r5941: Commit this patch much earlier than I would normally prefer, but metze needs a working tree...

The main volume of this patch was what I started working on today:
 - Cleans up memory handling around DCE/RPC pipes, to have a parent talloc context.
 - Uses sepereate inner loops for some of the DCE/RPC tests

The other and more important part of this patch fixes issues
surrounding the new credentials framwork:

This makes the struct cli_credentials always a talloc() structure,
rather than on the stack.  Parts of the cli_credentials code already
assumed this.

There were other issues, particularly in the DCERPC over SMB handling,
as well as little things that had to be tidied up before test_w2k3.sh
would start to pass.

Andrew Bartlett
(This used to be commit 0453f9d05d2e336fba1f85dbf2718d01fa2bf778)

34 files changed, 325 insertions, 252 deletions

diff --git a/source4/torture/com/simple.c b/source4/torture/com/simple.c
index 128d84d1c7..25800896db 100644
--- a/source4/torture/com/simple.c
+++ b/source4/torture/com/simple.c
@@ -28,7 +28,6 @@
 
 static BOOL test_readwrite(TALLOC_CTX *mem_ctx, const char *host)
 {
-	struct dcerpc_pipe *p = NULL;
 	BOOL ret = True;
 	struct GUID IID[2];
 	struct GUID clsid;
@@ -48,9 +47,9 @@ static BOOL test_readwrite(TALLOC_CTX *mem_ctx, const char *host)
 
 	if (host) {
 		error = dcom_create_object(ctx, &clsid, 
-							  host, 2, IID,
-							  &interfaces, 
-							  results);
+					   host, 2, IID,
+					   &interfaces, 
+					   results);
 	} else {
 		error = com_create_object(ctx, &clsid, 2, IID, interfaces, results);
 	}
@@ -78,8 +77,6 @@ static BOOL test_readwrite(TALLOC_CTX *mem_ctx, const char *host)
 
 	IUnknown_Release((struct IUnknown *)interfaces[1], mem_ctx);
 
-	torture_rpc_close(p);
-
 	return True;
 }
 
diff --git a/source4/torture/libnet/userinfo.c b/source4/torture/libnet/userinfo.c
index 9a775277cb..911aa086d4 100644
--- a/source4/torture/libnet/userinfo.c
+++ b/source4/torture/libnet/userinfo.c
@@ -220,7 +220,8 @@ BOOL torture_userinfo(void)
 	mem_ctx = talloc_init("test_userinfo");
 	binding = lp_parm_string(-1, "torture", "binding");
 
-	status = torture_rpc_connection(&p,
+	status = torture_rpc_connection(mem_ctx, 
+					&p,
 					DCERPC_SAMR_NAME,
 					DCERPC_SAMR_UUID,
 					DCERPC_SAMR_VERSION);
@@ -259,7 +260,6 @@ BOOL torture_userinfo(void)
 	}
 done:
 	talloc_free(mem_ctx);
-	torture_rpc_close(p);
 
 	return ret;
 }
diff --git a/source4/torture/masktest.c b/source4/torture/masktest.c
index 00a0c2688d..d760934334 100644
--- a/source4/torture/masktest.c
+++ b/source4/torture/masktest.c
@@ -25,7 +25,7 @@
 #include "libcli/raw/libcliraw.h"
 #include "system/time.h"
 
-static struct cli_credentials credentials;
+static struct cli_credentials *credentials;
 static BOOL showall = False;
 static BOOL old_list = False;
 static const char *maskchars = "<>\"?*abc.";
@@ -80,7 +80,7 @@ static struct smbcli_state *connect_one(char *share)
 	status = smbcli_full_connection(NULL, &c, "masktest",
 					server, 
 					share, NULL,
-					&credentials);
+					credentials);
 
 	if (!NT_STATUS_IS_OK(status)) {
 		return NULL;
@@ -297,8 +297,8 @@ static void usage(void)
 	lp_load(dyn_CONFIGFILE,True,False,False);
 	load_interfaces();
 
-	ZERO_STRUCT(credentials);
-	cli_credentials_guess(&credentials);
+	credentials = cli_credentials_init(talloc_autofree_context());
+	cli_credentials_guess(credentials);
 
 	seed = time(NULL);
 
@@ -322,7 +322,7 @@ static void usage(void)
 			lp_set_cmdline("max protocol", optarg);
 			break;
 		case 'U':
-			cli_credentials_parse_string(&credentials, optarg, CRED_SPECIFIED);
+			cli_credentials_parse_string(credentials, optarg, CRED_SPECIFIED);
 			break;
 		case 's':
 			seed = atoi(optarg);
diff --git a/source4/torture/rpc/alter_context.c b/source4/torture/rpc/alter_context.c
index 79135ba018..ad00a34913 100644
--- a/source4/torture/rpc/alter_context.c
+++ b/source4/torture/rpc/alter_context.c
@@ -38,11 +38,12 @@ BOOL torture_rpc_alter_context(void)
 	mem_ctx = talloc_init("torture_rpc_alter_context");
 
 	printf("opening LSA connection\n");
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, &p, 
 					DCERPC_LSARPC_NAME, 
 					DCERPC_LSARPC_UUID, 
 					DCERPC_LSARPC_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -53,6 +54,7 @@ BOOL torture_rpc_alter_context(void)
 	printf("Opening secondary DSSETUP context\n");
 	status = dcerpc_secondary_context(p, &p2, DCERPC_DSSETUP_UUID, DCERPC_DSSETUP_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		printf("dcerpc_alter_context failed - %s\n", nt_errstr(status));
 		return False;
 	}
@@ -60,6 +62,7 @@ BOOL torture_rpc_alter_context(void)
 	printf("Opening bad secondary connection\n");
 	status = dcerpc_secondary_context(p, &p2, DCERPC_DSSETUP_UUID, DCERPC_DSSETUP_VERSION+100);
 	if (NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		printf("dcerpc_alter_context with wrong version should fail\n");
 		return False;
 	}
@@ -77,6 +80,7 @@ BOOL torture_rpc_alter_context(void)
 	printf("Testing change of primary context\n");
 	status = dcerpc_alter_context(p, mem_ctx, &p2->syntax, &p2->transfer_syntax);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		printf("dcerpc_alter_context failed - %s\n", nt_errstr(status));
 		return False;
 	}
@@ -99,7 +103,5 @@ BOOL torture_rpc_alter_context(void)
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/atsvc.c b/source4/torture/rpc/atsvc.c
index fd29a9228b..0be4e3ca58 100644
--- a/source4/torture/rpc/atsvc.c
+++ b/source4/torture/rpc/atsvc.c
@@ -142,25 +142,27 @@ BOOL torture_rpc_atsvc(void)
 
 	mem_ctx = talloc_init("torture_rpc_atsvc");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_ATSVC_NAME, 
 					DCERPC_ATSVC_UUID, 
 					DCERPC_ATSVC_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
 	if (!test_JobEnum(p, mem_ctx)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
 	if (!test_JobAdd(p, mem_ctx)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/autoidl.c b/source4/torture/rpc/autoidl.c
index 0df88d2bf6..3bf8f0e2c8 100644
--- a/source4/torture/rpc/autoidl.c
+++ b/source4/torture/rpc/autoidl.c
@@ -84,15 +84,17 @@ static void fill_blob_handle(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
 	memcpy(blob->data, b2.data, 20);
 }
 
-static void reopen(struct dcerpc_pipe **p, const struct dcerpc_interface_table *iface)
+static void reopen(TALLOC_CTX *mem_ctx, 
+		   struct dcerpc_pipe **p, 
+		   const struct dcerpc_interface_table *iface)
 {
 	NTSTATUS status;
 
-	if (*p) {
-		dcerpc_pipe_close(*p);
-	}
+	talloc_free(*p);
 
-	status = torture_rpc_connection(p, iface->endpoints->names[0], iface->uuid, iface->if_version);
+	status = torture_rpc_connection(mem_ctx, 
+					p, iface->endpoints->names[0], 
+					iface->uuid, iface->if_version);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("Failed to reopen '%s' - %s\n", iface->name, nt_errstr(status));
 		exit(1);
@@ -118,7 +120,7 @@ static void try_expand(TALLOC_CTX *mem_ctx, const struct dcerpc_interface_table
 	NTSTATUS status;
 	struct dcerpc_pipe *p = NULL;
 
-	reopen(&p, iface);
+	reopen(mem_ctx, &p, iface);
 
 	/* work out how much to expand to get a non fault */
 	for (n=0;n<2000;n++) {
@@ -144,11 +146,11 @@ static void try_expand(TALLOC_CTX *mem_ctx, const struct dcerpc_interface_table
 #endif
 		}
 		if (p->last_fault_code == 5) {
-			reopen(&p, iface);
+			reopen(mem_ctx, &p, iface);
 		}
 	}
 
-	dcerpc_pipe_close(p);	
+	talloc_free(p);	
 }
 
 
@@ -160,7 +162,7 @@ static void test_ptr_scan(TALLOC_CTX *mem_ctx, const struct dcerpc_interface_tab
 	NTSTATUS status;
 	struct dcerpc_pipe *p = NULL;
 
-	reopen(&p, iface);
+	reopen(mem_ctx, &p, iface);
 
 	stub_in = data_blob(NULL, base_in->length);
 	memcpy(stub_in.data, base_in->data, base_in->length);
@@ -175,7 +177,7 @@ static void test_ptr_scan(TALLOC_CTX *mem_ctx, const struct dcerpc_interface_tab
 			printf("possible ptr at ofs %d - fault %s\n", 
 			       ofs-min_ofs, dcerpc_errstr(mem_ctx, p->last_fault_code));
 			if (p->last_fault_code == 5) {
-				reopen(&p, iface);
+				reopen(mem_ctx, &p, iface);
 			}
 			if (depth == 0) {
 				try_expand(mem_ctx, iface, opnum, &stub_in, ofs+4, depth+1);
@@ -188,7 +190,7 @@ static void test_ptr_scan(TALLOC_CTX *mem_ctx, const struct dcerpc_interface_tab
 		SIVAL(stub_in.data, ofs, 0);
 	}
 
-	dcerpc_pipe_close(p);	
+	talloc_free(p);	
 }
 	
 
@@ -200,7 +202,7 @@ static void test_scan_call(TALLOC_CTX *mem_ctx, const struct dcerpc_interface_ta
 	struct dcerpc_pipe *p = NULL;
 	struct policy_handle handle;
 
