_SUCCESS;
 
-		if (!asprintf(&new_authtok_required_during_auth, "%d", true)) {
+		new_authtok_required_during_auth = talloc_asprintf(NULL, "%d", true);
+		if (!new_authtok_required_during_auth) {
 			retval = PAM_BUF_ERR;
 			goto out;
 		}
@@ -2172,7 +2439,7 @@ out:
 
 	_PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx, retval);
 
-	_pam_winbind_free_context(ctx);
+	TALLOC_FREE(ctx);
 
 	return retval;
 }
@@ -2220,7 +2487,7 @@ int pam_sm_setcred(pam_handle_t *pamh, int flags,
 
 	_PAM_LOG_FUNCTION_LEAVE("pam_sm_setcred", ctx, ret);
 
-	_pam_winbind_free_context(ctx);
+	TALLOC_FREE(ctx);
 
 	return ret;
 }
@@ -2321,7 +2588,7 @@ int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
 
 	_PAM_LOG_FUNCTION_LEAVE("pam_sm_acct_mgmt", ctx, ret);
 
-	_pam_winbind_free_context(ctx);
+	TALLOC_FREE(ctx);
 
 	return ret;
 }
@@ -2330,7 +2597,7 @@ PAM_EXTERN
 int pam_sm_open_session(pam_handle_t *pamh, int flags,
 			int argc, const char **argv)
 {
-	int ret = PAM_SYSTEM_ERR;
+	int ret = PAM_SUCCESS;
 	struct pwb_context *ctx = NULL;
 
 	ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
@@ -2340,12 +2607,14 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags,
 
 	_PAM_LOG_FUNCTION_ENTER("pam_sm_open_session", ctx);
 
-	ret = PAM_SUCCESS;
-
+	if (ctx->ctrl & WINBIND_MKHOMEDIR) {
+		/* check and create homedir */
+		ret = _pam_mkhomedir(ctx);
+	}
  out:
 	_PAM_LOG_FUNCTION_LEAVE("pam_sm_open_session", ctx, ret);
 
-	_pam_winbind_free_context(ctx);
+	TALLOC_FREE(ctx);
 
 	return ret;
 }
@@ -2356,6 +2625,7 @@ int pam_sm_close_session(pam_handle_t *pamh, int flags,
 {
 	int retval = PAM_SUCCESS;
 	struct pwb_context *ctx = NULL;
+	struct wbcLogoffUserParams logoff;
 
 	retval = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
 	if (retval) {
@@ -2372,15 +2642,15 @@ int pam_sm_close_session(pam_handle_t *pamh, int flags,
 	if (ctx->ctrl & WINBIND_KRB5_AUTH) {
 
 		/* destroy the ccache here */
-		struct winbindd_request request;
-		struct winbindd_response response;
+
+		wbcErr wbc_status;
+		struct wbcAuthErrorInfo *error = NULL;
+
+		uint32_t flags = 0;
 		const char *user;
 		const char *ccname = NULL;
 		struct passwd *pwd = NULL;
 
-		ZERO_STRUCT(request);
-		ZERO_STRUCT(response);
-
 		retval = pam_get_user(pamh, &user, "Username: ");
 		if (retval) {
 			_pam_log(ctx, LOG_ERR,
@@ -2404,34 +2674,70 @@ int pam_sm_close_session(pam_handle_t *pamh, int flags,
 				       "user has no KRB5CCNAME environment");
 		}
 
-		strncpy(request.data.logoff.user, user,
-			sizeof(request.data.logoff.user) - 1);
-
-		if (ccname) {
-			strncpy(request.data.logoff.krb5ccname, ccname,
-				sizeof(request.data.logoff.krb5ccname) - 1);
-		}
-
 		pwd = getpwnam(user);
 		if (pwd == NULL) {
 			retval = PAM_USER_UNKNOWN;
 			goto out;
 		}
-		request.data.logoff.uid = pwd->pw_uid;
 
-		request.flags = WBFLAG_PAM_KRB5 |
-				WBFLAG_PAM_CONTACT_TRUSTDOM;
+		flags = WBFLAG_PAM_KRB5 |
+			WBFLAG_PAM_CONTACT_TRUSTDOM;
+
+		ZERO_STRUCT(logoff);
+
+		logoff.username		= user;
 
-	        retval = pam_winbind_request_log(ctx,
-						 WINBINDD_PAM_LOGOFF,
-						 &request, &response, user);
+		wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
+					     &logoff.blobs,
+					     "ccfilename",
+					     0,
+					     (uint8_t *)ccname,
+					     strlen(ccname)+1);
+		if (!WBC_ERROR_IS_OK(wbc_status)) {
+			goto out;
+		}
+
+		wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
+					     &logoff.blobs,
+					     "flags",
+					     0,
+					     (uint8_t *)&flags,
+					     sizeof(flags));
+		if (!WBC_ERROR_IS_OK(wbc_status)) {
+			goto out;
+		}
+
+		wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
+					     &logoff.blobs,
+					     "user_uid",
+					     0,
+					     (uint8_t *)&pwd->pw_uid,
+					     sizeof(pwd->pw_uid));
+		if (!WBC_ERROR_IS_OK(wbc_status)) {
+			goto out;
+		}
+
+		wbc_status = wbcLogoffUserEx(&logoff, &error);
+		retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
+						     user, "wbcLogoffUser");
+		wbcFreeMemory(error);
+		wbcFreeMemory(logoff.blobs);
+
+		if (!WBC_ERROR_IS_OK(wbc_status)) {
+			_pam_log(ctx, LOG_INFO,
+				 "failed to logoff user %s: %s\n",
+					 user, wbcErrorString(wbc_status));
+		}
 	}
 
 out:
+	if (logoff.blobs) {
+		wbcFreeMemory(logoff.blobs);
+	}
 
 	_PAM_LOG_FUNCTION_LEAVE("pam_sm_close_session", ctx, retval);
 
-	_pam_winbind_free_context(ctx);
+	TALLOC_FREE(ctx);
 
 	return retval;
 }
@@ -2503,11 +2809,9 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 
 	int retry = 0;
 	char *username_ret = NULL;
-	struct winbindd_response response;
+	struct wbcAuthErrorInfo *error = NULL;
 	struct pwb_context *ctx = NULL;
 
-	ZERO_STRUCT(response);
-
 	ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
 	if (ret) {
 		goto out;
@@ -2560,16 +2864,15 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 		time_t pwdlastset_prelim = 0;
 
 		/* instruct user what is happening */
-#define greeting "Changing password for "
-		Announce = (char *) malloc(sizeof(greeting) + strlen(user));
-		if (Announce == NULL) {
+
+#define greeting "Changing password for"
+		Announce = talloc_asprintf(ctx, "%s %s", greeting, user);
+		if (!Announce) {
 			_pam_log(ctx, LOG_CRIT,
 				 "password - out of memory");
 			ret = PAM_BUF_ERR;
 			goto out;
 		}
-		(void) strcpy(Announce, greeting);
-		(void) strcpy(Announce + sizeof(greeting) - 1, user);
 #undef greeting
 
 		lctrl = ctx->ctrl | WINBIND__OLD_PASSWORD;
@@ -2578,6 +2881,7 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 						"(current) NT password: ",
 						NULL,
 						(const char **) &pass_old);
+		TALLOC_FREE(Announce);
 		if (ret != PAM_SUCCESS) {
 			_pam_log(ctx, LOG_NOTICE,
 				 "password - (old) token not obtained");
@@ -2587,7 +2891,8 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 		/* verify that this is the password for this user */
 
 		ret = winbind_auth_request(ctx, user, pass_old,
-					   NULL, NULL, 0, &response,
+					   NULL, NULL, 0,
+					   &error, NULL, NULL,
 					   &pwdlastset_prelim, NULL);
 
 		if (ret != PAM_ACCT_EXPIRED &&
@@ -2696,6 +3001,8 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 			const char *member = NULL;
 			const char *cctype = NULL;
 			int warn_pwd_expire;
+			struct wbcLogonUserInfo *info = NULL;
+			struct wbcUserPasswordPolicyInfo *policy = NULL;
 
 			member = get_member_from_config(ctx);
 			cctype = get_krb5_cc_type_from_config(ctx);
@@ -2710,7 +3017,8 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 			 * */
 
 			ret = winbind_auth_request(ctx, user, pass_new,
-						   member, cctype, 0, &response,
+						   member, cctype, 0,
+						   &error, &info, &policy,
 						   NULL, &username_ret);
 			_pam_overwrite(pass_new);
 			_pam_overwrite(pass_old);
@@ -2718,19 +3026,24 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 
 			if (ret == PAM_SUCCESS) {
 
+				struct wbcAuthUserInfo *user_info = NULL;
+
+				if (info && info->info) {
+					user_info = info->info;
+				}
+
 				/* warn a user if the password is about to
 				 * expire soon */
-				_pam_warn_password_expiry(ctx, &response,
+				_pam_warn_password_expiry(ctx, user_info, policy,
 							  warn_pwd_expire,
 							  NULL);
 
 				/* set some info3 info for other modules in the
 				 * stack */
-				_pam_set_data_info3(ctx, &response);
+				_pam_set_data_info3(ctx, user_info);
 
 				/* put krb5ccname into env */
-				_pam_setup_krb5_env(ctx,
-						    response.data.auth.krb5ccname);
+				_pam_setup_krb5_env(ctx, info);
 
 				if (username_ret) {
 					pam_set_item(pamh, PAM_USER,
@@ -2740,6 +3053,9 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 						       username_ret);
 					free(username_ret);
 				}
+
+				wbcFreeMemory(info);
+				wbcFreeMemory(policy);
 			}
 
 			goto out;
@@ -2749,18 +3065,28 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 	}
 
 out:
+	{
+		/* Deal with offline errors. */
+		int i;
+		const char *codes[] = {
+			"NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
+			"NT_STATUS_NO_LOGON_SERVERS",
+			"NT_STATUS_ACCESS_DENIED"
+		};
+
+		for (i=0; i<ARRAY_SIZE(codes); i++) {
+			int _ret;
+			if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
+				break;
+			}
+		}
+	}
 
-	/* Deal with offline errors. */
-	PAM_WB_REMARK_CHECK_RESPONSE(ctx, response,
-				     "NT_STATUS_NO_LOGON_SERVERS");
-	PAM_WB_REMARK_CHECK_RESPONSE(ctx, response,
-				     "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND");
-	PAM_WB_REMARK_CHECK_RESPONSE(ctx, response,
-				     "NT_STATUS_ACCESS_DENIED");
+	wbcFreeMemory(error);
 
 	_PAM_LOG_FUNCTION_LEAVE("pam_sm_chauthtok", ctx, ret);
 
-	_pam_winbind_free_context(ctx);
+	TALLOC_FREE(ctx);
 
 	return ret;
 }
diff --git a/source3/nsswitch/pam_winbind.h b/source3/nsswitch/pam_winbind.h
index 6dba127cdc..cb6f450ccb 100644
--- a/source3/nsswitch/pam_winbind.h
+++ b/source3/nsswitch/pam_winbind.h
@@ -7,6 +7,8 @@
 #include "../lib/replace/replace.h"
 #include "system/syslog.h"
 #include "system/time.h"
+#include <talloc.h>
+#include "libwbclient/wbclient.h"
 
 #define MODULE_NAME "pam_winbind"
 #define PAM_SM_AUTH
@@ -97,6 +99,7 @@ do {                             \
 #define WINBIND_SILENT			0x00000800
 #define WINBIND_DEBUG_STATE		0x00001000
 #define WINBIND_WARN_PWD_EXPIRE		0x00002000
+#define WINBIND_MKHOMEDIR		0x00004000
 
 /*
  * here is the string to inform the user that the new passwords they
@@ -133,73 +136,11 @@ do {                             \
 	};\
 };
 
-#define PAM_WB_REMARK_DIRECT_RET(h,f,x)\
-{\
-	const char *error_string = NULL; \
-	error_string = _get_ntstatus_error_string(x);\
-	if (error_string != NULL) {\
-		_make_remark(h, f, PAM_ERROR_MSG, error_string);\
-		return ret;\
-	};\
-	_make_remark(h, f, PAM_ERROR_MSG, x);\
-	return ret;\
-};
-
-#define PAM_WB_REMARK_CHECK_RESPONSE(c,x,y)\
-{\
-	const char *ntstatus = x.data.auth.nt_status_string; \
-	const char *error_string = NULL; \
-	if (!strcasecmp(ntstatus,y)) {\
-		error_string = _get_ntstatus_error_string(y);\
-		if (error_string != NULL) {\
-			_make_remark(c, PAM_ERROR_MSG, error_string);\
-		};\
-		if (x.data.auth.error_string[0] != '\0') {\
-			_make_remark(c, PAM_ERROR_MSG, x.data.auth.error_string);\
-		};\
-		_make_remark(c, PAM_ERROR_MSG, y);\
-	};\
-};
-
-#define PAM_WB_REMARK_CHECK_RESPONSE_RET(c,x,y)\
-{\
-	const char *ntstatus = x.data.auth.nt_status_string; \
-	const char *error_string = NULL; \
-	if (!strcasecmp(ntstatus,y)) {\
-		error_string = _get_ntstatus_error_string(y);\
-		if (error_string != NULL) {\
-			_make_remark(c, PAM_ERROR_MSG, error_string);\
-			return ret;\
-		};\
-		if (x.data.auth.error_string[0] != '\0') {\
-			_make_remark(c, PAM_ERROR_MSG, x.data.auth.error_string);\
-			return ret;\
-		};\
-		_make_remark(c, PAM_ERROR_MSG, y);\
-		return ret;\
-	};\
-};
-
-/* from samr.idl */
-#define DOMAIN_PASSWORD_COMPLEX		0x00000001
-
-#define SAMR_REJECT_OTHER		0x00000000
-#define SAMR_REJECT_TOO_SHORT		0x00000001
-#define SAMR_REJECT_IN_HISTORY		0x00000002
-#define SAMR_REJECT_COMPLEXITY		0x00000005
-
-#define ACB_PWNOEXP			0x00000200
-
-/* from netlogon.idl */
-#define NETLOGON_CACHED_ACCOUNT		0x00000004
-#define NETLOGON_GRACE_LOGON		0x01000000
-
-/* from include/rpc_netlogon.h */
 #define LOGON_KRB5_FAIL_CLOCK_SKEW	0x02000000
 
-#define PAM_WB_CACHED_LOGON(x) (x & NETLOGON_CACHED_ACCOUNT)
+#define PAM_WB_CACHED_LOGON(x) (x & WBC_AUTH_USER_INFO_CACHED_ACCOUNT)
 #define PAM_WB_KRB5_CLOCK_SKEW(x) (x & LOGON_KRB5_FAIL_CLOCK_SKEW)
-#define PAM_WB_GRACE_LOGON(x)  ((NETLOGON_CACHED_ACCOUNT|NETLOGON_GRACE_LOGON) == ( x & (NETLOGON_CACHED_ACCOUNT|NETLOGON_GRACE_LOGON)))
+#define PAM_WB_GRACE_LOGON(x)  ((WBC_AUTH_USER_INFO_CACHED_ACCOUNT|WBC_AUTH_USER_INFO_GRACE_LOGON) == ( x & (WBC_AUTH_USER_INFO_CACHED_ACCOUNT|WBC_AUTH_USER_INFO_GRACE_LOGON)))
 
 struct pwb_context {
 	pam_handle_t *pamh;
@@ -209,3 +150,8 @@ struct pwb_context {
 	dictionary *dict;
 	uint32_t ctrl;
 };
+
+#define TALLOC_FREE(ctx) do { if ((ctx) != NULL) {talloc_free(ctx); ctx=NULL;} } while(0)
+#define TALLOC_ZERO_P(ctx, type) (type *)_talloc_zero(ctx, sizeof(type), #type)
+#define TALLOC_P(ctx, type) (type *)talloc_named_const(ctx, sizeof(type), #type)
+
diff --git a/source3/nsswitch/wbinfo.c b/source3/nsswitch/wbinfo.c
index 60524d1d1b..fc49be4314 100644
--- a/source3/nsswitch/wbinfo.c
+++ b/source3/nsswitch/wbinfo.c
@@ -538,8 +538,8 @@ static bool wbinfo_dsgetdcname(const char *domain_name, uint32_t flags)
 	ZERO_STRUCT(request);
 	ZERO_STRUCT(response);
 
-	fstrcpy(request.domain_name, domain_name);
-	request.flags = flags;
+	fstrcpy(request.data.dsgetdcname.domain_name, domain_name);
+	request.data.dsgetdcname.flags = flags;
 
 	request.flags |= DS_DIRECTORY_SERVICE_REQUIRED;
 
@@ -553,7 +553,15 @@ static bool wbinfo_dsgetdcname(const char *domain_name, uint32_t flags)
 
 	/* Display response */
 
-	d_printf("%s\n", response.data.dc_name);
+	d_printf("%s\n", response.data.dsgetdcname.dc_unc);
+	d_printf("%s\n", response.data.dsgetdcname.dc_address);
+	d_printf("%d\n", response.data.dsgetdcname.dc_address_type);
+	d_printf("%s\n", response.data.dsgetdcname.domain_guid);
+	d_printf("%s\n", response.data.dsgetdcname.domain_name);
+	d_printf("%s\n", response.data.dsgetdcname.forest_name);
+	d_printf("0x%08x\n", response.data.dsgetdcname.dc_flags);
+	d_printf("%s\n", response.data.dsgetdcname.dc_site_name);
+	d_printf("%s\n", response.data.dsgetdcname.client_site_name);
 
 	return true;
 }
diff --git a/source3/nsswitch/winbind_krb5_locator.c b/source3/nsswitch/winbind_krb5_locator.c
index 990c2cae50..b9e35bdec5 100644
--- a/source3/nsswitch/winbind_krb5_locator.c
+++ b/source3/nsswitch/winbind_krb5_locator.c
@@ -1,7 +1,7 @@
 /*
    Unix SMB/CIFS implementation.
    kerberos locator plugin
-   Copyright (C) Guenther Deschner 2007
+   Copyright (C) Guenther Deschner 2007-2008
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -18,6 +18,7 @@
 */
 
 #include "nsswitch/winbind_client.h"
+#include "libwbclient/wbclient.h"
 
 #ifndef DEBUG_KRB5
 #undef DEBUG_KRB5
@@ -244,37 +245,50 @@ static void smb_krb5_locator_close(void *private_data)
 
 static bool ask_winbind(const char *realm, char **dcname)
 {
-	NSS_STATUS status;
-	struct winbindd_request request;
-	struct winbindd_response response;
+	wbcErr wbc_status;
+	const char *dc = NULL;
+	struct wbcDomainControllerInfoEx *dc_info = NULL;
+	uint32_t flags;
 
-	ZERO_STRUCT(request);
-	ZERO_STRUCT(response);
+	flags = WBC_LOOKUP_DC_KDC_REQUIRED |
+		WBC_LOOKUP_DC_IS_DNS_NAME |
+		WBC_LOOKUP_DC_RETURN_DNS_NAME |
+		WBC_LOOKUP_DC_IP_REQUIRED;
 
-	request.flags = 0x40020600;
-			/* DS_KDC_REQUIRED |
-			DS_IS_DNS_NAME |
-			DS_RETURN_DNS_NAME |
-			DS_IP_REQUIRED */
+	wbc_status = wbcLookupDomainControllerEx(realm, NULL, NULL, flags, &dc_info);
 
-	strncpy(request.domain_name, realm,
-		sizeof(request.domain_name)-1);
-
-	status = winbindd_request_response(WINBINDD_DSGETDCNAME,
-					   &request, &response);
-	if (status != NSS_STATUS_SUCCESS) {
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
 #ifdef DEBUG_KRB5
 		fprintf(stderr,"[%5u]: smb_krb5_locator_lookup: failed with: %s\n",
-			(unsigned int)getpid(), nss_err_str(status));
+			(unsigned int)getpid(), wbcErrorString(wbc_status));
 #endif
 		return false;
 	}
 
