Merge branch 'v4-0-test' of git://git.samba.org/samba into 4-0-local

(This used to be commit d8a805a2544c8864136f77e9086b2a01ae79a1d5)

20 files changed, 1345 insertions, 226 deletions

diff --git a/source4/lib/ldb/tests/python/ldap.py b/source4/lib/ldb/tests/python/ldap.py
index cede927f7a..01b66a3890 100755
--- a/source4/lib/ldb/tests/python/ldap.py
+++ b/source4/lib/ldb/tests/python/ldap.py
@@ -11,7 +11,10 @@ sys.path.append("scripting/python")
 import samba.getopt as options
 
 from auth import system_session
-from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
+from ldb import (SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError,
+                 LDB_ERR_NO_SUCH_OBJECT, LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS,
+                 LDB_ERR_ENTRY_ALREADY_EXISTS, LDB_ERR_UNWILLING_TO_PERFORM,
+                 LDB_ERR_NOT_ALLOWED_ON_NON_LEAF)
 from samba import Ldb
 import param
 
@@ -38,7 +41,7 @@ def delete_force(ldb, dn):
     try:
         ldb.delete(dn)
     except LdbError, (num, _): 
-        if num != 32: # LDAP_NO_SUCH_OBJECT
+        if num != LDB_ERR_NO_SUCH_OBJECT:
             assert False
 
 def assertEquals(a1, a2):
@@ -57,7 +60,7 @@ def basic_tests(ldb, gc_ldb, base_dn, configuration_dn, schema_dn):
         "objectclass": "group",
         "member": "cn=ldaptestuser,cn=useRs," + base_dn})
     except LdbError, (num, _): 
-        if num != 32: # LDAP_NO_SUCH_OBJECT
+        if num != LDB_ERR_NO_SUCH_OBJECT:
             assert False
     else:
         assert False
@@ -122,8 +125,7 @@ servicePrincipalName: host/ldaptest2computer
 servicePrincipalName: cifs/ldaptest2computer
 """)
     except LdbError, (num, msg):
-        #LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
-        assert num == 20, "Expected error LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS, got : %s" % msg
+        assert num == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
 
         ldb.modify_ldif("""
 dn: cn=ldaptest2computer,cn=computers,""" + base_dn + """
@@ -140,7 +142,7 @@ add: servicePrincipalName
 servicePrincipalName: host/ldaptest2computer
 """)
         except LdbError, (num, msg):
-            assert num == 20, "Expected error LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS, got :" + msg
+            assert num == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
         
         print "Testing ranged results"
         ldb.modify_ldif("""
@@ -347,7 +349,7 @@ add: member
 member: cn=ldaptestuser3,cn=users,""" + base_dn + """
 """)
     except LdbError, (num, _):
-        assert num == 32
+        assert num == LDB_ERR_NO_SUCH_OBJECT
     else:
         assert False
 
@@ -391,7 +393,7 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
                   "objectClass": ["person", "user"],
                   "cn": "LDAPtestUSER3"})
     except LdbError, (num, _):
-        assert num == 68 #LDB_ERR_ENTRY_ALREADY_EXISTS
+        assert num == LDB_ERR_ENTRY_ALREADY_EXISTS
     else:
         assert False
 
@@ -402,7 +404,7 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
     try:
         ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser2,cn=users," + base_dn)
     except LdbError, (num, _): 
-        assert num == 32 # LDAP_NO_SUCH_OBJECT
+        assert num == LDB_ERR_NO_SUCH_OBJECT
     else:
         assert False
 
@@ -415,7 +417,7 @@ member: cn=ldaptestuser3,cn=users,""" + base_dn + """
     try:
         ldb.rename("cn=ldaptestuser2,cn=users," + base_dn, "cn=ldaptestuser3,cn=users," + base_dn)
     except LdbError, (num, _):
-        assert num == 68 #LDB_ERR_ENTRY_ALREADY_EXISTS
+        assert num == LDB_ERR_ENTRY_ALREADY_EXISTS
     else:
         assert False
     try:
@@ -468,7 +470,7 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
                 expression="(&(cn=ldaptestuser4)(objectClass=user))", 
                 scope=SCOPE_SUBTREE)
     except LdbError, (num, _):
-        assert num == 32
+        assert num == LDB_ERR_NO_SUCH_OBJECT
     else:
         assert False
 
@@ -476,7 +478,7 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
     try:
         res = ldb.search("cn=ldaptestcontainer," + base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_ONELEVEL)
     except LdbError, (num, _):
-        assert num == 32
+        assert num == LDB_ERR_NO_SUCH_OBJECT
     else:
         assert False
 
@@ -495,7 +497,7 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
     try:
         ldb.rename("cn=ldaptestcontainer2," + base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + base_dn)
     except LdbError, (num, _):
-        assert num == 53 # LDAP_UNWILLING_TO_PERFORM
+        assert num == LDB_ERR_UNWILLING_TO_PERFORM
     else:
         assert False
 
@@ -511,7 +513,7 @@ member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
     try:
         ldb.delete("cn=ldaptestcontainer2," + base_dn)
     except LdbError, (num, _):
-        assert num == 66
+        assert num == LDB_ERR_NOT_ALLOWED_ON_NON_LEAF
     else:
         assert False
 
diff --git a/source4/lib/replace/getpass.m4 b/source4/lib/replace/getpass.m4
index 17dfdf7bf5..c4da9aae59 100644
--- a/source4/lib/replace/getpass.m4
+++ b/source4/lib/replace/getpass.m4
@@ -1,3 +1,11 @@
+AC_CHECK_FUNC(getpass, samba_cv_HAVE_GETPASS=yes)
+AC_CHECK_FUNC(getpassphrase, samba_cv_HAVE_GETPASSPHRASE=yes)
+if test x"$samba_cv_HAVE_GETPASS" = x"yes" -a x"$samba_cv_HAVE_GETPASSPHRASE" = x"yes"; then
+        AC_DEFINE(REPLACE_GETPASS_BY_GETPASSPHRASE, 1, [getpass returns <9 chars where getpassphrase returns <265 chars])
+	AC_DEFINE(REPLACE_GETPASS,1,[Whether getpass should be replaced])
+	LIBREPLACEOBJ="${LIBREPLACEOBJ} getpass.o"
+else
+
 AC_CACHE_CHECK([whether getpass should be replaced],samba_cv_REPLACE_GETPASS,[
 SAVE_CPPFLAGS="$CPPFLAGS"
 CPPFLAGS="$CPPFLAGS -I$libreplacedir/"
@@ -12,3 +20,5 @@ if test x"$samba_cv_REPLACE_GETPASS" = x"yes"; then
 	AC_DEFINE(REPLACE_GETPASS,1,[Whether getpass should be replaced])
 	LIBREPLACEOBJ="${LIBREPLACEOBJ} getpass.o"
 fi
+
+fi
diff --git a/source4/lib/replace/libreplace.m4 b/source4/lib/replace/libreplace.m4
index a577285639..6d1d6b8afc 100644
--- a/source4/lib/replace/libreplace.m4
+++ b/source4/lib/replace/libreplace.m4
@@ -100,6 +100,7 @@ AC_CHECK_HEADERS(sys/socket.h netinet/in.h netdb.h arpa/inet.h)
 AC_CHECK_HEADERS(netinet/ip.h netinet/tcp.h netinet/in_systm.h netinet/in_ip.h)
 AC_CHECK_HEADERS(sys/sockio.h sys/un.h)
 AC_CHECK_HEADERS(sys/mount.h mntent.h)
+AC_CHECK_HEADERS(stropts.h)
 
 dnl we need to check that net/if.h really can be used, to cope with hpux
 dnl where including it always fails
diff --git a/source4/lib/replace/libreplace_ld.m4 b/source4/lib/replace/libreplace_ld.m4
index 0ca6f7a34d..2aec698967 100644
--- a/source4/lib/replace/libreplace_ld.m4
+++ b/source4/lib/replace/libreplace_ld.m4
@@ -265,7 +265,7 @@ AC_DEFUN([AC_LIBREPLACE_LD_SHLIB_ALLOW_UNDEF_FLAG],
 			LD_SHLIB_ALLOW_UNDEF_FLAG="-Wl,--allow-shlib-undefined"
 			;;
 		*osf*)
-			LD_SHLIB_ALLOW_UNDEF_FLAG="-Wl,-expect_unresolved,*"
+			LD_SHLIB_ALLOW_UNDEF_FLAG="-Wl,-expect_unresolved,\"*\""
 			;;
 		*darwin*)
 			LD_SHLIB_ALLOW_UNDEF_FLAG="-undefined dynamic_lookup"
diff --git a/source4/lib/replace/replace.c b/source4/lib/replace/replace.c
index cec158be31..b2a240e8ab 100644
--- a/source4/lib/replace/replace.c
+++ b/source4/lib/replace/replace.c
@@ -218,7 +218,7 @@ long nap(long milliseconds) {
 #ifndef HAVE_MEMMOVE
 /*******************************************************************
 safely copies memory, ensuring no overlap problems.
-this is only used if the machine does not have it's own memmove().
+this is only used if the machine does not have its own memmove().
 this is not the fastest algorithm in town, but it will do for our
 needs.
 ********************************************************************/
diff --git a/source4/lib/replace/replace.h b/source4/lib/replace/replace.h
index f8a89a7213..3f91544e97 100644
--- a/source4/lib/replace/replace.h
+++ b/source4/lib/replace/replace.h
@@ -546,4 +546,12 @@ typedef int bool;
 #define QSORT_CAST (int (*)(const void *, const void *))
 #endif
 
+#ifndef PATH_MAX
+#define PATH_MAX 1024
+#endif
+
+#ifndef MAX_DNS_NAME_LENGTH
+#define MAX_DNS_NAME_LENGTH 256 /* Actually 255 but +1 for terminating null. */
+#endif
+
 #endif /* _LIBREPLACE_REPLACE_H */
diff --git a/source4/lib/replace/system/network.h b/source4/lib/replace/system/network.h
index e2fad5f686..53bef66d48 100644
--- a/source4/lib/replace/system/network.h
+++ b/source4/lib/replace/system/network.h
@@ -79,6 +79,10 @@
 #include <sys/ioctl.h>
 #endif
 
+#ifdef HAVE_STROPTS_H
+#include <stropts.h>
+#endif
+
 #ifdef REPLACE_INET_NTOA
 /* define is in "replace.h" */
 char *rep_inet_ntoa(struct in_addr ip);
diff --git a/source4/lib/replace/system/passwd.h b/source4/lib/replace/system/passwd.h
index 36fca7b4f8..cad3197ccb 100644
--- a/source4/lib/replace/system/passwd.h
+++ b/source4/lib/replace/system/passwd.h
@@ -68,9 +68,13 @@
 #endif
 
