Merge branch 'master' of git://git.samba.org/samba

9 files changed, 644 insertions, 219 deletions

diff --git a/source4/dsdb/repl/drepl_notify.c b/source4/dsdb/repl/drepl_notify.c
index fe3b2d2497..2f0fa4892b 100644
--- a/source4/dsdb/repl/drepl_notify.c
+++ b/source4/dsdb/repl/drepl_notify.c
@@ -101,13 +101,14 @@ static void dreplsrv_op_notify_replica_sync_send(struct dreplsrv_op_notify_state
 /*
   called when we have an established connection
  */
-static void dreplsrv_op_notify_connect_recv(struct composite_context *creq)
+static void dreplsrv_op_notify_connect_done(struct tevent_req *subreq)
 {
-	struct dreplsrv_op_notify_state *st = talloc_get_type(creq->async.private_data,
-							      struct dreplsrv_op_notify_state);
+	struct dreplsrv_op_notify_state *st = tevent_req_callback_data(subreq,
+					      struct dreplsrv_op_notify_state);
 	struct composite_context *c = st->creq;
 
-	c->status = dreplsrv_out_drsuapi_recv(creq);
+	c->status = dreplsrv_out_drsuapi_recv(subreq);
+	TALLOC_FREE(subreq);
 	if (!composite_is_ok(c)) return;
 
 	dreplsrv_op_notify_replica_sync_send(st);
@@ -119,8 +120,8 @@ static void dreplsrv_op_notify_connect_recv(struct composite_context *creq)
 static struct composite_context *dreplsrv_op_notify_send(struct dreplsrv_notify_operation *op)
 {
 	struct composite_context *c;
-	struct composite_context *creq;
 	struct dreplsrv_op_notify_state *st;
+	struct tevent_req *subreq;
 
 	c = composite_create(op, op->service->task->event_ctx);
 	if (c == NULL) return NULL;
@@ -131,8 +132,11 @@ static struct composite_context *dreplsrv_op_notify_send(struct dreplsrv_notify_
 	st->creq	= c;
 	st->op		= op;
 
-	creq = dreplsrv_out_drsuapi_send(op->source_dsa->conn);
-	composite_continue(c, creq, dreplsrv_op_notify_connect_recv, st);
+	subreq = dreplsrv_out_drsuapi_send(st,
+					   op->service->task->event_ctx,
+					   op->source_dsa->conn);
+	if (composite_nomem(subreq, c)) return c;
+	tevent_req_set_callback(subreq, dreplsrv_op_notify_connect_done, st);
 
 	return c;
 }
diff --git a/source4/dsdb/repl/drepl_out_helpers.c b/source4/dsdb/repl/drepl_out_helpers.c
index 03f8842494..722db4f8ee 100644
--- a/source4/dsdb/repl/drepl_out_helpers.c
+++ b/source4/dsdb/repl/drepl_out_helpers.c
@@ -34,10 +34,9 @@
 #include "libcli/composite/composite.h"
 #include "auth/gensec/gensec.h"
 #include "param/param.h"
+#include "../lib/util/tevent_ntstatus.h"
 
 struct dreplsrv_out_drsuapi_state {
-	struct composite_context *creq;
-
 	struct dreplsrv_out_connection *conn;
 
 	struct dreplsrv_drsuapi_connection *drsuapi;
@@ -46,139 +45,160 @@ struct dreplsrv_out_drsuapi_state {
 	struct drsuapi_DsBind bind_r;
 };
 
-static void dreplsrv_out_drsuapi_connect_recv(struct composite_context *creq);
+static void dreplsrv_out_drsuapi_connect_done(struct composite_context *creq);
 
-struct composite_context *dreplsrv_out_drsuapi_send(struct dreplsrv_out_connection *conn)
+struct tevent_req *dreplsrv_out_drsuapi_send(TALLOC_CTX *mem_ctx,
+					     struct tevent_context *ev,
+					     struct dreplsrv_out_connection *conn)
 {
-	struct composite_context *c;
+	struct tevent_req *req;
+	struct dreplsrv_out_drsuapi_state *state;
 	struct composite_context *creq;
-	struct dreplsrv_out_drsuapi_state *st;
 
-	c = composite_create(conn, conn->service->task->event_ctx);
-	if (c == NULL) return NULL;
+	req = tevent_req_create(mem_ctx, &state,
+				struct dreplsrv_out_drsuapi_state);
+	if (req == NULL) {
+		return NULL;
+	}
 
-	st = talloc_zero(c, struct dreplsrv_out_drsuapi_state);
-	if (composite_nomem(st, c)) return c;
+	state->conn	= conn;
+	state->drsuapi	= conn->drsuapi;
 
-	c->private_data	= st;
+	if (state->drsuapi && !state->drsuapi->pipe->conn->dead) {
+		tevent_req_done(req);
+		return tevent_req_post(req, ev);
+	}
 
-	st->creq	= c;
-	st->conn	= conn;
-	st->drsuapi	= conn->drsuapi;
-
-	if (st->drsuapi && !st->drsuapi->pipe->conn->dead) {
-		composite_done(c);
-		return c;
-	} else if (st->drsuapi && st->drsuapi->pipe->conn->dead) {
-		talloc_free(st->drsuapi);
+	if (state->drsuapi && state->drsuapi->pipe->conn->dead) {
+		talloc_free(state->drsuapi);
 		conn->drsuapi = NULL;
 	}
 
-	st->drsuapi	= talloc_zero(st, struct dreplsrv_drsuapi_connection);
-	if (composite_nomem(st->drsuapi, c)) return c;
+	state->drsuapi = talloc_zero(state, struct dreplsrv_drsuapi_connection);
+	if (tevent_req_nomem(state->drsuapi, req)) {
+		return tevent_req_post(req, ev);
+	}
 
-	creq = dcerpc_pipe_connect_b_send(st, conn->binding, &ndr_table_drsuapi,
+	creq = dcerpc_pipe_connect_b_send(state, conn->binding, &ndr_table_drsuapi,
 					  conn->service->system_session_info->credentials,
-					  c->event_ctx, conn->service->task->lp_ctx);
-	composite_continue(c, creq, dreplsrv_out_drsuapi_connect_recv, st);
+					  ev, conn->service->task->lp_ctx);
+	if (tevent_req_nomem(creq, req)) {
+		return tevent_req_post(req, ev);
+	}
+	composite_continue(NULL, creq, dreplsrv_out_drsuapi_connect_done, req);
 
-	return c;
+	return req;
 }
 
-static void dreplsrv_out_drsuapi_bind_send(struct dreplsrv_out_drsuapi_state *st);
+static void dreplsrv_out_drsuapi_bind_done(struct rpc_request *rreq);
 
