Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-gmake3

Conflicts: source/build/smb_build/header.pm source/build/smb_build/makefile.pm source/lib/ldb/include/ldb_private.h (This used to be commit 1a646af0647f021d99473a8991c35e616a423ea6)
author: Jelmer Vernooij <jelmer@samba.org> 2008-02-25 12:58:09 +0100
committer: Jelmer Vernooij <jelmer@samba.org> 2008-02-25 12:58:09 +0100
commit: 584c4a518f4d18452b6515db132e4f75fba733a1 (patch)
tree: bbe367f36f092f233d7aefb61d75d5d1e1e85031 /source4
parent: 03ab8f9d79f2a06b357b2f5d392ea8b5be263c5e (diff)
parent: 71943b209b181e1e4a65ab477b83780add7051ae (diff)
download: samba-584c4a518f4d18452b6515db132e4f75fba733a1.tar.gz
samba-584c4a518f4d18452b6515db132e4f75fba733a1.tar.bz2
samba-584c4a518f4d18452b6515db132e4f75fba733a1.zip
197 files changed, 2904 insertions, 1436 deletions
diff --git a/source4/Makefile b/source4/Makefile
index ea98b5e469..1fddfefce3 100644
--- a/source4/Makefile
+++ b/source4/Makefile
@@ -14,10 +14,10 @@ SETUPDIR = $(datadir)/setup
 NCALRPCDIR = $(localstatedir)/ncalrpc
 
 BNLD = $(LD)
-BNLD_FLAGS = $(LDFLAGS)
+BNLD_FLAGS = $(LDFLAGS) $(SYS_LDFLAGS)
 
 HOSTCC_FLAGS = -D_SAMBA_HOSTCC_ $(CFLAGS)
-HOSTLD_FLAGS = $(LDFLAGS)
+HOSTLD_FLAGS = $(LDFLAGS) $(SYS_LDFLAGS)
 
 default: all
 
diff --git a/source4/auth/auth_anonymous.c b/source4/auth/auth_anonymous.c
index bcab918347..38c13d4b65 100644
--- a/source4/auth/auth_anonymous.c
+++ b/source4/auth/auth_anonymous.c
@@ -63,7 +63,7 @@ static const struct auth_operations anonymous_auth_ops = {
 	.check_password	= anonymous_check_password
 };
 
-NTSTATUS auth_anonymous_init(void)
+_PUBLIC_ NTSTATUS auth_anonymous_init(void)
 {
 	NTSTATUS ret;
 
diff --git a/source4/auth/auth_developer.c b/source4/auth/auth_developer.c
index 57eb752ac8..0da947b68d 100644
--- a/source4/auth/auth_developer.c
+++ b/source4/auth/auth_developer.c
@@ -186,7 +186,7 @@ static const struct auth_operations fixed_challenge_auth_ops = {
 	.check_password	= fixed_challenge_check_password
 };
 
-NTSTATUS auth_developer_init(void)
+_PUBLIC_ NTSTATUS auth_developer_init(void)
 {
 	NTSTATUS ret;
 
diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 0885d8265a..9189640150 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -425,7 +425,7 @@ static const struct auth_operations sam_ops = {
 	.check_password	= authsam_check_password
 };
 
-NTSTATUS auth_sam_init(void)
+_PUBLIC_ NTSTATUS auth_sam_init(void)
 {
 	NTSTATUS ret;
 
diff --git a/source4/auth/auth_unix.c b/source4/auth/auth_unix.c
index 62fb42935a..20e198701d 100644
--- a/source4/auth/auth_unix.c
+++ b/source4/auth/auth_unix.c
@@ -829,7 +829,7 @@ static const struct auth_operations unix_ops = {
 	.check_password	= authunix_check_password
 };
 
-NTSTATUS auth_unix_init(void)
+_PUBLIC_ NTSTATUS auth_unix_init(void)
 {
 	NTSTATUS ret;
 
diff --git a/source4/auth/auth_util.c b/source4/auth/auth_util.c
index b1f0e60507..5d2bc6bac0 100644
--- a/source4/auth/auth_util.c
+++ b/source4/auth/auth_util.c
@@ -144,7 +144,7 @@ NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth_context *auth_contex
 			
 			chall_blob = data_blob_talloc(mem_ctx, challenge, 8);
 			if (lp_client_ntlmv2_auth(auth_context->lp_ctx)) {
-				DATA_BLOB names_blob = NTLMv2_generate_names_blob(mem_ctx, lp_netbios_name(auth_context->lp_ctx), lp_workgroup(auth_context->lp_ctx));
+				DATA_BLOB names_blob = NTLMv2_generate_names_blob(mem_ctx, lp_iconv_convenience(auth_context->lp_ctx), lp_netbios_name(auth_context->lp_ctx), lp_workgroup(auth_context->lp_ctx));
 				DATA_BLOB lmv2_response, ntlmv2_response, lmv2_session_key, ntlmv2_session_key;
 				
 				if (!SMBNTLMv2encrypt_hash(user_info_temp,
diff --git a/source4/auth/auth_winbind.c b/source4/auth/auth_winbind.c
index 89ae3195df..2f8074d3cb 100644
--- a/source4/auth/auth_winbind.c
+++ b/source4/auth/auth_winbind.c
@@ -260,7 +260,7 @@ static const struct auth_operations winbind_ops = {
 	.check_password	= winbind_check_password
 };
 
-NTSTATUS auth_winbind_init(void)
+_PUBLIC_ NTSTATUS auth_winbind_init(void)
 {
 	NTSTATUS ret;
 
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index 87fa47646b..d8cdb90197 100644
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -1298,7 +1298,7 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi
 		}
 		
 		/* decode and verify the pac */
-		nt_status = kerberos_pac_logon_info(mem_ctx, &logon_info, pac_blob,
+		nt_status = kerberos_pac_logon_info(mem_ctx, lp_iconv_convenience(gensec_security->lp_ctx), &logon_info, pac_blob,
 						    gensec_gssapi_state->smb_krb5_context->krb5_context,
 						    NULL, keyblock, principal, authtime, NULL);
 		krb5_free_principal(gensec_gssapi_state->smb_krb5_context->krb5_context, principal);
@@ -1463,7 +1463,7 @@ static const struct gensec_security_ops gensec_gssapi_sasl_krb5_security_ops = {
 	.priority         = GENSEC_GSSAPI
 };
 
-NTSTATUS gensec_gssapi_init(void)
+_PUBLIC_ NTSTATUS gensec_gssapi_init(void)
 {
 	NTSTATUS ret;
 
diff --git a/source4/auth/gensec/gensec_krb5.c b/source4/auth/gensec/gensec_krb5.c
index 5cd0de1ceb..88432c7f89 100644
--- a/source4/auth/gensec/gensec_krb5.c
+++ b/source4/auth/gensec/gensec_krb5.c
@@ -617,7 +617,9 @@ static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security
 		}
 
 		/* decode and verify the pac */
-		nt_status = kerberos_pac_logon_info(gensec_krb5_state, &logon_info, pac,
+		nt_status = kerberos_pac_logon_info(gensec_krb5_state, 
+						    lp_iconv_convenience(gensec_security->lp_ctx),
+						    &logon_info, pac,
 						    gensec_krb5_state->smb_krb5_context->krb5_context,
 						    NULL, gensec_krb5_state->keyblock,
 						    client_principal,
@@ -775,7 +777,7 @@ static const struct gensec_security_ops gensec_krb5_security_ops = {
 	.priority       = GENSEC_KRB5
 };
 
-NTSTATUS gensec_krb5_init(void)
+_PUBLIC_ NTSTATUS gensec_krb5_init(void)
 {
 	NTSTATUS ret;
 
diff --git a/source4/auth/gensec/schannel.c b/source4/auth/gensec/schannel.c
index 42db959380..96e3478982 100644
--- a/source4/auth/gensec/schannel.c
+++ b/source4/auth/gensec/schannel.c
@@ -274,7 +274,7 @@ static const struct gensec_security_ops gensec_schannel_security_ops = {
 	.priority       = GENSEC_SCHANNEL
 };
 
-NTSTATUS gensec_schannel_init(void)
+_PUBLIC_ NTSTATUS gensec_schannel_init(void)
 {
 	NTSTATUS ret;
 	ret = gensec_register(&gensec_schannel_security_ops);
diff --git a/source4/auth/gensec/spnego.c b/source4/auth/gensec/spnego.c
index 782aa44c75..f593d17d4b 100644
--- a/source4/auth/gensec/spnego.c
+++ b/source4/auth/gensec/spnego.c
@@ -1042,7 +1042,7 @@ static const struct gensec_security_ops gensec_spnego_security_ops = {
 	.priority         = GENSEC_SPNEGO
 };
 
-NTSTATUS gensec_spnego_init(void)
+_PUBLIC_ NTSTATUS gensec_spnego_init(void)
 {
 	NTSTATUS ret;
 	ret = gensec_register(&gensec_spnego_security_ops);
diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
index bafd58a048..8585aa321b 100644
--- a/source4/auth/kerberos/kerberos.h
+++ b/source4/auth/kerberos/kerberos.h
@@ -111,6 +111,7 @@ krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
 					   struct smb_krb5_context *smb_krb5_context,
 					   krb5_principal *princ);
 NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
+			     struct smb_iconv_convenience *iconv_convenience,
 			     struct PAC_DATA **pac_data_out,
 			     DATA_BLOB blob,
 			     krb5_context context,
@@ -120,6 +121,7 @@ NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
 			     time_t tgs_authtime,
 			     krb5_error_code *k5ret);
  NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
+				  struct smb_iconv_convenience *iconv_convenience,
 				  struct PAC_LOGON_INFO **logon_info,
 				  DATA_BLOB blob,
 				  krb5_context context,
@@ -129,12 +131,14 @@ NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
 				  time_t tgs_authtime, 
 				  krb5_error_code *k5ret);
  krb5_error_code kerberos_encode_pac(TALLOC_CTX *mem_ctx,
+				     struct smb_iconv_convenience *iconv_convenience,
 				    struct PAC_DATA *pac_data,
 				    krb5_context context,
 				    const krb5_keyblock *krbtgt_keyblock,
 				    const krb5_keyblock *service_keyblock,
 				    DATA_BLOB *pac);
  krb5_error_code kerberos_create_pac(TALLOC_CTX *mem_ctx,
+				     struct smb_iconv_convenience *iconv_convenience,
 				     struct auth_serversupplied_info *server_info,
 				     krb5_context context,
 				     const krb5_keyblock *krbtgt_keyblock,
diff --git a/source4/auth/kerberos/kerberos_pac.c b/source4/auth/kerberos/kerberos_pac.c
index c46e06bc72..e485f75302 100644
--- a/source4/auth/kerberos/kerberos_pac.c
+++ b/source4/auth/kerberos/kerberos_pac.c
@@ -66,6 +66,7 @@ static krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
 }
 
  NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
+			      struct smb_iconv_convenience *iconv_convenience,
 			      struct PAC_DATA **pac_data_out,
 			      DATA_BLOB blob,
 			      krb5_context context,
@@ -86,7 +87,6 @@ static krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
 	struct PAC_LOGON_NAME *logon_name = NULL;
 	struct PAC_DATA *pac_data;
 	struct PAC_DATA_RAW *pac_data_raw;
-	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	DATA_BLOB *srv_sig_blob = NULL;
 	DATA_BLOB *kdc_sig_blob = NULL;
@@ -340,6 +340,7 @@ static krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
 }
 
 _PUBLIC_  NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
+				  struct smb_iconv_convenience *iconv_convenience,
 				  struct PAC_LOGON_INFO **logon_info,
 				  DATA_BLOB blob,
 				  krb5_context context,
@@ -352,7 +353,9 @@ _PUBLIC_  NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
 	NTSTATUS nt_status;
 	struct PAC_DATA *pac_data;
 	int i;
-	nt_status = kerberos_decode_pac(mem_ctx, &pac_data,
+	nt_status = kerberos_decode_pac(mem_ctx, 
+					iconv_convenience,
+					&pac_data,
 					blob,
 					context,
 					krbtgt_keyblock,
@@ -423,6 +426,7 @@ static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
 }
 
  krb5_error_code kerberos_encode_pac(TALLOC_CTX *mem_ctx,
+				     struct smb_iconv_convenience *iconv_convenience,
 				    struct PAC_DATA *pac_data,
 				    krb5_context context,
 				    const krb5_keyblock *krbtgt_keyblock,
@@ -437,7 +441,6 @@ static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
 	struct PAC_SIGNATURE_DATA *kdc_checksum = NULL;
 	struct PAC_SIGNATURE_DATA *srv_checksum = NULL;
 	int i;
-	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	/* First, just get the keytypes filled in (and lengths right, eventually) */
 	for (i=0; i < pac_data->num_buffers; i++) {
@@ -528,6 +531,7 @@ static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
 
 
  krb5_error_code kerberos_create_pac(TALLOC_CTX *mem_ctx,
+				     struct smb_iconv_convenience *iconv_convenience,
 				     struct auth_serversupplied_info *server_info,
 				     krb5_context context,
 				     const krb5_keyblock *krbtgt_keyblock,
@@ -640,6 +644,7 @@ static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
 	unix_to_nt_time(&LOGON_NAME->logon_time, tgs_authtime);
 
 	ret = kerberos_encode_pac(mem_ctx, 
+				  iconv_convenience,
 				  pac_data, 
 				  context,
 				  krbtgt_keyblock,
diff --git a/source4/auth/ntlmssp/ntlmssp.c b/source4/auth/ntlmssp/ntlmssp.c
index 4f5822567a..8901488004 100644
--- a/source4/auth/ntlmssp/ntlmssp.c
+++ b/source4/auth/ntlmssp/ntlmssp.c
@@ -425,7 +425,7 @@ static const struct gensec_security_ops gensec_ntlmssp_security_ops = {
 };
 
 
-NTSTATUS gensec_ntlmssp_init(void)
+_PUBLIC_ NTSTATUS gensec_ntlmssp_init(void)
 {
 	NTSTATUS ret;
 
diff --git a/source4/build/m4/check_ld.m4 b/source4/build/m4/check_ld.m4
index 3b69057a69..0d0742e5d2 100644
--- a/source4/build/m4/check_ld.m4
+++ b/source4/build/m4/check_ld.m4
@@ -13,6 +13,7 @@ LD=""
 
 AC_SUBST(BLDSHARED)
 AC_SUBST(LD)
+AC_SUBST(SYS_LDFLAGS)
 AC_SUBST(LDFLAGS)
 