 #ifdef REPLACE_GETPASS
+#if defined(REPLACE_GETPASS_BY_GETPASSPHRASE)
+#define getpass(prompt) getpassphrase(prompt)
+#else
 #define getpass(prompt) rep_getpass(prompt)
 char *rep_getpass(const char *prompt);
 #endif
+#endif
 
 #ifndef NGROUPS_MAX
 #define NGROUPS_MAX 32 /* Guess... */
diff --git a/source4/lib/tdb/common/freelist.c b/source4/lib/tdb/common/freelist.c
index b109643f23..c086c151fa 100644
--- a/source4/lib/tdb/common/freelist.c
+++ b/source4/lib/tdb/common/freelist.c
@@ -27,6 +27,12 @@
 
 #include "tdb_private.h"
 
+/* 'right' merges can involve O(n^2) cost when combined with a
+   traverse, so they are disabled until we find a way to do them in 
+   O(1) time
+*/
+#define USE_RIGHT_MERGES 0
+
 /* read a freelist record and check for simple errors */
 int tdb_rec_free_read(struct tdb_context *tdb, tdb_off_t off, struct list_struct *rec)
 {
@@ -56,7 +62,7 @@ int tdb_rec_free_read(struct tdb_context *tdb, tdb_off_t off, struct list_struct
 }
 
 
-
+#if USE_RIGHT_MERGES
 /* Remove an element from the freelist.  Must have alloc lock. */
 static int remove_from_freelist(struct tdb_context *tdb, tdb_off_t off, tdb_off_t next)
 {
@@ -75,6 +81,7 @@ static int remove_from_freelist(struct tdb_context *tdb, tdb_off_t off, tdb_off_
 	TDB_LOG((tdb, TDB_DEBUG_FATAL,"remove_from_freelist: not on list at off=%d\n", off));
 	return TDB_ERRCODE(TDB_ERR_CORRUPT, -1);
 }
+#endif
 
 
 /* update a record tailer (must hold allocation lock) */
@@ -93,8 +100,6 @@ static int update_tailer(struct tdb_context *tdb, tdb_off_t offset,
    neccessary. */
 int tdb_free(struct tdb_context *tdb, tdb_off_t offset, struct list_struct *rec)
 {
-	tdb_off_t right, left;
-
 	/* Allocation and tailer lock */
 	if (tdb_lock(tdb, -1, F_WRLCK) != 0)
 		return -1;
@@ -105,9 +110,10 @@ int tdb_free(struct tdb_context *tdb, tdb_off_t offset, struct list_struct *rec)
 		goto fail;
 	}
 
+#if USE_RIGHT_MERGES
 	/* Look right first (I'm an Australian, dammit) */
-	right = offset + sizeof(*rec) + rec->rec_len;
-	if (right + sizeof(*rec) <= tdb->map_size) {
+	if (offset + sizeof(*rec) + rec->rec_len + sizeof(*rec) <= tdb->map_size) {
+		tdb_off_t right = offset + sizeof(*rec) + rec->rec_len;
 		struct list_struct r;
 
 		if (tdb->methods->tdb_read(tdb, right, &r, sizeof(r), DOCONV()) == -1) {
@@ -122,13 +128,18 @@ int tdb_free(struct tdb_context *tdb, tdb_off_t offset, struct list_struct *rec)
 				goto left;
 			}
 			rec->rec_len += sizeof(r) + r.rec_len;
+			if (update_tailer(tdb, offset, rec) == -1) {
+				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: update_tailer failed at %u\n", offset));
+				goto fail;
+			}
 		}
 	}
-
 left:
+#endif
+
 	/* Look left */
-	left = offset - sizeof(tdb_off_t);
-	if (left > TDB_DATA_START(tdb->header.hash_size)) {
+	if (offset - sizeof(tdb_off_t) > TDB_DATA_START(tdb->header.hash_size)) {
+		tdb_off_t left = offset - sizeof(tdb_off_t);
 		struct list_struct l;
 		tdb_off_t leftsize;
 		
@@ -145,7 +156,12 @@ left:
 
 		left = offset - leftsize;
 
-		/* Now read in record */
+		if (leftsize > offset ||
+		    left < TDB_DATA_START(tdb->header.hash_size)) {
+			goto update;
+		}
+
+		/* Now read in the left record */
 		if (tdb->methods->tdb_read(tdb, left, &l, sizeof(l), DOCONV()) == -1) {
 			TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: left read failed at %u (%u)\n", left, leftsize));
 			goto update;
@@ -153,21 +169,24 @@ left:
 
 		/* If it's free, expand to include it. */
 		if (l.magic == TDB_FREE_MAGIC) {
-			if (remove_from_freelist(tdb, left, l.next) == -1) {
-				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: left free failed at %u\n", left));
-				goto update;
-			} else {
-				offset = left;
-				rec->rec_len += leftsize;
+			/* we now merge the new record into the left record, rather than the other 
+			   way around. This makes the operation O(1) instead of O(n). This change
+			   prevents traverse from being O(n^2) after a lot of deletes */
+			l.rec_len += sizeof(*rec) + rec->rec_len;
+			if (tdb_rec_write(tdb, left, &l) == -1) {
+				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: update_left failed at %u\n", left));
+				goto fail;
 			}
+			if (update_tailer(tdb, left, &l) == -1) {
+				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: update_tailer failed at %u\n", offset));
+				goto fail;
+			}
+			tdb_unlock(tdb, -1, F_WRLCK);
+			return 0;
 		}
 	}
 
 update:
-	if (update_tailer(tdb, offset, rec) == -1) {
-		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_free: update_tailer failed at %u\n", offset));
-		goto fail;
-	}
 
 	/* Now, prepend to free list */
 	rec->magic = TDB_FREE_MAGIC;
@@ -261,6 +280,7 @@ tdb_off_t tdb_allocate(struct tdb_context *tdb, tdb_len_t length, struct list_st
 		tdb_off_t rec_ptr, last_ptr;
 		tdb_len_t rec_len;
 	} bestfit;
+	float multiplier = 1.0;
 
 	if (tdb_lock(tdb, -1, F_WRLCK) == -1)
 		return 0;
@@ -295,18 +315,27 @@ tdb_off_t tdb_allocate(struct tdb_context *tdb, tdb_len_t length, struct list_st
 				bestfit.rec_len = rec->rec_len;
 				bestfit.rec_ptr = rec_ptr;
 				bestfit.last_ptr = last_ptr;
-				/* consider a fit to be good enough if
-				   we aren't wasting more than half
-				   the space */
-				if (bestfit.rec_len < 2*length) {
-					break;
-				}
 			}
 		}
 
 		/* move to the next record */
 		last_ptr = rec_ptr;
 		rec_ptr = rec->next;
+
+		/* if we've found a record that is big enough, then
+		   stop searching if its also not too big. The
+		   definition of 'too big' changes as we scan
+		   through */
+		if (bestfit.rec_len > 0 &&
+		    bestfit.rec_len < length * multiplier) {
+			break;
+		}
+		
+		/* this multiplier means we only extremely rarely
+		   search more than 50 or so records. At 50 records we
+		   accept records up to 11 times larger than what we
+		   want */
+		multiplier *= 1.05;
 	}
 
 	if (bestfit.rec_ptr != 0) {
@@ -328,3 +357,25 @@ tdb_off_t tdb_allocate(struct tdb_context *tdb, tdb_len_t length, struct list_st
 	return 0;
 }
 
+
+
+/* 
+   return the size of the freelist - used to decide if we should repack 
+*/
+int tdb_freelist_size(struct tdb_context *tdb)
+{
+	tdb_off_t ptr;
+	int count=0;
+
+	if (tdb_lock(tdb, -1, F_RDLCK) == -1) {
+		return -1;
+	}
+
+	ptr = FREELIST_TOP;
+	while (tdb_ofs_read(tdb, ptr, &ptr) == 0 && ptr != 0) {
+		count++;
+	}
+
+	tdb_unlock(tdb, -1, F_RDLCK);
+	return count;
+}
diff --git a/source4/lib/tdb/common/io.c b/source4/lib/tdb/common/io.c
index 8ab0768883..172ab69d8c 100644
--- a/source4/lib/tdb/common/io.c
+++ b/source4/lib/tdb/common/io.c
@@ -101,8 +101,8 @@ static int tdb_write(struct tdb_context *tdb, tdb_off_t off,
 					 off+written);
 		}
 		if (written == -1) {
-			/* Ensure ecode is set for log fn. */
-			tdb->ecode = TDB_ERR_IO;
+		/* Ensure ecode is set for log fn. */
+		tdb->ecode = TDB_ERR_IO;
 			TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_write failed at %d "
 				 "len=%d (%s)\n", off, len, strerror(errno)));
 			return TDB_ERRCODE(TDB_ERR_IO, -1);
@@ -111,8 +111,8 @@ static int tdb_write(struct tdb_context *tdb, tdb_off_t off,
 				 "write %d bytes at %d in two attempts\n",
 				 len, off));
 			errno = ENOSPC;
-			return TDB_ERRCODE(TDB_ERR_IO, -1);
-		}
+		return TDB_ERRCODE(TDB_ERR_IO, -1);
+	}
 	}
 	return 0;
 }
@@ -230,7 +230,7 @@ void tdb_mmap(struct tdb_context *tdb)
   says to use for mmap expansion */
 static int tdb_expand_file(struct tdb_context *tdb, tdb_off_t size, tdb_off_t addition)
 {
-	char buf[1024];
+	char buf[8192];
 
 	if (tdb->read_only || tdb->traverse_read) {
 		tdb->ecode = TDB_ERR_RDONLY;
@@ -294,7 +294,7 @@ static int tdb_expand_file(struct tdb_context *tdb, tdb_off_t size, tdb_off_t ad
 int tdb_expand(struct tdb_context *tdb, tdb_off_t size)
 {
 	struct list_struct rec;
-	tdb_off_t offset;
+	tdb_off_t offset, new_size;	
 
 	if (tdb_lock(tdb, -1, F_WRLCK) == -1) {
 		TDB_LOG((tdb, TDB_DEBUG_ERROR, "lock failed in tdb_expand\n"));
@@ -304,9 +304,11 @@ int tdb_expand(struct tdb_context *tdb, tdb_off_t size)
 	/* must know about any previous expansions by another process */
 	tdb->methods->tdb_oob(tdb, tdb->map_size + 1, 1);
 