-	reopen(&p, iface);
+	reopen(mem_ctx, &p, iface);
 
 	get_policy_handle(p, mem_ctx, &handle);
 
@@ -216,7 +218,7 @@ static void test_scan_call(TALLOC_CTX *mem_ctx, const struct dcerpc_interface_ta
 			printf("opnum %d   min_input %d - output %d\n", 
 			       opnum, stub_in.length, stub_out.length);
 			dump_data(0, stub_out.data, stub_out.length);
-			dcerpc_pipe_close(p);
+			talloc_free(p);
 			test_ptr_scan(mem_ctx, iface, opnum, &stub_in, 0, stub_in.length, 0);
 			return;
 		}
@@ -229,7 +231,7 @@ static void test_scan_call(TALLOC_CTX *mem_ctx, const struct dcerpc_interface_ta
 			printf("opnum %d   min_input %d - output %d (with handle)\n", 
 			       opnum, stub_in.length, stub_out.length);
 			dump_data(0, stub_out.data, stub_out.length);
-			dcerpc_pipe_close(p);
+			talloc_free(p);
 			test_ptr_scan(mem_ctx, iface, opnum, &stub_in, 0, stub_in.length, 0);
 			return;
 		}
@@ -237,7 +239,7 @@ static void test_scan_call(TALLOC_CTX *mem_ctx, const struct dcerpc_interface_ta
 		if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 			printf("opnum %d  size %d fault %s\n", opnum, i, dcerpc_errstr(mem_ctx, p->last_fault_code));
 			if (p->last_fault_code == 5) {
-				reopen(&p, iface);
+				reopen(mem_ctx, &p, iface);
 			}
 			continue;
 		}
@@ -246,7 +248,7 @@ static void test_scan_call(TALLOC_CTX *mem_ctx, const struct dcerpc_interface_ta
 	}
 
 	printf("opnum %d minimum not found!?\n", opnum);
-	dcerpc_pipe_close(p);
+	talloc_free(p);
 }
 
 
@@ -272,5 +274,6 @@ BOOL torture_rpc_autoidl(void)
 
 	test_auto_scan(mem_ctx, iface);
 
+	talloc_free(mem_ctx);
 	return True;
 }
diff --git a/source4/torture/rpc/bind.c b/source4/torture/rpc/bind.c
index 71eaec4f92..6ab36cf510 100644
--- a/source4/torture/rpc/bind.c
+++ b/source4/torture/rpc/bind.c
@@ -55,12 +55,14 @@ BOOL torture_multi_bind(void)
 		return False;
 	}
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					NULL,
 					pipe_uuid,
 					pipe_version);
 	
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -77,7 +79,6 @@ BOOL torture_multi_bind(void)
 	}
 
 	talloc_free(mem_ctx);
-	torture_rpc_close(p);
 
 	return ret;
 }
diff --git a/source4/torture/rpc/countcalls.c b/source4/torture/rpc/countcalls.c
index d42729769a..ac4788f349 100644
--- a/source4/torture/rpc/countcalls.c
+++ b/source4/torture/rpc/countcalls.c
@@ -44,7 +44,7 @@ BOOL torture_rpc_countcalls(void)
 		return False;
 	}
 
-	status = torture_rpc_connection(&p, iface->endpoints->names[0], 
+	status = torture_rpc_connection(NULL, &p, iface->endpoints->names[0], 
 					iface->uuid, iface->if_version);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("Failed to open '%s' - %s\n", iface->name, nt_errstr(status));
@@ -65,13 +65,14 @@ BOOL torture_rpc_countcalls(void)
 	}
 	
 	if (i==5000) {
+		talloc_free(p);
 		printf("no limit on calls!?\n");
 		return False;
 	}
 
 	printf("Found %d calls\n", i);
 
-	torture_rpc_close(p);
+	talloc_free(p);
 
 	return True;
 }
diff --git a/source4/torture/rpc/dcom.c b/source4/torture/rpc/dcom.c
index f8bcf40965..318e9c88ea 100644
--- a/source4/torture/rpc/dcom.c
+++ b/source4/torture/rpc/dcom.c
@@ -32,18 +32,16 @@ BOOL torture_rpc_dcom(void)
 
 	mem_ctx = talloc_init("torture_rpc_dcom");
 
-	status = torture_rpc_connection(&p, 
-									DCERPC_IOXIDRESOLVER_NAME,
-									DCERPC_IOXIDRESOLVER_UUID,
-									DCERPC_IOXIDRESOLVER_VERSION);
+	status = torture_rpc_connection(mem_ctx, &p, 
+					DCERPC_IOXIDRESOLVER_NAME,
+					DCERPC_IOXIDRESOLVER_UUID,
+					DCERPC_IOXIDRESOLVER_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
-		return False;
+		ret = False;
 	}
 
 	printf("\n");
 
 	talloc_free(mem_ctx);
-
-	torture_rpc_close(p);
 	return ret;
 }
diff --git a/source4/torture/rpc/dfs.c b/source4/torture/rpc/dfs.c
index 358b94fa72..4e33f921fa 100644
--- a/source4/torture/rpc/dfs.c
+++ b/source4/torture/rpc/dfs.c
@@ -173,7 +173,8 @@ BOOL torture_rpc_dfs(void)
 
 	mem_ctx = talloc_init("torture_rpc_dfs");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_NETDFS_NAME,
 					DCERPC_NETDFS_UUID,
 					DCERPC_NETDFS_VERSION);
@@ -197,7 +198,5 @@ BOOL torture_rpc_dfs(void)
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/drsuapi.c b/source4/torture/rpc/drsuapi.c
index c4dbe00958..88ff85d8da 100644
--- a/source4/torture/rpc/drsuapi.c
+++ b/source4/torture/rpc/drsuapi.c
@@ -1008,18 +1008,20 @@ BOOL torture_rpc_drsuapi(void)
 	BOOL ret = True;
 	struct DsPrivate priv;
 
-	status = torture_rpc_connection(&p, 
+	mem_ctx = talloc_init("torture_rpc_drsuapi");
+
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_DRSUAPI_NAME,
 					DCERPC_DRSUAPI_UUID,
 					DCERPC_DRSUAPI_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
 	printf("Connected to DRAUAPI pipe\n");
 
-	mem_ctx = talloc_init("torture_rpc_drsuapi");
-
 	ZERO_STRUCT(priv);
 
 	ret &= test_DsBind(p, mem_ctx, &priv);
@@ -1042,7 +1044,5 @@ BOOL torture_rpc_drsuapi(void)
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/dssetup.c b/source4/torture/rpc/dssetup.c
index bd20a695e2..d4f76fea90 100644
--- a/source4/torture/rpc/dssetup.c
+++ b/source4/torture/rpc/dssetup.c
@@ -64,11 +64,13 @@ BOOL torture_rpc_dssetup(void)
 
 	mem_ctx = talloc_init("torture_rpc_dssetup");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, &p, 
 					DCERPC_DSSETUP_NAME, 
 					DCERPC_DSSETUP_UUID, 
 					DCERPC_DSSETUP_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
+
 		return False;
 	}
 
@@ -76,7 +78,5 @@ BOOL torture_rpc_dssetup(void)
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/echo.c b/source4/torture/rpc/echo.c
index 8ef0b00eb2..34a509a1d4 100644
--- a/source4/torture/rpc/echo.c
+++ b/source4/torture/rpc/echo.c
@@ -398,13 +398,14 @@ static BOOL test_doublepointer(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
 BOOL torture_rpc_echo(void)
 {
 	NTSTATUS status;
-    struct dcerpc_pipe *p;
+	struct dcerpc_pipe *p;
 	TALLOC_CTX *mem_ctx;
 	BOOL ret = True;
 
 	mem_ctx = talloc_init("torture_rpc_echo");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_RPCECHO_NAME,
 					DCERPC_RPCECHO_UUID,
 					DCERPC_RPCECHO_VERSION);
@@ -427,6 +428,5 @@ BOOL torture_rpc_echo(void)
 	
 	talloc_free(mem_ctx);
 
-    torture_rpc_close(p);
 	return ret;
 }
diff --git a/source4/torture/rpc/epmapper.c b/source4/torture/rpc/epmapper.c
index debcd98756..28877fa1a4 100644
--- a/source4/torture/rpc/epmapper.c
+++ b/source4/torture/rpc/epmapper.c
@@ -281,11 +281,13 @@ BOOL torture_rpc_epmapper(void)
 
 	mem_ctx = talloc_init("torture_rpc_epmapper");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_EPMAPPER_NAME,
 					DCERPC_EPMAPPER_UUID,
 					DCERPC_EPMAPPER_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -303,7 +305,5 @@ BOOL torture_rpc_epmapper(void)
 
 	talloc_free(mem_ctx);
 
-	torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/eventlog.c b/source4/torture/rpc/eventlog.c
index 7e320200f0..7d3a3bfea9 100644
--- a/source4/torture/rpc/eventlog.c
+++ b/source4/torture/rpc/eventlog.c
@@ -155,15 +155,18 @@ BOOL torture_rpc_eventlog(void)
 
 	mem_ctx = talloc_init("torture_rpc_atsvc");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_EVENTLOG_NAME, 
 					DCERPC_EVENTLOG_UUID, 
 					DCERPC_EVENTLOG_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
 	if (!test_OpenEventLog(p, mem_ctx, &handle)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -175,7 +178,5 @@ BOOL torture_rpc_eventlog(void)
 
 	talloc_free(mem_ctx);
 
-    torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/initshutdown.c b/source4/torture/rpc/initshutdown.c
index 0aa64e3eb2..ff1496aea4 100644
--- a/source4/torture/rpc/initshutdown.c
+++ b/source4/torture/rpc/initshutdown.c
@@ -120,12 +120,14 @@ BOOL torture_rpc_initshutdown(void)
 
 	mem_ctx = talloc_init("torture_rpc_initshutdown");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_INITSHUTDOWN_NAME, 
 					DCERPC_INITSHUTDOWN_UUID, 
 					DCERPC_INITSHUTDOWN_VERSION);
 
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -140,7 +142,5 @@ BOOL torture_rpc_initshutdown(void)
 
 	talloc_free(mem_ctx);
 