-	*dcname = strdup(response.data.dc_name);
+	if (dc_info->dc_address) {
+		dc = dc_info->dc_address;
+		if (dc[0] == '\\') dc++;
+		if (dc[0] == '\\') dc++;
+	}
+
+	if (!dc && dc_info->dc_unc) {
+		dc = dc_info->dc_unc;
+		if (dc[0] == '\\') dc++;
+		if (dc[0] == '\\') dc++;
+	}
+
+	if (!dc) {
+		wbcFreeMemory(dc_info);
+		return false;
+	}
+
+	*dcname = strdup(dc);
 	if (!*dcname) {
+		wbcFreeMemory(dc_info);
 		return false;
 	}
 
+	wbcFreeMemory(dc_info);
 	return true;
 }
 
diff --git a/source3/nsswitch/winbind_struct_protocol.h b/source3/nsswitch/winbind_struct_protocol.h
index e81813c77b..ff52dbddaf 100644
--- a/source3/nsswitch/winbind_struct_protocol.h
+++ b/source3/nsswitch/winbind_struct_protocol.h
@@ -313,6 +313,12 @@ struct winbindd_request {
 			uint32_t initial_blob_len; /* blobs in extra_data */
 			uint32_t challenge_blob_len;
 		} ccache_ntlm_auth;
+		struct {
+			fstring domain_name;
+			fstring domain_guid;
+			fstring site_name;
+			uint32_t flags;
+		} dsgetdcname;
 
 		/* padding -- needed to fix alignment between 32bit and 64bit libs.
 		   The size is the sizeof the union without the padding aligned on 
@@ -453,6 +459,17 @@ struct winbindd_response {
 		struct {
 			uint32_t auth_blob_len; /* blob in extra_data */
 		} ccache_ntlm_auth;
+		struct {
+			fstring dc_unc;
+			fstring dc_address;
+			uint32_t dc_address_type;
+			fstring domain_guid;
+			fstring domain_name;
+			fstring forest_name;
+			uint32_t dc_flags;
+			fstring dc_site_name;
+			fstring client_site_name;
+		} dsgetdcname;
 	} data;
 
 	/* Variable length return data */
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index db9e990e64..1191c3d3aa 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -341,7 +341,7 @@ struct global {
 	int iKeepalive;
 	int iminreceivefile;
 	struct param_opt_struct *param_opt;
-	int cups_timeout;
+	int cups_connection_timeout;
 };
 
 static struct global Globals;
@@ -2597,10 +2597,10 @@ static struct parm_struct parm_table[] = {
 		.flags		= FLAG_ADVANCED | FLAG_PRINT | FLAG_GLOBAL,
 	},
 	{
-		.label		= "cups timeout",
+		.label		= "cups connection timeout",
 		.type		= P_INTEGER,
 		.p_class	= P_GLOBAL,
-		.ptr		= &Globals.cups_timeout,
+		.ptr		= &Globals.cups_connection_timeout,
 		.special	= NULL,
 		.enum_list	= NULL,
 		.flags		= FLAG_ADVANCED,
@@ -4572,6 +4572,54 @@ static void init_printer_values(struct service *pService)
 	}
 }
 
+/**
+ * Free the allocated data for one parameter for a given share.
+ */
+static void free_parameter(int snum, struct parm_struct parm)
+{
+	void *parm_ptr;
+
+	if (parm.ptr == NULL); {
+		return;
+	}
+
+	if (snum < 0) {
+		parm_ptr = parm.ptr;
+	} else if (parm.p_class != P_LOCAL) {
+		return;
+	} else {
+		parm_ptr = lp_local_ptr(snum, parm.ptr);
+	}
+
+	if ((parm.type == P_STRING) ||
+	    (parm.type == P_USTRING))
+	{
+		string_free((char**)parm_ptr);
+	} else if (parm.type == P_LIST) {
+		TALLOC_FREE(*((char***)parm_ptr));
+	}
+}
+
+/**
+ * Free the allocated parameter data for a share.
+ */
+static void free_parameters(int snum)
+{
+	uint32_t i;
+
+	for (i=0; parm_table[i].label; i++) {
+		free_parameter(snum, parm_table[i]);
+	}
+}
+
+/**
+ * Free the allocated global parameters.
+ */
+static void free_global_parameters(void)
+{
+	free_parameters(GLOBAL_SECTION_SNUM);
+}
+
 /***************************************************************************
  Initialise the global parameter structure.
 ***************************************************************************/
@@ -4596,14 +4644,7 @@ static void init_globals(bool first_time_only)
 		}
 		done_init = True;
 	} else {
-		for (i = 0; parm_table[i].label; i++) {
-			if ((parm_table[i].type == P_STRING ||
-			     parm_table[i].type == P_USTRING) &&
-			    parm_table[i].ptr)
-			{
-				string_free((char **)parm_table[i].ptr);
-			}
-		}
+		free_global_parameters();
 	}
 
 	memset((void *)&Globals, '\0', sizeof(Globals));
@@ -4805,7 +4846,7 @@ static void init_globals(bool first_time_only)
 	 * to never expire, though, when this runs out the afs client will 
 	 * forget the token. Set to 0 to get NEVERDATE.*/
 	Globals.iAfsTokenLifetime = 604800;
-	Globals.cups_timeout = CUPS_DEFAULT_TIMEOUT;
+	Globals.cups_connection_timeout = CUPS_DEFAULT_CONNECTION_TIMEOUT;
 
 /* these parameters are set to defaults that are more appropriate
    for the increasing samba install base:
@@ -5247,7 +5288,7 @@ FN_GLOBAL_LIST(lp_svcctl_list, &Globals.szServicesList)
 FN_LOCAL_STRING(lp_cups_options, szCupsOptions)
 FN_GLOBAL_STRING(lp_cups_server, &Globals.szCupsServer)
 FN_GLOBAL_STRING(lp_iprint_server, &Globals.szIPrintServer)
-FN_GLOBAL_INTEGER(lp_cups_timeout, &Globals.cups_timeout)
+FN_GLOBAL_INTEGER(lp_cups_connection_timeout, &Globals.cups_connection_timeout)
 FN_GLOBAL_CONST_STRING(lp_ctdbd_socket, &Globals.ctdbdSocket)
 FN_GLOBAL_LIST(lp_cluster_addresses, &Globals.szClusterAddresses)
 FN_GLOBAL_BOOL(lp_clustering, &Globals.clustering)
@@ -5390,6 +5431,7 @@ static bool do_section(const char *pszSectionName, void *userdata);
 static void init_copymap(struct service *pservice);
 static bool hash_a_service(const char *name, int number);
 static void free_service_byindex(int iService);
+static void free_param_opts(struct param_opt_struct **popts);
 static char * canonicalize_servicename(const char *name);
 static void show_parameter(int parmIndex);
 static bool is_synonym_of(int parm1, int parm2, bool *inverse);
@@ -5644,14 +5686,42 @@ static void init_service(struct service *pservice)
 	copy_service(pservice, &sDefault, NULL);
 }
 
+
+/**
+ * free a param_opts structure.
+ * param_opts handling should be moved to talloc;
+ * then this whole functions reduces to a TALLOC_FREE().
+ */
+
+static void free_param_opts(struct param_opt_struct **popts)
+{
+	struct param_opt_struct *opt, *next_opt;
+
+	if (popts == NULL) {
+		return;
+	}
+
+	if (*popts != NULL) {
+		DEBUG(5, ("Freeing parametrics:\n"));
+	}
+	opt = *popts;
+	while (opt != NULL) {
+		string_free(&opt->key);
+		string_free(&opt->value);
+		TALLOC_FREE(opt->list);
+		next_opt = opt->next;
+		SAFE_FREE(opt);
+		opt = next_opt;
+	}
+	*popts = NULL;
+}
+
 /***************************************************************************
  Free the dynamically allocated parts of a service struct.
 ***************************************************************************/
 
 static void free_service(struct service *pservice)
 {
-	int i;
-	struct param_opt_struct *data, *pdata;
 	if (!pservice)
 		return;
 
@@ -5659,36 +5729,12 @@ static void free_service(struct service *pservice)
 		DEBUG(5, ("free_service: Freeing service %s\n",
 		       pservice->szService));
 
+	free_parameters(getservicebyname(pservice->szService, NULL));
+
 	string_free(&pservice->szService);
 	bitmap_free(pservice->copymap);
 
-	for (i = 0; parm_table[i].label; i++) {
-		if ((parm_table[i].type == P_STRING ||
-		     parm_table[i].type == P_USTRING) &&
-		    parm_table[i].p_class == P_LOCAL)
-			string_free((char **)
-				    (((char *)pservice) +
-				     PTR_DIFF(parm_table[i].ptr, &sDefault)));
-		else if (parm_table[i].type == P_LIST &&
-			 parm_table[i].p_class == P_LOCAL)
-			     TALLOC_FREE(*((char ***)
-					   (((char *)pservice) +
-					    PTR_DIFF(parm_table[i].ptr,
-						     &sDefault))));
-	}
-
-	data = pservice->param_opt;
-	if (data)
-		DEBUG(5,("Freeing parametrics:\n"));
-	while (data) {
-		DEBUG(5,("[%s = %s]\n", data->key, data->value));
-		string_free(&data->key);
-		string_free(&data->value);
-		TALLOC_FREE(data->list);
-		pdata = data->next;
-		SAFE_FREE(data);
-		data = pdata;
-	}
+	free_param_opts(&pservice->param_opt);
 
 	ZERO_STRUCTP(pservice);
 }
@@ -5730,7 +5776,6 @@ static int add_a_service(const struct service *pservice, const char *name)
 	int i;
 	struct service tservice;
 	int num_to_alloc = iNumServices + 1;
-	struct param_opt_struct *data, *pdata;
 
 	tservice = *pservice;
 
@@ -5740,16 +5785,7 @@ static int add_a_service(const struct service *pservice, const char *name)
 		if (i >= 0) {
 			/* Clean all parametric options for service */
 			/* They will be added during parsing again */
-			data = ServicePtrs[i]->param_opt;
-			while (data) {
-				string_free(&data->key);
-				string_free(&data->value);
-				TALLOC_FREE(data->list);
-				pdata = data->next;
-				SAFE_FREE(data);
-				data = pdata;
-			}
-			ServicePtrs[i]->param_opt = NULL;
+			free_param_opts(&ServicePtrs[i]->param_opt);
 			return (i);
 		}
 	}
@@ -6408,13 +6444,51 @@ static int getservicebyname(const char *pszServiceName, struct service *pservice
  If pcopymapDest is NULL then copy all fields
 ***************************************************************************/
 
+/**
+ * Add a parametric option to a param_opt_struct,
+ * replacing old value, if already present.
+ */
+static void set_param_opt(struct param_opt_struct **opt_list,
+			  const char *opt_name,
+			  const char *opt_value)
+{
+	struct param_opt_struct *new_opt, *opt;
+	bool not_added;
+
+	if (opt_list == NULL) {
+		return;
+	}
+
+	opt = *opt_list;
+	not_added = true;
+
+	/* Traverse destination */
+	while (opt) {
+		/* If we already have same option, override it */
+		if (strwicmp(opt->key, opt_name) == 0) {
+			string_free(&opt->value);
+			TALLOC_FREE(opt->list);
+			opt->value = SMB_STRDUP(opt_value);
+			not_added = false;
+			break;
+		}
+		opt = opt->next;
+	}
+	if (not_added) {
+	    new_opt = SMB_XMALLOC_P(struct param_opt_struct);
+	    new_opt->key = SMB_STRDUP(opt_name);
+	    new_opt->value = SMB_STRDUP(opt_value);
+	    new_opt->list = NULL;
+	    DLIST_ADD(*opt_list, new_opt);
+	}
+}
+
 static void copy_service(struct service *pserviceDest, struct service *pserviceSource,
 			 struct bitmap *pcopymapDest)
 {
 	int i;
 	bool bcopyall = (pcopymapDest == NULL);
-	struct param_opt_struct *data, *pdata, *paramo;
-	bool not_added;
+	struct param_opt_struct *data;
 
 	for (i = 0; parm_table[i].label; i++)
 		if (parm_table[i].ptr && parm_table[i].p_class == P_LOCAL &&
@@ -6472,27 +6546,7 @@ static void copy_service(struct service *pserviceDest, struct service *pserviceS
 	
 	data = pserviceSource->param_opt;
 	while (data) {
-		not_added = True;
-		pdata = pserviceDest->param_opt;
-		/* Traverse destination */
-		while (pdata) {
-			/* If we already have same option, override it */
-			if (strwicmp(pdata->key, data->key) == 0) {
-				string_free(&pdata->value);
-				TALLOC_FREE(data->list);
-				pdata->value = SMB_STRDUP(data->value);
-				not_added = False;
-				break;
-			}
-			pdata = pdata->next;
-		}
-		if (not_added) {
-		    paramo = SMB_XMALLOC_P(struct param_opt_struct);
-		    paramo->key = SMB_STRDUP(data->key);
-		    paramo->value = SMB_STRDUP(data->value);
-		    paramo->list = NULL;
-		    DLIST_ADD(pserviceDest->param_opt, paramo);
-		}
+		set_param_opt(&pserviceDest->param_opt, data->key, data->value);
 		data = data->next;
 	}
 }
@@ -6560,7 +6614,7 @@ static struct smbconf_ctx *lp_smbconf_ctx(void)
 	return conf_ctx;
 }
 
-static bool process_registry_service(struct smbconf_service *service)
+static bool process_smbconf_service(struct smbconf_service *service)
 {
 	uint32_t count;
 	bool ret;
@@ -6616,7 +6670,7 @@ static bool process_registry_globals(void)
 		goto done;
 	}
 
-	ret = process_registry_service(service);
+	ret = process_smbconf_service(service);
 	if (!ret) {
 		goto done;
 	}
@@ -6654,7 +6708,7 @@ static bool process_registry_shares(void)
 		if (strequal(service[count]->name, GLOBAL_NAME)) {
 			continue;
 		}
-		ret = process_registry_service(service[count]);
+		ret = process_smbconf_service(service[count]);
 		if (!ret) {
 			goto done;
 		}
@@ -7157,14 +7211,11 @@ bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue
 	int parmnum, i;
 	void *parm_ptr = NULL;	/* where we are going to store the result */
 	void *def_ptr = NULL;
-	struct param_opt_struct *paramo, *data;
-	bool not_added;
+	struct param_opt_struct **opt_list;
 
 	parmnum = map_parameter(pszParmName);
 
 	if (parmnum < 0) {
-		TALLOC_CTX *frame;
-
 		if (strchr(pszParmName, ':') == NULL) {
 			DEBUG(0, ("Ignoring unknown parameter \"%s\"\n",
 				  pszParmName));
@@ -7175,37 +7226,10 @@ bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue
 		 * We've got a parametric option
 		 */
 
-		frame = talloc_stackframe();
+		opt_list = (snum < 0)
+			? &Globals.param_opt : &ServicePtrs[snum]->param_opt;
+		set_param_opt(opt_list, pszParmName, pszParmValue);
 
-		not_added = True;
-		data = (snum < 0)
-			? Globals.param_opt : ServicePtrs[snum]->param_opt;
-		/* Traverse destination */
-		while (data) {
-			/* If we already have same option, override it */
-			if (strwicmp(data->key, pszParmName) == 0) {
-				string_free(&data->value);
-				TALLOC_FREE(data->list);
-				data->value = SMB_STRDUP(pszParmValue);
-				not_added = False;
-				break;
-			}
-			data = data->next;
-		}
-		if (not_added) {
-			paramo = SMB_XMALLOC_P(struct param_opt_struct);
-			paramo->key = SMB_STRDUP(pszParmName);
-			paramo->value = SMB_STRDUP(pszParmValue);
-			paramo->list = NULL;
-			if (snum < 0) {
-				DLIST_ADD(Globals.param_opt, paramo);
-			} else {
-				DLIST_ADD(ServicePtrs[snum]->param_opt,
-					  paramo);
-			}
-		}
-
-		TALLOC_FREE(frame);
 		return (True);
 	}
 
@@ -7226,9 +7250,7 @@ bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue
 			       pszParmName));
 			return (True);
 		}
-		parm_ptr =
-			((char *)ServicePtrs[snum]) + PTR_DIFF(def_ptr,
-							    &sDefault);
+		parm_ptr = lp_local_ptr(snum, def_ptr);
 	}
 
 	if (snum >= 0) {
@@ -7826,7 +7848,7 @@ static void lp_add_auto_services(char *str)
  Auto-load one printer.
 ***************************************************************************/
 
-void lp_add_one_printer(char *name, char *comment)
+void lp_add_one_printer(const char *name, const char *comment, void *pdata)
 {
 	int printers = lp_servicenumber(PRINTERS_NAME);
 	int i;
@@ -8734,17 +8756,7 @@ void gfree_loadparm(void)
 	/* Now release all resources allocated to global
 	   parameters and the default service */
 
-	for (i = 0; parm_table[i].label; i++) 
-	{
-		if ( parm_table[i].type == P_STRING 
-			|| parm_table[i].type == P_USTRING ) 
-		{
-			string_free( (char**)parm_table[i].ptr );
-		}
-		else if (parm_table[i].type == P_LIST) {
-			TALLOC_FREE( *((char***)parm_table[i].ptr) );
-		}
-	}
+	free_global_parameters();
 }
 
 
@@ -8765,9 +8777,6 @@ bool lp_is_in_client(void)
     return in_client;
 }
 
-
-
-
 /***************************************************************************
  Load the services array from the services file. Return True on success, 
  False on failure.
@@ -8783,7 +8792,6 @@ bool lp_load_ex(const char *pszFname,
 {
 	char *n2 = NULL;
 	bool bRetval;
-	struct param_opt_struct *data, *pdata;
 
 	bRetval = False;
 
@@ -8801,22 +8809,11 @@ bool lp_load_ex(const char *pszFname,
 		lp_save_defaults();
 	}
 
+	free_param_opts(&Globals.param_opt);
+
 	/* We get sections first, so have to start 'behind' to make up */
 	iServiceIndex = -1;
 
-	if (Globals.param_opt != NULL) {
-		data = Globals.param_opt;
-		while (data) {
-			string_free(&data->key);
-			string_free(&data->value);
-			TALLOC_FREE(data->list);
-			pdata = data->next;
-			SAFE_FREE(data);
-			data = pdata;
-		}
-		Globals.param_opt = NULL;
-	}
-
 	if (lp_config_backend_is_file()) {
 		n2 = alloc_sub_basic(get_current_username(),
 					current_user_info.domain,
diff --git a/source3/param/test_lp_load.c b/source3/param/test_lp_load.c
new file mode 100644
index 0000000000..db1bad4726
--- /dev/null
+++ b/source3/param/test_lp_load.c
@@ -0,0 +1,88 @@
+/*
+ * Unix SMB/CIFS implementation.
+ * Test for lp_load()
+ * Copyright (C) Michael Adam 2008
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "includes.h"
+
+extern bool AllowDebugChange;
+
+int main(int argc, const char **argv)
+{
+	const char *config_file = get_dyn_CONFIGFILE();
+	int ret = 0;
+	poptContext pc;
+	char *count_str = NULL;
+	int i, count = 1;
+
+	struct poptOption long_options[] = {
+		POPT_AUTOHELP
+		{"count", 'c', POPT_ARG_STRING, &count_str, 1,
+		 "Load config <count> number of times"},
+		POPT_COMMON_DEBUGLEVEL
+		POPT_TABLEEND
+	};
+
+	TALLOC_CTX *frame = talloc_stackframe();
+
+	load_case_tables();
+	DEBUGLEVEL_CLASS[DBGC_ALL] = 0;
+
+	pc = poptGetContext(NULL, argc, argv, long_options,
+			    POPT_CONTEXT_KEEP_FIRST);
+	poptSetOtherOptionHelp(pc, "[OPTION...] <config-file>");
+
+	while(poptGetNextOpt(pc) != -1);
+
+	setup_logging(poptGetArg(pc), True);
+
+	if (poptPeekArg(pc)) {
+		config_file = poptGetArg(pc);
+	}
+
+	poptFreeContext(pc);
+
+	if (count_str != NULL) {
+		count = atoi(count_str);
+	}
+
+	dbf = x_stderr;
+	/* Don't let the debuglevel be changed by smb.conf. */
+	AllowDebugChange = False;
+
+	for (i=0; i < count; i++) {
+		printf("call lp_load() #%d: ", i+1);
+		if (!lp_load_with_registry_shares(config_file,
+						  False, /* global only */
+						  True,  /* save defaults */
+						  False, /*add_ipc */
+						  True)) /*init globals */
+		{
+			printf("ERROR.\n");
+			ret = 1;
+			goto done;
+		}
+		printf("ok.\n");
+	}
+
+
+done:
+	TALLOC_FREE(frame);
+	gfree_loadparm();
+	return ret;
+}
+
diff --git a/source3/passdb/secrets.c b/source3/passdb/secrets.c
index 4527ae7127..306d4d0a35 100644
--- a/source3/passdb/secrets.c
+++ b/source3/passdb/secrets.c
@@ -259,6 +259,31 @@ bool secrets_fetch_domain_guid(const char *domain, struct GUID *guid)
 	return True;
 }
 