-static void dreplsrv_out_drsuapi_connect_recv(struct composite_context *creq)
+static void dreplsrv_out_drsuapi_connect_done(struct composite_context *creq)
 {
-	struct dreplsrv_out_drsuapi_state *st = talloc_get_type(creq->async.private_data,
-						struct dreplsrv_out_drsuapi_state);
-	struct composite_context *c = st->creq;
-
-	c->status = dcerpc_pipe_connect_b_recv(creq, st->drsuapi, &st->drsuapi->pipe);
-	if (!composite_is_ok(c)) return;
-
-	c->status = gensec_session_key(st->drsuapi->pipe->conn->security_state.generic_state,
-				       &st->drsuapi->gensec_skey);
-	if (!composite_is_ok(c)) return;
-
-	dreplsrv_out_drsuapi_bind_send(st);
-}
+	struct tevent_req *req = talloc_get_type(creq->async.private_data,
+						 struct tevent_req);
+	struct dreplsrv_out_drsuapi_state *state = tevent_req_data(req,
+						   struct dreplsrv_out_drsuapi_state);
+	NTSTATUS status;
+	struct rpc_request *rreq;
 
-static void dreplsrv_out_drsuapi_bind_recv(struct rpc_request *req);
+	status = dcerpc_pipe_connect_b_recv(creq,
+					    state->drsuapi,
+					    &state->drsuapi->pipe);
+	if (tevent_req_nterror(req, status)) {
+		return;
+	}
 
-static void dreplsrv_out_drsuapi_bind_send(struct dreplsrv_out_drsuapi_state *st)
-{
-	struct composite_context *c = st->creq;
-	struct rpc_request *req;
+	status = gensec_session_key(state->drsuapi->pipe->conn->security_state.generic_state,
+				    &state->drsuapi->gensec_skey);
+	if (tevent_req_nterror(req, status)) {
+		return;
+	}
 
-	st->bind_info_ctr.length	= 28;
-	st->bind_info_ctr.info.info28	= st->conn->service->bind_info28;
+	state->bind_info_ctr.length		= 28;
+	state->bind_info_ctr.info.info28	= state->conn->service->bind_info28;
 
-	st->bind_r.in.bind_guid = &st->conn->service->ntds_guid;
-	st->bind_r.in.bind_info = &st->bind_info_ctr;
-	st->bind_r.out.bind_handle = &st->drsuapi->bind_handle;
+	state->bind_r.in.bind_guid = &state->conn->service->ntds_guid;
+	state->bind_r.in.bind_info = &state->bind_info_ctr;
+	state->bind_r.out.bind_handle = &state->drsuapi->bind_handle;
 
-	req = dcerpc_drsuapi_DsBind_send(st->drsuapi->pipe, st, &st->bind_r);
-	composite_continue_rpc(c, req, dreplsrv_out_drsuapi_bind_recv, st);
+	rreq = dcerpc_drsuapi_DsBind_send(state->drsuapi->pipe,
+					  state,
+					  &state->bind_r);
+	if (tevent_req_nomem(rreq, req)) {
+		return;
+	}
+	composite_continue_rpc(NULL, rreq, dreplsrv_out_drsuapi_bind_done, req);
 }
 
-static void dreplsrv_out_drsuapi_bind_recv(struct rpc_request *req)
+static void dreplsrv_out_drsuapi_bind_done(struct rpc_request *rreq)
 {
-	struct dreplsrv_out_drsuapi_state *st = talloc_get_type(req->async.private_data,
-						struct dreplsrv_out_drsuapi_state);
-	struct composite_context *c = st->creq;
+	struct tevent_req *req = talloc_get_type(rreq->async.private_data,
+						 struct tevent_req);
+	struct dreplsrv_out_drsuapi_state *state = tevent_req_data(req,
+						   struct dreplsrv_out_drsuapi_state);
+	NTSTATUS status;
 
-	c->status = dcerpc_ndr_request_recv(req);
-	if (!composite_is_ok(c)) return;
+	status = dcerpc_ndr_request_recv(rreq);
+	if (tevent_req_nterror(req, status)) {
+		return;
+	}
 
-	if (!W_ERROR_IS_OK(st->bind_r.out.result)) {
-		composite_error(c, werror_to_ntstatus(st->bind_r.out.result));
+	if (!W_ERROR_IS_OK(state->bind_r.out.result)) {
+		status = werror_to_ntstatus(state->bind_r.out.result);
+		tevent_req_nterror(req, status);
 		return;
 	}
 
-	ZERO_STRUCT(st->drsuapi->remote_info28);
-	if (st->bind_r.out.bind_info) {
-		switch (st->bind_r.out.bind_info->length) {
+	ZERO_STRUCT(state->drsuapi->remote_info28);
+	if (state->bind_r.out.bind_info) {
+		struct drsuapi_DsBindInfo28 *info28;
+		info28 = &state->drsuapi->remote_info28;
+
+		switch (state->bind_r.out.bind_info->length) {
 		case 24: {
 			struct drsuapi_DsBindInfo24 *info24;
-			info24 = &st->bind_r.out.bind_info->info.info24;
-			st->drsuapi->remote_info28.supported_extensions	= info24->supported_extensions;
-			st->drsuapi->remote_info28.site_guid		= info24->site_guid;
-			st->drsuapi->remote_info28.pid			= info24->pid;
-			st->drsuapi->remote_info28.repl_epoch		= 0;
+			info24 = &state->bind_r.out.bind_info->info.info24;
+
+			info28->supported_extensions	= info24->supported_extensions;
+			info28->site_guid		= info24->site_guid;
+			info28->pid			= info24->pid;
+			info28->repl_epoch		= 0;
 			break;
 		}
 		case 48: {
 			struct drsuapi_DsBindInfo48 *info48;
-			info48 = &st->bind_r.out.bind_info->info.info48;
-			st->drsuapi->remote_info28.supported_extensions	= info48->supported_extensions;
-			st->drsuapi->remote_info28.site_guid		= info48->site_guid;
-			st->drsuapi->remote_info28.pid			= info48->pid;
-			st->drsuapi->remote_info28.repl_epoch		= info48->repl_epoch;
+			info48 = &state->bind_r.out.bind_info->info.info48;
+
+			info28->supported_extensions	= info48->supported_extensions;
+			info28->site_guid		= info48->site_guid;
+			info28->pid			= info48->pid;
+			info28->repl_epoch		= info48->repl_epoch;
 			break;
 		}
 		case 28:
-			st->drsuapi->remote_info28 = st->bind_r.out.bind_info->info.info28;
+			*info28 = state->bind_r.out.bind_info->info.info28;
 			break;
 		}
 	}
 
-	composite_done(c);
+	tevent_req_done(req);
 }
 
-NTSTATUS dreplsrv_out_drsuapi_recv(struct composite_context *c)
+NTSTATUS dreplsrv_out_drsuapi_recv(struct tevent_req *req)
 {
+	struct dreplsrv_out_drsuapi_state *state = tevent_req_data(req,
+						   struct dreplsrv_out_drsuapi_state);
 	NTSTATUS status;
-	struct dreplsrv_out_drsuapi_state *st = talloc_get_type(c->private_data,
-						struct dreplsrv_out_drsuapi_state);
 