-	/* always make room for at least 10 more records, and round
-           the database up to a multiple of the page size */
-	size = TDB_ALIGN(tdb->map_size + size*10, tdb->page_size) - tdb->map_size;
+	/* always make room for at least 100 more records, and at
+           least 25% more space. Round the database up to a multiple
+           of the page size */
+	new_size = MAX(tdb->map_size + size*100, tdb->map_size * 1.25);
+	size = TDB_ALIGN(new_size, tdb->page_size) - tdb->map_size;
 
 	if (!(tdb->flags & TDB_INTERNAL))
 		tdb_munmap(tdb);
diff --git a/source4/lib/tdb/common/lock.c b/source4/lib/tdb/common/lock.c
index e3fe888c46..f156c0fa7b 100644
--- a/source4/lib/tdb/common/lock.c
+++ b/source4/lib/tdb/common/lock.c
@@ -505,6 +505,9 @@ int tdb_chainunlock_read(struct tdb_context *tdb, TDB_DATA key)
 /* record lock stops delete underneath */
 int tdb_lock_record(struct tdb_context *tdb, tdb_off_t off)
 {
+	if (tdb->global_lock.count) {
+		return 0;
+	}
 	return off ? tdb->methods->tdb_brlock(tdb, off, F_RDLCK, F_SETLKW, 0, 1) : 0;
 }
 
@@ -537,6 +540,10 @@ int tdb_unlock_record(struct tdb_context *tdb, tdb_off_t off)
 	struct tdb_traverse_lock *i;
 	uint32_t count = 0;
 
+	if (tdb->global_lock.count) {
+		return 0;
+	}
+
 	if (off == 0)
 		return 0;
 	for (i = &tdb->travlocks; i; i = i->next)
diff --git a/source4/lib/tdb/common/open.c b/source4/lib/tdb/common/open.c
index 0bd1c91a5e..6bd8fda2bf 100644
--- a/source4/lib/tdb/common/open.c
+++ b/source4/lib/tdb/common/open.c
@@ -35,7 +35,7 @@ static struct tdb_context *tdbs = NULL;
 static unsigned int default_tdb_hash(TDB_DATA *key)
 {
 	uint32_t value;	/* Used to compute the hash value.  */
-	uint32_t i;	/* Used to cycle through random values. */
+	uint32_t   i;	/* Used to cycle through random values. */
 
 	/* Set the initial value from the key size. */
 	for (value = 0x238F13AF * key->dsize, i=0; i < key->dsize; i++)
@@ -90,7 +90,7 @@ static int tdb_new_database(struct tdb_context *tdb, int hash_size)
 		size -= written;
 		written = write(tdb->fd, newdb+written, size);
 		if (written == size) {
-			ret = 0;
+		ret = 0;
 		} else if (written >= 0) {
 			/* a second incomplete write - we give up.
 			 * guessing the errno... */
@@ -152,6 +152,7 @@ struct tdb_context *tdb_open_ex(const char *name, int hash_size, int tdb_flags,
 	int rev = 0, locked = 0;
 	unsigned char *vp;
 	uint32_t vertest;
+	unsigned v;
 
 	if (!(tdb = (struct tdb_context *)calloc(1, sizeof *tdb))) {
 		/* Can't log this */
@@ -215,6 +216,10 @@ struct tdb_context *tdb_open_ex(const char *name, int hash_size, int tdb_flags,
 		goto fail;	/* errno set by open(2) */
 	}
 
+	/* on exec, don't inherit the fd */
+	v = fcntl(tdb->fd, F_GETFD, 0);
+        fcntl(tdb->fd, F_SETFD, v | FD_CLOEXEC);
+
 	/* ensure there is only one process initialising at once */
 	if (tdb->methods->tdb_brlock(tdb, GLOBAL_LOCK, F_WRLCK, F_SETLKW, 0, 1) == -1) {
 		TDB_LOG((tdb, TDB_DEBUG_ERROR, "tdb_open_ex: failed to get global lock on %s: %s\n",
@@ -242,7 +247,7 @@ struct tdb_context *tdb_open_ex(const char *name, int hash_size, int tdb_flags,
 		/* its not a valid database - possibly initialise it */
 		if (!(open_flags & O_CREAT) || tdb_new_database(tdb, hash_size) == -1) {
 			if (errno == 0) {
-				errno = EIO; /* ie bad format or something */
+			errno = EIO; /* ie bad format or something */
 			}
 			goto fail;
 		}
diff --git a/source4/lib/tdb/common/tdb.c b/source4/lib/tdb/common/tdb.c
index 0e9d1dbd74..fd4e1cc8af 100644
--- a/source4/lib/tdb/common/tdb.c
+++ b/source4/lib/tdb/common/tdb.c
@@ -102,8 +102,7 @@ static tdb_off_t tdb_find(struct tdb_context *tdb, TDB_DATA key, uint32_t hash,
 }
 
 /* As tdb_find, but if you succeed, keep the lock */
-tdb_off_t tdb_find_lock_hash(struct tdb_context *tdb, TDB_DATA key, 
-							 uint32_t hash, int locktype,
+tdb_off_t tdb_find_lock_hash(struct tdb_context *tdb, TDB_DATA key, uint32_t hash, int locktype,
 			   struct list_struct *rec)
 {
 	uint32_t rec_ptr;
@@ -237,14 +236,15 @@ int tdb_exists(struct tdb_context *tdb, TDB_DATA key)
 }
 
 /* actually delete an entry in the database given the offset */
-int tdb_do_delete(struct tdb_context *tdb, tdb_off_t rec_ptr, struct list_struct*rec)
+int tdb_do_delete(struct tdb_context *tdb, tdb_off_t rec_ptr, struct list_struct *rec)
 {
 	tdb_off_t last_ptr, i;
 	struct list_struct lastrec;
 
 	if (tdb->read_only || tdb->traverse_read) return -1;
 
-	if (tdb_write_lock_record(tdb, rec_ptr) == -1) {
+	if (tdb->traverse_write != 0 || 
+	    tdb_write_lock_record(tdb, rec_ptr) == -1) {
 		/* Someone traversing here: mark it as dead */
 		rec->magic = TDB_DEAD_MAGIC;
 		return tdb_rec_write(tdb, rec_ptr, rec);
@@ -666,6 +666,16 @@ int tdb_get_flags(struct tdb_context *tdb)
 	return tdb->flags;
 }
 
+void tdb_add_flags(struct tdb_context *tdb, unsigned flags)
+{
+	tdb->flags |= flags;
+}
+
+void tdb_remove_flags(struct tdb_context *tdb, unsigned flags)
+{
+	tdb->flags &= ~flags;
+}
+
 
 /*
   enable sequence number handling on an open tdb
@@ -674,3 +684,104 @@ void tdb_enable_seqnum(struct tdb_context *tdb)
 {
 	tdb->flags |= TDB_SEQNUM;
 }
+
+
+/*
+  wipe the entire database, deleting all records. This can be done
+  very fast by using a global lock. The entire data portion of the
+  file becomes a single entry in the freelist.
+ */
+int tdb_wipe_all(struct tdb_context *tdb)
+{
+	int i;
+	tdb_off_t offset = 0;
+	ssize_t data_len;
+
+	if (tdb_lockall(tdb) != 0) {
+		return -1;
+	}
+
+	/* wipe the hashes */
+	for (i=0;i<tdb->header.hash_size;i++) {
+		if (tdb_ofs_write(tdb, TDB_HASH_TOP(i), &offset) == -1) {
+			TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to write hash %d\n", i));
+			goto failed;
+		}
+	}
+
+	/* wipe the freelist */
+	if (tdb_ofs_write(tdb, FREELIST_TOP, &offset) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to write freelist\n"));
+		goto failed;
+	}
+
+	if (tdb_ofs_write(tdb, TDB_RECOVERY_HEAD, &offset) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to write recovery head\n"));
+		goto failed;		
+	}
+
+	/* add all the rest of the file to the freelist */
+	data_len = (tdb->map_size - TDB_DATA_START(tdb->header.hash_size)) - sizeof(struct list_struct);
+	if (data_len > 0) {
+		struct list_struct rec;
+		memset(&rec,'\0',sizeof(rec));
+		rec.rec_len = data_len;
+		if (tdb_free(tdb, TDB_DATA_START(tdb->header.hash_size), &rec) == -1) {
+			TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to add free record\n"));
+			goto failed;
+		}
+	}
+
+	if (tdb_unlockall(tdb) != 0) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to unlock\n"));
+		goto failed;
+	}
+
+	return 0;
+
+failed:
+	tdb_unlockall(tdb);
+	return -1;
+}
+
+
+/* 
+   validate the integrity of all tdb hash chains. Useful when debugging
+ */
+int tdb_validate(struct tdb_context *tdb)
+{
+	int h;
+	for (h=-1;h<(int)tdb->header.hash_size;h++) {
+		tdb_off_t rec_ptr;
+		uint32_t count = 0;
+		if (tdb_ofs_read(tdb, TDB_HASH_TOP(h), &rec_ptr) == -1) {
+			TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_validate: failed ofs_read at top of hash %d\n", h));
+			return -1;
+		}
+		while (rec_ptr) {
+			struct list_struct r;
+			tdb_off_t size;
+
+			if (tdb_rec_read(tdb, rec_ptr, &r) == -1) {
+				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_validate: failed rec_read h=%d rec_ptr=%u count=%u\n",
+					 h, rec_ptr, count));
+				return -1;
+			}
+			if (tdb_ofs_read(tdb, rec_ptr + sizeof(r) + r.rec_len - sizeof(tdb_off_t), &size) == -1) {
+				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_validate: failed ofs_read h=%d rec_ptr=%u count=%u\n",
+					 h, rec_ptr, count));
+				return -1;
+			}
+			if (size != r.rec_len + sizeof(r)) {
+				TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_validate: failed size check size=%u h=%d rec_ptr=%u count=%u\n",
+					 size, h, rec_ptr, count));
+				return -1;
+			}
+			rec_ptr = r.next;
+			count++;
+		}		
+	}
+	return 0;
+}
+
+
diff --git a/source4/lib/tdb/common/tdb_private.h b/source4/lib/tdb/common/tdb_private.h
index 00bd0eb537..63a6d04e72 100644
--- a/source4/lib/tdb/common/tdb_private.h
+++ b/source4/lib/tdb/common/tdb_private.h
@@ -38,6 +38,10 @@
 typedef uint32_t tdb_len_t;
 typedef uint32_t tdb_off_t;
 