 # Assume non-shared by default and override below
@@ -32,13 +33,13 @@ AC_MSG_CHECKING([whether to try to build shared libraries on $host_os])
 case "$host_os" in
 	*linux*)
 		BLDSHARED="true"
-		LDFLAGS="$LDFLAGS -Wl,--export-dynamic"
+		SYS_LDFLAGS="-Wl,--export-dynamic"
 		;;
 	*solaris*)
 		BLDSHARED="true"
 		if test "${GCC}" = "yes"; then
 			if test "${ac_cv_prog_gnu_ld}" = "yes"; then
-				LDFLAGS="$LDFLAGS -Wl,-E"
+				SYS_LDFLAGS="-Wl,-E"
 			fi
 		fi
 		;;
@@ -47,26 +48,26 @@ case "$host_os" in
 		;;
 	*netbsd* | *freebsd* | *dragonfly* )  
 		BLDSHARED="true"
-		LDFLAGS="$LDFLAGS -Wl,--export-dynamic"
+		SYS_LDFLAGS="-Wl,--export-dynamic"
 		;;
 	*openbsd*)
 		BLDSHARED="true"
-		LDFLAGS="$LDFLAGS -Wl,-Bdynamic"
+		SYS_LDFLAGS="-Wl,-Bdynamic"
 		;;
 	*irix*)
 		BLDSHARED="true"
 		;;
 	*aix*)
 		BLDSHARED="true"
-		LDFLAGS="$LDFLAGS -Wl,-brtl,-bexpall,-bbigtoc"
+		SYS_LDFLAGS="-Wl,-brtl,-bexpall,-bbigtoc"
 		;;
 	*hpux*)
 		# Use special PIC flags for the native HP-UX compiler.
 		BLDSHARED="true" # I hope this is correct
 		if test "$host_cpu" = "ia64"; then
-			LDFLAGS="$LDFLAGS -Wl,-E,+b/usr/local/lib/hpux32:/usr/lib/hpux32"
+			SYS_LDFLAGS="-Wl,-E,+b/usr/local/lib/hpux32:/usr/lib/hpux32"
 		else
-			LDFLAGS="$LDFLAGS -Wl,-E,+b/usr/local/lib:/usr/lib"
+			SYS_LDFLAGS="-Wl,-E,+b/usr/local/lib:/usr/lib"
 		fi
 		;;
 	*osf*)
@@ -86,6 +87,8 @@ AC_MSG_CHECKING([LD])
 AC_MSG_RESULT([$LD])
 AC_MSG_CHECKING([LDFLAGS])
 AC_MSG_RESULT([$LDFLAGS])
+AC_MSG_CHECKING([SYS_LDFLAGS])
+AC_MSG_RESULT([$SYS_LDFLAGS])
 
 AC_SUBST(HOSTLD)
 
diff --git a/source4/build/m4/check_path.m4 b/source4/build/m4/check_path.m4
index 1dacd956ea..08a858ebb2 100644
--- a/source4/build/m4/check_path.m4
+++ b/source4/build/m4/check_path.m4
@@ -132,7 +132,7 @@ AC_SUBST(modulesdir)
 selftest_prefix="./st"
 AC_SUBST(selftest_prefix)
 AC_ARG_WITH(selftest-prefix,
-[  --with-selftest-prefix=DIR    The prefix where make test will be runned ($selftest_prefix)],
+[  --with-selftest-prefix=DIR    The prefix where make test will be run ($selftest_prefix)],
 [ case "$withval" in
   yes|no)
     AC_MSG_WARN([--with-selftest-prefix called without argument - will use default])
diff --git a/source4/build/smb_build/input.pm b/source4/build/smb_build/input.pm
index 9aef1c1002..a8dd573744 100644
--- a/source4/build/smb_build/input.pm
+++ b/source4/build/smb_build/input.pm
@@ -233,14 +233,6 @@ sub check($$$$$)
 	my ($INPUT, $enabled, $subsys_ot, $lib_ot, $module_ot) = @_;
 
 	foreach my $part (values %$INPUT) {
-		unless (defined($part->{STANDARD_VISIBILITY})) {
-			if ($part->{TYPE} eq "MODULE" or $part->{TYPE} eq "BINARY") {
-				$part->{STANDARD_VISIBILITY} = "hidden";
-			} else {
-				$part->{STANDARD_VISIBILITY} = "default";
-			}
-		}
-
 		unless (defined($part->{PUBLIC_HEADERS})) {
 			$part->{PUBLIC_HEADERS} = [];
 		}
diff --git a/source4/build/smb_build/makefile.pm b/source4/build/smb_build/makefile.pm
index 8a99848437..23caec083f 100644
--- a/source4/build/smb_build/makefile.pm
+++ b/source4/build/smb_build/makefile.pm
@@ -145,7 +145,8 @@ sub SharedModule($$)
 	$self->_prepare_list($ctx, "DEPEND_LIST");
 	$self->_prepare_list($ctx, "LINK_FLAGS");
 
-	if (defined($ctx->{INIT_FUNCTION}) and $ctx->{TYPE} ne "PYTHON") {
+	if (defined($ctx->{INIT_FUNCTION}) and $ctx->{TYPE} ne "PYTHON" and
+		$ctx->{INIT_FUNCTION_TYPE} =~ /\(\*\)/) {
 		$self->output("\$($ctx->{NAME}_OBJ_LIST): CFLAGS+=-D$ctx->{INIT_FUNCTION}=init_module\n");
 	}
 
@@ -154,8 +155,8 @@ sub SharedModule($$)
 $ctx->{SHAREDDIR}/$ctx->{LIBRARY_REALNAME}: \$($ctx->{NAME}_DEPEND_LIST) \$($ctx->{NAME}_OBJ_LIST)
 	\@echo Linking \$\@
 	\@mkdir -p \$(\@D)
-	\@\$(MDLD) \$(MDLD_FLAGS) \$(INTERN_LDFLAGS) -o \$\@ \$(INSTALL_LINK_FLAGS) \\
-		\$($ctx->{NAME}\_OBJ_LIST) \\
+	\@\$(MDLD) \$(LDFLAGS) \$(MDLD_FLAGS) \$(INTERN_LDFLAGS) -o \$\@ \$(INSTALL_LINK_FLAGS) \\
+		\$($ctx->{NAME}\_FULL_OBJ_LIST) \\
 		\$($ctx->{NAME}_LINK_FLAGS)
 __EOD__
 );
@@ -195,8 +196,8 @@ sub SharedLibrary($$)
 $ctx->{RESULT_SHARED_LIBRARY}: \$($ctx->{NAME}_DEPEND_LIST) \$($ctx->{NAME}_FULL_OBJ_LIST)
 	\@echo Linking \$\@
 	\@mkdir -p $ctx->{SHAREDDIR}
-	\@\$(SHLD) \$(SHLD_FLAGS) \$(INTERN_LDFLAGS) -o \$\@ \$(INSTALL_LINK_FLAGS) \\
-		\$($ctx->{NAME}\_OBJ_LIST) \\
+	\@\$(SHLD) \$(LDFLAGS) \$(SHLD_FLAGS) \$(INTERN_LDFLAGS) -o \$\@ \$(INSTALL_LINK_FLAGS) \\
+		\$($ctx->{NAME}\_FULL_OBJ_LIST) \\
 		\$($ctx->{NAME}_LINK_FLAGS) \\
 		\$(if \$(SONAMEFLAG), \$(SONAMEFLAG)$ctx->{LIBRARY_SONAME})
 __EOD__
diff --git a/source4/build/smb_build/output.pm b/source4/build/smb_build/output.pm
index 83be28e740..ff9afe8e8c 100644
--- a/source4/build/smb_build/output.pm
+++ b/source4/build/smb_build/output.pm
@@ -185,7 +185,7 @@ sub create_output($$)
 		merge_array(\$part->{FINAL_CFLAGS}, $part->{CPPFLAGS});
 		merge_array(\$part->{FINAL_CFLAGS}, $part->{CFLAGS});
 
-		foreach (@{$part->{UNIQUE_DEPENDENCIES_COMPILE}}) {
+		foreach (@{$part->{UNIQUE_DEPENDENCIES_ALL}}) {
 			my $elem = $depend->{$_};
 			next if $elem == $part;
 
diff --git a/source4/build/smb_build/summary.pm b/source4/build/smb_build/summary.pm
index 4ea1ad525e..a6557fb1fe 100644
--- a/source4/build/smb_build/summary.pm
+++ b/source4/build/smb_build/summary.pm
@@ -53,6 +53,9 @@ sub show($$)
 	showitem($output, "using libblkid", ["BLKID"]);
 	showitem($output, "using iconv", ["ICONV"]);
 	showitem($output, "using pam", ["PAM"]);
+	if (enabled($config->{developer})) {
+		showitem($output, "using VDE", ["VDEPLUG"]);
+	}
 	showitem($output, "python bindings", ["LIBPYTHON"]);
 	showisexternal($output, "popt", "LIBPOPT");
 	showisexternal($output, "talloc", "LIBTALLOC");
diff --git a/source4/cluster/ctdb/opendb_ctdb.c b/source4/cluster/ctdb/opendb_ctdb.c
index aaab3aa55d..86dc1f50f1 100644
--- a/source4/cluster/ctdb/opendb_ctdb.c
+++ b/source4/cluster/ctdb/opendb_ctdb.c
@@ -133,6 +133,16 @@ static struct odb_lock *odb_ctdb_lock(TALLOC_CTX *mem_ctx,
 	return lck;
 }
 
+static DATA_BLOB odb_ctdb_get_key(TALLOC_CTX *mem_ctx, struct odb_lock *lck)
+{
+	/*
+	 * as this file will went away and isn't used yet,
+	 * copy the implementation from the tdb backend
+	 * --metze
+	 */
+	return data_blob_const(NULL, 0);
+}
+
 /*
   determine if two odb_entry structures conflict
 
@@ -440,6 +450,19 @@ static NTSTATUS odb_ctdb_close_file(struct odb_lock *lck, void *file_handle)
 	return odb_push_record(lck, &file);
 }
 
+/*
+  update the oplock level of the client
+*/
+static NTSTATUS odb_ctdb_update_oplock(struct odb_lock *lck, void *file_handle,
+				       uint32_t oplock_level)
+{
+	/*
+	 * as this file will went away and isn't used yet,
+	 * copy the implementation from the tdb backend
+	 * --metze
+	 */
+	return NT_STATUS_FOOBAR;
+}
 
 /*
   remove a pending opendb entry
@@ -610,6 +633,7 @@ static NTSTATUS odb_ctdb_can_open(struct odb_lock *lck,
 static const struct opendb_ops opendb_ctdb_ops = {
 	.odb_init                = odb_ctdb_init,
 	.odb_lock                = odb_ctdb_lock,
+	.odb_get_key             = odb_ctdb_get_key,
 	.odb_open_file           = odb_ctdb_open_file,
 	.odb_open_file_pending   = odb_ctdb_open_file_pending,
 	.odb_close_file          = odb_ctdb_close_file,
@@ -617,7 +641,8 @@ static const struct opendb_ops opendb_ctdb_ops = {
 	.odb_rename              = odb_ctdb_rename,
 	.odb_set_delete_on_close = odb_ctdb_set_delete_on_close,
 	.odb_get_delete_on_close = odb_ctdb_get_delete_on_close,
-	.odb_can_open            = odb_ctdb_can_open
+	.odb_can_open            = odb_ctdb_can_open,
+	.odb_update_oplock       = odb_ctdb_update_oplock
 };
 
 
diff --git a/source4/configure.ac b/source4/configure.ac
index 1c17126f4a..b609b4f52c 100644
--- a/source4/configure.ac
+++ b/source4/configure.ac
@@ -35,7 +35,7 @@ AC_CONFIG_FILES(auth/gensec/gensec.pc)
 AC_CONFIG_FILES(param/samba-config.pc)
 AC_CONFIG_FILES(librpc/dcerpc_samr.pc)
 
-SMB_EXT_LIB_FROM_PKGCONFIG(LIBTALLOC, talloc >= 1.1.0,
+SMB_EXT_LIB_FROM_PKGCONFIG(LIBTALLOC, talloc >= 1.2.0,
 	[],
 	[
 		m4_include(lib/talloc/libtalloc.m4)
diff --git a/source4/dsdb/samdb/ldb_modules/anr.c b/source4/dsdb/samdb/ldb_modules/anr.c
index 908d9b088c..1252c9ee42 100644
--- a/source4/dsdb/samdb/ldb_modules/anr.c
+++ b/source4/dsdb/samdb/ldb_modules/anr.c
@@ -295,13 +295,7 @@ static int anr_search(struct ldb_module *module, struct ldb_request *req)
 	return ldb_next_request(module, req);
 }
 