+bool secrets_store_local_schannel_key(uint8_t schannel_key[16])
+{
+	return secrets_store(SECRETS_LOCAL_SCHANNEL_KEY, schannel_key, 16);
+}
+
+bool secrets_fetch_local_schannel_key(uint8_t schannel_key[16])
+{
+	size_t size = 0;
+	uint8_t *key;
+
+	key = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY, &size);
+	if (key == NULL) {
+		return false;
+	}
+
+	if (size != 16) {
+		SAFE_FREE(key);
+		return false;
+	}
+
+	memcpy(schannel_key, key, 16);
+	SAFE_FREE(key);
+	return true;
+}
+
 /**
  * Form a key for fetching the machine trust account sec channel type
  *
diff --git a/source3/printing/load.c b/source3/printing/load.c
index 23144d5a95..fc21f271bd 100644
--- a/source3/printing/load.c
+++ b/source3/printing/load.c
@@ -60,5 +60,5 @@ void load_printers(void)
 
 	/* load all printcap printers */
 	if (lp_load_printers() && lp_servicenumber(PRINTERS_NAME) >= 0)
-		pcap_printer_fn(lp_add_one_printer);
+		pcap_printer_fn(lp_add_one_printer, NULL);
 }
diff --git a/source3/printing/notify.c b/source3/printing/notify.c
index 23df17c389..f6599c413d 100644
--- a/source3/printing/notify.c
+++ b/source3/printing/notify.c
@@ -34,6 +34,7 @@ static struct notify_queue {
 	size_t buflen;
 } *notify_queue_head = NULL;
 
+static struct timed_event *notify_event;
 
 static bool create_send_ctx(void)
 {
@@ -214,6 +215,22 @@ void print_notify_send_messages(struct messaging_context *msg_ctx,
 	num_messages = 0;
 }
 
+/*******************************************************************
+ Event handler to send the messages.
+*******************************************************************/
+
+static void print_notify_event_send_messages(struct event_context *event_ctx,
+					struct timed_event *te,
+					const struct timeval *now,
+					void *private_data)
+{
+	/* Remove this timed event handler. */
+	TALLOC_FREE(notify_event);
+
+	change_to_root_user();
+	print_notify_send_messages(smbd_messaging_context(), 0);
+}
+
 /**********************************************************************
  deep copy a SPOOLSS_NOTIFY_MSG structure using a TALLOC_CTX
  *********************************************************************/
@@ -304,6 +321,15 @@ to notify_queue_head\n", msg->type, msg->field, msg->printer));
 
 	DLIST_ADD_END(notify_queue_head, pnqueue, struct notify_queue *);
 	num_messages++;
+
+	if (smbd_event_context()) {
+		/* Add an event for 1 second's time to send this queue. */
+		notify_event = event_add_timed(smbd_event_context(), NULL,
+					timeval_current_ofs(1,0),
+					"print_notify",
+					print_notify_event_send_messages, NULL);
+	}
+
 }
 
 static void send_notify_field_values(const char *sharename, uint32 type,
diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index ded985c260..850375e82b 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -1377,6 +1377,7 @@ static int file_version_is_newer(connection_struct *conn, fstring new_file, fstr
 		}
 	}
 	close_file(fsp, NORMAL_CLOSE);
+	fsp = NULL;
 
 	/* Get file version info (if available) for new file */
 	filepath = driver_unix_convert(conn,new_file,&stat_buf);
@@ -1417,6 +1418,7 @@ static int file_version_is_newer(connection_struct *conn, fstring new_file, fstr
 		}
 	}
 	close_file(fsp, NORMAL_CLOSE);
+	fsp = NULL;
 
 	if (use_version && (new_major != old_major || new_minor != old_minor)) {
 		/* Compare versions and choose the larger version number */
@@ -5491,7 +5493,7 @@ static SEC_DESC_BUF *construct_default_printer_sdb(TALLOC_CTX *ctx)
 {
 	SEC_ACE ace[5];	/* max number of ace entries */
 	int i = 0;
-	SEC_ACCESS sa;
+	uint32_t sa;
 	SEC_ACL *psa = NULL;
 	SEC_DESC_BUF *sdb = NULL;
 	SEC_DESC *psd = NULL;
@@ -5500,7 +5502,7 @@ static SEC_DESC_BUF *construct_default_printer_sdb(TALLOC_CTX *ctx)
 
 	/* Create an ACE where Everyone is allowed to print */
 
-	init_sec_access(&sa, PRINTER_ACE_PRINT);
+	sa = PRINTER_ACE_PRINT;
 	init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
 		     sa, SEC_ACE_FLAG_CONTAINER_INHERIT);
 
@@ -5512,7 +5514,7 @@ static SEC_DESC_BUF *construct_default_printer_sdb(TALLOC_CTX *ctx)
 		sid_copy(&domadmins_sid, get_global_sam_sid());
 		sid_append_rid(&domadmins_sid, DOMAIN_GROUP_RID_ADMINS);
 		
-		init_sec_access(&sa, PRINTER_ACE_FULL_CONTROL);
+		sa = PRINTER_ACE_FULL_CONTROL;
 		init_sec_ace(&ace[i++], &domadmins_sid, 
 			SEC_ACE_TYPE_ACCESS_ALLOWED, sa, 
 			SEC_ACE_FLAG_OBJECT_INHERIT | SEC_ACE_FLAG_INHERIT_ONLY);
@@ -5522,7 +5524,7 @@ static SEC_DESC_BUF *construct_default_printer_sdb(TALLOC_CTX *ctx)
 	else if (secrets_fetch_domain_sid(lp_workgroup(), &adm_sid)) {
 		sid_append_rid(&adm_sid, DOMAIN_USER_RID_ADMIN);
 
-		init_sec_access(&sa, PRINTER_ACE_FULL_CONTROL);
+		sa = PRINTER_ACE_FULL_CONTROL;
 		init_sec_ace(&ace[i++], &adm_sid, 
 			SEC_ACE_TYPE_ACCESS_ALLOWED, sa, 
 			SEC_ACE_FLAG_OBJECT_INHERIT | SEC_ACE_FLAG_INHERIT_ONLY);
@@ -5532,7 +5534,7 @@ static SEC_DESC_BUF *construct_default_printer_sdb(TALLOC_CTX *ctx)
 
 	/* add BUILTIN\Administrators as FULL CONTROL */
 
-	init_sec_access(&sa, PRINTER_ACE_FULL_CONTROL);
+	sa = PRINTER_ACE_FULL_CONTROL;
 	init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators, 
 		SEC_ACE_TYPE_ACCESS_ALLOWED, sa, 
 		SEC_ACE_FLAG_OBJECT_INHERIT | SEC_ACE_FLAG_INHERIT_ONLY);
diff --git a/source3/printing/pcap.c b/source3/printing/pcap.c
index 30cb254a29..10c1a2d608 100644
--- a/source3/printing/pcap.c
+++ b/source3/printing/pcap.c
@@ -63,41 +63,51 @@
 #include "includes.h"
 
 
-typedef struct pcap_cache {
+struct pcap_cache {
 	char *name;
 	char *comment;
 	struct pcap_cache *next;
-} pcap_cache_t;
+};
 
-static pcap_cache_t *pcap_cache = NULL;
+/* The systemwide printcap cache. */
+static struct pcap_cache *pcap_cache = NULL;
 
-bool pcap_cache_add(const char *name, const char *comment)
+bool pcap_cache_add_specific(struct pcap_cache **ppcache, const char *name, const char *comment)
 {
-	pcap_cache_t *p;
+	struct pcap_cache *p;
 
-	if (name == NULL || ((p = SMB_MALLOC_P(pcap_cache_t)) == NULL))
-		return False;
+	if (name == NULL || ((p = SMB_MALLOC_P(struct pcap_cache)) == NULL))
+		return false;
 
 	p->name = SMB_STRDUP(name);
 	p->comment = (comment && *comment) ? SMB_STRDUP(comment) : NULL;
 
-	p->next = pcap_cache;
-	pcap_cache = p;
+	DEBUG(11,("pcap_cache_add_specific: Adding name %s info %s\n",
+		p->name, p->comment ? p->comment : ""));
+
+	p->next = *ppcache;
+	*ppcache = p;
 
-	return True;
+	return true;
 }
 
-static void pcap_cache_destroy(pcap_cache_t *cache)
+void pcap_cache_destroy_specific(struct pcap_cache **pp_cache)
 {
-	pcap_cache_t *p, *next;
+	struct pcap_cache *p, *next;
 
-	for (p = cache; p != NULL; p = next) {
+	for (p = *pp_cache; p != NULL; p = next) {
 		next = p->next;
 
 		SAFE_FREE(p->name);
 		SAFE_FREE(p->comment);
 		SAFE_FREE(p);
 	}
+	*pp_cache = NULL;
+}
+
+bool pcap_cache_add(const char *name, const char *comment)
+{
+	return pcap_cache_add_specific(&pcap_cache, name, comment);
 }
 
 bool pcap_cache_loaded(void)
@@ -105,11 +115,21 @@ bool pcap_cache_loaded(void)
 	return (pcap_cache != NULL);
 }
 
+void pcap_cache_replace(const struct pcap_cache *pcache)
+{
+	const struct pcap_cache *p;
+
+	pcap_cache_destroy_specific(&pcap_cache);
+	for (p = pcache; p; p = p->next) {
+		pcap_cache_add(p->name, p->comment);
+	}
+}
+
 void pcap_cache_reload(void)
 {
 	const char *pcap_name = lp_printcapname();
 	bool pcap_reloaded = False;
-	pcap_cache_t *tmp_cache = NULL;
+	struct pcap_cache *tmp_cache = NULL;
 	XFILE *pcap_file;
 	char *pcap_line;
 
@@ -223,9 +243,9 @@ done:
 	DEBUG(3, ("reload status: %s\n", (pcap_reloaded) ? "ok" : "error"));
 
 	if (pcap_reloaded)
-		pcap_cache_destroy(tmp_cache);
+		pcap_cache_destroy_specific(&tmp_cache);
 	else {
-		pcap_cache_destroy(pcap_cache);
+		pcap_cache_destroy_specific(&pcap_cache);
 		pcap_cache = tmp_cache;
 	}
 
@@ -235,7 +255,7 @@ done:
 
 bool pcap_printername_ok(const char *printername)
 {
-	pcap_cache_t *p;
+	struct pcap_cache *p;
 
 	for (p = pcap_cache; p != NULL; p = p->next)
 		if (strequal(p->name, printername))
@@ -245,19 +265,22 @@ bool pcap_printername_ok(const char *printername)
 }
 
 /***************************************************************************
-run a function on each printer name in the printcap file. The function is 
-passed the primary name and the comment (if possible). Note the fn() takes
-strings in DOS codepage. This means the xxx_printer_fn() calls must be fixed
-to return DOS codepage. FIXME !! JRA.
-
-XXX: I'm not sure if this comment still applies.. Anyone?  -Rob
+run a function on each printer name in the printcap file.
 ***************************************************************************/
-void pcap_printer_fn(void (*fn)(char *, char *))
+
+void pcap_printer_fn_specific(const struct pcap_cache *pc,
+			void (*fn)(const char *, const char *, void *),
+			void *pdata)
 {
-	pcap_cache_t *p;
+	const struct pcap_cache *p;
 
-	for (p = pcap_cache; p != NULL; p = p->next)
-		fn(p->name, p->comment);
+	for (p = pc; p != NULL; p = p->next)
+		fn(p->name, p->comment, pdata);
 
 	return;
 }
+
+void pcap_printer_fn(void (*fn)(const char *, const char *, void *), void *pdata)
+{
+	return pcap_printer_fn_specific(pcap_cache, fn, pdata);
+}
diff --git a/source3/printing/print_cups.c b/source3/printing/print_cups.c
index 2b2cf159fb..ca3415ca5a 100644
--- a/source3/printing/print_cups.c
+++ b/source3/printing/print_cups.c
@@ -2,21 +2,26 @@
  * Support code for the Common UNIX Printing System ("CUPS")
  *
  * Copyright 1999-2003 by Michael R Sweet.
+ * Copyright 2008 Jeremy Allison.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
- * 
+ *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
+/*
+ * JRA. Converted to utf8 pull/push.
+ */
+
 #include "includes.h"
 #include "printing.h"
 
@@ -51,24 +56,23 @@ cups_passwd_cb(const char *prompt)	/* I - Prompt */
 	return (NULL);
 }
 
-static http_t *cups_connect(void)
+static http_t *cups_connect(TALLOC_CTX *frame)
 {
-	http_t *http;
-	char *server, *p;
+	http_t *http = NULL;
+	char *server = NULL, *p = NULL;
 	int port;
-	int timeout = lp_cups_timeout();
-
-	gotalarm = 0;
-
-	if (timeout) {
-                CatchSignal(SIGALRM, SIGNAL_CAST gotalarm_sig);
-                alarm(timeout);
-        }
+	int timeout = lp_cups_connection_timeout();
+	size_t size;
 
 	if (lp_cups_server() != NULL && strlen(lp_cups_server()) > 0) {
-		server = smb_xstrdup(lp_cups_server());
+		if (!push_utf8_talloc(frame, &server, lp_cups_server(), &size)) {
+			return NULL;
+		}
 	} else {
-		server = smb_xstrdup(cupsServer());
+		server = talloc_strdup(frame,cupsServer());
+	}
+	if (!server) {
+		return NULL;
 	}
 
 	p = strchr(server, ':');
@@ -82,6 +86,13 @@ static http_t *cups_connect(void)
 	DEBUG(10, ("connecting to cups server %s:%d\n",
 		   server, port));
 
+	gotalarm = 0;
+
+	if (timeout) {
+                CatchSignal(SIGALRM, SIGNAL_CAST gotalarm_sig);
+                alarm(timeout);
+        }
+
 	http = httpConnect(server, port);
 
 	CatchSignal(SIGALRM, SIGNAL_CAST SIG_IGN);
@@ -92,12 +103,49 @@ static http_t *cups_connect(void)
 			 server, port, strerror(errno)));
 	}
 
-	SAFE_FREE(server);
 	return http;
 }
 
-bool cups_cache_reload(void)
+static void send_pcap_info(const char *name, const char *info, void *pd)
 {
+	int fd = *(int *)pd;
+	size_t namelen = name ? strlen(name)+1 : 0;
+	size_t infolen = info ? strlen(info)+1 : 0;
+
+	DEBUG(11,("send_pcap_info: writing namelen %u\n", (unsigned int)namelen));
+	if (sys_write(fd, &namelen, sizeof(namelen)) != sizeof(namelen)) {
+		DEBUG(10,("send_pcap_info: namelen write failed %s\n",
+			strerror(errno)));
+		return;
+	}
+	DEBUG(11,("send_pcap_info: writing infolen %u\n", (unsigned int)infolen));
+	if (sys_write(fd, &infolen, sizeof(infolen)) != sizeof(infolen)) {
+		DEBUG(10,("send_pcap_info: infolen write failed %s\n",
+			strerror(errno)));
+		return;
+	}
+	if (namelen) {
+		DEBUG(11,("send_pcap_info: writing name %s\n", name));
+		if (sys_write(fd, name, namelen) != namelen) {
+			DEBUG(10,("send_pcap_info: name write failed %s\n",
+				strerror(errno)));
+			return;
+		}
+	}
+	if (infolen) {
+		DEBUG(11,("send_pcap_info: writing info %s\n", info));
+		if (sys_write(fd, info, infolen) != infolen) {
+			DEBUG(10,("send_pcap_info: info write failed %s\n",
+				strerror(errno)));
+			return;
+		}
+	}
+}
+
+static bool cups_cache_reload_async(int fd)
+{
+	TALLOC_CTX *frame = talloc_stackframe();
+	struct pcap_cache *tmp_pcap_cache = NULL;
 	http_t		*http = NULL;		/* HTTP connection to server */
 	ipp_t		*request = NULL,	/* IPP Request */
 			*response = NULL;	/* IPP Response */
@@ -109,8 +157,9 @@ bool cups_cache_reload(void)
 			{
 			  "printer-name",
 			  "printer-info"
-			};       
+			};
 	bool ret = False;
+	size_t size;
 
 	DEBUG(5, ("reloading cups printcap cache\n"));
 
@@ -124,7 +173,7 @@ bool cups_cache_reload(void)
 	* Try to connect to the server...
 	*/
 
-	if ((http = cups_connect()) == NULL) {
+	if ((http = cups_connect(frame)) == NULL) {
 		goto out;
 	}
 
@@ -145,7 +194,7 @@ bool cups_cache_reload(void)
 	language = cupsLangDefault();
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-                     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
                      "attributes-natural-language", NULL, language->language);
@@ -185,12 +234,24 @@ bool cups_cache_reload(void)
 
 		while (attr != NULL && attr->group_tag == IPP_TAG_PRINTER) {
         		if (strcmp(attr->name, "printer-name") == 0 &&
-			    attr->value_tag == IPP_TAG_NAME)
-				name = attr->values[0].string.text;
+			    attr->value_tag == IPP_TAG_NAME) {
+				if (!pull_utf8_talloc(frame,
+						&name,
+						attr->values[0].string.text,
+						&size)) {
+					goto out;
+				}
+			}
 
         		if (strcmp(attr->name, "printer-info") == 0 &&
-			    attr->value_tag == IPP_TAG_TEXT)
-				info = attr->values[0].string.text;
+			    attr->value_tag == IPP_TAG_TEXT) {
+				if (!pull_utf8_talloc(frame,
+						&info,
+						attr->values[0].string.text,
+						&size)) {
+					goto out;
+				}
+			}
 
         		attr = attr->next;
 		}
@@ -202,7 +263,7 @@ bool cups_cache_reload(void)
 		if (name == NULL)
 			break;
 
-		if (!pcap_cache_add(name, info)) {
+		if (!pcap_cache_add_specific(&tmp_pcap_cache, name, info)) {
 			goto out;
 		}
 	}
@@ -225,7 +286,7 @@ bool cups_cache_reload(void)
 	request->request.op.request_id   = 1;
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-                     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
                      "attributes-natural-language", NULL, language->language);
@@ -265,12 +326,24 @@ bool cups_cache_reload(void)
 
 		while (attr != NULL && attr->group_tag == IPP_TAG_PRINTER) {
         		if (strcmp(attr->name, "printer-name") == 0 &&
-			    attr->value_tag == IPP_TAG_NAME)
-				name = attr->values[0].string.text;
+			    attr->value_tag == IPP_TAG_NAME) {
+				if (!pull_utf8_talloc(frame,
+						&name,
+						attr->values[0].string.text,
+						&size)) {
+					goto out;
+				}
+			}
 
         		if (strcmp(attr->name, "printer-info") == 0 &&
-			    attr->value_tag == IPP_TAG_TEXT)
-				info = attr->values[0].string.text;
+			    attr->value_tag == IPP_TAG_TEXT) {
+				if (!pull_utf8_talloc(frame,
+						&info,
+						attr->values[0].string.text,
+						&size)) {
+					goto out;
+				}
+			}
 
         		attr = attr->next;
 		}
@@ -282,7 +355,7 @@ bool cups_cache_reload(void)
 		if (name == NULL)
 			break;
 