-    torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c
index 277a5fc793..f723f68a02 100644
--- a/source4/torture/rpc/lsa.c
+++ b/source4/torture/rpc/lsa.c
@@ -1612,11 +1612,13 @@ BOOL torture_rpc_lsa(void)
 
 	mem_ctx = talloc_init("torture_rpc_lsa");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_LSARPC_NAME, 
 					DCERPC_LSARPC_UUID, 
 					DCERPC_LSARPC_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -1676,7 +1678,5 @@ BOOL torture_rpc_lsa(void)
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/mgmt.c b/source4/torture/rpc/mgmt.c
index cb2023b64c..be9cf649d3 100644
--- a/source4/torture/rpc/mgmt.c
+++ b/source4/torture/rpc/mgmt.c
@@ -177,7 +177,7 @@ BOOL torture_rpc_mgmt(void)
 {
         NTSTATUS status;
         struct dcerpc_pipe *p;
-	TALLOC_CTX *mem_ctx;
+	TALLOC_CTX *mem_ctx, *loop_ctx;
 	BOOL ret = True;
 	const char *binding = lp_parm_string(-1, "torture", "binding");
 	const struct dcerpc_interface_list *l;
@@ -192,24 +192,29 @@ BOOL torture_rpc_mgmt(void)
 	
 	status = dcerpc_parse_binding(mem_ctx, binding, &b);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		printf("Failed to parse binding '%s'\n", binding);
 		return False;
 	}
 
 	for (l=librpc_dcerpc_pipes();l;l=l->next) {		
+		loop_ctx = talloc_named(mem_ctx, 0, "torture_rpc_mgmt loop context");
+		
 		/* some interfaces are not mappable */
 		if (l->table->num_calls == 0 ||
 		    strcmp(l->table->name, "mgmt") == 0) {
+			talloc_free(loop_ctx);
 			continue;
 		}
 
 		printf("\nTesting pipe '%s'\n", l->table->name);
 
 		if (b->transport == NCACN_IP_TCP) {
-			status = dcerpc_epm_map_binding(mem_ctx, b, 
-							 l->table->uuid,
-							 l->table->if_version);
+			status = dcerpc_epm_map_binding(loop_ctx, b, 
+							l->table->uuid,
+							l->table->if_version);
 			if (!NT_STATUS_IS_OK(status)) {
+				talloc_free(loop_ctx);
 				printf("Failed to map port for uuid %s\n", l->table->uuid);
 				continue;
 			}
@@ -217,38 +222,39 @@ BOOL torture_rpc_mgmt(void)
 			b->endpoint = talloc_strdup(b, l->table->name);
 		}
 
-		lp_set_cmdline("torture:binding", dcerpc_binding_string(mem_ctx, b));
+		lp_set_cmdline("torture:binding", dcerpc_binding_string(loop_ctx, b));
 
-		status = torture_rpc_connection(&p, 
+		status = torture_rpc_connection(loop_ctx, 
+						&p, 
 						l->table->name,
 						DCERPC_MGMT_UUID,
 						DCERPC_MGMT_VERSION);
 		if (!NT_STATUS_IS_OK(status)) {
+			talloc_free(loop_ctx);
 			ret = False;
 			continue;
 		}
 	
-		if (!test_is_server_listening(p, mem_ctx)) {
+		if (!test_is_server_listening(p, loop_ctx)) {
 			ret = False;
 		}
 
-		if (!test_stop_server_listening(p, mem_ctx)) {
+		if (!test_stop_server_listening(p, loop_ctx)) {
 			ret = False;
 		}
 
-		if (!test_inq_stats(p, mem_ctx)) {
+		if (!test_inq_stats(p, loop_ctx)) {
 			ret = False;
 		}
 
-		if (!test_inq_princ_name(p, mem_ctx)) {
+		if (!test_inq_princ_name(p, loop_ctx)) {
 			ret = False;
 		}
 
-		if (!test_inq_if_ids(p, mem_ctx)) {
+		if (!test_inq_if_ids(p, loop_ctx)) {
 			ret = False;
 		}
 
-		torture_rpc_close(p);
 	}
 
 	return ret;
diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c
index 2266659c37..d9ce350428 100644
--- a/source4/torture/rpc/netlogon.c
+++ b/source4/torture/rpc/netlogon.c
@@ -26,6 +26,7 @@
 #include "lib/events/events.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
 #include "auth/auth.h"
+#include "lib/cmdline/popt_common.h"
 
 static const char *machine_password;
 
@@ -37,7 +38,7 @@ static BOOL test_LogonUasLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
 	struct netr_LogonUasLogon r;
 
 	r.in.server_name = NULL;
-	r.in.account_name = lp_parm_string(-1, "torture", "username");
+	r.in.account_name = cli_credentials_get_username(cmdline_credentials),
 	r.in.workstation = TEST_MACHINE_NAME;
 
 	printf("Testing LogonUasLogon\n");
@@ -58,7 +59,7 @@ static BOOL test_LogonUasLogoff(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
 	struct netr_LogonUasLogoff r;
 
 	r.in.server_name = NULL;
-	r.in.account_name = lp_parm_string(-1, "torture", "username");
+	r.in.account_name = cli_credentials_get_username(cmdline_credentials),
 	r.in.workstation = TEST_MACHINE_NAME;
 
 	printf("Testing LogonUasLogoff\n");
@@ -491,8 +492,8 @@ static BOOL test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
 	struct netr_LogonSamLogon r;
 	struct netr_Authenticator auth, auth2;
 	struct netr_NetworkInfo ninfo;
-	const char *username = lp_parm_string(-1, "torture", "username");
-	const char *password = lp_parm_string(-1, "torture", "password");
+	const char *username = cli_credentials_get_username(cmdline_credentials);
+	const char *password = cli_credentials_get_password(cmdline_credentials);
 	struct creds_CredentialState *creds;
 
 	int i;
@@ -503,7 +504,7 @@ static BOOL test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
 		return False;
 	}
 
-	ninfo.identity_info.domain_name.string = lp_workgroup();
+	ninfo.identity_info.domain_name.string = cli_credentials_get_domain(cmdline_credentials);
 	ninfo.identity_info.parameter_control = 0;
 	ninfo.identity_info.logon_id_low = 0;
 	ninfo.identity_info.logon_id_high = 0;
@@ -1330,7 +1331,7 @@ static BOOL test_ManyGetDCName(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
 		return False;
 	}
 
-	dcerpc_pipe_close(p2);
+	talloc_free(p2);
 
 	d.in.logon_server = talloc_asprintf(mem_ctx, "\\\\%s",
 					    dcerpc_server_name(p));
@@ -1368,15 +1369,17 @@ BOOL torture_rpc_netlogon(void)
 	join_ctx = torture_join_domain(TEST_MACHINE_NAME, lp_workgroup(), ACB_SVRTRUST, 
 				       &machine_password);
 	if (!join_ctx) {
+		talloc_free(mem_ctx);
 		printf("Failed to join as BDC\n");
 		return False;
 	}
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, &p, 
 					DCERPC_NETLOGON_NAME,
 					DCERPC_NETLOGON_UUID,
 					DCERPC_NETLOGON_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -1403,8 +1406,6 @@ BOOL torture_rpc_netlogon(void)
 
 	talloc_free(mem_ctx);
 
-	torture_rpc_close(p);
-
 	torture_leave_domain(join_ctx);
 
 	return ret;
diff --git a/source4/torture/rpc/oxidresolve.c b/source4/torture/rpc/oxidresolve.c
index 2caf3512d5..3b0269891c 100644
--- a/source4/torture/rpc/oxidresolve.c
+++ b/source4/torture/rpc/oxidresolve.c
@@ -223,21 +223,25 @@ BOOL torture_rpc_oxidresolve(void)
 
 	mem_ctx = talloc_init("torture_rpc_oxidresolve");
 
-	status = torture_rpc_connection(&premact, 
+	status = torture_rpc_connection(mem_ctx, 
+					&premact, 
 					DCERPC_IREMOTEACTIVATION_NAME, 
 					DCERPC_IREMOTEACTIVATION_UUID, 
 					DCERPC_IREMOTEACTIVATION_VERSION);								
 			
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_IOXIDRESOLVER_NAME, 
 					DCERPC_IOXIDRESOLVER_UUID, 
 					DCERPC_IOXIDRESOLVER_VERSION);
 
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -264,7 +268,5 @@ BOOL torture_rpc_oxidresolve(void)
 
 	talloc_free(mem_ctx);
 
-    torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/remact.c b/source4/torture/rpc/remact.c
index a8dff5f50b..1d145dd1cb 100644
--- a/source4/torture/rpc/remact.c
+++ b/source4/torture/rpc/remact.c
@@ -95,19 +95,21 @@ static int test_RemoteActivation(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
 
 BOOL torture_rpc_remact(void)
 {
-     NTSTATUS status;
-     struct dcerpc_pipe *p;
+	NTSTATUS status;
+	struct dcerpc_pipe *p;
 	TALLOC_CTX *mem_ctx;
 	BOOL ret = True;
 
 	mem_ctx = talloc_init("torture_rpc_remact");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx,
+					&p, 
 					DCERPC_IREMOTEACTIVATION_NAME,
 					DCERPC_IREMOTEACTIVATION_UUID, 
 					DCERPC_IREMOTEACTIVATION_VERSION);
 
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -116,7 +118,5 @@ BOOL torture_rpc_remact(void)
 
 	talloc_free(mem_ctx);
 
-    torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/rot.c b/source4/torture/rpc/rot.c
index d2e3742cf0..ee47fe350e 100644
--- a/source4/torture/rpc/rot.c
+++ b/source4/torture/rpc/rot.c
@@ -24,23 +24,25 @@
 
 BOOL torture_rpc_rot(void)
 {
-    NTSTATUS status;
-    struct dcerpc_pipe *p;
+	NTSTATUS status;
+	struct dcerpc_pipe *p;
 	TALLOC_CTX *mem_ctx;
 	BOOL ret = True;
 
 	mem_ctx = talloc_init("torture_rpc_rot");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_ROT_NAME, 
 					DCERPC_ROT_UUID, 
 					DCERPC_ROT_VERSION);
 
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
-    torture_rpc_close(p);
+	talloc_free(mem_ctx);
 
 	return ret;
 }
diff --git a/source4/torture/rpc/samlogon.c b/source4/torture/rpc/samlogon.c
index 1ee8f36b8e..86bfe48a75 100644
--- a/source4/torture/rpc/samlogon.c
+++ b/source4/torture/rpc/samlogon.c
@@ -1072,6 +1072,7 @@ static BOOL test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			  const char *plain_pass,
 			  int n_subtests)
 {
+	TALLOC_CTX *fn_ctx = talloc_named(mem_ctx, 0, "test_SamLogon function-level context");
 	int i, v, l, f;
 	BOOL ret = True;
 	int validation_levels[] = {2,3,6};
@@ -1084,27 +1085,26 @@ static BOOL test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	
 	printf("testing netr_LogonSamLogon and netr_LogonSamLogonWithFlags\n");
 	
