Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-python

(This used to be commit 2f57e25f8f692889d9e057e13256f8a24c5ec10c)

47 files changed, 2236 insertions, 790 deletions

diff --git a/source4/lib/ldb/include/ldb.h b/source4/lib/ldb/include/ldb.h
index e2ff8c6f98..2e54920c17 100644
--- a/source4/lib/ldb/include/ldb.h
+++ b/source4/lib/ldb/include/ldb.h
@@ -705,7 +705,7 @@ struct ldb_handle {
 struct ldb_search {
 	struct ldb_dn *base;
 	enum ldb_scope scope;
-	const struct ldb_parse_tree *tree;
+	struct ldb_parse_tree *tree;
 	const char * const *attrs;
 	struct ldb_result *res;
 };
diff --git a/source4/lib/ldb/ldb.i b/source4/lib/ldb/ldb.i
index 57cb6b5f47..560142eb6d 100644
--- a/source4/lib/ldb/ldb.i
+++ b/source4/lib/ldb/ldb.i
@@ -50,6 +50,15 @@ typedef int ldb_error;
 %include "exception.i"
 %import "stdint.i"
 
+/* Don't expose talloc contexts in Python code. Python does reference 
+   counting for us, so just create a new top-level talloc context.
+ */
+%typemap(in, numinputs=0, noblock=1) TALLOC_CTX * {
+    $1 = NULL;
+}
+
+
+
 %constant int SCOPE_DEFAULT = LDB_SCOPE_DEFAULT;
 %constant int SCOPE_BASE = LDB_SCOPE_BASE;
 %constant int SCOPE_ONELEVEL = LDB_SCOPE_ONELEVEL;
@@ -115,7 +124,7 @@ typedef int ldb_error;
     }
 }
 
-%typemap(in,noblock=1,numinputs=1) const char * const *attrs {
+%typemap(in,noblock=1,numinputs=1) const char * const *NULL_STR_LIST {
     if ($input == Py_None) {
         $1 = NULL;
     } else if (PySequence_Check($input)) {
@@ -129,9 +138,13 @@ typedef int ldb_error;
     }
 }
 
-%typemap(freearg,noblock=1) const char * const *attrs {
+%typemap(freearg,noblock=1) const char * const *NULL_STR_LIST {
     talloc_free($1);
 }
+
+%apply const char * const *NULL_STR_LIST { const char * const *attrs }
+%apply const char * const *NULL_STR_LIST { const char * const *control_strings }
+
 #endif
 
 %types(struct ldb_result *);
@@ -188,6 +201,14 @@ fail:
 
         /* FIXME: implement __getslice__ */
 #endif
+    %pythoncode {
+        def __eq__(self, other):
+            if isinstance(other, self.__class__):
+                return self.__cmp__(other) == 0
+            if isinstance(other, str):
+                return str(self) == other
+            return False
+    }
     }
 } ldb_dn;
 
@@ -278,18 +299,43 @@ typedef struct ldb_message_element {
         {
             return ldb_msg_element_from_pyobject(NULL, set_obj, flags, name);
         }
+
+        int __len__()
+        {
+            return $self->num_values;
+        }
 #endif
+
+        PyObject *get(int i)
+        {
+            if (i < 0 || i >= $self->num_values)
+                return Py_None;
+
+            return PyString_FromStringAndSize(
+                        (const char *)$self->values[i].data, 
+                        $self->values[i].length);
+        }
+
         ~ldb_msg_element() { talloc_free($self); }
         int compare(ldb_msg_element *);
     }
     %pythoncode {
+        def __getitem__(self, i):
+            ret = self.get(i)
+            if ret is None:
+                raise KeyError("no such value")
+            return ret
+
         def __eq__(self, other):
-            if (isinstance(other, str) and 
-                len(set(self)) == 1 and 
-                set(self).pop() == other):
+            if (len(self) == 1 and self.get(0) == other):
                 return True
-            return self.__cmp__(other) == 0
-                
+            if isinstance(other, self.__class__):
+                return self.__cmp__(other) == 0
+            o = iter(other)
+            for i in range(len(self)):
+                if self.get(i) != o.next():
+                    return False
+            return True
     }
 } ldb_msg_element;
 
@@ -447,6 +493,14 @@ PyObject *PyExc_LdbError;
     $result = Py_None;
 };
 
+%typemap(out,noblock=1) struct ldb_control ** {
+    if ($1 == NULL) {
+        PyErr_SetObject(PyExc_LdbError, Py_BuildValue((char *)"(s)", ldb_errstring(arg1)));
+        SWIG_fail;
+    }
+    $result = SWIG_NewPointerObj($1, $1_descriptor, 0);
+}
+
 %rename(Ldb) ldb_context;
 
 %typemap(in,noblock=1) struct ldb_dn * {
@@ -468,13 +522,53 @@ typedef struct ldb_context {
             const char *options[] = NULL);
 
         ~ldb() { talloc_free($self); }
-        ldb_error search(ldb_dn *base = NULL, 
+        ldb_error search_ex(TALLOC_CTX *mem_ctx,
+                   ldb_dn *base = NULL, 
                    enum ldb_scope scope = LDB_SCOPE_DEFAULT, 
                    const char *expression = NULL, 
-                   const char * const *attrs = NULL, 
-                   struct ldb_result **OUT);
+                   const char *const *attrs = NULL, 
+                   struct ldb_control **controls = NULL,
+                   struct ldb_result **OUT) {
+            int ret;
+            struct ldb_result *res;
+            struct ldb_request *req;
+            res = talloc_zero(mem_ctx, struct ldb_result);
+            if (!res) {
+                return LDB_ERR_OPERATIONS_ERROR;
+            }
+
+            ret = ldb_build_search_req(&req, $self, mem_ctx,
+                           base?base:ldb_get_default_basedn($self),
+                           scope,
+                           expression,
+                           attrs,
+                           controls,
+                           res,
+                           ldb_search_default_callback);
+
+            if (ret != LDB_SUCCESS) {
+                talloc_free(res);
+                return ret;
+            }
+
+            ldb_set_timeout($self, req, 0); /* use default timeout */
+                
+            ret = ldb_request($self, req);
+                
+            if (ret == LDB_SUCCESS) {
+                ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+            }
+
+            talloc_free(req);
+
+            *OUT = res;
+            return ret;
+        }
+
         ldb_error delete(ldb_dn *dn);
         ldb_error rename(ldb_dn *olddn, ldb_dn *newdn);
+        struct ldb_control **parse_control_strings(TALLOC_CTX *mem_ctx, 
+                                                   const char * const*control_strings);
         ldb_error add(ldb_msg *add_msg);
         ldb_error add(PyObject *py_msg) 
         {
@@ -567,6 +661,14 @@ typedef struct ldb_context {
             _ldb.Ldb_swiginit(self,_ldb.new_Ldb())
             if url is not None:
                 self.connect(url, flags, options)
+
+        def search(self, base=None, scope=SCOPE_DEFAULT, expression=None, 
+                   attrs=None, controls=None):
+            parsed_controls = None
+            if controls is not None:
+                parsed_controls = self.parse_control_strings(controls)
+            return self.search_ex(base, scope, expression, attrs, 
+                                  parsed_controls)
     }
 
 } ldb;
diff --git a/source4/lib/ldb/ldb.py b/source4/lib/ldb/ldb.py
index ebf8f6025a..ab2a68a4b3 100644
--- a/source4/lib/ldb/ldb.py
+++ b/source4/lib/ldb/ldb.py
@@ -71,6 +71,13 @@ class Dn(object):
     def __init__(self, *args, **kwargs): 
         _ldb.Dn_swiginit(self,_ldb.new_Dn(*args, **kwargs))
     __swig_destroy__ = _ldb.delete_Dn
+    def __eq__(self, other):
+        if isinstance(other, self.__class__):
+            return self.__cmp__(other) == 0
+        if isinstance(other, str):
+            return str(self) == other
+        return False
+
 Dn.validate = new_instancemethod(_ldb.Dn_validate,None,Dn)
 Dn.get_casefold = new_instancemethod(_ldb.Dn_get_casefold,None,Dn)
 Dn.__str__ = new_instancemethod(_ldb.Dn___str__,None,Dn)
@@ -94,16 +101,27 @@ class ldb_msg_element(object):
     def __init__(self): raise AttributeError, "No constructor defined"
     __repr__ = _swig_repr
     __swig_destroy__ = _ldb.delete_ldb_msg_element
+    def __getitem__(self, i):
+        ret = self.get(i)
+        if ret is None:
+            raise KeyError("no such value")
+        return ret
+
     def __eq__(self, other):
-        if (isinstance(other, str) and 
-            len(set(self)) == 1 and 
-            set(self).pop() == other):
+        if (len(self) == 1 and self.get(0) == other):
             return True
-        return self.__cmp__(other) == 0
-            
+        if isinstance(other, self.__class__):
+            return self.__cmp__(other) == 0
+        o = iter(other)
+        for i in range(len(self)):
+            if self.get(i) != o.next():
+                return False
+        return True
 
 ldb_msg_element.__iter__ = new_instancemethod(_ldb.ldb_msg_element___iter__,None,ldb_msg_element)
 ldb_msg_element.__set__ = new_instancemethod(_ldb.ldb_msg_element___set__,None,ldb_msg_element)
+ldb_msg_element.__len__ = new_instancemethod(_ldb.ldb_msg_element___len__,None,ldb_msg_element)
+ldb_msg_element.get = new_instancemethod(_ldb.ldb_msg_element_get,None,ldb_msg_element)
 ldb_msg_element.__cmp__ = new_instancemethod(_ldb.ldb_msg_element___cmp__,None,ldb_msg_element)
 ldb_msg_element_swigregister = _ldb.ldb_msg_element_swigregister
 ldb_msg_element_swigregister(ldb_msg_element)
@@ -181,10 +199,19 @@ class Ldb(object):
         if url is not None:
             self.connect(url, flags, options)
 
+    def search(self, base=None, scope=SCOPE_DEFAULT, expression=None, 
+               attrs=None, controls=None):
+        parsed_controls = None
+        if controls is not None:
+            parsed_controls = self.parse_control_strings(controls)
+        return self.search_ex(base, scope, expression, attrs, 
+                              parsed_controls)
+
 Ldb.connect = new_instancemethod(_ldb.Ldb_connect,None,Ldb)
-Ldb.search = new_instancemethod(_ldb.Ldb_search,None,Ldb)
+Ldb.search_ex = new_instancemethod(_ldb.Ldb_search_ex,None,Ldb)
 Ldb.delete = new_instancemethod(_ldb.Ldb_delete,None,Ldb)
 Ldb.rename = new_instancemethod(_ldb.Ldb_rename,None,Ldb)
+Ldb.parse_control_strings = new_instancemethod(_ldb.Ldb_parse_control_strings,None,Ldb)
 Ldb.add = new_instancemethod(_ldb.Ldb_add,None,Ldb)
 Ldb.modify = new_instancemethod(_ldb.Ldb_modify,None,Ldb)
 Ldb.get_config_basedn = new_instancemethod(_ldb.Ldb_get_config_basedn,None,Ldb)
diff --git a/source4/lib/ldb/ldb_map/ldb_map.c b/source4/lib/ldb/ldb_map/ldb_map.c
index 39df427c2c..9582f36130 100644
--- a/source4/lib/ldb/ldb_map/ldb_map.c
+++ b/source4/lib/ldb/ldb_map/ldb_map.c
@@ -737,6 +737,7 @@ static struct ldb_val map_objectclass_convert_local(struct ldb_module *module, v
 /* Generate a remote message with a mapped objectClass. */
 static void map_objectclass_generate_remote(struct ldb_module *module, const char *local_attr, const struct ldb_message *old, struct ldb_message *remote, struct ldb_message *local)
 {
+	const struct ldb_map_context *data = map_get_context(module);
 	struct ldb_message_element *el, *oc;
 	struct ldb_val val;
 	bool found_extensibleObject = false;
@@ -770,16 +771,16 @@ static void map_objectclass_generate_remote(struct ldb_module *module, const cha
 	/* Convert all local objectClasses */
 	for (i = 0; i < el->num_values - 1; i++) {
 		el->values[i] = map_objectclass_convert_local(module, el->values, &oc->values[i]);
-		if (ldb_attr_cmp((char *)el->values[i].data, "extensibleObject") == 0) {
+		if (ldb_attr_cmp((char *)el->values[i].data, data->add_objectclass) == 0) {
 			found_extensibleObject = true;
 		}
 	}
 
 	if (!found_extensibleObject) {
-		val.data = (uint8_t *)talloc_strdup(el->values, "extensibleObject");
+		val.data = (uint8_t *)talloc_strdup(el->values, data->add_objectclass);
 		val.length = strlen((char *)val.data);
 
-		/* Append additional objectClass "extensibleObject" */
+		/* Append additional objectClass data->add_objectclass */
 		el->values[i] = val;
 	} else {
 		el->num_values--;
@@ -860,6 +861,19 @@ static struct ldb_message_element *map_objectclass_generate_local(struct ldb_mod
 	return el;
 }
 
+static const struct ldb_map_attribute objectclass_convert_map = {
+	.local_name = "objectClass",
+	.type = MAP_CONVERT,
+	.u = {
+		.convert = {
+			.remote_name = "objectClass",
+			.convert_local = map_objectclass_convert_local,
+			.convert_remote = map_objectclass_convert_remote,
+		},
+	},
+};
+
+
 /* Mappings for searches on objectClass= assuming a one-to-one
  * mapping.  Needed because this is a generate operator for the
  * add/modify code */
@@ -867,19 +881,7 @@ static int map_objectclass_convert_operator(struct ldb_module *module, void *mem
 					    struct ldb_parse_tree **new, const struct ldb_parse_tree *tree) 
 {
 	
-	static const struct ldb_map_attribute objectclass_map = {
-		.local_name = "objectClass",
-		.type = MAP_CONVERT,
-		.u = {
-			.convert = {
-				 .remote_name = "objectClass",
-				 .convert_local = map_objectclass_convert_local,
-				 .convert_remote = map_objectclass_convert_remote,
-			 },
-		},
-	};
-
-	return map_subtree_collect_remote_simple(module, mem_ctx, new, tree, &objectclass_map);
+	return map_subtree_collect_remote_simple(module, mem_ctx, new, tree, &objectclass_convert_map);
 }
 
 /* Auxiliary request construction
@@ -1222,22 +1224,24 @@ static const struct ldb_map_attribute builtin_attribute_maps[] = {
 		},
 	},
 	{
-		.local_name = "objectClass",
-		.type = MAP_GENERATE,
-		.convert_operator = map_objectclass_convert_operator,
-		.u = {
-			.generate = {
-				 .remote_names = { "objectClass", NULL },
-				 .generate_local = map_objectclass_generate_local,
-				 .generate_remote = map_objectclass_generate_remote,
-			 },
-		},
-	},
-	{
 		.local_name = NULL,
 	}
 };
 
+static const struct ldb_map_attribute objectclass_attribute_map	= {
+	.local_name = "objectClass",
+	.type = MAP_GENERATE,
+	.convert_operator = map_objectclass_convert_operator,
+	.u = {
+		.generate = {
+			.remote_names = { "objectClass", NULL },
+			.generate_local = map_objectclass_generate_local,
+			.generate_remote = map_objectclass_generate_remote,
+		},
+	},
+};
+
+
 /* Find the special 'MAP_DN_NAME' record and store local and remote
  * base DNs in private data. */
 static int map_init_dns(struct ldb_module *module, struct ldb_map_context *data, const char *name)
@@ -1302,7 +1306,7 @@ static int map_init_maps(struct ldb_module *module, struct ldb_map_context *data
 	for (j = 0; builtin_attribute_maps[j].local_name; j++) /* noop */ ;
 
 	/* Store list of attribute maps */
-	data->attribute_maps = talloc_array(data, struct ldb_map_attribute, i+j+1);
+	data->attribute_maps = talloc_array(data, struct ldb_map_attribute, i+j+2);
 	if (data->attribute_maps == NULL) {
 		map_oom(module);
 		return LDB_ERR_OPERATIONS_ERROR;
@@ -1320,6 +1324,15 @@ static int map_init_maps(struct ldb_module *module, struct ldb_map_context *data
 		last++;
 	}
 
+	if (data->add_objectclass) {
+		/* ObjectClass one is very last, if required */
+		data->attribute_maps[last] = objectclass_attribute_map;
+		last++;
+	} else if (ocls) {
+		data->attribute_maps[last] = objectclass_convert_map;
+		last++;
+	}
+
 	/* Ensure 'local_name == NULL' for the last entry */
 	memset(&data->attribute_maps[last], 0, sizeof(struct ldb_map_attribute));
 
@@ -1339,9 +1352,10 @@ _PUBLIC_ struct ldb_module_ops ldb_map_get_ops(void)
 
 /* Initialize global private data. */
 _PUBLIC_ int ldb_map_init(struct ldb_module *module, const struct ldb_map_attribute *attrs, 
-		 const struct ldb_map_objectclass *ocls,
-		 const char * const *wildcard_attributes,
-		 const char *name)
+			  const struct ldb_map_objectclass *ocls,
+			  const char * const *wildcard_attributes,
+			  const char *add_objectclass,
+			  const char *name)
 {
 	struct map_private *data;
 	int ret;
@@ -1368,6 +1382,8 @@ _PUBLIC_ int ldb_map_init(struct ldb_module *module, const struct ldb_map_attrib
 		return ret;
 	}
 
+	data->context->add_objectclass = add_objectclass;
+
 	/* Store list of attribute and objectClass maps */
 	ret = map_init_maps(module, data->context, attrs, ocls, wildcard_attributes);
 	if (ret != LDB_SUCCESS) {
diff --git a/source4/lib/ldb/ldb_map/ldb_map.h b/source4/lib/ldb/ldb_map/ldb_map.h
index 7fe9c223b8..ef4da4e654 100644
--- a/source4/lib/ldb/ldb_map/ldb_map.h
+++ b/source4/lib/ldb/ldb_map/ldb_map.h
@@ -134,6 +134,9 @@ struct ldb_map_context {
 	 * to any wildcard search */
 	const char * const *wildcard_attributes;
 
+	/* ObjectClass (if any) to be added to remote attributes on add */
+	const char *add_objectclass;
+
 	/* struct ldb_context *mapped_ldb; */
 	struct ldb_dn *local_base_dn;
 	struct ldb_dn *remote_base_dn;
@@ -149,6 +152,7 @@ struct map_private {
 int ldb_map_init(struct ldb_module *module, const struct ldb_map_attribute *attrs, 
 		 const struct ldb_map_objectclass *ocls,
 		 const char * const *wildcard_attributes,
+		 const char *add_objectclass,
 		 const char *name);
 
 /* get copy of map_ops */
diff --git a/source4/lib/ldb/ldb_wrap.c b/source4/lib/ldb/ldb_wrap.c
index 7368d7f058..c833246ead 100644
--- a/source4/lib/ldb/ldb_wrap.c
+++ b/source4/lib/ldb/ldb_wrap.c
@@ -2459,29 +2459,31 @@ SWIG_Python_MustGetPtr(PyObject *obj, swig_type_info *ty, int argnum, int flags)
 
 /* -------- TYPES TABLE (BEGIN) -------- */
 
-#define SWIGTYPE_p_char swig_types[0]
-#define SWIGTYPE_p_f_p_void_enum_ldb_debug_level_p_q_const__char_va_list__void swig_types[1]
-#define SWIGTYPE_p_int swig_types[2]
-#define SWIGTYPE_p_ldb_context swig_types[3]
-#define SWIGTYPE_p_ldb_dn swig_types[4]
-#define SWIGTYPE_p_ldb_ldif swig_types[5]
-#define SWIGTYPE_p_ldb_message swig_types[6]
-#define SWIGTYPE_p_ldb_message_element swig_types[7]
-#define SWIGTYPE_p_ldb_module_ops swig_types[8]
-#define SWIGTYPE_p_ldb_result swig_types[9]
-#define SWIGTYPE_p_long_long swig_types[10]
-#define SWIGTYPE_p_p_char swig_types[11]
-#define SWIGTYPE_p_p_ldb_result swig_types[12]
-#define SWIGTYPE_p_short swig_types[13]
-#define SWIGTYPE_p_signed_char swig_types[14]
-#define SWIGTYPE_p_unsigned_char swig_types[15]
-#define SWIGTYPE_p_unsigned_int swig_types[16]
-#define SWIGTYPE_p_unsigned_long swig_types[17]
-#define SWIGTYPE_p_unsigned_long_long swig_types[18]
-#define SWIGTYPE_p_unsigned_short swig_types[19]
-#define SWIGTYPE_p_void swig_types[20]
-static swig_type_info *swig_types[22];
-static swig_module_info swig_module = {swig_types, 21, 0, 0, 0, 0};
+#define SWIGTYPE_p_TALLOC_CTX swig_types[0]
+#define SWIGTYPE_p_char swig_types[1]
+#define SWIGTYPE_p_f_p_void_enum_ldb_debug_level_p_q_const__char_va_list__void swig_types[2]
+#define SWIGTYPE_p_int swig_types[3]
+#define SWIGTYPE_p_ldb_context swig_types[4]
+#define SWIGTYPE_p_ldb_dn swig_types[5]
+#define SWIGTYPE_p_ldb_ldif swig_types[6]
+#define SWIGTYPE_p_ldb_message swig_types[7]
+#define SWIGTYPE_p_ldb_message_element swig_types[8]
+#define SWIGTYPE_p_ldb_module_ops swig_types[9]
+#define SWIGTYPE_p_ldb_result swig_types[10]
+#define SWIGTYPE_p_long_long swig_types[11]
+#define SWIGTYPE_p_p_char swig_types[12]
+#define SWIGTYPE_p_p_ldb_control swig_types[13]
+#define SWIGTYPE_p_p_ldb_result swig_types[14]
+#define SWIGTYPE_p_short swig_types[15]
+#define SWIGTYPE_p_signed_char swig_types[16]
+#define SWIGTYPE_p_unsigned_char swig_types[17]
+#define SWIGTYPE_p_unsigned_int swig_types[18]
+#define SWIGTYPE_p_unsigned_long swig_types[19]
+#define SWIGTYPE_p_unsigned_long_long swig_types[20]
+#define SWIGTYPE_p_unsigned_short swig_types[21]
+#define SWIGTYPE_p_void swig_types[22]
+static swig_type_info *swig_types[24];
+static swig_module_info swig_module = {swig_types, 23, 0, 0, 0, 0};
 #define SWIG_TypeQuery(name) SWIG_TypeQueryModule(&swig_module, &swig_module, name)
 #define SWIG_MangledTypeQuery(name) SWIG_MangledTypeQueryModule(&swig_module, &swig_module, name)
 
@@ -2889,6 +2891,17 @@ SWIG_AsVal_int (PyObject * obj, int *val)
 SWIGINTERN ldb_msg_element *new_ldb_msg_element(PyObject *set_obj,int flags,char const *name){
             return ldb_msg_element_from_pyobject(NULL, set_obj, flags, name);
         }
+SWIGINTERN int ldb_msg_element___len__(ldb_msg_element *self){
+            return self->num_values;
+        }
+SWIGINTERN PyObject *ldb_msg_element_get(ldb_msg_element *self,int i){
+            if (i < 0 || i >= self->num_values)
+                return Py_None;
+
+            return PyString_FromStringAndSize(
+                        (const char *)self->values[i].data, 
+                        self->values[i].length);
+        }
 SWIGINTERN void delete_ldb_msg_element(ldb_msg_element *self){ talloc_free(self); }
 
     PyObject *ldb_msg_list_elements(ldb_msg *msg)
@@ -3034,6 +3047,42 @@ SWIG_AsVal_unsigned_SS_int (PyObject * obj, unsigned int *val)
 }
 
 SWIGINTERN void delete_ldb(ldb *self){ talloc_free(self); }
+SWIGINTERN ldb_error ldb_search_ex(ldb *self,TALLOC_CTX *mem_ctx,ldb_dn *base,enum ldb_scope scope,char const *expression,char const *const *attrs,struct ldb_control **controls,struct ldb_result **OUT){
+            int ret;
+            struct ldb_result *res;
+            struct ldb_request *req;
+            res = talloc_zero(mem_ctx, struct ldb_result);
+            if (!res) {
+                return 1;
+            }
+
+            ret = ldb_build_search_req(&req, self, mem_ctx,
+                           base?base:ldb_get_default_basedn(self),
+                           scope,
+                           expression,
+                           attrs,
+                           controls,
+                           res,
+                           ldb_search_default_callback);
+
+            if (ret != 0) {
+                talloc_free(res);
+                return ret;
+            }
+
+            ldb_set_timeout(self, req, 0); /* use default timeout */
+                
+            ret = ldb_request(self, req);
+                
+            if (ret == 0) {
+                ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+            }
+
+            talloc_free(req);
+
+            *OUT = res;
+            return ret;
+        }
 SWIGINTERN ldb_error ldb_add__SWIG_1(ldb *self,PyObject *py_msg){
             ldb_error ret;
             int dict_pos, msg_pos;
@@ -3671,6 +3720,63 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_ldb_msg_element___len__(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
+  PyObject *resultobj = 0;
+  ldb_msg_element *arg1 = (ldb_msg_element *) 0 ;
+  int result;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  PyObject *swig_obj[1] ;
+  
+  if (!args) SWIG_fail;
+  swig_obj[0] = args;
+  res1 = SWIG_ConvertPtr(swig_obj[0], &argp1,SWIGTYPE_p_ldb_message_element, 0 |  0 );
+  if (!SWIG_IsOK(res1)) {
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "ldb_msg_element___len__" "', argument " "1"" of type '" "ldb_msg_element *""'"); 
+  }
+  arg1 = (ldb_msg_element *)(argp1);
+  result = (int)ldb_msg_element___len__(arg1);
+  resultobj = SWIG_From_int((int)(result));
+  return resultobj;
+fail:
+  return NULL;
+}
+
+
+SWIGINTERN PyObject *_wrap_ldb_msg_element_get(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  ldb_msg_element *arg1 = (ldb_msg_element *) 0 ;
+  int arg2 ;
+  PyObject *result = 0 ;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  int val2 ;
+  int ecode2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "i", NULL 
+  };
+  
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:ldb_msg_element_get",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_ldb_message_element, 0 |  0 );
+  if (!SWIG_IsOK(res1)) {
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "ldb_msg_element_get" "', argument " "1"" of type '" "ldb_msg_element *""'"); 
+  }
+  arg1 = (ldb_msg_element *)(argp1);
+  ecode2 = SWIG_AsVal_int(obj1, &val2);
+  if (!SWIG_IsOK(ecode2)) {
+    SWIG_exception_fail(SWIG_ArgError(ecode2), "in method '" "ldb_msg_element_get" "', argument " "2"" of type '" "int""'");
+  } 
+  arg2 = (int)(val2);
+  result = (PyObject *)ldb_msg_element_get(arg1,arg2);
+  resultobj = result;
+  return resultobj;
+fail:
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_delete_ldb_msg_element(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
   PyObject *resultobj = 0;
   ldb_msg_element *arg1 = (ldb_msg_element *) 0 ;
@@ -4284,95 +4390,108 @@ fail:
 }
 