+#ifndef offsetof
+#define offsetof(t,f) ((unsigned int)&((t *)0)->f)
+#endif
+
 #define TDB_MAGIC_FOOD "TDB file\n"
 #define TDB_VERSION (0x26011967 + 6)
 #define TDB_MAGIC (0x26011999U)
@@ -54,7 +58,7 @@ typedef uint32_t tdb_off_t;
 #define TDB_BAD_MAGIC(r) ((r)->magic != TDB_MAGIC && !TDB_DEAD(r))
 #define TDB_HASH_TOP(hash) (FREELIST_TOP + (BUCKET(hash)+1)*sizeof(tdb_off_t))
 #define TDB_HASHTABLE_SIZE(tdb) ((tdb->header.hash_size+1)*sizeof(tdb_off_t))
-#define TDB_DATA_START(hash_size) TDB_HASH_TOP(hash_size-1)
+#define TDB_DATA_START(hash_size) (TDB_HASH_TOP(hash_size-1) + sizeof(tdb_off_t))
 #define TDB_RECOVERY_HEAD offsetof(struct tdb_header, recovery_start)
 #define TDB_SEQNUM_OFS    offsetof(struct tdb_header, sequence_number)
 #define TDB_PAD_BYTE 0x42
@@ -144,6 +148,7 @@ struct tdb_context {
 	tdb_len_t map_size; /* how much space has been mapped */
 	int read_only; /* opened read-only */
 	int traverse_read; /* read-only traversal */
+	int traverse_write; /* read-write traversal */
 	struct tdb_lock_type global_lock;
 	int num_lockrecs;
 	struct tdb_lock_type *lockrecs; /* only real locks, all with count>0 */
diff --git a/source4/lib/tdb/common/transaction.c b/source4/lib/tdb/common/transaction.c
index 7eaacf7a16..0ecfb9b7ff 100644
--- a/source4/lib/tdb/common/transaction.c
+++ b/source4/lib/tdb/common/transaction.c
@@ -87,12 +87,6 @@
 
 */
 
-struct tdb_transaction_el {
-	struct tdb_transaction_el *next, *prev;
-	tdb_off_t offset;
-	tdb_len_t length;
-	unsigned char *data;
-};
 
 /*
   hold the context of any current transaction
@@ -105,12 +99,12 @@ struct tdb_transaction {
 	/* the original io methods - used to do IOs to the real db */
 	const struct tdb_methods *io_methods;
 
-	/* the list of transaction elements. We use a doubly linked
-	   list with a last pointer to allow us to keep the list
-	   ordered, with first element at the front of the list. It
-	   needs to be doubly linked as the read/write traversals need
-	   to be backwards, while the commit needs to be forwards */
-	struct tdb_transaction_el *elements, *elements_last;
+	/* the list of transaction blocks. When a block is first
+	   written to, it gets created in this list */
+	uint8_t **blocks;
+	uint32_t num_blocks;
+	uint32_t block_size;      /* bytes in each block */
+	uint32_t last_block_size; /* number of valid bytes in the last block */
 
 	/* non-zero when an internal transaction error has
 	   occurred. All write operations will then fail until the
@@ -134,52 +128,48 @@ struct tdb_transaction {
 static int transaction_read(struct tdb_context *tdb, tdb_off_t off, void *buf, 
 			    tdb_len_t len, int cv)
 {
-	struct tdb_transaction_el *el;
-
-	/* we need to walk the list backwards to get the most recent data */
-	for (el=tdb->transaction->elements_last;el;el=el->prev) {
-		tdb_len_t partial;
+	uint32_t blk;
 
-		if (off+len <= el->offset) {
-			continue;
-		}
-		if (off >= el->offset + el->length) {
-			continue;
+	/* break it down into block sized ops */
+	while (len + (off % tdb->transaction->block_size) > tdb->transaction->block_size) {
+		tdb_len_t len2 = tdb->transaction->block_size - (off % tdb->transaction->block_size);
+		if (transaction_read(tdb, off, buf, len2, cv) != 0) {
+			return -1;
 		}
+		len -= len2;
+		off += len2;
+		buf = (void *)(len2 + (char *)buf);
+	}
 
-		/* an overlapping read - needs to be split into up to
-		   2 reads and a memcpy */
-		if (off < el->offset) {
-			partial = el->offset - off;
-			if (transaction_read(tdb, off, buf, partial, cv) != 0) {
-				goto fail;
-			}
-			len -= partial;
-			off += partial;
-			buf = (void *)(partial + (char *)buf);
-		}
-		if (off + len <= el->offset + el->length) {
-			partial = len;
-		} else {
-			partial = el->offset + el->length - off;
-		}
-		memcpy(buf, el->data + (off - el->offset), partial);
-		if (cv) {
-			tdb_convert(buf, len);
-		}
-		len -= partial;
-		off += partial;
-		buf = (void *)(partial + (char *)buf);
-		
-		if (len != 0 && transaction_read(tdb, off, buf, len, cv) != 0) {
+	if (len == 0) {
+		return 0;
+	}
+
+	blk = off / tdb->transaction->block_size;
+
+	/* see if we have it in the block list */
+	if (tdb->transaction->num_blocks <= blk ||
+	    tdb->transaction->blocks[blk] == NULL) {
+		/* nope, do a real read */
+		if (tdb->transaction->io_methods->tdb_read(tdb, off, buf, len, cv) != 0) {
 			goto fail;
 		}
-
 		return 0;
 	}
 
-	/* its not in the transaction elements - do a real read */
-	return tdb->transaction->io_methods->tdb_read(tdb, off, buf, len, cv);
+	/* it is in the block list. Now check for the last block */
+	if (blk == tdb->transaction->num_blocks-1) {
+		if (len > tdb->transaction->last_block_size) {
+			goto fail;
+		}
+	}
+	
+	/* now copy it out of this block */
+	memcpy(buf, tdb->transaction->blocks[blk] + (off % tdb->transaction->block_size), len);
+	if (cv) {
+		tdb_convert(buf, len);
+	}
+	return 0;
 
 fail:
 	TDB_LOG((tdb, TDB_DEBUG_FATAL, "transaction_read: failed at off=%d len=%d\n", off, len));
@@ -195,12 +185,8 @@ fail:
 static int transaction_write(struct tdb_context *tdb, tdb_off_t off, 
 			     const void *buf, tdb_len_t len)
 {
-	struct tdb_transaction_el *el, *best_el=NULL;
+	uint32_t blk;
 
-	if (len == 0) {
-		return 0;
-	}
-	
 	/* if the write is to a hash head, then update the transaction
 	   hash heads */
 	if (len == sizeof(tdb_off_t) && off >= FREELIST_TOP &&
@@ -209,110 +195,149 @@ static int transaction_write(struct tdb_context *tdb, tdb_off_t off,
 		memcpy(&tdb->transaction->hash_heads[chain], buf, len);
 	}
 
-	/* first see if we can replace an existing entry */
-	for (el=tdb->transaction->elements_last;el;el=el->prev) {
-		tdb_len_t partial;
-
-		if (best_el == NULL && off == el->offset+el->length) {
-			best_el = el;
-		}
-
-		if (off+len <= el->offset) {
-			continue;
+	/* break it up into block sized chunks */
+	while (len + (off % tdb->transaction->block_size) > tdb->transaction->block_size) {
+		tdb_len_t len2 = tdb->transaction->block_size - (off % tdb->transaction->block_size);
+		if (transaction_write(tdb, off, buf, len2) != 0) {
+			return -1;
 		}
-		if (off >= el->offset + el->length) {
-			continue;
+		len -= len2;
+		off += len2;
+		if (buf != NULL) {
+			buf = (const void *)(len2 + (const char *)buf);
 		}
+	}
 
-		/* an overlapping write - needs to be split into up to
-		   2 writes and a memcpy */
-		if (off < el->offset) {
-			partial = el->offset - off;
-			if (transaction_write(tdb, off, buf, partial) != 0) {
-				goto fail;
-			}
-			len -= partial;
-			off += partial;
-			buf = (const void *)(partial + (const char *)buf);
-		}
-		if (off + len <= el->offset + el->length) {
-			partial = len;
+	if (len == 0) {
+		return 0;
+	}
+
+	blk = off / tdb->transaction->block_size;
+	off = off % tdb->transaction->block_size;
+
+	if (tdb->transaction->num_blocks <= blk) {
+		uint8_t **new_blocks;
+		/* expand the blocks array */
+		if (tdb->transaction->blocks == NULL) {
+			new_blocks = malloc((blk+1)*sizeof(uint8_t *));
 		} else {
-			partial = el->offset + el->length - off;
+			new_blocks = realloc(tdb->transaction->blocks, (blk+1)*sizeof(uint8_t *));
 		}
-		memcpy(el->data + (off - el->offset), buf, partial);
-		len -= partial;
-		off += partial;
-		buf = (const void *)(partial + (const char *)buf);
-		
-		if (len != 0 && transaction_write(tdb, off, buf, len) != 0) {
+		if (new_blocks == NULL) {
+			tdb->ecode = TDB_ERR_OOM;
 			goto fail;
 		}
-
-		return 0;
+		memset(&new_blocks[tdb->transaction->num_blocks], 0, 
+		       (1+(blk - tdb->transaction->num_blocks))*sizeof(uint8_t *));
+		tdb->transaction->blocks = new_blocks;
+		tdb->transaction->num_blocks = blk+1;
+		tdb->transaction->last_block_size = 0;
 	}
 
-	/* see if we can append the new entry to an existing entry */
-	if (best_el && best_el->offset + best_el->length == off && 
-	    (off+len < tdb->transaction->old_map_size ||
-	     off > tdb->transaction->old_map_size)) {
-		unsigned char *data = best_el->data;
-		el = best_el;
-		el->data = (unsigned char *)realloc(el->data,
-						    el->length + len);
-		if (el->data == NULL) {
+	/* allocate and fill a block? */
+	if (tdb->transaction->blocks[blk] == NULL) {
+		tdb->transaction->blocks[blk] = (uint8_t *)calloc(tdb->transaction->block_size, 1);
+		if (tdb->transaction->blocks[blk] == NULL) {
 			tdb->ecode = TDB_ERR_OOM;
 			tdb->transaction->transaction_error = 1;
-			el->data = data;
+			return -1;			
+		}
+		if (tdb->transaction->old_map_size > blk * tdb->transaction->block_size) {
+			tdb_len_t len2 = tdb->transaction->block_size;
+			if (len2 + (blk * tdb->transaction->block_size) > tdb->transaction->old_map_size) {
+				len2 = tdb->transaction->old_map_size - (blk * tdb->transaction->block_size);
+			}
+			if (tdb->transaction->io_methods->tdb_read(tdb, blk * tdb->transaction->block_size, 
+								   tdb->transaction->blocks[blk], 
+								   len2, 0) != 0) {
+				SAFE_FREE(tdb->transaction->blocks[blk]);				
+				tdb->ecode = TDB_ERR_IO;
+				goto fail;
+			}
+			if (blk == tdb->transaction->num_blocks-1) {
+				tdb->transaction->last_block_size = len2;
+			}			
+		}
+	}
+	
+	/* overwrite part of an existing block */
+	if (buf == NULL) {
+		memset(tdb->transaction->blocks[blk] + off, 0, len);
+	} else {
+		memcpy(tdb->transaction->blocks[blk] + off, buf, len);
+	}
+	if (blk == tdb->transaction->num_blocks-1) {
+		if (len + off > tdb->transaction->last_block_size) {
+			tdb->transaction->last_block_size = len + off;
+		}
+	}
+
+	return 0;
+
+fail:
+	TDB_LOG((tdb, TDB_DEBUG_FATAL, "transaction_write: failed at off=%d len=%d\n", 
+		 (blk*tdb->transaction->block_size) + off, len));
+	tdb->transaction->transaction_error = 1;
+	return -1;
+}
+
+
+/*
+  write while in a transaction - this varient never expands the transaction blocks, it only
+  updates existing blocks. This means it cannot change the recovery size
+*/
+static int transaction_write_existing(struct tdb_context *tdb, tdb_off_t off, 
+				      const void *buf, tdb_len_t len)
+{
+	uint32_t blk;
+
+	/* break it up into block sized chunks */
+	while (len + (off % tdb->transaction->block_size) > tdb->transaction->block_size) {
+		tdb_len_t len2 = tdb->transaction->block_size - (off % tdb->transaction->block_size);
+		if (transaction_write_existing(tdb, off, buf, len2) != 0) {
 			return -1;
 		}
-		if (buf) {
-			memcpy(el->data + el->length, buf, len);
-		} else {
-			memset(el->data + el->length, TDB_PAD_BYTE, len);
+		len -= len2;
+		off += len2;
+		if (buf != NULL) {
+			buf = (const void *)(len2 + (const char *)buf);
 		}
-		el->length += len;
-		return 0;
 	}
 