-static const struct ldb_module_ops anr_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_anr_module_ops = {
 	.name		   = "anr",
 	.search = anr_search
 };
-
-int ldb_anr_init(void)
-{
-	return ldb_register_module(&anr_ops);
-}
-
diff --git a/source4/dsdb/samdb/ldb_modules/config.mk b/source4/dsdb/samdb/ldb_modules/config.mk
index dc407fbd8a..de93b5638d 100644
--- a/source4/dsdb/samdb/ldb_modules/config.mk
+++ b/source4/dsdb/samdb/ldb_modules/config.mk
@@ -4,7 +4,7 @@
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC LIBNDR NDR_MISC
-INIT_FUNCTION = objectguid_module_init
+INIT_FUNCTION = objectguid_module_module_ops
 OBJ_FILES = \
 		objectguid.o
 # End MODULE ldb_objectguid
@@ -17,7 +17,7 @@ SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = SAMDB LIBTALLOC LIBNDR NDR_MISC NDR_DRSUAPI \
 					   NDR_DRSBLOBS LIBNDR
-INIT_FUNCTION = repl_meta_data_module_init
+INIT_FUNCTION = repl_meta_data_module_module_ops
 OBJ_FILES = \
 		repl_meta_data.o
 # End MODULE ldb_repl_meta_data
@@ -29,7 +29,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = SAMDB LIBTALLOC
-INIT_FUNCTION = dsdb_cache_module_init
+INIT_FUNCTION = dsdb_cache_module_module_ops
 OBJ_FILES = \
 		dsdb_cache.o
 # End MODULE ldb_dsdb_cache
@@ -41,7 +41,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = SAMDB LIBTALLOC
-INIT_FUNCTION = schema_fsmo_module_init
+INIT_FUNCTION = schema_fsmo_module_module_ops
 OBJ_FILES = \
 		schema_fsmo.o
 # End MODULE ldb_schema_fsmo
@@ -53,7 +53,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = SAMDB LIBTALLOC
-INIT_FUNCTION = naming_fsmo_module_init
+INIT_FUNCTION = naming_fsmo_module_module_ops
 OBJ_FILES = \
 		naming_fsmo.o
 # End MODULE ldb_naming_fsmo
@@ -65,7 +65,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = SAMDB LIBTALLOC
-INIT_FUNCTION = pdc_fsmo_module_init
+INIT_FUNCTION = pdc_fsmo_module_module_ops
 OBJ_FILES = \
 		pdc_fsmo.o
 # End MODULE ldb_pdc_fsmo
@@ -77,7 +77,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC LDAP_ENCODE NDR_MISC SAMDB
-INIT_FUNCTION = samldb_module_init
+INIT_FUNCTION = samldb_module_module_ops
 OBJ_FILES = \
 		samldb.o
 #
@@ -89,7 +89,7 @@ OBJ_FILES = \
 [MODULE::ldb_samba3sam]
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
-INIT_FUNCTION = ldb_samba3sam_module_init
+INIT_FUNCTION = &ldb_samba3sam_module_module_ops
 PRIVATE_DEPENDENCIES = LIBTALLOC ldb_map SMBPASSWD NSS_WRAPPER LIBSECURITY \
 					   NDR_SECURITY
 OBJ_FILES = \
@@ -103,7 +103,7 @@ OBJ_FILES = \
 [MODULE::ldb_simple_ldap_map]
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
-INIT_FUNCTION = ldb_simple_ldap_map_module_init
+INIT_FUNCTION = &ldb_simple_ldap_map_module_module_ops
 PRIVATE_DEPENDENCIES = LIBTALLOC ldb_map LIBNDR NDR_MISC
 ENABLE = YES
 ALIASES = entryuuid nsuniqueid
@@ -117,7 +117,7 @@ OBJ_FILES = \
 # # Start MODULE ldb_proxy
 # [MODULE::ldb_proxy]
 # SUBSYSTEM = LIBLDB
-# INIT_FUNCTION = proxy_module_init
+# INIT_FUNCTION = proxy_module_module_ops
 # OBJ_FILES = \
 # 		proxy.o
 # 
@@ -131,7 +131,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 PRIVATE_DEPENDENCIES = LIBTALLOC SAMDB
 OUTPUT_TYPE = SHARED_LIBRARY
-INIT_FUNCTION = rootdse_module_init
+INIT_FUNCTION = rootdse_module_module_ops
 OBJ_FILES = \
 		rootdse.o
 #
@@ -143,7 +143,7 @@ OBJ_FILES = \
 [MODULE::ldb_password_hash]
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
-INIT_FUNCTION = password_hash_module_init
+INIT_FUNCTION = password_hash_module_module_ops
 OBJ_FILES = password_hash.o
 PRIVATE_DEPENDENCIES = HEIMDAL_HDB_KEYS LIBTALLOC HEIMDAL_KRB5 LDAP_ENCODE \
 					   LIBCLI_AUTH NDR_DRSBLOBS KERBEROS SAMDB
@@ -157,7 +157,7 @@ PRIVATE_DEPENDENCIES = HEIMDAL_HDB_KEYS LIBTALLOC HEIMDAL_KRB5 LDAP_ENCODE \
 PRIVATE_DEPENDENCIES = LIBTALLOC LIBNDR SAMDB
 OUTPUT_TYPE = SHARED_LIBRARY
 SUBSYSTEM = LIBLDB
-INIT_FUNCTION = local_password_module_init
+INIT_FUNCTION = local_password_module_module_ops
 OBJ_FILES = local_password.o
 #
 # End MODULE ldb_local_password
@@ -169,7 +169,7 @@ OBJ_FILES = local_password.o
 PRIVATE_DEPENDENCIES = LIBTALLOC LIBSECURITY SAMDB
 OUTPUT_TYPE = SHARED_LIBRARY
 SUBSYSTEM = LIBLDB
-INIT_FUNCTION = ldb_kludge_acl_init
+INIT_FUNCTION = &ldb_kludge_acl_module_ops
 OBJ_FILES = \
 		kludge_acl.o
 #
@@ -182,7 +182,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC LIBNDR LIBSECURITY SAMDB
-INIT_FUNCTION = ldb_extended_dn_init
+INIT_FUNCTION = &ldb_extended_dn_module_ops
 OBJ_FILES = \
 		extended_dn.o
 #
@@ -195,7 +195,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC
-INIT_FUNCTION = ldb_show_deleted_init
+INIT_FUNCTION = &ldb_show_deleted_module_ops
 OBJ_FILES = \
 		show_deleted.o
 #
@@ -208,7 +208,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC SAMDB
-INIT_FUNCTION = ldb_partition_init
+INIT_FUNCTION = &ldb_partition_module_ops
 OBJ_FILES = \
 		partition.o
 #
@@ -221,7 +221,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC LIBLDB
-INIT_FUNCTION = ldb_schema_init
+INIT_FUNCTION = &ldb_schema_module_ops
 OBJ_FILES = \
 		schema.o schema_syntax.o
 #
@@ -235,7 +235,7 @@ SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC CREDENTIALS
 #Also depends on credentials, but that would loop
-INIT_FUNCTION = ldb_update_kt_init
+INIT_FUNCTION = &ldb_update_kt_module_ops
 OBJ_FILES = \
 		update_keytab.o 
 #
@@ -245,7 +245,7 @@ OBJ_FILES = \
 ################################################
 # Start MODULE ldb_objectclass
 [MODULE::ldb_objectclass]
-INIT_FUNCTION = ldb_objectclass_init
+INIT_FUNCTION = &ldb_objectclass_module_ops
 OUTPUT_TYPE = SHARED_LIBRARY
 CFLAGS = -Ilib/ldb/include
 PRIVATE_DEPENDENCIES = LIBTALLOC LIBSECURITY NDR_SECURITY SAMDB
@@ -258,8 +258,7 @@ OBJ_FILES = \
 ################################################
 # Start MODULE ldb_subtree_rename
 [MODULE::ldb_subtree_rename]
-INIT_FUNCTION = ldb_subtree_rename_init
-OUTPUT_TYPE = SHARED_LIBRARY
+INIT_FUNCTION = &ldb_subtree_rename_module_ops
 CFLAGS = -Ilib/ldb/include
 PRIVATE_DEPENDENCIES = LIBTALLOC
 SUBSYSTEM = LIBLDB
@@ -271,8 +270,7 @@ OBJ_FILES = \
 ################################################
 # Start MODULE ldb_subtree_rename
 [MODULE::ldb_subtree_delete]
-INIT_FUNCTION = ldb_subtree_delete_init
-OUTPUT_TYPE = SHARED_LIBRARY
+INIT_FUNCTION = &ldb_subtree_delete_module_ops
 CFLAGS = -Ilib/ldb/include
 PRIVATE_DEPENDENCIES = LIBTALLOC
 SUBSYSTEM = LIBLDB
@@ -284,7 +282,7 @@ OBJ_FILES = \
 ################################################
 # Start MODULE ldb_linked_attributes
 [MODULE::ldb_linked_attributes]
-INIT_FUNCTION = ldb_linked_attributes_init
+INIT_FUNCTION = &ldb_linked_attributes_module_ops
 CFLAGS = -Ilib/ldb/include
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC SAMDB
@@ -297,9 +295,8 @@ OBJ_FILES = \
 ################################################
 # Start MODULE ldb_ranged_results
 [MODULE::ldb_ranged_results]
-INIT_FUNCTION = ldb_ranged_results_init
+INIT_FUNCTION = &ldb_ranged_results_module_ops
 CFLAGS = -Ilib/ldb/include
-OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC
 SUBSYSTEM = LIBLDB
 OBJ_FILES = \
@@ -310,7 +307,7 @@ OBJ_FILES = \
 ################################################
 # Start MODULE ldb_anr
 [MODULE::ldb_anr]
-INIT_FUNCTION = ldb_anr_init
+INIT_FUNCTION = &ldb_anr_module_ops
 CFLAGS = -Ilib/ldb/include
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC LIBSAMBA-UTIL SAMDB
@@ -323,7 +320,7 @@ OBJ_FILES = \
 ################################################
 # Start MODULE ldb_normalise
 [MODULE::ldb_normalise]
-INIT_FUNCTION = ldb_normalise_init
+INIT_FUNCTION = &ldb_normalise_module_ops
 CFLAGS = -Ilib/ldb/include
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC LIBSAMBA-UTIL SAMDB
@@ -336,7 +333,7 @@ OBJ_FILES = \
 ################################################
 # Start MODULE ldb_instancetype
 [MODULE::ldb_instancetype]
-INIT_FUNCTION = ldb_instancetype_init
+INIT_FUNCTION = &ldb_instancetype_module_ops
 CFLAGS = -Ilib/ldb/include
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC
diff --git a/source4/dsdb/samdb/ldb_modules/dsdb_cache.c b/source4/dsdb/samdb/ldb_modules/dsdb_cache.c
index 4ca8bbf463..e60605dce1 100644
--- a/source4/dsdb/samdb/ldb_modules/dsdb_cache.c
+++ b/source4/dsdb/samdb/ldb_modules/dsdb_cache.c
@@ -36,12 +36,7 @@ static int dsdb_cache_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops dsdb_cache_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_dsdb_cache_module_ops = {
 	.name		= "dsdb_cache",
 	.init_context	= dsdb_cache_init
 };
-
-int dsdb_cache_module_init(void)
-{
-	return ldb_register_module(&dsdb_cache_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/extended_dn.c b/source4/dsdb/samdb/ldb_modules/extended_dn.c
index 802f86570b..84bf5e4843 100644
--- a/source4/dsdb/samdb/ldb_modules/extended_dn.c
+++ b/source4/dsdb/samdb/ldb_modules/extended_dn.c
@@ -362,13 +362,8 @@ static int extended_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops extended_dn_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_extended_dn_module_ops = {
 	.name		   = "extended_dn",
 	.search            = extended_search,
 	.init_context	   = extended_init
 };
-
-int ldb_extended_dn_init(void)
-{
-	return ldb_register_module(&extended_dn_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/instancetype.c b/source4/dsdb/samdb/ldb_modules/instancetype.c
index 65df294e90..fd5aa5e18a 100644
--- a/source4/dsdb/samdb/ldb_modules/instancetype.c
+++ b/source4/dsdb/samdb/ldb_modules/instancetype.c
@@ -118,13 +118,7 @@ static int instancetype_add(struct ldb_module *module, struct ldb_request *req)
 	return ret;
 }
 
-static const struct ldb_module_ops instancetype_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_instancetype_module_ops = {
 	.name          = "instancetype",
 	.add           = instancetype_add,
 };
-
-
-int ldb_instancetype_init(void)
-{
-	return ldb_register_module(&instancetype_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/kludge_acl.c b/source4/dsdb/samdb/ldb_modules/kludge_acl.c
index ea33548b91..e3e1f7ac88 100644
--- a/source4/dsdb/samdb/ldb_modules/kludge_acl.c
+++ b/source4/dsdb/samdb/ldb_modules/kludge_acl.c
@@ -471,7 +471,7 @@ done:
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops kludge_acl_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_kludge_acl_module_ops = {
 	.name		   = "kludge_acl",
 	.search            = kludge_acl_search,
 	.add               = kludge_acl_change,
@@ -481,8 +481,3 @@ static const struct ldb_module_ops kludge_acl_ops = {
 	.extended          = kludge_acl_change,
 	.init_context	   = kludge_acl_init
 };
-
-int ldb_kludge_acl_init(void)
-{
-	return ldb_register_module(&kludge_acl_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/linked_attributes.c b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
index b3fdffe566..8685c722aa 100644
--- a/source4/dsdb/samdb/ldb_modules/linked_attributes.c
+++ b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
@@ -915,7 +915,7 @@ static int linked_attributes_wait(struct ldb_handle *handle, enum ldb_wait_type
 	}
 }
 
-static const struct ldb_module_ops linked_attributes_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_linked_attributes_module_ops = {
 	.name		   = "linked_attributes",
 	.add               = linked_attributes_add,
 	.modify            = linked_attributes_modify,
@@ -923,8 +923,3 @@ static const struct ldb_module_ops linked_attributes_ops = {
 	.rename            = linked_attributes_rename,
 	.wait              = linked_attributes_wait,
 };
-
-int ldb_linked_attributes_init(void)
-{
-	return ldb_register_module(&linked_attributes_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/local_password.c b/source4/dsdb/samdb/ldb_modules/local_password.c
index 350434df51..dfa98ef0af 100644
--- a/source4/dsdb/samdb/ldb_modules/local_password.c
+++ b/source4/dsdb/samdb/ldb_modules/local_password.c
@@ -843,16 +843,10 @@ static int local_password_wait(struct ldb_handle *handle, enum ldb_wait_type typ
 	}
 }
 
-static const struct ldb_module_ops local_password_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_local_password_module_ops = {
 	.name          = "local_password",
 	.add           = local_password_add,
 	.modify        = local_password_modify,
 	.search        = local_password_search,
 	.wait          = local_password_wait
 };
-
-
-int local_password_module_init(void)
-{
-	return ldb_register_module(&local_password_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/naming_fsmo.c b/source4/dsdb/samdb/ldb_modules/naming_fsmo.c
index d6b6a24287..084540f68d 100644
--- a/source4/dsdb/samdb/ldb_modules/naming_fsmo.c
+++ b/source4/dsdb/samdb/ldb_modules/naming_fsmo.c
@@ -117,12 +117,7 @@ static int naming_fsmo_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops naming_fsmo_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_naming_fsmo_module_ops = {
 	.name		= "naming_fsmo",
 	.init_context	= naming_fsmo_init
 };
-
-int naming_fsmo_module_init(void)
-{
-	return ldb_register_module(&naming_fsmo_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/normalise.c b/source4/dsdb/samdb/ldb_modules/normalise.c
index efc9bb29e8..695393d4e8 100644
--- a/source4/dsdb/samdb/ldb_modules/normalise.c
+++ b/source4/dsdb/samdb/ldb_modules/normalise.c
@@ -105,6 +105,7 @@ static int normalise_search_callback(struct ldb_context *ldb, void *context, str
 		if (!attribute) {
 			continue;
 		}
+		/* Look to see if this attributeSyntax is a DN */
 		if ((strcmp(attribute->attributeSyntax_oid, "2.5.5.1") != 0) &&
 		    (strcmp(attribute->attributeSyntax_oid, "2.5.5.7") != 0)) {
 			continue;
@@ -155,12 +156,7 @@ static int normalise_search(struct ldb_module *module, struct ldb_request *req)
 }
 
 
-static const struct ldb_module_ops normalise_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_normalise_module_ops = {
 	.name		   = "normalise",
 	.search            = normalise_search,
 };
-
-int ldb_normalise_init(void)
-{
-	return ldb_register_module(&normalise_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c
index 737475ca78..e63ad4de56 100644
--- a/source4/dsdb/samdb/ldb_modules/objectclass.c
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -1153,16 +1153,10 @@ static int objectclass_wait(struct ldb_handle *handle, enum ldb_wait_type type)
 	}
 }
 
-static const struct ldb_module_ops objectclass_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_objectclass_module_ops = {
 	.name		   = "objectclass",
 	.add           = objectclass_add,
 	.modify        = objectclass_modify,
 	.rename        = objectclass_rename,
 	.wait          = objectclass_wait
 };
-
-int ldb_objectclass_init(void)
-{
-	return ldb_register_module(&objectclass_ops);
-}
-
diff --git a/source4/dsdb/samdb/ldb_modules/objectguid.c b/source4/dsdb/samdb/ldb_modules/objectguid.c
index bf57f5c21b..f62839389d 100644
--- a/source4/dsdb/samdb/ldb_modules/objectguid.c
+++ b/source4/dsdb/samdb/ldb_modules/objectguid.c
@@ -247,14 +247,8 @@ static int objectguid_modify(struct ldb_module *module, struct ldb_request *req)
 	return ret;
 }
 
-static const struct ldb_module_ops objectguid_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_objectguid_module_ops = {
 	.name          = "objectguid",
 	.add           = objectguid_add,
 	.modify        = objectguid_modify,
 };
-
-
-int objectguid_module_init(void)
-{
-	return ldb_register_module(&objectguid_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/partition.c b/source4/dsdb/samdb/ldb_modules/partition.c
index 61b64441a7..78b5a09f78 100644
--- a/source4/dsdb/samdb/ldb_modules/partition.c
+++ b/source4/dsdb/samdb/ldb_modules/partition.c
@@ -87,7 +87,7 @@ static struct ldb_module *make_module_for_next_request(TALLOC_CTX *mem_ctx,
 						       struct ldb_module *module)
 {
 	struct ldb_module *current;
-	static const struct ldb_module_ops ops; /* zero */
+_PUBLIC_ 	static const struct ldb_module_ops ops; /* zero */
 	current = talloc_zero(mem_ctx, struct ldb_module);
 	if (current == NULL) {
 		return module;
@@ -1030,7 +1030,7 @@ static int partition_wait(struct ldb_handle *handle, enum ldb_wait_type type)
 	}
 }
 