-	status = composite_wait(c);
-
-	if (NT_STATUS_IS_OK(status)) {
-		st->conn->drsuapi = talloc_steal(st->conn, st->drsuapi);
+	if (tevent_req_is_nterror(req, &status)) {
+		tevent_req_received(req);
+		return status;
 	}
 
-	talloc_free(c);
-	return status;
+	state->conn->drsuapi = talloc_move(state->conn, &state->drsuapi);
+
+	tevent_req_received(req);
+	return NT_STATUS_OK;
 }
 
 struct dreplsrv_op_pull_source_state {
@@ -195,13 +215,13 @@ struct dreplsrv_op_pull_source_state {
 	struct drsuapi_DsGetNCChangesCtr6 *ctr6;
 };
 
-static void dreplsrv_op_pull_source_connect_recv(struct composite_context *creq);
+static void dreplsrv_op_pull_source_connect_done(struct tevent_req *subreq);
 
 struct composite_context *dreplsrv_op_pull_source_send(struct dreplsrv_out_operation *op)
 {
 	struct composite_context *c;
-	struct composite_context *creq;
 	struct dreplsrv_op_pull_source_state *st;
+	struct tevent_req *subreq;
 
 	c = composite_create(op, op->service->task->event_ctx);
 	if (c == NULL) return NULL;
@@ -212,21 +232,25 @@ struct composite_context *dreplsrv_op_pull_source_send(struct dreplsrv_out_opera
 	st->creq	= c;
 	st->op		= op;
 
-	creq = dreplsrv_out_drsuapi_send(op->source_dsa->conn);
-	composite_continue(c, creq, dreplsrv_op_pull_source_connect_recv, st);
+	subreq = dreplsrv_out_drsuapi_send(st,
+					   op->service->task->event_ctx,
+					   op->source_dsa->conn);
+	if (composite_nomem(subreq, c)) return c;
+	tevent_req_set_callback(subreq, dreplsrv_op_pull_source_connect_done, st);
 
 	return c;
 }
 
 static void dreplsrv_op_pull_source_get_changes_send(struct dreplsrv_op_pull_source_state *st);
 
-static void dreplsrv_op_pull_source_connect_recv(struct composite_context *creq)
+static void dreplsrv_op_pull_source_connect_done(struct tevent_req *subreq)
 {
-	struct dreplsrv_op_pull_source_state *st = talloc_get_type(creq->async.private_data,
+	struct dreplsrv_op_pull_source_state *st = tevent_req_callback_data(subreq,
 						   struct dreplsrv_op_pull_source_state);
 	struct composite_context *c = st->creq;
 
-	c->status = dreplsrv_out_drsuapi_recv(creq);
+	c->status = dreplsrv_out_drsuapi_recv(subreq);
+	TALLOC_FREE(subreq);
 	if (!composite_is_ok(c)) return;
 
 	dreplsrv_op_pull_source_get_changes_send(st);
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index fc286c4d83..17a99c74c7 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -9,12 +9,12 @@
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
@@ -333,37 +333,37 @@ static int samldb_check_samAccountName_callback(struct ldb_request *req,
 {
 	struct samldb_ctx *ac;
 	int ret;
-	
+
 	ac = talloc_get_type(req->context, struct samldb_ctx);
-	
+
 	if (ares->error != LDB_SUCCESS) {
 		return ldb_module_done(ac->req, ares->controls,
                                        ares->response, ares->error);
 	}
-	
+
 	switch (ares->type) {
-	case LDB_REPLY_ENTRY:		
+	case LDB_REPLY_ENTRY:
 		/* if we get an entry it means this samAccountName
 		 * already exists */
 		return ldb_module_done(ac->req, NULL, NULL,
                                        LDB_ERR_ENTRY_ALREADY_EXISTS);
-		
+
 	case LDB_REPLY_REFERRAL:
 		/* this should not happen */
 		return ldb_module_done(ac->req, NULL, NULL,
                                        LDB_ERR_OPERATIONS_ERROR);
-		
+
 	case LDB_REPLY_DONE:
 		/* not found, go on */
 		talloc_free(ares);
 		ret = samldb_next_step(ac);
 		break;
 	}
-	
+
 	if (ret != LDB_SUCCESS) {
 		return ldb_module_done(ac->req, NULL, NULL, ret);
 	}
-	
+
 	return LDB_SUCCESS;
 }
 
@@ -374,16 +374,16 @@ static int samldb_check_samAccountName(struct samldb_ctx *ac)
 	const char *name;
 	char *filter;
         int ret;
-	
+
 	ldb = ldb_module_get_ctx(ac->module);
-	
+
         if (ldb_msg_find_element(ac->msg, "samAccountName") == NULL) {
                 ret = samldb_generate_samAccountName(ac->msg);
                 if (ret != LDB_SUCCESS) {
                         return ret;
                 }
         }
-	
+
 	name = ldb_msg_find_attr_as_string(ac->msg, "samAccountName", NULL);
 	if (name == NULL) {
 		return LDB_ERR_OPERATIONS_ERROR;
@@ -393,7 +393,7 @@ static int samldb_check_samAccountName(struct samldb_ctx *ac)
 	if (filter == NULL) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
-	
+
 	ret = ldb_build_search_req(&req, ldb, ac,
 				   ac->domain_dn, LDB_SCOPE_SUBTREE,
 				   filter, NULL,
@@ -569,7 +569,7 @@ static int samldb_get_sid_domain(struct samldb_ctx *ac)
 	/* get the domain component part of the provided SID */
 	ac->domain_sid->num_auths--;
 
-	filter = talloc_asprintf(ac, 
+	filter = talloc_asprintf(ac,
 				 "(&(objectSid=%s)"
 				 "(|(objectClass=domain)"
 				 "(objectClass=builtinDomain)))",
@@ -713,7 +713,7 @@ static int samldb_check_primaryGroupID_2(struct samldb_ctx *ac)
 		struct ldb_context *ldb;
 		ldb = ldb_module_get_ctx(ac->module);
 		ldb_asprintf_errstring(ldb,
-				       "Failed to find group sid %s!", 
+				       "Failed to find group sid %s!",
 				       dom_sid_string(ac->sid, ac->sid));
 		return LDB_ERR_UNWILLING_TO_PERFORM;
 	}
@@ -918,36 +918,33 @@ done:
 
 static int samldb_set_defaultObjectCategory(struct samldb_ctx *ac)
 {
+	struct ldb_context *ldb;
+	struct ldb_message *msg;
+	struct ldb_request *req;
 	int ret;
-	if (ac->dn) {
-		struct ldb_request *req;
-		struct ldb_context *ldb;
-		struct ldb_message *msg = ldb_msg_new(ac);
-
-		msg->dn = ac->dn;
-
-		ldb_msg_add_empty(msg, "defaultObjectCategory", LDB_FLAG_MOD_REPLACE, NULL);
-
-		ldb_msg_add_steal_string(msg, "defaultObjectCategory", ldb_dn_alloc_linearized(msg, ac->dn));
-
-		ldb = ldb_module_get_ctx(ac->module);
 