-		if (!pcap_cache_add(name, info)) {
+		if (!pcap_cache_add_specific(&tmp_pcap_cache, name, info)) {
 			goto out;
 		}
 	}
@@ -299,9 +372,229 @@ bool cups_cache_reload(void)
 	if (http)
 		httpClose(http);
 
+	/* Send all the entries up the pipe. */
+	if (tmp_pcap_cache) {
+		pcap_printer_fn_specific(tmp_pcap_cache,
+				send_pcap_info,
+				(void *)&fd);
+
+		pcap_cache_destroy_specific(&tmp_pcap_cache);
+	}
+	TALLOC_FREE(frame);
 	return ret;
 }
 
+static struct pcap_cache *local_pcap_copy;
+struct fd_event *cache_fd_event;
+
+static bool cups_pcap_load_async(int *pfd)
+{
+	int fds[2];
+	pid_t pid;
+
+	*pfd = -1;
+
+	if (cache_fd_event) {
+		DEBUG(3,("cups_pcap_load_async: already waiting for "
+			"a refresh event\n" ));
+		return false;
+	}
+
+	DEBUG(5,("cups_pcap_load_async: asynchronously loading cups printers\n"));
+
+	if (pipe(fds) == -1) {
+		return false;
+	}
+
+	pid = sys_fork();
+	if (pid == (pid_t)-1) {
+		DEBUG(10,("cups_pcap_load_async: fork failed %s\n",
+			strerror(errno) ));
+		close(fds[0]);
+		close(fds[1]);
+		return false;
+	}
+
+	if (pid) {
+		DEBUG(10,("cups_pcap_load_async: child pid = %u\n",
+			(unsigned int)pid ));
+		/* Parent. */
+		close(fds[1]);
+		*pfd = fds[0];
+		return true;
+	}
+
+	/* Child. */
+	if (!reinit_after_fork(smbd_messaging_context(), true)) {
+		DEBUG(0,("cups_pcap_load_async: reinit_after_fork() failed\n"));
+		smb_panic("cups_pcap_load_async: reinit_after_fork() failed");
+	}
+
+	close(fds[0]);
+	cups_cache_reload_async(fds[1]);
+	close(fds[1]);
+	_exit(0);
+}
+
+static void cups_async_callback(struct event_context *event_ctx,
+				struct fd_event *event,
+				uint16 flags,
+				void *p)
+{
+	TALLOC_CTX *frame = talloc_stackframe();
+	int fd = *(int *)p;
+	struct pcap_cache *tmp_pcap_cache = NULL;
+
+	DEBUG(5,("cups_async_callback: callback received for printer data. "
+		"fd = %d\n", fd));
+
+	while (1) {
+		char *name = NULL, *info = NULL;
+		size_t namelen = 0, infolen = 0;
+		ssize_t ret = -1;
+
+		ret = sys_read(fd, &namelen, sizeof(namelen));
+		if (ret == 0) {
+			/* EOF */
+			break;
+		}
+		if (ret != sizeof(namelen)) {
+			DEBUG(10,("cups_async_callback: namelen read failed %d %s\n",
+				errno, strerror(errno)));
+			break;
+		}
+
+		DEBUG(11,("cups_async_callback: read namelen %u\n",
+			(unsigned int)namelen));
+
+		ret = sys_read(fd, &infolen, sizeof(infolen));
+		if (ret == 0) {
+			/* EOF */
+			break;
+		}
+		if (ret != sizeof(infolen)) {
+			DEBUG(10,("cups_async_callback: infolen read failed %s\n",
+				strerror(errno)));
+			break;
+		}
+
+		DEBUG(11,("cups_async_callback: read infolen %u\n",
+			(unsigned int)infolen));
+
+		if (namelen) {
+			name = TALLOC_ARRAY(frame, char, namelen);
+			if (!name) {
+				break;
+			}
+			ret = sys_read(fd, name, namelen);
+			if (ret == 0) {
+				/* EOF */
+				break;
+			}
+			if (ret != namelen) {
+				DEBUG(10,("cups_async_callback: name read failed %s\n",
+					strerror(errno)));
+				break;
+			}
+			DEBUG(11,("cups_async_callback: read name %s\n",
+				name));
+		} else {
+			name = NULL;
+		}
+		if (infolen) {
+			info = TALLOC_ARRAY(frame, char, infolen);
+			if (!info) {
+				break;
+			}
+			ret = sys_read(fd, info, infolen);
+			if (ret == 0) {
+				/* EOF */
+				break;
+			}
+			if (ret != infolen) {
+				DEBUG(10,("cups_async_callback: info read failed %s\n",
+					strerror(errno)));
+				break;
+			}
+			DEBUG(11,("cups_async_callback: read info %s\n",
+				info));
+		} else {
+			info = NULL;
+		}
+
+		/* Add to our local pcap cache. */
+		pcap_cache_add_specific(&tmp_pcap_cache, name, info);
+		TALLOC_FREE(name);
+		TALLOC_FREE(info);
+	}
+
+	TALLOC_FREE(frame);
+	if (tmp_pcap_cache) {
+		/* We got a namelist, replace our local cache. */
+		pcap_cache_destroy_specific(&local_pcap_copy);
+		local_pcap_copy = tmp_pcap_cache;
+
+		/* And the systemwide pcap cache. */
+		pcap_cache_replace(local_pcap_copy);
+	} else {
+		DEBUG(2,("cups_async_callback: failed to read a new "
+			"printer list\n"));
+	}
+	close(fd);
+	TALLOC_FREE(p);
+	TALLOC_FREE(cache_fd_event);
+}
+
+bool cups_cache_reload(void)
+{
+	int *p_pipe_fd = TALLOC_P(NULL, int);
+
+	if (!p_pipe_fd) {
+		return false;
+	}
+
+	*p_pipe_fd = -1;
+
+	/* Set up an async refresh. */
+	if (!cups_pcap_load_async(p_pipe_fd)) {
+		return false;
+	}
+	if (!local_pcap_copy) {
+		/* We have no local cache, wait directly for
+		 * async refresh to complete.
+		 */
+		DEBUG(10,("cups_cache_reload: sync read on fd %d\n",
+			*p_pipe_fd ));
+
+		cups_async_callback(smbd_event_context(),
+					NULL,
+					EVENT_FD_READ,
+					(void *)p_pipe_fd);
+		if (!local_pcap_copy) {
+			return false;
+		}
+	} else {
+		/* Replace the system cache with our
+		 * local copy. */
+		pcap_cache_replace(local_pcap_copy);
+
+		DEBUG(10,("cups_cache_reload: async read on fd %d\n",
+			*p_pipe_fd ));
+
+		/* Trigger an event when the pipe can be read. */
+		cache_fd_event = event_add_fd(smbd_event_context(),
+					NULL, *p_pipe_fd,
+					EVENT_FD_READ,
+					cups_async_callback,
+					(void *)p_pipe_fd);
+		if (!cache_fd_event) {
+			close(*p_pipe_fd);
+			TALLOC_FREE(p_pipe_fd);
+			return false;
+		}
+	}
+	return true;
+}
 
 /*
  * 'cups_job_delete()' - Delete a job.
@@ -309,13 +602,15 @@ bool cups_cache_reload(void)
 
 static int cups_job_delete(const char *sharename, const char *lprm_command, struct printjob *pjob)
 {
+	TALLOC_CTX *frame = talloc_stackframe();
 	int		ret = 1;		/* Return value */
 	http_t		*http = NULL;		/* HTTP connection to server */
 	ipp_t		*request = NULL,	/* IPP Request */
 			*response = NULL;	/* IPP Response */
 	cups_lang_t	*language = NULL;	/* Default language */
+	char *user = NULL;
 	char		uri[HTTP_MAX_URI]; /* printer-uri attribute */
-
+	size_t size;
 
 	DEBUG(5,("cups_job_delete(%s, %p (%d))\n", sharename, pjob, pjob->sysjob));
 
@@ -329,7 +624,7 @@ static int cups_job_delete(const char *sharename, const char *lprm_command, stru
 	* Try to connect to the server...
 	*/
 
-	if ((http = cups_connect()) == NULL) {
+	if ((http = cups_connect(frame)) == NULL) {
 		goto out;
 	}
 
@@ -351,7 +646,7 @@ static int cups_job_delete(const char *sharename, const char *lprm_command, stru
 	language = cupsLangDefault();
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-        	     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
         	     "attributes-natural-language", NULL, language->language);
@@ -360,8 +655,12 @@ static int cups_job_delete(const char *sharename, const char *lprm_command, stru
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "job-uri", NULL, uri);
 
+	if (!push_utf8_talloc(frame, &user, pjob->user, &size)) {
+		goto out;
+	}
+
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name",
-        	     NULL, pjob->user);
+        	     NULL, user);
 
        /*
 	* Do the request and get back a response...
@@ -389,6 +688,7 @@ static int cups_job_delete(const char *sharename, const char *lprm_command, stru
 	if (http)
 		httpClose(http);
 
+	TALLOC_FREE(frame);
 	return ret;
 }
 
@@ -399,13 +699,15 @@ static int cups_job_delete(const char *sharename, const char *lprm_command, stru
 
 static int cups_job_pause(int snum, struct printjob *pjob)
 {
+	TALLOC_CTX *frame = talloc_stackframe();
 	int		ret = 1;		/* Return value */
 	http_t		*http = NULL;		/* HTTP connection to server */
 	ipp_t		*request = NULL,	/* IPP Request */
 			*response = NULL;	/* IPP Response */
 	cups_lang_t	*language = NULL;	/* Default language */
+	char *user = NULL;
 	char		uri[HTTP_MAX_URI]; /* printer-uri attribute */
-
+	size_t size;
 
 	DEBUG(5,("cups_job_pause(%d, %p (%d))\n", snum, pjob, pjob->sysjob));
 
@@ -419,7 +721,7 @@ static int cups_job_pause(int snum, struct printjob *pjob)
 	* Try to connect to the server...
 	*/
 
-	if ((http = cups_connect()) == NULL) {
+	if ((http = cups_connect(frame)) == NULL) {
 		goto out;
 	}
 
@@ -441,7 +743,7 @@ static int cups_job_pause(int snum, struct printjob *pjob)
 	language = cupsLangDefault();
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-        	     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
         	     "attributes-natural-language", NULL, language->language);
@@ -450,8 +752,11 @@ static int cups_job_pause(int snum, struct printjob *pjob)
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "job-uri", NULL, uri);
 
+	if (!push_utf8_talloc(frame, &user, pjob->user, &size)) {
+		goto out;
+	}
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name",
-        	     NULL, pjob->user);
+        	     NULL, user);
 
        /*
 	* Do the request and get back a response...
@@ -479,6 +784,7 @@ static int cups_job_pause(int snum, struct printjob *pjob)
 	if (http)
 		httpClose(http);
 
+	TALLOC_FREE(frame);
 	return ret;
 }
 
@@ -489,13 +795,15 @@ static int cups_job_pause(int snum, struct printjob *pjob)
 
 static int cups_job_resume(int snum, struct printjob *pjob)
 {
+	TALLOC_CTX *frame = talloc_stackframe();
 	int		ret = 1;		/* Return value */
 	http_t		*http = NULL;		/* HTTP connection to server */
 	ipp_t		*request = NULL,	/* IPP Request */
 			*response = NULL;	/* IPP Response */
 	cups_lang_t	*language = NULL;	/* Default language */
+	char *user = NULL;
 	char		uri[HTTP_MAX_URI]; /* printer-uri attribute */
-
+	size_t size;
 
 	DEBUG(5,("cups_job_resume(%d, %p (%d))\n", snum, pjob, pjob->sysjob));
 
@@ -509,7 +817,7 @@ static int cups_job_resume(int snum, struct printjob *pjob)
 	* Try to connect to the server...
 	*/
 
-	if ((http = cups_connect()) == NULL) {
+	if ((http = cups_connect(frame)) == NULL) {
 		goto out;
 	}
 
@@ -531,7 +839,7 @@ static int cups_job_resume(int snum, struct printjob *pjob)
 	language = cupsLangDefault();
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-        	     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
         	     "attributes-natural-language", NULL, language->language);
@@ -540,8 +848,11 @@ static int cups_job_resume(int snum, struct printjob *pjob)
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "job-uri", NULL, uri);
 
+	if (!push_utf8_talloc(frame, &user, pjob->user, &size)) {
+		goto out;
+	}
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name",
-        	     NULL, pjob->user);
+        	     NULL, user);
 
        /*
 	* Do the request and get back a response...
@@ -569,6 +880,7 @@ static int cups_job_resume(int snum, struct printjob *pjob)
 	if (http)
 		httpClose(http);
 
+	TALLOC_FREE(frame);
 	return ret;
 }
 
@@ -579,6 +891,7 @@ static int cups_job_resume(int snum, struct printjob *pjob)
 
 static int cups_job_submit(int snum, struct printjob *pjob)
 {
+	TALLOC_CTX *frame = talloc_stackframe();
 	int		ret = 1;		/* Return value */
 	http_t		*http = NULL;		/* HTTP connection to server */
 	ipp_t		*request = NULL,	/* IPP Request */
@@ -589,6 +902,12 @@ static int cups_job_submit(int snum, struct printjob *pjob)
 	char *new_jobname = NULL;
 	int		num_options = 0;
 	cups_option_t 	*options = NULL;
+	char *printername = NULL;
+	char *user = NULL;
+	char *jobname = NULL;
+	char *cupsoptions = NULL;
+	char *filename = NULL;
+	size_t size;
 	char addr[INET6_ADDRSTRLEN];
 
 	DEBUG(5,("cups_job_submit(%d, %p (%d))\n", snum, pjob, pjob->sysjob));
@@ -603,7 +922,7 @@ static int cups_job_submit(int snum, struct printjob *pjob)
 	* Try to connect to the server...
 	*/
 
-	if ((http = cups_connect()) == NULL) {
+	if ((http = cups_connect(frame)) == NULL) {
 		goto out;
 	}
 
@@ -626,19 +945,25 @@ static int cups_job_submit(int snum, struct printjob *pjob)
 	language = cupsLangDefault();
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-        	     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
         	     "attributes-natural-language", NULL, language->language);
 
+	if (!push_utf8_talloc(frame, &printername, PRINTERNAME(snum), &size)) {
+		goto out;
+	}
 	slprintf(uri, sizeof(uri) - 1, "ipp://localhost/printers/%s",
-	         PRINTERNAME(snum));
+	         printername);
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI,
         	     "printer-uri", NULL, uri);
 
+	if (!push_utf8_talloc(frame, &user, pjob->user, &size)) {
+		goto out;
+	}
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name",
-        	     NULL, pjob->user);
+        	     NULL, user);
 
 	clientname = client_name(get_client_fd());
 	if (strcmp(clientname, "UNKNOWN") == 0) {
@@ -649,31 +974,43 @@ static int cups_job_submit(int snum, struct printjob *pjob)
 	             "job-originating-host-name", NULL,
 		      clientname);
 
-	if (asprintf(&new_jobname,"%s%.8u %s", PRINT_SPOOL_PREFIX,
-			(unsigned int)pjob->smbjob, pjob->jobname) < 0) {
+	if (!push_utf8_talloc(frame, &jobname, pjob->jobname, &size)) {
+		goto out;
+	}
+	new_jobname = talloc_asprintf(frame,
+			"%s%.8u %s", PRINT_SPOOL_PREFIX,
+			(unsigned int)pjob->smbjob,
+			jobname);
+	if (new_jobname == NULL) {
 		goto out;
 	}
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "job-name", NULL,
         	     new_jobname);
 
-	/* 
-	 * add any options defined in smb.conf 
+	/*
+	 * add any options defined in smb.conf
 	 */
 
+	if (!push_utf8_talloc(frame, &cupsoptions, lp_cups_options(snum), &size)) {
+		goto out;
+	}
 	num_options = 0;
 	options     = NULL;
-	num_options = cupsParseOptions(lp_cups_options(snum), num_options, &options);
+	num_options = cupsParseOptions(cupsoptions, num_options, &options);
 
 	if ( num_options )
-		cupsEncodeOptions(request, num_options, options); 
+		cupsEncodeOptions(request, num_options, options);
 
        /*
 	* Do the request and get back a response...
 	*/
 
-	slprintf(uri, sizeof(uri) - 1, "/printers/%s", PRINTERNAME(snum));
+	slprintf(uri, sizeof(uri) - 1, "/printers/%s", printername);
 
+	if (!push_utf8_talloc(frame, &filename, pjob->filename, &size)) {
+		goto out;
+	}
 	if ((response = cupsDoFileRequest(http, request, uri, pjob->filename)) != NULL) {
 		if (response->request.status.status_code >= IPP_OK_CONFLICT) {
 			DEBUG(0,("Unable to print file to %s - %s\n", PRINTERNAME(snum),
@@ -700,7 +1037,7 @@ static int cups_job_submit(int snum, struct printjob *pjob)
 	if (http)
 		httpClose(http);
 
-	SAFE_FREE(new_jobname);
+	TALLOC_FREE(frame);
 
 	return ret;
 }
@@ -712,10 +1049,11 @@ static int cups_job_submit(int snum, struct printjob *pjob)
 static int cups_queue_get(const char *sharename,
                enum printing_types printing_type,
                char *lpq_command,
-               print_queue_struct **q, 
+               print_queue_struct **q,
                print_status_struct *status)
 {
-	fstring		printername;
+	TALLOC_CTX *frame = talloc_stackframe();
+	char *printername = NULL;
 	http_t		*http = NULL;		/* HTTP connection to server */
 	ipp_t		*request = NULL,	/* IPP Request */
 			*response = NULL;	/* IPP Response */
@@ -726,13 +1064,14 @@ static int cups_queue_get(const char *sharename,
 			qalloc = 0;		/* Number of queue entries allocated */
 	print_queue_struct *queue = NULL,	/* Queue entries */
 			*temp;		/* Temporary pointer for queue */
-	const char	*user_name,	/* job-originating-user-name attribute */
-			*job_name;	/* job-name attribute */
+	char		*user_name = NULL,	/* job-originating-user-name attribute */
+			*job_name = NULL;	/* job-name attribute */
 	int		job_id;		/* job-id attribute */
 	int		job_k_octets;	/* job-k-octets attribute */
 	time_t		job_time;	/* time-at-creation attribute */
 	ipp_jstate_t	job_status;	/* job-status attribute */
 	int		job_priority;	/* job-priority attribute */
+	size_t size;
 	static const char *jattrs[] =	/* Requested job attributes */
 			{
 			  "job-id",
@@ -751,15 +1090,16 @@ static int cups_queue_get(const char *sharename,
 
 	*q = NULL;
 
-	/* HACK ALERT!!!  The problem with support the 'printer name' 
-	   option is that we key the tdb off the sharename.  So we will 
-	   overload the lpq_command string to pass in the printername 
-	   (which is basically what we do for non-cups printers ... using 
+	/* HACK ALERT!!!  The problem with support the 'printer name'
+	   option is that we key the tdb off the sharename.  So we will
+	   overload the lpq_command string to pass in the printername
+	   (which is basically what we do for non-cups printers ... using
 	   the lpq_command to get the queue listing). */
 