-static const struct ldb_module_ops partition_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_partition_module_ops = {
 	.name		   = "partition",
 	.init_context	   = partition_init,
 	.search            = partition_search,
@@ -1045,8 +1045,3 @@ static const struct ldb_module_ops partition_ops = {
 	.del_transaction   = partition_del_trans,
 	.wait              = partition_wait
 };
-
-int ldb_partition_init(void)
-{
-	return ldb_register_module(&partition_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
index 57c053d961..aa64700f2f 100644
--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
@@ -2044,15 +2044,9 @@ static int password_hash_wait(struct ldb_handle *handle, enum ldb_wait_type type
 	}
 }
 
-static const struct ldb_module_ops password_hash_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_password_hash_module_ops = {
 	.name          = "password_hash",
 	.add           = password_hash_add,
 	.modify        = password_hash_modify,
 	.wait          = password_hash_wait
 };
-
-
-int password_hash_module_init(void)
-{
-	return ldb_register_module(&password_hash_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/pdc_fsmo.c b/source4/dsdb/samdb/ldb_modules/pdc_fsmo.c
index 0f3293ed1d..09d56d77c9 100644
--- a/source4/dsdb/samdb/ldb_modules/pdc_fsmo.c
+++ b/source4/dsdb/samdb/ldb_modules/pdc_fsmo.c
@@ -115,12 +115,7 @@ static int pdc_fsmo_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops pdc_fsmo_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_pdc_fsmo_module_ops = {
 	.name		= "pdc_fsmo",
 	.init_context	= pdc_fsmo_init
 };
-
-int pdc_fsmo_module_init(void)
-{
-	return ldb_register_module(&pdc_fsmo_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/proxy.c b/source4/dsdb/samdb/ldb_modules/proxy.c
index 37ee7f9fce..0d065425ca 100644
--- a/source4/dsdb/samdb/ldb_modules/proxy.c
+++ b/source4/dsdb/samdb/ldb_modules/proxy.c
@@ -331,12 +331,7 @@ static int proxy_request(struct ldb_module *module, struct ldb_request *req)
 	}
 }
 
-static const struct ldb_module_ops proxy_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_proxy_module_ops = {
 	.name		= "proxy",
 	.request	= proxy_request
 };
-
-int proxy_module_init(void)
-{
-	return ldb_register_module(&proxy_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/ranged_results.c b/source4/dsdb/samdb/ldb_modules/ranged_results.c
index c527afc6db..c6ebea1044 100644
--- a/source4/dsdb/samdb/ldb_modules/ranged_results.c
+++ b/source4/dsdb/samdb/ldb_modules/ranged_results.c
@@ -201,12 +201,7 @@ static int rr_search(struct ldb_module *module, struct ldb_request *req)
 	return ldb_next_request(module, req);
 }
 
-static const struct ldb_module_ops rr_ops = {
+const struct ldb_module_ops ldb_ranged_results_module_ops = {
 	.name		   = "ranged_results",
 	.search            = rr_search,
 };
-
-int ldb_ranged_results_init(void)
-{
-	return ldb_register_module(&rr_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
index 441dbc9598..dd5faf837a 100644
--- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
@@ -1579,15 +1579,10 @@ static int replmd_wait(struct ldb_handle *handle, enum ldb_wait_type type)
 	}
 }
 
-static const struct ldb_module_ops replmd_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
 	.name          = "repl_meta_data",
 	.add           = replmd_add,
 	.modify        = replmd_modify,
 	.extended      = replmd_extended,
 	.wait          = replmd_wait
 };
-
-int repl_meta_data_module_init(void)
-{
-	return ldb_register_module(&replmd_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/rootdse.c b/source4/dsdb/samdb/ldb_modules/rootdse.c
index 02f43d7076..3235b24ef9 100644
--- a/source4/dsdb/samdb/ldb_modules/rootdse.c
+++ b/source4/dsdb/samdb/ldb_modules/rootdse.c
@@ -386,15 +386,9 @@ static int rootdse_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops rootdse_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_rootdse_module_ops = {
 	.name			= "rootdse",
 	.init_context           = rootdse_init,
 	.search                 = rootdse_search,
 	.request		= rootdse_request
 };
-
-int rootdse_module_init(void)
-{
-	return ldb_register_module(&rootdse_ops);
-}
-
diff --git a/source4/dsdb/samdb/ldb_modules/samba3sam.c b/source4/dsdb/samdb/ldb_modules/samba3sam.c
index 3a666b5380..88b04b1bb6 100644
--- a/source4/dsdb/samdb/ldb_modules/samba3sam.c
+++ b/source4/dsdb/samdb/ldb_modules/samba3sam.c
@@ -925,21 +925,8 @@ static int samba3sam_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static struct ldb_module_ops samba3sam_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_samba3sam_module_ops = {
+	LDB_MAP_OPS
 	.name		   = "samba3sam",
 	.init_context	   = samba3sam_init,
 };
-
-/* the init function */
-int ldb_samba3sam_module_init(void)
-{
-	struct ldb_module_ops ops = ldb_map_get_ops();
-	samba3sam_ops.add	= ops.add;
-	samba3sam_ops.modify	= ops.modify;
-	samba3sam_ops.del	= ops.del;
-	samba3sam_ops.rename	= ops.rename;
-	samba3sam_ops.search	= ops.search;
-	samba3sam_ops.wait	= ops.wait;
-
-	return ldb_register_module(&samba3sam_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index baf419c750..178149a886 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -750,14 +750,8 @@ static int samldb_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops samldb_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_samldb_module_ops = {
 	.name          = "samldb",
 	.init_context  = samldb_init,
 	.add           = samldb_add,
 };
-
-
-int samldb_module_init(void)
-{
-	return ldb_register_module(&samldb_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/schema.c b/source4/dsdb/samdb/ldb_modules/schema.c
index 525193ac8c..ff9530ca92 100644
--- a/source4/dsdb/samdb/ldb_modules/schema.c
+++ b/source4/dsdb/samdb/ldb_modules/schema.c
@@ -1221,7 +1221,7 @@ static int schema_init(struct ldb_module *module)
 	return LDB_SUCCESS;
 }
 
-static const struct ldb_module_ops schema_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_schema_module_ops = {
 	.name          = "schema",
 	.init_context  = schema_init,
 	.add           = schema_add,
@@ -1230,8 +1230,3 @@ static const struct ldb_module_ops schema_ops = {
 	.rename        = schema_rename,
 	.wait          = schema_wait
 };
-
-int ldb_schema_init(void)
-{
-	return ldb_register_module(&schema_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/schema_fsmo.c b/source4/dsdb/samdb/ldb_modules/schema_fsmo.c
index f9dd131fd4..729fd15202 100644
--- a/source4/dsdb/samdb/ldb_modules/schema_fsmo.c
+++ b/source4/dsdb/samdb/ldb_modules/schema_fsmo.c
@@ -255,12 +255,7 @@ static int schema_fsmo_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops schema_fsmo_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_schema_fsmo_module_ops = {
 	.name		= "schema_fsmo",
 	.init_context	= schema_fsmo_init
 };
-
-int schema_fsmo_module_init(void)
-{
-	return ldb_register_module(&schema_fsmo_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/show_deleted.c b/source4/dsdb/samdb/ldb_modules/show_deleted.c
index 19fa63fb6e..361cf226dc 100644
--- a/source4/dsdb/samdb/ldb_modules/show_deleted.c
+++ b/source4/dsdb/samdb/ldb_modules/show_deleted.c
@@ -194,13 +194,8 @@ static int show_deleted_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops show_deleted_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_show_deleted_module_ops = {
 	.name		   = "show_deleted",
 	.search            = show_deleted_search,
 	.init_context	   = show_deleted_init
 };
-
-int ldb_show_deleted_init(void)
-{
-	return ldb_register_module(&show_deleted_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c b/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c
index acf2fd622c..3f4c19d285 100644
--- a/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c
+++ b/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c
@@ -793,42 +793,16 @@ static int entryuuid_sequence_number(struct ldb_module *module, struct ldb_reque
 	return LDB_SUCCESS;
 }
 
-static struct ldb_module_ops entryuuid_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_entryuuid_module_ops = {
 	.name		   = "entryuuid",
 	.init_context	   = entryuuid_init,
-	.sequence_number   = entryuuid_sequence_number
+	.sequence_number   = entryuuid_sequence_number,
+	LDB_MAP_OPS
 };
 
-static struct ldb_module_ops nsuniqueid_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_nsuniqueid_module_ops = {
 	.name		   = "nsuniqueid",
 	.init_context	   = nsuniqueid_init,
-	.sequence_number   = entryuuid_sequence_number
+	.sequence_number   = entryuuid_sequence_number,
+	LDB_MAP_OPS
 };
-
-/* the init function */
-int ldb_simple_ldap_map_module_init(void)
-{
-	int ret;
-	struct ldb_module_ops ops = ldb_map_get_ops();
-	entryuuid_ops.add	= ops.add;
-	entryuuid_ops.modify	= ops.modify;
-	entryuuid_ops.del	= ops.del;
-	entryuuid_ops.rename	= ops.rename;
-	entryuuid_ops.search	= ops.search;
-	entryuuid_ops.wait	= ops.wait;
-	ret = ldb_register_module(&entryuuid_ops);
-
-	if (ret) {
-		return ret;
-	}
-
-	nsuniqueid_ops.add	= ops.add;
-	nsuniqueid_ops.modify	= ops.modify;
-	nsuniqueid_ops.del	= ops.del;
-	nsuniqueid_ops.rename	= ops.rename;
-	nsuniqueid_ops.search	= ops.search;
-	nsuniqueid_ops.wait	= ops.wait;
-	ret = ldb_register_module(&nsuniqueid_ops);
-
-	return ret;
-}
diff --git a/source4/dsdb/samdb/ldb_modules/subtree_delete.c b/source4/dsdb/samdb/ldb_modules/subtree_delete.c
index e84bf60b32..56ae7b239a 100644
--- a/source4/dsdb/samdb/ldb_modules/subtree_delete.c
+++ b/source4/dsdb/samdb/ldb_modules/subtree_delete.c
@@ -247,13 +247,8 @@ static int subtree_delete_wait(struct ldb_handle *handle, enum ldb_wait_type typ
 	}
 }
 
-static const struct ldb_module_ops subtree_delete_ops = {
+const struct ldb_module_ops ldb_subtree_delete_module_ops = {
 	.name		   = "subtree_delete",
 	.del               = subtree_delete,
 	.wait              = subtree_delete_wait,
 };
-
-int ldb_subtree_delete_init(void)
-{
-	return ldb_register_module(&subtree_delete_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/subtree_rename.c b/source4/dsdb/samdb/ldb_modules/subtree_rename.c
index 0964c3fdcd..bf8124e253 100644
--- a/source4/dsdb/samdb/ldb_modules/subtree_rename.c
+++ b/source4/dsdb/samdb/ldb_modules/subtree_rename.c
@@ -264,13 +264,8 @@ static int subtree_rename_wait(struct ldb_handle *handle, enum ldb_wait_type typ
 	}
 }
 
-static const struct ldb_module_ops subtree_rename_ops = {
+const struct ldb_module_ops ldb_subtree_rename_module_ops = {
 	.name		   = "subtree_rename",
 	.rename            = subtree_rename,
 	.wait              = subtree_rename_wait,
 };
-
-int ldb_subtree_rename_init(void)
-{
-	return ldb_register_module(&subtree_rename_ops);
-}
diff --git a/source4/dsdb/samdb/ldb_modules/update_keytab.c b/source4/dsdb/samdb/ldb_modules/update_keytab.c
index a18efd757a..54362dcfd4 100644
--- a/source4/dsdb/samdb/ldb_modules/update_keytab.c
+++ b/source4/dsdb/samdb/ldb_modules/update_keytab.c
@@ -199,7 +199,7 @@ static int update_kt_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops update_kt_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_update_keytab_module_ops = {
 	.name		   = "update_keytab",
 	.init_context	   = update_kt_init,
 	.add               = update_kt_add,
@@ -209,8 +209,3 @@ static const struct ldb_module_ops update_kt_ops = {
 	.end_transaction   = update_kt_end_trans,
 	.del_transaction   = update_kt_del_trans,
 };
-
-int ldb_update_kt_init(void)
-{
-	return ldb_register_module(&update_kt_ops);
-}
diff --git a/source4/dsdb/schema/schema.h b/source4/dsdb/schema/schema.h
index 1379ddee9f..bb34235465 100644
--- a/source4/dsdb/schema/schema.h
+++ b/source4/dsdb/schema/schema.h
@@ -149,6 +149,8 @@ struct dsdb_schema {
 
 	struct dsdb_attribute *attributes;
 	struct dsdb_class *classes;
+
+	struct smb_iconv_convenience *iconv_convenience;
 };
 
 #include "dsdb/schema/proto.h"
diff --git a/source4/dsdb/schema/schema_init.c b/source4/dsdb/schema/schema_init.c
index 6a7463951e..30d0adeda7 100644
--- a/source4/dsdb/schema/schema_init.c
+++ b/source4/dsdb/schema/schema_init.c
@@ -88,8 +88,7 @@ WERROR dsdb_load_oid_mappings_ldb(struct dsdb_schema *schema,
 	TALLOC_CTX *mem_ctx = talloc_new(schema);
 	W_ERROR_HAVE_NO_MEMORY(mem_ctx);
 	
-	ndr_err = ndr_pull_struct_blob(prefixMap, mem_ctx, lp_iconv_convenience(global_loadparm), &pfm,
-				       (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob);
+	ndr_err = ndr_pull_struct_blob(prefixMap, mem_ctx, schema->iconv_convenience, &pfm, (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 		talloc_free(mem_ctx);
@@ -181,8 +180,7 @@ WERROR dsdb_get_oid_mappings_ldb(const struct dsdb_schema *schema,
 	pfm.reserved	= 0;
 	pfm.ctr.dsdb	= *ctr;
 
-	ndr_err = ndr_push_struct_blob(prefixMap, mem_ctx, lp_iconv_convenience(global_loadparm), &pfm,
-				       (ndr_push_flags_fn_t)ndr_push_prefixMapBlob);
+	ndr_err = ndr_push_struct_blob(prefixMap, mem_ctx, schema->iconv_convenience, &pfm, (ndr_push_flags_fn_t)ndr_push_prefixMapBlob);
 	talloc_free(ctr);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
@@ -628,7 +626,7 @@ static struct drsuapi_DsReplicaAttribute *dsdb_find_object_attr_name(struct dsdb
 	} \
 	if (_a && _a->value_ctr.num_values >= 1) { \
 		ssize_t _ret; \
-		_ret = convert_string_talloc(mem_ctx, lp_iconv_convenience(global_loadparm), CH_UTF16, CH_UNIX, \
+		_ret = convert_string_talloc(mem_ctx, s->iconv_convenience, CH_UTF16, CH_UNIX, \
 					     _a->value_ctr.values[0].blob->data, \
 					     _a->value_ctr.values[0].blob->length, \
 					     (void **)discard_const(&(p)->elem)); \
@@ -665,7 +663,7 @@ static struct drsuapi_DsReplicaAttribute *dsdb_find_object_attr_name(struct dsdb
 		struct drsuapi_DsReplicaObjectIdentifier3 _id3; \
 		enum ndr_err_code _ndr_err; \
 		_ndr_err = ndr_pull_struct_blob_all(_a->value_ctr.values[0].blob, \
-						      mem_ctx, lp_iconv_convenience(global_loadparm), &_id3,\
+						      mem_ctx, s->iconv_convenience, &_id3,\
 						      (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);\
 		if (!NDR_ERR_CODE_IS_SUCCESS(_ndr_err)) { \
 			NTSTATUS _nt_status = ndr_map_error2ntstatus(_ndr_err); \
@@ -727,7 +725,7 @@ static struct drsuapi_DsReplicaAttribute *dsdb_find_object_attr_name(struct dsdb
 	    && _a->value_ctr.values[0].blob->length == 16) { \
 		enum ndr_err_code _ndr_err; \
 		_ndr_err = ndr_pull_struct_blob_all(_a->value_ctr.values[0].blob, \
-						      mem_ctx, lp_iconv_convenience(global_loadparm), &(p)->elem, \
+						      mem_ctx, s->iconv_convenience, &(p)->elem, \
 						      (ndr_pull_flags_fn_t)ndr_pull_GUID); \
 		if (!NDR_ERR_CODE_IS_SUCCESS(_ndr_err)) { \
 			NTSTATUS _nt_status = ndr_map_error2ntstatus(_ndr_err); \
@@ -1157,6 +1155,8 @@ WERROR dsdb_attach_schema_from_ldif_file(struct ldb_context *ldb, const char *pf
 		goto nomem;
 	}
 