-		ret = ldb_build_mod_req(&req, ldb, ac,
-					msg, NULL,
-					ac, samldb_set_defaultObjectCategory_callback,
-					ac->req);
-		if (ret != LDB_SUCCESS) {
-			return ret;
-		}
+	ldb = ldb_module_get_ctx(ac->module);
 
-		return ldb_next_request(ac->module, req);
-	}
+	/* (Re)set the default object category to have it set to the DN in the
+	 * storage format */
+	msg = ldb_msg_new(ac);
+	msg->dn = ac->msg->dn;
+	ldb_msg_add_empty(msg, "defaultObjectCategory",
+			  LDB_FLAG_MOD_REPLACE, NULL);
+	ldb_msg_add_steal_string(msg, "defaultObjectCategory",
+				 ldb_dn_alloc_linearized(msg, ac->dn));
 
-	ret = samldb_next_step(ac);
+	ret = ldb_build_mod_req(&req, ldb, ac,
+				msg, NULL,
+				ac,
+				samldb_set_defaultObjectCategory_callback,
+				ac->req);
 	if (ret != LDB_SUCCESS) {
-		return ldb_module_done(ac->req, NULL, NULL, ret);
+		talloc_free(msg);
+		return ret;
 	}
-	return ret;
+
+	return ldb_next_request(ac->module, req);
 }
 
 /*
@@ -955,14 +952,35 @@ static int samldb_set_defaultObjectCategory(struct samldb_ctx *ac)
  */
 
 static int samldb_find_for_defaultObjectCategory_callback(struct ldb_request *req,
-						struct ldb_reply *ares)
+							  struct ldb_reply *ares)
 {
+	struct ldb_context *ldb;
 	struct samldb_ctx *ac;
 	int ret;
 
 	ac = talloc_get_type(req->context, struct samldb_ctx);
+	ldb = ldb_module_get_ctx(ac->module);
 
+	if (!ares) {
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
+	}
 	if (ares->error != LDB_SUCCESS) {
+		if (ares->error == LDB_ERR_NO_SUCH_OBJECT) {
+			if (ldb_request_get_control(ac->req,
+						    LDB_CONTROL_RELAX_OID) != NULL) {
+				/* Don't be pricky when the DN doesn't exist */
+				/* if we have the RELAX control specified */
+				ac->dn = req->op.search.base;
+				return samldb_next_step(ac);
+			} else {
+				ldb_set_errstring(ldb,
+					"samldb_find_defaultObjectCategory: "
+					"Invalid DN for 'defaultObjectCategory'!");
+				ares->error = LDB_ERR_CONSTRAINT_VIOLATION;
+			}
+		}
+
 		return ldb_module_done(ac->req, ares->controls,
                                        ares->response, ares->error);
 	}
@@ -970,22 +988,33 @@ static int samldb_find_for_defaultObjectCategory_callback(struct ldb_request *re
 	switch (ares->type) {
 	case LDB_REPLY_ENTRY:
 		ac->dn = talloc_steal(ac, ares->message->dn);
+
+		ret = LDB_SUCCESS;
 		break;
+
 	case LDB_REPLY_REFERRAL:
 		/* this should not happen */
-		return ldb_module_done(ac->req, NULL, NULL,
-                                       LDB_ERR_OPERATIONS_ERROR);
+		talloc_free(ares);
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		break;
 
 	case LDB_REPLY_DONE:
-		/* found or not found, go on */
 		talloc_free(ares);
-		ret = samldb_next_step(ac);
-		if (ret != LDB_SUCCESS) {
-			return ldb_module_done(ac->req, NULL, NULL, ret);
+
+		if (ac->dn != NULL) {
+			/* when found go on */
+			ret = samldb_next_step(ac);
+		} else {
+			ret = LDB_ERR_OPERATIONS_ERROR;
 		}
 		break;
 	}
 
+done:
+	if (ret != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, NULL, NULL, ret);
+	}
+
 	return LDB_SUCCESS;
 }
 
@@ -993,38 +1022,55 @@ static int samldb_find_for_defaultObjectCategory(struct samldb_ctx *ac)
 {
 	struct ldb_context *ldb;
 	struct ldb_request *req;
-        int ret;
 	static const char *no_attrs[] = { NULL };
+        int ret;
+	const struct ldb_val *val;
+	struct ldb_dn *def_obj_cat_dn;
 
 	ldb = ldb_module_get_ctx(ac->module);
 
 	ac->dn = NULL;
 
-        if (ldb_msg_find_element(ac->msg, "defaultObjectCategory") == NULL) {
-		ret = ldb_build_search_req(&req, ldb, ac,
-					   ac->msg->dn, LDB_SCOPE_BASE,
-					   "objectClass=classSchema", no_attrs,
-					   NULL,
-					   ac, samldb_find_for_defaultObjectCategory_callback,
-					   ac->req);
-		if (ret != LDB_SUCCESS) {
-			return ret;
-		}
-		ret = dsdb_request_add_controls(ac->module, req, DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
-		if (ret != LDB_SUCCESS) {
-			return ret;
+	val = ldb_msg_find_ldb_val(ac->msg, "defaultObjectCategory");
+	if (val != NULL) {
+		/* "defaultObjectCategory" has been set by the caller. Do some
+		 * checks for consistency.
+		 * NOTE: The real constraint check (that 'defaultObjectCategory'
+		 * is the DN of the new objectclass or any parent of it) is
+		 * still incomplete.
+		 * For now we say that 'defaultObjectCategory' is valid if it
+		 * exists and it is of objectclass "classSchema". */
+		def_obj_cat_dn = ldb_dn_from_ldb_val(ac, ldb, val);
+		if (def_obj_cat_dn == NULL) {
+			ldb_set_errstring(ldb,
+				"samldb_find_defaultObjectCategory: Invalid DN "
+				"for 'defaultObjectCategory'!");
+			return LDB_ERR_CONSTRAINT_VIOLATION;
 		}
-		return ldb_next_request(ac->module, req);
+	} else {
+		/* "defaultObjectCategory" has not been set by the caller. Use
+		 * the entry DN for it. */
+		def_obj_cat_dn = ac->msg->dn;
 	}
 
-	ret = samldb_next_step(ac);
+	ret = ldb_build_search_req(&req, ldb, ac,
+				   def_obj_cat_dn, LDB_SCOPE_BASE,
+				   "objectClass=classSchema", no_attrs,
+				   NULL,
+				   ac, samldb_find_for_defaultObjectCategory_callback,
+				   ac->req);
 	if (ret != LDB_SUCCESS) {
-		return ldb_module_done(ac->req, NULL, NULL, ret);
+		return ret;
 	}
-	return ret;
 
-}
+	ret = dsdb_request_add_controls(ac->module, req,
+					DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
 
+	return ldb_next_request(ac->module, req);
+}
 
 
 /*
@@ -1377,7 +1423,7 @@ static int samldb_foreign_notice_sid(struct samldb_ctx *ac)
 	}
 