-	samlogon_state.mem_ctx = mem_ctx;
 	samlogon_state.account_name = account_name;
 	samlogon_state.account_domain = account_domain;
 	samlogon_state.password = plain_pass;
 	samlogon_state.p = p;
 	samlogon_state.creds = creds;
 
-	samlogon_state.chall = data_blob_talloc(mem_ctx, NULL, 8);
+	samlogon_state.chall = data_blob_talloc(fn_ctx, NULL, 8);
 
 	generate_random_buffer(samlogon_state.chall.data, 8);
-	samlogon_state.r_flags.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
+	samlogon_state.r_flags.in.server_name = talloc_asprintf(fn_ctx, "\\\\%s", dcerpc_server_name(p));
 	samlogon_state.r_flags.in.workstation = TEST_MACHINE_NAME;
 	samlogon_state.r_flags.in.credential = &samlogon_state.auth;
 	samlogon_state.r_flags.in.return_authenticator = &samlogon_state.auth2;
 	samlogon_state.r_flags.in.flags = 0;
 
-	samlogon_state.r_ex.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
+	samlogon_state.r_ex.in.server_name = talloc_asprintf(fn_ctx, "\\\\%s", dcerpc_server_name(p));
 	samlogon_state.r_ex.in.workstation = TEST_MACHINE_NAME;
 	samlogon_state.r_ex.in.flags = 0;
 
-	samlogon_state.r.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
+	samlogon_state.r.in.server_name = talloc_asprintf(fn_ctx, "\\\\%s", dcerpc_server_name(p));
 	samlogon_state.r.in.workstation = TEST_MACHINE_NAME;
 	samlogon_state.r.in.credential = &samlogon_state.auth;
 	samlogon_state.r.in.return_authenticator = &samlogon_state.auth2;
@@ -1117,6 +1117,8 @@ static BOOL test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			for (v=0;v<ARRAY_SIZE(validation_levels);v++) {
 				for (l=0;l<ARRAY_SIZE(logon_levels);l++) {
 					char *error_string = NULL;
+					TALLOC_CTX *tmp_ctx = talloc_named(fn_ctx, 0, "test_SamLogon inner loop");
+					samlogon_state.mem_ctx = tmp_ctx;
 					samlogon_state.function_level = function_levels[f];
 					samlogon_state.r.in.validation_level = validation_levels[v];
 					samlogon_state.r.in.logon_level = logon_levels[l];
@@ -1139,11 +1141,12 @@ static BOOL test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 						}
 						SAFE_FREE(error_string);
 					}
+					talloc_free(tmp_ctx);
 				}
 			}
 		}
 	}
-
+	talloc_free(fn_ctx);
 	return ret;
 }
 
@@ -1156,6 +1159,7 @@ static BOOL test_InteractiveLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 				  const char *plain_pass)
 {
 	NTSTATUS status;
+	TALLOC_CTX *fn_ctx = talloc_named(mem_ctx, 0, "test_InteractiveLogon function-level context");
 	struct netr_LogonSamLogonWithFlags r;
 	struct netr_Authenticator a, ra;
 	struct netr_PasswordInfo pinfo;
@@ -1166,7 +1170,7 @@ static BOOL test_InteractiveLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
 	creds_client_authenticator(creds, &a);
 
-	r.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
+	r.in.server_name = talloc_asprintf(fn_ctx, "\\\\%s", dcerpc_server_name(p));
 	r.in.workstation = TEST_MACHINE_NAME;
 	r.in.credential = &a;
 	r.in.return_authenticator = &ra;
@@ -1195,14 +1199,17 @@ static BOOL test_InteractiveLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
 	printf("Testing netr_LogonSamLogonWithFlags (Interactive Logon)\n");
 
-	status = dcerpc_netr_LogonSamLogonWithFlags(p, mem_ctx, &r);
+	status = dcerpc_netr_LogonSamLogonWithFlags(p, fn_ctx, &r);
 	if (!r.out.return_authenticator || !creds_client_check(creds, &r.out.return_authenticator->cred)) {
 		printf("Credential chaining failed\n");
+		talloc_free(fn_ctx);
 		return False;
 	}
 
+	talloc_free(fn_ctx);
+
 	if (!NT_STATUS_IS_OK(status)) {
-		printf("netr_LogonSamLogonWithFlags - %s\n", nt_errstr(status));
+		printf("[%s]\\[%s] netr_LogonSamLogonWithFlags - %s\n", account_name, account_domain, nt_errstr(status));
 		return False;
 	}
 
@@ -1216,7 +1223,7 @@ BOOL torture_rpc_samlogon(void)
         NTSTATUS status;
         struct dcerpc_pipe *p;
 	struct dcerpc_binding *b;
-	struct cli_credentials credentials;
+	struct cli_credentials *credentials;
 	TALLOC_CTX *mem_ctx = talloc_init("torture_rpc_netlogon");
 	BOOL ret = True;
 	struct test_join *join_ctx;
@@ -1256,9 +1263,9 @@ BOOL torture_rpc_samlogon(void)
 			NULL,
 			talloc_asprintf(mem_ctx, 
 					"%s@%s", 
-			cli_credentials_get_domain(cmdline_credentials),
-			cli_credentials_get_username(cmdline_credentials)
-					),
+					cli_credentials_get_username(cmdline_credentials),
+					cli_credentials_get_domain(cmdline_credentials)
+				),
 			cli_credentials_get_password(cmdline_credentials),
 			False
 		},
@@ -1268,7 +1275,7 @@ BOOL torture_rpc_samlogon(void)
 					"%s@%s", 
 					cli_credentials_get_username(cmdline_credentials),
 					cli_credentials_get_realm(cmdline_credentials)
-					),
+				),
 			cli_credentials_get_password(cmdline_credentials),
 			True
 		},
@@ -1300,6 +1307,8 @@ BOOL torture_rpc_samlogon(void)
 #endif
 	};
 		
+	credentials = cli_credentials_init(mem_ctx);
+
 	test_machine_account = talloc_asprintf(mem_ctx, "%s$", TEST_MACHINE_NAME);
 	/* We only need to join as a workstation here, and in future,
 	 * if we wish to test against trusted domains, we must be a
@@ -1338,17 +1347,18 @@ BOOL torture_rpc_samlogon(void)
 	b->flags &= ~DCERPC_AUTH_OPTIONS;
 	b->flags |= DCERPC_SCHANNEL_WORKSTATION | DCERPC_SIGN | DCERPC_SCHANNEL_128;
 
-	cli_credentials_set_workstation(&credentials, TEST_MACHINE_NAME, CRED_SPECIFIED);
-	cli_credentials_set_domain(&credentials, lp_workgroup(), CRED_SPECIFIED);
-	cli_credentials_set_username(&credentials, test_machine_account, CRED_SPECIFIED);
-	cli_credentials_set_password(&credentials, machine_password, CRED_SPECIFIED);
+	cli_credentials_set_workstation(credentials, TEST_MACHINE_NAME, CRED_SPECIFIED);
+	cli_credentials_set_domain(credentials, lp_workgroup(), CRED_SPECIFIED);
+	cli_credentials_set_username(credentials, test_machine_account, CRED_SPECIFIED);
+	cli_credentials_set_password(credentials, machine_password, CRED_SPECIFIED);
 
-	status = dcerpc_pipe_connect_b(&p, b, 
+	status = dcerpc_pipe_connect_b(mem_ctx, &p, b, 
 				       DCERPC_NETLOGON_UUID,
 				       DCERPC_NETLOGON_VERSION,
-					   &credentials);
+				       credentials);
 
 	if (!NT_STATUS_IS_OK(status)) {
+		printf("RPC pipe connect as domain member failed: %s\n", nt_errstr(status));
 		ret = False;
 		goto failed;
 	}
@@ -1405,8 +1415,6 @@ BOOL torture_rpc_samlogon(void)
 failed:
 	talloc_free(mem_ctx);
 
-	torture_rpc_close(p);
-
 	torture_leave_domain(join_ctx);
 #if 0
 	torture_leave_domain(user_ctx);
diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
index 6b663acdf5..969711858c 100644
--- a/source4/torture/rpc/samr.c
+++ b/source4/torture/rpc/samr.c
@@ -1573,12 +1573,15 @@ static BOOL test_CreateUser(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		SAMR_FIELD_PASSWORD | SAMR_FIELD_PASSWORD2,
 		0
 	};
+	
+	TALLOC_CTX *user_ctx;
 
 	/* This call creates a 'normal' account - check that it really does */
 	const uint32_t acct_flags = ACB_NORMAL;
 	struct samr_String name;
 	BOOL ret = True;
 
+	user_ctx = talloc_named(mem_ctx, 0, "test_CreateUser2 per-user context");
 	init_samr_String(&name, TEST_ACCOUNT_NAME);
 
 	r.in.domain_handle = domain_handle;
@@ -1589,21 +1592,24 @@ static BOOL test_CreateUser(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
 	printf("Testing CreateUser(%s)\n", r.in.account_name->string);
 
-	status = dcerpc_samr_CreateUser(p, mem_ctx, &r);
+	status = dcerpc_samr_CreateUser(p, user_ctx, &r);
 
 	if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 		printf("Server refused create of '%s'\n", r.in.account_name->string);
 		ZERO_STRUCTP(user_handle);
+		talloc_free(user_ctx);
 		return True;
 	}
 
 	if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
-		if (!test_DeleteUser_byname(p, mem_ctx, domain_handle, r.in.account_name->string)) {
+		if (!test_DeleteUser_byname(p, user_ctx, domain_handle, r.in.account_name->string)) {
+			talloc_free(user_ctx);
 			return False;
 		}
-		status = dcerpc_samr_CreateUser(p, mem_ctx, &r);
+		status = dcerpc_samr_CreateUser(p, user_ctx, &r);
 	}
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(user_ctx);
 		printf("CreateUser failed - %s\n", nt_errstr(status));
 		return False;
 	}
@@ -1611,7 +1617,7 @@ static BOOL test_CreateUser(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	q.in.user_handle = user_handle;
 	q.in.level = 16;
 