+	schema->iconv_convenience = lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm"));
+
 	/*
 	 * load the prefixMap attribute from pf
 	 */
diff --git a/source4/dsdb/schema/schema_syntax.c b/source4/dsdb/schema/schema_syntax.c
index 2c133b6424..beacfc49c2 100644
--- a/source4/dsdb/schema/schema_syntax.c
+++ b/source4/dsdb/schema/schema_syntax.c
@@ -767,7 +767,8 @@ static WERROR dsdb_syntax_UNICODE_drsuapi_to_ldb(const struct dsdb_schema *schem
 			return WERR_FOOBAR;
 		}
 
-		ret = convert_string_talloc(out->values, lp_iconv_convenience(global_loadparm), CH_UTF16, CH_UNIX,
+		ret = convert_string_talloc(out->values, schema->iconv_convenience, 
+									CH_UTF16, CH_UNIX,
 					    in->value_ctr.values[i].blob->data,
 					    in->value_ctr.values[i].blob->length,
 					    (void **)&str);
@@ -809,7 +810,7 @@ static WERROR dsdb_syntax_UNICODE_ldb_to_drsuapi(const struct dsdb_schema *schem
 
 		out->value_ctr.values[i].blob	= &blobs[i];
 
-		ret = convert_string_talloc(blobs, lp_iconv_convenience(global_loadparm), CH_UNIX, CH_UTF16,
+		ret = convert_string_talloc(blobs, schema->iconv_convenience, CH_UNIX, CH_UTF16,
 					    in->values[i].data,
 					    in->values[i].length,
 					    (void **)&blobs[i].data);
@@ -851,7 +852,7 @@ static WERROR dsdb_syntax_DN_drsuapi_to_ldb(const struct dsdb_schema *schema,
 		}
 
 		ndr_err = ndr_pull_struct_blob_all(in->value_ctr.values[i].blob,
-						   out->values, lp_iconv_convenience(global_loadparm), &id3,
+						   out->values, schema->iconv_convenience, &id3,
 						   (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
@@ -898,7 +899,7 @@ static WERROR dsdb_syntax_DN_ldb_to_drsuapi(const struct dsdb_schema *schema,
 		ZERO_STRUCT(id3);
 		id3.dn = (const char *)in->values[i].data;
 
-		ndr_err = ndr_push_struct_blob(&blobs[i], blobs, lp_iconv_convenience(global_loadparm), &id3, (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		ndr_err = ndr_push_struct_blob(&blobs[i], blobs, schema->iconv_convenience, &id3, (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 			return ntstatus_to_werror(status);
@@ -939,7 +940,7 @@ static WERROR dsdb_syntax_DN_BINARY_drsuapi_to_ldb(const struct dsdb_schema *sch
 		}
 
 		ndr_err = ndr_pull_struct_blob_all(in->value_ctr.values[i].blob,
-						   out->values, lp_iconv_convenience(global_loadparm), &id3b,
+						   out->values, schema->iconv_convenience, &id3b,
 						   (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3Binary);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
@@ -997,7 +998,7 @@ static WERROR dsdb_syntax_DN_BINARY_ldb_to_drsuapi(const struct dsdb_schema *sch
 		id3b.dn		= (const char *)in->values[i].data;
 		id3b.binary	= data_blob(NULL, 0);
 
-		ndr_err = ndr_push_struct_blob(&blobs[i], blobs, lp_iconv_convenience(global_loadparm), &id3b,
+		ndr_err = ndr_push_struct_blob(&blobs[i], blobs, schema->iconv_convenience, &id3b,
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3Binary);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
@@ -1043,7 +1044,7 @@ static WERROR dsdb_syntax_PRESENTATION_ADDRESS_drsuapi_to_ldb(const struct dsdb_
 			return WERR_FOOBAR;
 		}
 
-		ret = convert_string_talloc(out->values, lp_iconv_convenience(global_loadparm), CH_UTF16, CH_UNIX,
+		ret = convert_string_talloc(out->values, schema->iconv_convenience, CH_UTF16, CH_UNIX,
 					    in->value_ctr.values[i].blob->data+4,
 					    in->value_ctr.values[i].blob->length-4,
 					    (void **)&str);
@@ -1086,7 +1087,7 @@ static WERROR dsdb_syntax_PRESENTATION_ADDRESS_ldb_to_drsuapi(const struct dsdb_
 
 		out->value_ctr.values[i].blob	= &blobs[i];
 
-		ret = convert_string_talloc(blobs, lp_iconv_convenience(global_loadparm), CH_UNIX, CH_UTF16,
+		ret = convert_string_talloc(blobs, schema->iconv_convenience, CH_UNIX, CH_UTF16,
 					    in->values[i].data,
 					    in->values[i].length,
 					    (void **)&data);
diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c
index 51726a03c3..ff226e5b46 100644
--- a/source4/kdc/hdb-ldb.c
+++ b/source4/kdc/hdb-ldb.c
@@ -180,6 +180,7 @@ static void hdb_ldb_free_entry(krb5_context context, hdb_entry_ex *entry_ex)
 }
 
 static krb5_error_code LDB_message2entry_keys(krb5_context context,
+					      struct smb_iconv_convenience *iconv_convenience,
 					      TALLOC_CTX *mem_ctx,
 					      struct ldb_message *msg,
 					      unsigned int userAccountControl,
@@ -213,7 +214,7 @@ static krb5_error_code LDB_message2entry_keys(krb5_context context,
 
 	/* supplementalCredentials if present */
 	if (sc_val) {
-		ndr_err = ndr_pull_struct_blob_all(sc_val, mem_ctx, lp_iconv_convenience(global_loadparm), &scb,
+		ndr_err = ndr_pull_struct_blob_all(sc_val, mem_ctx, iconv_convenience, &scb,
 						   (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			dump_data(0, sc_val->data, sc_val->length);
@@ -250,7 +251,7 @@ static krb5_error_code LDB_message2entry_keys(krb5_context context,
 		talloc_steal(mem_ctx, blob.data);
 
 		/* TODO: use ndr_pull_struct_blob_all(), when the ndr layer handles it correct with relative pointers */
-		ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, lp_iconv_convenience(global_loadparm), &_pkb,
+		ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, iconv_convenience, &_pkb,
 					       (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			krb5_set_error_string(context, "LDB_message2entry_keys: could not parse package_PrimaryKerberosBlob");
@@ -393,6 +394,7 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db,
 	krb5_boolean is_computer = FALSE;
 	const char *dnsdomain = ldb_msg_find_attr_as_string(realm_ref_msg, "dnsRoot", NULL);
 	char *realm = strupper_talloc(mem_ctx, dnsdomain);
+	struct loadparm_context *lp_ctx = ldb_get_opaque((struct ldb_context *)db->hdb_db, "loadparm");
 	struct ldb_dn *domain_dn = samdb_result_dn((struct ldb_context *)db->hdb_db,
 							mem_ctx,
 							realm_ref_msg,
@@ -428,6 +430,8 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db,
 	}
 
 	private->entry_ex = entry_ex;
+	private->iconv_convenience = lp_iconv_convenience(lp_ctx);
+	private->netbios_name = lp_netbios_name(lp_ctx);
 
 	talloc_set_destructor(private, hdb_ldb_destrutor);
 
@@ -481,7 +485,7 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db,
 		entry_ex->entry.flags.ok_as_delegate = 1;
 	}
 
-	if (lp_parm_bool(global_loadparm, NULL, "kdc", "require spn for service", true)) {
+	if (lp_parm_bool(lp_ctx, NULL, "kdc", "require spn for service", true)) {
 		if (!is_computer && !ldb_msg_find_attr_as_string(msg, "servicePrincipalName", NULL)) {
 			entry_ex->entry.flags.server = 0;
 		}
@@ -544,7 +548,7 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db,
 	entry_ex->entry.generation = NULL;
 
 	/* Get keys from the db */
-	ret = LDB_message2entry_keys(context, private, msg, userAccountControl, entry_ex);
+	ret = LDB_message2entry_keys(context, private->iconv_convenience, private, msg, userAccountControl, entry_ex);
 	if (ret) {
 		/* Could be bougus data in the entry, or out of memory */
 		goto out;
diff --git a/source4/kdc/kdc.h b/source4/kdc/kdc.h
index 9d031b8f7d..3a1f9bd34e 100644
--- a/source4/kdc/kdc.h
+++ b/source4/kdc/kdc.h
@@ -51,7 +51,9 @@ struct kdc_server {
 
 struct hdb_ldb_private {
 	struct ldb_context *samdb;
+	struct smb_iconv_convenience *iconv_convenience;
 	struct ldb_message *msg;
 	struct ldb_message *realm_ref_msg;
 	hdb_entry_ex *entry_ex;
+	const char *netbios_name;
 };
diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index 5f3a718abd..a99cf6ded8 100644
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -47,6 +47,7 @@ void	samba_kdc_plugin_fini(void *ptr)
 
 static krb5_error_code make_pac(krb5_context context,
 				TALLOC_CTX *mem_ctx, 
+				struct smb_iconv_convenience *iconv_convenience,
 				struct auth_serversupplied_info *server_info,
 				krb5_pac *pac) 
 {
@@ -73,7 +74,7 @@ static krb5_error_code make_pac(krb5_context context,
 
 	logon_info.info->info3 = *info3;
 
-	ndr_err = ndr_push_struct_blob(&pac_out, mem_ctx, lp_iconv_convenience(global_loadparm), &logon_info,
+	ndr_err = ndr_push_struct_blob(&pac_out, mem_ctx, iconv_convenience, &logon_info,
 				       (ndr_push_flags_fn_t)ndr_push_PAC_LOGON_INFO_CTR);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		nt_status = ndr_map_error2ntstatus(ndr_err);
@@ -126,7 +127,7 @@ krb5_error_code samba_kdc_get_pac(void *priv,
 	}
 
 	nt_status = authsam_make_server_info(mem_ctx, private->samdb, 
-					     lp_netbios_name(global_loadparm),
+					     private->netbios_name,
 					     private->msg, 
 					     private->realm_ref_msg,
 					     data_blob(NULL, 0),
@@ -138,7 +139,7 @@ krb5_error_code samba_kdc_get_pac(void *priv,
 		return ENOMEM;
 	}
 
-	ret = make_pac(context, mem_ctx, server_info, pac);
+	ret = make_pac(context, mem_ctx, private->iconv_convenience, server_info, pac);
 
 	talloc_free(mem_ctx);
 	return ret;
@@ -190,7 +191,7 @@ krb5_error_code samba_kdc_reget_pac(void *priv, krb5_context context,
 		return ENOMEM;
 	}
 		
-	ndr_err = ndr_pull_struct_blob(&pac_in, mem_ctx, lp_iconv_convenience(global_loadparm), &logon_info,
+	ndr_err = ndr_pull_struct_blob(&pac_in, mem_ctx, private->iconv_convenience, &logon_info,
 				       (ndr_pull_flags_fn_t)ndr_pull_PAC_LOGON_INFO_CTR);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err) || !logon_info.info) {
 		nt_status = ndr_map_error2ntstatus(ndr_err);
@@ -213,7 +214,7 @@ krb5_error_code samba_kdc_reget_pac(void *priv, krb5_context context,
 	/* We will compleatly regenerate this pac */
 	krb5_pac_free(context, *pac);
 
-	ret = make_pac(context, mem_ctx, server_info_out, pac);
+	ret = make_pac(context, mem_ctx, private->iconv_convenience, server_info_out, pac);
 
 	talloc_free(mem_ctx);
 	return ret;
diff --git a/source4/lib/charset/charcnv.c b/source4/lib/charset/charcnv.c
index 54a0676599..0465be689e 100644
--- a/source4/lib/charset/charcnv.c
+++ b/source4/lib/charset/charcnv.c
@@ -677,7 +677,7 @@ _PUBLIC_ codepoint_t next_codepoint(struct smb_iconv_convenience *ic,
 	   with codepoints above 64k */
 	olen = 2;
 	outbuf = (char *)buf;
-	smb_iconv(descriptor,  &str, &ilen, &outbuf, &olen);
+	smb_iconv(descriptor, &str, &ilen, &outbuf, &olen);
 	if (olen == 2) {
 		olen = 4;
 		outbuf = (char *)buf;
diff --git a/source4/lib/events/events_select.c b/source4/lib/events/events_select.c
index 3f9eeb5617..f4b7e4e5eb 100644
--- a/source4/lib/events/events_select.c
+++ b/source4/lib/events/events_select.c
@@ -300,7 +300,7 @@ bool events_select_init(void)
 }
 
 #if _SAMBA_BUILD_
-NTSTATUS s4_events_select_init(void)
+_PUBLIC_ NTSTATUS s4_events_select_init(void)
 {
 	if (!events_select_init()) {
 		return NT_STATUS_INTERNAL_ERROR;
diff --git a/source4/lib/events/events_standard.c b/source4/lib/events/events_standard.c
index 5e529d66ab..7b945b154d 100644
--- a/source4/lib/events/events_standard.c
+++ b/source4/lib/events/events_standard.c
@@ -602,7 +602,7 @@ bool events_standard_init(void)
 }
 
 #if _SAMBA_BUILD_
-NTSTATUS s4_events_standard_init(void)
+_PUBLIC_ NTSTATUS s4_events_standard_init(void)
 {
 	if (!events_standard_init()) {
 		return NT_STATUS_INTERNAL_ERROR;
diff --git a/source4/lib/ldb/Makefile.in b/source4/lib/ldb/Makefile.in
index 756beb1fed..d88f82b726 100644
--- a/source4/lib/ldb/Makefile.in
+++ b/source4/lib/ldb/Makefile.in
@@ -125,7 +125,7 @@ realdistclean:: distclean
 
 check:: test @PYTHON_CHECK_TARGET@
 
-check-soloading: sample_module.$(SHLIBEXT)
+check-soloading: sample.$(SHLIBEXT)
 	LDB_MODULES_PATH=$(builddir) $(srcdir)/tests/test-soloading.sh
 
 test:: all check-soloading
diff --git a/source4/lib/ldb/common/ldb.c b/source4/lib/ldb/common/ldb.c
index 87f791cb38..3c9ef3ff69 100644
--- a/source4/lib/ldb/common/ldb.c
+++ b/source4/lib/ldb/common/ldb.c
@@ -56,20 +56,51 @@ struct ldb_context *ldb_init(void *mem_ctx)
 	return ldb;
 }
 