 
-SWIGINTERN PyObject *_wrap_Ldb_search(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+SWIGINTERN PyObject *_wrap_Ldb_search_ex(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   ldb *arg1 = (ldb *) 0 ;
-  ldb_dn *arg2 = (ldb_dn *) NULL ;
-  enum ldb_scope arg3 = (enum ldb_scope) LDB_SCOPE_DEFAULT ;
-  char *arg4 = (char *) NULL ;
-  char **arg5 = (char **) NULL ;
-  struct ldb_result **arg6 = (struct ldb_result **) 0 ;
+  TALLOC_CTX *arg2 = (TALLOC_CTX *) 0 ;
+  ldb_dn *arg3 = (ldb_dn *) NULL ;
+  enum ldb_scope arg4 = (enum ldb_scope) LDB_SCOPE_DEFAULT ;
+  char *arg5 = (char *) NULL ;
+  char **arg6 = (char **) NULL ;
+  struct ldb_control **arg7 = (struct ldb_control **) NULL ;
+  struct ldb_result **arg8 = (struct ldb_result **) 0 ;
   ldb_error result;
   void *argp1 = 0 ;
   int res1 = 0 ;
-  int val3 ;
-  int ecode3 = 0 ;
-  int res4 ;
-  char *buf4 = 0 ;
-  int alloc4 = 0 ;
-  struct ldb_result *temp_ldb_result6 ;
-  int i6 ;
+  int val4 ;
+  int ecode4 = 0 ;
+  int res5 ;
+  char *buf5 = 0 ;
+  int alloc5 = 0 ;
+  void *argp7 = 0 ;
+  int res7 = 0 ;
+  struct ldb_result *temp_ldb_result8 ;
+  int i8 ;
   PyObject * obj0 = 0 ;
   PyObject * obj1 = 0 ;
   PyObject * obj2 = 0 ;
   PyObject * obj3 = 0 ;
   PyObject * obj4 = 0 ;
+  PyObject * obj5 = 0 ;
   char *  kwnames[] = {
-    (char *) "self",(char *) "base",(char *) "scope",(char *) "expression",(char *) "attrs", NULL 
+    (char *) "self",(char *) "base",(char *) "scope",(char *) "expression",(char *) "attrs",(char *) "controls", NULL 
   };
   
-  arg6 = &temp_ldb_result6;
-  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"O|OOOO:Ldb_search",kwnames,&obj0,&obj1,&obj2,&obj3,&obj4)) SWIG_fail;
+  arg2 = NULL;
+  arg8 = &temp_ldb_result8;
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"O|OOOOO:Ldb_search_ex",kwnames,&obj0,&obj1,&obj2,&obj3,&obj4,&obj5)) SWIG_fail;
   res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
   if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_search" "', argument " "1"" of type '" "ldb *""'"); 
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_search_ex" "', argument " "1"" of type '" "ldb *""'"); 
   }
   arg1 = (ldb *)(argp1);
   if (obj1) {
-    if (ldb_dn_from_pyobject(NULL, obj1, arg1, &arg2) != 0) {
+    if (ldb_dn_from_pyobject(NULL, obj1, arg1, &arg3) != 0) {
       SWIG_fail;
     }
   }
   if (obj2) {
-    ecode3 = SWIG_AsVal_int(obj2, &val3);
-    if (!SWIG_IsOK(ecode3)) {
-      SWIG_exception_fail(SWIG_ArgError(ecode3), "in method '" "Ldb_search" "', argument " "3"" of type '" "enum ldb_scope""'");
+    ecode4 = SWIG_AsVal_int(obj2, &val4);
+    if (!SWIG_IsOK(ecode4)) {
+      SWIG_exception_fail(SWIG_ArgError(ecode4), "in method '" "Ldb_search_ex" "', argument " "4"" of type '" "enum ldb_scope""'");
     } 
-    arg3 = (enum ldb_scope)(val3);
+    arg4 = (enum ldb_scope)(val4);
   }
   if (obj3) {
-    res4 = SWIG_AsCharPtrAndSize(obj3, &buf4, NULL, &alloc4);
-    if (!SWIG_IsOK(res4)) {
-      SWIG_exception_fail(SWIG_ArgError(res4), "in method '" "Ldb_search" "', argument " "4"" of type '" "char const *""'");
+    res5 = SWIG_AsCharPtrAndSize(obj3, &buf5, NULL, &alloc5);
+    if (!SWIG_IsOK(res5)) {
+      SWIG_exception_fail(SWIG_ArgError(res5), "in method '" "Ldb_search_ex" "', argument " "5"" of type '" "char const *""'");
     }
-    arg4 = (char *)(buf4);
+    arg5 = (char *)(buf5);
   }
   if (obj4) {
     if (obj4 == Py_None) {
-      arg5 = NULL;
+      arg6 = NULL;
     } else if (PySequence_Check(obj4)) {
       int i;
-      arg5 = talloc_array(NULL, char *, PySequence_Size(obj4)+1);
+      arg6 = talloc_array(NULL, char *, PySequence_Size(obj4)+1);
       for(i = 0; i < PySequence_Size(obj4); i++)
-      arg5[i] = PyString_AsString(PySequence_GetItem(obj4, i));
-      arg5[i] = NULL;
+      arg6[i] = PyString_AsString(PySequence_GetItem(obj4, i));
+      arg6[i] = NULL;
     } else {
       SWIG_exception(SWIG_TypeError, "expected sequence");
     }
   }
+  if (obj5) {
+    res7 = SWIG_ConvertPtr(obj5, &argp7,SWIGTYPE_p_p_ldb_control, 0 |  0 );
+    if (!SWIG_IsOK(res7)) {
+      SWIG_exception_fail(SWIG_ArgError(res7), "in method '" "Ldb_search_ex" "', argument " "7"" of type '" "struct ldb_control **""'"); 
+    }
+    arg7 = (struct ldb_control **)(argp7);
+  }
   if (arg1 == NULL)
   SWIG_exception(SWIG_ValueError, 
     "ldb context must be non-NULL");
-  result = ldb_search(arg1,arg2,arg3,(char const *)arg4,(char const *const *)arg5,arg6);
+  result = ldb_search_ex(arg1,arg2,arg3,arg4,(char const *)arg5,(char const *const *)arg6,arg7,arg8);
   if (result != 0) {
     PyErr_SetObject(PyExc_LdbError, Py_BuildValue((char *)"(i,s)", result, ldb_strerror(result)));
     SWIG_fail;
   }
   resultobj = Py_None;
-  resultobj = PyList_New((*arg6)->count);
-  for (i6 = 0; i6 < (*arg6)->count; i6++) {
-    PyList_SetItem(resultobj, i6, 
-      SWIG_NewPointerObj((*arg6)->msgs[i6], SWIGTYPE_p_ldb_message, 0)
+  resultobj = PyList_New((*arg8)->count);
+  for (i8 = 0; i8 < (*arg8)->count; i8++) {
+    PyList_SetItem(resultobj, i8, 
+      SWIG_NewPointerObj((*arg8)->msgs[i8], SWIGTYPE_p_ldb_message, 0)
       );
   }
-  talloc_free(arg2);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  talloc_free(arg5);
+  talloc_free(arg3);
+  if (alloc5 == SWIG_NEWOBJ) free((char*)buf5);
+  talloc_free(arg6);
   return resultobj;
 fail:
-  talloc_free(arg2);
-  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
-  talloc_free(arg5);
+  talloc_free(arg3);
+  if (alloc5 == SWIG_NEWOBJ) free((char*)buf5);
+  talloc_free(arg6);
   return NULL;
 }
 
@@ -4462,6 +4581,55 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_Ldb_parse_control_strings(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  ldb *arg1 = (ldb *) 0 ;
+  TALLOC_CTX *arg2 = (TALLOC_CTX *) 0 ;
+  char **arg3 = (char **) 0 ;
+  struct ldb_control **result = 0 ;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "control_strings", NULL 
+  };
+  
+  arg2 = NULL;
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:Ldb_parse_control_strings",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
+  if (!SWIG_IsOK(res1)) {
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_parse_control_strings" "', argument " "1"" of type '" "ldb *""'"); 
+  }
+  arg1 = (ldb *)(argp1);
+  if (obj1 == Py_None) {
+    arg3 = NULL;
+  } else if (PySequence_Check(obj1)) {
+    int i;
+    arg3 = talloc_array(NULL, char *, PySequence_Size(obj1)+1);
+    for(i = 0; i < PySequence_Size(obj1); i++)
+    arg3[i] = PyString_AsString(PySequence_GetItem(obj1, i));
+    arg3[i] = NULL;
+  } else {
+    SWIG_exception(SWIG_TypeError, "expected sequence");
+  }
+  if (arg1 == NULL)
+  SWIG_exception(SWIG_ValueError, 
+    "ldb context must be non-NULL");
+  result = (struct ldb_control **)ldb_parse_control_strings(arg1,arg2,(char const *const *)arg3);
+  if (result == NULL) {
+    PyErr_SetObject(PyExc_LdbError, Py_BuildValue((char *)"(s)", ldb_errstring(arg1)));
+    SWIG_fail;
+  }
+  resultobj = SWIG_NewPointerObj(result, SWIGTYPE_p_p_ldb_control, 0);
+  talloc_free(arg3);
+  return resultobj;
+fail:
+  talloc_free(arg3);
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_Ldb_add__SWIG_0(PyObject *SWIGUNUSEDPARM(self), int nobjs, PyObject **swig_obj) {
   PyObject *resultobj = 0;
   ldb *arg1 = (ldb *) 0 ;
@@ -5254,6 +5422,8 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"ldb_msg_element___iter__", (PyCFunction)_wrap_ldb_msg_element___iter__, METH_O, NULL},
 	 { (char *)"ldb_msg_element___set__", (PyCFunction)_wrap_ldb_msg_element___set__, METH_O, NULL},
 	 { (char *)"new_MessageElement", (PyCFunction) _wrap_new_MessageElement, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"ldb_msg_element___len__", (PyCFunction)_wrap_ldb_msg_element___len__, METH_O, NULL},
+	 { (char *)"ldb_msg_element_get", (PyCFunction) _wrap_ldb_msg_element_get, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"delete_ldb_msg_element", (PyCFunction)_wrap_delete_ldb_msg_element, METH_O, NULL},
 	 { (char *)"ldb_msg_element___cmp__", (PyCFunction) _wrap_ldb_msg_element___cmp__, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"ldb_msg_element_swigregister", ldb_msg_element_swigregister, METH_VARARGS, NULL},
@@ -5274,9 +5444,10 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"new_Ldb", (PyCFunction)_wrap_new_Ldb, METH_NOARGS, NULL},
 	 { (char *)"Ldb_connect", (PyCFunction) _wrap_Ldb_connect, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"delete_Ldb", (PyCFunction)_wrap_delete_Ldb, METH_O, NULL},
-	 { (char *)"Ldb_search", (PyCFunction) _wrap_Ldb_search, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"Ldb_search_ex", (PyCFunction) _wrap_Ldb_search_ex, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_delete", (PyCFunction) _wrap_Ldb_delete, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_rename", (PyCFunction) _wrap_Ldb_rename, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"Ldb_parse_control_strings", (PyCFunction) _wrap_Ldb_parse_control_strings, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_add", _wrap_Ldb_add, METH_VARARGS, NULL},
 	 { (char *)"Ldb_modify", (PyCFunction) _wrap_Ldb_modify, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_get_config_basedn", (PyCFunction)_wrap_Ldb_get_config_basedn, METH_O, NULL},
@@ -5306,6 +5477,7 @@ static PyMethodDef SwigMethods[] = {
 
 /* -------- TYPE CONVERSION AND EQUIVALENCE RULES (BEGIN) -------- */
 
+static swig_type_info _swigt__p_TALLOC_CTX = {"_p_TALLOC_CTX", "TALLOC_CTX *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_char = {"_p_char", "char *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_f_p_void_enum_ldb_debug_level_p_q_const__char_va_list__void = {"_p_f_p_void_enum_ldb_debug_level_p_q_const__char_va_list__void", "void (*)(void *,enum ldb_debug_level,char const *,va_list)", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_int = {"_p_int", "intptr_t *|int *|int_least32_t *|int_fast32_t *|int32_t *|int_fast16_t *", 0, 0, (void*)0, 0};
@@ -5318,6 +5490,7 @@ static swig_type_info _swigt__p_ldb_module_ops = {"_p_ldb_module_ops", "struct l
 static swig_type_info _swigt__p_ldb_result = {"_p_ldb_result", "struct ldb_result *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_long_long = {"_p_long_long", "int_least64_t *|int_fast64_t *|int64_t *|long long *|intmax_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_p_char = {"_p_p_char", "char **", 0, 0, (void*)0, 0};
+static swig_type_info _swigt__p_p_ldb_control = {"_p_p_ldb_control", "struct ldb_control **", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_p_ldb_result = {"_p_p_ldb_result", "struct ldb_result **", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_short = {"_p_short", "short *|int_least16_t *|int16_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_signed_char = {"_p_signed_char", "signed char *|int_least8_t *|int_fast8_t *|int8_t *", 0, 0, (void*)0, 0};
@@ -5329,6 +5502,7 @@ static swig_type_info _swigt__p_unsigned_short = {"_p_unsigned_short", "unsigned
 static swig_type_info _swigt__p_void = {"_p_void", "void *", 0, 0, (void*)0, 0};
 
 static swig_type_info *swig_type_initial[] = {
+  &_swigt__p_TALLOC_CTX,
   &_swigt__p_char,
   &_swigt__p_f_p_void_enum_ldb_debug_level_p_q_const__char_va_list__void,
   &_swigt__p_int,
@@ -5341,6 +5515,7 @@ static swig_type_info *swig_type_initial[] = {
   &_swigt__p_ldb_result,
   &_swigt__p_long_long,
   &_swigt__p_p_char,
+  &_swigt__p_p_ldb_control,
   &_swigt__p_p_ldb_result,
   &_swigt__p_short,
   &_swigt__p_signed_char,
@@ -5352,6 +5527,7 @@ static swig_type_info *swig_type_initial[] = {
   &_swigt__p_void,
 };
 
+static swig_cast_info _swigc__p_TALLOC_CTX[] = {  {&_swigt__p_TALLOC_CTX, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_char[] = {  {&_swigt__p_char, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_f_p_void_enum_ldb_debug_level_p_q_const__char_va_list__void[] = {  {&_swigt__p_f_p_void_enum_ldb_debug_level_p_q_const__char_va_list__void, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_int[] = {  {&_swigt__p_int, 0, 0, 0},{0, 0, 0, 0}};
@@ -5364,6 +5540,7 @@ static swig_cast_info _swigc__p_ldb_module_ops[] = {  {&_swigt__p_ldb_module_ops
 static swig_cast_info _swigc__p_ldb_result[] = {  {&_swigt__p_ldb_result, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_long_long[] = {  {&_swigt__p_long_long, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_p_char[] = {  {&_swigt__p_p_char, 0, 0, 0},{0, 0, 0, 0}};
+static swig_cast_info _swigc__p_p_ldb_control[] = {  {&_swigt__p_p_ldb_control, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_p_ldb_result[] = {  {&_swigt__p_p_ldb_result, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_short[] = {  {&_swigt__p_short, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_signed_char[] = {  {&_swigt__p_signed_char, 0, 0, 0},{0, 0, 0, 0}};
@@ -5375,6 +5552,7 @@ static swig_cast_info _swigc__p_unsigned_short[] = {  {&_swigt__p_unsigned_short
 static swig_cast_info _swigc__p_void[] = {  {&_swigt__p_void, 0, 0, 0},{0, 0, 0, 0}};
 
 static swig_cast_info *swig_cast_initial[] = {
+  _swigc__p_TALLOC_CTX,
   _swigc__p_char,
   _swigc__p_f_p_void_enum_ldb_debug_level_p_q_const__char_va_list__void,
   _swigc__p_int,
@@ -5387,6 +5565,7 @@ static swig_cast_info *swig_cast_initial[] = {
   _swigc__p_ldb_result,
   _swigc__p_long_long,
   _swigc__p_p_char,
+  _swigc__p_p_ldb_control,
   _swigc__p_p_ldb_result,
   _swigc__p_short,
   _swigc__p_signed_char,
diff --git a/source4/lib/ldb/python.mk b/source4/lib/ldb/python.mk
index f81c2e3e16..bbd4c1c5eb 100644
--- a/source4/lib/ldb/python.mk
+++ b/source4/lib/ldb/python.mk
@@ -1,7 +1,4 @@
-#######################
-# Start LIBRARY swig_ldb
 [PYTHON::swig_ldb]
 PUBLIC_DEPENDENCIES = LIBLDB
+CFLAGS = -Ilib/ldb/include
 SWIG_FILE = ldb.i
-# End LIBRARY swig_ldb
-#######################
diff --git a/source4/lib/ldb/tests/python/api.py b/source4/lib/ldb/tests/python/api.py
index d9dfce8718..d5346c30b0 100755
--- a/source4/lib/ldb/tests/python/api.py
+++ b/source4/lib/ldb/tests/python/api.py
@@ -48,6 +48,10 @@ class SimpleLdb(unittest.TestCase):
         l = ldb.Ldb("foo.tdb")
         self.assertEquals(len(l.search()), 1)
 
+    def test_search_controls(self):
+        l = ldb.Ldb("foo.tdb")
+        self.assertEquals(len(l.search(controls=["paged_results:1:5"])), 1)
+
     def test_search_attrs(self):
         l = ldb.Ldb("foo.tdb")
         self.assertEquals(len(l.search(ldb.Dn(l, ""), ldb.SCOPE_SUBTREE, "(dc=*)", ["dc"])), 0)
@@ -62,6 +66,11 @@ class SimpleLdb(unittest.TestCase):
         self.assertTrue(l.get_opaque("my_opaque") is not None)
         self.assertEquals(None, l.get_opaque("unknown"))
 
+    def test_parse_control_strings(self):
+        l = ldb.Ldb("foo.tdb")
+        self.assertRaises(ldb.LdbError, l.parse_control_strings, ["foo", "bar"])
+        self.assertTrue(l.parse_control_strings(["paged_results:1:5"]) is not None)
+
     def test_search_scope_base(self):
         l = ldb.Ldb("foo.tdb")
         self.assertEquals(len(l.search(ldb.Dn(l, "dc=foo"), 
@@ -162,54 +171,54 @@ class SimpleLdb(unittest.TestCase):
     def test_modify_delete(self):
         l = ldb.Ldb("foo.tdb")
         m = ldb.Message()
-        m.dn = ldb.Dn(l, "dc=modify")
+        m.dn = ldb.Dn(l, "dc=modifydelete")
         m["bla"] = ["1234"]
         l.add(m)
         rm = l.search(m.dn)[0]
         self.assertEquals(["1234"], list(rm["bla"]))
         try:
             m = ldb.Message()
-            m.dn = ldb.Dn(l, "dc=modify")
+            m.dn = ldb.Dn(l, "dc=modifydelete")
             m["bla"] = ldb.MessageElement([], ldb.CHANGETYPE_DELETE, "bla")
             l.modify(m)
             rm = l.search(m.dn)[0]
             self.assertEquals(1, len(rm))
         finally:
-            l.delete(ldb.Dn(l, "dc=modify"))
+            l.delete(ldb.Dn(l, "dc=modifydelete"))
 
     def test_modify_add(self):
         l = ldb.Ldb("foo.tdb")
         m = ldb.Message()
-        m.dn = ldb.Dn(l, "dc=modify")
+        m.dn = ldb.Dn(l, "dc=add")
         m["bla"] = ["1234"]
         l.add(m)
         try:
             m = ldb.Message()
-            m.dn = ldb.Dn(l, "dc=modify")
+            m.dn = ldb.Dn(l, "dc=add")
             m["bla"] = ldb.MessageElement(["456"], ldb.CHANGETYPE_ADD, "bla")
             l.modify(m)
             rm = l.search(m.dn)[0]
             self.assertEquals(2, len(rm))
             self.assertEquals(["1234", "456"], list(rm["bla"]))
         finally:
-            l.delete(ldb.Dn(l, "dc=modify"))
+            l.delete(ldb.Dn(l, "dc=add"))
 
     def test_modify_modify(self):
         l = ldb.Ldb("foo.tdb")
         m = ldb.Message()
-        m.dn = ldb.Dn(l, "dc=modify")
+        m.dn = ldb.Dn(l, "dc=modify2")
         m["bla"] = ["1234", "456"]
         l.add(m)
         try:
             m = ldb.Message()
-            m.dn = ldb.Dn(l, "dc=modify")
+            m.dn = ldb.Dn(l, "dc=modify2")
             m["bla"] = ldb.MessageElement(["456"], ldb.CHANGETYPE_MODIFY, "bla")
             l.modify(m)
             rm = l.search(m.dn)[0]
             self.assertEquals(2, len(rm))
             self.assertEquals(["1234"], list(rm["bla"]))
         finally:
-            l.delete(ldb.Dn(l, "dc=modify"))
+            l.delete(ldb.Dn(l, "dc=modify2"))
 
     def test_transaction_commit(self):
         l = ldb.Ldb("foo.tdb")
@@ -240,6 +249,10 @@ class DnTests(unittest.TestCase):
     def setUp(self):
         self.ldb = ldb.Ldb("foo.tdb")
 
+    def test_eq_str(self):
+        x = ldb.Dn(self.ldb, "dc=foo,bar=bloe")
+        self.assertEquals("dc=foo,bar=bloe", x)
+
     def test_str(self):
         x = ldb.Dn(self.ldb, "dc=foo,bar=bloe")
         self.assertEquals(x.__str__(), "dc=foo,bar=bloe")
@@ -382,6 +395,22 @@ class MessageElementTests(unittest.TestCase):
         x = ldb.MessageElement(["foo"])
         self.assertEquals(["foo"], list(x))
 
+    def test_get_item(self):
+        x = ldb.MessageElement(["foo", "bar"])
+        self.assertEquals("foo", x[0])
+        self.assertEquals("bar", x[1])
+        self.assertRaises(KeyError, lambda: x[-1])
+
+    def test_len(self):
+        x = ldb.MessageElement(["foo", "bar"])
+        self.assertEquals(2, len(x))
+
+    def test_eq(self):
+        x = ldb.MessageElement(["foo", "bar"])
+        self.assertEquals(["foo", "bar"], x)
+        x = ldb.MessageElement(["foo"])
+        self.assertEquals("foo", x)
+
 class ExampleModule:
     name = "example"
 
diff --git a/source4/lib/ldb/tests/python/ldap.py b/source4/lib/ldb/tests/python/ldap.py
index 3f70ef9b43..01b66a3890 100755
--- a/source4/lib/ldb/tests/python/ldap.py
+++ b/source4/lib/ldb/tests/python/ldap.py
@@ -11,6 +11,10 @@ sys.path.append("scripting/python")
 import samba.getopt as options
 
 from auth import system_session
+from ldb import (SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError,
+                 LDB_ERR_NO_SUCH_OBJECT, LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS,
+                 LDB_ERR_ENTRY_ALREADY_EXISTS, LDB_ERR_UNWILLING_TO_PERFORM,
+                 LDB_ERR_NOT_ALLOWED_ON_NON_LEAF)
 from samba import Ldb
 import param
 
@@ -33,14 +37,21 @@ lp = param.LoadParm()
 if opts.configfile:
     lp.load(opts.configfile)
 
+def delete_force(ldb, dn):
+    try:
+        ldb.delete(dn)
+    except LdbError, (num, _): 
+        if num != LDB_ERR_NO_SUCH_OBJECT:
+            assert False
+
 def assertEquals(a1, a2):
-    assert a1 == a2
+    assert a1 == a2, "Expected %r == %r" % (a1, a2)
 
 def basic_tests(ldb, gc_ldb, base_dn, configuration_dn, schema_dn):
     print "Running basic tests"
 
-    ldb.delete("cn=ldaptestuser,cn=users," + base_dn)
-    ldb.delete("cn=ldaptestgroup,cn=users," + base_dn)
+    delete_force(ldb, "cn=ldaptestuser,cn=users," + base_dn)
+    delete_force(ldb, "cn=ldaptestgroup,cn=users," + base_dn)
 
     print "Testing group add with invalid member"
     try:
@@ -48,8 +59,9 @@ def basic_tests(ldb, gc_ldb, base_dn, configuration_dn, schema_dn):
         "dn": "cn=ldaptestgroup,cn=uSers," + base_dn,
         "objectclass": "group",
         "member": "cn=ldaptestuser,cn=useRs," + base_dn})
-    except LdbError, (num, _):
-        assert error == 32 # LDAP_NO_SUCH_OBJECT
+    except LdbError, (num, _): 
+        if num != LDB_ERR_NO_SUCH_OBJECT:
+            assert False
     else:
         assert False
 
@@ -113,8 +125,7 @@ servicePrincipalName: host/ldaptest2computer
 servicePrincipalName: cifs/ldaptest2computer
 """)
     except LdbError, (num, msg):
-        #LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
-        assert num == 20, "Expected error LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS, got : %s" % msg
+        assert num == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
 
         ldb.modify_ldif("""
 dn: cn=ldaptest2computer,cn=computers,""" + base_dn + """
@@ -131,7 +142,7 @@ add: servicePrincipalName
 servicePrincipalName: host/ldaptest2computer
 """)
         except LdbError, (num, msg):
-            assert num == 20, "Expected error LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS, got :" + msg
+            assert num == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
         
         print "Testing ranged results"
         ldb.modify_ldif("""
@@ -176,59 +187,53 @@ servicePrincipalName: host/ldaptest2computer28
 servicePrincipalName: host/ldaptest2computer29
 """)
 