-	fstrcpy( printername, lpq_command );
-
-	DEBUG(5,("cups_queue_get(%s, %p, %p)\n", printername, q, status));
+	if (!push_utf8_talloc(frame, &printername, lpq_command, &size)) {
+		goto out;
+	}
+	DEBUG(5,("cups_queue_get(%s, %p, %p)\n", lpq_command, q, status));
 
        /*
         * Make sure we don't ask for passwords...
@@ -771,7 +1111,7 @@ static int cups_queue_get(const char *sharename,
 	* Try to connect to the server...
 	*/
 
-	if ((http = cups_connect()) == NULL) {
+	if ((http = cups_connect(frame)) == NULL) {
 		goto out;
 	}
 
@@ -799,7 +1139,7 @@ static int cups_queue_get(const char *sharename,
 	language = cupsLangDefault();
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-                     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
                      "attributes-natural-language", NULL, language->language);
@@ -904,12 +1244,24 @@ static int cups_queue_get(const char *sharename,
 				job_time = attr->values[0].integer;
 
         		if (strcmp(attr->name, "job-name") == 0 &&
-			    attr->value_tag == IPP_TAG_NAME)
-				job_name = attr->values[0].string.text;
+			    attr->value_tag == IPP_TAG_NAME) {
+				if (!pull_utf8_talloc(frame,
+						&job_name,
+						attr->values[0].string.text,
+						&size)) {
+					goto out;
+				}
+			}
 
         		if (strcmp(attr->name, "job-originating-user-name") == 0 &&
-			    attr->value_tag == IPP_TAG_NAME)
-				user_name = attr->values[0].string.text;
+			    attr->value_tag == IPP_TAG_NAME) {
+				if (!pull_utf8_talloc(frame,
+						&user_name,
+						attr->values[0].string.text,
+						&size)) {
+					goto out;
+				}
+			}
 
         		attr = attr->next;
 		}
@@ -933,8 +1285,8 @@ static int cups_queue_get(const char *sharename,
 			         LPQ_PRINTING;
 		temp->priority = job_priority;
 		temp->time     = job_time;
-		strncpy(temp->fs_user, user_name, sizeof(temp->fs_user) - 1);
-		strncpy(temp->fs_file, job_name, sizeof(temp->fs_file) - 1);
+		strlcpy(temp->fs_user, user_name, sizeof(temp->fs_user));
+		strlcpy(temp->fs_file, job_name, sizeof(temp->fs_file));
 
 		qcount ++;
 
@@ -961,7 +1313,7 @@ static int cups_queue_get(const char *sharename,
 	request->request.op.request_id   = 1;
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-                     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
                      "attributes-natural-language", NULL, language->language);
@@ -1004,8 +1356,15 @@ static int cups_queue_get(const char *sharename,
 	}
 
         if ((attr = ippFindAttribute(response, "printer-state-message",
-	                             IPP_TAG_TEXT)) != NULL)
-	        fstrcpy(status->message, attr->values[0].string.text);
+	                             IPP_TAG_TEXT)) != NULL) {
+		char *msg = NULL;
+		if (!pull_utf8_talloc(frame, &msg,
+				attr->values[0].string.text,
+				&size)) {
+			goto out;
+		}
+	        fstrcpy(status->message, msg);
+	}
 
        /*
         * Return the job queue...
@@ -1023,6 +1382,7 @@ static int cups_queue_get(const char *sharename,
 	if (http)
 		httpClose(http);
 
+	TALLOC_FREE(frame);
 	return qcount;
 }
 
@@ -1033,13 +1393,16 @@ static int cups_queue_get(const char *sharename,
 
 static int cups_queue_pause(int snum)
 {
+	TALLOC_CTX *frame = talloc_stackframe();
 	int		ret = 1;		/* Return value */
 	http_t		*http = NULL;		/* HTTP connection to server */
 	ipp_t		*request = NULL,	/* IPP Request */
 			*response = NULL;	/* IPP Response */
 	cups_lang_t	*language = NULL;	/* Default language */
+	char *printername = NULL;
+	char *username = NULL;
 	char		uri[HTTP_MAX_URI]; /* printer-uri attribute */
-
+	size_t size;
 
 	DEBUG(5,("cups_queue_pause(%d)\n", snum));
 
@@ -1053,7 +1416,7 @@ static int cups_queue_pause(int snum)
 	 * Try to connect to the server...
 	 */
 
-	if ((http = cups_connect()) == NULL) {
+	if ((http = cups_connect(frame)) == NULL) {
 		goto out;
 	}
 
@@ -1075,18 +1438,24 @@ static int cups_queue_pause(int snum)
 	language = cupsLangDefault();
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-        	     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
         	     "attributes-natural-language", NULL, language->language);
 
+	if (!push_utf8_talloc(frame, &printername, PRINTERNAME(snum), &size)) {
+		goto out;
+	}
 	slprintf(uri, sizeof(uri) - 1, "ipp://localhost/printers/%s",
-	         PRINTERNAME(snum));
+	         printername);
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, uri);
 
+	if (!push_utf8_talloc(frame, &username, current_user_info.unix_name, &size)) {
+		goto out;
+	}
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name",
-        	     NULL, current_user_info.unix_name);
+        	     NULL, username);
 
        /*
 	* Do the request and get back a response...
@@ -1114,6 +1483,7 @@ static int cups_queue_pause(int snum)
 	if (http)
 		httpClose(http);
 
+	TALLOC_FREE(frame);
 	return ret;
 }
 
@@ -1124,13 +1494,16 @@ static int cups_queue_pause(int snum)
 
 static int cups_queue_resume(int snum)
 {
+	TALLOC_CTX *frame = talloc_stackframe();
 	int		ret = 1;		/* Return value */
 	http_t		*http = NULL;		/* HTTP connection to server */
 	ipp_t		*request = NULL,	/* IPP Request */
 			*response = NULL;	/* IPP Response */
 	cups_lang_t	*language = NULL;	/* Default language */
+	char *printername = NULL;
+	char *username = NULL;
 	char		uri[HTTP_MAX_URI]; /* printer-uri attribute */
-
+	size_t size;
 
 	DEBUG(5,("cups_queue_resume(%d)\n", snum));
 
@@ -1144,7 +1517,7 @@ static int cups_queue_resume(int snum)
 	* Try to connect to the server...
 	*/
 
-	if ((http = cups_connect()) == NULL) {
+	if ((http = cups_connect(frame)) == NULL) {
 		goto out;
 	}
 
@@ -1166,18 +1539,24 @@ static int cups_queue_resume(int snum)
 	language = cupsLangDefault();
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-        	     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
         	     "attributes-natural-language", NULL, language->language);
 
+	if (!push_utf8_talloc(frame, &printername, PRINTERNAME(snum), &size)) {
+		goto out;
+	}
 	slprintf(uri, sizeof(uri) - 1, "ipp://localhost/printers/%s",
-	         PRINTERNAME(snum));
+	         printername);
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, uri);
 
+	if (!push_utf8_talloc(frame, &username, current_user_info.unix_name, &size)) {
+		goto out;
+	}
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name",
-        	     NULL, current_user_info.unix_name);
+        	     NULL, username);
 
        /*
 	* Do the request and get back a response...
@@ -1205,6 +1584,7 @@ static int cups_queue_resume(int snum)
 	if (http)
 		httpClose(http);
 
+	TALLOC_FREE(frame);
 	return ret;
 }
 
@@ -1226,15 +1606,16 @@ struct printif	cups_printif =
 
 bool cups_pull_comment_location(NT_PRINTER_INFO_LEVEL_2 *printer)
 {
+	TALLOC_CTX *frame = talloc_stackframe();
 	http_t		*http = NULL;		/* HTTP connection to server */
 	ipp_t		*request = NULL,	/* IPP Request */
 			*response = NULL;	/* IPP Response */
 	ipp_attribute_t	*attr;		/* Current attribute */
 	cups_lang_t	*language = NULL;	/* Default language */
-	char		*name,		/* printer-name attribute */
-			*info,		/* printer-info attribute */
-			*location;	/* printer-location attribute */
 	char		uri[HTTP_MAX_URI];
+	char *server = NULL;
+	char *sharename = NULL;
+	char *name = NULL;
 	static const char *requested[] =/* Requested attributes */
 			{
 			  "printer-name",
@@ -1242,6 +1623,7 @@ bool cups_pull_comment_location(NT_PRINTER_INFO_LEVEL_2 *printer)
 			  "printer-location"
 			};
 	bool ret = False;
+	size_t size;
 
 	DEBUG(5, ("pulling %s location\n", printer->sharename));
 
@@ -1255,7 +1637,7 @@ bool cups_pull_comment_location(NT_PRINTER_INFO_LEVEL_2 *printer)
 	 * Try to connect to the server...
 	 */
 
-	if ((http = cups_connect()) == NULL) {
+	if ((http = cups_connect(frame)) == NULL) {
 		goto out;
 	}
 
@@ -1267,13 +1649,26 @@ bool cups_pull_comment_location(NT_PRINTER_INFO_LEVEL_2 *printer)
 	language = cupsLangDefault();
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-                     "attributes-charset", NULL, cupsLangEncoding(language));
+                     "attributes-charset", NULL, "utf-8");
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
                      "attributes-natural-language", NULL, language->language);
 
+	if (lp_cups_server() != NULL && strlen(lp_cups_server()) > 0) {
+		if (!push_utf8_talloc(frame, &server, lp_cups_server(), &size)) {
+			goto out;
+		}
+	} else {
+		server = talloc_strdup(frame,cupsServer());
+	}
+	if (server) {
+		goto out;
+	}
+	if (!push_utf8_talloc(frame, &sharename, printer->sharename, &size)) {
+		goto out;
+	}
 	slprintf(uri, sizeof(uri) - 1, "ipp://%s/printers/%s",
-		 lp_cups_server(), printer->sharename);
+		 server, sharename);
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI,
                      "printer-uri", NULL, uri);
@@ -1308,43 +1703,64 @@ bool cups_pull_comment_location(NT_PRINTER_INFO_LEVEL_2 *printer)
 		 * Pull the needed attributes from this printer...
 		 */
 
-		name       = NULL;
-		info       = NULL;
-		location   = NULL;
-
 		while ( attr && (attr->group_tag == IPP_TAG_PRINTER) ) {
+        		if (strcmp(attr->name, "printer-name") == 0 &&
+			    attr->value_tag == IPP_TAG_NAME) {
+				if (!pull_utf8_talloc(frame,
+						&name,
+						attr->values[0].string.text,
+						&size)) {
+					goto out;
+				}
+			}
+
 			/* Grab the comment if we don't have one */
         		if ( (strcmp(attr->name, "printer-info") == 0)
 			     && (attr->value_tag == IPP_TAG_TEXT)
-			     && !strlen(printer->comment) ) 
+			     && !strlen(printer->comment) )
 			{
+				char *comment = NULL;
+				if (!pull_utf8_talloc(frame,
+						&comment,
+						attr->values[0].string.text,
+						&size)) {
+					goto out;
+				}
 				DEBUG(5,("cups_pull_comment_location: Using cups comment: %s\n",
-					 attr->values[0].string.text));				
+					 comment));
 			    	strlcpy(printer->comment,
-						attr->values[0].string.text,
-						sizeof(printer->comment));
+					comment,
+					sizeof(printer->comment));
 			}
 
-			/* Grab the location if we don't have one */ 
+			/* Grab the location if we don't have one */
 			if ( (strcmp(attr->name, "printer-location") == 0)
-			     && (attr->value_tag == IPP_TAG_TEXT) 
+			     && (attr->value_tag == IPP_TAG_TEXT)
 			     && !strlen(printer->location) )
 			{
+				char *location = NULL;
+				if (!pull_utf8_talloc(frame,
+						&location,
+						attr->values[0].string.text,
+						&size)) {
+					goto out;
+				}
 				DEBUG(5,("cups_pull_comment_location: Using cups location: %s\n",
-					 attr->values[0].string.text));				
-			    	fstrcpy(printer->location,attr->values[0].string.text);
+					 location));
+			    	strlcpy(printer->location,
+					location,
+					sizeof(printer->location));
 			}
 
         		attr = attr->next;
 		}
 
 		/*
-		 * See if we have everything needed...
+		 * We have everything needed...
 		 */
 
-		if (name == NULL)
+		if (name != NULL)
 			break;
-
 	}
 
 	ret = True;
@@ -1359,6 +1775,7 @@ bool cups_pull_comment_location(NT_PRINTER_INFO_LEVEL_2 *printer)
 	if (http)
 		httpClose(http);
 
+	TALLOC_FREE(frame);
 	return ret;
 }
 
diff --git a/source3/registry/reg_dispatcher.c b/source3/registry/reg_dispatcher.c
index c68ecdedeb..d06410a1b3 100644
--- a/source3/registry/reg_dispatcher.c
+++ b/source3/registry/reg_dispatcher.c
@@ -37,7 +37,6 @@ static const struct generic_mapping reg_generic_map =
 static WERROR construct_registry_sd(TALLOC_CTX *ctx, SEC_DESC **psd)
 {
 	SEC_ACE ace[3];
-	SEC_ACCESS mask;
 	size_t i = 0;
 	SEC_DESC *sd;
 	SEC_ACL *acl;
@@ -45,21 +44,18 @@ static WERROR construct_registry_sd(TALLOC_CTX *ctx, SEC_DESC **psd)
 
 	/* basic access for Everyone */
 
-	init_sec_access(&mask, REG_KEY_READ);
 	init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
-		     mask, 0);
+		     REG_KEY_READ, 0);
 
 	/* Full Access 'BUILTIN\Administrators' */
 
-	init_sec_access(&mask, REG_KEY_ALL);
 	init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
-		     SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+		     SEC_ACE_TYPE_ACCESS_ALLOWED, REG_KEY_ALL, 0);
 
 	/* Full Access 'NT Authority\System' */
 
-	init_sec_access(&mask, REG_KEY_ALL );
 	init_sec_ace(&ace[i++], &global_sid_System, SEC_ACE_TYPE_ACCESS_ALLOWED,
-		     mask, 0);
+		     REG_KEY_ALL, 0);
 
 	/* create the security descriptor */
 
diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index 94517f3478..0e9d121242 100644
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -290,22 +290,18 @@ static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *s
 	DOM_SID adm_sid;
 
 	SEC_ACE ace[3];
-	SEC_ACCESS mask;
 
 	SEC_ACL *psa = NULL;
 
-	init_sec_access(&mask, LSA_POLICY_EXECUTE);
-	init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, LSA_POLICY_EXECUTE, 0);
 
 	sid_copy(&adm_sid, get_global_sam_sid());
 	sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
-	init_sec_access(&mask, LSA_POLICY_ALL_ACCESS);
-	init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, LSA_POLICY_ALL_ACCESS, 0);
 
 	sid_copy(&local_adm_sid, &global_sid_Builtin);
 	sid_append_rid(&local_adm_sid, BUILTIN_ALIAS_RID_ADMINS);
-	init_sec_access(&mask, LSA_POLICY_ALL_ACCESS);
-	init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, LSA_POLICY_ALL_ACCESS, 0);
 
 	if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
 		return NT_STATUS_NO_MEMORY;
diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 1b1e98c049..6455f02374 100644
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -113,36 +113,35 @@ static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd
 {
 	DOM_SID domadmin_sid;
 	SEC_ACE ace[5];		/* at most 5 entries */
-	SEC_ACCESS mask;
 	size_t i = 0;
 
 	SEC_ACL *psa = NULL;
 
 	/* basic access for Everyone */
 
-	init_sec_access(&mask, map->generic_execute | map->generic_read );
-	init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
+			map->generic_execute | map->generic_read, 0);
 
 	/* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
 
-	init_sec_access(&mask, map->generic_all);
-
-	init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
-	init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
+			SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
+	init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators,
+			SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 
 	/* Add Full Access for Domain Admins if we are a DC */
 
 	if ( IS_DC ) {
 		sid_copy( &domadmin_sid, get_global_sam_sid() );
 		sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
-		init_sec_ace(&ace[i++], &domadmin_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+		init_sec_ace(&ace[i++], &domadmin_sid,
+			SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 	}
 
 	/* if we have a sid, give it some special access */
 
 	if ( sid ) {
-		init_sec_access( &mask, sid_access );
-		init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+		init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, sid_access, 0);
 	}
 
 	/* create the security descriptor */
diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c
index bb9c3687fb..47688b114c 100644
--- a/source3/rpc_server/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srv_srvsvc_nt.c
@@ -1700,7 +1700,9 @@ WERROR _srvsvc_NetShareAdd(pipes_struct *p,
 
 	DEBUG(5,("_srvsvc_NetShareAdd: %d\n", __LINE__));
 
-	*r->out.parm_error = 0;
+	if (r->out.parm_error) {
+		*r->out.parm_error = 0;
+	}
 
 	get_current_user(&user,p);
 
@@ -2148,6 +2150,8 @@ WERROR _srvsvc_NetSetFileSecurity(pipes_struct *p,
 	connection_struct *conn = NULL;
 	int snum;
 	char *oldcwd = NULL;
+	struct security_descriptor *psd = NULL;
+	uint32_t security_info_sent = 0;
 
 	ZERO_STRUCT(st);
 
@@ -2196,9 +2200,29 @@ WERROR _srvsvc_NetSetFileSecurity(pipes_struct *p,
 		goto error_exit;
 	}
 
+	psd = r->in.sd_buf->sd;
+	security_info_sent = r->in.securityinformation;
+
+	if (psd->owner_sid==0) {
+		security_info_sent &= ~OWNER_SECURITY_INFORMATION;
+	}
+	if (psd->group_sid==0) {
+		security_info_sent &= ~GROUP_SECURITY_INFORMATION;
+	}
+	if (psd->sacl==0) {
+		security_info_sent &= ~SACL_SECURITY_INFORMATION;
+	}
+	if (psd->dacl==0) {
+		security_info_sent &= ~DACL_SECURITY_INFORMATION;
+	}
+
+	/* Convert all the generic bits. */
+	security_acl_map_generic(psd->dacl, &file_generic_mapping);
+	security_acl_map_generic(psd->sacl, &file_generic_mapping);
+
 	nt_status = SMB_VFS_FSET_NT_ACL(fsp,
-				       r->in.securityinformation,
-				       r->in.sd_buf->sd);
+					security_info_sent,
+					psd);
 
 	if (!NT_STATUS_IS_OK(nt_status) ) {
 		DEBUG(3,("_srvsvc_NetSetFileSecurity: Unable to set NT ACL "
diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c
index 6bb538a311..a57d0ff4a4 100644
--- a/source3/rpc_server/srv_svcctl_nt.c
+++ b/source3/rpc_server/srv_svcctl_nt.c
@@ -140,7 +140,6 @@ static NTSTATUS svcctl_access_check( SEC_DESC *sec_desc, NT_USER_TOKEN *token,
 static SEC_DESC* construct_scm_sd( TALLOC_CTX *ctx )
 {
 	SEC_ACE ace[2];
-	SEC_ACCESS mask;
 	size_t i = 0;
 	SEC_DESC *sd;
 	SEC_ACL *acl;
@@ -148,13 +147,13 @@ static SEC_DESC* construct_scm_sd( TALLOC_CTX *ctx )
 
 	/* basic access for Everyone */
 
-	init_sec_access(&mask, SC_MANAGER_READ_ACCESS );
-	init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[i++], &global_sid_World,
+		SEC_ACE_TYPE_ACCESS_ALLOWED, SC_MANAGER_READ_ACCESS, 0);
 
 	/* Full Access 'BUILTIN\Administrators' */
 
-	init_sec_access(&mask,SC_MANAGER_ALL_ACCESS );
-	init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
+		SEC_ACE_TYPE_ACCESS_ALLOWED, SC_MANAGER_ALL_ACCESS, 0);
 
 
 	/* create the security descriptor */
diff --git a/source3/samba4.m4 b/source3/samba4.m4
index 728fd2d45d..81f1809210 100644
--- a/source3/samba4.m4
+++ b/source3/samba4.m4
@@ -35,7 +35,7 @@ SMB_EXT_LIB_FROM_PKGCONFIG(LIBTALLOC, talloc >= 1.2.0,
 	]
 )
 