-	status = dcerpc_samr_QueryUserInfo(p, mem_ctx, &q);
+	status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("QueryUserInfo level %u failed - %s\n", 
 		       q.in.level, nt_errstr(status));
@@ -1625,44 +1631,46 @@ static BOOL test_CreateUser(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		}
 	}
 
-	if (!test_user_ops(p, mem_ctx, user_handle, acct_flags, name.string)) {
+	if (!test_user_ops(p, user_ctx, user_handle, acct_flags, name.string)) {
 		ret = False;
 	}
 
-	if (!test_SetUserPass(p, mem_ctx, user_handle, &password)) {
+	if (!test_SetUserPass(p, user_ctx, user_handle, &password)) {
 		ret = False;
 	}	
 
 	for (i = 0; password_fields[i]; i++) {
-		if (!test_SetUserPass_23(p, mem_ctx, user_handle, password_fields[i], &password)) {
+		if (!test_SetUserPass_23(p, user_ctx, user_handle, password_fields[i], &password)) {
 			ret = False;
 		}	
 		
 		/* check it was set right */
-		if (!test_ChangePasswordUser3(p, mem_ctx, domain_handle, 0, &password)) {
+		if (!test_ChangePasswordUser3(p, user_ctx, domain_handle, 0, &password)) {
 			ret = False;
 		}
 	}		
 
 	for (i = 0; password_fields[i]; i++) {
-		if (!test_SetUserPass_25(p, mem_ctx, user_handle, password_fields[i], &password)) {
+		if (!test_SetUserPass_25(p, user_ctx, user_handle, password_fields[i], &password)) {
 			ret = False;
 		}	
 		
 		/* check it was set right */
-		if (!test_ChangePasswordUser3(p, mem_ctx, domain_handle, 0, &password)) {
+		if (!test_ChangePasswordUser3(p, user_ctx, domain_handle, 0, &password)) {
 			ret = False;
 		}
 	}		
 
-	if (!test_SetUserPassEx(p, mem_ctx, user_handle, &password)) {
+	if (!test_SetUserPassEx(p, user_ctx, user_handle, &password)) {
 		ret = False;
 	}	
 
-	if (!test_ChangePassword(p, mem_ctx, domain_handle, &password)) {
+	if (!test_ChangePassword(p, user_ctx, domain_handle, &password)) {
 		ret = False;
 	}	
 
+	talloc_free(user_ctx);
+	
 	return ret;
 }
 
@@ -1724,9 +1732,10 @@ static BOOL test_CreateUser2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	};
 
 	for (i = 0; account_types[i].account_name; i++) {
+		TALLOC_CTX *user_ctx;
 		uint32_t acct_flags = account_types[i].acct_flags;
 		uint32_t access_granted;
-
+		user_ctx = talloc_named(mem_ctx, 0, "test_CreateUser2 per-user context");
 		init_samr_String(&name, account_types[i].account_name);
 
 		r.in.domain_handle = handle;
@@ -1739,17 +1748,20 @@ static BOOL test_CreateUser2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		
 		printf("Testing CreateUser2(%s, 0x%x)\n", r.in.account_name->string, acct_flags);
 		
-		status = dcerpc_samr_CreateUser2(p, mem_ctx, &r);
+		status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
 		
 		if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
+			talloc_free(user_ctx);
 			printf("Server refused create of '%s'\n", r.in.account_name->string);
 			continue;
 
 		} else if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
-			if (!test_DeleteUser_byname(p, mem_ctx, handle, r.in.account_name->string)) {
-				return False;
+			if (!test_DeleteUser_byname(p, user_ctx, handle, r.in.account_name->string)) {
+				talloc_free(user_ctx);
+				ret = False;
+				continue;
 			}
-			status = dcerpc_samr_CreateUser2(p, mem_ctx, &r);
+			status = dcerpc_samr_CreateUser2(p, user_ctx, &r);
 
 		}
 		if (!NT_STATUS_EQUAL(status, account_types[i].nt_status)) {
@@ -1762,7 +1774,7 @@ static BOOL test_CreateUser2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			q.in.user_handle = &user_handle;
 			q.in.level = 16;
 			
-			status = dcerpc_samr_QueryUserInfo(p, mem_ctx, &q);
+			status = dcerpc_samr_QueryUserInfo(p, user_ctx, &q);
 			if (!NT_STATUS_IS_OK(status)) {
 				printf("QueryUserInfo level %u failed - %s\n", 
 				       q.in.level, nt_errstr(status));
@@ -1776,7 +1788,7 @@ static BOOL test_CreateUser2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 				}
 			}
 		
-			if (!test_user_ops(p, mem_ctx, &user_handle, acct_flags, name.string)) {
+			if (!test_user_ops(p, user_ctx, &user_handle, acct_flags, name.string)) {
 				ret = False;
 			}
 
@@ -1785,12 +1797,13 @@ static BOOL test_CreateUser2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			d.in.user_handle = &user_handle;
 			d.out.user_handle = &user_handle;
 			
-			status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
+			status = dcerpc_samr_DeleteUser(p, user_ctx, &d);
 			if (!NT_STATUS_IS_OK(status)) {
 				printf("DeleteUser failed - %s\n", nt_errstr(status));
 				ret = False;
 			}
 		}
+		talloc_free(user_ctx);
 	}
 
 	return ret;
@@ -3188,11 +3201,13 @@ BOOL torture_rpc_samr(void)
 
 	mem_ctx = talloc_init("torture_rpc_samr");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_SAMR_NAME,
 					DCERPC_SAMR_UUID,
 					DCERPC_SAMR_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -3222,8 +3237,6 @@ BOOL torture_rpc_samr(void)
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
 
diff --git a/source4/torture/rpc/samsync.c b/source4/torture/rpc/samsync.c
index b92752227c..b8214859cd 100644
--- a/source4/torture/rpc/samsync.c
+++ b/source4/torture/rpc/samsync.c
@@ -309,11 +309,13 @@ static BOOL samsync_handle_domain(TALLOC_CTX *mem_ctx, struct samsync_state *sam
 
 	if (!samsync_state->domain_handle[database_id]) {
 		samsync_state->domain_handle[database_id]
-			= samsync_open_domain(mem_ctx, samsync_state, samsync_state->domain_name[database_id], 
-					      &dom_sid);
+			= talloc_reference(samsync_state, 
+					   samsync_open_domain(mem_ctx, samsync_state, samsync_state->domain_name[database_id], 
+							       &dom_sid));
 	}
 	if (samsync_state->domain_handle[database_id]) {
 		samsync_state->sid[database_id] = talloc_reference(samsync_state, dom_sid);
+		talloc_reference(dom_sid, dom_sid->sub_auths);
 	}
 
 	printf("\tsequence_nums[%d/%s]=%llu\n",
@@ -730,6 +732,7 @@ static BOOL samsync_handle_secret(TALLOC_CTX *mem_ctx, struct samsync_state *sam
 	new->secret = data_blob_talloc(new, secret->current_cipher.cipher_data, secret->current_cipher.maxlen);
 	new->mtime = secret->current_cipher_set_time;
 
+	new = talloc_reference(samsync_state, new);
 	DLIST_ADD(samsync_state->secrets, new);
 
 	old->name = talloc_reference(old, name);
@@ -918,6 +921,7 @@ static BOOL samsync_handle_trusted_domain(TALLOC_CTX *mem_ctx, struct samsync_st
   We would like to do this, but it is NOT_SUPPORTED on win2k3
 	TEST_SEC_DESC_EQUAL(trusted_domain->sdbuf, lsa, &trustdom_handle);
 */
+	new = talloc_reference(samsync_state, new);
 	DLIST_ADD(samsync_state->trusted_domains, new);
 
 	return ret;
@@ -1015,6 +1019,7 @@ static BOOL test_DatabaseSync(struct samsync_state *samsync_state,
 			      TALLOC_CTX *mem_ctx)
 {
 	NTSTATUS status;
+	TALLOC_CTX *loop_ctx, *delta_ctx, *trustdom_ctx;
 	struct netr_DatabaseSync r;
 	const uint32_t database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS}; 
 	int i, d;
@@ -1036,9 +1041,10 @@ static BOOL test_DatabaseSync(struct samsync_state *samsync_state,
 		printf("Testing DatabaseSync of id %d\n", r.in.database_id);
 
 		do {
+			loop_ctx = talloc_named(mem_ctx, 0, "DatabaseSync loop context");
 			creds_client_authenticator(samsync_state->creds, &r.in.credential);
 
-			status = dcerpc_netr_DatabaseSync(samsync_state->p, mem_ctx, &r);
+			status = dcerpc_netr_DatabaseSync(samsync_state->p, loop_ctx, &r);
 			if (!NT_STATUS_IS_OK(status) &&
 			    !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
 				printf("DatabaseSync - %s\n", nt_errstr(status));
@@ -1053,65 +1059,68 @@ static BOOL test_DatabaseSync(struct samsync_state *samsync_state,
 			r.in.sync_context = r.out.sync_context;
 