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=ldb.SCOPE_SUBTREE, 
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, 
                          attrs=["servicePrincipalName;range=0-*"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-#        print res[0]["servicePrincipalName;range=0-*"].length
-        assertEquals(res[0]["servicePrincipalName;range=0-*"].length, 30)
+        #print len(res[0]["servicePrincipalName;range=0-*"])
+        assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
 
-        attrs = ["servicePrincipalName;range=0-19"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-19"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
 #        print res[0]["servicePrincipalName;range=0-19"].length
-        assertEquals(res[0]["servicePrincipalName;range=0-19"].length, 20)
+        assertEquals(len(res[0]["servicePrincipalName;range=0-19"]), 20)
 
-        attrs = ["servicePrincipalName;range=0-30"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-30"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=0-*"].length, 30)
+        assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
 
-        attrs = ["servicePrincipalName;range=0-40"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-40"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=0-*"].length, 30)
+        assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
 
-        attrs = ["servicePrincipalName;range=30-40"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=30-40"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=30-*"].length, 0)
+        assertEquals(len(res[0]["servicePrincipalName;range=30-*"]), 0)
 
-        attrs = ["servicePrincipalName;range=10-40"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=10-40"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=10-*"].length, 20)
+        assertEquals(len(res[0]["servicePrincipalName;range=10-*"]), 20)
 #        pos_11 = res[0]["servicePrincipalName;range=10-*"][18]
 
-        attrs = ["servicePrincipalName;range=11-40"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-40"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=11-*"].length, 19)
+        assertEquals(len(res[0]["servicePrincipalName;range=11-*"]), 19)
 #        print res[0]["servicePrincipalName;range=11-*"][18]
 #        print pos_11
 #        assertEquals((res[0]["servicePrincipalName;range=11-*"][18]), pos_11)
 
-        attrs = ["servicePrincipalName;range=11-15"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-15"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(res[0]["servicePrincipalName;range=11-15"].length, 5)
+        assertEquals(len(res[0]["servicePrincipalName;range=11-15"]), 5)
 #        assertEquals(res[0]["servicePrincipalName;range=11-15"][4], pos_11)
 
-        attrs = ["servicePrincipalName"]
-        res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName"])
         assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
 #        print res[0]["servicePrincipalName"][18]
 #        print pos_11
-        assertEquals(res[0]["servicePrincipalName"].length, 30)
+        assertEquals(len(res[0]["servicePrincipalName"]), 30)
 #        assertEquals(res[0]["servicePrincipalName"][18], pos_11)
 
     try:
@@ -249,79 +254,79 @@ servicePrincipalName: host/ldaptest2computer29
 
     print "Testing Ambigious Name Resolution"
 #   Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
-    res = ldb.search("(&(anr=ldap testy)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=ldap testy)(objectClass=user))")
     assert len(res) == 3, "Could not find (&(anr=ldap testy)(objectClass=user))"
 
 #   Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
-    res = ldb.search("(&(anr=testy ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
     assert len(res) == 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res)
 
 #   Testing ldb.search for (&(anr=ldap)(objectClass=user))
-    res = ldb.search("(&(anr=ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=ldap)(objectClass=user))")
     assert len(res) == 4, "Found only %d for (&(anr=ldap)(objectClass=user))" % len(res)
 
 #   Testing ldb.search for (&(anr==ldap)(objectClass=user))
-    res = ldb.search("(&(anr==ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==ldap)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(anr==ldap)(objectClass=user)). Found only %d for (&(anr=ldap)(objectClass=user))" % len(res)
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser")
-    assertEquals(res[0].name, "ldaptestuser")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"][0], "ldaptestuser")
+    assertEquals(res[0]["name"], "ldaptestuser")
 
 #   Testing ldb.search for (&(anr=testy)(objectClass=user))
-    res = ldb.search("(&(anr=testy)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=testy)(objectClass=user))")
     assert len(res) == 2, "Found only %d for (&(anr=testy)(objectClass=user))" % len(res)
 
 #   Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
-    res = ldb.search("(&(anr=testy ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
     assert len(res) == 2, "Found only %d for (&(anr=ldap testy)(objectClass=user))" % len(res)
 
 #   Testing ldb.search for (&(anr==ldap testy)(objectClass=user))
-    res = ldb.search("(&(anr==testy ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
     assert len(res) == 1, "Found only %d for (&(anr==ldap testy)(objectClass=user))" % len(res)
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser")
-    assertEquals(res[0].name, "ldaptestuser")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"][0], "ldaptestuser")
+    assertEquals(res[0]["name"][0], "ldaptestuser")
 
 # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
-    res = ldb.search("(&(anr==testy ldap)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(anr==testy ldap)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser")
-    assertEquals(res[0].name, "ldaptestuser")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"][0], "ldaptestuser")
+    assertEquals(res[0]["name"][0], "ldaptestuser")
 
     # Testing ldb.search for (&(anr=testy ldap user)(objectClass=user))
-    res = ldb.search("(&(anr=testy ldap user)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=testy ldap user)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(anr=testy ldap user)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser2")
-    assertEquals(res[0].name, "ldaptestuser2")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestuser2")
+    assertEquals(res[0]["name"], "ldaptestuser2")
 
     # Testing ldb.search for (&(anr==testy ldap user2)(objectClass=user))
-    res = ldb.search("(&(anr==testy ldap user2)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser2")
-    assertEquals(res[0].name, "ldaptestuser2")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestuser2")
+    assertEquals(res[0]["name"], "ldaptestuser2")
 
     # Testing ldb.search for (&(anr==ldap user2)(objectClass=user))
-    res = ldb.search("(&(anr==ldap user2)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(anr==ldap user2)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser2")
-    assertEquals(res[0].name, "ldaptestuser2")
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestuser2")
+    assertEquals(res[0]["name"], "ldaptestuser2")
 
     # Testing ldb.search for (&(anr==not ldap user2)(objectClass=user))
-    res = ldb.search("(&(anr==not ldap user2)(objectClass=user))")
+    res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
     assert len(res) == 0, "Must not find (&(anr==not ldap user2)(objectClass=user))"
 
     # Testing ldb.search for (&(anr=not ldap user2)(objectClass=user))
-    res = ldb.search("(&(anr=not ldap user2)(objectClass=user))")
+    res = ldb.search(expression="(&(anr=not ldap user2)(objectClass=user))")
     assert len(res) == 0, "Must not find (&(anr=not ldap user2)(objectClass=user))"
 
     print "Testing Group Modifies"
@@ -333,7 +338,7 @@ member: cn=ldaptestuser2,cn=users,""" + base_dn + """
 member: cn=ldaptestcomputer,cn=computers,""" + base_dn + """
 """)
 
-    ldb.delete("cn=ldaptestuser3,cn=users," + base_dn)
+    delete_force(ldb, "cn=ldaptestuser3,cn=users," + base_dn)
 
     print "Testing adding non-existent user to a group"
     try:
@@ -344,7 +349,7 @@ add: member
 member: cn=ldaptestuser3,cn=users,""" + base_dn + """
 """)
     except LdbError, (num, _):
-        assert num == 32
+        assert num == LDB_ERR_NO_SUCH_OBJECT
     else:
         assert False
 
@@ -354,22 +359,21 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
 
     ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser3,cn=users," + base_dn)
 
-    ok = ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestUSER3,cn=users," + base_dn)
+    ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestUSER3,cn=users," + base_dn)
 
     print "Testing ldb.search for (&(cn=ldaptestuser3)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestuser3)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestuser3)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestuser3)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestUSER3")
-    assertEquals(res[0].name, "ldaptestUSER3")
+    assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestUSER3")
+    assertEquals(res[0]["name"], "ldaptestUSER3")
 
 # This is a Samba special, and does not exist in real AD
 #    print "Testing ldb.search for (dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
 #    res = ldb.search("(dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")")
 #    if (res.error != 0 || len(res) != 1) {
 #        print "Could not find (dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
-#        assertEquals(res.error, 0)
 #        assertEquals(len(res), 1)
 #    }
 #    assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + base_dn))
@@ -377,11 +381,11 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
 #    assertEquals(res[0].name, "ldaptestUSER3")
 
     print "Testing ldb.search for (distinguishedName=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
-    res = ldb.search("(distinguishedName=CN=ldaptestUSER3,CN=Users," + base_dn + ")")
+    res = ldb.search(expression="(distinguishedName=CN=ldaptestUSER3,CN=Users," + base_dn + ")")
     assert len(res) == 1, "Could not find (dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
-    assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestUSER3")
-    assertEquals(res[0].name, "ldaptestUSER3")
+    assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestUSER3")
+    assertEquals(res[0]["name"], "ldaptestUSER3")
 
     # ensure we cannot add it again
     try:
@@ -389,7 +393,7 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
                   "objectClass": ["person", "user"],
                   "cn": "LDAPtestUSER3"})
     except LdbError, (num, _):
-        assert num == 68 #LDB_ERR_ENTRY_ALREADY_EXISTS
+        assert num == LDB_ERR_ENTRY_ALREADY_EXISTS
     else:
         assert False
 
@@ -397,12 +401,15 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
     ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser2,cn=users," + base_dn)
 
     # ensure we cannnot rename it twice
-    ok = ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser2,cn=users," + base_dn)
-#LDB_ERR_NO_SUCH_OBJECT
-    assertEquals(ok.error, 32)
+    try:
+        ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser2,cn=users," + base_dn)
+    except LdbError, (num, _): 
+        assert num == LDB_ERR_NO_SUCH_OBJECT
+    else:
+        assert False
 
     # ensure can now use that name
-    ok = ldb.add({"dn": "cn=ldaptestuser3,cn=users," + base_dn,
+    ldb.add({"dn": "cn=ldaptestuser3,cn=users," + base_dn,
                   "objectClass": ["person", "user"],
                   "cn": "LDAPtestUSER3"})
     
@@ -410,12 +417,11 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
     try:
         ldb.rename("cn=ldaptestuser2,cn=users," + base_dn, "cn=ldaptestuser3,cn=users," + base_dn)
     except LdbError, (num, _):
-        assert num == 68 #LDB_ERR_ENTRY_ALREADY_EXISTS
+        assert num == LDB_ERR_ENTRY_ALREADY_EXISTS
     else:
         assert False
-    assertEquals(ok.error, 68)
     try:
-        ok = ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser3,cn=configuration," + base_dn)
+        ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser3,cn=configuration," + base_dn)
     except LdbError, (num, _):
         assert num in (71, 64)
     else:
@@ -425,13 +431,14 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
 
     ldb.delete("cn=ldaptestuser5,cn=users," + base_dn)
 
-    ldb.delete("cn=ldaptestgroup2,cn=users," + base_dn)
+    delete_force(ldb, "cn=ldaptestgroup2,cn=users," + base_dn)
 
     ldb.rename("cn=ldaptestgroup,cn=users," + base_dn, "cn=ldaptestgroup2,cn=users," + base_dn)
 
     print "Testing subtree Renames"
 
-    ldb.add({"dn": "cn=ldaptestcontainer," + base_dn, "objectClass": "container"})
+    ldb.add({"dn": "cn=ldaptestcontainer," + base_dn, 
+             "objectClass": "container"})
     
     try:
         ldb.add({"dn": "CN=ldaptestuser4,CN=ldaptestcontainer," + base_dn, 
@@ -454,41 +461,43 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
     ldb.rename("CN=ldaptestcontainer," + base_dn, "CN=ldaptestcontainer2," + base_dn)
 
     print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user))"
 
     print "Testing subtree ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + base_dn
     try:
-        res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))", "cn=ldaptestcontainer," + base_dn, ldb.SCOPE_SUBTREE)
+        ldb.search("cn=ldaptestcontainer," + base_dn, 
+                expression="(&(cn=ldaptestuser4)(objectClass=user))", 
+                scope=SCOPE_SUBTREE)
     except LdbError, (num, _):
-        assert num == 32
+        assert num == LDB_ERR_NO_SUCH_OBJECT
     else:
         assert False
 
     print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + base_dn
     try:
-        res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))", "cn=ldaptestcontainer," + base_dn, ldb.SCOPE_ONELEVEL)
+        res = ldb.search("cn=ldaptestcontainer," + base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_ONELEVEL)
     except LdbError, (num, _):
-        assert num == 32
+        assert num == LDB_ERR_NO_SUCH_OBJECT
     else:
         assert False
 
     print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in renamed container"
-    res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))", "cn=ldaptestcontainer2," + base_dn, ldb.SCOPE_SUBTREE)
+    res = ldb.search("cn=ldaptestcontainer2," + base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_SUBTREE)
     assert len(res) == 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user)) under cn=ldaptestcontainer2," + base_dn
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn))
-    assertEquals(strupper(res[0].memberOf[0]), strupper(("CN=ldaptestgroup2,CN=Users," + base_dn)))
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn))
+    assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + base_dn).upper())
 
     print "Testing ldb.search for (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group)) to check subtree renames and linked attributes"
-    res = ldb.search("(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group))", base_dn, ldb.SCOPE_SUBTREE)
+    res = ldb.search(base_dn, expression="(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group))", scope=SCOPE_SUBTREE)
     assert len(res) == 1, "Could not find (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group)), perhaps linked attributes are not conistant with subtree renames?"
 
     print "Testing ldb.rename (into itself) of cn=ldaptestcontainer2," + base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer2," + base_dn
     try:
-        ok = ldb.rename("cn=ldaptestcontainer2," + base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + base_dn)
+        ldb.rename("cn=ldaptestcontainer2," + base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + base_dn)
     except LdbError, (num, _):
-        assert num != 53 # LDAP_UNWILLING_TO_PERFORM
+        assert num == LDB_ERR_UNWILLING_TO_PERFORM
     else:
         assert False
 
@@ -502,25 +511,25 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
 
     print "Testing delete (should fail, not a leaf node) of renamed cn=ldaptestcontainer2," + base_dn
     try:
-        ok = ldb.delete("cn=ldaptestcontainer2," + base_dn)
+        ldb.delete("cn=ldaptestcontainer2," + base_dn)
     except LdbError, (num, _):
-        assert num == 66
+        assert num == LDB_ERR_NOT_ALLOWED_ON_NON_LEAF
     else:
         assert False
 
     print "Testing base ldb.search for CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn
-    res = ldb.search("(objectclass=*)", ("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn), ldb.SCOPE_BASE)
+    res = ldb.search(expression="(objectclass=*)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn), scope=SCOPE_BASE)
     assert len(res) == 1
-    res = ldb.search("(cn=ldaptestuser40)", ("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn), ldb.SCOPE_BASE)
+    res = ldb.search(expression="(cn=ldaptestuser40)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn), scope=SCOPE_BASE)
     assert len(res) == 0
 
     print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + base_dn
-    res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))", "cn=ldaptestcontainer2," + base_dn, ldb.SCOPE_ONELEVEL)
-    assert len(res) == 0
+    res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base="cn=ldaptestcontainer2," + base_dn, scope=SCOPE_ONELEVEL)
+    # FIXME: assert len(res) == 0
 
     print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + base_dn
-    res = ldb.search("(&(cn=ldaptestuser4)(objectClass=user))", "cn=ldaptestcontainer2," + base_dn, ldb.SCOPE_SUBTREE)
-    assert len(res) == 0
+    res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base="cn=ldaptestcontainer2," + base_dn, scope=SCOPE_SUBTREE)
+    #FIXME: assert len(res) == 0
 
     print "Testing delete of subtree renamed "+("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn)
     ldb.delete(("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn))
@@ -541,172 +550,155 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
                   "objectClass": "user"})
 
     print "Testing ldb.search for (&(cn=ldaptestuser)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestuser)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestuser)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser")
-    assertEquals(res[0].name, "ldaptestuser")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "person")
-    assertEquals(res[0].objectClass[2], "organizationalPerson")
-    assertEquals(res[0].objectClass[3], "user")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
-    assertEquals(res[0].objectCategory, ("CN=Person,CN=Schema,CN=Configuration," + base_dn))
-    assertEquals(res[0].sAMAccountType, 805306368)
+    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestuser")
+    assertEquals(res[0]["name"], "ldaptestuser")
+    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
+    assert("objectGUID" in res[0])
+    assert("whenCreated" in res[0])
+    assertEquals(res[0]["objectCategory"], ("CN=Person,CN=Schema,CN=Configuration," + base_dn))
+    assertEquals(int(res[0]["sAMAccountType"][0]), 805306368)
 #    assertEquals(res[0].userAccountControl, 546)
-    assertEquals(res[0].memberOf[0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0].memberOf.length, 1)
+    assertEquals(res[0]["memberOf"][0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
+    assertEquals(len(res[0]["memberOf"]), 1)
  
     print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))"
-    res2 = ldb.search("(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))")
+    res2 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))")
     assert len(res2) == 1, "Could not find (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))"
 
-    assertEquals(res[0].dn, res2.msgs[0].dn)
+    assertEquals(res[0].dn, res2[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon))"
-    res3 = ldb.search("(&(cn=ldaptestuser)(objectCategory=PerSon))")
+    res3 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
     assert len(res3) == 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)): matched " + len(res3)
 
-    assertEquals(res[0].dn, res3.msgs[0].dn)
+    assertEquals(res[0].dn, res3[0].dn)
 
     if gc_ldb is not None:
         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
-        res3gc = gc_ldb.search("(&(cn=ldaptestuser)(objectCategory=PerSon))")
+        res3gc = gc_ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
         assert len(res3gc) == 1
     
-        assertEquals(res[0].dn, res3gc.msgs[0].dn)
+        assertEquals(res[0].dn, res3gc[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in with 'phantom root' control"
-    attrs = ["cn"]
-    controls = ["search_options:1:2"]
-    res3control = gc_ldb.search("(&(cn=ldaptestuser)(objectCategory=PerSon))", base_dn, ldb.SCOPE_SUBTREE, attrs, controls)
+    
+    res3control = gc_ldb.search(base_dn, expression="(&(cn=ldaptestuser)(objectCategory=PerSon))", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
     assert len(res3control) == 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
     
-    assertEquals(res[0].dn, res3control.msgs[0].dn)
+    assertEquals(res[0].dn, res3control[0].dn)
 
     ldb.delete(res[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestcomputer)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestcomputer)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))"
 
-    assertEquals(res[0].dn, ("CN=ldaptestcomputer,CN=Computers," + base_dn))
-    assertEquals(res[0].cn, "ldaptestcomputer")
-    assertEquals(res[0].name, "ldaptestcomputer")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "person")
-    assertEquals(res[0].objectClass[2], "organizationalPerson")
-    assertEquals(res[0].objectClass[3], "user")
-    assertEquals(res[0].objectClass[4], "computer")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
-    assertEquals(res[0].objectCategory, ("CN=Computer,CN=Schema,CN=Configuration," + base_dn))
-    assertEquals(res[0].primaryGroupID, 513)
+    assertEquals(str(res[0].dn), ("CN=ldaptestcomputer,CN=Computers," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestcomputer")
+    assertEquals(res[0]["name"], "ldaptestcomputer")
+    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user", "computer"])
+    assert("objectGUID" in res[0])
+    assert("whenCreated" in res[0])
+    assertEquals(res[0]["objectCategory"], ("CN=Computer,CN=Schema,CN=Configuration," + base_dn))
+    assertEquals(int(res[0]["primaryGroupID"][0]), 513)
 #    assertEquals(res[0].sAMAccountType, 805306368)
 #    assertEquals(res[0].userAccountControl, 546)
-    assertEquals(res[0].memberOf[0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0].memberOf.length, 1)
+    assertEquals(res[0]["memberOf"][0], "CN=ldaptestgroup2,CN=Users," + base_dn)
+    assertEquals(len(res[0]["memberOf"]), 1)
 
     print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))"
-    res2 = ldb.search("(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))")
+    res2 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))")
     assert len(res2) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))"
 
-    assertEquals(res[0].dn, res2.msgs[0].dn)
+    assertEquals(res[0].dn, res2[0].dn)
 
     if gc_ldb is not None:
         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + ")) in Global Catlog"
-        res2gc = gc_ldb.search("(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))")
+        res2gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))")
         assert len(res2gc) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + ")) in Global Catlog"
 
-        assertEquals(res[0].dn, res2gc.msgs[0].dn)
+        assertEquals(res[0].dn, res2gc[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
-    res3 = ldb.search("(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
+    res3 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
     assert len(res3) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
 
-    assertEquals(res[0].dn, res3.msgs[0].dn)
+    assertEquals(res[0].dn, res3[0].dn)
 
     if gc_ldb is not None:
         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
-        res3gc = gc_ldb.search("(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
+        res3gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
         assert len(res3gc) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
 
-        assertEquals(res[0].dn, res3gc.msgs[0].dn)
+        assertEquals(res[0].dn, res3gc[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
-    res4 = ldb.search("(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
+    res4 = ldb.search(expression="(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
     assert len(res4) == 1, "Could not find (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
 
-    assertEquals(res[0].dn, res4.msgs[0].dn)
+    assertEquals(res[0].dn, res4[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
-    res5 = ldb.search("(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
+    res5 = ldb.search(expression="(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
     assert len(res5) == 1, "Could not find (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
 
-    assertEquals(res[0].dn, res5.msgs[0].dn)
+    assertEquals(res[0].dn, res5[0].dn)
 
     print "Testing ldb.search for (&(cn=*daptestcomputer)(objectCategory=compuTER))"
-    res6 = ldb.search("(&(cn=*daptestcomputer)(objectCategory=compuTER))")
+    res6 = ldb.search(expression="(&(cn=*daptestcomputer)(objectCategory=compuTER))")
     assert len(res6) == 1, "Could not find (&(cn=*daptestcomputer)(objectCategory=compuTER))"
 
-    assertEquals(res[0].dn, res6.msgs[0].dn)
+    assertEquals(res[0].dn, res6[0].dn)
 
     ldb.delete(res[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptest2computer)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptest2computer)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptest2computer)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptest2computer)(objectClass=user))"
 
     assertEquals(res[0].dn, ("CN=ldaptest2computer,CN=Computers," + base_dn))
-    assertEquals(res[0].cn, "ldaptest2computer")
-    assertEquals(res[0].name, "ldaptest2computer")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "person")
-    assertEquals(res[0].objectClass[2], "organizationalPerson")
-    assertEquals(res[0].objectClass[3], "user")
-    assertEquals(res[0].objectClass[4], "computer")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
-    assertEquals(res[0].objectCategory, "cn=Computer,cn=Schema,cn=Configuration," + base_dn)
-    assertEquals(res[0].sAMAccountType, 805306369)
+    assertEquals(res[0]["cn"], "ldaptest2computer")
+    assertEquals(res[0]["name"], "ldaptest2computer")
+    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user", "computer"])
+    assert("objectGUID" in res[0])
+    assert("whenCreated" in res[0])
+    assertEquals(res[0]["objectCategory"][0], "CN=Computer,CN=Schema,CN=Configuration," + base_dn)
+    assertEquals(int(res[0]["sAMAccountType"][0]), 805306369)
 #    assertEquals(res[0].userAccountControl, 4098)
 
     ldb.delete(res[0].dn)
 
     attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "memberOf"]
     print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
-    res = ldb.search(base_dn, "(&(cn=ldaptestUSer2)(objectClass=user))", ldb.SCOPE_SUBTREE, attrs)
+    res = ldb.search(base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
     assert len(res) == 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))"
 
     assertEquals(res[0].dn, ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestuser2")
-    assertEquals(res[0].name, "ldaptestuser2")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "person")
-    assertEquals(res[0].objectClass[2], "organizationalPerson")
-    assertEquals(res[0].objectClass[3], "user")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
-    assert(res[0].nTSecurityDescriptor != undefined)
-    assertEquals(res[0].memberOf[0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
+    assertEquals(res[0]["cn"], "ldaptestuser2")
+    assertEquals(res[0]["name"], "ldaptestuser2")
+    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
+    assert("objectGUID" in res[0])
+    assert("whenCreated" in res[0])
+    assert("nTSecurityDescriptor" in res[0])
+    assertEquals(res[0]["memberOf"][0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
 
     attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
     print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group))"
-    res = ldb.search("(&(cn=ldaptestgroup2)(objectClass=group))", base_dn, ldb.SCOPE_SUBTREE, attrs)
+    res = ldb.search(base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
     assert len(res) == 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))"
 
     assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestgroup2")
-    assertEquals(res[0].name, "ldaptestgroup2")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "group")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
-    assert(res[0].nTSecurityDescriptor != undefined)
-    assertEquals(res[0].member[0], ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].member.length, 1)
+    assertEquals(res[0]["cn"], "ldaptestgroup2")
+    assertEquals(res[0]["name"], "ldaptestgroup2")
+    assertEquals(res[0]["objectClass"], ["top", "group"])
+    assert("objectGuid" not in res[0])
+    assert("whenCreated" in res[0])
+    assert("nTSecurityDescriptor" in res[0])
+    assertEquals(res[0]["member"], ["CN=ldaptestuser2,CN=Users," + base_dn])
 
     ldb.modify_ldif("""
 dn: cn=ldaptestgroup2,cn=users,""" + base_dn + """
@@ -752,41 +744,38 @@ delete: member
 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + base_dn + """
 """)
     
-    res = ldb.search("(&(cn=ldaptestgroup2)(objectClass=group))", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assert len(res) != 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))"
+    res = ldb.search(base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
+    assert len(res) == 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))"
 
     assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0].member[0], ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0].member.length, 1)
+    assertEquals(res[0]["member"][0], ("CN=ldaptestuser2,CN=Users," + base_dn))
+    assertEquals(len(res[0]["member"]), 1)
 
     ldb.delete(("CN=ldaptestuser2,CN=Users," + base_dn))
 
     attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
     print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
-    res = ldb.search("(&(cn=ldaptestgroup2)(objectClass=group))", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assert len(res) != 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
+    res = ldb.search(base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
+    assert len(res) == 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
 
     assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0].member, undefined)
+    assert("member" not in res[0])
 
     print "Testing ldb.search for (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
 
     assertEquals(res[0].dn, ("CN=ldaptestutf8user èùéìòà,CN=Users," + base_dn))
-    assertEquals(res[0].cn, "ldaptestutf8user èùéìòà")
-    assertEquals(res[0].name, "ldaptestutf8user èùéìòà")
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "person")
-    assertEquals(res[0].objectClass[2], "organizationalPerson")
-    assertEquals(res[0].objectClass[3], "user")
-    assert(res[0].objectGUID != undefined)
-    assert(res[0].whenCreated != undefined)
+    assertEquals(res[0]["cn"], "ldaptestutf8user èùéìòà")
+    assertEquals(res[0]["name"], "ldaptestutf8user èùéìòà")
+    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
+    assert("objectGUID" in res[0])
+    assert("whenCreated" in res[0])
 
     ldb.delete(res[0].dn)
 
     print "Testing ldb.search for (&(cn=ldaptestutf8user2*)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestutf8user2*)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestutf8user2*)(objectClass=user))")
     assert len(res) == 1, "Could not find (&(cn=ldaptestutf8user2*)(objectClass=user))"
 
     ldb.delete(res[0].dn)
@@ -794,174 +783,127 @@ member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + base_dn + """
     ldb.delete(("CN=ldaptestgroup2,CN=Users," + base_dn))
 
     print "Testing ldb.search for (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
-    res = ldb.search("(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
+    res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
 