 
-	filter = talloc_asprintf(ac, 
+	filter = talloc_asprintf(ac,
 				 "(&(objectSid=%s)"
 				 "(|(objectClass=domain)"
 				 "(objectClass=builtinDomain)))",
diff --git a/source4/dsdb/samdb/ldb_modules/schema_load.c b/source4/dsdb/samdb/ldb_modules/schema_load.c
index c7cd76a395..c72911fe89 100644
--- a/source4/dsdb/samdb/ldb_modules/schema_load.c
+++ b/source4/dsdb/samdb/ldb_modules/schema_load.c
@@ -102,7 +102,7 @@ static int dsdb_schema_from_schema_dn(TALLOC_CTX *mem_ctx, struct ldb_module *mo
 				 "(objectClass=classSchema)");
 	if (ret != LDB_SUCCESS) {
 		ldb_asprintf_errstring(ldb, 
-				       "dsdb_schema: failed to search attributeSchema objects: %s",
+				       "dsdb_schema: failed to search classSchema objects: %s",
 				       ldb_errstring(ldb));
 		goto failed;
 	}
diff --git a/source4/lib/ldb/config.mk b/source4/lib/ldb/config.mk
index 7d110fc618..54e1416ed3 100644
--- a/source4/lib/ldb/config.mk
+++ b/source4/lib/ldb/config.mk
@@ -16,7 +16,7 @@ ldb_asq_OBJ_FILES = $(ldbsrcdir)/modules/asq.o
 PRIVATE_DEPENDENCIES = LIBTALLOC LIBTEVENT
 CFLAGS = -I$(ldbsrcdir)/include
 INIT_FUNCTION = LDB_MODULE(sample)
-SUBSYSTEM = LIBTESTLDB
+SUBSYSTEM = LIBLDB
 
 # End MODULE sample_module
 ################################################
diff --git a/source4/lib/ldb/tests/python/ldap_schema.py b/source4/lib/ldb/tests/python/ldap_schema.py
index 0a31db82f7..9e54732104 100755
--- a/source4/lib/ldb/tests/python/ldap_schema.py
+++ b/source4/lib/ldb/tests/python/ldap_schema.py
@@ -132,9 +132,41 @@ systemOnly: FALSE
 """
         self.ldb.add_ldif(ldif)
 
+        # Search for created attribute
+        res = []
+        res = self.ldb.search("cn=%s,%s" % (attr_name, self.schema_dn), scope=SCOPE_BASE, attrs=["*"])
+        self.assertEquals(len(res), 1)
+        self.assertEquals(res[0]["lDAPDisplayName"][0], attr_ldap_display_name)
+        self.assertTrue("schemaIDGUID" in res[0])
+
         class_name = "test-Class" + time.strftime("%s", time.gmtime())
         class_ldap_display_name = class_name.replace("-", "")
 
+        # First try to create a class with a wrong "defaultObjectCategory"
+        ldif = """
+dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
+objectClass: top
+objectClass: classSchema
+defaultObjectCategory: CN=_
+adminDescription: """ + class_name + """
+adminDisplayName: """ + class_name + """
+cn: """ + class_name + """
+governsId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
+instanceType: 4
+objectClassCategory: 1
+subClassOf: organizationalPerson
+systemFlags: 16
+rDNAttID: cn
+systemMustContain: cn
+systemMustContain: """ + attr_ldap_display_name + """
+systemOnly: FALSE
+"""
+        try:
+                 self.ldb.add_ldif(ldif)
+                 self.fail()
+        except LdbError, (num, _):
+                 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
+
         ldif = """
 dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
 objectClass: top
@@ -154,6 +186,14 @@ systemOnly: FALSE
 """
         self.ldb.add_ldif(ldif)
 
+        # Search for created objectclass
+        res = []
+        res = self.ldb.search("cn=%s,%s" % (class_name, self.schema_dn), scope=SCOPE_BASE, attrs=["*"])
+        self.assertEquals(len(res), 1)
+        self.assertEquals(res[0]["lDAPDisplayName"][0], class_ldap_display_name)
+        self.assertEquals(res[0]["defaultObjectCategory"][0], res[0]["distinguishedName"][0])
+        self.assertTrue("schemaIDGUID" in res[0])
+
         ldif = """
 dn:
 changetype: modify
@@ -179,21 +219,6 @@ name: """ + object_name + """
 """
         self.ldb.add_ldif(ldif)
 
-        # Search for created attribute
-        res = []
-        res = self.ldb.search("cn=%s,%s" % (attr_name, self.schema_dn), scope=SCOPE_BASE, attrs=["*"])
-        self.assertEquals(len(res), 1)
-        self.assertEquals(res[0]["lDAPDisplayName"][0], attr_ldap_display_name)
-        self.assertTrue("schemaIDGUID" in res[0])
-
-        # Search for created objectclass
-        res = []
-        res = self.ldb.search("cn=%s,%s" % (class_name, self.schema_dn), scope=SCOPE_BASE, attrs=["*"])
-        self.assertEquals(len(res), 1)
-        self.assertEquals(res[0]["lDAPDisplayName"][0], class_ldap_display_name)
-        self.assertEquals(res[0]["defaultObjectCategory"][0], res[0]["distinguishedName"][0])
-        self.assertTrue("schemaIDGUID" in res[0])
-
         # Search for created object
         res = []
         res = self.ldb.search("cn=%s,cn=Users,%s" % (object_name, self.base_dn), scope=SCOPE_BASE, attrs=["*"])
diff --git a/source4/libcli/resolve/dns_ex.c b/source4/libcli/resolve/dns_ex.c
index 1b5037273a..79ed78340c 100644
--- a/source4/libcli/resolve/dns_ex.c
+++ b/source4/libcli/resolve/dns_ex.c
@@ -283,14 +283,19 @@ static void run_child_getaddrinfo(struct dns_ex_state *state, int fd)
 	hints.ai_flags = AI_ADDRCONFIG | AI_NUMERICSERV;
 