 			for (d=0; d < r.out.delta_enum_array->num_deltas; d++) {
+				delta_ctx = talloc_named(loop_ctx, 0, "DatabaseSync delta context");
 				switch (r.out.delta_enum_array->delta_enum[d].delta_type) {
 				case NETR_DELTA_DOMAIN:
-					if (!samsync_handle_domain(mem_ctx, samsync_state, 
+					if (!samsync_handle_domain(delta_ctx, samsync_state, 
 								   r.in.database_id, &r.out.delta_enum_array->delta_enum[d])) {
 						printf("Failed to handle DELTA_DOMAIN\n");
 						ret = False;
 					}
 					break;
 				case NETR_DELTA_GROUP:
-					if (!samsync_handle_group(mem_ctx, samsync_state, 
+					if (!samsync_handle_group(delta_ctx, samsync_state, 
 								  r.in.database_id, &r.out.delta_enum_array->delta_enum[d])) {
 						printf("Failed to handle DELTA_USER\n");
 						ret = False;
 					}
 					break;
 				case NETR_DELTA_USER:
-					if (!samsync_handle_user(mem_ctx, samsync_state, 
+					if (!samsync_handle_user(delta_ctx, samsync_state, 
 								 r.in.database_id, &r.out.delta_enum_array->delta_enum[d])) {
 						printf("Failed to handle DELTA_USER\n");
 						ret = False;
 					}
 					break;
 				case NETR_DELTA_ALIAS:
-					if (!samsync_handle_alias(mem_ctx, samsync_state, 
+					if (!samsync_handle_alias(delta_ctx, samsync_state, 
 								  r.in.database_id, &r.out.delta_enum_array->delta_enum[d])) {
 						printf("Failed to handle DELTA_ALIAS\n");
 						ret = False;
 					}
 					break;
 				case NETR_DELTA_POLICY:
-					if (!samsync_handle_policy(mem_ctx, samsync_state, 
+					if (!samsync_handle_policy(delta_ctx, samsync_state, 
 								   r.in.database_id, &r.out.delta_enum_array->delta_enum[d])) {
 						printf("Failed to handle DELTA_POLICY\n");
 						ret = False;
 					}
 					break;
 				case NETR_DELTA_TRUSTED_DOMAIN:
-					if (!samsync_handle_trusted_domain(mem_ctx, samsync_state, 
+					if (!samsync_handle_trusted_domain(delta_ctx, samsync_state, 
 									   r.in.database_id, &r.out.delta_enum_array->delta_enum[d])) {
 						printf("Failed to handle DELTA_TRUSTED_DOMAIN\n");
 						ret = False;
 					}
 					break;
 				case NETR_DELTA_ACCOUNT:
-					if (!samsync_handle_account(mem_ctx, samsync_state, 
+					if (!samsync_handle_account(delta_ctx, samsync_state, 
 								    r.in.database_id, &r.out.delta_enum_array->delta_enum[d])) {
 						printf("Failed to handle DELTA_ACCOUNT\n");
 						ret = False;
 					}
 					break;
 				case NETR_DELTA_SECRET:
-					if (!samsync_handle_secret(mem_ctx, samsync_state, 
+					if (!samsync_handle_secret(delta_ctx, samsync_state, 
 								   r.in.database_id, &r.out.delta_enum_array->delta_enum[d])) {
 						printf("Failed to handle DELTA_SECRET\n");
 						ret = False;
 					}
 					break;
 				}
+				talloc_free(delta_ctx);
 			}
+			talloc_free(loop_ctx);
 		} while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
 		
 	}
@@ -1121,10 +1130,12 @@ static BOOL test_DatabaseSync(struct samsync_state *samsync_state,
 		printf("Never got a DOMAIN object in samsync!\n");
 		return False;
 	}
+
+	trustdom_ctx = talloc_named(mem_ctx, 0, "test_DatabaseSync Trusted domains context");
 	
-	username = talloc_asprintf(mem_ctx, "%s$", domain);
+	username = talloc_asprintf(trustdom_ctx, "%s$", domain);
 	for (t=samsync_state->trusted_domains; t; t=t->next) {
-		char *secret_name = talloc_asprintf(mem_ctx, "G$$%s", t->name);
+		char *secret_name = talloc_asprintf(trustdom_ctx, "G$$%s", t->name);
 		for (s=samsync_state->secrets; s; s=s->next) {
 			if (StrCaseCmp(s->name, secret_name) == 0) {
 				NTSTATUS nt_status;
@@ -1132,7 +1143,7 @@ static BOOL test_DatabaseSync(struct samsync_state *samsync_state,
 				mdfour(nt_hash.hash, s->secret.data, s->secret.length);
 				
 				printf("Checking password for %s\\%s\n", t->name, username);
-				nt_status = test_SamLogon(samsync_state->p_netlogon_wksta, mem_ctx, samsync_state->creds_netlogon_wksta, 
+				nt_status = test_SamLogon(samsync_state->p_netlogon_wksta, trustdom_ctx, samsync_state->creds_netlogon_wksta, 
 							  t->name,
 							  username, 
 							  TEST_WKSTA_MACHINE_NAME,
@@ -1153,7 +1164,7 @@ static BOOL test_DatabaseSync(struct samsync_state *samsync_state,
 				
 				/* break it */
 				nt_hash.hash[0]++;
-				nt_status = test_SamLogon(samsync_state->p_netlogon_wksta, mem_ctx, samsync_state->creds_netlogon_wksta, 
+				nt_status = test_SamLogon(samsync_state->p_netlogon_wksta, trustdom_ctx, samsync_state->creds_netlogon_wksta, 
 							  t->name,
 							  username, 
 							  TEST_WKSTA_MACHINE_NAME,
@@ -1171,6 +1182,7 @@ static BOOL test_DatabaseSync(struct samsync_state *samsync_state,
 			}
 		}
 	}
+	talloc_free(trustdom_ctx);
 	return ret;
 }
 
@@ -1181,6 +1193,7 @@ static BOOL test_DatabaseSync(struct samsync_state *samsync_state,
 static BOOL test_DatabaseDeltas(struct samsync_state *samsync_state, TALLOC_CTX *mem_ctx)
 {
 	NTSTATUS status;
+	TALLOC_CTX *loop_ctx;
 	struct netr_DatabaseDeltas r;
 	const uint32_t database_ids[] = {0, 1, 2}; 
 	int i;
@@ -1204,15 +1217,15 @@ static BOOL test_DatabaseDeltas(struct samsync_state *samsync_state, TALLOC_CTX
 		       r.in.database_id, r.in.sequence_num);
 
 		do {
+			loop_ctx = talloc_named(mem_ctx, 0, "test_DatabaseDeltas loop context");
 			creds_client_authenticator(samsync_state->creds, &r.in.credential);
 
-			status = dcerpc_netr_DatabaseDeltas(samsync_state->p, mem_ctx, &r);
+			status = dcerpc_netr_DatabaseDeltas(samsync_state->p, loop_ctx, &r);
 			if (!NT_STATUS_IS_OK(status) &&
 			    !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) &&
 			    !NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED)) {
 				printf("DatabaseDeltas - %s\n", nt_errstr(status));
 				ret = False;
-				break;
 			}
 
 			if (!creds_client_check(samsync_state->creds, &r.out.return_authenticator.cred)) {
@@ -1220,6 +1233,7 @@ static BOOL test_DatabaseDeltas(struct samsync_state *samsync_state, TALLOC_CTX
 			}
 
 			r.in.sequence_num++;
+			talloc_free(loop_ctx);
 		} while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
 	}
 
@@ -1234,6 +1248,7 @@ static BOOL test_DatabaseSync2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			       struct creds_CredentialState *creds)
 {
 	NTSTATUS status;
+	TALLOC_CTX *loop_ctx;
 	struct netr_DatabaseSync2 r;
 	const uint32_t database_ids[] = {0, 1, 2}; 
 	int i;
@@ -1252,14 +1267,14 @@ static BOOL test_DatabaseSync2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		printf("Testing DatabaseSync2 of id %d\n", r.in.database_id);
 
 		do {
+			loop_ctx = talloc_named(mem_ctx, 0, "test_DatabaseSync2 loop context");
 			creds_client_authenticator(creds, &r.in.credential);
 
-			status = dcerpc_netr_DatabaseSync2(p, mem_ctx, &r);
+			status = dcerpc_netr_DatabaseSync2(p, loop_ctx, &r);
 			if (!NT_STATUS_IS_OK(status) &&
 			    !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
 				printf("DatabaseSync2 - %s\n", nt_errstr(status));
 				ret = False;
-				break;
 			}
 
 			if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
@@ -1267,6 +1282,7 @@ static BOOL test_DatabaseSync2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			}
 
 			r.in.sync_context = r.out.sync_context;
+			talloc_free(loop_ctx);
 		} while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES));
 	}
 
@@ -1295,7 +1311,8 @@ BOOL torture_rpc_samsync(void)
 	struct lsa_ObjectAttribute attr;
 	struct lsa_QosInfo qos;
 	struct lsa_OpenPolicy2 r;
-	struct cli_credentials credentials;
+	struct cli_credentials *credentials;
+	struct cli_credentials *credentials_wksta;
 
 	struct samsync_state *samsync_state;
 
@@ -1304,11 +1321,12 @@ BOOL torture_rpc_samsync(void)
 	char *test_wksta_machine_account;
 
 	mem_ctx = talloc_init("torture_rpc_netlogon");
-
+	
 	test_machine_account = talloc_asprintf(mem_ctx, "%s$", TEST_MACHINE_NAME);
 	join_ctx = torture_create_testuser(test_machine_account, lp_workgroup(), ACB_SVRTRUST, 
 					   &machine_password);
 	if (!join_ctx) {
+		talloc_free(mem_ctx);
 		printf("Failed to join as BDC\n");
 		return False;
 	}
@@ -1317,6 +1335,7 @@ BOOL torture_rpc_samsync(void)
 	join_ctx2 = torture_create_testuser(test_wksta_machine_account, lp_workgroup(), ACB_WSTRUST, 
 					    &wksta_machine_password);
 	if (!join_ctx2) {
+		talloc_free(mem_ctx);
 		printf("Failed to join as member\n");
 		return False;
 	}
@@ -1325,6 +1344,7 @@ BOOL torture_rpc_samsync(void)
 					   lp_workgroup(),
 					   ACB_NORMAL, NULL);
 	if (!user_ctx) {
+		talloc_free(mem_ctx);
 		printf("Failed to create test account\n");
 		return False;
 	}
@@ -1375,7 +1395,8 @@ BOOL torture_rpc_samsync(void)
 	}
 	
 
-	status = torture_rpc_connection(&samsync_state->p_lsa, 
+	status = torture_rpc_connection(samsync_state,
+					&samsync_state->p_lsa, 
 					DCERPC_LSARPC_NAME,
 					DCERPC_LSARPC_UUID,
 					DCERPC_LSARPC_VERSION);
@@ -1419,23 +1440,27 @@ BOOL torture_rpc_samsync(void)
 	b->flags &= ~DCERPC_AUTH_OPTIONS;
 	b->flags |= DCERPC_SCHANNEL_BDC | DCERPC_SIGN;
 
-	cli_credentials_set_workstation(&credentials, TEST_MACHINE_NAME, CRED_SPECIFIED);
-	cli_credentials_set_domain(&credentials, lp_workgroup(), CRED_SPECIFIED);
-	cli_credentials_set_username(&credentials, test_machine_account, CRED_SPECIFIED);
-	cli_credentials_set_password(&credentials, machine_password, CRED_SPECIFIED);
+	credentials = cli_credentials_init(mem_ctx);
 