-struct ldb_backend {
-	const char *name;
-	ldb_connect_fn connect_fn;
-	struct ldb_backend *prev, *next;
+static struct backends_list_entry {
+	struct ldb_backend_ops *ops;
+	struct backends_list_entry *prev, *next;
 } *ldb_backends = NULL;
 
+#ifndef STATIC_LIBLDB_BACKENDS 
+
+#ifdef HAVE_LDB_LDAP
+#define LDAP_INIT &ldb_ldap_backend_ops, \
+				  &ldb_ildap_backend_ops, \
+				  &ldb_ldaps_backend_ops,
+#else
+#define LDAP_INIT
+#endif
+
+#ifdef HAVE_LDB_SQLITE3
+#define SQLITE3_INIT &ldb_sqlite3_backend_ops,
+#else
+#define SQLITE3_INIT
+#endif
+
+#define STATIC_LIBLDB_BACKENDS \
+	LDAP_INIT \
+	SQLITE3_INIT \
+	&ldb_tdb_backend_ops, 	\
+	NULL
+#endif
+
+const static struct ldb_backend_ops *builtin_backends[] = {
+	STATIC_LIBLDB_BACKENDS
+};
 
 static ldb_connect_fn ldb_find_backend(const char *url)
 {
-	struct ldb_backend *backend;
+	struct backends_list_entry *backend;
+	int i;
+
+	for (i = 0; builtin_backends[i]; i++) {
+		if (strncmp(builtin_backends[i]->name, url, strlen(builtin_backends[i]->name)) == 0)
+			return builtin_backends[i]->connect_fn;
+	}
 
 	for (backend = ldb_backends; backend; backend = backend->next) {
-		if (strncmp(backend->name, url, strlen(backend->name)) == 0) {
-			return backend->connect_fn;
+		if (strncmp(backend->ops->name, url, strlen(backend->ops->name)) == 0) {
+			return backend->ops->connect_fn;
 		}
 	}
 
@@ -81,7 +112,8 @@ static ldb_connect_fn ldb_find_backend(const char *url)
 */
 int ldb_register_backend(const char *url_prefix, ldb_connect_fn connectfn)
 {
-	struct ldb_backend *backend = talloc(talloc_autofree_context(), struct ldb_backend);
+	struct ldb_backend_ops *backend = talloc(talloc_autofree_context(), struct ldb_backend_ops);
+	struct backends_list_entry *entry = talloc(talloc_autofree_context(), struct backends_list_entry);
 
 	if (ldb_find_backend(url_prefix)) {
 		return LDB_SUCCESS;
@@ -91,7 +123,8 @@ int ldb_register_backend(const char *url_prefix, ldb_connect_fn connectfn)
 
 	backend->name = talloc_strdup(backend, url_prefix);
 	backend->connect_fn = connectfn;
-	DLIST_ADD(ldb_backends, backend);
+	entry->ops = backend;
+	DLIST_ADD(ldb_backends, entry);
 
 	return LDB_SUCCESS;
 }
@@ -135,6 +168,19 @@ int ldb_connect_backend(struct ldb_context *ldb, const char *url, const char *op
 		}
 	}
 
+	if (fn == NULL) {
+		struct ldb_backend_ops *ops;
+		char *symbol_name = talloc_asprintf(ldb, "ldb_%s_backend_ops", backend);
+		if (symbol_name == NULL) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+		ops = ldb_dso_load_symbol(ldb, backend, symbol_name);
+		if (ops != NULL) {
+			fn = ops->connect_fn;
+		}
+		talloc_free(symbol_name);
+	}
+
 	talloc_free(backend);
 
 	if (fn == NULL) {
@@ -236,7 +282,6 @@ int ldb_connect(struct ldb_context *ldb, const char *url, unsigned int flags, co
 	int ret;
 	const char *url2;
 	/* We seem to need to do this here, or else some utilities don't get ldb backends */
-	ldb_global_init();
 
 	ldb->flags = flags;
 
@@ -463,11 +508,17 @@ static int ldb_autotransaction_request(struct ldb_context *ldb, struct ldb_reque
 
 int ldb_wait(struct ldb_handle *handle, enum ldb_wait_type type)
 {
+	int ret;
 	if (!handle) {
 		return LDB_SUCCESS;
 	}
 
-	return handle->module->ops->wait(handle, type);
+	ret = handle->module->ops->wait(handle, type);
+	if (!ldb_errstring(handle->module->ldb)) {
+		/* Set a default error string, to place the blame somewhere */
+		ldb_asprintf_errstring(handle->module->ldb, "error waiting on module %s: %s (%d)", handle->module->ops->name, ldb_strerror(ret), ret);
+	}
+	return ret;
 }
 
 /* set the specified timeout or, if timeout is 0 set the default timeout */
diff --git a/source4/lib/ldb/common/ldb_modules.c b/source4/lib/ldb/common/ldb_modules.c
index a3bf71d0d8..a4e0b94188 100644
--- a/source4/lib/ldb/common/ldb_modules.c
+++ b/source4/lib/ldb/common/ldb_modules.c
@@ -125,9 +125,30 @@ static struct ops_list_entry {
 	struct ops_list_entry *next;	
 } *registered_modules = NULL;
 
+#ifndef STATIC_LIBLDB_MODULES
+
+#define STATIC_LIBLDB_MODULES \
+	ldb_operational_module_ops,	\
+	ldb_rdn_name_module_ops,	\
+	ldb_paged_results_module_ops,	\
+	ldb_sort_module_ops,		\
+	ldb_asq_module_ops, \
+	NULL
+#endif
+
+const static struct ldb_module_ops *builtin_modules[] = {
+	STATIC_LIBLDB_MODULES
+};
+
 static const struct ldb_module_ops *ldb_find_module_ops(const char *name)
 {
 	struct ops_list_entry *e;
+	int i;
+
+	for (i = 0; builtin_modules[i]; i++) {
+		if (strcmp(builtin_modules[i]->name, name) == 0)
+			return builtin_modules[i];
+	}
  
 	for (e = registered_modules; e; e = e->next) {
  		if (strcmp(e->ops->name, name) == 0) 
@@ -137,51 +158,6 @@ static const struct ldb_module_ops *ldb_find_module_ops(const char *name)
 	return NULL;
 }
 
-#ifndef STATIC_LIBLDB_MODULES
-
-#ifdef HAVE_LDB_LDAP
-#define LDAP_INIT ldb_ldap_init,
-#else
-#define LDAP_INIT
-#endif
-
-#ifdef HAVE_LDB_SQLITE3
-#define SQLITE3_INIT ldb_sqlite3_init,
-#else
-#define SQLITE3_INIT
-#endif
-
-#define STATIC_LIBLDB_MODULES \
-	LDAP_INIT \
-	SQLITE3_INIT \
-	ldb_tdb_init, 	\
-	ldb_operational_init,	\
-	ldb_rdn_name_init,	\
-	ldb_paged_results_init,	\
-	ldb_sort_init,		\
-	ldb_asq_init, \
-	NULL
-#endif
-
-int ldb_global_init(void)
-{
-	int (*static_init_fns[])(void) = { STATIC_LIBLDB_MODULES };
-
-	static int initialized = 0;
-	int ret = 0, i;
-
-	if (initialized) 
-		return 0;
-
-	initialized = 1;
-	
-	for (i = 0; static_init_fns[i]; i++) {
-		if (static_init_fns[i]() == -1)
-			ret = -1;
-	}
-
-	return ret;
-}
 
 int ldb_register_module(const struct ldb_module_ops *ops)
 {
@@ -256,8 +232,13 @@ int ldb_load_modules_list(struct ldb_context *ldb, const char **module_list, str
 		}
 
 		if (ops == NULL) {
-			ops = ldb_dso_load_symbol(ldb, module_list[i], 
-						      "ldb_module_ops");
+			char *symbol_name = talloc_asprintf(ldb, "ldb_%s_module_ops", 
+												module_list[i]);
+			if (symbol_name == NULL) {
+				return LDB_ERR_OPERATIONS_ERROR;
+			}
+			ops = ldb_dso_load_symbol(ldb, module_list[i], symbol_name);
+			talloc_free(symbol_name);
 		}
 		
 		if (ops == NULL) {
diff --git a/source4/lib/ldb/config.mk b/source4/lib/ldb/config.mk
index 0e7caa381f..d6980f341a 100644
--- a/source4/lib/ldb/config.mk
+++ b/source4/lib/ldb/config.mk
@@ -3,7 +3,7 @@
 [MODULE::ldb_asq]
 PRIVATE_DEPENDENCIES = LIBTALLOC
 CFLAGS = -Ilib/ldb/include
-INIT_FUNCTION = ldb_asq_init
+INIT_FUNCTION = &ldb_asq_module_ops
 SUBSYSTEM = LIBLDB
 OBJ_FILES = \
 		modules/asq.o
@@ -15,7 +15,7 @@ OBJ_FILES = \
 [MODULE::ldb_server_sort]
 PRIVATE_DEPENDENCIES = LIBTALLOC
 CFLAGS = -Ilib/ldb/include
-INIT_FUNCTION = ldb_sort_init
+INIT_FUNCTION = &ldb_server_sort_module_ops
 SUBSYSTEM = LIBLDB
 OBJ_FILES = \
 		modules/sort.o
@@ -25,7 +25,7 @@ OBJ_FILES = \
 ################################################
 # Start MODULE ldb_paged_results
 [MODULE::ldb_paged_results]
-INIT_FUNCTION = ldb_paged_results_init
+INIT_FUNCTION = &ldb_paged_results_module_ops
 CFLAGS = -Ilib/ldb/include
 PRIVATE_DEPENDENCIES = LIBTALLOC
 SUBSYSTEM = LIBLDB
@@ -37,7 +37,7 @@ OBJ_FILES = \
 ################################################
 # Start MODULE ldb_paged_results
 [MODULE::ldb_paged_searches]
-INIT_FUNCTION = ldb_paged_searches_init
+INIT_FUNCTION = &ldb_paged_searches_module_ops
 CFLAGS = -Ilib/ldb/include
 PRIVATE_DEPENDENCIES = LIBTALLOC
 SUBSYSTEM = LIBLDB
@@ -52,7 +52,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 CFLAGS = -Ilib/ldb/include
 PRIVATE_DEPENDENCIES = LIBTALLOC
-INIT_FUNCTION = ldb_operational_init
+INIT_FUNCTION = &ldb_operational_module_ops
 OBJ_FILES = \
 		modules/operational.o
 # End MODULE ldb_operational
@@ -64,7 +64,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 CFLAGS = -Ilib/ldb/include
 PRIVATE_DEPENDENCIES = LIBTALLOC
-INIT_FUNCTION = ldb_rdn_name_init
+INIT_FUNCTION = &ldb_rdn_name_module_ops
 OBJ_FILES = \
 		modules/rdn_name.o
 # End MODULE ldb_rdn_name
@@ -88,7 +88,7 @@ OBJ_FILES = \
 SUBSYSTEM = LIBLDB
 CFLAGS = -Ilib/ldb/include
 PRIVATE_DEPENDENCIES = LIBTALLOC
-INIT_FUNCTION = ldb_skel_init
+INIT_FUNCTION = &ldb_skel_module_ops
 OBJ_FILES = modules/skel.o
 # End MODULE ldb_skel
 ################################################
@@ -99,7 +99,6 @@ OBJ_FILES = modules/skel.o
 SUBSYSTEM = LIBLDB
 CFLAGS = -Ilib/ldb/include
 PRIVATE_DEPENDENCIES = LIBTALLOC SQLITE3 LIBTALLOC
-INIT_FUNCTION = ldb_sqlite3_init
 OBJ_FILES = \
 		ldb_sqlite3/ldb_sqlite3.o
 # End MODULE ldb_sqlite3
@@ -110,7 +109,6 @@ OBJ_FILES = \
 [MODULE::ldb_tdb]
 SUBSYSTEM = LIBLDB
 CFLAGS = -Ilib/ldb/include -Ilib/ldb/ldb_tdb
-INIT_FUNCTION = ldb_tdb_init
 OBJ_FILES = \
 		ldb_tdb/ldb_tdb.o \
 		ldb_tdb/ldb_search.o \
@@ -128,10 +126,9 @@ PRIVATE_DEPENDENCIES = \
 [LIBRARY::LIBLDB]
 VERSION = 0.0.1
 SO_VERSION = 0
-OUTPUT_TYPE = SHARED_LIBRARY
 CFLAGS = -Ilib/ldb/include
 PC_FILE = ldb.pc
-INIT_FUNCTION_TYPE = int (*) (void)
+INIT_FUNCTION_TYPE = extern const struct ldb_module_ops
 OBJ_FILES = \
 		common/ldb.o \
 		common/ldb_ldif.o \
diff --git a/source4/lib/ldb/include/ldb_private.h b/source4/lib/ldb/include/ldb_private.h
index 61d5f5148a..d2dcc675a5 100644
--- a/source4/lib/ldb/include/ldb_private.h
+++ b/source4/lib/ldb/include/ldb_private.h
@@ -41,6 +41,8 @@ struct ldb_context;
 
 struct ldb_module_ops;
 
+struct ldb_backend_ops;
+
 /* basic module structure */
 struct ldb_module {
 	struct ldb_module *prev, *next;
@@ -70,9 +72,16 @@ struct ldb_module_ops {
 	int (*sequence_number)(struct ldb_module *, struct ldb_request *);
 };
 
+
 typedef int (*ldb_connect_fn) (struct ldb_context *ldb, const char *url, unsigned int flags, const char *options[],
 			       struct ldb_module **module);
 
+
+struct ldb_backend_ops {
+	const char *name;
+	ldb_connect_fn connect_fn;
+};
+
 const char *ldb_default_modules_dir(void);
 
 /*
@@ -170,19 +179,23 @@ void ldb_debug_set(struct ldb_context *ldb, enum ldb_debug_level level,
 /* The following definitions come from lib/ldb/common/ldb_ldif.c  */
 int ldb_should_b64_encode(const struct ldb_val *val);
 
-int ldb_objectclass_init(void);
-int ldb_operational_init(void);
-int ldb_paged_results_init(void);
-int ldb_paged_searches_init(void);
-int ldb_rdn_name_init(void);
-int ldb_schema_init(void);
-int ldb_asq_init(void);
-int ldb_sort_init(void);
-int ldb_ldap_init(void);
-int ldb_ildap_init(void);
-int ldb_tdb_init(void);
-int ldb_skel_init(void);
-int ldb_sqlite3_init(void);
+extern const struct ldb_module_ops ldb_objectclass_module_ops;
+extern const struct ldb_module_ops ldb_operational_module_ops;
+extern const struct ldb_module_ops ldb_paged_results_module_ops;
+extern const struct ldb_module_ops ldb_rdn_name_module_ops;
+extern const struct ldb_module_ops ldb_schema_module_ops;
+extern const struct ldb_module_ops ldb_asq_module_ops;
+extern const struct ldb_module_ops ldb_sort_module_ops;
+extern const struct ldb_module_ops ldb_ldap_module_ops;
+extern const struct ldb_module_ops ldb_ildap_module_ops;
+extern const struct ldb_module_ops ldb_tdb_module_ops;
+extern const struct ldb_module_ops ldb_sqlite3_module_ops;
+
+extern const struct ldb_backend_ops ldb_tdb_backend_ops;
+extern const struct ldb_backend_ops ldb_sqlite3_backend_ops;
+extern const struct ldb_backend_ops ldb_ldap_backend_ops;
+extern const struct ldb_backend_ops ldb_ildap_backend_ops;
+extern const struct ldb_backend_ops ldb_ldaps_backend_ops;
 
 int ldb_match_msg(struct ldb_context *ldb,
 		  const struct ldb_message *msg,
diff --git a/source4/lib/ldb/ldb.mk b/source4/lib/ldb/ldb.mk
index 6119f085d8..cc920178bc 100644
--- a/source4/lib/ldb/ldb.mk
+++ b/source4/lib/ldb/ldb.mk
@@ -31,7 +31,7 @@ lib/libldb.a: $(OBJS)
 	ar -rv $@ $(OBJS)
 	@-ranlib $@
 