 	ret = getaddrinfo(state->name.name, "0", &hints, &res_list);
+	/* try to fallback in case of error */
+	if (state->do_fallback) {
+		switch (ret) {
 #ifdef EAI_NODATA
-	if (ret == EAI_NODATA && state->do_fallback) {
-#else
-	if (ret == EAI_NONAME && state->do_fallback) {
+		case EAI_NODATA:
 #endif
-		/* getaddrinfo() doesn't handle CNAME records */
-		run_child_dns_lookup(state, fd);
-		return;
+		case EAI_NONAME:
+			/* getaddrinfo() doesn't handle CNAME records */
+			run_child_dns_lookup(state, fd);
+			return;
+		default:
+			break;
+		}
 	}
 	if (ret != 0) {
 		goto done;
diff --git a/source4/torture/raw/lock.c b/source4/torture/raw/lock.c
index 34b05b70e4..7eb461048b 100644
--- a/source4/torture/raw/lock.c
+++ b/source4/torture/raw/lock.c
@@ -643,10 +643,104 @@ static bool test_async(struct torture_context *tctx,
 	/* cleanup the second lock */
 	io.lockx.in.ulock_cnt = 1;
 	io.lockx.in.lock_cnt = 0;
+	io.lockx.in.mode = LOCKING_ANDX_LARGE_FILES;
+	io.lockx.in.locks = &lock[1];
+	status = smb_raw_lock(cli->tree, &io);
+	CHECK_STATUS(status, NT_STATUS_OK);
+
+	/* If a lock request contained multiple ranges and we are cancelling
+	 * one while it's still pending, what happens? */
+	torture_comment(tctx, "testing cancel 1/2 lock request\n");
+
+	/* Send request with two ranges */
+	io.lockx.in.timeout = -1;
+	io.lockx.in.ulock_cnt = 0;
+	io.lockx.in.lock_cnt = 2;
+	io.lockx.in.mode = LOCKING_ANDX_LARGE_FILES;
+	io.lockx.in.locks = lock;
+	req = smb_raw_lock_send(cli->tree, &io);
+	torture_assert(tctx,(req != NULL), talloc_asprintf(tctx,
+		       "Failed to setup pending lock (%s)\n", __location__));
+
+	/* Try to cancel the first lock range */
+	io.lockx.in.timeout = 0;
+	io.lockx.in.lock_cnt = 1;
+	io.lockx.in.mode = LOCKING_ANDX_CANCEL_LOCK | LOCKING_ANDX_LARGE_FILES;
+	io.lockx.in.locks = &lock[0];
+	status = smb_raw_lock(cli->tree, &io);
+	CHECK_STATUS(status, NT_STATUS_OK);
+
+	/* Locking request should've failed and second range should be
+	 * unlocked */
+	status = smbcli_request_simple_recv(req);
+	CHECK_STATUS(status, NT_STATUS_FILE_LOCK_CONFLICT);
+
+	io.lockx.in.timeout = 0;
+	io.lockx.in.ulock_cnt = 0;
+	io.lockx.in.lock_cnt = 1;
+	io.lockx.in.mode = LOCKING_ANDX_LARGE_FILES;
 	io.lockx.in.locks = &lock[1];
 	status = smb_raw_lock(cli->tree, &io);
 	CHECK_STATUS(status, NT_STATUS_OK);
 
+	/* Cleanup both locks */
+	io.lockx.in.ulock_cnt = 2;
+	io.lockx.in.lock_cnt = 0;
+	io.lockx.in.mode = LOCKING_ANDX_LARGE_FILES;
+	io.lockx.in.locks = lock;
+	status = smb_raw_lock(cli->tree, &io);
+	CHECK_STATUS(status, NT_STATUS_OK);
+
+	torture_comment(tctx, "testing cancel 2/2 lock request\n");
+
+	/* Lock second range so it contends */
+	io.lockx.in.timeout = 0;
+	io.lockx.in.ulock_cnt = 0;
+	io.lockx.in.lock_cnt = 1;
+	io.lockx.in.mode = LOCKING_ANDX_LARGE_FILES;
+	io.lockx.in.locks = &lock[1];
+	status = smb_raw_lock(cli->tree, &io);
+	CHECK_STATUS(status, NT_STATUS_OK);
+
+	/* Send request with two ranges */
+	io.lockx.in.timeout = -1;
+	io.lockx.in.ulock_cnt = 0;
+	io.lockx.in.lock_cnt = 2;
+	io.lockx.in.mode = LOCKING_ANDX_LARGE_FILES;
+	io.lockx.in.locks = lock;
+	req = smb_raw_lock_send(cli->tree, &io);
+	torture_assert(tctx,(req != NULL), talloc_asprintf(tctx,
+		       "Failed to setup pending lock (%s)\n", __location__));
+
+	/* Try to cancel the second lock range */
+	io.lockx.in.timeout = 0;
+	io.lockx.in.lock_cnt = 1;
+	io.lockx.in.mode = LOCKING_ANDX_CANCEL_LOCK | LOCKING_ANDX_LARGE_FILES;
+	io.lockx.in.locks = &lock[1];
+	status = smb_raw_lock(cli->tree, &io);
+	CHECK_STATUS(status, NT_STATUS_OK);
+
+	/* Locking request should've failed and first range should be
+	 * unlocked */
+	status = smbcli_request_simple_recv(req);
+	CHECK_STATUS(status, NT_STATUS_FILE_LOCK_CONFLICT);
+
+	io.lockx.in.timeout = 0;
+	io.lockx.in.ulock_cnt = 0;
+	io.lockx.in.lock_cnt = 1;
+	io.lockx.in.mode = LOCKING_ANDX_LARGE_FILES;
+	io.lockx.in.locks = &lock[0];
+	status = smb_raw_lock(cli->tree, &io);
+	CHECK_STATUS(status, NT_STATUS_OK);
+
+	/* Cleanup both locks */
+	io.lockx.in.ulock_cnt = 2;
+	io.lockx.in.lock_cnt = 0;
+	io.lockx.in.mode = LOCKING_ANDX_LARGE_FILES;
+	io.lockx.in.locks = lock;
+	status = smb_raw_lock(cli->tree, &io);
+	CHECK_STATUS(status, NT_STATUS_OK);
+
 	torture_comment(tctx, "testing cancel by unlock\n");
 	io.lockx.in.ulock_cnt = 0;
 	io.lockx.in.lock_cnt = 1;
@@ -654,7 +748,7 @@ static bool test_async(struct torture_context *tctx,
 	io.lockx.in.timeout = 0;
 	io.lockx.in.locks = &lock[0];
 	status = smb_raw_lock(cli->tree, &io);
-	CHECK_STATUS(status, NT_STATUS_LOCK_NOT_GRANTED);
+	CHECK_STATUS(status, NT_STATUS_OK);
 
 	io.lockx.in.timeout = 5000;
 	req = smb_raw_lock_send(cli->tree, &io);
@@ -680,7 +774,7 @@ static bool test_async(struct torture_context *tctx,
 	io.lockx.in.mode = LOCKING_ANDX_LARGE_FILES;
 	io.lockx.in.timeout = 0;
 	status = smb_raw_lock(cli->tree, &io);
-	CHECK_STATUS(status, NT_STATUS_FILE_LOCK_CONFLICT);
+	CHECK_STATUS(status, NT_STATUS_LOCK_NOT_GRANTED);
 
 	t = time(NULL);
 	io.lockx.in.timeout = 10000;
diff --git a/source4/torture/rpc/spoolss.c b/source4/torture/rpc/spoolss.c
index 65bc3619ca..489174bde6 100644
--- a/source4/torture/rpc/spoolss.c
+++ b/source4/torture/rpc/spoolss.c
@@ -5,7 +5,7 @@
    Copyright (C) Tim Potter 2003
    Copyright (C) Stefan Metzmacher 2005
    Copyright (C) Jelmer Vernooij 2007
-   Copyright (C) Guenther Deschner 2009
+   Copyright (C) Guenther Deschner 2009-2010
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -865,45 +865,67 @@ static bool test_GetPrinterDriver2(struct torture_context *tctx,
 				   struct policy_handle *handle,
 				   const char *driver_name);
 