-	/* add a new entry at the end of the list */
-	el = (struct tdb_transaction_el *)malloc(sizeof(*el));
-	if (el == NULL) {
-		tdb->ecode = TDB_ERR_OOM;
-		tdb->transaction->transaction_error = 1;		
-		return -1;
+	if (len == 0) {
+		return 0;
 	}
-	el->next = NULL;
-	el->prev = tdb->transaction->elements_last;
-	el->offset = off;
-	el->length = len;
-	el->data = (unsigned char *)malloc(len);
-	if (el->data == NULL) {
-		free(el);
-		tdb->ecode = TDB_ERR_OOM;
-		tdb->transaction->transaction_error = 1;		
-		return -1;
+
+	blk = off / tdb->transaction->block_size;
+	off = off % tdb->transaction->block_size;
+
+	if (tdb->transaction->num_blocks <= blk ||
+	    tdb->transaction->blocks[blk] == NULL) {
+		return 0;
 	}
-	if (buf) {
-		memcpy(el->data, buf, len);
+
+	/* overwrite part of an existing block */
+	if (buf == NULL) {
+		memset(tdb->transaction->blocks[blk] + off, 0, len);
 	} else {
-		memset(el->data, TDB_PAD_BYTE, len);
+		memcpy(tdb->transaction->blocks[blk] + off, buf, len);
 	}
-	if (el->prev) {
-		el->prev->next = el;
-	} else {
-		tdb->transaction->elements = el;
+	if (blk == tdb->transaction->num_blocks-1) {
+		if (len + off > tdb->transaction->last_block_size) {
+			tdb->transaction->last_block_size = len + off;
+		}
 	}
-	tdb->transaction->elements_last = el;
+
 	return 0;
 
 fail:
-	TDB_LOG((tdb, TDB_DEBUG_FATAL, "transaction_write: failed at off=%d len=%d\n", off, len));
-	tdb->ecode = TDB_ERR_IO;
+	TDB_LOG((tdb, TDB_DEBUG_FATAL, "transaction_write: failed at off=%d len=%d\n", 
+		 (blk*tdb->transaction->block_size) + off, len));
 	tdb->transaction->transaction_error = 1;
 	return -1;
 }
 
+
 /*
   accelerated hash chain head search, using the cached hash heads
 */
@@ -419,10 +444,14 @@ int tdb_transaction_start(struct tdb_context *tdb)
 		return -1;
 	}
 
+	/* a page at a time seems like a reasonable compromise between compactness and efficiency */
+	tdb->transaction->block_size = tdb->page_size;
+
 	/* get the transaction write lock. This is a blocking lock. As
 	   discussed with Volker, there are a number of ways we could
 	   make this async, which we will probably do in the future */
 	if (tdb_transaction_lock(tdb, F_WRLCK) == -1) {
+		SAFE_FREE(tdb->transaction->blocks);
 		SAFE_FREE(tdb->transaction);
 		return -1;
 	}
@@ -460,21 +489,12 @@ int tdb_transaction_start(struct tdb_context *tdb)
 	tdb->transaction->io_methods = tdb->methods;
 	tdb->methods = &transaction_methods;
 
-	/* by calling this transaction write here, we ensure that we don't grow the
-	   transaction linked list due to hash table updates */
-	if (transaction_write(tdb, FREELIST_TOP, tdb->transaction->hash_heads, 
-			      TDB_HASHTABLE_SIZE(tdb)) != 0) {
-		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_start: failed to prime hash table\n"));
-		tdb->ecode = TDB_ERR_IO;
-		tdb->methods = tdb->transaction->io_methods;
-		goto fail;
-	}
-
 	return 0;
 	
 fail:
 	tdb_brlock(tdb, FREELIST_TOP, F_UNLCK, F_SETLKW, 0, 0);
 	tdb_transaction_unlock(tdb);
+	SAFE_FREE(tdb->transaction->blocks);
 	SAFE_FREE(tdb->transaction->hash_heads);
 	SAFE_FREE(tdb->transaction);
 	return -1;
@@ -486,6 +506,8 @@ fail:
 */
 int tdb_transaction_cancel(struct tdb_context *tdb)
 {	
+	int i;
+
 	if (tdb->transaction == NULL) {
 		TDB_LOG((tdb, TDB_DEBUG_ERROR, "tdb_transaction_cancel: no transaction\n"));
 		return -1;
@@ -499,13 +521,13 @@ int tdb_transaction_cancel(struct tdb_context *tdb)
 
 	tdb->map_size = tdb->transaction->old_map_size;
 
-	/* free all the transaction elements */
-	while (tdb->transaction->elements) {
-		struct tdb_transaction_el *el = tdb->transaction->elements;
-		tdb->transaction->elements = el->next;
-		free(el->data);
-		free(el);
+	/* free all the transaction blocks */
+	for (i=0;i<tdb->transaction->num_blocks;i++) {
+		if (tdb->transaction->blocks[i] != NULL) {
+			free(tdb->transaction->blocks[i]);
+		}
 	}
+	SAFE_FREE(tdb->transaction->blocks);
 
 	/* remove any global lock created during the transaction */
 	if (tdb->global_lock.count != 0) {
@@ -515,7 +537,6 @@ int tdb_transaction_cancel(struct tdb_context *tdb)
 
 	/* remove any locks created during the transaction */
 	if (tdb->num_locks != 0) {
-		int i;
 		for (i=0;i<tdb->num_lockrecs;i++) {
 			tdb_brlock(tdb,FREELIST_TOP+4*tdb->lockrecs[i].list,
 				   F_UNLCK,F_SETLKW, 0, 1);
@@ -567,16 +588,24 @@ static int transaction_sync(struct tdb_context *tdb, tdb_off_t offset, tdb_len_t
 */
 static tdb_len_t tdb_recovery_size(struct tdb_context *tdb)
 {
-	struct tdb_transaction_el *el;
 	tdb_len_t recovery_size = 0;
+	int i;
 
 	recovery_size = sizeof(uint32_t);
-	for (el=tdb->transaction->elements;el;el=el->next) {
-		if (el->offset >= tdb->transaction->old_map_size) {
+	for (i=0;i<tdb->transaction->num_blocks;i++) {
+		if (i * tdb->transaction->block_size >= tdb->transaction->old_map_size) {
+			break;
+		}
+		if (tdb->transaction->blocks[i] == NULL) {
 			continue;
 		}
-		recovery_size += 2*sizeof(tdb_off_t) + el->length;
-	}
+		recovery_size += 2*sizeof(tdb_off_t);
+		if (i == tdb->transaction->num_blocks-1) {
+			recovery_size += tdb->transaction->last_block_size;
+		} else {
+			recovery_size += tdb->transaction->block_size;
+		}
+	}	
 
 	return recovery_size;
 }
@@ -658,6 +687,10 @@ static int tdb_recovery_allocate(struct tdb_context *tdb,
 		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_recovery_allocate: failed to write recovery head\n"));
 		return -1;
 	}
+	if (transaction_write_existing(tdb, TDB_RECOVERY_HEAD, &recovery_head, sizeof(tdb_off_t)) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_recovery_allocate: failed to write recovery head\n"));
+		return -1;
+	}
 
 	return 0;
 }
@@ -669,7 +702,6 @@ static int tdb_recovery_allocate(struct tdb_context *tdb,
 static int transaction_setup_recovery(struct tdb_context *tdb, 
 				      tdb_off_t *magic_offset)
 {
-	struct tdb_transaction_el *el;
 	tdb_len_t recovery_size;
 	unsigned char *data, *p;
 	const struct tdb_methods *methods = tdb->transaction->io_methods;
@@ -677,6 +709,7 @@ static int transaction_setup_recovery(struct tdb_context *tdb,
 	tdb_off_t recovery_offset, recovery_max_size;
 	tdb_off_t old_map_size = tdb->transaction->old_map_size;
 	uint32_t magic, tailer;
+	int i;
 
 	/*
 	  check that the recovery area has enough space
@@ -704,30 +737,43 @@ static int transaction_setup_recovery(struct tdb_context *tdb,
 	/* build the recovery data into a single blob to allow us to do a single
 	   large write, which should be more efficient */
 	p = data + sizeof(*rec);
-	for (el=tdb->transaction->elements;el;el=el->next) {
-		if (el->offset >= old_map_size) {
+	for (i=0;i<tdb->transaction->num_blocks;i++) {
+		tdb_off_t offset;
+		tdb_len_t length;
+
+		if (tdb->transaction->blocks[i] == NULL) {
+			continue;
+		}
+
+		offset = i * tdb->transaction->block_size;
+		length = tdb->transaction->block_size;
+		if (i == tdb->transaction->num_blocks-1) {
+			length = tdb->transaction->last_block_size;
+		}
+		
+		if (offset >= old_map_size) {
 			continue;
 		}
-		if (el->offset + el->length > tdb->transaction->old_map_size) {
+		if (offset + length > tdb->transaction->old_map_size) {
 			TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_setup_recovery: transaction data over new region boundary\n"));
 			free(data);
 			tdb->ecode = TDB_ERR_CORRUPT;
 			return -1;
 		}
-		memcpy(p, &el->offset, 4);
-		memcpy(p+4, &el->length, 4);
+		memcpy(p, &offset, 4);
+		memcpy(p+4, &length, 4);
 		if (DOCONV()) {
 			tdb_convert(p, 8);
 		}
 		/* the recovery area contains the old data, not the
 		   new data, so we have to call the original tdb_read
 		   method to get it */
-		if (methods->tdb_read(tdb, el->offset, p + 8, el->length, 0) != 0) {
+		if (methods->tdb_read(tdb, offset, p + 8, length, 0) != 0) {
 			free(data);
 			tdb->ecode = TDB_ERR_IO;
 			return -1;
 		}
-		p += 8 + el->length;
+		p += 8 + length;
 	}
 