-sample_module.$(SHLIBEXT): tests/sample_module.o
+sample.$(SHLIBEXT): tests/sample_module.o
 	$(MDLD) $(MDLD_FLAGS) -o $@ tests/sample_module.o
 
 bin/ldbadd: tools/ldbadd.o tools/cmdline.o $(LIBS)
diff --git a/source4/lib/ldb/ldb_ildap/config.mk b/source4/lib/ldb/ldb_ildap/config.mk
index 01d9ec88ff..3062dc886f 100644
--- a/source4/lib/ldb/ldb_ildap/config.mk
+++ b/source4/lib/ldb/ldb_ildap/config.mk
@@ -5,7 +5,6 @@ SUBSYSTEM = LIBLDB
 CFLAGS = -Ilib/ldb/include
 OUTPUT_TYPE = SHARED_LIBRARY
 PRIVATE_DEPENDENCIES = LIBTALLOC LIBCLI_LDAP CREDENTIALS
-INIT_FUNCTION = ldb_ildap_init
 ALIASES = ldapi ldaps ldap
 OBJ_FILES = \
 		ldb_ildap.o
diff --git a/source4/lib/ldb/ldb_ildap/ldb_ildap.c b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
index a834e912d4..995b584f51 100644
--- a/source4/lib/ldb/ldb_ildap/ldb_ildap.c
+++ b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
@@ -811,9 +811,18 @@ failed:
 	return -1;
 }
 
-int ldb_ildap_init(void)
-{
-	return ldb_register_backend("ldap", ildb_connect) + 
-		   ldb_register_backend("ldapi", ildb_connect) + 
-		   ldb_register_backend("ldaps", ildb_connect);
-}
+_PUBLIC_ const struct ldb_backend_ops ldb_ldap_backend_ops = {
+	.name = "ldap",
+	.connect_fn = ildb_connect
+};
+
+_PUBLIC_ const struct ldb_backend_ops ldb_ildap_backend_ops = {
+	.name = "ildap",
+	.connect_fn = ildb_connect
+};
+
+_PUBLIC_ const struct ldb_backend_ops ldb_ldaps_backend_ops = {
+	.name = "ldaps",
+	.connect_fn = ildb_connect
+};
+
diff --git a/source4/lib/ldb/ldb_ldap/ldb_ldap.c b/source4/lib/ldb/ldb_ldap/ldb_ldap.c
index d897350c2f..3f6ff3fd5b 100644
--- a/source4/lib/ldb/ldb_ldap/ldb_ldap.c
+++ b/source4/lib/ldb/ldb_ldap/ldb_ldap.c
@@ -826,9 +826,17 @@ failed:
 	return -1;
 }
 
-int ldb_ldap_init(void)
-{
-	return ldb_register_backend("ldap", lldb_connect) +
-		   ldb_register_backend("ldapi", lldb_connect) + 
-		   ldb_register_backend("ldaps", lldb_connect);
-}
+_PUBLIC_ struct ldb_backend_ops ldb_ldap_backend_ops = {
+	.name = "ldap",
+	.connect_fn = lldb_connect
+};
+
+_PUBLIC_ struct ldb_backend_ops ldb_ldapi_backend_ops = {
+	.name = "ldapi",
+	.connect_fn = lldb_connect
+};
+
+_PUBLIC_ struct ldb_backend_ops ldb_ldaps_backend_ops = {
+	.name = "ldaps",
+	.connect_fn = lldb_connect
+};
diff --git a/source4/lib/ldb/ldb_map/ldb_map.c b/source4/lib/ldb/ldb_map/ldb_map.c
index 9582f36130..9c189feb11 100644
--- a/source4/lib/ldb/ldb_map/ldb_map.c
+++ b/source4/lib/ldb/ldb_map/ldb_map.c
@@ -1186,7 +1186,7 @@ static int map_wait_all(struct ldb_handle *handle)
 }
 
 /* Wait for pending requests to finish. */
-static int map_wait(struct ldb_handle *handle, enum ldb_wait_type type)
+int map_wait(struct ldb_handle *handle, enum ldb_wait_type type)
 {
 	if (type == LDB_WAIT_ALL) {
 		return map_wait_all(handle);
@@ -1199,16 +1199,6 @@ static int map_wait(struct ldb_handle *handle, enum ldb_wait_type type)
 /* Module initialization
  * ===================== */
 
-/* Provided module operations */
-static const struct ldb_module_ops map_ops = {
-	.name		= "ldb_map",
-	.add		= map_add,
-	.modify		= map_modify,
-	.del		= map_delete,
-	.rename		= map_rename,
-	.search		= map_search,
-	.wait		= map_wait,
-};
 
 /* Builtin mappings for DNs and objectClasses */
 static const struct ldb_map_attribute builtin_attribute_maps[] = {
@@ -1344,12 +1334,6 @@ static int map_init_maps(struct ldb_module *module, struct ldb_map_context *data
 	return LDB_SUCCESS;
 }
 
-/* Copy the list of provided module operations. */
-_PUBLIC_ struct ldb_module_ops ldb_map_get_ops(void)
-{
-	return map_ops;
-}
-
 /* Initialize global private data. */
 _PUBLIC_ int ldb_map_init(struct ldb_module *module, const struct ldb_map_attribute *attrs, 
 			  const struct ldb_map_objectclass *ocls,
@@ -1393,23 +1377,3 @@ _PUBLIC_ int ldb_map_init(struct ldb_module *module, const struct ldb_map_attrib
 
 	return LDB_SUCCESS;
 }
-
-/* Usage note for initialization of this module:
- *
- * ldb_map is meant to be used from a different module that sets up
- * the mappings and gets registered in ldb.
- *
- * 'ldb_map_init' initializes the private data of this module and
- * stores the attribute and objectClass maps in there.	It also looks
- * up the '@MAP' special DN so requests can be redirected to the
- * remote partition.
- *
- * This function should be called from the 'init_context' op of the
- * module using ldb_map.
- *
- * 'ldb_map_get_ops' returns a copy of ldb_maps module operations.
- *
- * It should be called from the initialize function of the using
- * module, which should then override the 'init_context' op with a
- * function making the appropriate calls to 'ldb_map_init'.
- */
diff --git a/source4/lib/ldb/ldb_map/ldb_map.h b/source4/lib/ldb/ldb_map/ldb_map.h
index ef4da4e654..e40bb9cd7e 100644
--- a/source4/lib/ldb/ldb_map/ldb_map.h
+++ b/source4/lib/ldb/ldb_map/ldb_map.h
@@ -155,8 +155,19 @@ int ldb_map_init(struct ldb_module *module, const struct ldb_map_attribute *attr
 		 const char *add_objectclass,
 		 const char *name);
 
-/* get copy of map_ops */
-struct ldb_module_ops
-ldb_map_get_ops(void);
+int map_add(struct ldb_module *module, struct ldb_request *req);
+int map_search(struct ldb_module *module, struct ldb_request *req);
+int map_rename(struct ldb_module *module, struct ldb_request *req);
+int map_delete(struct ldb_module *module, struct ldb_request *req);
+int map_modify(struct ldb_module *module, struct ldb_request *req);
+int map_wait(struct ldb_handle *handle, enum ldb_wait_type type);
+
+#define LDB_MAP_OPS \
+	.add		= map_add, \
+	.modify		= map_modify, \
+	.del		= map_delete, \
+	.rename		= map_rename, \
+	.search		= map_search, \
+	.wait		= map_wait,
 
 #endif /* __LDB_MAP_H__ */
diff --git a/source4/lib/ldb/ldb_map/ldb_map_private.h b/source4/lib/ldb/ldb_map/ldb_map_private.h
index 2c35097069..58a9f2704e 100644
--- a/source4/lib/ldb/ldb_map/ldb_map_private.h
+++ b/source4/lib/ldb/ldb_map/ldb_map_private.h
@@ -98,20 +98,13 @@ int map_subtree_collect_remote_simple(struct ldb_module *module, void *mem_ctx,
 /* The following definitions come from lib/ldb/modules/ldb_map_inbound.c */
 int map_add_do_remote(struct ldb_handle *handle);
 int map_add_do_local(struct ldb_handle *handle);
-int map_add(struct ldb_module *module, struct ldb_request *req);
 
 int map_modify_do_remote(struct ldb_handle *handle);
 int map_modify_do_local(struct ldb_handle *handle);
-int map_modify(struct ldb_module *module, struct ldb_request *req);
 
 int map_delete_do_remote(struct ldb_handle *handle);
 int map_delete_do_local(struct ldb_handle *handle);
-int map_delete(struct ldb_module *module, struct ldb_request *req);
 
 int map_rename_do_remote(struct ldb_handle *handle);
 int map_rename_do_fixup(struct ldb_handle *handle);
 int map_rename_do_local(struct ldb_handle *handle);
-int map_rename(struct ldb_module *module, struct ldb_request *req);
-
-/* The following definitions come from lib/ldb/modules/ldb_map_outbound.c */
-int map_search(struct ldb_module *module, struct ldb_request *req);
diff --git a/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c b/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
index 1ec3b1aabd..8742e257f3 100644
--- a/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
+++ b/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
@@ -1903,7 +1903,7 @@ failed:
 	return -1;
 }
 
-int ldb_sqlite3_init(void)
-{
-	return ldb_register_backend("sqlite3", lsqlite3_connect);
-}
+const struct ldb_backend_ops ldb_sqlite3_backend_ops = {
+	.name = "sqlite3",
+	.connect_fn = lsqlite3_connect
+};
diff --git a/source4/lib/ldb/ldb_tdb/ldb_tdb.c b/source4/lib/ldb/ldb_tdb/ldb_tdb.c
index 45a8109584..11d6c30710 100644
--- a/source4/lib/ldb/ldb_tdb/ldb_tdb.c
+++ b/source4/lib/ldb/ldb_tdb/ldb_tdb.c
@@ -1107,7 +1107,7 @@ static int ltdb_connect(struct ldb_context *ldb, const char *url,
 	return 0;
 }
 
-int ldb_tdb_init(void)
-{
-	return ldb_register_backend("tdb", ltdb_connect);
-}
+const struct ldb_backend_ops ldb_tdb_backend_ops = {
+	.name = "tdb",
+	.connect_fn = ltdb_connect
+};
diff --git a/source4/lib/ldb/modules/asq.c b/source4/lib/ldb/modules/asq.c
index b6a8594166..eb27263b16 100644
--- a/source4/lib/ldb/modules/asq.c
+++ b/source4/lib/ldb/modules/asq.c
@@ -473,15 +473,9 @@ static int asq_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-
-static const struct ldb_module_ops asq_ops = {
+const struct ldb_module_ops ldb_asq_module_ops = {
 	.name		   = "asq",
 	.search		   = asq_search,
 	.wait              = asq_wait,
 	.init_context	   = asq_init
 };
-
-int ldb_asq_init(void)
-{
-	return ldb_register_module(&asq_ops);
-}
diff --git a/source4/lib/ldb/modules/operational.c b/source4/lib/ldb/modules/operational.c
index 45f23aa0c1..7dc4ae08c3 100644
--- a/source4/lib/ldb/modules/operational.c
+++ b/source4/lib/ldb/modules/operational.c
@@ -304,13 +304,8 @@ static int operational_init(struct ldb_module *ctx)
 	return ldb_next_init(ctx);
 }
 
-static const struct ldb_module_ops operational_ops = {
+const struct ldb_module_ops ldb_operational_module_ops = {
 	.name              = "operational",
 	.search            = operational_search,
 	.init_context	   = operational_init
 };
-
-int ldb_operational_init(void)
-{
-	return ldb_register_module(&operational_ops);
-}
diff --git a/source4/lib/ldb/modules/paged_results.c b/source4/lib/ldb/modules/paged_results.c
index ee1bbe0335..b62b1f92cb 100644
--- a/source4/lib/ldb/modules/paged_results.c
+++ b/source4/lib/ldb/modules/paged_results.c
@@ -549,15 +549,9 @@ static int paged_request_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops paged_ops = {
+const struct ldb_module_ops ldb_paged_results_module_ops = {
 	.name           = "paged_results",
 	.search         = paged_search,
 	.wait           = paged_wait,
 	.init_context 	= paged_request_init
 };
-
-int ldb_paged_results_init(void)
-{
-	return ldb_register_module(&paged_ops);
-}
-
diff --git a/source4/lib/ldb/modules/paged_searches.c b/source4/lib/ldb/modules/paged_searches.c
index fd580a3c4a..40e87f70d6 100644
--- a/source4/lib/ldb/modules/paged_searches.c
+++ b/source4/lib/ldb/modules/paged_searches.c
@@ -455,15 +455,9 @@ static int ps_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops ps_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_paged_searches_module_ops = {
 	.name           = "paged_searches",
 	.search         = ps_search,
 	.wait           = ps_wait,
 	.init_context 	= ps_init
 };
-
-int ldb_paged_searches_init(void)
-{
-	return ldb_register_module(&ps_ops);
-}
-
diff --git a/source4/lib/ldb/modules/rdn_name.c b/source4/lib/ldb/modules/rdn_name.c
index 1a0ddbb3c4..c4de8e8da8 100644
--- a/source4/lib/ldb/modules/rdn_name.c
+++ b/source4/lib/ldb/modules/rdn_name.c
@@ -326,15 +326,9 @@ static int rdn_name_wait(struct ldb_handle *handle, enum ldb_wait_type type)
 	return rdn_name_wait_once(handle);
 }
 
-static const struct ldb_module_ops rdn_name_ops = {
+const struct ldb_module_ops ldb_rdn_name_module_ops = {
 	.name              = "rdn_name",
 	.add               = rdn_name_add,
 	.rename            = rdn_name_rename,
 	.wait              = rdn_name_wait
 };
-
-
-int ldb_rdn_name_init(void)
-{
-	return ldb_register_module(&rdn_name_ops);
-}
diff --git a/source4/lib/ldb/modules/skel.c b/source4/lib/ldb/modules/skel.c
index 5400c502f1..0cd29ac4b7 100644
--- a/source4/lib/ldb/modules/skel.c
+++ b/source4/lib/ldb/modules/skel.c
@@ -116,7 +116,7 @@ static int skel_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops skel_ops = {
+const struct ldb_module_ops ldb_skel_module_ops = {
 	.name		   = "skel",
 	.init_context	   = skel_init,
 	.search            = skel_search,
@@ -129,8 +129,3 @@ static const struct ldb_module_ops skel_ops = {
 	.end_transaction   = skel_end_trans,
 	.del_transaction   = skel_del_trans,
 };
-
-int ldb_skel_init(void)
-{
-	return ldb_register_module(&skel_ops);
-}
diff --git a/source4/lib/ldb/modules/sort.c b/source4/lib/ldb/modules/sort.c
index 89b9a4fb19..746befa559 100644
--- a/source4/lib/ldb/modules/sort.c
+++ b/source4/lib/ldb/modules/sort.c
@@ -450,14 +450,9 @@ static int server_sort_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static const struct ldb_module_ops server_sort_ops = {
+const struct ldb_module_ops ldb_server_sort_module_ops = {
 	.name		   = "server_sort",
 	.search            = server_sort_search,
 	.wait              = server_sort_wait,
 	.init_context	   = server_sort_init
 };
-
-int ldb_sort_init(void)
-{
-	return ldb_register_module(&server_sort_ops);
-}
diff --git a/source4/lib/ldb/nssldb/ldb-nss.c b/source4/lib/ldb/nssldb/ldb-nss.c
index 199212dbbf..e256f41a4d 100644
--- a/source4/lib/ldb/nssldb/ldb-nss.c
+++ b/source4/lib/ldb/nssldb/ldb-nss.c
@@ -45,11 +45,6 @@ NSS_STATUS _ldb_nss_init(void)
 