-static bool test_GetPrinter(struct torture_context *tctx,
-			    struct dcerpc_pipe *p,
-		     struct policy_handle *handle)
+static bool test_GetPrinter_level(struct torture_context *tctx,
+				  struct dcerpc_pipe *p,
+				  struct policy_handle *handle,
+				  uint32_t level,
+				  union spoolss_PrinterInfo *info)
 {
-	NTSTATUS status;
 	struct spoolss_GetPrinter r;
-	uint16_t levels[] = {0, 1, 2, 3, 4, 5, 6, 7, 8};
-	int i;
 	uint32_t needed;
 
-	for (i=0;i<ARRAY_SIZE(levels);i++) {
-		r.in.handle = handle;
-		r.in.level = levels[i];
-		r.in.buffer = NULL;
-		r.in.offered = 0;
-		r.out.needed = &needed;
+	r.in.handle = handle;
+	r.in.level = level;
+	r.in.buffer = NULL;
+	r.in.offered = 0;
+	r.out.needed = &needed;
 
-		torture_comment(tctx, "Testing GetPrinter level %u\n", r.in.level);
+	torture_comment(tctx, "Testing GetPrinter level %u\n", r.in.level);
 
-		status = dcerpc_spoolss_GetPrinter(p, tctx, &r);
-		torture_assert_ntstatus_ok(tctx, status, "GetPrinter failed");
+	torture_assert_ntstatus_ok(tctx, dcerpc_spoolss_GetPrinter(p, tctx, &r),
+		"GetPrinter failed");
 
-		if (W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
-			DATA_BLOB blob = data_blob_talloc(tctx, NULL, needed);
-			data_blob_clear(&blob);
-			r.in.buffer = &blob;
-			r.in.offered = needed;
-			status = dcerpc_spoolss_GetPrinter(p, tctx, &r);
-		}
+	if (W_ERROR_EQUAL(r.out.result, WERR_INSUFFICIENT_BUFFER)) {
+		DATA_BLOB blob = data_blob_talloc(tctx, NULL, needed);
+		data_blob_clear(&blob);
+		r.in.buffer = &blob;
+		r.in.offered = needed;
+
+		torture_assert_ntstatus_ok(tctx, dcerpc_spoolss_GetPrinter(p, tctx, &r),
+			"GetPrinter failed");
+	}
+
+	torture_assert_werr_ok(tctx, r.out.result, "GetPrinter failed");
 
-		torture_assert_ntstatus_ok(tctx, status, "GetPrinter failed");
+	CHECK_NEEDED_SIZE_LEVEL(spoolss_PrinterInfo, r.out.info, r.in.level, lp_iconv_convenience(tctx->lp_ctx), needed, 4);
 
-		torture_assert_werr_ok(tctx, r.out.result, "GetPrinter failed");
+	if (info && r.out.info) {
+		*info = *r.out.info;
+	}
+
+	return true;
+}
+
+
+static bool test_GetPrinter(struct torture_context *tctx,
+			    struct dcerpc_pipe *p,
+			    struct policy_handle *handle)
+{
+	uint32_t levels[] = {0, 1, 2, 3, 4, 5, 6, 7, 8};
+	int i;
+
+	for (i=0;i<ARRAY_SIZE(levels);i++) {
 
-		CHECK_NEEDED_SIZE_LEVEL(spoolss_PrinterInfo, r.out.info, r.in.level, lp_iconv_convenience(tctx->lp_ctx), needed, 4);
+		union spoolss_PrinterInfo info;
 
-		if ((r.in.level == 2) && r.out.info->info2.drivername && strlen(r.out.info->info2.drivername)) {
+		ZERO_STRUCT(info);
+
+		torture_assert(tctx, test_GetPrinter_level(tctx, p, handle, levels[i], &info),
+			"failed to call GetPrinter");
+
+		if ((levels[i] == 2) && info.info2.drivername && strlen(info.info2.drivername)) {
 			torture_assert(tctx,
-				test_GetPrinterDriver2(tctx, p, handle, r.out.info->info2.drivername),
+				test_GetPrinterDriver2(tctx, p, handle, info.info2.drivername),
 				"failed to call test_GetPrinterDriver2");
 		}
 	}
@@ -911,6 +933,32 @@ static bool test_GetPrinter(struct torture_context *tctx,
 	return true;
 }
 
+static bool test_SetPrinter(struct torture_context *tctx,
+			    struct dcerpc_pipe *p,
+			    struct policy_handle *handle,
+			    struct spoolss_SetPrinterInfoCtr *info_ctr,
+			    struct spoolss_DevmodeContainer *devmode_ctr,
+			    struct sec_desc_buf *secdesc_ctr,
+			    enum spoolss_PrinterControl command)
+{
+	struct spoolss_SetPrinter r;
+
+	r.in.handle = handle;
+	r.in.info_ctr = info_ctr;
+	r.in.devmode_ctr = devmode_ctr;
+	r.in.secdesc_ctr = secdesc_ctr;
+	r.in.command = command;
+
+	torture_comment(tctx, "Testing SetPrinter Level %d\n", r.in.info_ctr->level);
+
+	torture_assert_ntstatus_ok(tctx, dcerpc_spoolss_SetPrinter(p, tctx, &r),
+		"failed to call SetPrinter");
+	torture_assert_werr_ok(tctx, r.out.result,
+		"failed to call SetPrinter");
+
+	return true;
+}
+
 static bool test_SetPrinter_errors(struct torture_context *tctx,
 				   struct dcerpc_pipe *p,
 				   struct policy_handle *handle)
@@ -2618,6 +2666,181 @@ static bool test_SetPrinterDataEx(struct torture_context *tctx,
 	return true;
 }
 