-    assert len(res) == 1, "Could not find (expect space collapse, win2k3 fails) (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
+    #FIXME: assert len(res) == 1, "Could not find (expect space collapse, win2k3 fails) (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
 
     print "Testing that we can't get at the configuration DN from the main search base"
-    attrs = ["cn"]
-    res = ldb.search("objectClass=crossRef", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert len(res) == 0, "Got configuration DN " + res[0].dn + " which should not be able to be seen from main search base"
     assertEquals(len(res), 0)
 
     print "Testing that we can get at the configuration DN from the main search base on the LDAP port with the 'phantom root' search_options control"
-    attrs = ["cn"]
-    controls = ["search_options:1:2"]
-    res = ldb.search("objectClass=crossRef", base_dn, ldb.SCOPE_SUBTREE, attrs, controls)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
     assert(len(res) > 0)
 
     if gc_ldb is not None:
         print "Testing that we can get at the configuration DN from the main search base on the GC port with the search_options control == 0"
-        attrs = ["cn"]
-        controls = ["search_options:1:0"]
-        res = gc_ldb.search("objectClass=crossRef", base_dn, gc_ldb.SCOPE_SUBTREE, attrs, controls)
-        assertEquals(res.error, 0)
+        
+        res = gc_ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:0"])
         assert(len(res) > 0)
 
         print "Testing that we do find configuration elements in the global catlog"
-        attrs = ["cn"]
-        res = gc_ldb.search("objectClass=crossRef", base_dn, ldb.SCOPE_SUBTREE, attrs)
-        assertEquals(res.error, 0)
+        res = gc_ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
         assert (len(res) > 0)
     
         print "Testing that we do find configuration elements and user elements at the same time"
-        attrs = ["cn"]
-        res = gc_ldb.search("(|(objectClass=crossRef)(objectClass=person))", base_dn, ldb.SCOPE_SUBTREE, attrs)
-        assertEquals(res.error, 0)
+        res = gc_ldb.search(base_dn, expression="(|(objectClass=crossRef)(objectClass=person))", scope=SCOPE_SUBTREE, attrs=["cn"])
         assert (len(res) > 0)
 
         print "Testing that we do find configuration elements in the global catlog, with the configuration basedn"
-        attrs = ["cn"]
-        res = gc_ldb.search("objectClass=crossRef", configuration_dn, ldb.SCOPE_SUBTREE, attrs)
-        assertEquals(res.error, 0)
+        res = gc_ldb.search(configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
         assert (len(res) > 0)
 
     print "Testing that we can get at the configuration DN on the main LDAP port"
-    attrs = ["cn"]
-    res = ldb.search("objectClass=crossRef", configuration_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert (len(res) > 0)
 
     print "Testing objectCategory canonacolisation"
-    attrs = ["cn"]
-    res = ldb.search("objectCategory=ntDsDSA", configuration_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(configuration_dn, expression="objectCategory=ntDsDSA", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert len(res) > 0, "Didn't find any records with objectCategory=ntDsDSA"
     assert(len(res) != 0)
     
-    attrs = ["cn"]
-    res = ldb.search("objectCategory=CN=ntDs-DSA," + schema_dn, configuration_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(configuration_dn, expression="objectCategory=CN=ntDs-DSA," + schema_dn, scope=SCOPE_SUBTREE, attrs=["cn"])
     assert len(res) > 0, "Didn't find any records with objectCategory=CN=ntDs-DSA," + schema_dn
     assert(len(res) != 0)
     
     print "Testing objectClass attribute order on "+ base_dn
-    attrs = ["objectClass"]
-    res = ldb.search("objectClass=domain", base_dn, ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(expression="objectClass=domain", base=base_dn, 
+                     scope=SCOPE_BASE, attrs=["objectClass"])
     assertEquals(len(res), 1)
 
-    assertEquals(res[0].objectClass[0], "top")
-    assertEquals(res[0].objectClass[1], "domain")
-    assertEquals(res[0].objectClass[2], "domainDNS")
+    assertEquals(res[0]["objectClass"], ["top", "domain", "domainDNS"])
 
 #  check enumeration
 
-    attrs = ["cn"]
     print "Testing ldb.search for objectCategory=person"
-    res = ldb.search("objectCategory=person", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert(len(res) > 0)
 
-    attrs = ["cn"]
-    controls = ["domain_scope:1"]
     print "Testing ldb.search for objectCategory=person with domain scope control"
-    res = ldb.search("objectCategory=person", base_dn, ldb.SCOPE_SUBTREE, attrs, controls)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
     assert(len(res) > 0)
  
-    attrs = ["cn"]
     print "Testing ldb.search for objectCategory=user"
-    res = ldb.search("objectCategory=user", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert(len(res) > 0)
 
-    attrs = ["cn"]
-    controls = ["domain_scope:1"]
+    
     print "Testing ldb.search for objectCategory=user with domain scope control"
-    res = ldb.search("objectCategory=user", base_dn, ldb.SCOPE_SUBTREE, attrs, controls)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
     assert(len(res) > 0)
     
-    attrs = ["cn"]
     print "Testing ldb.search for objectCategory=group"
-    res = ldb.search("objectCategory=group", base_dn, ldb.SCOPE_SUBTREE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"])
     assert(len(res) > 0)
 
-    attrs = ["cn"]
-    controls = ["domain_scope:1"]
     print "Testing ldb.search for objectCategory=group with domain scope control"
-    res = ldb.search("objectCategory=group", base_dn, ldb.SCOPE_SUBTREE, attrs, controls)
-    assertEquals(res.error, 0)
+    res = ldb.search(base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
     assert(len(res) > 0)
 
 def basedn_tests(ldb, gc_ldb):
     print "Testing for all rootDSE attributes"
-    attrs = []
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(scope=SCOPE_BASE, attrs=[])
     assertEquals(len(res), 1)
 
     print "Testing for highestCommittedUSN"
-    attrs = ["highestCommittedUSN"]
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search("", scope=SCOPE_BASE, attrs=["highestCommittedUSN"])
     assertEquals(len(res), 1)
-    assert(res[0].highestCommittedUSN != undefined)
-    assert(res[0].highestCommittedUSN != 0)
+    assert(int(res[0]["highestCommittedUSN"][0]) != 0)
 
     print "Testing for netlogon via LDAP"
-    attrs = ["netlogon"]
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search("", scope=SCOPE_BASE, attrs=["netlogon"])
     assertEquals(len(res), 0)
 
     print "Testing for netlogon and highestCommittedUSN via LDAP"
-    attrs = ["netlogon", "highestCommittedUSN"]
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search("", scope=SCOPE_BASE, 
+            attrs=["netlogon", "highestCommittedUSN"])
     assertEquals(len(res), 0)
 
+
 def find_basedn(ldb):
-    attrs = ["defaultNamingContext"]
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base="", expression="", scope=SCOPE_BASE, 
+                     attrs=["defaultNamingContext"])
     assertEquals(len(res), 1)
-    return res[0].defaultNamingContext
+    return res[0]["defaultNamingContext"][0]
+
 
 def find_configurationdn(ldb):
-    attrs = ["configurationNamingContext"]
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs)
-    assertEquals(res.error, 0)
+    res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["configurationNamingContext"])
     assertEquals(len(res), 1)
-    return res[0].configurationNamingContext
+    return res[0]["configurationNamingContext"][0]
+
 
 def find_schemadn(ldb):
-    res = ldb.search("", "", ldb.SCOPE_BASE, attrs=["schemaNamingContext"])
-    assertEquals(res.error, 0)
+    res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
     assertEquals(len(res), 1)
-    return res[0].schemaNamingContext
+    return res[0]["schemaNamingContext"][0]
 
 if not "://" in host:
     host = "ldap://%s" % host
 
-ldb = Ldb(host, credentials=creds, session_info=system_session(), 
-          lp=lp)
+ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
 base_dn = find_basedn(ldb)
-
 configuration_dn = find_configurationdn(ldb)
 schema_dn = find_schemadn(ldb)
 
diff --git a/source4/lib/ldb/tools/ldbsearch.c b/source4/lib/ldb/tools/ldbsearch.c
index c33cba1d77..24ceb30963 100644
--- a/source4/lib/ldb/tools/ldbsearch.c
+++ b/source4/lib/ldb/tools/ldbsearch.c
@@ -61,6 +61,7 @@ struct search_context {
 	int sort;
 	int num_stored;
 	struct ldb_message **store;
+	int refs_stored;
 	char **refs_store;
 
 	int entries;
@@ -87,15 +88,15 @@ static int store_message(struct ldb_message *msg, struct search_context *sctx) {
 
 static int store_referral(char *referral, struct search_context *sctx) {
 
-	sctx->refs_store = talloc_realloc(sctx, sctx->refs_store, char *, sctx->refs + 2);
+	sctx->refs_store = talloc_realloc(sctx, sctx->refs_store, char *, sctx->refs_stored + 2);
 	if (!sctx->refs_store) {
 		fprintf(stderr, "talloc_realloc failed while storing referrals\n");
 		return -1;
 	}
 
-	sctx->refs_store[sctx->refs] = talloc_move(sctx->refs_store, &referral);
-	sctx->refs++;
-	sctx->refs_store[sctx->refs] = NULL;
+	sctx->refs_store[sctx->refs_stored] = talloc_move(sctx->refs_store, &referral);
+	sctx->refs_stored++;
+	sctx->refs_store[sctx->refs_stored] = NULL;
 
 	return 0;
 }
@@ -199,6 +200,7 @@ static int do_search(struct ldb_context *ldb,
 
 	sctx->sort = options->sorted;
 	sctx->num_stored = 0;
+	sctx->refs_stored = 0;
 	sctx->store = NULL;
 	sctx->req_ctrls = ldb_parse_control_strings(ldb, sctx, (const char **)options->controls);
 	if (options->controls != NULL &&  sctx->req_ctrls== NULL) {
@@ -241,22 +243,18 @@ again:
 	if (sctx->pending)
 		goto again;
 
-	if (sctx->sort && sctx->num_stored != 0) {
+	if (sctx->sort && (sctx->num_stored != 0 || sctx->refs != 0)) {
 		int i;
 
-		ldb_qsort(sctx->store, ret, sizeof(struct ldb_message *),
-			  ldb, (ldb_qsort_cmp_fn_t)do_compare_msg);
-
-		if (ret != 0) {
-			fprintf(stderr, "An error occurred while sorting messages\n");
-			exit(1);
+		if (sctx->num_stored) {
+			ldb_qsort(sctx->store, sctx->num_stored, sizeof(struct ldb_message *),
+				  ldb, (ldb_qsort_cmp_fn_t)do_compare_msg);
 		}
-
 		for (i = 0; i < sctx->num_stored; i++) {
 			display_message(ldb, sctx->store[i], sctx);
 		}
 
-		for (i = 0; i < sctx->refs; i++) {
+		for (i = 0; i < sctx->refs_stored; i++) {
 			display_referral(sctx->refs_store[i], sctx);
 		}
 	}
diff --git a/source4/lib/nss_wrapper/config.mk b/source4/lib/nss_wrapper/config.mk
index 9751d2bf73..b46f7c3ee7 100644
--- a/source4/lib/nss_wrapper/config.mk
+++ b/source4/lib/nss_wrapper/config.mk
@@ -1,9 +1,6 @@
 ##############################
 # Start SUBSYSTEM NSS_WRAPPER
-[LIBRARY::NSS_WRAPPER]
-VERSION = 0.0.1
-SO_VERSION = 0
-DESCRIPTION = Wrapper library for testing nss calls without being root
+[SUBSYSTEM::NSS_WRAPPER]
 PUBLIC_HEADERS = nss_wrapper.h
 OBJ_FILES = nss_wrapper.o
 # End SUBSYSTEM NSS_WRAPPER
diff --git a/source4/lib/policy/config.mk b/source4/lib/policy/config.mk
index f404d58377..aae98b86b2 100644
--- a/source4/lib/policy/config.mk
+++ b/source4/lib/policy/config.mk
@@ -1,4 +1,4 @@
-[LIBRARY::LIBPOLICY]
+[SUBSYSTEM::LIBPOLICY]
 CFLAGS = -Iheimdal/lib/roken
 OBJ_FILES = lex.o parse_adm.o 
 PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL LIBSAMBA-CONFIG LIBTALLOC CHARSET 
diff --git a/source4/lib/registry/dir.c b/source4/lib/registry/dir.c
index a13e3753b7..27cae8c490 100644
--- a/source4/lib/registry/dir.c
+++ b/source4/lib/registry/dir.c
@@ -64,7 +64,7 @@ static WERROR reg_dir_del_key(const struct hive_key *k, const char *name)
 	if (rmdir(child) == 0)
 		ret = WERR_OK;
 	else if (errno == ENOENT)
-		ret = WERR_NOT_FOUND;
+		ret = WERR_BADFILE;
 	else
 		ret = WERR_GENERAL_FAILURE;
 
@@ -282,7 +282,7 @@ static WERROR reg_dir_get_value(TALLOC_CTX *mem_ctx,
 	contents = file_load(path, &size, mem_ctx);
 	talloc_free(path);
 	if (contents == NULL)
-		return WERR_NOT_FOUND;
+		return WERR_BADFILE;
 
 	if (type != NULL)
 		*type = 4; /* FIXME */
@@ -339,7 +339,7 @@ static WERROR reg_dir_del_value (struct hive_key *key, const char *name)
 	if (unlink(path) < 0) {
 		talloc_free(path);
 		if (errno == ENOENT)
-			return WERR_NOT_FOUND;
+			return WERR_BADFILE;
 		return WERR_GENERAL_FAILURE;
 	}
 	talloc_free(path);
diff --git a/source4/lib/registry/hive.c b/source4/lib/registry/hive.c
index bbe510772c..5d56a30b3e 100644
--- a/source4/lib/registry/hive.c
+++ b/source4/lib/registry/hive.c
@@ -41,7 +41,7 @@ _PUBLIC_ WERROR reg_open_hive(TALLOC_CTX *parent_ctx, const char *location,
 	fd = open(location, O_RDWR);
 	if (fd == -1) {
 		if (errno == ENOENT)
-			return WERR_NOT_FOUND;
+			return WERR_BADFILE;
 		return WERR_BADFILE;
 	}
 
diff --git a/source4/lib/registry/ldb.c b/source4/lib/registry/ldb.c
index 259315cc39..262859f64b 100644
--- a/source4/lib/registry/ldb.c
+++ b/source4/lib/registry/ldb.c
@@ -111,6 +111,15 @@ static struct ldb_message *reg_ldb_pack_value(struct ldb_context *ctx,
 	return msg;
 }
 
+static char *reg_ldb_escape(TALLOC_CTX *mem_ctx, const char *value)
+{
+	struct ldb_val val;
+
+	val.data = discard_const_p(uint8_t, value);
+	val.length = strlen(value);
+
+	return ldb_dn_escape_value(mem_ctx, val);
+}
 
 static int reg_close_ldb_key(struct ldb_key_data *key)
 {
@@ -159,7 +168,13 @@ static struct ldb_dn *reg_path_to_ldb(TALLOC_CTX *mem_ctx,
 		else keyname = mypath;
 
 		if(strlen(keyname)) {
-			ldb_dn_add_base_fmt(ret, "key=%s", keyname);
+			if (!ldb_dn_add_base_fmt(ret, "key=%s",
+						 reg_ldb_escape(local_ctx,
+								keyname)))
+			{
+				talloc_free(local_ctx);
+				return NULL;
+			}
 		}
 
 		if(begin) {
@@ -293,7 +308,7 @@ static WERROR ldb_get_value(TALLOC_CTX *mem_ctx, struct hive_key *k,
 	}
 
 	if (res->count == 0)
-		return WERR_NOT_FOUND;
+		return WERR_BADFILE;
 
 	reg_ldb_unpack_value(mem_ctx, res->msgs[0], NULL, data_type, data);
 
@@ -322,7 +337,7 @@ static WERROR ldb_open_key(TALLOC_CTX *mem_ctx, const struct hive_key *h,
 		DEBUG(3, ("Key '%s' not found\n",
 			ldb_dn_get_linearized(ldap_path)));
 		talloc_free(res);
-		return WERR_NOT_FOUND;
+		return WERR_BADFILE;
 	}
 
 	newkd = talloc_zero(mem_ctx, struct ldb_key_data);
@@ -385,7 +400,7 @@ static WERROR ldb_add_key(TALLOC_CTX *mem_ctx, const struct hive_key *parent,
 			  struct security_descriptor *sd,
 			  struct hive_key **newkey)
 {
-	const struct ldb_key_data *parentkd = (const struct ldb_key_data *)parent;
+	struct ldb_key_data *parentkd = (const struct ldb_key_data *)parent;
 	struct ldb_message *msg;
 	struct ldb_key_data *newkd;
 	int ret;
@@ -400,8 +415,12 @@ static WERROR ldb_add_key(TALLOC_CTX *mem_ctx, const struct hive_key *parent,
 				   talloc_strdup(mem_ctx, classname));
 
 	ret = ldb_add(parentkd->ldb, msg);
-	if (ret < 0) {
-		DEBUG(1, ("ldb_msg_add: %s\n", ldb_errstring(parentkd->ldb)));
+	if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
+		return WERR_ALREADY_EXISTS;
+	}
+
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("ldb_add: %s\n", ldb_errstring(parentkd->ldb)));
 		return WERR_FOOBAR;
 	}
 
@@ -414,29 +433,37 @@ static WERROR ldb_add_key(TALLOC_CTX *mem_ctx, const struct hive_key *parent,
 
 	*newkey = (struct hive_key *)newkd;
 
+	/* reset cache */
+	talloc_free(parentkd->subkeys);
+	parentkd->subkeys = NULL;
+
 	return WERR_OK;
 }
 
-static WERROR ldb_del_key(const struct hive_key *key, const char *child)
+static WERROR ldb_del_key(const struct hive_key *key, const char *name)
 {
 	int ret;
 	struct ldb_key_data *parentkd = talloc_get_type(key, struct ldb_key_data);
-	struct ldb_dn *childdn;
+	struct ldb_dn *ldap_path;
+	TALLOC_CTX *mem_ctx = talloc_init("ldb_del_key");
 
-	childdn = ldb_dn_copy(parentkd->ldb, parentkd->dn);
-	ldb_dn_add_child_fmt(childdn, "key=%s", child);
+	ldap_path = reg_path_to_ldb(mem_ctx, key, name, NULL);
 
-	ret = ldb_delete(parentkd->ldb, childdn);
+	ret = ldb_delete(parentkd->ldb, ldap_path);
 
-	talloc_free(childdn);
+	talloc_free(mem_ctx);
 
 	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
-		return WERR_NOT_FOUND;
-	} else if (ret < 0) {
+		return WERR_BADFILE;
+	} else if (ret != LDB_SUCCESS) {
 		DEBUG(1, ("ldb_del_key: %s\n", ldb_errstring(parentkd->ldb)));
 		return WERR_FOOBAR;
 	}
 
+	/* reset cache */
+	talloc_free(parentkd->subkeys);
+	parentkd->subkeys = NULL;
+
 	return WERR_OK;
 }
 
@@ -447,19 +474,28 @@ static WERROR ldb_del_value (struct hive_key *key, const char *child)
 	struct ldb_dn *childdn;
 
 	childdn = ldb_dn_copy(kd->ldb, kd->dn);
-	ldb_dn_add_child_fmt(childdn, "value=%s", child);
+	if (!ldb_dn_add_child_fmt(childdn, "value=%s",
+				  reg_ldb_escape(childdn, child)))
+	{
+		talloc_free(childdn);
+		return WERR_FOOBAR;
+	}
 
 	ret = ldb_delete(kd->ldb, childdn);
 
 	talloc_free(childdn);
 
 	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
-		return WERR_NOT_FOUND;
-	} else if (ret < 0) {
+		return WERR_BADFILE;
+	} else if (ret != LDB_SUCCESS) {
 		DEBUG(1, ("ldb_del_value: %s\n", ldb_errstring(kd->ldb)));
 		return WERR_FOOBAR;
 	}
 
+	/* reset cache */
+	talloc_free(kd->values);
+	kd->values = NULL;
+
 	return WERR_OK;
 }
 
@@ -475,18 +511,32 @@ static WERROR ldb_set_value(struct hive_key *parent,
 	msg = reg_ldb_pack_value(kd->ldb, mem_ctx, name, type, data);
 
 	msg->dn = ldb_dn_copy(msg, kd->dn);
-	ldb_dn_add_child_fmt(msg->dn, "value=%s", name);
+	if (!ldb_dn_add_child_fmt(msg->dn, "value=%s",
+				  reg_ldb_escape(mem_ctx, name)))
+	{
+		talloc_free(mem_ctx);
+		return WERR_FOOBAR;
+	}
 
 	ret = ldb_add(kd->ldb, msg);
-	if (ret < 0) {
-		ret = ldb_modify(kd->ldb, msg);
-		if (ret < 0) {
-			DEBUG(1, ("ldb_msg_add: %s\n", ldb_errstring(kd->ldb)));
-			talloc_free(mem_ctx);
-			return WERR_FOOBAR;
+	if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
+		int i;
+		for (i = 0; i < msg->num_elements; i++) {
+			msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
 		}
+		ret = ldb_modify(kd->ldb, msg);
+	}
+
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("ldb_msg_add: %s\n", ldb_errstring(kd->ldb)));
+		talloc_free(mem_ctx);
+		return WERR_FOOBAR;
 	}
 
+	/* reset cache */
+	talloc_free(kd->values);
+	kd->values = NULL;
+
 	talloc_free(mem_ctx);
 	return WERR_OK;
 }
@@ -503,17 +553,23 @@ static WERROR ldb_get_key_info(TALLOC_CTX *mem_ctx,
 {
 	struct ldb_key_data *kd = talloc_get_type(key, struct ldb_key_data);
 
+	if (kd->subkeys == NULL) {
+		W_ERROR_NOT_OK_RETURN(cache_subkeys(kd));
+	}
+
+	if (kd->values == NULL) {
+		W_ERROR_NOT_OK_RETURN(cache_values(kd));
+	}
+
 	/* FIXME */
 	if (classname != NULL)
 		*classname = NULL;
 
 	if (num_subkeys != NULL) {
-		W_ERROR_NOT_OK_RETURN(cache_subkeys(kd));
 		*num_subkeys = kd->subkey_count;
 	}
 
 	if (num_values != NULL) {
-		W_ERROR_NOT_OK_RETURN(cache_values(kd));
 		*num_values = kd->value_count;
 	}
 
@@ -523,7 +579,6 @@ static WERROR ldb_get_key_info(TALLOC_CTX *mem_ctx,
 	if (max_subkeynamelen != NULL) {
 		int i;
 		struct ldb_message_element *el;
-		W_ERROR_NOT_OK_RETURN(cache_subkeys(kd));
 
 		*max_subkeynamelen = 0;
 
diff --git a/source4/lib/registry/local.c b/source4/lib/registry/local.c
index fa59f25596..3e463100c9 100644
--- a/source4/lib/registry/local.c
+++ b/source4/lib/registry/local.c
@@ -140,7 +140,7 @@ WERROR local_get_predefined_key(struct registry_context *ctx,
 	}
 
 	if (mp == NULL)
-		return WERR_NOT_FOUND;
+		return WERR_BADFILE;
 
 	*key = reg_import_hive_key(ctx, mp->key,
 				   mp->path.predefined_key,
diff --git a/source4/lib/registry/patchfile.c b/source4/lib/registry/patchfile.c
index b6ad7dfb10..fa1367bbd2 100644
--- a/source4/lib/registry/patchfile.c
+++ b/source4/lib/registry/patchfile.c
@@ -82,11 +82,11 @@ WERROR reg_generate_diff_key(struct registry_key *oldkey,
 			if (W_ERROR_IS_OK(error2))
 				continue;
 		} else {
-			error2 = WERR_DEST_NOT_FOUND;
+			error2 = WERR_BADFILE;
 			t2 = NULL;
 		}
 
-		if (!W_ERROR_EQUAL(error2, WERR_DEST_NOT_FOUND)) {
+		if (!W_ERROR_EQUAL(error2, WERR_BADFILE)) {
 			DEBUG(0, ("Error occured while getting subkey by name: %s\n",
 				win_errstr(error2)));
 			talloc_free(mem_ctx);
@@ -132,10 +132,10 @@ WERROR reg_generate_diff_key(struct registry_key *oldkey,
 				continue;
 		} else {
 			t1 = NULL;
-			error2 = WERR_DEST_NOT_FOUND;
+			error2 = WERR_BADFILE;
 		}
 
-		if (!W_ERROR_EQUAL(error2, WERR_DEST_NOT_FOUND)) {
+		if (!W_ERROR_EQUAL(error2, WERR_BADFILE)) {
 			DEBUG(0, ("Error occured while getting subkey by name: %s\n",
 				win_errstr(error2)));
 			talloc_free(mem_ctx);
@@ -174,10 +174,10 @@ WERROR reg_generate_diff_key(struct registry_key *oldkey,
 							   name, &type2,
 							   &contents2);
 		} else
-			error2 = WERR_DEST_NOT_FOUND;
+			error2 = WERR_BADFILE;
 
 		if(!W_ERROR_IS_OK(error2) &&
-		   !W_ERROR_EQUAL(error2, WERR_DEST_NOT_FOUND)) {
+		   !W_ERROR_EQUAL(error2, WERR_BADFILE)) {
 			DEBUG(0, ("Error occured while getting value by name: %s\n",
 				win_errstr(error2)));
 			talloc_free(mem_ctx);
@@ -210,7 +210,7 @@ WERROR reg_generate_diff_key(struct registry_key *oldkey,
 		if (W_ERROR_IS_OK(error2))
 			continue;
 