 	/* and the tailer */
@@ -742,6 +788,12 @@ static int transaction_setup_recovery(struct tdb_context *tdb,
 		tdb->ecode = TDB_ERR_IO;
 		return -1;
 	}
+	if (transaction_write_existing(tdb, recovery_offset, data, sizeof(*rec) + recovery_size) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_setup_recovery: failed to write secondary recovery data\n"));
+		free(data);
+		tdb->ecode = TDB_ERR_IO;
+		return -1;
+	}
 
 	/* as we don't have ordered writes, we have to sync the recovery
 	   data before we update the magic to indicate that the recovery
@@ -763,6 +815,11 @@ static int transaction_setup_recovery(struct tdb_context *tdb,
 		tdb->ecode = TDB_ERR_IO;
 		return -1;
 	}
+	if (transaction_write_existing(tdb, *magic_offset, &magic, sizeof(magic)) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_setup_recovery: failed to write secondary recovery magic\n"));
+		tdb->ecode = TDB_ERR_IO;
+		return -1;
+	}
 
 	/* ensure the recovery magic marker is on disk */
 	if (transaction_sync(tdb, *magic_offset, sizeof(magic)) == -1) {
@@ -780,6 +837,7 @@ int tdb_transaction_commit(struct tdb_context *tdb)
 	const struct tdb_methods *methods;
 	tdb_off_t magic_offset = 0;
 	uint32_t zero = 0;
+	int i;
 
 	if (tdb->transaction == NULL) {
 		TDB_LOG((tdb, TDB_DEBUG_ERROR, "tdb_transaction_commit: no transaction\n"));
@@ -793,13 +851,14 @@ int tdb_transaction_commit(struct tdb_context *tdb)
 		return -1;
 	}
 
+
 	if (tdb->transaction->nesting != 0) {
 		tdb->transaction->nesting--;
 		return 0;
 	}		
 
 	/* check for a null transaction */
-	if (tdb->transaction->elements == NULL) {
+	if (tdb->transaction->blocks == NULL) {
 		tdb_transaction_cancel(tdb);
 		return 0;
 	}
@@ -858,10 +917,21 @@ int tdb_transaction_commit(struct tdb_context *tdb)
 	}
 
 	/* perform all the writes */
-	while (tdb->transaction->elements) {
-		struct tdb_transaction_el *el = tdb->transaction->elements;
+	for (i=0;i<tdb->transaction->num_blocks;i++) {
+		tdb_off_t offset;
+		tdb_len_t length;
 
-		if (methods->tdb_write(tdb, el->offset, el->data, el->length) == -1) {
+		if (tdb->transaction->blocks[i] == NULL) {
+			continue;
+		}
+
+		offset = i * tdb->transaction->block_size;
+		length = tdb->transaction->block_size;
+		if (i == tdb->transaction->num_blocks-1) {
+			length = tdb->transaction->last_block_size;
+		}
+
+		if (methods->tdb_write(tdb, offset, tdb->transaction->blocks[i], length) == -1) {
 			TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_commit: write failed during commit\n"));
 			
 			/* we've overwritten part of the data and
@@ -876,11 +946,12 @@ int tdb_transaction_commit(struct tdb_context *tdb)
 			TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_transaction_commit: write failed\n"));
 			return -1;
 		}
-		tdb->transaction->elements = el->next;
-		free(el->data); 
-		free(el);
+		SAFE_FREE(tdb->transaction->blocks[i]);
 	} 
 
+	SAFE_FREE(tdb->transaction->blocks);
+	tdb->transaction->num_blocks = 0;
+
 	if (!(tdb->flags & TDB_NOSYNC)) {
 		/* ensure the new data is on disk */
 		if (transaction_sync(tdb, 0, tdb->map_size) == -1) {
@@ -919,6 +990,7 @@ int tdb_transaction_commit(struct tdb_context *tdb)
 	/* use a transaction cancel to free memory and remove the
 	   transaction locks */
 	tdb_transaction_cancel(tdb);
+
 	return 0;
 }
 
diff --git a/source4/lib/tdb/common/traverse.c b/source4/lib/tdb/common/traverse.c
index 6fc576a55a..2bde1270a0 100644
--- a/source4/lib/tdb/common/traverse.c
+++ b/source4/lib/tdb/common/traverse.c
@@ -238,7 +238,9 @@ int tdb_traverse(struct tdb_context *tdb,
 		return -1;
 	}
 
+	tdb->traverse_write++;
 	ret = tdb_traverse_internal(tdb, fn, private_data, &tl);
+	tdb->traverse_write--;
 
 	tdb_transaction_unlock(tdb);
 
@@ -330,3 +332,4 @@ TDB_DATA tdb_nextkey(struct tdb_context *tdb, TDB_DATA oldkey)
 		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_nextkey: WARNING tdb_unlock failed!\n"));
 	return key;
 }
+
diff --git a/source4/lib/tdb/include/tdb.h b/source4/lib/tdb/include/tdb.h
index 7de4c419a8..0058d55793 100644
--- a/source4/lib/tdb/include/tdb.h
+++ b/source4/lib/tdb/include/tdb.h
@@ -135,6 +135,8 @@ int tdb_get_seqnum(struct tdb_context *tdb);
 int tdb_hash_size(struct tdb_context *tdb);
 size_t tdb_map_size(struct tdb_context *tdb);
 int tdb_get_flags(struct tdb_context *tdb);
+void tdb_add_flags(struct tdb_context *tdb, unsigned flag);
+void tdb_remove_flags(struct tdb_context *tdb, unsigned flag);
 void tdb_enable_seqnum(struct tdb_context *tdb);
 void tdb_increment_seqnum_nonblock(struct tdb_context *tdb);
 
@@ -153,6 +155,9 @@ void tdb_setalarm_sigptr(struct tdb_context *tdb, volatile sig_atomic_t *sigptr)
 void tdb_dump_all(struct tdb_context *tdb);
 int tdb_printfreelist(struct tdb_context *tdb);
 int tdb_validate_freelist(struct tdb_context *tdb, int *pnum_entries);
+int tdb_wipe_all(struct tdb_context *tdb);
+int tdb_freelist_size(struct tdb_context *tdb);
+int tdb_validate(struct tdb_context *tdb);
 
 extern TDB_DATA tdb_null;
 