-	status = dcerpc_pipe_connect_b(&samsync_state->p, b, 
+	cli_credentials_set_workstation(credentials, TEST_MACHINE_NAME, CRED_SPECIFIED);
+	cli_credentials_set_domain(credentials, lp_workgroup(), CRED_SPECIFIED);
+	cli_credentials_set_username(credentials, test_machine_account, CRED_SPECIFIED);
+	cli_credentials_set_password(credentials, machine_password, CRED_SPECIFIED);
+
+	status = dcerpc_pipe_connect_b(samsync_state,
+				       &samsync_state->p, b, 
 				       DCERPC_NETLOGON_UUID,
 				       DCERPC_NETLOGON_VERSION,
-					   &credentials);
-
+				       credentials);
+	
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("Failed to connect to server as a BDC: %s\n", nt_errstr(status));
 		ret = False;
 		goto failed;
 	}
 
-	status = dcerpc_schannel_creds(samsync_state->p->conn->security_state.generic_state, mem_ctx, &samsync_state->creds);
+	status = dcerpc_schannel_creds(samsync_state->p->conn->security_state.generic_state, 
+				       samsync_state, &samsync_state->creds);
 	if (!NT_STATUS_IS_OK(status)) {
 		ret = False;
 	}
@@ -1452,15 +1477,19 @@ BOOL torture_rpc_samsync(void)
 	b_netlogon_wksta->flags &= ~DCERPC_AUTH_OPTIONS;
 	b_netlogon_wksta->flags |= DCERPC_SCHANNEL_WORKSTATION | DCERPC_SIGN;
 
-	cli_credentials_set_workstation(&credentials, TEST_WKSTA_MACHINE_NAME, CRED_SPECIFIED);
-	cli_credentials_set_username(&credentials, test_wksta_machine_account, CRED_SPECIFIED);
-	cli_credentials_set_password(&credentials, wksta_machine_password, CRED_SPECIFIED);
+	credentials_wksta = cli_credentials_init(mem_ctx);
+
+	cli_credentials_set_workstation(credentials_wksta, TEST_WKSTA_MACHINE_NAME, CRED_SPECIFIED);
+	cli_credentials_set_domain(credentials_wksta, lp_workgroup(), CRED_SPECIFIED);
+	cli_credentials_set_username(credentials_wksta, test_wksta_machine_account, CRED_SPECIFIED);
+	cli_credentials_set_password(credentials_wksta, wksta_machine_password, CRED_SPECIFIED);
 
-	status = dcerpc_pipe_connect_b(&samsync_state->p_netlogon_wksta, 
+	status = dcerpc_pipe_connect_b(samsync_state, 
+				       &samsync_state->p_netlogon_wksta, 
 				       b_netlogon_wksta, 
 				       DCERPC_NETLOGON_UUID,
 				       DCERPC_NETLOGON_VERSION,
-					   &credentials);
+				       credentials_wksta);
 
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("Failed to connect to server as a Workstation: %s\n", nt_errstr(status));
@@ -1469,7 +1498,7 @@ BOOL torture_rpc_samsync(void)
 	}
 
 	status = dcerpc_schannel_creds(samsync_state->p_netlogon_wksta->conn->security_state.generic_state, 
-				       mem_ctx, &samsync_state->creds_netlogon_wksta);
+				       samsync_state, &samsync_state->creds_netlogon_wksta);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("Failed to obtail schanel creds!\n");
 		ret = False;
@@ -1490,7 +1519,6 @@ BOOL torture_rpc_samsync(void)
 		ret = False;
 	}
 failed:
-	torture_rpc_close(samsync_state->p);
 
 	torture_leave_domain(join_ctx);
 	torture_leave_domain(join_ctx2);
diff --git a/source4/torture/rpc/scanner.c b/source4/torture/rpc/scanner.c
index 3d78d7a888..d7a5d03271 100644
--- a/source4/torture/rpc/scanner.c
+++ b/source4/torture/rpc/scanner.c
@@ -39,7 +39,8 @@ static BOOL test_num_calls(const struct dcerpc_interface_table *iface,
 
 	uuid = GUID_string(mem_ctx, &id->uuid);
 
-	status = torture_rpc_connection(&p, iface->name,
+	status = torture_rpc_connection(mem_ctx, 
+					&p, iface->name,
 					uuid, id->if_version);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("Failed to connect to '%s' on '%s' - %s\n", 
@@ -80,7 +81,7 @@ static BOOL test_num_calls(const struct dcerpc_interface_table *iface,
 	}
 
 done:
-	torture_rpc_close(p);
+	talloc_free(p);
 	return True;
 }
 
@@ -132,7 +133,7 @@ BOOL torture_rpc_scanner(void)
 {
         NTSTATUS status;
         struct dcerpc_pipe *p;
-	TALLOC_CTX *mem_ctx;
+	TALLOC_CTX *mem_ctx, *loop_ctx;
 	BOOL ret = True;
 	const struct dcerpc_interface_list *l;
 	const char *binding = lp_parm_string(-1, "torture", "binding");
@@ -141,20 +142,24 @@ BOOL torture_rpc_scanner(void)
 	mem_ctx = talloc_init("torture_rpc_scanner");
 
 	if (!binding) {
+		talloc_free(mem_ctx);
 		printf("You must supply a ncacn binding string\n");
 		return False;
 	}
 	
 	status = dcerpc_parse_binding(mem_ctx, binding, &b);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		printf("Failed to parse binding '%s'\n", binding);
 		return False;
 	}
 
 	for (l=librpc_dcerpc_pipes();l;l=l->next) {		
+		loop_ctx = talloc_named(mem_ctx, 0, "torture_rpc_scanner loop context");
 		/* some interfaces are not mappable */
 		if (l->table->num_calls == 0 ||
 		    strcmp(l->table->name, "mgmt") == 0) {
+			talloc_free(loop_ctx);
 			continue;
 		}
 
@@ -165,6 +170,7 @@ BOOL torture_rpc_scanner(void)
 							 l->table->uuid,
 							 l->table->if_version);
 			if (!NT_STATUS_IS_OK(status)) {
+				talloc_free(loop_ctx);
 				printf("Failed to map port for uuid %s\n", l->table->uuid);
 				continue;
 			}
@@ -174,11 +180,13 @@ BOOL torture_rpc_scanner(void)
 
 		lp_set_cmdline("torture:binding", dcerpc_binding_string(mem_ctx, b));
 
-		status = torture_rpc_connection(&p, 
+		status = torture_rpc_connection(loop_ctx, 
+						&p, 
 						l->table->name,
 						DCERPC_MGMT_UUID,
 						DCERPC_MGMT_VERSION);
 		if (!NT_STATUS_IS_OK(status)) {
+			talloc_free(loop_ctx);
 			ret = False;
 			continue;
 		}
@@ -186,8 +194,6 @@ BOOL torture_rpc_scanner(void)
 		if (!test_inq_if_ids(p, mem_ctx, l->table)) {
 			ret = False;
 		}
-
-		torture_rpc_close(p);
 	}
 
 	return ret;
diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c
index f572933bf5..d27285a9cc 100644
--- a/source4/torture/rpc/schannel.c
+++ b/source4/torture/rpc/schannel.c
@@ -127,17 +127,22 @@ static BOOL test_schannel(TALLOC_CTX *mem_ctx,
 	struct dcerpc_pipe *p = NULL;
 	struct dcerpc_pipe *p_netlogon = NULL;
 	struct creds_CredentialState *creds;
-	struct cli_credentials credentials;
+	struct cli_credentials *credentials;
+
+	TALLOC_CTX *test_ctx = talloc_named(mem_ctx, 0, "test_schannel context");
 	char *test_machine_account = talloc_asprintf(NULL, "%s$", TEST_MACHINE_NAME);
 
+	credentials = cli_credentials_init(mem_ctx);
+
 	join_ctx = torture_create_testuser(test_machine_account, lp_workgroup(), 
 					   acct_flags, &machine_password);
 	if (!join_ctx) {
 		printf("Failed to join domain with acct_flags=0x%x\n", acct_flags);
+		talloc_free(test_ctx);
 		return False;
 	}
 
-	status = dcerpc_parse_binding(mem_ctx, binding, &b);
+	status = dcerpc_parse_binding(test_ctx, binding, &b);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("Bad binding string %s\n", binding);
 		goto failed;
@@ -146,25 +151,27 @@ static BOOL test_schannel(TALLOC_CTX *mem_ctx,
 	b->flags &= ~DCERPC_AUTH_OPTIONS;
 	b->flags |= dcerpc_flags;
 
-	cli_credentials_set_domain(&credentials, lp_workgroup(), CRED_SPECIFIED);
-	cli_credentials_set_workstation(&credentials, TEST_MACHINE_NAME, CRED_SPECIFIED);
-	cli_credentials_set_username(&credentials, test_machine_account, CRED_SPECIFIED);
-	cli_credentials_set_password(&credentials, machine_password, CRED_SPECIFIED);
-	status = dcerpc_pipe_connect_b(&p, b, 
+	cli_credentials_set_domain(credentials, lp_workgroup(), CRED_SPECIFIED);
+	cli_credentials_set_workstation(credentials, TEST_MACHINE_NAME, CRED_SPECIFIED);
+	cli_credentials_set_username(credentials, test_machine_account, CRED_SPECIFIED);
+	cli_credentials_set_password(credentials, machine_password, CRED_SPECIFIED);
+
+	status = dcerpc_pipe_connect_b(test_ctx, 
+				       &p, b, 
 				       DCERPC_SAMR_UUID,
 				       DCERPC_SAMR_VERSION,
-					   &credentials);
+				       credentials);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("Failed to connect with schannel: %s\n", nt_errstr(status));
 		goto failed;
 	}
 
-	if (!test_samr_ops(p, mem_ctx)) {
+	if (!test_samr_ops(p, test_ctx)) {
 		printf("Failed to process schannel secured ops\n");
 		goto failed;
 	}
 
-	status = dcerpc_schannel_creds(p->conn->security_state.generic_state, mem_ctx, &creds);
+	status = dcerpc_schannel_creds(p->conn->security_state.generic_state, test_ctx, &creds);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto failed;
 	}
@@ -174,7 +181,7 @@ static BOOL test_schannel(TALLOC_CTX *mem_ctx,
 	 * the second */
 
 	/* Swap the binding details from SAMR to NETLOGON */
-	status = dcerpc_epm_map_binding(mem_ctx, b, DCERPC_NETLOGON_UUID,
+	status = dcerpc_epm_map_binding(test_ctx, b, DCERPC_NETLOGON_UUID,
 					DCERPC_NETLOGON_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto failed;
@@ -196,26 +203,24 @@ static BOOL test_schannel(TALLOC_CTX *mem_ctx,
 		goto failed;
 	}
 