-		if (!W_ERROR_EQUAL(error2, WERR_DEST_NOT_FOUND)) {
+		if (!W_ERROR_EQUAL(error2, WERR_BADFILE)) {
 			DEBUG(0, ("Error occured while getting value by name: %s\n",
 				win_errstr(error2)));
 			return error2;
@@ -238,14 +238,14 @@ _PUBLIC_ WERROR reg_generate_diff(struct registry_context *ctx1,
 		struct registry_key *r1 = NULL, *r2 = NULL;
 		error = reg_get_predefined_key(ctx1, i, &r1);
 		if (!W_ERROR_IS_OK(error) &&
-		    !W_ERROR_EQUAL(error, WERR_NOT_FOUND)) {
+		    !W_ERROR_EQUAL(error, WERR_BADFILE)) {
 			DEBUG(0, ("Unable to open hive %s for backend 1\n",
 				reg_get_predef_name(i)));
 		}
 
 		error = reg_get_predefined_key(ctx2, i, &r2);
 		if (!W_ERROR_IS_OK(error) &&
-		    !W_ERROR_EQUAL(error, WERR_NOT_FOUND)) {
+		    !W_ERROR_EQUAL(error, WERR_BADFILE)) {
 			DEBUG(0, ("Unable to open hive %s for backend 2\n",
 				reg_get_predef_name(i)));
 		}
@@ -356,7 +356,7 @@ static WERROR reg_diff_apply_set_value(void *_ctx, const char *path,
 	/* Open key */
 	error = reg_open_key_abs(ctx, ctx, path, &tmp);
 
-	if (W_ERROR_EQUAL(error, WERR_DEST_NOT_FOUND)) {
+	if (W_ERROR_EQUAL(error, WERR_BADFILE)) {
 		DEBUG(0, ("Error opening key '%s'\n", path));
 		return error;
 	}
diff --git a/source4/lib/registry/regf.c b/source4/lib/registry/regf.c
index 9b126cc808..15b60745f0 100644
--- a/source4/lib/registry/regf.c
+++ b/source4/lib/registry/regf.c
@@ -575,7 +575,7 @@ static WERROR regf_get_value_by_name(TALLOC_CTX *mem_ctx,
 	}
 
 	if (W_ERROR_EQUAL(error, WERR_NO_MORE_ITEMS))
-		return WERR_NOT_FOUND;
+		return WERR_BADFILE;
 
 	return error;
 }
@@ -870,7 +870,7 @@ static WERROR regf_get_subkey_by_name(TALLOC_CTX *ctx,
 				break;
 		}
 		if (key_off == 0)
-			return WERR_NOT_FOUND;
+			return WERR_BADFILE;
 	} else if (!strncmp((char *)data.data, "lf", 2)) {
 		struct lf_block lf;
 		struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
@@ -905,7 +905,7 @@ static WERROR regf_get_subkey_by_name(TALLOC_CTX *ctx,
 				break;
 		}
 		if (key_off == 0)
-			return WERR_NOT_FOUND;
+			return WERR_BADFILE;
 	} else if (!strncmp((char *)data.data, "lh", 2)) {
 		struct lh_block lh;
 		struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
@@ -942,7 +942,7 @@ static WERROR regf_get_subkey_by_name(TALLOC_CTX *ctx,
 				break;
 		}
 		if (key_off == 0)
-			return WERR_NOT_FOUND;
+			return WERR_BADFILE;
 	} else if (!strncmp((char *)data.data, "ri", 2)) {
 		struct ri_block ri;
 		struct tdr_pull *pull = tdr_pull_init(ctx, private_data->hive->iconv_convenience);
@@ -1022,7 +1022,7 @@ static WERROR regf_get_subkey_by_name(TALLOC_CTX *ctx,
 		}
 		talloc_free(pull);
 		if (!key_off)
-			return WERR_NOT_FOUND;
+			return WERR_BADFILE;
 	} else {
 		DEBUG(0, ("Unknown subkey list type.\n"));
 		return WERR_GENERAL_FAILURE;
@@ -1419,7 +1419,7 @@ static WERROR regf_sl_del_entry(struct regf_data *regf, uint32_t list_offset,
 		}
 		if (!found_offset) {
 			DEBUG(2, ("Subkey not found\n"));
-			return WERR_NOT_FOUND;
+			return WERR_BADFILE;
 		}
 		li.key_count--;
 
@@ -1464,7 +1464,7 @@ static WERROR regf_sl_del_entry(struct regf_data *regf, uint32_t list_offset,
 		}
 		if (!found_offset) {
 			DEBUG(2, ("Subkey not found\n"));
-			return WERR_NOT_FOUND;
+			return WERR_BADFILE;
 		}
 		lf.key_count--;
 
@@ -1510,7 +1510,7 @@ static WERROR regf_sl_del_entry(struct regf_data *regf, uint32_t list_offset,
 		}
 		if (!found_offset) {
 			DEBUG(0, ("Subkey not found\n"));
-			return WERR_NOT_FOUND;
+			return WERR_BADFILE;
 		}
 		lh.key_count--;
 
@@ -1548,7 +1548,7 @@ static WERROR regf_del_value (struct hive_key *key, const char *name)
 	uint32_t i;
 
 	if (nk->values_offset == -1) {
-		return WERR_NOT_FOUND;
+		return WERR_BADFILE;
 	}
 
 	values = hbin_get(regf, nk->values_offset);
@@ -1572,7 +1572,7 @@ static WERROR regf_del_value (struct hive_key *key, const char *name)
 		}
 	}
 	if (!found_offset) {
-		return WERR_NOT_FOUND;
+		return WERR_BADFILE;
 	} else {
 		nk->num_values--;
 		values.length = (nk->num_values)*4;
@@ -1608,14 +1608,14 @@ static WERROR regf_del_key(const struct hive_key *parent, const char *name)
 
 	if (parent_nk->subkeys_offset == -1) {
 		DEBUG(4, ("Subkey list is empty, this key cannot contain subkeys.\n"));
-		return WERR_NOT_FOUND;
+		return WERR_BADFILE;
 	}
 
 	/* Find the key */
 	if (!W_ERROR_IS_OK(regf_get_subkey_by_name(parent_nk, parent, name,
 						   (struct hive_key **)&key))) {
 		DEBUG(2, ("Key '%s' not found\n", name));
-		return WERR_NOT_FOUND;
+		return WERR_BADFILE;
 	}
 
 	if (key->nk->subkeys_offset != -1 ||
diff --git a/source4/lib/registry/samba.c b/source4/lib/registry/samba.c
index 02f3363bab..599385e73c 100644
--- a/source4/lib/registry/samba.c
+++ b/source4/lib/registry/samba.c
@@ -42,7 +42,7 @@ static WERROR mount_samba_hive(struct registry_context *ctx,
 
 	error = reg_open_hive(ctx, location, auth_info, creds, lp_ctx, &hive);
 
-	if (W_ERROR_EQUAL(error, WERR_NOT_FOUND))
+	if (W_ERROR_EQUAL(error, WERR_BADFILE))
 		error = reg_open_ldb_file(ctx, location, auth_info,
 					  creds, lp_ctx, &hive);
 
diff --git a/source4/lib/registry/tests/hive.c b/source4/lib/registry/tests/hive.c
index 22b4785222..4d27e83a74 100644
--- a/source4/lib/registry/tests/hive.c
+++ b/source4/lib/registry/tests/hive.c
@@ -31,7 +31,7 @@ static bool test_del_nonexistant_key(struct torture_context *tctx,
 {
 	const struct hive_key *root = (const struct hive_key *)test_data;
 	WERROR error = hive_key_del(root, "bla");
-	torture_assert_werr_equal(tctx, error, WERR_NOT_FOUND,
+	torture_assert_werr_equal(tctx, error, WERR_BADFILE,
 				  "invalid return code");
 
 	return true;
@@ -134,7 +134,7 @@ static bool test_del_key(struct torture_context *tctx, const void *test_data)
 	torture_assert_werr_ok(tctx, error, "reg_key_del");
 
 	error = hive_key_del(root, "Nested Key");
-	torture_assert_werr_equal(tctx, error, WERR_NOT_FOUND, "reg_key_del");
+	torture_assert_werr_equal(tctx, error, WERR_BADFILE, "reg_key_del");
 
 	return true;
 }
@@ -174,7 +174,7 @@ static bool test_get_value(struct torture_context *tctx, const void *test_data)
 	torture_assert_werr_ok(tctx, error, "hive_key_add_name");
 
 	error = hive_get_value(mem_ctx, subkey, "Answer", &type, &value);
-	torture_assert_werr_equal(tctx, error, WERR_NOT_FOUND,
+	torture_assert_werr_equal(tctx, error, WERR_BADFILE,
 				  "getting missing value");
 
 	error = hive_key_set_value(subkey, "Answer", REG_DWORD,
@@ -215,10 +215,10 @@ static bool test_del_value(struct torture_context *tctx, const void *test_data)
 	torture_assert_werr_ok(tctx, error, "deleting value");
 
 	error = hive_get_value(mem_ctx, subkey, "Answer", &type, &value);
-	torture_assert_werr_equal(tctx, error, WERR_NOT_FOUND, "getting value");
+	torture_assert_werr_equal(tctx, error, WERR_BADFILE, "getting value");
 
 	error = hive_key_del_value(subkey, "Answer");
-	torture_assert_werr_equal(tctx, error, WERR_NOT_FOUND,
+	torture_assert_werr_equal(tctx, error, WERR_BADFILE,
 				  "deleting value");
 
 	return true;
diff --git a/source4/lib/registry/tests/registry.c b/source4/lib/registry/tests/registry.c
index 75fbe1cbea..7d14b3a412 100644
--- a/source4/lib/registry/tests/registry.c
+++ b/source4/lib/registry/tests/registry.c
@@ -53,7 +53,7 @@ static bool test_get_predefined_unknown(struct torture_context *tctx,
 	WERROR error;
 
 	error = reg_get_predefined_key(rctx, 1337, &root);
-	torture_assert_werr_equal(tctx, error, WERR_NOT_FOUND,
+	torture_assert_werr_equal(tctx, error, WERR_BADFILE,
 				  "getting predefined key failed");
 	return true;
 }
@@ -195,16 +195,16 @@ static bool test_del_key(struct torture_context *tctx, void *_data)
 	torture_assert_werr_ok(tctx, error,
 			       "getting predefined key failed");
 
-	error = reg_key_add_name(rctx, root, "Hamburg", NULL, NULL, &newkey);
+	error = reg_key_add_name(rctx, root, "Polen", NULL, NULL, &newkey);
 
 	torture_assert_werr_ok(tctx, error, "Creating key return code");
 	torture_assert(tctx, newkey != NULL, "Creating new key");
 
-	error = reg_key_del(root, "Hamburg");
+	error = reg_key_del(root, "Polen");
 	torture_assert_werr_ok(tctx, error, "Delete key");
 
-	error = reg_key_del(root, "Hamburg");
-	torture_assert_werr_equal(tctx, error, WERR_NOT_FOUND,
+	error = reg_key_del(root, "Polen");
+	torture_assert_werr_equal(tctx, error, WERR_BADFILE,
 				  "Delete missing key");
 
 	return true;
@@ -239,7 +239,7 @@ static bool test_flush_key(struct torture_context *tctx, void *_data)
 	struct registry_key *root, *subkey;
 	WERROR error;
 
-	if (!create_test_key(tctx, rctx, "Munchen", &root, &subkey))
+	if (!create_test_key(tctx, rctx, "Bremen", &root, &subkey))
 		return false;
 
 	error = reg_key_flush(subkey);
@@ -416,7 +416,7 @@ static bool test_get_value(struct torture_context *tctx, void *_data)
 
 	error = reg_key_get_value_by_name(tctx, subkey, __FUNCTION__, &type,
 					  &data);
-	torture_assert_werr_equal(tctx, error, WERR_NOT_FOUND,
+	torture_assert_werr_equal(tctx, error, WERR_BADFILE,
 				  "getting missing value");
 
 	error = reg_val_set(subkey, __FUNCTION__, REG_DWORD,
@@ -447,12 +447,12 @@ static bool test_del_value(struct torture_context *tctx, void *_data)
 	uint32_t value = 42;
 	uint32_t type;
 
-	if (!create_test_key(tctx, rctx, "Duisburg", &root, &subkey))
+	if (!create_test_key(tctx, rctx, "Warschau", &root, &subkey))
 		return false;
 
 	error = reg_key_get_value_by_name(tctx, subkey, __FUNCTION__, &type,
 					  &data);
-	torture_assert_werr_equal(tctx, error, WERR_NOT_FOUND,
+	torture_assert_werr_equal(tctx, error, WERR_BADFILE,
 				  "getting missing value");
 
 	error = reg_val_set(subkey, __FUNCTION__, REG_DWORD,
@@ -464,7 +464,7 @@ static bool test_del_value(struct torture_context *tctx, void *_data)
 
 	error = reg_key_get_value_by_name(tctx, subkey, __FUNCTION__,
 					  &type, &data);
-	torture_assert_werr_equal(tctx, error, WERR_NOT_FOUND,
+	torture_assert_werr_equal(tctx, error, WERR_BADFILE,
 				  "getting missing value");
 
 	return true;
diff --git a/source4/lib/replace/getpass.m4 b/source4/lib/replace/getpass.m4
index 17dfdf7bf5..c4da9aae59 100644
--- a/source4/lib/replace/getpass.m4
+++ b/source4/lib/replace/getpass.m4
@@ -1,3 +1,11 @@
+AC_CHECK_FUNC(getpass, samba_cv_HAVE_GETPASS=yes)
+AC_CHECK_FUNC(getpassphrase, samba_cv_HAVE_GETPASSPHRASE=yes)
+if test x"$samba_cv_HAVE_GETPASS" = x"yes" -a x"$samba_cv_HAVE_GETPASSPHRASE" = x"yes"; then
+        AC_DEFINE(REPLACE_GETPASS_BY_GETPASSPHRASE, 1, [getpass returns <9 chars where getpassphrase returns <265 chars])
+	AC_DEFINE(REPLACE_GETPASS,1,[Whether getpass should be replaced])
+	LIBREPLACEOBJ="${LIBREPLACEOBJ} getpass.o"
+else
+
 AC_CACHE_CHECK([whether getpass should be replaced],samba_cv_REPLACE_GETPASS,[
 SAVE_CPPFLAGS="$CPPFLAGS"
 CPPFLAGS="$CPPFLAGS -I$libreplacedir/"
@@ -12,3 +20,5 @@ if test x"$samba_cv_REPLACE_GETPASS" = x"yes"; then
 	AC_DEFINE(REPLACE_GETPASS,1,[Whether getpass should be replaced])
 	LIBREPLACEOBJ="${LIBREPLACEOBJ} getpass.o"
 fi
+
+fi
diff --git a/source4/lib/replace/libreplace.m4 b/source4/lib/replace/libreplace.m4
index a577285639..6d1d6b8afc 100644
--- a/source4/lib/replace/libreplace.m4
+++ b/source4/lib/replace/libreplace.m4
@@ -100,6 +100,7 @@ AC_CHECK_HEADERS(sys/socket.h netinet/in.h netdb.h arpa/inet.h)
 AC_CHECK_HEADERS(netinet/ip.h netinet/tcp.h netinet/in_systm.h netinet/in_ip.h)
 AC_CHECK_HEADERS(sys/sockio.h sys/un.h)
 AC_CHECK_HEADERS(sys/mount.h mntent.h)
+AC_CHECK_HEADERS(stropts.h)
 
 dnl we need to check that net/if.h really can be used, to cope with hpux
 dnl where including it always fails
diff --git a/source4/lib/replace/libreplace_ld.m4 b/source4/lib/replace/libreplace_ld.m4
index cb8e21434e..2aec698967 100644
--- a/source4/lib/replace/libreplace_ld.m4
+++ b/source4/lib/replace/libreplace_ld.m4
@@ -265,7 +265,7 @@ AC_DEFUN([AC_LIBREPLACE_LD_SHLIB_ALLOW_UNDEF_FLAG],
 			LD_SHLIB_ALLOW_UNDEF_FLAG="-Wl,--allow-shlib-undefined"
 			;;
 		*osf*)
-			LD_SHLIB_ALLOW_UNDEF_FLAG="-expect_unresolved '*'"
+			LD_SHLIB_ALLOW_UNDEF_FLAG="-Wl,-expect_unresolved,\"*\""
 			;;
 		*darwin*)
 			LD_SHLIB_ALLOW_UNDEF_FLAG="-undefined dynamic_lookup"
diff --git a/source4/lib/replace/replace.c b/source4/lib/replace/replace.c
index cec158be31..b2a240e8ab 100644
--- a/source4/lib/replace/replace.c
+++ b/source4/lib/replace/replace.c
@@ -218,7 +218,7 @@ long nap(long milliseconds) {
 #ifndef HAVE_MEMMOVE
 /*******************************************************************
 safely copies memory, ensuring no overlap problems.
-this is only used if the machine does not have it's own memmove().
+this is only used if the machine does not have its own memmove().
 this is not the fastest algorithm in town, but it will do for our
 needs.
 ********************************************************************/
diff --git a/source4/lib/replace/replace.h b/source4/lib/replace/replace.h
index f8a89a7213..3f91544e97 100644
--- a/source4/lib/replace/replace.h
+++ b/source4/lib/replace/replace.h
@@ -546,4 +546,12 @@ typedef int bool;
 #define QSORT_CAST (int (*)(const void *, const void *))
 #endif
 
+#ifndef PATH_MAX
+#define PATH_MAX 1024
+#endif
+
+#ifndef MAX_DNS_NAME_LENGTH
+#define MAX_DNS_NAME_LENGTH 256 /* Actually 255 but +1 for terminating null. */
+#endif
+
 #endif /* _LIBREPLACE_REPLACE_H */
diff --git a/source4/lib/replace/system/config.m4 b/source4/lib/replace/system/config.m4
index 799187af7d..1c05733126 100644
--- a/source4/lib/replace/system/config.m4
+++ b/source4/lib/replace/system/config.m4
@@ -73,6 +73,18 @@ AC_VERIFY_C_PROTOTYPE([struct passwd *getpwent_r(struct passwd *src, char *buf,
 	#include <unistd.h>
 	#include <pwd.h>
 	])
+AC_VERIFY_C_PROTOTYPE([struct passwd *getpwent_r(struct passwd *src, char *buf, size_t buflen)],
+	[
+	#ifndef HAVE_GETPWENT_R_DECL
+	#error missing getpwent_r prototype
+	#endif
+	return NULL;
+	],[
+	AC_DEFINE(SOLARIS_GETPWENT_R, 1, [getpwent_r irix (similar to solaris) function prototype])
+	],[],[
+	#include <unistd.h>
+	#include <pwd.h>
+	])
 AC_CHECK_FUNCS(getgrnam_r getgrgid_r getgrent_r)
 AC_HAVE_DECL(getgrent_r, [
 	#include <unistd.h>
@@ -91,6 +103,19 @@ AC_VERIFY_C_PROTOTYPE([struct group *getgrent_r(struct group *src, char *buf, in
 	#include <grp.h>
 	])
 
+AC_VERIFY_C_PROTOTYPE([struct group *getgrent_r(struct group *src, char *buf, size_t buflen)],
+	[
+	#ifndef HAVE_GETGRENT_R_DECL
+	#error missing getgrent_r prototype
+	#endif
+	return NULL;
+	],[
+	AC_DEFINE(SOLARIS_GETGRENT_R, 1, [getgrent_r irix (similar to solaris)  function prototype])
+	],[],[
+	#include <unistd.h>
+	#include <grp.h>
+	])
+
 # locale
 AC_CHECK_HEADERS(ctype.h locale.h)
 
diff --git a/source4/lib/replace/system/network.h b/source4/lib/replace/system/network.h
index e2fad5f686..53bef66d48 100644
--- a/source4/lib/replace/system/network.h
+++ b/source4/lib/replace/system/network.h
@@ -79,6 +79,10 @@
 #include <sys/ioctl.h>
 #endif
 
+#ifdef HAVE_STROPTS_H
+#include <stropts.h>
+#endif
+
 #ifdef REPLACE_INET_NTOA
 /* define is in "replace.h" */
 char *rep_inet_ntoa(struct in_addr ip);
diff --git a/source4/lib/replace/system/passwd.h b/source4/lib/replace/system/passwd.h
index 36fca7b4f8..cad3197ccb 100644
--- a/source4/lib/replace/system/passwd.h
+++ b/source4/lib/replace/system/passwd.h
@@ -68,9 +68,13 @@
 #endif
 
 #ifdef REPLACE_GETPASS
+#if defined(REPLACE_GETPASS_BY_GETPASSPHRASE)
+#define getpass(prompt) getpassphrase(prompt)
+#else
 #define getpass(prompt) rep_getpass(prompt)
 char *rep_getpass(const char *prompt);
 #endif
+#endif
 
 #ifndef NGROUPS_MAX
 #define NGROUPS_MAX 32 /* Guess... */
diff --git a/source4/lib/samba3/config.mk b/source4/lib/samba3/config.mk
index 76f1ce5096..705bdd4002 100644
--- a/source4/lib/samba3/config.mk
+++ b/source4/lib/samba3/config.mk
@@ -1,9 +1,6 @@
 ################################################
 # Start SUBSYSTEM LIBSAMBA3
-[LIBRARY::LIBSAMBA3]
-VERSION = 0.0.1
-SO_VERSION = 0
-DESCRIPTION = Library for reading Samba3 data files
+[SUBSYSTEM::LIBSAMBA3]
 PRIVATE_PROTO_HEADER = samba3_proto.h
 PUBLIC_HEADERS = samba3.h
 OBJ_FILES = tdbsam.o policy.o \
diff --git a/source4/lib/socket_wrapper/config.mk b/source4/lib/socket_wrapper/config.mk
index 9e194230dc..4c5cf94348 100644
--- a/source4/lib/socket_wrapper/config.mk
+++ b/source4/lib/socket_wrapper/config.mk
@@ -1,9 +1,6 @@
 ##############################
 # Start SUBSYSTEM SOCKET_WRAPPER
-[LIBRARY::SOCKET_WRAPPER]
-VERSION = 0.0.1
-SO_VERSION = 0
-DESCRIPTION = Wrapper library for testing TCP/IP connections using Unix Sockets
+[SUBSYSTEM::SOCKET_WRAPPER]
 PUBLIC_HEADERS = socket_wrapper.h
 OBJ_FILES = socket_wrapper.o
 PRIVATE_DEPENDENCIES = EXT_SOCKET
diff --git a/source4/lib/tdb/common/freelist.c b/source4/lib/tdb/common/freelist.c
index b109643f23..2f2a4c379b 100644
--- a/source4/lib/tdb/common/freelist.c
+++ b/source4/lib/tdb/common/freelist.c
@@ -27,6 +27,12 @@
 
 #include "tdb_private.h"
 
+/* 'right' merges can involve O(n^2) cost when combined with a
+   traverse, so they are disabled until we find a way to do them in 
+   O(1) time
+*/
+#define USE_RIGHT_MERGES 0
+
 /* read a freelist record and check for simple errors */
 int tdb_rec_free_read(struct tdb_context *tdb, tdb_off_t off, struct list_struct *rec)
 {
@@ -56,7 +62,7 @@ int tdb_rec_free_read(struct tdb_context *tdb, tdb_off_t off, struct list_struct
 }
 
 
-
+#if USE_RIGHT_MERGES
 /* Remove an element from the freelist.  Must have alloc lock. */
 static int remove_from_freelist(struct tdb_context *tdb, tdb_off_t off, tdb_off_t next)
 {
@@ -75,6 +81,7 @@ static int remove_from_freelist(struct tdb_context *tdb, tdb_off_t off, tdb_off_
 	TDB_LOG((tdb, TDB_DEBUG_FATAL,"remove_from_freelist: not on list at off=%d\n", off));
 	return TDB_ERRCODE(TDB_ERR_CORRUPT, -1);
 }
+#endif
 
 
 /* update a record tailer (must hold allocation lock) */
@@ -93,8 +100,6 @@ static int update_tailer(struct tdb_context *tdb, tdb_off_t offset,
    neccessary. */
 int tdb_free(struct tdb_context *tdb, tdb_off_t offset, struct list_struct *rec)
 {
-	tdb_off_t right, left;
-
 	/* Allocation and tailer lock */
 	if (tdb_lock(tdb, -1, F_WRLCK) != 0)
 		return -1;
@@ -105,9 +110,10 @@ int tdb_free(struct tdb_context *tdb, tdb_off_t offset, struct list_struct *rec)
 		goto fail;
 	}
 
+#if USE_RIGHT_MERGES
 	/* Look right first (I'm an Australian, dammit) */
-	right = offset + sizeof(*rec) + rec->rec_len;
-	if (right + sizeof(*rec) <= tdb->map_size) {
+	if (offset + sizeof(*rec) + rec->rec_len + sizeof(*rec) <= tdb->map_size) {
+		tdb_off_t right = offset + sizeof(*rec) + rec->rec_len;
 		struct list_struct r;
 
 		if (tdb->methods->tdb_read(tdb, right, &r, sizeof(r), DOCONV()) == -1) {
@@ -122,13 +128,18 @@ int tdb_free(struct tdb_context *tdb, tdb_off_t offset, struct list_struct *rec)
 				goto left;
 			}
 			rec->rec_len += sizeof(r) + r.rec_len;
+			if (update_tailer(tdb, offset, rec) == -1) {
+				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: update_tailer failed at %u\n", offset));
+				goto fail;
+			}
 		}
 	}
-
 left:
+#endif
+
 	/* Look left */
-	left = offset - sizeof(tdb_off_t);
-	if (left > TDB_DATA_START(tdb->header.hash_size)) {
+	if (offset - sizeof(tdb_off_t) > TDB_DATA_START(tdb->header.hash_size)) {
+		tdb_off_t left = offset - sizeof(tdb_off_t);
 		struct list_struct l;
 		tdb_off_t leftsize;
 		
@@ -145,7 +156,12 @@ left:
 
 		left = offset - leftsize;
 