diff --git a/source4/lib/util/asn1.c b/source4/lib/util/asn1.c
new file mode 100644
index 0000000000..4756c0640d
--- /dev/null
+++ b/source4/lib/util/asn1.c
@@ -0,0 +1,770 @@
+/* 
+   Unix SMB/CIFS implementation.
+   simple ASN1 routines
+   Copyright (C) Andrew Tridgell 2001
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "lib/util/asn1.h"
+
+/* allocate an asn1 structure */
+struct asn1_data *asn1_init(TALLOC_CTX *mem_ctx)
+{
+	struct asn1_data *ret = talloc_zero(mem_ctx, struct asn1_data);
+	if (ret == NULL) {
+		DEBUG(0,("asn1_init failed! out of memory\n"));
+	}
+	return ret;
+}
+
+/* free an asn1 structure */
+void asn1_free(struct asn1_data *data)
+{
+	talloc_free(data);
+}
+
+/* write to the ASN1 buffer, advancing the buffer pointer */
+bool asn1_write(struct asn1_data *data, const void *p, int len)
+{
+	if (data->has_error) return false;
+	if (data->length < data->ofs+len) {
+		uint8_t *newp;
+		newp = talloc_realloc(data, data->data, uint8_t, data->ofs+len);
+		if (!newp) {
+			asn1_free(data);
+			data->has_error = true;
+			return false;
+		}
+		data->data = newp;
+		data->length = data->ofs+len;
+	}
+	memcpy(data->data + data->ofs, p, len);
+	data->ofs += len;
+	return true;
+}
+
+/* useful fn for writing a uint8_t */
+bool asn1_write_uint8(struct asn1_data *data, uint8_t v)
+{
+	return asn1_write(data, &v, 1);
+}
+
+/* push a tag onto the asn1 data buffer. Used for nested structures */
+bool asn1_push_tag(struct asn1_data *data, uint8_t tag)
+{
+	struct nesting *nesting;
+
+	asn1_write_uint8(data, tag);
+	nesting = talloc(data, struct nesting);
+	if (!nesting) {
+		data->has_error = true;
+		return false;
+	}
+
+	nesting->start = data->ofs;
+	nesting->next = data->nesting;
+	data->nesting = nesting;
+	return asn1_write_uint8(data, 0xff);
+}
+
+/* pop a tag */
+bool asn1_pop_tag(struct asn1_data *data)
+{
+	struct nesting *nesting;
+	size_t len;
+
+	nesting = data->nesting;
+
+	if (!nesting) {
+		data->has_error = true;
+		return false;
+	}
+	len = data->ofs - (nesting->start+1);
+	/* yes, this is ugly. We don't know in advance how many bytes the length
+	   of a tag will take, so we assumed 1 byte. If we were wrong then we 
+	   need to correct our mistake */
+	if (len > 0xFFFFFF) {
+		data->data[nesting->start] = 0x84;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		memmove(data->data+nesting->start+5, data->data+nesting->start+1, len);
+		data->data[nesting->start+1] = (len>>24) & 0xFF;
+		data->data[nesting->start+2] = (len>>16) & 0xFF;
+		data->data[nesting->start+3] = (len>>8) & 0xFF;
+		data->data[nesting->start+4] = len&0xff;
+	} else if (len > 0xFFFF) {
+		data->data[nesting->start] = 0x83;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		memmove(data->data+nesting->start+4, data->data+nesting->start+1, len);
+		data->data[nesting->start+1] = (len>>16) & 0xFF;
+		data->data[nesting->start+2] = (len>>8) & 0xFF;
+		data->data[nesting->start+3] = len&0xff;
+	} else if (len > 255) {
+		data->data[nesting->start] = 0x82;
+		if (!asn1_write_uint8(data, 0)) return false;
+		if (!asn1_write_uint8(data, 0)) return false;
+		memmove(data->data+nesting->start+3, data->data+nesting->start+1, len);
+		data->data[nesting->start+1] = len>>8;
+		data->data[nesting->start+2] = len&0xff;
+	} else if (len > 127) {
+		data->data[nesting->start] = 0x81;
+		if (!asn1_write_uint8(data, 0)) return false;
+		memmove(data->data+nesting->start+2, data->data+nesting->start+1, len);
+		data->data[nesting->start+1] = len;
+	} else {
+		data->data[nesting->start] = len;
+	}
+
+	data->nesting = nesting->next;
+	talloc_free(nesting);
+	return true;
+}
+
+/* "i" is the one's complement representation, as is the normal result of an
+ * implicit signed->unsigned conversion */
+
+static bool push_int_bigendian(struct asn1_data *data, unsigned int i, bool negative)
+{
+	uint8_t lowest = i & 0xFF;
+
+	i = i >> 8;
+	if (i != 0)
+		if (!push_int_bigendian(data, i, negative))
+			return false;
+
+	if (data->nesting->start+1 == data->ofs) {
+
+		/* We did not write anything yet, looking at the highest
+		 * valued byte */
+
+		if (negative) {
+			/* Don't write leading 0xff's */
+			if (lowest == 0xFF)
+				return true;
+
+			if ((lowest & 0x80) == 0) {
+				/* The only exception for a leading 0xff is if
+				 * the highest bit is 0, which would indicate
+				 * a positive value */
+				if (!asn1_write_uint8(data, 0xff))
+					return false;
+			}
+		} else {
+			if (lowest & 0x80) {
+				/* The highest bit of a positive integer is 1,
+				 * this would indicate a negative number. Push
+				 * a 0 to indicate a positive one */
+				if (!asn1_write_uint8(data, 0))
+					return false;
+			}
+		}
+	}
+
+	return asn1_write_uint8(data, lowest);
+}
+
+/* write an Integer without the tag framing. Needed for example for the LDAP
+ * Abandon Operation */
+
+bool asn1_write_implicit_Integer(struct asn1_data *data, int i)
+{
+	if (i == -1) {
+		/* -1 is special as it consists of all-0xff bytes. In
+                    push_int_bigendian this is the only case that is not
+                    properly handled, as all 0xff bytes would be handled as
+                    leading ones to be ignored. */
+		return asn1_write_uint8(data, 0xff);
+	} else {
+		return push_int_bigendian(data, i, i<0);
+	}
+}
+
+
+/* write an integer */
+bool asn1_write_Integer(struct asn1_data *data, int i)
+{
+	if (!asn1_push_tag(data, ASN1_INTEGER)) return false;
+	if (!asn1_write_implicit_Integer(data, i)) return false;
+	return asn1_pop_tag(data);
+}
+
+bool ber_write_OID_String(DATA_BLOB *blob, const char *OID)
+{
+	uint_t v, v2;
+	const char *p = (const char *)OID;
+	char *newp;
+	int i;
+
+	v = strtoul(p, &newp, 10);
+	if (newp[0] != '.') return false;
+	p = newp + 1;
+
+	v2 = strtoul(p, &newp, 10);
+	if (newp[0] != '.') return false;
+	p = newp + 1;
+
+	/*the ber representation can't use more space then the string one */
+	*blob = data_blob(NULL, strlen(OID));
+	if (!blob->data) return false;
+
+	blob->data[0] = 40*v + v2;
+
+	i = 1;
+	while (*p) {
+		v = strtoul(p, &newp, 10);
+		if (newp[0] == '.') {
+			p = newp + 1;
+		} else if (newp[0] == '\0') {
+			p = newp;
+		} else {
+			data_blob_free(blob);
+			return false;
+		}
+		if (v >= (1<<28)) blob->data[i++] = (0x80 | ((v>>28)&0x7f));
+		if (v >= (1<<21)) blob->data[i++] = (0x80 | ((v>>21)&0x7f));
+		if (v >= (1<<14)) blob->data[i++] = (0x80 | ((v>>14)&0x7f));
+		if (v >= (1<<7)) blob->data[i++] = (0x80 | ((v>>7)&0x7f));
+		blob->data[i++] = (v&0x7f);
+	}
+
+	blob->length = i;
+
+	return true;
+}
+
+/* write an object ID to a ASN1 buffer */
+bool asn1_write_OID(struct asn1_data *data, const char *OID)
+{
+	DATA_BLOB blob;
+
+	if (!asn1_push_tag(data, ASN1_OID)) return false;
+
+	if (!ber_write_OID_String(&blob, OID)) {
+		data->has_error = true;
+		return false;
+	}
+
+	if (!asn1_write(data, blob.data, blob.length)) {
+		data->has_error = true;
+		return false;
+	}
+	data_blob_free(&blob);
+	return asn1_pop_tag(data);
+}
+
+/* write an octet string */
+bool asn1_write_OctetString(struct asn1_data *data, const void *p, size_t length)
+{
+	asn1_push_tag(data, ASN1_OCTET_STRING);
+	asn1_write(data, p, length);
+	asn1_pop_tag(data);
+	return !data->has_error;
+}
+
+/* write a LDAP string */
+bool asn1_write_LDAPString(struct asn1_data *data, const char *s)
+{
+	asn1_write(data, s, strlen(s));
+	return !data->has_error;
+}
+
+/* write a LDAP string from a DATA_BLOB */
+bool asn1_write_DATA_BLOB_LDAPString(struct asn1_data *data, const DATA_BLOB *s)
+{
+	asn1_write(data, s->data, s->length);
+	return !data->has_error;
+}
+
+/* write a general string */
+bool asn1_write_GeneralString(struct asn1_data *data, const char *s)
+{
+	asn1_push_tag(data, ASN1_GENERAL_STRING);
+	asn1_write_LDAPString(data, s);
+	asn1_pop_tag(data);
+	return !data->has_error;
+}
+
+bool asn1_write_ContextSimple(struct asn1_data *data, uint8_t num, DATA_BLOB *blob)
+{
+	asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(num));
+	asn1_write(data, blob->data, blob->length);
+	asn1_pop_tag(data);
+	return !data->has_error;
+}
+
+/* write a BOOLEAN */
+bool asn1_write_BOOLEAN(struct asn1_data *data, bool v)
+{
+	asn1_push_tag(data, ASN1_BOOLEAN);
+	asn1_write_uint8(data, v ? 0xFF : 0);
+	asn1_pop_tag(data);
+	return !data->has_error;
+}
+
+bool asn1_read_BOOLEAN(struct asn1_data *data, bool *v)
+{
+	uint8_t tmp = 0;
+	asn1_start_tag(data, ASN1_BOOLEAN);
+	asn1_read_uint8(data, &tmp);
+	if (tmp == 0xFF) {
+		*v = true;
+	} else {
+		*v = false;
+	}
+	asn1_end_tag(data);
+	return !data->has_error;
+}
+
+/* check a BOOLEAN */
+bool asn1_check_BOOLEAN(struct asn1_data *data, bool v)
+{
+	uint8_t b = 0;
+
+	asn1_read_uint8(data, &b);
+	if (b != ASN1_BOOLEAN) {
+		data->has_error = true;
+		return false;
+	}
+	asn1_read_uint8(data, &b);
+	if (b != v) {
+		data->has_error = true;
+		return false;
+	}
+	return !data->has_error;
+}
+
+
+/* load a struct asn1_data structure with a lump of data, ready to be parsed */
+bool asn1_load(struct asn1_data *data, DATA_BLOB blob)
+{
+	ZERO_STRUCTP(data);
+	data->data = talloc_memdup(data, blob.data, blob.length);
+	if (!data->data) {
+		data->has_error = true;
+		return false;
+	}
+	data->length = blob.length;
+	return true;
+}
+
+/* Peek into an ASN1 buffer, not advancing the pointer */
+bool asn1_peek(struct asn1_data *data, void *p, int len)
+{
+	if (data->has_error)
+		return false;
+
+	if (len < 0 || data->ofs + len < data->ofs || data->ofs + len < len)
+		return false;
+
+	if (data->ofs + len > data->length) {
+		/* we need to mark the buffer as consumed, so the caller knows
+		   this was an out of data error, and not a decode error */
+		data->ofs = data->length;
+		return false;
+	}
+
+	memcpy(p, data->data + data->ofs, len);