+static bool test_GetChangeID_PrinterData(struct torture_context *tctx,
+					 struct dcerpc_pipe *p,
+					 struct policy_handle *handle,
+					 uint32_t *change_id)
+{
+	enum winreg_Type type;
+	union spoolss_PrinterData data;
+
+	torture_assert(tctx,
+		test_GetPrinterData(tctx, p, handle, "ChangeID", &type, &data),
+		"failed to call GetPrinterData");
+
+	torture_assert(tctx, type == REG_DWORD, "unexpected type");
+
+	*change_id = data.value;
+
+	return true;
+}
+
+static bool test_GetChangeID_PrinterDataEx(struct torture_context *tctx,
+					   struct dcerpc_pipe *p,
+					   struct policy_handle *handle,
+					   uint32_t *change_id)
+{
+	enum winreg_Type type;
+	union spoolss_PrinterData data;
+
+	torture_assert(tctx,
+		test_GetPrinterDataEx(tctx, p, handle, "PrinterDriverData", "ChangeID", &type, &data),
+		"failed to call GetPrinterData");
+
+	torture_assert(tctx, type == REG_DWORD, "unexpected type");
+
+	*change_id = data.value;
+
+	return true;
+}
+
+static bool test_GetChangeID_PrinterInfo(struct torture_context *tctx,
+					 struct dcerpc_pipe *p,
+					 struct policy_handle *handle,
+					 uint32_t *change_id)
+{
+	union spoolss_PrinterInfo info;
+
+	torture_assert(tctx, test_GetPrinter_level(tctx, p, handle, 0, &info),
+		"failed to query Printer level 0");
+
+	*change_id = info.info0.change_id;
+
+	return true;
+}
+
+static bool test_ChangeID(struct torture_context *tctx,
+			  struct dcerpc_pipe *p,
+			  struct policy_handle *handle)
+{
+	uint32_t change_id, change_id_ex, change_id_info;
+	uint32_t change_id2, change_id_ex2, change_id_info2;
+	union spoolss_PrinterInfo info;
+	const char *comment;
+
+
+	torture_comment(tctx, "Testing ChangeID: id change test #1\n");
+
+	torture_assert(tctx, test_GetChangeID_PrinterData(tctx, p, handle, &change_id),
+		"failed to query for ChangeID");
+	torture_assert(tctx, test_GetChangeID_PrinterDataEx(tctx, p, handle, &change_id_ex),
+		"failed to query for ChangeID");
+	torture_assert(tctx, test_GetChangeID_PrinterInfo(tctx, p, handle, &change_id_info),
+		"failed to query for ChangeID");
+
+	torture_assert_int_equal(tctx, change_id, change_id_ex,
+		"change_ids should all be equal");
+	torture_assert_int_equal(tctx, change_id_ex, change_id_info,
+		"change_ids should all be equal");
+
+
+	torture_comment(tctx, "Testing ChangeID: id change test #2\n");
+
+	torture_assert(tctx, test_GetChangeID_PrinterData(tctx, p, handle, &change_id),
+		"failed to query for ChangeID");
+	torture_assert(tctx, test_GetPrinter_level(tctx, p, handle, 2, &info),
+		"failed to query Printer level 2");
+	torture_assert(tctx, test_GetChangeID_PrinterDataEx(tctx, p, handle, &change_id_ex),
+		"failed to query for ChangeID");
+	torture_assert(tctx, test_GetChangeID_PrinterInfo(tctx, p, handle, &change_id_info),
+		"failed to query for ChangeID");
+	torture_assert_int_equal(tctx, change_id, change_id_ex,
+		"change_id should not have changed");
+	torture_assert_int_equal(tctx, change_id_ex, change_id_info,
+		"change_id should not have changed");
+
+
+	torture_comment(tctx, "Testing ChangeID: id change test #3\n");
+
+	torture_assert(tctx, test_GetChangeID_PrinterData(tctx, p, handle, &change_id),
+		"failed to query for ChangeID");
+	torture_assert(tctx, test_GetChangeID_PrinterDataEx(tctx, p, handle, &change_id_ex),
+		"failed to query for ChangeID");
+	torture_assert(tctx, test_GetChangeID_PrinterInfo(tctx, p, handle, &change_id_info),
+		"failed to query for ChangeID");
+	torture_assert(tctx, test_GetPrinter_level(tctx, p, handle, 2, &info),
+		"failed to query Printer level 2");
+	comment = talloc_strdup(tctx, info.info2.comment);
+
+	{
+		struct spoolss_SetPrinterInfoCtr info_ctr;
+		struct spoolss_DevmodeContainer devmode_ctr;
+		struct sec_desc_buf secdesc_ctr;
+		struct spoolss_SetPrinterInfo2 info2;
+
+		ZERO_STRUCT(info_ctr);
+		ZERO_STRUCT(devmode_ctr);
+		ZERO_STRUCT(secdesc_ctr);
+
+		info2.servername	= info.info2.servername;
+		info2.printername	= info.info2.printername;
+		info2.sharename		= info.info2.sharename;
+		info2.portname		= info.info2.portname;
+		info2.drivername	= info.info2.drivername;
+		info2.comment		= "torture_comment";
+		info2.location		= info.info2.location;
+		info2.devmode_ptr	= 0;
+		info2.sepfile		= info.info2.sepfile;
+		info2.printprocessor	= info.info2.printprocessor;
+		info2.datatype		= info.info2.datatype;
+		info2.parameters	= info.info2.parameters;
+		info2.secdesc_ptr	= 0;
+		info2.attributes	= info.info2.attributes;
+		info2.priority		= info.info2.priority;
+		info2.defaultpriority	= info.info2.defaultpriority;
+		info2.starttime		= info.info2.starttime;
+		info2.untiltime		= info.info2.untiltime;
+		info2.status		= info.info2.status;
+		info2.cjobs		= info.info2.cjobs;
+		info2.averageppm	= info.info2.averageppm;
+
+		info_ctr.level = 2;
+		info_ctr.info.info2 = &info2;
+
+		torture_assert(tctx, test_SetPrinter(tctx, p, handle, &info_ctr, &devmode_ctr, &secdesc_ctr, 0),
+			"failed to call SetPrinter");
+
+		info2.comment		= comment;
+
+		torture_assert(tctx, test_SetPrinter(tctx, p, handle, &info_ctr, &devmode_ctr, &secdesc_ctr, 0),
+			"failed to call SetPrinter");
+
+	}
+
+	torture_assert(tctx, test_GetChangeID_PrinterData(tctx, p, handle, &change_id2),
+		"failed to query for ChangeID");
+	torture_assert(tctx, test_GetChangeID_PrinterDataEx(tctx, p, handle, &change_id_ex2),
+		"failed to query for ChangeID");
+	torture_assert(tctx, test_GetChangeID_PrinterInfo(tctx, p, handle, &change_id_info2),
+		"failed to query for ChangeID");
+
+	torture_assert_int_equal(tctx, change_id2, change_id_ex2,
+		"change_ids should all be equal");
+	torture_assert_int_equal(tctx, change_id_ex2, change_id_info2,
+		"change_ids should all be equal");
+
+	torture_assert(tctx, (change_id < change_id2),
+		talloc_asprintf(tctx, "change_id %d needs to be larger than change_id %d",
+		change_id2, change_id));
+	torture_assert(tctx, (change_id_ex < change_id_ex2),
+		talloc_asprintf(tctx, "change_id %d needs to be larger than change_id %d",
+		change_id_ex2, change_id_ex));
+	torture_assert(tctx, (change_id_info < change_id_info2),
+		talloc_asprintf(tctx, "change_id %d needs to be larger than change_id %d",
+		change_id_info2, change_id_info));
+
+	return true;
+}
 
 static bool test_SecondaryClosePrinter(struct torture_context *tctx,
 				       struct dcerpc_pipe *p,
@@ -2848,6 +3071,10 @@ static bool test_OpenPrinterEx(struct torture_context *tctx,
 		ret = false;
 	}
 
+	if (!test_ChangeID(tctx, p, &handle)) {
+		ret = false;
+	}
+
 	if (!torture_setting_bool(tctx, "samba3", false)) {
 		if (!test_SecondaryClosePrinter(tctx, p, &handle)) {
 			ret = false;