-		/* Now read in record */
+		if (leftsize > offset ||
+		    left < TDB_DATA_START(tdb->header.hash_size)) {
+			goto update;
+		}
+
+		/* Now read in the left record */
 		if (tdb->methods->tdb_read(tdb, left, &l, sizeof(l), DOCONV()) == -1) {
 			TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: left read failed at %u (%u)\n", left, leftsize));
 			goto update;
@@ -153,21 +169,24 @@ left:
 
 		/* If it's free, expand to include it. */
 		if (l.magic == TDB_FREE_MAGIC) {
-			if (remove_from_freelist(tdb, left, l.next) == -1) {
-				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: left free failed at %u\n", left));
-				goto update;
-			} else {
-				offset = left;
-				rec->rec_len += leftsize;
+			/* we now merge the new record into the left record, rather than the other 
+			   way around. This makes the operation O(1) instead of O(n). This change
+			   prevents traverse from being O(n^2) after a lot of deletes */
+			l.rec_len += sizeof(*rec) + rec->rec_len;
+			if (tdb_rec_write(tdb, left, &l) == -1) {
+				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: update_left failed at %u\n", left));
+				goto fail;
+			}
+			if (update_tailer(tdb, left, &l) == -1) {
+				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: update_tailer failed at %u\n", offset));
+				goto fail;
 			}
+			tdb_unlock(tdb, -1, F_WRLCK);
+			return 0;
 		}
 	}
 
 update:
-	if (update_tailer(tdb, offset, rec) == -1) {
-		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: update_tailer failed at %u\n", offset));
-		goto fail;
-	}
 
 	/* Now, prepend to free list */
 	rec->magic = TDB_FREE_MAGIC;
@@ -189,62 +208,61 @@ update:
 }
 
 
+
 /* 
    the core of tdb_allocate - called when we have decided which
    free list entry to use
+
+   Note that we try to allocate by grabbing data from the end of an existing record,
+   not the beginning. This is so the left merge in a free is more likely to be
+   able to free up the record without fragmentation
  */
-static tdb_off_t tdb_allocate_ofs(struct tdb_context *tdb, tdb_len_t length, tdb_off_t rec_ptr,
-				struct list_struct *rec, tdb_off_t last_ptr)
+static tdb_off_t tdb_allocate_ofs(struct tdb_context *tdb, 
+				  tdb_len_t length, tdb_off_t rec_ptr,
+				  struct list_struct *rec, tdb_off_t last_ptr)
 {
-	struct list_struct newrec;
-	tdb_off_t newrec_ptr;
+#define MIN_REC_SIZE (sizeof(struct list_struct) + sizeof(tdb_off_t) + 8)
 
-	memset(&newrec, '\0', sizeof(newrec));
+	if (rec->rec_len < length + MIN_REC_SIZE) {
+		/* we have to grab the whole record */
 
-	/* found it - now possibly split it up  */
-	if (rec->rec_len > length + MIN_REC_SIZE) {
-		/* Length of left piece */
-		length = TDB_ALIGN(length, TDB_ALIGNMENT);
-		
-		/* Right piece to go on free list */
-		newrec.rec_len = rec->rec_len - (sizeof(*rec) + length);
-		newrec_ptr = rec_ptr + sizeof(*rec) + length;
-		
-		/* And left record is shortened */
-		rec->rec_len = length;
-	} else {
-		newrec_ptr = 0;
+		/* unlink it from the previous record */
+		if (tdb_ofs_write(tdb, last_ptr, &rec->next) == -1) {
+			return 0;
+		}
+
+		/* mark it not free */
+		rec->magic = TDB_MAGIC;
+		if (tdb_rec_write(tdb, rec_ptr, rec) == -1) {
+			return 0;
+		}
+		return rec_ptr;
+	}
+
+	/* we're going to just shorten the existing record */
+	rec->rec_len -= (length + sizeof(*rec));
+	if (tdb_rec_write(tdb, rec_ptr, rec) == -1) {
+		return 0;
 	}
-	
-	/* Remove allocated record from the free list */
-	if (tdb_ofs_write(tdb, last_ptr, &rec->next) == -1) {
+	if (update_tailer(tdb, rec_ptr, rec) == -1) {
 		return 0;
 	}
-	
-	/* Update header: do this before we drop alloc
-	   lock, otherwise tdb_free() might try to
-	   merge with us, thinking we're free.
-	   (Thanks Jeremy Allison). */
+
+	/* and setup the new record */
+	rec_ptr += sizeof(*rec) + rec->rec_len;	
+
+	memset(rec, '\0', sizeof(*rec));
+	rec->rec_len = length;
 	rec->magic = TDB_MAGIC;
+
 	if (tdb_rec_write(tdb, rec_ptr, rec) == -1) {
 		return 0;
 	}
-	
-	/* Did we create new block? */
-	if (newrec_ptr) {
-		/* Update allocated record tailer (we
-		   shortened it). */
-		if (update_tailer(tdb, rec_ptr, rec) == -1) {
-			return 0;
-		}
-		
-		/* Free new record */
-		if (tdb_free(tdb, newrec_ptr, &newrec) == -1) {
-			return 0;
-		}
+
+	if (update_tailer(tdb, rec_ptr, rec) == -1) {
+		return 0;
 	}
-	
-	/* all done - return the new record offset */
+
 	return rec_ptr;
 }
 
@@ -261,12 +279,14 @@ tdb_off_t tdb_allocate(struct tdb_context *tdb, tdb_len_t length, struct list_st
 		tdb_off_t rec_ptr, last_ptr;
 		tdb_len_t rec_len;
 	} bestfit;
+	float multiplier = 1.0;
 
 	if (tdb_lock(tdb, -1, F_WRLCK) == -1)
 		return 0;
 
 	/* Extra bytes required for tailer */
 	length += sizeof(tdb_off_t);
+	length = TDB_ALIGN(length, TDB_ALIGNMENT);
 
  again:
 	last_ptr = FREELIST_TOP;
@@ -295,18 +315,27 @@ tdb_off_t tdb_allocate(struct tdb_context *tdb, tdb_len_t length, struct list_st
 				bestfit.rec_len = rec->rec_len;
 				bestfit.rec_ptr = rec_ptr;
 				bestfit.last_ptr = last_ptr;
-				/* consider a fit to be good enough if
-				   we aren't wasting more than half
-				   the space */
-				if (bestfit.rec_len < 2*length) {
-					break;
-				}
 			}
 		}
 
 		/* move to the next record */
 		last_ptr = rec_ptr;
 		rec_ptr = rec->next;
+
+		/* if we've found a record that is big enough, then
+		   stop searching if its also not too big. The
+		   definition of 'too big' changes as we scan
+		   through */
+		if (bestfit.rec_len > 0 &&
+		    bestfit.rec_len < length * multiplier) {
+			break;
+		}
+		
+		/* this multiplier means we only extremely rarely
+		   search more than 50 or so records. At 50 records we
+		   accept records up to 11 times larger than what we
+		   want */
+		multiplier *= 1.05;
 	}
 
 	if (bestfit.rec_ptr != 0) {
@@ -314,7 +343,8 @@ tdb_off_t tdb_allocate(struct tdb_context *tdb, tdb_len_t length, struct list_st
 			goto fail;
 		}
 
-		newrec_ptr = tdb_allocate_ofs(tdb, length, bestfit.rec_ptr, rec, bestfit.last_ptr);
+		newrec_ptr = tdb_allocate_ofs(tdb, length, bestfit.rec_ptr, 
+					      rec, bestfit.last_ptr);
 		tdb_unlock(tdb, -1, F_WRLCK);
 		return newrec_ptr;
 	}
@@ -328,3 +358,25 @@ tdb_off_t tdb_allocate(struct tdb_context *tdb, tdb_len_t length, struct list_st
 	return 0;
 }
 
+
+
+/* 
+   return the size of the freelist - used to decide if we should repack 
+*/
+int tdb_freelist_size(struct tdb_context *tdb)
+{
+	tdb_off_t ptr;
+	int count=0;
+
+	if (tdb_lock(tdb, -1, F_RDLCK) == -1) {
+		return -1;
+	}
+
+	ptr = FREELIST_TOP;
+	while (tdb_ofs_read(tdb, ptr, &ptr) == 0 && ptr != 0) {
+		count++;
+	}
+
+	tdb_unlock(tdb, -1, F_RDLCK);
+	return count;
+}
diff --git a/source4/lib/tdb/common/io.c b/source4/lib/tdb/common/io.c
index 8ab0768883..172ab69d8c 100644
--- a/source4/lib/tdb/common/io.c
+++ b/source4/lib/tdb/common/io.c
@@ -101,8 +101,8 @@ static int tdb_write(struct tdb_context *tdb, tdb_off_t off,
 					 off+written);
 		}
 		if (written == -1) {
-			/* Ensure ecode is set for log fn. */
-			tdb->ecode = TDB_ERR_IO;
+		/* Ensure ecode is set for log fn. */
+		tdb->ecode = TDB_ERR_IO;
 			TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_write failed at %d "
 				 "len=%d (%s)\n", off, len, strerror(errno)));
 			return TDB_ERRCODE(TDB_ERR_IO, -1);
@@ -111,8 +111,8 @@ static int tdb_write(struct tdb_context *tdb, tdb_off_t off,
 				 "write %d bytes at %d in two attempts\n",
 				 len, off));
 			errno = ENOSPC;
-			return TDB_ERRCODE(TDB_ERR_IO, -1);
-		}
+		return TDB_ERRCODE(TDB_ERR_IO, -1);
+	}
 	}
 	return 0;
 }
@@ -230,7 +230,7 @@ void tdb_mmap(struct tdb_context *tdb)
   says to use for mmap expansion */
 static int tdb_expand_file(struct tdb_context *tdb, tdb_off_t size, tdb_off_t addition)
 {
-	char buf[1024];
+	char buf[8192];
 
 	if (tdb->read_only || tdb->traverse_read) {
 		tdb->ecode = TDB_ERR_RDONLY;
@@ -294,7 +294,7 @@ static int tdb_expand_file(struct tdb_context *tdb, tdb_off_t size, tdb_off_t ad
 int tdb_expand(struct tdb_context *tdb, tdb_off_t size)
 {
 	struct list_struct rec;
-	tdb_off_t offset;
+	tdb_off_t offset, new_size;	
 
 	if (tdb_lock(tdb, -1, F_WRLCK) == -1) {
 		TDB_LOG((tdb, TDB_DEBUG_ERROR, "lock failed in tdb_expand\n"));
@@ -304,9 +304,11 @@ int tdb_expand(struct tdb_context *tdb, tdb_off_t size)
 	/* must know about any previous expansions by another process */
 	tdb->methods->tdb_oob(tdb, tdb->map_size + 1, 1);
 
-	/* always make room for at least 10 more records, and round
-           the database up to a multiple of the page size */
-	size = TDB_ALIGN(tdb->map_size + size*10, tdb->page_size) - tdb->map_size;
+	/* always make room for at least 100 more records, and at
+           least 25% more space. Round the database up to a multiple
+           of the page size */
+	new_size = MAX(tdb->map_size + size*100, tdb->map_size * 1.25);
+	size = TDB_ALIGN(new_size, tdb->page_size) - tdb->map_size;
 
 	if (!(tdb->flags & TDB_INTERNAL))
 		tdb_munmap(tdb);
diff --git a/source4/lib/tdb/common/lock.c b/source4/lib/tdb/common/lock.c
index e3fe888c46..f156c0fa7b 100644
--- a/source4/lib/tdb/common/lock.c
+++ b/source4/lib/tdb/common/lock.c
@@ -505,6 +505,9 @@ int tdb_chainunlock_read(struct tdb_context *tdb, TDB_DATA key)
 /* record lock stops delete underneath */
 int tdb_lock_record(struct tdb_context *tdb, tdb_off_t off)
 {
+	if (tdb->global_lock.count) {
+		return 0;
+	}
 	return off ? tdb->methods->tdb_brlock(tdb, off, F_RDLCK, F_SETLKW, 0, 1) : 0;
 }
 
@@ -537,6 +540,10 @@ int tdb_unlock_record(struct tdb_context *tdb, tdb_off_t off)
 	struct tdb_traverse_lock *i;
 	uint32_t count = 0;
 
+	if (tdb->global_lock.count) {
+		return 0;
+	}
+
 	if (off == 0)
 		return 0;
 	for (i = &tdb->travlocks; i; i = i->next)
diff --git a/source4/lib/tdb/common/open.c b/source4/lib/tdb/common/open.c
index 0bd1c91a5e..b19e4cea29 100644
--- a/source4/lib/tdb/common/open.c
+++ b/source4/lib/tdb/common/open.c
@@ -35,7 +35,7 @@ static struct tdb_context *tdbs = NULL;
 static unsigned int default_tdb_hash(TDB_DATA *key)
 {
 	uint32_t value;	/* Used to compute the hash value.  */
-	uint32_t i;	/* Used to cycle through random values. */
+	uint32_t   i;	/* Used to cycle through random values. */
 
 	/* Set the initial value from the key size. */
 	for (value = 0x238F13AF * key->dsize, i=0; i < key->dsize; i++)
@@ -90,7 +90,7 @@ static int tdb_new_database(struct tdb_context *tdb, int hash_size)
 		size -= written;
 		written = write(tdb->fd, newdb+written, size);
 		if (written == size) {
-			ret = 0;
+		ret = 0;
 		} else if (written >= 0) {
 			/* a second incomplete write - we give up.
 			 * guessing the errno... */
@@ -152,6 +152,7 @@ struct tdb_context *tdb_open_ex(const char *name, int hash_size, int tdb_flags,
 	int rev = 0, locked = 0;
 	unsigned char *vp;
 	uint32_t vertest;
+	unsigned v;
 
 	if (!(tdb = (struct tdb_context *)calloc(1, sizeof *tdb))) {
 		/* Can't log this */
@@ -178,9 +179,7 @@ struct tdb_context *tdb_open_ex(const char *name, int hash_size, int tdb_flags,
 		tdb->page_size = 0x2000;
 	}
 
-	if (open_flags & TDB_VOLATILE) {
-		tdb->max_dead_records = 5;
-	}
+	tdb->max_dead_records = (tdb_flags & TDB_VOLATILE) ? 5 : 0;
 
 	if ((open_flags & O_ACCMODE) == O_WRONLY) {
 		TDB_LOG((tdb, TDB_DEBUG_ERROR, "tdb_open_ex: can't open tdb %s write-only\n",
@@ -215,6 +214,10 @@ struct tdb_context *tdb_open_ex(const char *name, int hash_size, int tdb_flags,
 		goto fail;	/* errno set by open(2) */
 	}
 
+	/* on exec, don't inherit the fd */
+	v = fcntl(tdb->fd, F_GETFD, 0);
+        fcntl(tdb->fd, F_SETFD, v | FD_CLOEXEC);
+
 	/* ensure there is only one process initialising at once */
 	if (tdb->methods->tdb_brlock(tdb, GLOBAL_LOCK, F_WRLCK, F_SETLKW, 0, 1) == -1) {
 		TDB_LOG((tdb, TDB_DEBUG_ERROR, "tdb_open_ex: failed to get global lock on %s: %s\n",
@@ -224,6 +227,7 @@ struct tdb_context *tdb_open_ex(const char *name, int hash_size, int tdb_flags,
 
 	/* we need to zero database if we are the only one with it open */
 	if ((tdb_flags & TDB_CLEAR_IF_FIRST) &&
+	    (!tdb->read_only) &&
 	    (locked = (tdb->methods->tdb_brlock(tdb, ACTIVE_LOCK, F_WRLCK, F_SETLK, 0, 1) == 0))) {
 		open_flags |= O_CREAT;
 		if (ftruncate(tdb->fd, 0) == -1) {
@@ -242,7 +246,7 @@ struct tdb_context *tdb_open_ex(const char *name, int hash_size, int tdb_flags,
 		/* its not a valid database - possibly initialise it */
 		if (!(open_flags & O_CREAT) || tdb_new_database(tdb, hash_size) == -1) {
 			if (errno == 0) {
-				errno = EIO; /* ie bad format or something */
+			errno = EIO; /* ie bad format or something */
 			}
 			goto fail;
 		}
@@ -283,7 +287,6 @@ struct tdb_context *tdb_open_ex(const char *name, int hash_size, int tdb_flags,
 	tdb->map_size = st.st_size;
 	tdb->device = st.st_dev;
 	tdb->inode = st.st_ino;
-	tdb->max_dead_records = 0;
 	tdb_mmap(tdb);
 	if (locked) {
 		if (tdb->methods->tdb_brlock(tdb, ACTIVE_LOCK, F_UNLCK, F_SETLK, 0, 1) == -1) {
diff --git a/source4/lib/tdb/common/tdb.c b/source4/lib/tdb/common/tdb.c
index 0e9d1dbd74..ea5d9ccc60 100644
--- a/source4/lib/tdb/common/tdb.c
+++ b/source4/lib/tdb/common/tdb.c
@@ -102,8 +102,7 @@ static tdb_off_t tdb_find(struct tdb_context *tdb, TDB_DATA key, uint32_t hash,
 }
 
 /* As tdb_find, but if you succeed, keep the lock */
-tdb_off_t tdb_find_lock_hash(struct tdb_context *tdb, TDB_DATA key, 
-							 uint32_t hash, int locktype,
+tdb_off_t tdb_find_lock_hash(struct tdb_context *tdb, TDB_DATA key, uint32_t hash, int locktype,
 			   struct list_struct *rec)
 {
 	uint32_t rec_ptr;
@@ -237,14 +236,15 @@ int tdb_exists(struct tdb_context *tdb, TDB_DATA key)
 }
 
 /* actually delete an entry in the database given the offset */
-int tdb_do_delete(struct tdb_context *tdb, tdb_off_t rec_ptr, struct list_struct*rec)
+int tdb_do_delete(struct tdb_context *tdb, tdb_off_t rec_ptr, struct list_struct *rec)
 {
 	tdb_off_t last_ptr, i;
 	struct list_struct lastrec;
 
 	if (tdb->read_only || tdb->traverse_read) return -1;
 
-	if (tdb_write_lock_record(tdb, rec_ptr) == -1) {
+	if (tdb->traverse_write != 0 || 
+	    tdb_write_lock_record(tdb, rec_ptr) == -1) {
 		/* Someone traversing here: mark it as dead */
 		rec->magic = TDB_DEAD_MAGIC;
 		return tdb_rec_write(tdb, rec_ptr, rec);
@@ -666,6 +666,16 @@ int tdb_get_flags(struct tdb_context *tdb)
 	return tdb->flags;
 }
 
+void tdb_add_flags(struct tdb_context *tdb, unsigned flags)
+{
+	tdb->flags |= flags;
+}
+
+void tdb_remove_flags(struct tdb_context *tdb, unsigned flags)
+{
+	tdb->flags &= ~flags;
+}
+
 
 /*
   enable sequence number handling on an open tdb
@@ -674,3 +684,62 @@ void tdb_enable_seqnum(struct tdb_context *tdb)
 {
 	tdb->flags |= TDB_SEQNUM;
 }
+
+
+/*
+  wipe the entire database, deleting all records. This can be done
+  very fast by using a global lock. The entire data portion of the
+  file becomes a single entry in the freelist.
+ */
+int tdb_wipe_all(struct tdb_context *tdb)
+{
+	int i;
+	tdb_off_t offset = 0;
+	ssize_t data_len;
+
+	if (tdb_lockall(tdb) != 0) {
+		return -1;
+	}
+
+	/* wipe the hashes */
+	for (i=0;i<tdb->header.hash_size;i++) {
+		if (tdb_ofs_write(tdb, TDB_HASH_TOP(i), &offset) == -1) {
+			TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to write hash %d\n", i));
+			goto failed;
+		}
+	}
+
+	/* wipe the freelist */
+	if (tdb_ofs_write(tdb, FREELIST_TOP, &offset) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to write freelist\n"));
+		goto failed;
+	}
+
+	if (tdb_ofs_write(tdb, TDB_RECOVERY_HEAD, &offset) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to write recovery head\n"));
+		goto failed;		
+	}
+
+	/* add all the rest of the file to the freelist */
+	data_len = (tdb->map_size - TDB_DATA_START(tdb->header.hash_size)) - sizeof(struct list_struct);
+	if (data_len > 0) {
+		struct list_struct rec;
+		memset(&rec,'\0',sizeof(rec));
+		rec.rec_len = data_len;
+		if (tdb_free(tdb, TDB_DATA_START(tdb->header.hash_size), &rec) == -1) {
+			TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to add free record\n"));
+			goto failed;
+		}
+	}
+
+	if (tdb_unlockall(tdb) != 0) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to unlock\n"));
+		goto failed;
+	}
+
+	return 0;
+
+failed:
+	tdb_unlockall(tdb);
+	return -1;
+}
diff --git a/source4/lib/tdb/common/tdb_private.h b/source4/lib/tdb/common/tdb_private.h
index 00bd0eb537..ffac89ff0e 100644
--- a/source4/lib/tdb/common/tdb_private.h
+++ b/source4/lib/tdb/common/tdb_private.h
@@ -38,6 +38,10 @@
 typedef uint32_t tdb_len_t;
 typedef uint32_t tdb_off_t;
 
+#ifndef offsetof
+#define offsetof(t,f) ((unsigned int)&((t *)0)->f)
+#endif
+
 #define TDB_MAGIC_FOOD "TDB file\n"
 #define TDB_VERSION (0x26011967 + 6)
 #define TDB_MAGIC (0x26011999U)
@@ -45,7 +49,6 @@ typedef uint32_t tdb_off_t;
 #define TDB_DEAD_MAGIC (0xFEE1DEAD)
 #define TDB_RECOVERY_MAGIC (0xf53bc0e7U)
 #define TDB_ALIGNMENT 4
-#define MIN_REC_SIZE (2*sizeof(struct list_struct) + TDB_ALIGNMENT)
 #define DEFAULT_HASH_SIZE 131
 #define FREELIST_TOP (sizeof(struct tdb_header))
 #define TDB_ALIGN(x,a) (((x) + (a)-1) & ~((a)-1))
@@ -54,7 +57,7 @@ typedef uint32_t tdb_off_t;
 #define TDB_BAD_MAGIC(r) ((r)->magic != TDB_MAGIC && !TDB_DEAD(r))
 #define TDB_HASH_TOP(hash) (FREELIST_TOP + (BUCKET(hash)+1)*sizeof(tdb_off_t))
 #define TDB_HASHTABLE_SIZE(tdb) ((tdb->header.hash_size+1)*sizeof(tdb_off_t))
-#define TDB_DATA_START(hash_size) TDB_HASH_TOP(hash_size-1)
+#define TDB_DATA_START(hash_size) (TDB_HASH_TOP(hash_size-1) + sizeof(tdb_off_t))
 #define TDB_RECOVERY_HEAD offsetof(struct tdb_header, recovery_start)
 #define TDB_SEQNUM_OFS    offsetof(struct tdb_header, sequence_number)
 #define TDB_PAD_BYTE 0x42
@@ -144,6 +147,7 @@ struct tdb_context {
 	tdb_len_t map_size; /* how much space has been mapped */
 	int read_only; /* opened read-only */
 	int traverse_read; /* read-only traversal */
+	int traverse_write; /* read-write traversal */
 	struct tdb_lock_type global_lock;
 	int num_lockrecs;
 	struct tdb_lock_type *lockrecs; /* only real locks, all with count>0 */
@@ -173,6 +177,7 @@ struct tdb_context {
 int tdb_munmap(struct tdb_context *tdb);
 void tdb_mmap(struct tdb_context *tdb);
 int tdb_lock(struct tdb_context *tdb, int list, int ltype);
+int tdb_lock_nonblock(struct tdb_context *tdb, int list, int ltype);
 int tdb_unlock(struct tdb_context *tdb, int list, int ltype);
 int tdb_brlock(struct tdb_context *tdb, tdb_off_t offset, int rw_type, int lck_type, int probe, size_t len);
 int tdb_transaction_lock(struct tdb_context *tdb, int ltype);
diff --git a/source4/lib/tdb/common/transaction.c b/source4/lib/tdb/common/transaction.c
index 7eaacf7a16..c3e7a4e2c0 100644
--- a/source4/lib/tdb/common/transaction.c
+++ b/source4/lib/tdb/common/transaction.c
@@ -87,12 +87,6 @@
 
 */
 
-struct tdb_transaction_el {
-	struct tdb_transaction_el *next, *prev;
-	tdb_off_t offset;
-	tdb_len_t length;
-	unsigned char *data;
-};
 
 /*
   hold the context of any current transaction
@@ -105,12 +99,12 @@ struct tdb_transaction {
 	/* the original io methods - used to do IOs to the real db */
 	const struct tdb_methods *io_methods;
 
-	/* the list of transaction elements. We use a doubly linked
-	   list with a last pointer to allow us to keep the list
-	   ordered, with first element at the front of the list. It
-	   needs to be doubly linked as the read/write traversals need
-	   to be backwards, while the commit needs to be forwards */
-	struct tdb_transaction_el *elements, *elements_last;
+	/* the list of transaction blocks. When a block is first
+	   written to, it gets created in this list */
+	uint8_t **blocks;
+	uint32_t num_blocks;
+	uint32_t block_size;      /* bytes in each block */
+	uint32_t last_block_size; /* number of valid bytes in the last block */
 
 	/* non-zero when an internal transaction error has
 	   occurred. All write operations will then fail until the
@@ -134,52 +128,48 @@ struct tdb_transaction {
 static int transaction_read(struct tdb_context *tdb, tdb_off_t off, void *buf, 
 			    tdb_len_t len, int cv)
 {
-	struct tdb_transaction_el *el;
-
-	/* we need to walk the list backwards to get the most recent data */
-	for (el=tdb->transaction->elements_last;el;el=el->prev) {
-		tdb_len_t partial;
+	uint32_t blk;
 
-		if (off+len <= el->offset) {
-			continue;
-		}
-		if (off >= el->offset + el->length) {
-			continue;
+	/* break it down into block sized ops */
+	while (len + (off % tdb->transaction->block_size) > tdb->transaction->block_size) {
+		tdb_len_t len2 = tdb->transaction->block_size - (off % tdb->transaction->block_size);
+		if (transaction_read(tdb, off, buf, len2, cv) != 0) {
+			return -1;
 		}
+		len -= len2;
+		off += len2;
+		buf = (void *)(len2 + (char *)buf);
+	}
 