+	return true;
+}
+
+/* read from a ASN1 buffer, advancing the buffer pointer */
+bool asn1_read(struct asn1_data *data, void *p, int len)
+{
+	if (!asn1_peek(data, p, len)) {
+		data->has_error = true;
+		return false;
+	}
+
+	data->ofs += len;
+	return true;
+}
+
+/* read a uint8_t from a ASN1 buffer */
+bool asn1_read_uint8(struct asn1_data *data, uint8_t *v)
+{
+	return asn1_read(data, v, 1);
+}
+
+bool asn1_peek_uint8(struct asn1_data *data, uint8_t *v)
+{
+	return asn1_peek(data, v, 1);
+}
+
+bool asn1_peek_tag(struct asn1_data *data, uint8_t tag)
+{
+	uint8_t b;
+
+	if (asn1_tag_remaining(data) <= 0) {
+		return false;
+	}
+
+	if (!asn1_peek_uint8(data, &b))
+		return false;
+
+	return (b == tag);
+}
+
+/* start reading a nested asn1 structure */
+bool asn1_start_tag(struct asn1_data *data, uint8_t tag)
+{
+	uint8_t b;
+	struct nesting *nesting;
+	
+	if (!asn1_read_uint8(data, &b))
+		return false;
+
+	if (b != tag) {
+		data->has_error = true;
+		return false;
+	}
+	nesting = talloc(data, struct nesting);
+	if (!nesting) {
+		data->has_error = true;
+		return false;
+	}
+
+	if (!asn1_read_uint8(data, &b)) {
+		return false;
+	}
+
+	if (b & 0x80) {
+		int n = b & 0x7f;
+		if (!asn1_read_uint8(data, &b))
+			return false;
+		nesting->taglen = b;
+		while (n > 1) {
+			if (!asn1_read_uint8(data, &b)) 
+				return false;
+			nesting->taglen = (nesting->taglen << 8) | b;
+			n--;
+		}
+	} else {
+		nesting->taglen = b;
+	}
+	nesting->start = data->ofs;
+	nesting->next = data->nesting;
+	data->nesting = nesting;
+	if (asn1_tag_remaining(data) == -1) {
+		return false;
+	}
+	return !data->has_error;
+}
+
+/* stop reading a tag */
+bool asn1_end_tag(struct asn1_data *data)
+{
+	struct nesting *nesting;
+
+	/* make sure we read it all */
+	if (asn1_tag_remaining(data) != 0) {
+		data->has_error = true;
+		return false;
+	}
+
+	nesting = data->nesting;
+
+	if (!nesting) {
+		data->has_error = true;
+		return false;
+	}
+
+	data->nesting = nesting->next;
+	talloc_free(nesting);
+	return true;
+}
+
+/* work out how many bytes are left in this nested tag */
+int asn1_tag_remaining(struct asn1_data *data)
+{
+	int remaining;
+	if (data->has_error) {
+		return -1;
+	}
+
+	if (!data->nesting) {
+		data->has_error = true;
+		return -1;
+	}
+	remaining = data->nesting->taglen - (data->ofs - data->nesting->start);
+	if (remaining > (data->length - data->ofs)) {
+		data->has_error = true;
+		return -1;
+	}
+	return remaining;
+}
+
+/* read an object ID from a data blob */
+bool ber_read_OID_String(TALLOC_CTX *mem_ctx, DATA_BLOB blob, const char **OID)
+{
+	int i;
+	uint8_t *b;
+	uint_t v;
+	char *tmp_oid = NULL;
+
+	if (blob.length < 2) return false;
+
+	b = blob.data;
+
+	tmp_oid = talloc_asprintf(mem_ctx, "%u",  b[0]/40);
+	if (!tmp_oid) goto nomem;
+	tmp_oid = talloc_asprintf_append_buffer(tmp_oid, ".%u",  b[0]%40);
+	if (!tmp_oid) goto nomem;
+
+	for(i = 1, v = 0; i < blob.length; i++) {
+		v = (v<<7) | (b[i]&0x7f);
+		if ( ! (b[i] & 0x80)) {
+			tmp_oid = talloc_asprintf_append_buffer(tmp_oid, ".%u",  v);
+			v = 0;
+		}
+		if (!tmp_oid) goto nomem;
+	}
+
+	if (v != 0) {
+		talloc_free(tmp_oid);
+		return false;
+	}
+
+	*OID = tmp_oid;
+	return true;
+
+nomem:	
+	return false;
+}
+
+/* read an object ID from a ASN1 buffer */
+bool asn1_read_OID(struct asn1_data *data, TALLOC_CTX *mem_ctx, const char **OID)
+{
+	DATA_BLOB blob;
+	int len;
+
+	if (!asn1_start_tag(data, ASN1_OID)) return false;
+
+	len = asn1_tag_remaining(data);
+	if (len < 0) {
+		data->has_error = true;
+		return false;
+	}
+
+	blob = data_blob(NULL, len);
+	if (!blob.data) {
+		data->has_error = true;
+		return false;
+	}
+
+	asn1_read(data, blob.data, len);
+	asn1_end_tag(data);
+	if (data->has_error) {
+		data_blob_free(&blob);
+		return false;
+	}
+
+	if (!ber_read_OID_String(mem_ctx, blob, OID)) {
+		data->has_error = true;
+		data_blob_free(&blob);
+		return false;
+	}
+
+	data_blob_free(&blob);
+	return true;
+}
+
+/* check that the next object ID is correct */
+bool asn1_check_OID(struct asn1_data *data, const char *OID)
+{
+	const char *id;
+
+	if (!asn1_read_OID(data, data, &id)) return false;
+
+	if (strcmp(id, OID) != 0) {
+		talloc_free(discard_const(id));
+		data->has_error = true;
+		return false;
+	}
+	talloc_free(discard_const(id));
+	return true;
+}
+
+/* read a LDAPString from a ASN1 buffer */
+bool asn1_read_LDAPString(struct asn1_data *data, TALLOC_CTX *mem_ctx, char **s)
+{
+	int len;
+	len = asn1_tag_remaining(data);
+	if (len < 0) {
+		data->has_error = true;
+		return false;
+	}
+	*s = talloc_array(mem_ctx, char, len+1);
+	if (! *s) {
+		data->has_error = true;
+		return false;
+	}
+	asn1_read(data, *s, len);
+	(*s)[len] = 0;
+	return !data->has_error;
+}
+
+
+/* read a GeneralString from a ASN1 buffer */
+bool asn1_read_GeneralString(struct asn1_data *data, TALLOC_CTX *mem_ctx, char **s)
+{
+	if (!asn1_start_tag(data, ASN1_GENERAL_STRING)) return false;
+	if (!asn1_read_LDAPString(data, mem_ctx, s)) return false;
+	return asn1_end_tag(data);
+}
+
+
+/* read a octet string blob */
+bool asn1_read_OctetString(struct asn1_data *data, TALLOC_CTX *mem_ctx, DATA_BLOB *blob)
+{
+	int len;
+	ZERO_STRUCTP(blob);
+	if (!asn1_start_tag(data, ASN1_OCTET_STRING)) return false;
+	len = asn1_tag_remaining(data);
+	if (len < 0) {
+		data->has_error = true;
+		return false;
+	}
+	*blob = data_blob_talloc(mem_ctx, NULL, len+1);
+	if (!blob->data) {
+		data->has_error = true;
+		return false;
+	}
+	asn1_read(data, blob->data, len);
+	asn1_end_tag(data);
+	blob->length--;
+	blob->data[len] = 0;
+	
+	if (data->has_error) {
+		data_blob_free(blob);
+		*blob = data_blob(NULL, 0);
+		return false;
+	}
+	return true;
+}
+
+bool asn1_read_ContextSimple(struct asn1_data *data, uint8_t num, DATA_BLOB *blob)
+{
+	int len;
+	ZERO_STRUCTP(blob);
+	if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(num))) return false;
+	len = asn1_tag_remaining(data);
+	if (len < 0) {
+		data->has_error = true;
+		return false;
+	}
+	*blob = data_blob(NULL, len);
+	if ((len != 0) && (!blob->data)) {
+		data->has_error = true;
+		return false;
+	}
+	asn1_read(data, blob->data, len);
+	asn1_end_tag(data);
+	return !data->has_error;
+}
+
+/* read an integer without tag*/
+bool asn1_read_implicit_Integer(struct asn1_data *data, int *i)
+{
+	uint8_t b;
+	*i = 0;
+
+	while (!data->has_error && asn1_tag_remaining(data)>0) {
+		if (!asn1_read_uint8(data, &b)) return false;
+		*i = (*i << 8) + b;
+	}
+	return !data->has_error;	
+	
+}
+
+/* read an integer */
+bool asn1_read_Integer(struct asn1_data *data, int *i)
+{
+	*i = 0;
+
+	if (!asn1_start_tag(data, ASN1_INTEGER)) return false;
+	if (!asn1_read_implicit_Integer(data, i)) return false;
+	return asn1_end_tag(data);	
+}
+
+/* read an integer */
+bool asn1_read_enumerated(struct asn1_data *data, int *v)
+{
+	*v = 0;
+	
+	if (!asn1_start_tag(data, ASN1_ENUMERATED)) return false;
+	while (!data->has_error && asn1_tag_remaining(data)>0) {
+		uint8_t b;
+		asn1_read_uint8(data, &b);
+		*v = (*v << 8) + b;
+	}
+	return asn1_end_tag(data);	
+}
+
+/* check a enumerated value is correct */
+bool asn1_check_enumerated(struct asn1_data *data, int v)
+{
+	uint8_t b;
+	if (!asn1_start_tag(data, ASN1_ENUMERATED)) return false;
+	asn1_read_uint8(data, &b);
+	asn1_end_tag(data);
+
+	if (v != b)
+		data->has_error = false;
+
+	return !data->has_error;
+}
+
+/* write an enumerated value to the stream */
+bool asn1_write_enumerated(struct asn1_data *data, uint8_t v)
+{
+	if (!asn1_push_tag(data, ASN1_ENUMERATED)) return false;
+	asn1_write_uint8(data, v);
+	asn1_pop_tag(data);
+	return !data->has_error;
+}
+
+/*
+  check if a ASN.1 blob is a full tag
+*/
+NTSTATUS asn1_full_tag(DATA_BLOB blob, uint8_t tag, size_t *packet_size)
+{
+	struct asn1_data *asn1 = asn1_init(NULL);
+	int size;
+
+	NT_STATUS_HAVE_NO_MEMORY(asn1);
+
+	asn1->data = blob.data;
+	asn1->length = blob.length;
+	asn1_start_tag(asn1, tag);
+	if (asn1->has_error) {
+		talloc_free(asn1);
+		return STATUS_MORE_ENTRIES;
+	}
+	size = asn1_tag_remaining(asn1) + asn1->ofs;
+
+	talloc_free(asn1);
+
+	if (size > blob.length) {
+		return STATUS_MORE_ENTRIES;
+	}		
+
+	*packet_size = size;
+	return NT_STATUS_OK;
+}
diff --git a/source4/lib/util/asn1.h b/source4/lib/util/asn1.h
new file mode 100644
index 0000000000..34aa1e2cb9
--- /dev/null
+++ b/source4/lib/util/asn1.h
@@ -0,0 +1,54 @@
+/* 
+   Unix SMB/CIFS implementation.   
+   simple ASN1 code
+   Copyright (C) Andrew Tridgell 2001
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _ASN_1_H
+#define _ASN_1_H
+
+struct nesting {
+	off_t start;
+	size_t taglen; /* for parsing */
+	struct nesting *next;
+};
+
+struct asn1_data {
+	uint8_t *data;
+	size_t length;
+	off_t ofs;
+	struct nesting *nesting;
+	bool has_error;
+};
+
+#define ASN1_APPLICATION(x) ((x)+0x60)
+#define ASN1_APPLICATION_SIMPLE(x) ((x)+0x40)
+#define ASN1_SEQUENCE(x) ((x)+0x30)
+#define ASN1_CONTEXT(x) ((x)+0xa0)
+#define ASN1_CONTEXT_SIMPLE(x) ((x)+0x80)
+#define ASN1_GENERAL_STRING 0x1b
+#define ASN1_OCTET_STRING 0x4
+#define ASN1_OID 0x6
+#define ASN1_BOOLEAN 0x1
+#define ASN1_INTEGER 0x2
+#define ASN1_ENUMERATED 0xa
+#define ASN1_SET 0x31
+
+#define ASN1_MAX_OIDS 20
+
+#include "lib/util/asn1_proto.h"
+
+#endif /* _ASN_1_H */
diff --git a/source4/lib/util/config.mk b/source4/lib/util/config.mk
index 01ad14aa95..53a55bf7af 100644
--- a/source4/lib/util/config.mk
+++ b/source4/lib/util/config.mk
@@ -34,6 +34,11 @@ PUBLIC_DEPENDENCIES = \
 		SOCKET_WRAPPER EXT_NSL \
 		CHARSET EXECINFO
 
+[SUBSYSTEM::ASN1_UTIL]
+PUBLIC_PROTO_HEADER = asn1_proto.h
+PUBLIC_HEADERS = asn1.h
+OBJ_FILES = asn1.o
+
 [SUBSYSTEM::UNIX_PRIVS]
 PRIVATE_PROTO_HEADER = unix_privs.h
 OBJ_FILES = unix_privs.o