-SMB_EXT_LIB_FROM_PKGCONFIG(LIBTDB, tdb >= 1.1.0,
+SMB_EXT_LIB_FROM_PKGCONFIG(LIBTDB, tdb >= 1.1.3,
 	[],
 	[
 		m4_include(../lib/tdb/libtdb.m4)
diff --git a/source3/samba4.mk b/source3/samba4.mk
index 53ea76ed90..524fc9f64c 100644
--- a/source3/samba4.mk
+++ b/source3/samba4.mk
@@ -87,7 +87,7 @@ libstreamsrcdir := $(samba4srcdir)/lib/stream
 libutilsrcdir := $(samba4srcdir)/lib/util
 libtdrsrcdir := $(samba4srcdir)/lib/tdr
 libdbwrapsrcdir := $(samba4srcdir)/lib/dbwrap
-libcryptosrcdir := $(samba4srcdir)/lib/crypto
+libcryptosrcdir := $(samba4srcdir)/../lib/crypto
 libtorturesrcdir := $(samba4srcdir)/lib/torture
 libcompressionsrcdir := $(samba4srcdir)/../lib/compression
 libgencachesrcdir := $(samba4srcdir)/lib
@@ -107,7 +107,7 @@ ntvfssrcdir := $(samba4srcdir)/ntvfs
 ntptrsrcdir := $(samba4srcdir)/ntptr
 clientsrcdir := $(samba4srcdir)/client
 libclisrcdir := $(samba4srcdir)/libcli
-libclinbtsrcdir := $(samba4srcdir)/../libcli
+libclinbtsrcdir := $(samba4srcdir)/../libcli/nbt
 pyscriptsrcdir := $(samba4srcdir)/scripting/python
 kdcsrcdir := $(samba4srcdir)/kdc
 smbreadlinesrcdir := $(samba4srcdir)/lib/smbreadline
diff --git a/source3/script/tests/wb_pad.sh b/source3/script/tests/wb_pad.sh
new file mode 100755
index 0000000000..f1f5ca24c4
--- /dev/null
+++ b/source3/script/tests/wb_pad.sh
@@ -0,0 +1,82 @@
+#!/bin/sh
+#
+# Copyright (C) Guenther Deschner 2008
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+tempdir=`mktemp -d /tmp/wb_padXXXXXX`
+test -n "$tempdir" || exit 1
+cat >> $tempdir/wb_pad.c << _EOF
+#include "nsswitch/winbind_client.h"
+
+int main(int argc, const char **argv)
+{
+	struct winbindd_request req;
+	struct winbindd_response resp;
+
+	if (argc != 2) {
+		printf("usage: %s [req|resp]\n", argv[0]);
+		return 0;
+	}
+
+	if (strcmp(argv[1], "req") == 0) {
+		printf("%d\n", (uint32_t)sizeof(req));
+	}
+	if (strcmp(argv[1], "resp") == 0) {
+		printf("%d\n", (uint32_t)sizeof(resp));
+	}
+
+	return 0;
+}
+_EOF
+
+cleanup() {
+	rm -f $tempdir/wb_pad_32 $tempdir/wb_pad_64 $tempdir/wb_pad.c
+	rmdir $tempdir
+}
+
+cflags="-I. -I./../lib/replace -Iinclude"
+${CC:-gcc} -m32 $RPM_OPT_FLAGS $CFLAGS -o $tempdir/wb_pad_32 $cflags $tempdir/wb_pad.c
+if [ $? -ne 0 ]; then
+	cleanup
+	exit 1
+fi
+${CC:-gcc} -m64 $RPM_OPT_FLAGS $CFLAGS -o $tempdir/wb_pad_64 $cflags $tempdir/wb_pad.c
+if [ $? -ne 0 ]; then
+	cleanup
+	exit 1
+fi
+
+out_64_req=`$tempdir/wb_pad_64 req`
+out_64_resp=`$tempdir/wb_pad_64 resp`
+out_32_req=`$tempdir/wb_pad_32 req`
+out_32_resp=`$tempdir/wb_pad_32 resp`
+
+cleanup
+
+if test "$out_64_req" != "$out_32_req"; then
+	echo "winbind request size differs!"
+	echo "64bit: $out_64_req"
+	echo "32bit: $out_32_req"
+	exit 1
+fi
+
+if test "$out_64_resp" != "$out_32_resp"; then
+	echo "winbind response size differs!"
+	echo "64bit: $out_64_resp"
+	echo "32bit: $out_32_resp"
+	exit 1
+fi
+
+exit 0
diff --git a/source3/services/services_db.c b/source3/services/services_db.c
index 8f58c2dbfa..0f5264bcd8 100644
--- a/source3/services/services_db.c
+++ b/source3/services/services_db.c
@@ -89,7 +89,6 @@ struct service_display_info common_unix_svcs[] = {
 static SEC_DESC* construct_service_sd( TALLOC_CTX *ctx )
 {
 	SEC_ACE ace[4];
-	SEC_ACCESS mask;
 	size_t i = 0;
 	SEC_DESC *sd = NULL;
 	SEC_ACL *acl = NULL;
@@ -97,15 +96,16 @@ static SEC_DESC* construct_service_sd( TALLOC_CTX *ctx )
 
 	/* basic access for Everyone */
 
-	init_sec_access(&mask, SERVICE_READ_ACCESS );
-	init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[i++], &global_sid_World,
+		SEC_ACE_TYPE_ACCESS_ALLOWED, SERVICE_READ_ACCESS, 0);
 
-	init_sec_access(&mask,SERVICE_EXECUTE_ACCESS );
-	init_sec_ace(&ace[i++], &global_sid_Builtin_Power_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[i++], &global_sid_Builtin_Power_Users,
+			SEC_ACE_TYPE_ACCESS_ALLOWED, SERVICE_EXECUTE_ACCESS, 0);
 
-	init_sec_access(&mask,SERVICE_ALL_ACCESS );
-	init_sec_ace(&ace[i++], &global_sid_Builtin_Server_Operators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
-	init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+	init_sec_ace(&ace[i++], &global_sid_Builtin_Server_Operators,
+		SEC_ACE_TYPE_ACCESS_ALLOWED, SERVICE_ALL_ACCESS, 0);
+	init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
+		SEC_ACE_TYPE_ACCESS_ALLOWED, SERVICE_ALL_ACCESS, 0);
 
 	/* create the security descriptor */
 
diff --git a/source3/smbd/conn.c b/source3/smbd/conn.c
index b9433bb965..7f34d2b8e2 100644
--- a/source3/smbd/conn.c
+++ b/source3/smbd/conn.c
@@ -252,8 +252,8 @@ void conn_free_internal(connection_struct *conn)
 	/* Free vfs_connection_struct */
 	handle = conn->vfs_handles;
 	while(handle) {
-		DLIST_REMOVE(conn->vfs_handles, handle);
 		thandle = handle->next;
+		DLIST_REMOVE(conn->vfs_handles, handle);
 		if (handle->free_data)
 			handle->free_data(&handle->data);
 		handle = thandle;
diff --git a/source3/smbd/connection.c b/source3/smbd/connection.c
index 8dd5964f5f..fd83f77725 100644
--- a/source3/smbd/connection.c
+++ b/source3/smbd/connection.c
@@ -2,17 +2,17 @@
    Unix SMB/CIFS implementation.
    connection claim routines
    Copyright (C) Andrew Tridgell 1998
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
@@ -63,7 +63,7 @@ static int count_fn(struct db_record *rec,
 		    void *udp)
 {
 	struct count_stat *cs = (struct count_stat *)udp;
- 
+
 	if (crec->cnum == -1) {
 		return 0;
 	}
@@ -159,7 +159,7 @@ bool claim_connection(connection_struct *conn, const char *name,
 	}
 	crec.start = time(NULL);
 	crec.bcast_msg_flags = msg_flags;
-	
+
 	strlcpy(crec.machine,get_remote_machine_name(),sizeof(crec.machine));
 	strlcpy(crec.addr,conn?conn->client_address:
 			client_addr(get_client_fd(),addr,sizeof(addr)),
@@ -232,17 +232,17 @@ static TDB_DATA* make_pipe_rec_key( struct pipe_open_rec *prec )
 {
 	TDB_DATA *kbuf = NULL;
 	fstring key_string;
-	
+
 	if ( !prec )
 		return NULL;
-	
+
 	if ( (kbuf = TALLOC_P(prec, TDB_DATA)) == NULL ) {
 		return NULL;
 	}
-	
+
 	snprintf( key_string, sizeof(key_string), "%s/%d/%d",
 		prec->name, procid_to_pid(&prec->pid), prec->pnum );
-		
+
 	*kbuf = string_term_tdb_data(talloc_strdup(prec, key_string));
 	if (kbuf->dptr == NULL )
 		return NULL;
@@ -273,17 +273,17 @@ bool store_pipe_opendb( smb_np_struct *p )
 	TDB_DATA *key;
 	TDB_DATA data;
 	bool ret = False;
-	
-	if ( (prec = TALLOC_P( NULL, struct pipe_open_rec)) == NULL ) {
+
+	if ( (prec = TALLOC_P( talloc_tos(), struct pipe_open_rec)) == NULL ) {
 		DEBUG(0,("store_pipe_opendb: talloc failed!\n"));
 		return False;
 	}
-	
+
 	fill_pipe_open_rec( prec, p );
 	if ( (key = make_pipe_rec_key( prec )) == NULL ) {
 		goto done;
 	}
-	
+
 	data.dptr = (uint8 *)prec;
 	data.dsize = sizeof(struct pipe_open_rec);
 
@@ -293,7 +293,7 @@ bool store_pipe_opendb( smb_np_struct *p )
 	}
 
 	ret = NT_STATUS_IS_OK(dbrec->store(dbrec, data, TDB_REPLACE));
-	
+
 done:
 	TALLOC_FREE( prec );	
 	return ret;
@@ -308,24 +308,24 @@ bool delete_pipe_opendb( smb_np_struct *p )
 	struct pipe_open_rec *prec;
 	TDB_DATA *key;
 	bool ret = False;
-	
-	if ( (prec = TALLOC_P( NULL, struct pipe_open_rec)) == NULL ) {
+
+	if ( (prec = TALLOC_P( talloc_tos(), struct pipe_open_rec)) == NULL ) {
 		DEBUG(0,("store_pipe_opendb: talloc failed!\n"));
 		return False;
 	}
-	
+
 	fill_pipe_open_rec( prec, p );
 	if ( (key = make_pipe_rec_key( prec )) == NULL ) {
 		goto done;
 	}
-	
+
 	if (!(dbrec = connections_fetch_record(prec, *key))) {
 		DEBUG(0, ("connections_fetch_record failed\n"));
 		goto done;
 	}
 
 	ret = NT_STATUS_IS_OK(dbrec->delete_rec(dbrec));
-	
+
 done:
 	TALLOC_FREE( prec );
 	return ret;
diff --git a/source3/smbd/fake_file.c b/source3/smbd/fake_file.c
index 8dd9abee1a..1761cb66a8 100644
--- a/source3/smbd/fake_file.c
+++ b/source3/smbd/fake_file.c
@@ -146,14 +146,6 @@ NTSTATUS open_fake_file(connection_struct *conn,
 	return NT_STATUS_OK;
 }
 
-void destroy_fake_file_handle(struct fake_file_handle **fh)
-{
-	if (!fh) {
-		return;
-	}
-	TALLOC_FREE(*fh);
-}
-
 NTSTATUS close_fake_file(files_struct *fsp)
 {
 	file_free(fsp);
diff --git a/source3/smbd/files.c b/source3/smbd/files.c
index 17c473f028..519f4945f2 100644
--- a/source3/smbd/files.c
+++ b/source3/smbd/files.c
@@ -122,10 +122,12 @@ NTSTATUS file_new(connection_struct *conn, files_struct **result)
 
 	chain_fsp = fsp;
 
-	/* A new fsp invalidates a negative fsp_fi_cache. */
-	if (fsp_fi_cache.fsp == NULL) {
-		ZERO_STRUCT(fsp_fi_cache);
-	}
+	/* A new fsp invalidates the positive and
+	  negative fsp_fi_cache as the new fsp is pushed
+	  at the start of the list and we search from
+	  a cache hit to the *end* of the list. */
+
+	ZERO_STRUCT(fsp_fi_cache);
 
 	*result = fsp;
 	return NT_STATUS_OK;
@@ -326,8 +328,7 @@ files_struct *file_find_di_first(struct file_id id)
 	fsp_fi_cache.id = id;
 
 	for (fsp=Files;fsp;fsp=fsp->next) {
-		if ( fsp->fh->fd != -1 &&
-		     file_id_equal(&fsp->file_id, &id)) {
+		if (file_id_equal(&fsp->file_id, &id)) {
 			/* Setup positive cache. */
 			fsp_fi_cache.fsp = fsp;
 			return fsp;
@@ -348,8 +349,7 @@ files_struct *file_find_di_next(files_struct *start_fsp)
 	files_struct *fsp;
 
 	for (fsp = start_fsp->next;fsp;fsp=fsp->next) {
-		if ( fsp->fh->fd != -1 &&
-		     file_id_equal(&fsp->file_id, &start_fsp->file_id)) {
+		if (file_id_equal(&fsp->file_id, &start_fsp->file_id)) {
 			return fsp;
 		}
 	}
@@ -400,9 +400,7 @@ void file_free(files_struct *fsp)
 
 	string_free(&fsp->fsp_name);
 
-	if (fsp->fake_file_handle) {
-		destroy_fake_file_handle(&fsp->fake_file_handle);
-	}
+	TALLOC_FREE(fsp->fake_file_handle);
 
 	if (fsp->fh->ref_count == 1) {
 		SAFE_FREE(fsp->fh);
diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index f4c45999ba..a824ab7fd3 100644
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -5,17 +5,17 @@
 
    SMB Version handling
    Copyright (C) John H Terpstra 1995-1998
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
    */
@@ -162,7 +162,7 @@ void send_trans_reply(connection_struct *conn, const uint8_t *inbuf,
 		copy_trans_params_and_data(outbuf, align,
 					   rparam, tot_param_sent, this_lparam,
 					   rdata, tot_data_sent, this_ldata);
-		
+
 		SSVAL(outbuf,smb_vwv3,this_lparam);
 		SSVAL(outbuf,smb_vwv4,smb_offset(smb_buf(outbuf)+1,outbuf));
 		SSVAL(outbuf,smb_vwv5,tot_param_sent);
@@ -318,7 +318,7 @@ static void api_fd_reply(connection_struct *conn, uint16 vuid,
 	/* Get the file handle and hence the file name. */
 	/* 
 	 * NB. The setup array has already been transformed
-	 * via SVAL and so is in gost byte order.
+	 * via SVAL and so is in host byte order.
 	 */
 	pnum = ((int)setup[1]) & 0xFFFF;
 	subcommand = ((int)setup[0]) & 0xFFFF;
@@ -735,11 +735,11 @@ void reply_transs(struct smb_request *req)
 
 	state->received_param += pcnt;
 	state->received_data += dcnt;
-		
+
 	if ((state->received_data > state->total_data) ||
 	    (state->received_param > state->total_param))
 		goto bad_param;
-		
+
 	if (pcnt) {
 		if (pdisp > state->total_param ||
 				pcnt > state->total_param ||
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 584399c86c..43492bf8b6 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -22,6 +22,7 @@
 
 extern int max_send;
 extern enum protocol_types Protocol;
+extern const struct generic_mapping file_generic_mapping;
 
 static char *nttrans_realloc(char **ptr, size_t size)
 {
@@ -739,6 +740,10 @@ static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
 		security_info_sent &= ~DACL_SECURITY_INFORMATION;
 	}
 
+	/* Convert all the generic bits. */
+	security_acl_map_generic(psd->dacl, &file_generic_mapping);
+	security_acl_map_generic(psd->sacl, &file_generic_mapping);
+
 	status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
 
 	TALLOC_FREE(psd);
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 71191475b3..8727e80d5f 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -2608,9 +2608,7 @@ NTSTATUS create_file_unixpath(connection_struct *conn,
 	    && (create_disposition != FILE_CREATE)
 	    && (share_access & FILE_SHARE_DELETE)
 	    && (access_mask & DELETE_ACCESS)
-	    && (((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY)
-		 && !lp_delete_readonly(SNUM(conn)))
-		|| !can_delete_file_in_directory(conn, fname))) {
+	    && (!can_delete_file_in_directory(conn, fname))) {
 		status = NT_STATUS_ACCESS_DENIED;
 		goto fail;
 	}
@@ -2766,6 +2764,10 @@ NTSTATUS create_file_unixpath(connection_struct *conn,
 
 		fsp->access_mask = FILE_GENERIC_ALL;
 
+		/* Convert all the generic bits. */
+		security_acl_map_generic(sd->dacl, &file_generic_mapping);
+		security_acl_map_generic(sd->sacl, &file_generic_mapping);
+
 		status = SMB_VFS_FSET_NT_ACL(fsp, sec_info_sent, sd);
 
 		fsp->access_mask = saved_access_mask;
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 7479aea076..4e35e9deaa 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -890,13 +890,12 @@ static bool nt4_compatible_acls(void)
  not get. Deny entries are implicit on get with ace->perms = 0.
 ****************************************************************************/
 
-static SEC_ACCESS map_canon_ace_perms(int snum,
+static uint32_t map_canon_ace_perms(int snum,
 				enum security_ace_type *pacl_type,
 				mode_t perms,
 				bool directory_ace)
 {
-	SEC_ACCESS sa;
-	uint32 nt_mask = 0;
+	uint32_t nt_mask = 0;
 
 	*pacl_type = SEC_ACE_TYPE_ACCESS_ALLOWED;
 
@@ -935,8 +934,7 @@ static SEC_ACCESS map_canon_ace_perms(int snum,
 	DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
 			(unsigned int)perms, (unsigned int)nt_mask ));
 
-	init_sec_access(&sa,nt_mask);
-	return sa;
+	return nt_mask;
 }
 
 /****************************************************************************
@@ -988,7 +986,7 @@ static mode_t map_nt_perms( uint32 *mask, int type)
  Unpack a SEC_DESC into a UNIX owner and group.
 ****************************************************************************/
 
-NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, SEC_DESC *psd)
+NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd)
 {
 	DOM_SID owner_sid;
 	DOM_SID grp_sid;
@@ -1329,11 +1327,13 @@ static void check_owning_objs(canon_ace *ace, DOM_SID *pfile_owner_sid, DOM_SID
  Unpack a SEC_DESC into two canonical ace lists.
 ****************************************************************************/
 
-static bool create_canon_ace_lists(files_struct *fsp, SMB_STRUCT_STAT *pst,
-							DOM_SID *pfile_owner_sid,
-							DOM_SID *pfile_grp_sid,
-							canon_ace **ppfile_ace, canon_ace **ppdir_ace,
-							SEC_ACL *dacl)
+static bool create_canon_ace_lists(files_struct *fsp,
+					SMB_STRUCT_STAT *pst,
+					DOM_SID *pfile_owner_sid,
+					DOM_SID *pfile_grp_sid,
+					canon_ace **ppfile_ace,
+					canon_ace **ppdir_ace,
+					const SEC_ACL *dacl)
 {
 	bool all_aces_are_inherit_only = (fsp->is_directory ? True : False);
 	canon_ace *file_ace = NULL;
@@ -2016,12 +2016,14 @@ static mode_t create_default_mode(files_struct *fsp, bool interitable_mode)
  succeeding.
 ****************************************************************************/
 