-		/* an overlapping read - needs to be split into up to
-		   2 reads and a memcpy */
-		if (off < el->offset) {
-			partial = el->offset - off;
-			if (transaction_read(tdb, off, buf, partial, cv) != 0) {
-				goto fail;
-			}
-			len -= partial;
-			off += partial;
-			buf = (void *)(partial + (char *)buf);
-		}
-		if (off + len <= el->offset + el->length) {
-			partial = len;
-		} else {
-			partial = el->offset + el->length - off;
-		}
-		memcpy(buf, el->data + (off - el->offset), partial);
-		if (cv) {
-			tdb_convert(buf, len);
-		}
-		len -= partial;
-		off += partial;
-		buf = (void *)(partial + (char *)buf);
-		
-		if (len != 0 && transaction_read(tdb, off, buf, len, cv) != 0) {
+	if (len == 0) {
+		return 0;
+	}
+
+	blk = off / tdb->transaction->block_size;
+
+	/* see if we have it in the block list */
+	if (tdb->transaction->num_blocks <= blk ||
+	    tdb->transaction->blocks[blk] == NULL) {
+		/* nope, do a real read */
+		if (tdb->transaction->io_methods->tdb_read(tdb, off, buf, len, cv) != 0) {
 			goto fail;
 		}
-
 		return 0;
 	}
 
-	/* its not in the transaction elements - do a real read */
-	return tdb->transaction->io_methods->tdb_read(tdb, off, buf, len, cv);
+	/* it is in the block list. Now check for the last block */
+	if (blk == tdb->transaction->num_blocks-1) {
+		if (len > tdb->transaction->last_block_size) {
+			goto fail;
+		}
+	}
+	
+	/* now copy it out of this block */
+	memcpy(buf, tdb->transaction->blocks[blk] + (off % tdb->transaction->block_size), len);
+	if (cv) {
+		tdb_convert(buf, len);
+	}
+	return 0;
 
 fail:
 	TDB_LOG((tdb, TDB_DEBUG_FATAL, "transaction_read: failed at off=%d len=%d\n", off, len));
@@ -195,12 +185,8 @@ fail:
 static int transaction_write(struct tdb_context *tdb, tdb_off_t off, 
 			     const void *buf, tdb_len_t len)
 {
-	struct tdb_transaction_el *el, *best_el=NULL;
+	uint32_t blk;
 
-	if (len == 0) {
-		return 0;
-	}
-	
 	/* if the write is to a hash head, then update the transaction
 	   hash heads */
 	if (len == sizeof(tdb_off_t) && off >= FREELIST_TOP &&
@@ -209,110 +195,142 @@ static int transaction_write(struct tdb_context *tdb, tdb_off_t off,
 		memcpy(&tdb->transaction->hash_heads[chain], buf, len);
 	}
 
-	/* first see if we can replace an existing entry */
-	for (el=tdb->transaction->elements_last;el;el=el->prev) {
-		tdb_len_t partial;
-
-		if (best_el == NULL && off == el->offset+el->length) {
-			best_el = el;
-		}
-
-		if (off+len <= el->offset) {
-			continue;
+	/* break it up into block sized chunks */
+	while (len + (off % tdb->transaction->block_size) > tdb->transaction->block_size) {
+		tdb_len_t len2 = tdb->transaction->block_size - (off % tdb->transaction->block_size);
+		if (transaction_write(tdb, off, buf, len2) != 0) {
+			return -1;
 		}
-		if (off >= el->offset + el->length) {
-			continue;
+		len -= len2;
+		off += len2;
+		if (buf != NULL) {
+			buf = (const void *)(len2 + (const char *)buf);
 		}
+	}
 
-		/* an overlapping write - needs to be split into up to
-		   2 writes and a memcpy */
-		if (off < el->offset) {
-			partial = el->offset - off;
-			if (transaction_write(tdb, off, buf, partial) != 0) {
-				goto fail;
-			}
-			len -= partial;
-			off += partial;
-			buf = (const void *)(partial + (const char *)buf);
-		}
-		if (off + len <= el->offset + el->length) {
-			partial = len;
+	if (len == 0) {
+		return 0;
+	}
+
+	blk = off / tdb->transaction->block_size;
+	off = off % tdb->transaction->block_size;
+
+	if (tdb->transaction->num_blocks <= blk) {
+		uint8_t **new_blocks;
+		/* expand the blocks array */
+		if (tdb->transaction->blocks == NULL) {
+			new_blocks = (uint8_t **)malloc(
+				(blk+1)*sizeof(uint8_t *));
 		} else {
-			partial = el->offset + el->length - off;
+			new_blocks = (uint8_t **)realloc(
+				tdb->transaction->blocks,
+				(blk+1)*sizeof(uint8_t *));
 		}
-		memcpy(el->data + (off - el->offset), buf, partial);
-		len -= partial;
-		off += partial;
-		buf = (const void *)(partial + (const char *)buf);
-		
-		if (len != 0 && transaction_write(tdb, off, buf, len) != 0) {
+		if (new_blocks == NULL) {
+			tdb->ecode = TDB_ERR_OOM;
 			goto fail;
 		}
-
-		return 0;
+		memset(&new_blocks[tdb->transaction->num_blocks], 0, 
+		       (1+(blk - tdb->transaction->num_blocks))*sizeof(uint8_t *));
+		tdb->transaction->blocks = new_blocks;
+		tdb->transaction->num_blocks = blk+1;
+		tdb->transaction->last_block_size = 0;
 	}
 
-	/* see if we can append the new entry to an existing entry */
-	if (best_el && best_el->offset + best_el->length == off && 
-	    (off+len < tdb->transaction->old_map_size ||
-	     off > tdb->transaction->old_map_size)) {
-		unsigned char *data = best_el->data;
-		el = best_el;
-		el->data = (unsigned char *)realloc(el->data,
-						    el->length + len);
-		if (el->data == NULL) {
+	/* allocate and fill a block? */
+	if (tdb->transaction->blocks[blk] == NULL) {
+		tdb->transaction->blocks[blk] = (uint8_t *)calloc(tdb->transaction->block_size, 1);
+		if (tdb->transaction->blocks[blk] == NULL) {
 			tdb->ecode = TDB_ERR_OOM;
 			tdb->transaction->transaction_error = 1;
-			el->data = data;
-			return -1;
+			return -1;			
 		}
-		if (buf) {
-			memcpy(el->data + el->length, buf, len);
-		} else {
-			memset(el->data + el->length, TDB_PAD_BYTE, len);
+		if (tdb->transaction->old_map_size > blk * tdb->transaction->block_size) {
+			tdb_len_t len2 = tdb->transaction->block_size;
+			if (len2 + (blk * tdb->transaction->block_size) > tdb->transaction->old_map_size) {
+				len2 = tdb->transaction->old_map_size - (blk * tdb->transaction->block_size);
+			}
+			if (tdb->transaction->io_methods->tdb_read(tdb, blk * tdb->transaction->block_size, 
+								   tdb->transaction->blocks[blk], 
+								   len2, 0) != 0) {
+				SAFE_FREE(tdb->transaction->blocks[blk]);				
+				tdb->ecode = TDB_ERR_IO;
+				goto fail;
+			}
+			if (blk == tdb->transaction->num_blocks-1) {
+				tdb->transaction->last_block_size = len2;
+			}			
 		}
-		el->length += len;
-		return 0;
-	}
-
-	/* add a new entry at the end of the list */
-	el = (struct tdb_transaction_el *)malloc(sizeof(*el));
-	if (el == NULL) {
-		tdb->ecode = TDB_ERR_OOM;
-		tdb->transaction->transaction_error = 1;		
-		return -1;
-	}
-	el->next = NULL;
-	el->prev = tdb->transaction->elements_last;
-	el->offset = off;
-	el->length = len;
-	el->data = (unsigned char *)malloc(len);
-	if (el->data == NULL) {
-		free(el);
-		tdb->ecode = TDB_ERR_OOM;
-		tdb->transaction->transaction_error = 1;		
-		return -1;
 	}
-	if (buf) {
-		memcpy(el->data, buf, len);
+	
+	/* overwrite part of an existing block */
+	if (buf == NULL) {
+		memset(tdb->transaction->blocks[blk] + off, 0, len);
 	} else {
-		memset(el->data, TDB_PAD_BYTE, len);
+		memcpy(tdb->transaction->blocks[blk] + off, buf, len);
 	}
-	if (el->prev) {
-		el->prev->next = el;
-	} else {
-		tdb->transaction->elements = el;
+	if (blk == tdb->transaction->num_blocks-1) {
+		if (len + off > tdb->transaction->last_block_size) {
+			tdb->transaction->last_block_size = len + off;
+		}
 	}
-	tdb->transaction->elements_last = el;
+
 	return 0;
 
 fail:
-	TDB_LOG((tdb, TDB_DEBUG_FATAL, "transaction_write: failed at off=%d len=%d\n", off, len));
-	tdb->ecode = TDB_ERR_IO;
+	TDB_LOG((tdb, TDB_DEBUG_FATAL, "transaction_write: failed at off=%d len=%d\n", 
+		 (blk*tdb->transaction->block_size) + off, len));
 	tdb->transaction->transaction_error = 1;
 	return -1;
 }
 
+
+/*
+  write while in a transaction - this varient never expands the transaction blocks, it only
+  updates existing blocks. This means it cannot change the recovery size
+*/
+static int transaction_write_existing(struct tdb_context *tdb, tdb_off_t off, 
+				      const void *buf, tdb_len_t len)
+{
+	uint32_t blk;
+
+	/* break it up into block sized chunks */
+	while (len + (off % tdb->transaction->block_size) > tdb->transaction->block_size) {
+		tdb_len_t len2 = tdb->transaction->block_size - (off % tdb->transaction->block_size);
+		if (transaction_write_existing(tdb, off, buf, len2) != 0) {
+			return -1;
+		}
+		len -= len2;
+		off += len2;
+		if (buf != NULL) {
+			buf = (const void *)(len2 + (const char *)buf);
+		}
+	}
+
+	if (len == 0) {
+		return 0;
+	}
+
+	blk = off / tdb->transaction->block_size;
+	off = off % tdb->transaction->block_size;
+
+	if (tdb->transaction->num_blocks <= blk ||
+	    tdb->transaction->blocks[blk] == NULL) {
+		return 0;
+	}
+
+	if (blk == tdb->transaction->num_blocks-1 &&
+	    off + len > tdb->transaction->last_block_size) {
+		len = tdb->transaction->last_block_size - off;
+	}
+
+	/* overwrite part of an existing block */
+	memcpy(tdb->transaction->blocks[blk] + off, buf, len);
+
+	return 0;
+}
+
+
 /*
   accelerated hash chain head search, using the cached hash heads
 */
@@ -419,10 +437,14 @@ int tdb_transaction_start(struct tdb_context *tdb)
 		return -1;
 	}
 
+	/* a page at a time seems like a reasonable compromise between compactness and efficiency */
+	tdb->transaction->block_size = tdb->page_size;
+
 	/* get the transaction write lock. This is a blocking lock. As
 	   discussed with Volker, there are a number of ways we could
 	   make this async, which we will probably do in the future */
 	if (tdb_transaction_lock(tdb, F_WRLCK) == -1) {
+		SAFE_FREE(tdb->transaction->blocks);
 		SAFE_FREE(tdb->transaction);
 		return -1;
 	}
@@ -460,21 +482,12 @@ int tdb_transaction_start(struct tdb_context *tdb)
 	tdb->transaction->io_methods = tdb->methods;
 	tdb->methods = &transaction_methods;
 
-	/* by calling this transaction write here, we ensure that we don't grow the
-	   transaction linked list due to hash table updates */
-	if (transaction_write(tdb, FREELIST_TOP, tdb->transaction->hash_heads, 
-			      TDB_HASHTABLE_SIZE(tdb)) != 0) {
-		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_start: failed to prime hash table\n"));
-		tdb->ecode = TDB_ERR_IO;
-		tdb->methods = tdb->transaction->io_methods;
-		goto fail;
-	}
-
 	return 0;
 	
 fail:
 	tdb_brlock(tdb, FREELIST_TOP, F_UNLCK, F_SETLKW, 0, 0);
 	tdb_transaction_unlock(tdb);
+	SAFE_FREE(tdb->transaction->blocks);
 	SAFE_FREE(tdb->transaction->hash_heads);
 	SAFE_FREE(tdb->transaction);
 	return -1;
@@ -486,6 +499,8 @@ fail:
 */
 int tdb_transaction_cancel(struct tdb_context *tdb)
 {	
+	int i;
+
 	if (tdb->transaction == NULL) {
 		TDB_LOG((tdb, TDB_DEBUG_ERROR, "tdb_transaction_cancel: no transaction\n"));
 		return -1;
@@ -499,13 +514,13 @@ int tdb_transaction_cancel(struct tdb_context *tdb)
 
 	tdb->map_size = tdb->transaction->old_map_size;
 
-	/* free all the transaction elements */
-	while (tdb->transaction->elements) {
-		struct tdb_transaction_el *el = tdb->transaction->elements;
-		tdb->transaction->elements = el->next;
-		free(el->data);
-		free(el);
+	/* free all the transaction blocks */
+	for (i=0;i<tdb->transaction->num_blocks;i++) {
+		if (tdb->transaction->blocks[i] != NULL) {
+			free(tdb->transaction->blocks[i]);
+		}
 	}
+	SAFE_FREE(tdb->transaction->blocks);
 
 	/* remove any global lock created during the transaction */
 	if (tdb->global_lock.count != 0) {
@@ -515,7 +530,6 @@ int tdb_transaction_cancel(struct tdb_context *tdb)
 
 	/* remove any locks created during the transaction */
 	if (tdb->num_locks != 0) {
-		int i;
 		for (i=0;i<tdb->num_lockrecs;i++) {
 			tdb_brlock(tdb,FREELIST_TOP+4*tdb->lockrecs[i].list,
 				   F_UNLCK,F_SETLKW, 0, 1);
@@ -567,16 +581,24 @@ static int transaction_sync(struct tdb_context *tdb, tdb_off_t offset, tdb_len_t
 */
 static tdb_len_t tdb_recovery_size(struct tdb_context *tdb)
 {
-	struct tdb_transaction_el *el;
 	tdb_len_t recovery_size = 0;
+	int i;
 
 	recovery_size = sizeof(uint32_t);
-	for (el=tdb->transaction->elements;el;el=el->next) {
-		if (el->offset >= tdb->transaction->old_map_size) {
+	for (i=0;i<tdb->transaction->num_blocks;i++) {
+		if (i * tdb->transaction->block_size >= tdb->transaction->old_map_size) {
+			break;
+		}
+		if (tdb->transaction->blocks[i] == NULL) {
 			continue;
 		}
-		recovery_size += 2*sizeof(tdb_off_t) + el->length;
-	}
+		recovery_size += 2*sizeof(tdb_off_t);
+		if (i == tdb->transaction->num_blocks-1) {
+			recovery_size += tdb->transaction->last_block_size;
+		} else {
+			recovery_size += tdb->transaction->block_size;
+		}
+	}	
 
 	return recovery_size;
 }
@@ -658,6 +680,10 @@ static int tdb_recovery_allocate(struct tdb_context *tdb,
 		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_recovery_allocate: failed to write recovery head\n"));
 		return -1;
 	}
+	if (transaction_write_existing(tdb, TDB_RECOVERY_HEAD, &recovery_head, sizeof(tdb_off_t)) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_recovery_allocate: failed to write recovery head\n"));
+		return -1;
+	}
 
 	return 0;
 }
@@ -669,7 +695,6 @@ static int tdb_recovery_allocate(struct tdb_context *tdb,
 static int transaction_setup_recovery(struct tdb_context *tdb, 
 				      tdb_off_t *magic_offset)
 {
-	struct tdb_transaction_el *el;
 	tdb_len_t recovery_size;
 	unsigned char *data, *p;
 	const struct tdb_methods *methods = tdb->transaction->io_methods;
@@ -677,6 +702,7 @@ static int transaction_setup_recovery(struct tdb_context *tdb,
 	tdb_off_t recovery_offset, recovery_max_size;
 	tdb_off_t old_map_size = tdb->transaction->old_map_size;
 	uint32_t magic, tailer;
+	int i;
 
 	/*
 	  check that the recovery area has enough space
@@ -704,30 +730,43 @@ static int transaction_setup_recovery(struct tdb_context *tdb,
 	/* build the recovery data into a single blob to allow us to do a single
 	   large write, which should be more efficient */
 	p = data + sizeof(*rec);
-	for (el=tdb->transaction->elements;el;el=el->next) {
-		if (el->offset >= old_map_size) {
+	for (i=0;i<tdb->transaction->num_blocks;i++) {
+		tdb_off_t offset;
+		tdb_len_t length;
+
+		if (tdb->transaction->blocks[i] == NULL) {
+			continue;
+		}
+
+		offset = i * tdb->transaction->block_size;
+		length = tdb->transaction->block_size;
+		if (i == tdb->transaction->num_blocks-1) {
+			length = tdb->transaction->last_block_size;
+		}
+		
+		if (offset >= old_map_size) {
 			continue;
 		}
-		if (el->offset + el->length > tdb->transaction->old_map_size) {
+		if (offset + length > tdb->transaction->old_map_size) {
 			TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_setup_recovery: transaction data over new region boundary\n"));
 			free(data);
 			tdb->ecode = TDB_ERR_CORRUPT;
 			return -1;
 		}
-		memcpy(p, &el->offset, 4);
-		memcpy(p+4, &el->length, 4);
+		memcpy(p, &offset, 4);
+		memcpy(p+4, &length, 4);
 		if (DOCONV()) {
 			tdb_convert(p, 8);
 		}
 		/* the recovery area contains the old data, not the
 		   new data, so we have to call the original tdb_read
 		   method to get it */
-		if (methods->tdb_read(tdb, el->offset, p + 8, el->length, 0) != 0) {
+		if (methods->tdb_read(tdb, offset, p + 8, length, 0) != 0) {
 			free(data);
 			tdb->ecode = TDB_ERR_IO;
 			return -1;
 		}
-		p += 8 + el->length;
+		p += 8 + length;
 	}
 
 	/* and the tailer */
@@ -742,6 +781,12 @@ static int transaction_setup_recovery(struct tdb_context *tdb,
 		tdb->ecode = TDB_ERR_IO;
 		return -1;
 	}
+	if (transaction_write_existing(tdb, recovery_offset, data, sizeof(*rec) + recovery_size) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_setup_recovery: failed to write secondary recovery data\n"));
+		free(data);
+		tdb->ecode = TDB_ERR_IO;
+		return -1;
+	}
 
 	/* as we don't have ordered writes, we have to sync the recovery
 	   data before we update the magic to indicate that the recovery
@@ -763,6 +808,11 @@ static int transaction_setup_recovery(struct tdb_context *tdb,
 		tdb->ecode = TDB_ERR_IO;
 		return -1;
 	}
+	if (transaction_write_existing(tdb, *magic_offset, &magic, sizeof(magic)) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_setup_recovery: failed to write secondary recovery magic\n"));
+		tdb->ecode = TDB_ERR_IO;
+		return -1;
+	}
 
 	/* ensure the recovery magic marker is on disk */
 	if (transaction_sync(tdb, *magic_offset, sizeof(magic)) == -1) {
@@ -780,6 +830,7 @@ int tdb_transaction_commit(struct tdb_context *tdb)
 	const struct tdb_methods *methods;
 	tdb_off_t magic_offset = 0;
 	uint32_t zero = 0;
+	int i;
 
 	if (tdb->transaction == NULL) {
 		TDB_LOG((tdb, TDB_DEBUG_ERROR, "tdb_transaction_commit: no transaction\n"));
@@ -793,13 +844,14 @@ int tdb_transaction_commit(struct tdb_context *tdb)
 		return -1;
 	}
 
+
 	if (tdb->transaction->nesting != 0) {
 		tdb->transaction->nesting--;
 		return 0;
 	}		
 
 	/* check for a null transaction */
-	if (tdb->transaction->elements == NULL) {
+	if (tdb->transaction->blocks == NULL) {
 		tdb_transaction_cancel(tdb);
 		return 0;
 	}
@@ -858,10 +910,21 @@ int tdb_transaction_commit(struct tdb_context *tdb)
 	}
 
 	/* perform all the writes */
-	while (tdb->transaction->elements) {
-		struct tdb_transaction_el *el = tdb->transaction->elements;
+	for (i=0;i<tdb->transaction->num_blocks;i++) {
+		tdb_off_t offset;
+		tdb_len_t length;
+
+		if (tdb->transaction->blocks[i] == NULL) {
+			continue;
+		}
 
-		if (methods->tdb_write(tdb, el->offset, el->data, el->length) == -1) {
+		offset = i * tdb->transaction->block_size;
+		length = tdb->transaction->block_size;
+		if (i == tdb->transaction->num_blocks-1) {
+			length = tdb->transaction->last_block_size;
+		}
+
+		if (methods->tdb_write(tdb, offset, tdb->transaction->blocks[i], length) == -1) {
 			TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_commit: write failed during commit\n"));
 			
 			/* we've overwritten part of the data and
@@ -876,11 +939,12 @@ int tdb_transaction_commit(struct tdb_context *tdb)
 			TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_commit: write failed\n"));
 			return -1;
 		}
-		tdb->transaction->elements = el->next;
-		free(el->data); 
-		free(el);
+		SAFE_FREE(tdb->transaction->blocks[i]);
 	} 
 
+	SAFE_FREE(tdb->transaction->blocks);
+	tdb->transaction->num_blocks = 0;
+
 	if (!(tdb->flags & TDB_NOSYNC)) {
 		/* ensure the new data is on disk */
 		if (transaction_sync(tdb, 0, tdb->map_size) == -1) {
@@ -919,6 +983,7 @@ int tdb_transaction_commit(struct tdb_context *tdb)
 	/* use a transaction cancel to free memory and remove the
 	   transaction locks */
 	tdb_transaction_cancel(tdb);
+
 	return 0;
 }
 
diff --git a/source4/lib/tdb/common/traverse.c b/source4/lib/tdb/common/traverse.c
index 6fc576a55a..07b0c23858 100644
--- a/source4/lib/tdb/common/traverse.c
+++ b/source4/lib/tdb/common/traverse.c
@@ -223,6 +223,9 @@ int tdb_traverse_read(struct tdb_context *tdb,
 /*
   a write style traverse - needs to get the transaction lock to
   prevent deadlocks
+
+  WARNING: The data buffer given to the callback fn does NOT meet the
+  alignment restrictions malloc gives you.
 */
 int tdb_traverse(struct tdb_context *tdb, 
 		 tdb_traverse_func fn, void *private_data)
@@ -238,7 +241,9 @@ int tdb_traverse(struct tdb_context *tdb,
 		return -1;
 	}
 
+	tdb->traverse_write++;
 	ret = tdb_traverse_internal(tdb, fn, private_data, &tl);
+	tdb->traverse_write--;
 
 	tdb_transaction_unlock(tdb);
 
@@ -330,3 +335,4 @@ TDB_DATA tdb_nextkey(struct tdb_context *tdb, TDB_DATA oldkey)
 		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_nextkey: WARNING tdb_unlock failed!\n"));
 	return key;
 }
+
diff --git a/source4/lib/tdb/docs/README b/source4/lib/tdb/docs/README
index b31ce36ab1..63fcf5e049 100644
--- a/source4/lib/tdb/docs/README
+++ b/source4/lib/tdb/docs/README
@@ -130,6 +130,9 @@ int tdb_traverse(TDB_CONTEXT *tdb, int (*fn)(TDB_CONTEXT *tdb,
    a non-zero return value from fn() indicates that the traversal
    should stop. Traversal callbacks may not start transactions.
 