-	status = dcerpc_schannel_creds(p_netlogon->conn->security_state.generic_state, mem_ctx, &creds);
+	status = dcerpc_schannel_creds(p_netlogon->conn->security_state.generic_state, test_ctx, &creds);
 	if (!NT_STATUS_IS_OK(status)) {
 		goto failed;
 	}
 
 	/* do a couple of logins */
-	if (!test_netlogon_ops(p_netlogon, mem_ctx, creds)) {
+	if (!test_netlogon_ops(p_netlogon, test_ctx, creds)) {
 		printf("Failed to process schannel secured ops\n");
 		goto failed;
 	}
 
 	torture_leave_domain(join_ctx);
-	dcerpc_pipe_close(p_netlogon);
-	dcerpc_pipe_close(p);
+	talloc_free(test_ctx);
 	return True;
 
 failed:
 	torture_leave_domain(join_ctx);
-	dcerpc_pipe_close(p_netlogon);
-	dcerpc_pipe_close(p);
+	talloc_free(test_ctx);
 	return False;	
 }
 
diff --git a/source4/torture/rpc/spoolss.c b/source4/torture/rpc/spoolss.c
index e5c827afaa..acaa5828dc 100644
--- a/source4/torture/rpc/spoolss.c
+++ b/source4/torture/rpc/spoolss.c
@@ -732,7 +732,7 @@ static BOOL test_SecondaryClosePrinter(struct dcerpc_pipe *p, TALLOC_CTX *mem_ct
 				       DCERPC_SPOOLSS_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("Failed to create bind on secondary connection\n");
-		dcerpc_pipe_close(p2);
+		talloc_free(p2);
 
                 return False;
         }
@@ -748,7 +748,7 @@ static BOOL test_SecondaryClosePrinter(struct dcerpc_pipe *p, TALLOC_CTX *mem_ct
 		ret = False;
 	}
 
-	dcerpc_pipe_close(p2);
+	talloc_free(p2);
 
 	return ret;
 }
@@ -1165,16 +1165,18 @@ BOOL torture_rpc_spoolss(void)
 	TALLOC_CTX *mem_ctx;
 	BOOL ret = True;
 
-	status = torture_rpc_connection(&p, 
+	mem_ctx = talloc_init("torture_rpc_spoolss");
+
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_SPOOLSS_NAME,
 					DCERPC_SPOOLSS_UUID,
 					DCERPC_SPOOLSS_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
-	mem_ctx = talloc_init("torture_rpc_spoolss");
-
 	ret &= test_OpenPrinter_badnames(p, mem_ctx);
 
 	ret &= test_AddPort(p, mem_ctx);
@@ -1187,7 +1189,5 @@ BOOL torture_rpc_spoolss(void)
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/srvsvc.c b/source4/torture/rpc/srvsvc.c
index 697ae4afe7..c12504e646 100644
--- a/source4/torture/rpc/srvsvc.c
+++ b/source4/torture/rpc/srvsvc.c
@@ -720,11 +720,13 @@ BOOL torture_rpc_srvsvc(void)
 
 	mem_ctx = talloc_init("torture_rpc_srvsvc");
 
-	status = torture_rpc_connection(&p,
+	status = torture_rpc_connection(mem_ctx, 
+					&p,
 					DCERPC_SRVSVC_NAME,
 					DCERPC_SRVSVC_UUID,
 					DCERPC_SRVSVC_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -774,7 +776,5 @@ BOOL torture_rpc_srvsvc(void)
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c
index 092329ab68..44b79058a9 100644
--- a/source4/torture/rpc/svcctl.c
+++ b/source4/torture/rpc/svcctl.c
@@ -117,11 +117,13 @@ BOOL torture_rpc_svcctl(void)
 
 	mem_ctx = talloc_init("torture_rpc_svcctl");
 
-	status = torture_rpc_connection(&p,
+	status = torture_rpc_connection(mem_ctx, 
+					&p,
 					DCERPC_SVCCTL_NAME,
 					DCERPC_SVCCTL_UUID,
 					DCERPC_SVCCTL_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -139,7 +141,5 @@ BOOL torture_rpc_svcctl(void)
 
 	talloc_free(mem_ctx);
 
-    torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/testjoin.c b/source4/torture/rpc/testjoin.c
index 2d96116c0d..5e4c5a32f3 100644
--- a/source4/torture/rpc/testjoin.c
+++ b/source4/torture/rpc/testjoin.c
@@ -121,7 +121,8 @@ struct test_join *torture_create_testuser(const char *username,
 
 	printf("Connecting to SAMR\n");
 
-	status = torture_rpc_connection(&join->p, 
+	status = torture_rpc_connection(join, 
+					&join->p, 
 					DCERPC_SAMR_NAME,
 					DCERPC_SAMR_UUID,
 					DCERPC_SAMR_VERSION);
@@ -305,10 +306,6 @@ void torture_leave_domain(struct test_join *join)
 		}
 	}
 
-	if (join->p) {
-		torture_rpc_close(join->p);
-	}
-
 	talloc_free(join);
 }
 
diff --git a/source4/torture/rpc/winreg.c b/source4/torture/rpc/winreg.c
index df0114b669..c6eada4d79 100644
--- a/source4/torture/rpc/winreg.c
+++ b/source4/torture/rpc/winreg.c
@@ -760,7 +760,7 @@ static BOOL test_Open(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, void *fn)
 BOOL torture_rpc_winreg(void)
 {
         NTSTATUS status;
-       struct dcerpc_pipe *p;
+	struct dcerpc_pipe *p;
 	TALLOC_CTX *mem_ctx;
 	BOOL ret = True;
 	winreg_open_fn *open_fns[] = { test_OpenHKLM, test_OpenHKU,
@@ -769,12 +769,14 @@ BOOL torture_rpc_winreg(void)
 
 	mem_ctx = talloc_init("torture_rpc_winreg");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_WINREG_NAME, 
 					DCERPC_WINREG_UUID, 
 					DCERPC_WINREG_VERSION);
 
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -794,7 +796,5 @@ BOOL torture_rpc_winreg(void)
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/rpc/wkssvc.c b/source4/torture/rpc/wkssvc.c
index f3a3ec233c..47e893ae2e 100644
--- a/source4/torture/rpc/wkssvc.c
+++ b/source4/torture/rpc/wkssvc.c
@@ -93,11 +93,13 @@ BOOL torture_rpc_wkssvc(void)
 
 	mem_ctx = talloc_init("torture_rpc_wkssvc");
 
-	status = torture_rpc_connection(&p, 
+	status = torture_rpc_connection(mem_ctx, 
+					&p, 
 					DCERPC_WKSSVC_NAME,
 					DCERPC_WKSSVC_UUID,
 					DCERPC_WKSSVC_VERSION);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(mem_ctx);
 		return False;
 	}
 
@@ -111,7 +113,5 @@ BOOL torture_rpc_wkssvc(void)
 
 	talloc_free(mem_ctx);
 
-        torture_rpc_close(p);
-
 	return ret;
 }
diff --git a/source4/torture/torture.c b/source4/torture/torture.c
index cdc9efbf7c..4fca36a9ae 100644
--- a/source4/torture/torture.c
+++ b/source4/torture/torture.c
@@ -120,7 +120,8 @@ BOOL torture_close_connection(struct smbcli_state *c)
 }
 
 /* open a rpc connection to the chosen binding string */
-NTSTATUS torture_rpc_connection(struct dcerpc_pipe **p, 
+NTSTATUS torture_rpc_connection(TALLOC_CTX *parent_ctx, 
+				struct dcerpc_pipe **p, 
 				const char *pipe_name,
 				const char *pipe_uuid, 
 				uint32_t pipe_version)
@@ -133,14 +134,16 @@ NTSTATUS torture_rpc_connection(struct dcerpc_pipe **p,
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
-	status = dcerpc_pipe_connect(p, binding, pipe_uuid, pipe_version,
-					 cmdline_credentials);
+	status = dcerpc_pipe_connect(parent_ctx, 
+				     p, binding, pipe_uuid, pipe_version,
+				     cmdline_credentials);
  
         return status;
 }
 
 /* open a rpc connection to a specific transport */
-NTSTATUS torture_rpc_connection_transport(struct dcerpc_pipe **p, 
+NTSTATUS torture_rpc_connection_transport(TALLOC_CTX *parent_ctx, 
+					  struct dcerpc_pipe **p, 
 					  const char *pipe_name,
 					  const char *pipe_uuid, 
 					  uint32_t pipe_version,
@@ -149,10 +152,11 @@ NTSTATUS torture_rpc_connection_transport(struct dcerpc_pipe **p,
         NTSTATUS status;
 	const char *binding = lp_parm_string(-1, "torture", "binding");
 	struct dcerpc_binding *b;
-	TALLOC_CTX *mem_ctx = talloc_init("torture_rpc_connection_smb");
+	TALLOC_CTX *mem_ctx = talloc_named(parent_ctx, 0, "torture_rpc_connection_smb");
 
 	if (!binding) {
 		printf("You must specify a ncacn binding string\n");
+		talloc_free(mem_ctx);
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
@@ -165,21 +169,18 @@ NTSTATUS torture_rpc_connection_transport(struct dcerpc_pipe **p,
 
 	b->transport = transport;
 
-	status = dcerpc_pipe_connect_b(p, b, pipe_uuid, pipe_version,
+	status = dcerpc_pipe_connect_b(mem_ctx, p, b, pipe_uuid, pipe_version,
 								   cmdline_credentials);
 					   
- 
+	if (NT_STATUS_IS_OK(status)) {
+		*p = talloc_reference(parent_ctx, *p);
+	} else {
+		*p = NULL;
+	}
+	talloc_free(mem_ctx);
         return status;
 }
 
-/* close a rpc connection to a named pipe */
-NTSTATUS torture_rpc_close(struct dcerpc_pipe *p)
-{
-	dcerpc_pipe_close(p);
-	return NT_STATUS_OK;
-}
-
-
 /* check if the server produced the expected error code */
 BOOL check_error(const char *location, struct smbcli_state *c, 
 		 uint8_t eclass, uint32_t ecode, NTSTATUS nterr)
@@ -2636,7 +2637,7 @@ static BOOL is_binding_string(const char *binding_string)
 #endif
 
 	pc = poptGetContext("smbtorture", argc, (const char **) argv, long_options, 
-				POPT_CONTEXT_KEEP_FIRST);
+			    POPT_CONTEXT_KEEP_FIRST);
 
 	poptSetOtherOptionHelp(pc, "<binding>|<unc> TEST1 TEST2 ...");