-static bool unpack_canon_ace(files_struct *fsp, 
-							SMB_STRUCT_STAT *pst,
-							DOM_SID *pfile_owner_sid,
-							DOM_SID *pfile_grp_sid,
-							canon_ace **ppfile_ace, canon_ace **ppdir_ace,
-							uint32 security_info_sent, SEC_DESC *psd)
+static bool unpack_canon_ace(files_struct *fsp,
+				SMB_STRUCT_STAT *pst,
+				DOM_SID *pfile_owner_sid,
+				DOM_SID *pfile_grp_sid,
+				canon_ace **ppfile_ace,
+				canon_ace **ppdir_ace,
+				uint32 security_info_sent,
+				const SEC_DESC *psd)
 {
 	canon_ace *file_ace = NULL;
 	canon_ace *dir_ace = NULL;
@@ -2958,9 +2960,7 @@ static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
 			 */
 
 			for (ace = file_ace; ace != NULL; ace = ace->next) {
-				SEC_ACCESS acc;
-
-				acc = map_canon_ace_perms(SNUM(conn),
+				uint32_t acc = map_canon_ace_perms(SNUM(conn),
 						&nt_acl_type,
 						ace->perms,
 						S_ISDIR(sbuf->st_mode));
@@ -2975,19 +2975,14 @@ static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
 			/* The User must have access to a profile share - even
 			 * if we can't map the SID. */
 			if (lp_profile_acls(SNUM(conn))) {
-				SEC_ACCESS acc;
-
-				init_sec_access(&acc,FILE_GENERIC_ALL);
 				init_sec_ace(&nt_ace_list[num_aces++],
 						&global_sid_Builtin_Users,
 						SEC_ACE_TYPE_ACCESS_ALLOWED,
-						acc, 0);
+						FILE_GENERIC_ALL, 0);
 			}
 
 			for (ace = dir_ace; ace != NULL; ace = ace->next) {
-				SEC_ACCESS acc;
-
-				acc = map_canon_ace_perms(SNUM(conn),
+				uint32_t acc = map_canon_ace_perms(SNUM(conn),
 						&nt_acl_type,
 						ace->perms,
 						S_ISDIR(sbuf->st_mode));
@@ -3005,10 +3000,7 @@ static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
 			/* The User must have access to a profile share - even
 			 * if we can't map the SID. */
 			if (lp_profile_acls(SNUM(conn))) {
-				SEC_ACCESS acc;
-
-				init_sec_access(&acc,FILE_GENERIC_ALL);
-				init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, acc,
+				init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, FILE_GENERIC_ALL,
 						SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
 						SEC_ACE_FLAG_INHERIT_ONLY|0);
 			}
@@ -3223,26 +3215,26 @@ int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_t gid)
  Take care of parent ACL inheritance.
 ****************************************************************************/
 
-static NTSTATUS append_parent_acl(files_struct *fsp,
-				SMB_STRUCT_STAT *psbuf,
-				SEC_DESC *psd,
+NTSTATUS append_parent_acl(files_struct *fsp,
+				const SEC_DESC *pcsd,
 				SEC_DESC **pp_new_sd)
 {
 	SEC_DESC *parent_sd = NULL;
 	files_struct *parent_fsp = NULL;
-	TALLOC_CTX *mem_ctx = talloc_parent(psd);
+	TALLOC_CTX *mem_ctx = talloc_tos();
 	char *parent_name = NULL;
 	SEC_ACE *new_ace = NULL;
-	unsigned int num_aces = psd->dacl->num_aces;
+	unsigned int num_aces = pcsd->dacl->num_aces;
 	SMB_STRUCT_STAT sbuf;
 	NTSTATUS status;
 	int info;
 	unsigned int i, j;
-	bool is_dacl_protected = (psd->type & SE_DESC_DACL_PROTECTED);
+	SEC_DESC *psd = dup_sec_desc(talloc_tos(), pcsd);
+	bool is_dacl_protected = (pcsd->type & SE_DESC_DACL_PROTECTED);
 
 	ZERO_STRUCT(sbuf);
 
-	if (mem_ctx == NULL) {
+	if (psd == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
@@ -3398,11 +3390,6 @@ static NTSTATUS append_parent_acl(files_struct *fsp,
 			parent_name));
 	}
 
-	/* This sucks. psd should be const and we should
-	 * be doing a deep-copy here. We're getting away
-	 * with is as we know parent_sd is talloced off
-	 * talloc_tos() as well as psd. JRA. */
-
 	psd->dacl->aces = new_ace;
 	psd->dacl->num_aces = i;
 	psd->type &= ~(SE_DESC_DACL_AUTO_INHERITED|
@@ -3418,7 +3405,7 @@ static NTSTATUS append_parent_acl(files_struct *fsp,
  This should be the only external function needed for the UNIX style set ACL.
 ****************************************************************************/
 
-NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd)
+NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const SEC_DESC *psd)
 {
 	connection_struct *conn = fsp->conn;
 	uid_t user = (uid_t)-1;
@@ -3529,10 +3516,12 @@ NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd)
 			      SE_DESC_DACL_AUTO_INHERIT_REQ))==
 			(SE_DESC_DACL_AUTO_INHERITED|
 			 SE_DESC_DACL_AUTO_INHERIT_REQ) ) {
-		status = append_parent_acl(fsp, &sbuf, psd, &psd);
+		SEC_DESC *new_sd = NULL;
+		status = append_parent_acl(fsp, psd, &new_sd);
 		if (!NT_STATUS_IS_OK(status)) {
 			return status;
 		}
+		psd = new_sd;
 	}
 
 	acl_perms = unpack_canon_ace( fsp, &sbuf, &file_owner_sid, &file_grp_sid,
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index b2d19e11e3..32629fd392 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -706,7 +706,7 @@ The timeout is in milliseconds
 ****************************************************************************/
 
 static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
-				       size_t *buffer_len, int timeout,
+				       size_t *buffer_len,
 				       size_t *p_unread, bool *p_encrypted)
 {
 	fd_set r_fds, w_fds;
@@ -720,13 +720,8 @@ static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
 
  again:
 
-	if (timeout >= 0) {
-		to.tv_sec = timeout / 1000;
-		to.tv_usec = (timeout % 1000) * 1000;
-	} else {
-		to.tv_sec = SMBD_SELECT_TIMEOUT;
-		to.tv_usec = 0;
-	}
+	to.tv_sec = SMBD_SELECT_TIMEOUT;
+	to.tv_usec = 0;
 
 	/*
 	 * Note that this call must be before processing any SMB
@@ -869,7 +864,7 @@ static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
 
 	/* Did we timeout ? */
 	if (selrtn == 0) {
-		return NT_STATUS_IO_TIMEOUT;
+		goto again;
 	}
 
 	/*
@@ -1837,23 +1832,6 @@ void chain_reply(struct smb_request *req)
 }
 
 /****************************************************************************
- Setup the needed select timeout in milliseconds.
-****************************************************************************/
-
-static int setup_select_timeout(void)
-{
-	int select_timeout;
-
-	select_timeout = SMBD_SELECT_TIMEOUT*1000;
-
-	if (print_notify_messages_pending()) {
-		select_timeout = MIN(select_timeout, 1000);
-	}
-
-	return select_timeout;
-}
-
-/****************************************************************************
  Check if services need reloading.
 ****************************************************************************/
 
@@ -1907,113 +1885,18 @@ void check_reload(time_t t)
 }
 
 /****************************************************************************
- Process any timeout housekeeping. Return False if the caller should exit.
-****************************************************************************/
-
-static void timeout_processing(int *select_timeout,
-			       time_t *last_timeout_processing_time)
-{
-	time_t t;
-
-	*last_timeout_processing_time = t = time(NULL);
-
-	/* become root again if waiting */
-	change_to_root_user();
-
-	/* check if we need to reload services */
-	check_reload(t);
-
-	if(global_machine_password_needs_changing && 
-			/* for ADS we need to do a regular ADS password change, not a domain
-					password change */
-			lp_security() == SEC_DOMAIN) {
-
-		unsigned char trust_passwd_hash[16];
-		time_t lct;
-		void *lock;
-
-		/*
-		 * We're in domain level security, and the code that
-		 * read the machine password flagged that the machine
-		 * password needs changing.
-		 */
-
-		/*
-		 * First, open the machine password file with an exclusive lock.
-		 */
-
-		lock = secrets_get_trust_account_lock(NULL, lp_workgroup());
-
-		if (lock == NULL) {
-			DEBUG(0,("process: unable to lock the machine account password for \
-machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
-			return;
-		}
-
-		if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
-			DEBUG(0,("process: unable to read the machine account password for \
-machine %s in domain %s.\n", global_myname(), lp_workgroup()));
-			TALLOC_FREE(lock);
-			return;
-		}
-
-		/*
-		 * Make sure someone else hasn't already done this.
-		 */
-
-		if(t < lct + lp_machine_password_timeout()) {
-			global_machine_password_needs_changing = False;
-			TALLOC_FREE(lock);
-			return;
-		}
-
-		/* always just contact the PDC here */
-    
-		change_trust_account_password( lp_workgroup(), NULL);
-		global_machine_password_needs_changing = False;
-		TALLOC_FREE(lock);
-	}
-
-	/* update printer queue caches if necessary */
-  
-	update_monitored_printq_cache();
-  
-	/*
-	 * Now we are root, check if the log files need pruning.
-	 * Force a log file check.
-	 */
-	force_check_log_size();
-	check_log_size();
-
-	/* Send any queued printer notify message to interested smbd's. */
-
-	print_notify_send_messages(smbd_messaging_context(), 0);
-
-	/*
-	 * Modify the select timeout depending upon
-	 * what we have remaining in our queues.
-	 */
-
-	*select_timeout = setup_select_timeout();
-
-	return;
-}
-
-/****************************************************************************
  Process commands from the client
 ****************************************************************************/
 
 void smbd_process(void)
 {
-	time_t last_timeout_processing_time = time(NULL);
 	unsigned int num_smbs = 0;
 	size_t unread_bytes = 0;
 
 	max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
 
 	while (True) {
-		int select_timeout = setup_select_timeout();
-		int num_echos;
+		NTSTATUS status;
 		char *inbuf = NULL;
 		size_t inbuf_len = 0;
 		bool encrypted = false;
@@ -2021,82 +1904,24 @@ void smbd_process(void)
 
 		errno = 0;
 
-		/* Did someone ask for immediate checks on things like blocking locks ? */
-		if (select_timeout == 0) {
-			timeout_processing(&select_timeout,
-					   &last_timeout_processing_time);
-			num_smbs = 0; /* Reset smb counter. */
-		}
-
 		run_events(smbd_event_context(), 0, NULL, NULL);
 
-		while (True) {
-			NTSTATUS status;
-
-			status = receive_message_or_smb(
-				talloc_tos(), &inbuf, &inbuf_len,
-				select_timeout,	&unread_bytes, &encrypted);
-
-			if (NT_STATUS_IS_OK(status)) {
-				break;
-			}
-
-			if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
-				timeout_processing(
-					&select_timeout,
-					&last_timeout_processing_time);
-				continue;
-			}
+		status = receive_message_or_smb(
+			talloc_tos(), &inbuf, &inbuf_len,
+			&unread_bytes, &encrypted);
 
+		if (!NT_STATUS_IS_OK(status)) {
 			DEBUG(3, ("receive_message_or_smb failed: %s, "
 				  "exiting\n", nt_errstr(status)));
 			return;
-
-			num_smbs = 0; /* Reset smb counter. */
 		}
 
-
-		/*
-		 * Ensure we do timeout processing if the SMB we just got was
-		 * only an echo request. This allows us to set the select
-		 * timeout in 'receive_message_or_smb()' to any value we like
-		 * without worrying that the client will send echo requests
-		 * faster than the select timeout, thus starving out the
-		 * essential processing (change notify, blocking locks) that
-		 * the timeout code does. JRA.
-		 */
-		num_echos = smb_echo_count;
-
 		process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
 
 		TALLOC_FREE(inbuf);
 
-		if (smb_echo_count != num_echos) {
-			timeout_processing(&select_timeout,
-					   &last_timeout_processing_time);
-			num_smbs = 0; /* Reset smb counter. */
-		}
-
 		num_smbs++;
 
-		/*
-		 * If we are getting smb requests in a constant stream
-		 * with no echos, make sure we attempt timeout processing
-		 * every select_timeout milliseconds - but only check for this
-		 * every 200 smb requests.
-		 */
-		
-		if ((num_smbs % 200) == 0) {
-			time_t new_check_time = time(NULL);
-			if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
-				timeout_processing(
-					&select_timeout,
-					&last_timeout_processing_time);
-				num_smbs = 0; /* Reset smb counter. */
-				last_timeout_processing_time = new_check_time; /* Reset time. */
-			}
-		}
-
 		/* The timeout_processing function isn't run nearly
 		   often enough to implement 'max log size' without
 		   overrunning the size of the file by many megabytes.
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 6933533672..48403073f7 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -29,7 +29,6 @@
 /* look in server.c for some explanation of these variables */
 extern enum protocol_types Protocol;
 extern int max_recv;
-unsigned int smb_echo_count = 0;
 extern uint32 global_client_caps;
 
 extern bool global_encrypted_passwords_negotiated;
@@ -340,8 +339,7 @@ bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 }
 
 /****************************************************************************
- Check if we have a correct fsp pointing to a file. Replacement for the
- CHECK_FSP macro.
+ Check if we have a correct fsp pointing to a file.
 ****************************************************************************/
 
 bool check_fsp(connection_struct *conn, struct smb_request *req,
@@ -4273,7 +4271,7 @@ void reply_close(struct smb_request *req)
 	fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
 
 	/*
-	 * We can only use CHECK_FSP if we know it's not a directory.
+	 * We can only use check_fsp if we know it's not a directory.
 	 */
 
 	if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
@@ -4611,8 +4609,6 @@ void reply_echo(struct smb_request *req)
 
 	TALLOC_FREE(req->outbuf);
 
-	smb_echo_count++;
-
 	END_PROFILE(SMBecho);
 	return;
 }
@@ -5583,10 +5579,10 @@ NTSTATUS rename_internals_fsp(connection_struct *conn,
 		DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
 			fsp->fsp_name,newname));
 
-		rename_open_files(conn, lck, newname);
-
 		notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
 
+		rename_open_files(conn, lck, newname);
+
 		/*
 		 * A rename acts as a new file create w.r.t. allowing an initial delete
 		 * on close, probably because in Windows there is a new handle to the
diff --git a/source3/smbd/server.c b/source3/smbd/server.c
index 53116f3d98..69a483e4fc 100644
--- a/source3/smbd/server.c
+++ b/source3/smbd/server.c
@@ -1067,6 +1067,30 @@ static bool deadtime_fn(const struct timeval *now, void *private_data)
 	return True;
 }
 
+/*
+ * Do the recurring log file and smb.conf reload checks.
+ */
+
+static bool housekeeping_fn(const struct timeval *now, void *private_data)
+{
+	change_to_root_user();
+
+	/* update printer queue caches if necessary */
+	update_monitored_printq_cache();
+
+	/* check if we need to reload services */
+	check_reload(time(NULL));
+
+	/* Change machine password if neccessary. */
+	attempt_machine_password_change();
+
+        /*
+	 * Force a log file check.
+	 */
+        force_check_log_size();
+        check_log_size();
+	return true;
+}
 
 /****************************************************************************
  main program.
@@ -1426,6 +1450,13 @@ extern void build_options(bool screen);
 		exit(1);
 	}
 
+	if (!(event_add_idle(smbd_event_context(), NULL,
+			     timeval_set(SMBD_SELECT_TIMEOUT, 0),
+			     "housekeeping", housekeeping_fn, NULL))) {
+		DEBUG(0, ("Could not add housekeeping event\n"));
+		exit(1);
+	}
+
 #ifdef CLUSTER_SUPPORT
 
 	if (lp_clustering()) {
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index 1ef4c152a3..627374cb96 100644
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -56,11 +56,11 @@ static int net_ads_cldap_netlogon(struct net_context *c, ADS_STRUCT *ads)
 
 	d_printf("Response Type: ");
 	switch (reply.command) {
-	case SAMLOGON_AD_UNK_R:
-		d_printf("SAMLOGON\n");
+	case LOGON_SAM_LOGON_USER_UNKNOWN_EX:
+		d_printf("LOGON_SAM_LOGON_USER_UNKNOWN_EX\n");
 		break;
-	case SAMLOGON_AD_R:
-		d_printf("SAMLOGON_USER\n");
+	case LOGON_SAM_LOGON_RESPONSE_EX:
+		d_printf("LOGON_SAM_LOGON_RESPONSE_EX\n");
 		break;
 	default:
 		d_printf("0x%x\n", reply.command);
diff --git a/source3/utils/net_dns.c b/source3/utils/net_dns.c
index 14d45e2b0f..4e617a1968 100644
--- a/source3/utils/net_dns.c
+++ b/source3/utils/net_dns.c
@@ -145,14 +145,14 @@ error:
 int get_my_ip_address( struct sockaddr_storage **pp_ss )
 
 {
-	struct iface_struct nics[MAX_INTERFACES];
 	int i, n;
 	struct sockaddr_storage *list = NULL;
 	int count = 0;
 
-	/* find the first non-loopback address from our list of interfaces */
+	/* Honor the configured list of interfaces to register */
 
-	n = get_interfaces(nics, MAX_INTERFACES);
+	load_interfaces();
+	n = iface_count();
 
 	if (n <= 0) {
 		return -1;
@@ -163,19 +163,17 @@ int get_my_ip_address( struct sockaddr_storage **pp_ss )
 	}
 
 	for ( i=0; i<n; i++ ) {
-		if (is_loopback_addr(&nics[i].ip)) {
+		const struct sockaddr_storage *nic_sa_storage = NULL;
+
+		if ((nic_sa_storage = iface_n_sockaddr_storage(i)) == NULL)
+			continue;
+
+		/* Don't register loopback addresses */
+		if (is_loopback_addr(nic_sa_storage)) {
 			continue;
 		}
-#if defined(HAVE_IPV6)
-		if ((nics[i].ip.ss_family == AF_INET6)) {
-			memcpy(&list[count++], &nics[i].ip,
-			       sizeof(struct sockaddr_storage));
-		} else
-#endif
-		if (nics[i].ip.ss_family == AF_INET) {
-			memcpy(&list[count++], &nics[i].ip,
-			       sizeof(struct sockaddr_storage));
-		}
+
+		memcpy(&list[count++], nic_sa_storage, sizeof(struct sockaddr_storage));
 	}
 	*pp_ss = list;
 
diff --git a/source3/utils/net_proto.h b/source3/utils/net_proto.h
index 1e355e54a3..ee4388f157 100644
--- a/source3/utils/net_proto.h
+++ b/source3/utils/net_proto.h
@@ -471,6 +471,8 @@ int net_run_function(struct net_context *c, int argc, const char **argv,
 		      const char *whoami, struct functable *table);
 void net_display_usage_from_functable(struct functable *table);
 
+const char *net_share_type_str(int num_type);
+
 /* The following definitions come from utils/netlookup.c  */
 
 NTSTATUS net_lookup_name_from_sid(struct net_context *c,
diff --git a/source3/utils/net_rap.c b/source3/utils/net_rap.c
index 883524dc2d..32f4dd31b4 100644
--- a/source3/utils/net_rap.c
+++ b/source3/utils/net_rap.c
@@ -34,13 +34,6 @@
 #define ERRMSG_BOTH_SERVER_IPADDRESS    "\nTarget server and IP address both "\
   "specified. Do not set both at the same time.  The target IP address was used\n"
 