+   WARNING: The data buffer given to the callback fn does NOT meet the
+   alignment restrictions malloc gives you.
+
 ----------------------------------------------------------------------
 int tdb_traverse_read(TDB_CONTEXT *tdb, int (*fn)(TDB_CONTEXT *tdb,
                      TDB_DATA key, TDB_DATA dbuf, void *state), void *state);
diff --git a/source4/lib/tdb/include/tdb.h b/source4/lib/tdb/include/tdb.h
index 7de4c419a8..0008085de5 100644
--- a/source4/lib/tdb/include/tdb.h
+++ b/source4/lib/tdb/include/tdb.h
@@ -32,9 +32,9 @@ extern "C" {
 
 
 /* flags to tdb_store() */
-#define TDB_REPLACE 1
-#define TDB_INSERT 2
-#define TDB_MODIFY 3
+#define TDB_REPLACE 1		/* Unused */
+#define TDB_INSERT 2 		/* Don't overwrite an existing entry */
+#define TDB_MODIFY 3		/* Don't create an existing entry    */
 
 /* flags for tdb_open() */
 #define TDB_DEFAULT 0 /* just a readability place holder */
@@ -135,6 +135,8 @@ int tdb_get_seqnum(struct tdb_context *tdb);
 int tdb_hash_size(struct tdb_context *tdb);
 size_t tdb_map_size(struct tdb_context *tdb);
 int tdb_get_flags(struct tdb_context *tdb);
+void tdb_add_flags(struct tdb_context *tdb, unsigned flag);
+void tdb_remove_flags(struct tdb_context *tdb, unsigned flag);
 void tdb_enable_seqnum(struct tdb_context *tdb);
 void tdb_increment_seqnum_nonblock(struct tdb_context *tdb);
 
@@ -153,6 +155,8 @@ void tdb_setalarm_sigptr(struct tdb_context *tdb, volatile sig_atomic_t *sigptr)
 void tdb_dump_all(struct tdb_context *tdb);
 int tdb_printfreelist(struct tdb_context *tdb);
 int tdb_validate_freelist(struct tdb_context *tdb, int *pnum_entries);
+int tdb_wipe_all(struct tdb_context *tdb);
+int tdb_freelist_size(struct tdb_context *tdb);
 
 extern TDB_DATA tdb_null;
 
diff --git a/source4/lib/tdb/python/tdbdump.py b/source4/lib/tdb/python/tdbdump.py
new file mode 100644
index 0000000000..d759d771c8
--- /dev/null
+++ b/source4/lib/tdb/python/tdbdump.py
@@ -0,0 +1,12 @@
+#!/usr/bin/python
+# Trivial reimplementation of tdbdump in Python
+
+import tdb, sys
+
+if len(sys.argv) < 2:
+    print "Usage: tdbdump.py <tdb-file>"
+    sys.exit(1)
+
+db = tdb.Tdb(sys.argv[1])
+for (k, v) in db.iteritems():
+    print "{\nkey(%d) = %r\ndata(%d) = %r\n}" % (len(k), k, len(v), v)
diff --git a/source4/lib/tdb/tools/tdbtool.c b/source4/lib/tdb/tools/tdbtool.c
index 79435a3571..d104ccd7c4 100644
--- a/source4/lib/tdb/tools/tdbtool.c
+++ b/source4/lib/tdb/tools/tdbtool.c
@@ -135,7 +135,7 @@ static void print_data(const char *buf,int len)
 	if (len<=0) return;
 	printf("[%03X] ",i);
 	for (i=0;i<len;) {
-		printf("%02X ",(int)buf[i]);
+		printf("%02X ",(int)((unsigned char)buf[i]));
 		i++;
 		if (i%8 == 0) printf(" ");
 		if (i%16 == 0) {      
diff --git a/source4/lib/tdr/config.mk b/source4/lib/tdr/config.mk
index f0e24c54b4..b8473e5ba8 100644
--- a/source4/lib/tdr/config.mk
+++ b/source4/lib/tdr/config.mk
@@ -1,9 +1,6 @@
-[LIBRARY::TDR]
+[SUBSYSTEM::TDR]
 CFLAGS = -Ilib/tdr
 PUBLIC_HEADERS = tdr.h
-VERSION = 0.0.1
-SO_VERSION = 0
-DESCRIPTION = Simple marshall/unmarshall library
 PUBLIC_PROTO_HEADER = tdr_proto.h
 PUBLIC_DEPENDENCIES = LIBTALLOC LIBSAMBA-UTIL
 OBJ_FILES = tdr.o
diff --git a/source4/lib/util/asn1.c b/source4/lib/util/asn1.c
new file mode 100644
index 0000000000..4756c0640d
--- /dev/null
+++ b/source4/lib/util/asn1.c
@@ -0,0 +1,770 @@
+/* 
+   Unix SMB/CIFS implementation.
+   simple ASN1 routines
+   Copyright (C) Andrew Tridgell 2001
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "lib/util/asn1.h"
+
+/* allocate an asn1 structure */
+struct asn1_data *asn1_init(TALLOC_CTX *mem_ctx)
+{
+	struct asn1_data *ret = talloc_zero(mem_ctx, struct asn1_data);
+	if (ret == NULL) {
+		DEBUG(0,("asn1_init failed! out of memory\n"));
+	}
+	return ret;
+}
+
+/* free an asn1 structure */
+void asn1_free(struct asn1_data *data)
+{
+	talloc_free(data);
+}
+
+/* write to the ASN1 buffer, advancing the buffer pointer */
+bool asn1_write(struct asn1_data *data, const void *p, int len)
+{
+	if (data->has_error) return false;
+	if (data->length < data->ofs+len) {
+		uint8_t *newp;
+		newp = talloc_realloc(data, data->data, uint8_t, data->ofs+len);
+		if (!newp) {
+			asn1_free(data);
+			data->has_error = true;
+			return false;
+		}
+		data->data = newp;
+		data->length = data->ofs+len;
+	}
+	memcpy(data->data + data->ofs, p, len);
+	data->ofs += len;
+	return true;
+}
+
+/* useful fn for writing a uint8_t */
+bool asn1_write_uint8(struct asn1_data *data, uint8_t v)
+{
+	return asn1_write(data, &v, 1);
+}
+
+/* push a tag onto the asn1 data buffer. Used for nested structures */
+bool asn1_push_tag(struct asn1_data *data, uint8_t tag)
+{
+	struct nesting *nesting;
+
+	asn1_write_uint8(data, tag);
+	nesting = talloc(data, struct nesting);
+	if (!nesting) {
+		data->has_error = true;
+		return false;
+	}
+
+	nesting->start = data->ofs;
+	nesting->next = data->nesting;
+	data->nesting = nesting;
+	return asn1_write_uint8(data, 0xff);
+}
+
+/* pop a tag */
+bool asn1_pop_tag(struct asn1_data *data)
+{
+	struct nesting *nesting;
+	size_t len;
+
+	nesting = data->nesting;
+
+	if (!nesting) {
+		data->has_error = true;
+		return false;
+	}
+	len = data->ofs - (nesting->start+1);
+	/* yes, this is ugly. We don't know in advance how many bytes the length
+	   of a tag will take, so we assumed 1 byte. If we were wrong then we 
+	   need to correct our mistake */
+	if (len > 0xFFFFFF) {
+		data->data[nesting->start] = 0x84;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		memmove(data->data+nesting->start+5, data->data+nesting->start+1, len);
+		data->data[nesting->start+1] = (len>>24) & 0xFF;
+		data->data[nesting->start+2] = (len>>16) & 0xFF;
+		data->data[nesting->start+3] = (len>>8) & 0xFF;
+		data->data[nesting->start+4] = len&0xff;
+	} else if (len > 0xFFFF) {
+		data->data[nesting->start] = 0x83;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		memmove(data->data+nesting->start+4, data->data+nesting->start+1, len);
+		data->data[nesting->start+1] = (len>>16) & 0xFF;
+		data->data[nesting->start+2] = (len>>8) & 0xFF;
+		data->data[nesting->start+3] = len&0xff;
+	} else if (len > 255) {
+		data->data[nesting->start] = 0x82;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		memmove(data->data+nesting->start+3, data->data+nesting->start+1, len);
+		data->data[nesting->start+1] = len>>8;
+		data->data[nesting->start+2] = len&0xff;
+	} else if (len > 127) {
+		data->data[nesting->start] = 0x81;
+		if (!asn1_write_uint8(data, 0)) return false;
+		memmove(data->data+nesting->start+2, data->data+nesting->start+1, len);
+		data->data[nesting->start+1] = len;
+	} else {
+		data->data[nesting->start] = len;
+	}
+
+	data->nesting = nesting->next;
+	talloc_free(nesting);
+	return true;
+}
+
+/* "i" is the one's complement representation, as is the normal result of an
+ * implicit signed->unsigned conversion */
+
+static bool push_int_bigendian(struct asn1_data *data, unsigned int i, bool negative)
+{
+	uint8_t lowest = i & 0xFF;
+
+	i = i >> 8;
+	if (i != 0)
+		if (!push_int_bigendian(data, i, negative))
+			return false;
+
+	if (data->nesting->start+1 == data->ofs) {
+
+		/* We did not write anything yet, looking at the highest
+		 * valued byte */
+
+		if (negative) {
+			/* Don't write leading 0xff's */
+			if (lowest == 0xFF)
+				return true;
+
+			if ((lowest & 0x80) == 0) {
+				/* The only exception for a leading 0xff is if
+				 * the highest bit is 0, which would indicate
+				 * a positive value */
+				if (!asn1_write_uint8(data, 0xff))
+					return false;
+			}
+		} else {
+			if (lowest & 0x80) {
+				/* The highest bit of a positive integer is 1,
+				 * this would indicate a negative number. Push
+				 * a 0 to indicate a positive one */
+				if (!asn1_write_uint8(data, 0))
+					return false;
+			}
+		}
+	}
+
+	return asn1_write_uint8(data, lowest);
+}
+
+/* write an Integer without the tag framing. Needed for example for the LDAP
+ * Abandon Operation */
+
+bool asn1_write_implicit_Integer(struct asn1_data *data, int i)
+{
+	if (i == -1) {
+		/* -1 is special as it consists of all-0xff bytes. In
+                    push_int_bigendian this is the only case that is not
+                    properly handled, as all 0xff bytes would be handled as
+                    leading ones to be ignored. */
+		return asn1_write_uint8(data, 0xff);
+	} else {
+		return push_int_bigendian(data, i, i<0);
+	}
+}
+
+
+/* write an integer */
+bool asn1_write_Integer(struct asn1_data *data, int i)
+{
+	if (!asn1_push_tag(data, ASN1_INTEGER)) return false;
+	if (!asn1_write_implicit_Integer(data, i)) return false;
+	return asn1_pop_tag(data);
+}
+
+bool ber_write_OID_String(DATA_BLOB *blob, const char *OID)
+{
+	uint_t v, v2;
+	const char *p = (const char *)OID;
+	char *newp;
+	int i;
+
+	v = strtoul(p, &newp, 10);
+	if (newp[0] != '.') return false;
+	p = newp + 1;
+
+	v2 = strtoul(p, &newp, 10);
+	if (newp[0] != '.') return false;
+	p = newp + 1;
+
+	/*the ber representation can't use more space then the string one */
+	*blob = data_blob(NULL, strlen(OID));
+	if (!blob->data) return false;
+
+	blob->data[0] = 40*v + v2;
+
+	i = 1;
+	while (*p) {
+		v = strtoul(p, &newp, 10);
+		if (newp[0] == '.') {
+			p = newp + 1;
+		} else if (newp[0] == '\0') {
+			p = newp;
+		} else {
+			data_blob_free(blob);
+			return false;
+		}
+		if (v >= (1<<28)) blob->data[i++] = (0x80 | ((v>>28)&0x7f));
+		if (v >= (1<<21)) blob->data[i++] = (0x80 | ((v>>21)&0x7f));
+		if (v >= (1<<14)) blob->data[i++] = (0x80 | ((v>>14)&0x7f));
+		if (v >= (1<<7)) blob->data[i++] = (0x80 | ((v>>7)&0x7f));
+		blob->data[i++] = (v&0x7f);
+	}
+
+	blob->length = i;
+
+	return true;
+}
+
+/* write an object ID to a ASN1 buffer */
+bool asn1_write_OID(struct asn1_data *data, const char *OID)
+{
+	DATA_BLOB blob;
+
+	if (!asn1_push_tag(data, ASN1_OID)) return false;
+
+	if (!ber_write_OID_String(&blob, OID)) {
+		data->has_error = true;
+		return false;
+	}
+
+	if (!asn1_write(data, blob.data, blob.length)) {
+		data->has_error = true;
+		return false;
+	}
+	data_blob_free(&blob);
+	return asn1_pop_tag(data);
+}
+
+/* write an octet string */
+bool asn1_write_OctetString(struct asn1_data *data, const void *p, size_t length)
+{
+	asn1_push_tag(data, ASN1_OCTET_STRING);
+	asn1_write(data, p, length);
+	asn1_pop_tag(data);
+	return !data->has_error;
+}
+
+/* write a LDAP string */
+bool asn1_write_LDAPString(struct asn1_data *data, const char *s)
+{
+	asn1_write(data, s, strlen(s));
+	return !data->has_error;
+}
+
+/* write a LDAP string from a DATA_BLOB */
+bool asn1_write_DATA_BLOB_LDAPString(struct asn1_data *data, const DATA_BLOB *s)
+{
+	asn1_write(data, s->data, s->length);
+	return !data->has_error;
+}
+
+/* write a general string */
+bool asn1_write_GeneralString(struct asn1_data *data, const char *s)
+{
+	asn1_push_tag(data, ASN1_GENERAL_STRING);
+	asn1_write_LDAPString(data, s);
+	asn1_pop_tag(data);
+	return !data->has_error;
+}
+
+bool asn1_write_ContextSimple(struct asn1_data *data, uint8_t num, DATA_BLOB *blob)
+{
+	asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(num));
+	asn1_write(data, blob->data, blob->length);
+	asn1_pop_tag(data);
+	return !data->has_error;
+}
+
+/* write a BOOLEAN */
+bool asn1_write_BOOLEAN(struct asn1_data *data, bool v)
+{
+	asn1_push_tag(data, ASN1_BOOLEAN);
+	asn1_write_uint8(data, v ? 0xFF : 0);
+	asn1_pop_tag(data);
+	return !data->has_error;
+}
+
+bool asn1_read_BOOLEAN(struct asn1_data *data, bool *v)
+{
+	uint8_t tmp = 0;
+	asn1_start_tag(data, ASN1_BOOLEAN);
+	asn1_read_uint8(data, &tmp);
+	if (tmp == 0xFF) {
+		*v = true;
+	} else {
+		*v = false;
+	}
+	asn1_end_tag(data);
+	return !data->has_error;
+}
+
+/* check a BOOLEAN */
+bool asn1_check_BOOLEAN(struct asn1_data *data, bool v)
+{
+	uint8_t b = 0;
+
+	asn1_read_uint8(data, &b);
+	if (b != ASN1_BOOLEAN) {
+		data->has_error = true;
+		return false;
+	}
+	asn1_read_uint8(data, &b);
+	if (b != v) {
+		data->has_error = true;
+		return false;
+	}
+	return !data->has_error;
+}
+
+
+/* load a struct asn1_data structure with a lump of data, ready to be parsed */
+bool asn1_load(struct asn1_data *data, DATA_BLOB blob)
+{
+	ZERO_STRUCTP(data);
+	data->data = talloc_memdup(data, blob.data, blob.length);
+	if (!data->data) {
+		data->has_error = true;
+		return false;
+	}
+	data->length = blob.length;
+	return true;
+}
+
+/* Peek into an ASN1 buffer, not advancing the pointer */
+bool asn1_peek(struct asn1_data *data, void *p, int len)
+{
+	if (data->has_error)
+		return false;
+
+	if (len < 0 || data->ofs + len < data->ofs || data->ofs + len < len)
+		return false;
+
+	if (data->ofs + len > data->length) {
+		/* we need to mark the buffer as consumed, so the caller knows
+		   this was an out of data error, and not a decode error */
+		data->ofs = data->length;
+		return false;
+	}
+
+	memcpy(p, data->data + data->ofs, len);
+	return true;
+}
+
+/* read from a ASN1 buffer, advancing the buffer pointer */
+bool asn1_read(struct asn1_data *data, void *p, int len)
+{
+	if (!asn1_peek(data, p, len)) {
+		data->has_error = true;
+		return false;
+	}
+
+	data->ofs += len;
+	return true;
+}
+
+/* read a uint8_t from a ASN1 buffer */
+bool asn1_read_uint8(struct asn1_data *data, uint8_t *v)
+{
+	return asn1_read(data, v, 1);
+}
+
+bool asn1_peek_uint8(struct asn1_data *data, uint8_t *v)
+{
+	return asn1_peek(data, v, 1);
+}
+
+bool asn1_peek_tag(struct asn1_data *data, uint8_t tag)
+{
+	uint8_t b;
+
+	if (asn1_tag_remaining(data) <= 0) {
+		return false;
+	}
+
+	if (!asn1_peek_uint8(data, &b))
+		return false;
+
+	return (b == tag);
+}
+
+/* start reading a nested asn1 structure */
+bool asn1_start_tag(struct asn1_data *data, uint8_t tag)
+{
+	uint8_t b;
+	struct nesting *nesting;
+	
+	if (!asn1_read_uint8(data, &b))
+		return false;
+
+	if (b != tag) {
+		data->has_error = true;
+		return false;
+	}
+	nesting = talloc(data, struct nesting);
+	if (!nesting) {
+		data->has_error = true;
+		return false;
+	}
+
+	if (!asn1_read_uint8(data, &b)) {
+		return false;
+	}
+
+	if (b & 0x80) {
+		int n = b & 0x7f;
+		if (!asn1_read_uint8(data, &b))
+			return false;
+		nesting->taglen = b;
+		while (n > 1) {
+			if (!asn1_read_uint8(data, &b)) 
+				return false;
+			nesting->taglen = (nesting->taglen << 8) | b;
+			n--;
+		}
+	} else {
+		nesting->taglen = b;
+	}
+	nesting->start = data->ofs;
+	nesting->next = data->nesting;
+	data->nesting = nesting;
+	if (asn1_tag_remaining(data) == -1) {
+		return false;
+	}
+	return !data->has_error;
+}
+
+/* stop reading a tag */
+bool asn1_end_tag(struct asn1_data *data)
+{
+	struct nesting *nesting;
+
+	/* make sure we read it all */
+	if (asn1_tag_remaining(data) != 0) {
+		data->has_error = true;
+		return false;
+	}
+
+	nesting = data->nesting;
+
+	if (!nesting) {
+		data->has_error = true;
+		return false;
+	}
+
+	data->nesting = nesting->next;
+	talloc_free(nesting);
+	return true;
+}
+
+/* work out how many bytes are left in this nested tag */
+int asn1_tag_remaining(struct asn1_data *data)
+{
+	int remaining;
+	if (data->has_error) {
+		return -1;
+	}
+
+	if (!data->nesting) {
+		data->has_error = true;
+		return -1;
+	}
+	remaining = data->nesting->taglen - (data->ofs - data->nesting->start);
+	if (remaining > (data->length - data->ofs)) {
+		data->has_error = true;
+		return -1;
+	}
+	return remaining;
+}
+
+/* read an object ID from a data blob */
+bool ber_read_OID_String(TALLOC_CTX *mem_ctx, DATA_BLOB blob, const char **OID)
+{
+	int i;
+	uint8_t *b;
+	uint_t v;
+	char *tmp_oid = NULL;
+
+	if (blob.length < 2) return false;
+
+	b = blob.data;
+
+	tmp_oid = talloc_asprintf(mem_ctx, "%u",  b[0]/40);
+	if (!tmp_oid) goto nomem;
+	tmp_oid = talloc_asprintf_append_buffer(tmp_oid, ".%u",  b[0]%40);
+	if (!tmp_oid) goto nomem;
+
+	for(i = 1, v = 0; i < blob.length; i++) {
+		v = (v<<7) | (b[i]&0x7f);
+		if ( ! (b[i] & 0x80)) {
+			tmp_oid = talloc_asprintf_append_buffer(tmp_oid, ".%u",  v);
+			v = 0;
+		}
+		if (!tmp_oid) goto nomem;
+	}
+
+	if (v != 0) {
+		talloc_free(tmp_oid);
+		return false;
+	}
+
+	*OID = tmp_oid;
+	return true;
+
+nomem:	
+	return false;
+}
+
+/* read an object ID from a ASN1 buffer */
+bool asn1_read_OID(struct asn1_data *data, TALLOC_CTX *mem_ctx, const char **OID)
+{
+	DATA_BLOB blob;
+	int len;
+
+	if (!asn1_start_tag(data, ASN1_OID)) return false;
+
+	len = asn1_tag_remaining(data);
+	if (len < 0) {
+		data->has_error = true;
+		return false;
+	}
+
+	blob = data_blob(NULL, len);
+	if (!blob.data) {
+		data->has_error = true;
+		return false;
+	}
+
+	asn1_read(data, blob.data, len);
+	asn1_end_tag(data);
+	if (data->has_error) {
+		data_blob_free(&blob);
+		return false;
+	}
+
+	if (!ber_read_OID_String(mem_ctx, blob, OID)) {
+		data->has_error = true;
+		data_blob_free(&blob);
+		return false;
+	}
+
+	data_blob_free(&blob);
+	return true;
+}
+
+/* check that the next object ID is correct */
+bool asn1_check_OID(struct asn1_data *data, const char *OID)
+{
+	const char *id;
+
+	if (!asn1_read_OID(data, data, &id)) return false;
+
+	if (strcmp(id, OID) != 0) {
+		talloc_free(discard_const(id));
+		data->has_error = true;
+		return false;
+	}
+	talloc_free(discard_const(id));
+	return true;
+}
+
+/* read a LDAPString from a ASN1 buffer */
+bool asn1_read_LDAPString(struct asn1_data *data, TALLOC_CTX *mem_ctx, char **s)
+{
+	int len;
+	len = asn1_tag_remaining(data);
+	if (len < 0) {
+		data->has_error = true;
+		return false;
+	}
+	*s = talloc_array(mem_ctx, char, len+1);
+	if (! *s) {
+		data->has_error = true;
+		return false;
+	}
+	asn1_read(data, *s, len);
+	(*s)[len] = 0;
+	return !data->has_error;
+}
+
+
+/* read a GeneralString from a ASN1 buffer */
+bool asn1_read_GeneralString(struct asn1_data *data, TALLOC_CTX *mem_ctx, char **s)
+{
+	if (!asn1_start_tag(data, ASN1_GENERAL_STRING)) return false;
+	if (!asn1_read_LDAPString(data, mem_ctx, s)) return false;
+	return asn1_end_tag(data);
+}
+
+
+/* read a octet string blob */
+bool asn1_read_OctetString(struct asn1_data *data, TALLOC_CTX *mem_ctx, DATA_BLOB *blob)
+{
+	int len;
+	ZERO_STRUCTP(blob);
+	if (!asn1_start_tag(data, ASN1_OCTET_STRING)) return false;
+	len = asn1_tag_remaining(data);
+	if (len < 0) {
+		data->has_error = true;
+		return false;
+	}
+	*blob = data_blob_talloc(mem_ctx, NULL, len+1);
+	if (!blob->data) {
+		data->has_error = true;
+		return false;
+	}
+	asn1_read(data, blob->data, len);
+	asn1_end_tag(data);
+	blob->length--;
+	blob->data[len] = 0;
+	
+	if (data->has_error) {
+		data_blob_free(blob);
+		*blob = data_blob(NULL, 0);
+		return false;
+	}
+	return true;
+}
+
+bool asn1_read_ContextSimple(struct asn1_data *data, uint8_t num, DATA_BLOB *blob)
+{
+	int len;
+	ZERO_STRUCTP(blob);
+	if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(num))) return false;
+	len = asn1_tag_remaining(data);
+	if (len < 0) {
+		data->has_error = true;
+		return false;
+	}
+	*blob = data_blob(NULL, len);
+	if ((len != 0) && (!blob->data)) {
+		data->has_error = true;
+		return false;
+	}
+	asn1_read(data, blob->data, len);
+	asn1_end_tag(data);
+	return !data->has_error;
+}
+
+/* read an integer without tag*/
+bool asn1_read_implicit_Integer(struct asn1_data *data, int *i)
+{
+	uint8_t b;
+	*i = 0;
+
+	while (!data->has_error && asn1_tag_remaining(data)>0) {
+		if (!asn1_read_uint8(data, &b)) return false;
+		*i = (*i << 8) + b;
+	}
+	return !data->has_error;	
+	
+}
+
+/* read an integer */
+bool asn1_read_Integer(struct asn1_data *data, int *i)
+{
+	*i = 0;
+
+	if (!asn1_start_tag(data, ASN1_INTEGER)) return false;
+	if (!asn1_read_implicit_Integer(data, i)) return false;
+	return asn1_end_tag(data);	
+}
+
+/* read an integer */
+bool asn1_read_enumerated(struct asn1_data *data, int *v)
+{
+	*v = 0;
+	
+	if (!asn1_start_tag(data, ASN1_ENUMERATED)) return false;
+	while (!data->has_error && asn1_tag_remaining(data)>0) {
+		uint8_t b;
+		asn1_read_uint8(data, &b);
+		*v = (*v << 8) + b;
+	}
+	return asn1_end_tag(data);	
+}
+
+/* check a enumerated value is correct */
+bool asn1_check_enumerated(struct asn1_data *data, int v)
+{
+	uint8_t b;
+	if (!asn1_start_tag(data, ASN1_ENUMERATED)) return false;
+	asn1_read_uint8(data, &b);
+	asn1_end_tag(data);
+
+	if (v != b)
+		data->has_error = false;
+
+	return !data->has_error;
+}
+
+/* write an enumerated value to the stream */
+bool asn1_write_enumerated(struct asn1_data *data, uint8_t v)
+{
+	if (!asn1_push_tag(data, ASN1_ENUMERATED)) return false;
+	asn1_write_uint8(data, v);
+	asn1_pop_tag(data);
+	return !data->has_error;
+}
+
+/*
+  check if a ASN.1 blob is a full tag
+*/
+NTSTATUS asn1_full_tag(DATA_BLOB blob, uint8_t tag, size_t *packet_size)
+{
+	struct asn1_data *asn1 = asn1_init(NULL);
+	int size;
+
+	NT_STATUS_HAVE_NO_MEMORY(asn1);
+
+	asn1->data = blob.data;
+	asn1->length = blob.length;
+	asn1_start_tag(asn1, tag);
+	if (asn1->has_error) {
+		talloc_free(asn1);
+		return STATUS_MORE_ENTRIES;
+	}
+	size = asn1_tag_remaining(asn1) + asn1->ofs;
+
+	talloc_free(asn1);
+
+	if (size > blob.length) {
+		return STATUS_MORE_ENTRIES;
+	}		
+
+	*packet_size = size;
+	return NT_STATUS_OK;
+}
diff --git a/source4/lib/util/asn1.h b/source4/lib/util/asn1.h
new file mode 100644
index 0000000000..34aa1e2cb9
--- /dev/null
+++ b/source4/lib/util/asn1.h
@@ -0,0 +1,54 @@
+/* 
+   Unix SMB/CIFS implementation.   
+   simple ASN1 code
+   Copyright (C) Andrew Tridgell 2001
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _ASN_1_H
+#define _ASN_1_H
+
+struct nesting {
+	off_t start;
+	size_t taglen; /* for parsing */
+	struct nesting *next;
+};
+
+struct asn1_data {
+	uint8_t *data;
+	size_t length;
+	off_t ofs;
+	struct nesting *nesting;
+	bool has_error;
+};
+
+#define ASN1_APPLICATION(x) ((x)+0x60)
+#define ASN1_APPLICATION_SIMPLE(x) ((x)+0x40)
+#define ASN1_SEQUENCE(x) ((x)+0x30)
+#define ASN1_CONTEXT(x) ((x)+0xa0)
+#define ASN1_CONTEXT_SIMPLE(x) ((x)+0x80)
+#define ASN1_GENERAL_STRING 0x1b
+#define ASN1_OCTET_STRING 0x4
+#define ASN1_OID 0x6
+#define ASN1_BOOLEAN 0x1
+#define ASN1_INTEGER 0x2
+#define ASN1_ENUMERATED 0xa
+#define ASN1_SET 0x31
+
+#define ASN1_MAX_OIDS 20
+
+#include "lib/util/asn1_proto.h"
+
+#endif /* _ASN_1_H */
diff --git a/source4/lib/util/config.mk b/source4/lib/util/config.mk
index 01ad14aa95..53a55bf7af 100644
--- a/source4/lib/util/config.mk
+++ b/source4/lib/util/config.mk
@@ -34,6 +34,11 @@ PUBLIC_DEPENDENCIES = \
 		SOCKET_WRAPPER EXT_NSL \
 		CHARSET EXECINFO
 
+[SUBSYSTEM::ASN1_UTIL]
+PUBLIC_PROTO_HEADER = asn1_proto.h
+PUBLIC_HEADERS = asn1.h
+OBJ_FILES = asn1.o
+
 [SUBSYSTEM::UNIX_PRIVS]
 PRIVATE_PROTO_HEADER = unix_privs.h
 OBJ_FILES = unix_privs.o