-const char *share_type[] = {
-  "Disk",
-  "Print",
-  "Dev",
-  "IPC"
-};
-
 static int errmsg_not_implemented(void)
 {
 	d_printf("\nNot implemented\n");
@@ -201,7 +194,7 @@ static void long_share_fn(const char *share_name, uint32 type,
 			  const char *comment, void *state)
 {
 	d_printf("%-12s %-8.8s %-50s\n",
-		 share_name, share_type[type], comment);
+		 share_name, net_share_type_str(type), comment);
 }
 
 static void share_fn(const char *share_name, uint32 type,
@@ -388,7 +381,7 @@ static void display_conns_func(uint16 conn_id, uint16 conn_type, uint16 opens,
 			       const char *username, const char *netname)
 {
 	d_printf("%-14.14s %-8.8s %5d\n",
-		 netname, share_type[conn_type], opens);
+		 netname, net_share_type_str(conn_type), opens);
 }
 
 static int rap_session_info(struct net_context *c, int argc, const char **argv)
diff --git a/source3/utils/net_rpc.c b/source3/utils/net_rpc.c
index a849ec4c10..0e91144d33 100644
--- a/source3/utils/net_rpc.c
+++ b/source3/utils/net_rpc.c
@@ -26,8 +26,6 @@
 static int net_mode_share;
 static bool sync_files(struct copy_clistate *cp_clistate, const char *mask);
 
-extern const char *share_type[];
-
 /**
  * @file net_rpc.c
  *
@@ -2876,7 +2874,7 @@ static void display_share_info_1(struct net_context *c,
 	if (c->opt_long_list_entries) {
 		d_printf("%-12s %-8.8s %-50s\n",
 			 r->shi1_netname,
-			 share_type[r->shi1_type & ~(STYPE_TEMPORARY|STYPE_HIDDEN)],
+			 net_share_type_str(r->shi1_type & ~(STYPE_TEMPORARY|STYPE_HIDDEN)),
 			 r->shi1_remark);
 	} else {
 		d_printf("%s\n", r->shi1_netname);
diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c
index 88850d29df..fbb3c24b03 100644
--- a/source3/utils/net_util.c
+++ b/source3/utils/net_util.c
@@ -2,6 +2,7 @@
  *  Unix SMB/CIFS implementation.
  *  Helper routines for net
  *  Copyright (C) Volker Lendecke 2006
+ *  Copyright (C) Kai Blin 2008
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -595,3 +596,14 @@ void net_display_usage_from_functable(struct functable *table)
 		d_printf("%s\n", table[i].usage);
 	}
 }
+
+const char *net_share_type_str(int num_type)
+{
+	switch(num_type) {
+		case 0: return "Disk";
+		case 1: return "Print";
+		case 2: return "Dev";
+		case 3: return "IPC";
+		default: return "Unknown";
+	}
+}
diff --git a/source3/utils/sharesec.c b/source3/utils/sharesec.c
index 46f9ecdc7d..3ad949a6d3 100644
--- a/source3/utils/sharesec.c
+++ b/source3/utils/sharesec.c
@@ -153,7 +153,7 @@ static bool parse_ace(SEC_ACE *ace, const char *orig_str)
 	unsigned int aflags = 0;
 	unsigned int amask = 0;
 	DOM_SID sid;
-	SEC_ACCESS mask;
+	uint32_t mask;
 	const struct perm_value *v;
 	char *str = SMB_STRDUP(orig_str);
 	TALLOC_CTX *frame = talloc_stackframe();
diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
index d488ce2187..eda8732c89 100644
--- a/source3/utils/smbcacls.c
+++ b/source3/utils/smbcacls.c
@@ -275,7 +275,7 @@ static bool parse_ace(struct cli_state *cli, SEC_ACE *ace,
 	unsigned int aflags = 0;
 	unsigned int amask = 0;
 	DOM_SID sid;
-	SEC_ACCESS mask;
+	uint32_t mask;
 	const struct perm_value *v;
 	char *str = SMB_STRDUP(orig_str);
 	TALLOC_CTX *frame = talloc_stackframe();
diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c
index 527db2d805..4370d49523 100644
--- a/source3/utils/testparm.c
+++ b/source3/utils/testparm.c
@@ -329,9 +329,12 @@ rameter is ignored when using CUPS libraries.\n",
 	cname = poptGetArg(pc);
 	caddr = poptGetArg(pc);
 
+	poptFreeContext(pc);
+
 	if ( cname && ! caddr ) {
 		printf ( "ERROR: You must specify both a machine name and an IP address.\n" );
-		return(1);
+		ret = 1;
+		goto done;
 	}
 
 	if (new_local_machine) {
@@ -346,7 +349,8 @@ rameter is ignored when using CUPS libraries.\n",
 
 	if (!lp_load_with_registry_shares(config_file,False,True,False,True)) {
 		fprintf(stderr,"Error loading services.\n");
-		return(1);
+		ret = 1;
+		goto done;
 	}
 
 	fprintf(stderr,"Loaded services file OK.\n");
@@ -393,13 +397,15 @@ rameter is ignored when using CUPS libraries.\n",
 				 (s=lp_servicenumber(section_name)) == -1) {
 					fprintf(stderr,"Unknown section %s\n",
 						section_name);
-					return(1);
+					ret = 1;
+					goto done;
 			}
 			if (parameter_name) {
 				if (!dump_a_parameter( s, parameter_name, stdout, isGlobal)) {
 					fprintf(stderr,"Parameter %s unknown for section %s\n",
 						parameter_name, section_name);
-					return(1);
+					ret = 1;
+					goto done;
 				}
 			} else {
 				if (isGlobal == True)
@@ -407,7 +413,7 @@ rameter is ignored when using CUPS libraries.\n",
 				else
 					lp_dump_one(stdout, show_defaults, s);
 			}
-			return(ret);
+			goto done;
 		}
 
 		lp_dump(stdout, show_defaults, lp_numservices());
@@ -428,7 +434,10 @@ rameter is ignored when using CUPS libraries.\n",
 			}
 		}
 	}
+
+done:
 	TALLOC_FREE(frame);
-	return(ret);
+	gfree_loadparm();
+	return ret;
 }
 
diff --git a/source3/web/statuspage.c b/source3/web/statuspage.c
index ce24c7cddd..e684a075c2 100644
--- a/source3/web/statuspage.c
+++ b/source3/web/statuspage.c
@@ -43,9 +43,10 @@ static void initPid2Machine (void)
 {
 	/* show machine name rather PID on table "Open Files"? */
 	if (PID_or_Machine) {
-		PIDMAP *p;
+		PIDMAP *p, *next;
 
-		for (p = pidmap; p != NULL; ) {
+		for (p = pidmap; p != NULL; p = next) {
+			next = p->next;
 			DLIST_REMOVE(pidmap, p);
 			SAFE_FREE(p->machine);
 			SAFE_FREE(p);
diff --git a/source3/winbindd/idmap_adex/domain_util.c b/source3/winbindd/idmap_adex/domain_util.c
index ab31ccef7a..6851503cc8 100644
--- a/source3/winbindd/idmap_adex/domain_util.c
+++ b/source3/winbindd/idmap_adex/domain_util.c
@@ -49,6 +49,12 @@ static NTSTATUS dc_add_domain(const char *domain)
 	NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 	struct dc_info *dc = NULL;
 
+	if (!domain) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	DEBUG(10,("dc_add_domain: Attempting to add domain %s\n", domain));
+
 	/* Check for duplicates */
 
 	dc = dc_list_head();
@@ -73,6 +79,8 @@ static NTSTATUS dc_add_domain(const char *domain)
 
 	nt_status = NT_STATUS_OK;
 
+	DEBUG(5,("dc_add_domain: Successfully added %s\n", domain));
+
 done:
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		talloc_destroy(dc);
diff --git a/source3/winbindd/idmap_adex/likewise_cell.c b/source3/winbindd/idmap_adex/likewise_cell.c
index 77eeee406b..7723b3e015 100644
--- a/source3/winbindd/idmap_adex/likewise_cell.c
+++ b/source3/winbindd/idmap_adex/likewise_cell.c
@@ -389,6 +389,24 @@ done:
 		status = ads_do_search(c->conn, search_base,
 				       scope, expr, attrs, msg);
 		if (ADS_ERR_OK(status)) {
+			if (DEBUGLEVEL >= 10) {
+				LDAPMessage *e = NULL;
+
+				int n = ads_count_replies(c->conn, *msg);
+
+				DEBUG(10,("cell_do_search: Located %d entries\n", n));
+
+				for (e=ads_first_entry(c->conn, *msg);
+				     e!=NULL;
+				     e = ads_next_entry(c->conn, e))
+				{
+					char *dn = ads_get_dn(c->conn, e);
+
+					DEBUGADD(10,("   dn: %s\n", dn ? dn : "<NULL>"));
+					SAFE_FREE(dn);
+				}
+			}
+
 			return status;
 		}
 
diff --git a/source3/winbindd/idmap_tdb2.c b/source3/winbindd/idmap_tdb2.c
index 3066db6f3b..8bde963c60 100644
--- a/source3/winbindd/idmap_tdb2.c
+++ b/source3/winbindd/idmap_tdb2.c
@@ -94,12 +94,11 @@ static NTSTATUS idmap_tdb2_open_db(void)
 */
 static NTSTATUS idmap_tdb2_alloc_load(void)
 {
-	const char *range;
 	uid_t low_uid = 0;
 	uid_t high_uid = 0;
 	gid_t low_gid = 0;
 	gid_t high_gid = 0;
-	uint32 low_id, high_id;
+	uint32 low_id;
 
 	/* see if a idmap script is configured */
 	idmap_tdb2_state.idmap_script = lp_parm_const_string(-1, "idmap",
@@ -187,6 +186,10 @@ static NTSTATUS idmap_tdb2_allocate_id(struct unixid *xid)
 	uint32_t high_hwm;
 	uint32_t hwm;
 	int res;
+	NTSTATUS status;
+
+	status = idmap_tdb2_open_db();
+	NT_STATUS_NOT_OK_RETURN(status);
 
 	/* Get current high water mark */
 	switch (xid->type) {
@@ -264,6 +267,10 @@ static NTSTATUS idmap_tdb2_get_hwm(struct unixid *xid)
 	const char *hwmtype;
 	uint32_t hwm;
 	uint32_t high_hwm;
+	NTSTATUS status;
+
+	status = idmap_tdb2_open_db();
+	NT_STATUS_NOT_OK_RETURN(status);
 
 	/* Get current high water mark */
 	switch (xid->type) {
@@ -451,6 +458,10 @@ static NTSTATUS idmap_tdb2_id_to_sid(struct idmap_tdb2_context *ctx, struct id_m
 	NTSTATUS ret;
 	TDB_DATA data;
 	char *keystr;
+	NTSTATUS status;
+
+	status = idmap_tdb2_open_db();
+	NT_STATUS_NOT_OK_RETURN(status);
 
 	if (!ctx || !map) {
 		return NT_STATUS_INVALID_PARAMETER;
@@ -546,6 +557,10 @@ static NTSTATUS idmap_tdb2_sid_to_id(struct idmap_tdb2_context *ctx, struct id_m
 	TDB_DATA data;
 	char *keystr;
 	unsigned long rec_id = 0;
+	NTSTATUS status;
+
+	status = idmap_tdb2_open_db();
+	NT_STATUS_NOT_OK_RETURN(status);
 
 	if ((keystr = sid_string_talloc(ctx, map->sid)) == NULL) {
 		DEBUG(0, ("Out of memory!\n"));
diff --git a/source3/winbindd/idmap_util.c b/source3/winbindd/idmap_util.c
index b10a1a4ba9..9f876618be 100644
--- a/source3/winbindd/idmap_util.c
+++ b/source3/winbindd/idmap_util.c
@@ -121,7 +121,7 @@ backend:
 		return NT_STATUS_NONE_MAPPED;
 	}
 
-	idmap_cache_set_sid2uid(sid, gid);
+	idmap_cache_set_sid2gid(sid, gid);
 
 	return NT_STATUS_OK;
 }
diff --git a/source3/winbindd/winbindd_dual.c b/source3/winbindd/winbindd_dual.c
index 1600f05eb1..aeb52d9b5a 100644
--- a/source3/winbindd/winbindd_dual.c
+++ b/source3/winbindd/winbindd_dual.c
@@ -120,6 +120,10 @@ void async_request(TALLOC_CTX *mem_ctx, struct winbindd_child *child,
 
 	SMB_ASSERT(continuation != NULL);
 
+	DEBUG(10, ("Sending request to child pid %d (domain=%s)\n",
+		   (int)child->pid,
+		   (child->domain != NULL) ? child->domain->name : "''"));
+
 	state = TALLOC_P(mem_ctx, struct winbindd_async_request);
 
 	if (state == NULL) {
@@ -296,6 +300,18 @@ static void schedule_async_request(struct winbindd_child *child)
 		return;		/* Busy */
 	}
 
+	/*
+	 * This may be a reschedule, so we might
+	 * have an existing timeout event pending on
+	 * the first entry in the child->requests list
+	 * (we only send one request at a time).
+	 * Ensure we free it before we reschedule.
+	 * Bug #5814, from hargagan <shargagan@novell.com>.
+	 * JRA.
+	 */
+
+	TALLOC_FREE(request->reply_timeout_event);
+
 	if ((child->pid == 0) && (!fork_domain_child(child))) {
 		/* fork_domain_child failed.
 		   Cancel all outstanding requests */
@@ -491,6 +507,17 @@ void winbind_child_died(pid_t pid)
 	child->event.flags = 0;
 	child->pid = 0;
 
+	if (child->requests) {
+		/*
+		 * schedule_async_request() will also
+		 * clear this event but the call is
+		 * idempotent so it doesn't hurt to
+		 * cover all possible future code
+		 * paths. JRA.
+		 */
+		TALLOC_FREE(child->requests->reply_timeout_event);
+	}
+
 	schedule_async_request(child);
 }
 
diff --git a/source3/winbindd/winbindd_locator.c b/source3/winbindd/winbindd_locator.c
index b2a8bd7e30..b60d235f70 100644
--- a/source3/winbindd/winbindd_locator.c
+++ b/source3/winbindd/winbindd_locator.c
@@ -45,11 +45,15 @@ struct winbindd_child *locator_child(void)
 
 void winbindd_dsgetdcname(struct winbindd_cli_state *state)
 {
-	state->request.domain_name
-		[sizeof(state->request.domain_name)-1] = '\0';
+	state->request.data.dsgetdcname.domain_name
+		[sizeof(state->request.data.dsgetdcname.domain_name)-1] = '\0';
+	state->request.data.dsgetdcname.site_name
+		[sizeof(state->request.data.dsgetdcname.site_name)-1] = '\0';
+	state->request.data.dsgetdcname.domain_guid
+		[sizeof(state->request.data.dsgetdcname.domain_guid)-1] = '\0';
 
 	DEBUG(3, ("[%5lu]: dsgetdcname for %s\n", (unsigned long)state->pid,
-		  state->request.domain_name));
+		  state->request.data.dsgetdcname.domain_name));
 
 	sendto_child(state, locator_child());
 }
@@ -94,44 +98,59 @@ static uint32_t get_dsgetdc_flags(uint32_t wbc_flags)
 	return ds_flags;
 }
 
-
 static enum winbindd_result dual_dsgetdcname(struct winbindd_domain *domain,
 					     struct winbindd_cli_state *state)
 {
 	NTSTATUS result;
 	struct netr_DsRGetDCNameInfo *info = NULL;
-	const char *dc = NULL;
 	uint32_t ds_flags = 0;
+	struct GUID guid, *guid_ptr = NULL;
+	const char *guid_str = NULL;
 
-	state->request.domain_name
-		[sizeof(state->request.domain_name)-1] = '\0';
+	state->request.data.dsgetdcname.domain_name
+		[sizeof(state->request.data.dsgetdcname.domain_name)-1] = '\0';
+	state->request.data.dsgetdcname.site_name
+		[sizeof(state->request.data.dsgetdcname.site_name)-1] = '\0';
+	state->request.data.dsgetdcname.domain_guid
+		[sizeof(state->request.data.dsgetdcname.domain_guid)-1] = '\0';
 
 	DEBUG(3, ("[%5lu]: dsgetdcname for %s\n", (unsigned long)state->pid,
-		  state->request.domain_name));
+		  state->request.data.dsgetdcname.domain_name));
 
 	ds_flags = get_dsgetdc_flags(state->request.flags);
 
-	result = dsgetdcname(state->mem_ctx, winbind_messaging_context(),
-			     state->request.domain_name,
-			     NULL, NULL, ds_flags, &info);
-
-	if (!NT_STATUS_IS_OK(result)) {
-		return WINBINDD_ERROR;
+	result = GUID_from_string(state->request.data.dsgetdcname.domain_guid,
+				  &guid);
+	if (NT_STATUS_IS_OK(result) && !GUID_all_zero(&guid)) {
+		guid_ptr = &guid;
 	}
 
-	if (info->dc_address) {
-		dc = strip_hostname(info->dc_address);
-	}
+	result = dsgetdcname(state->mem_ctx,
+			     winbind_messaging_context(),
+			     state->request.data.dsgetdcname.domain_name,
+			     guid_ptr,
+			     state->request.data.dsgetdcname.site_name,
+			     ds_flags,
+			     &info);
 
-	if ((!dc || !is_ipaddress_v4(dc)) && info->dc_unc) {
-		dc = strip_hostname(info->dc_unc);
+	if (!NT_STATUS_IS_OK(result)) {
+		return WINBINDD_ERROR;
 	}
 
-	if (!dc || !*dc) {
+	guid_str = GUID_string(state->mem_ctx, &info->domain_guid);
+	if (!guid_str) {
 		return WINBINDD_ERROR;
 	}
 
-	fstrcpy(state->response.data.dc_name, dc);
+	fstrcpy(state->response.data.dsgetdcname.dc_unc, info->dc_unc);
+	fstrcpy(state->response.data.dsgetdcname.dc_address, info->dc_address);
+	state->response.data.dsgetdcname.dc_address_type = info->dc_address_type;
+	fstrcpy(state->response.data.dsgetdcname.domain_guid, guid_str);
+	fstrcpy(state->response.data.dsgetdcname.domain_name, info->domain_name);
+	fstrcpy(state->response.data.dsgetdcname.forest_name, info->forest_name);
+	state->response.data.dsgetdcname.dc_flags = info->dc_flags;
+	fstrcpy(state->response.data.dsgetdcname.dc_site_name, info->dc_site_name);
+	fstrcpy(state->response.data.dsgetdcname.client_site_name, info->client_site_name);
 
 	return WINBINDD_OK;
 }
diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index 5b5ca41a74..fdfc8ed9d1 100644
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -111,7 +111,16 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const
 	const char *alternative_name = NULL;
 	char *idmap_config_option;
 	const char *param;
+	const char **ignored_domains, **dom;
 	
+	ignored_domains = lp_parm_string_list(-1, "winbind", "ignore domains", NULL);
+	for (dom=ignored_domains; dom && *dom; dom++) {
+		if (gen_fnmatch(*dom, domain_name) == 0) {
+			DEBUG(2,("Ignoring domain '%s'\n", domain_name));
+			return NULL;
+		}
+	}
+
 	/* ignore alt_name if we are not in an AD domain */
 	
 	if ( (lp_security() == SEC_ADS) && alt_name && *alt_name) {
@@ -436,6 +445,10 @@ static void rescan_forest_root_trusts( void )
 						&dom_list[i].sid );
 		}
 
+		if (d == NULL) {
+			continue;
+		}
+
        		DEBUG(10,("rescan_forest_root_trusts: Following trust path "
 			  "for domain tree root %s (%s)\n",
 	       		  d->name, d->alt_name ));
@@ -500,6 +513,10 @@ static void rescan_forest_trusts( void )
 							&cache_methods,
 							&dom_list[i].sid );
 			}
+
+			if (d == NULL) {
+				continue;
+			}
 			
 			DEBUG(10,("Following trust path for domain %s (%s)\n",
 				  d->name, d->alt_name ));
@@ -1058,13 +1075,12 @@ void free_getent_state(struct getent_state *state)
 	temp = state;
 
 	while(temp != NULL) {
-		struct getent_state *next;
+		struct getent_state *next = temp->next;
 
 		/* Free sam entries then list entry */
 
 		SAFE_FREE(state->sam_entries);
 		DLIST_REMOVE(state, state);
-		next = temp->next;
 
 		SAFE_FREE(temp);
 		temp = next;