 	_ldb_nss_ctx->pid = mypid;
 
-	ret = ldb_global_init();
-	if (ret != 0) {
-		goto failed;
-	}
-
 	_ldb_nss_ctx->ldb = ldb_init(_ldb_nss_ctx);
 	if (_ldb_nss_ctx->ldb == NULL) {
 		goto failed;
diff --git a/source4/lib/ldb/tests/sample_module.c b/source4/lib/ldb/tests/sample_module.c
index 8ab1d33146..98d8e865dd 100644
--- a/source4/lib/ldb/tests/sample_module.c
+++ b/source4/lib/ldb/tests/sample_module.c
@@ -32,12 +32,7 @@ int sample_add(struct ldb_module *mod, struct ldb_request *req)
 	return ldb_next_request(mod, req);
 }
 
-static const struct ldb_module_ops sample_ops = {
-	.name              = "sample_module",
+_PUBLIC_ const struct ldb_module_ops ldb_sample_module_ops = {
+	.name              = "sample",
 	.add		   = sample_add,
 };
-
-int init_module(void)
-{
-	return ldb_register_module(&sample_ops);
-}
diff --git a/source4/lib/ldb/tools/ad2oLschema.c b/source4/lib/ldb/tools/ad2oLschema.c
index dec8a5f972..67b16dd06e 100644
--- a/source4/lib/ldb/tools/ad2oLschema.c
+++ b/source4/lib/ldb/tools/ad2oLschema.c
@@ -656,8 +656,6 @@ static struct schema_conv process_convert(struct ldb_context *ldb, enum convert_
 	const char *target_str;
 	enum convert_target target;
 
-	ldb_global_init();
-
 	ctx = talloc_new(NULL);
 	ldb = ldb_init(ctx);
 
diff --git a/source4/lib/ldb/tools/cmdline.c b/source4/lib/ldb/tools/cmdline.c
index 8ee1994615..c9c77c4e47 100644
--- a/source4/lib/ldb/tools/cmdline.c
+++ b/source4/lib/ldb/tools/cmdline.c
@@ -80,8 +80,6 @@ struct ldb_cmdline *ldb_cmdline_process(struct ldb_context *ldb,
 		{ NULL }
 	};
 
-	ldb_global_init();
-
 #if (_SAMBA_BUILD_ >= 4)
 	r = ldb_register_samba_handlers(ldb);
 	if (r != 0) {
diff --git a/source4/lib/ldb/tools/ldbadd.c b/source4/lib/ldb/tools/ldbadd.c
index d34193b86c..4ee66c4fc0 100644
--- a/source4/lib/ldb/tools/ldbadd.c
+++ b/source4/lib/ldb/tools/ldbadd.c
@@ -88,8 +88,6 @@ int main(int argc, const char **argv)
 	int i, ret=0, count=0;
 	struct ldb_cmdline *options;
 
-	ldb_global_init();
-
 	ldb = ldb_init(NULL);
 
 	options = ldb_cmdline_process(ldb, argc, argv, usage);
diff --git a/source4/lib/ldb/tools/ldbdel.c b/source4/lib/ldb/tools/ldbdel.c
index fcd0978779..184172b22b 100644
--- a/source4/lib/ldb/tools/ldbdel.c
+++ b/source4/lib/ldb/tools/ldbdel.c
@@ -77,8 +77,6 @@ int main(int argc, const char **argv)
 	int ret = 0, i;
 	struct ldb_cmdline *options;
 
-	ldb_global_init();
-
 	ldb = ldb_init(NULL);
 
 	options = ldb_cmdline_process(ldb, argc, argv, usage);
diff --git a/source4/lib/ldb/tools/ldbedit.c b/source4/lib/ldb/tools/ldbedit.c
index ed98a6d615..a9fd064bf8 100644
--- a/source4/lib/ldb/tools/ldbedit.c
+++ b/source4/lib/ldb/tools/ldbedit.c
@@ -279,8 +279,6 @@ int main(int argc, const char **argv)
 	const char *expression = "(|(objectClass=*)(distinguishedName=*))";
 	const char * const * attrs = NULL;
 
-	ldb_global_init();
-
 	ldb = ldb_init(NULL);
 
 	options = ldb_cmdline_process(ldb, argc, argv, usage);
diff --git a/source4/lib/ldb/tools/ldbmodify.c b/source4/lib/ldb/tools/ldbmodify.c
index ed12380095..dd6206b824 100644
--- a/source4/lib/ldb/tools/ldbmodify.c
+++ b/source4/lib/ldb/tools/ldbmodify.c
@@ -89,8 +89,6 @@ int main(int argc, const char **argv)
 	int i, ret=LDB_SUCCESS;
 	struct ldb_cmdline *options;
 
-	ldb_global_init();
-
 	ldb = ldb_init(NULL);
 
 	options = ldb_cmdline_process(ldb, argc, argv, usage);
diff --git a/source4/lib/ldb/tools/ldbrename.c b/source4/lib/ldb/tools/ldbrename.c
index c160e87ee4..b36310a500 100644
--- a/source4/lib/ldb/tools/ldbrename.c
+++ b/source4/lib/ldb/tools/ldbrename.c
@@ -56,8 +56,6 @@ int main(int argc, const char **argv)
 	struct ldb_cmdline *options;
 	struct ldb_dn *dn1, *dn2;
 
-	ldb_global_init();
-
 	ldb = ldb_init(NULL);
 
 	options = ldb_cmdline_process(ldb, argc, argv, usage);
diff --git a/source4/lib/ldb/tools/ldbsearch.c b/source4/lib/ldb/tools/ldbsearch.c
index 24ceb30963..e25bd19965 100644
--- a/source4/lib/ldb/tools/ldbsearch.c
+++ b/source4/lib/ldb/tools/ldbsearch.c
@@ -276,8 +276,6 @@ int main(int argc, const char **argv)
 	int ret = -1;
 	const char *expression = "(|(objectClass=*)(distinguishedName=*))";
 
-	ldb_global_init();
-
 	ldb = ldb_init(NULL);
 
 	options = ldb_cmdline_process(ldb, argc, argv, usage);
diff --git a/source4/lib/ldb/tools/ldbtest.c b/source4/lib/ldb/tools/ldbtest.c
index 5c21dd3830..57a7848733 100644
--- a/source4/lib/ldb/tools/ldbtest.c
+++ b/source4/lib/ldb/tools/ldbtest.c
@@ -393,8 +393,6 @@ int main(int argc, const char **argv)
 	TALLOC_CTX *mem_ctx = talloc_new(NULL);
 	struct ldb_context *ldb;
 
-	ldb_global_init();
-
 	ldb = ldb_init(mem_ctx);
 
 	options = ldb_cmdline_process(ldb, argc, argv, usage);
diff --git a/source4/lib/ldb/tools/oLschema2ldif.c b/source4/lib/ldb/tools/oLschema2ldif.c
index 7b5f1b835c..1846a2c852 100644
--- a/source4/lib/ldb/tools/oLschema2ldif.c
+++ b/source4/lib/ldb/tools/oLschema2ldif.c
@@ -560,8 +560,6 @@ static void usage(void)
 	struct ldb_cmdline *options;
 	FILE *in = stdin;
 	FILE *out = stdout;
-	ldb_global_init();
-
 	ctx = talloc_new(NULL);
 	ldb_ctx = ldb_init(ctx);
 
diff --git a/source4/lib/registry/patchfile.c b/source4/lib/registry/patchfile.c
index fa1367bbd2..a4579010cd 100644
--- a/source4/lib/registry/patchfile.c
+++ b/source4/lib/registry/patchfile.c
@@ -23,6 +23,7 @@
 #include "lib/registry/patchfile.h"
 #include "lib/registry/registry.h"
 #include "system/filesys.h"
+#include "param/param.h"
 
 
 _PUBLIC_ WERROR reg_preg_diff_load(int fd,
@@ -30,6 +31,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 				   void *callback_data);
 
 _PUBLIC_ WERROR reg_dotreg_diff_load(int fd,
+				     struct smb_iconv_convenience *iconv_convenience,
 				     const struct reg_diff_callbacks *callbacks,
 				     void *callback_data);
 
@@ -306,7 +308,7 @@ _PUBLIC_ WERROR reg_diff_load(const char *filename,
 		return reg_preg_diff_load(fd, callbacks, callback_data);
 	} else {
 		/* Must be a normal .REG file */
-		return reg_dotreg_diff_load(fd, callbacks, callback_data);
+		return reg_dotreg_diff_load(fd, lp_iconv_convenience(global_loadparm), callbacks, callback_data);
 	}
 }
 
diff --git a/source4/lib/registry/patchfile_dotreg.c b/source4/lib/registry/patchfile_dotreg.c
index ebcafc92af..46ea7c0008 100644
--- a/source4/lib/registry/patchfile_dotreg.c
+++ b/source4/lib/registry/patchfile_dotreg.c
@@ -26,6 +26,7 @@
 #include "lib/registry/patchfile.h"
 #include "lib/registry/registry.h"
 #include "system/filesys.h"
+#include "param/param.h"
 
 /**
  * @file
@@ -36,6 +37,7 @@
 
 struct dotreg_data {
 	int fd;
+	struct smb_iconv_convenience *iconv_convenience;
 };
 
 static WERROR reg_dotreg_diff_add_key(void *_data, const char *key_name)
@@ -64,7 +66,7 @@ static WERROR reg_dotreg_diff_set_value(void *_data, const char *path,
 
 	fdprintf(data->fd, "\"%s\"=%s:%s\n",
 			value_name, str_regtype(value_type),
-			reg_val_data_string(NULL, value_type, value));
+			reg_val_data_string(NULL, data->iconv_convenience, value_type, value));
 
 	return WERR_OK;
 }
@@ -107,6 +109,8 @@ _PUBLIC_ WERROR reg_dotreg_diff_save(TALLOC_CTX *ctx, const char *filename,
 	data = talloc_zero(ctx, struct dotreg_data);
 	*callback_data = data;
 
+	data->iconv_convenience = lp_iconv_convenience(global_loadparm);
+
 	if (filename) {
 		data->fd = open(filename, O_CREAT, 0755);
 		if (data->fd == -1) {
@@ -135,6 +139,7 @@ _PUBLIC_ WERROR reg_dotreg_diff_save(TALLOC_CTX *ctx, const char *filename,
  * Load diff file
  */
 _PUBLIC_ WERROR reg_dotreg_diff_load(int fd,
+				     struct smb_iconv_convenience *iconv_convenience,
 				     const struct reg_diff_callbacks *callbacks,
 				     void *callback_data)
 {
@@ -239,7 +244,8 @@ _PUBLIC_ WERROR reg_dotreg_diff_load(int fd,
 			q++;
 		}
 
-		reg_string_to_val(line, q?p:"REG_SZ", q?q:p,
+		reg_string_to_val(line, iconv_convenience, 
+				  q?p:"REG_SZ", q?q:p,
 				  &value_type, &value);
 
 		error = callbacks->set_value(callback_data, curkey, line,
diff --git a/source4/lib/registry/registry.h b/source4/lib/registry/registry.h
index fac9180378..5e0b971a1d 100644
--- a/source4/lib/registry/registry.h
+++ b/source4/lib/registry/registry.h
@@ -254,11 +254,10 @@ WERROR reg_create_key(TALLOC_CTX *mem_ctx,
 
 /* Utility functions */
 const char *str_regtype(int type);
-char *reg_val_data_string(TALLOC_CTX *mem_ctx, uint32_t type,
-			  const DATA_BLOB data);
-char *reg_val_description(TALLOC_CTX *mem_ctx, const char *name,
+char *reg_val_data_string(TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, uint32_t type, const DATA_BLOB data);
+char *reg_val_description(TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, const char *name,
 			  uint32_t type, const DATA_BLOB data);
-bool reg_string_to_val(TALLOC_CTX *mem_ctx, const char *type_str,
+bool reg_string_to_val(TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, const char *type_str,
 		       const char *data_str, uint32_t *type, DATA_BLOB *data);
 WERROR reg_open_key_abs(TALLOC_CTX *mem_ctx, struct registry_context *handle,
 			const char *name, struct registry_key **result);
diff --git a/source4/lib/registry/tests/generic.c b/source4/lib/registry/tests/generic.c
index 25a89793bd..145e599504 100644
--- a/source4/lib/registry/tests/generic.c
+++ b/source4/lib/registry/tests/generic.c
@@ -45,7 +45,7 @@ static bool test_reg_val_data_string_dword(struct torture_context *ctx)
 	uint32_t d = 0x20;
 	DATA_BLOB db = { (uint8_t *)&d, sizeof(d) };
 	torture_assert_str_equal(ctx, "0x20",
-				 reg_val_data_string(ctx, REG_DWORD, db),
+				 reg_val_data_string(ctx, lp_iconv_convenience(ctx->lp_ctx), REG_DWORD, db),
 				 "dword failed");
 	return true;
 }
@@ -56,11 +56,11 @@ static bool test_reg_val_data_string_sz(struct torture_context *ctx)
 	db.length = convert_string_talloc(ctx, lp_iconv_convenience(ctx->lp_ctx), CH_UNIX, CH_UTF16,
 					  "bla", 3, (void **)&db.data);
 	torture_assert_str_equal(ctx, "bla",
-				 reg_val_data_string(ctx, REG_SZ, db),
+				 reg_val_data_string(ctx, lp_iconv_convenience(ctx->lp_ctx), REG_SZ, db),
 				 "sz failed");
 	db.length = 4;
 	torture_assert_str_equal(ctx, "bl",
-				 reg_val_data_string(ctx, REG_SZ, db),
+				 reg_val_data_string(ctx, lp_iconv_convenience(ctx->lp_ctx), REG_SZ, db),
 				 "sz failed");
 	return true;
 }
@@ -70,7 +70,7 @@ static bool test_reg_val_data_string_binary(struct torture_context *ctx)
 	uint8_t x[] = { 0x1, 0x2, 0x3, 0x4 };
 	DATA_BLOB db = { x, 4 };
 	torture_assert_str_equal(ctx, "01020304",
-				 reg_val_data_string(ctx, REG_BINARY, db),
+				 reg_val_data_string(ctx, lp_iconv_convenience(ctx->lp_ctx), REG_BINARY, db),
 				 "binary failed");
 	return true;
 }
@@ -80,7 +80,7 @@ static bool test_reg_val_data_string_empty(struct torture_context *ctx)
 {
 	DATA_BLOB db = { NULL, 0 };
 	torture_assert_str_equal(ctx, "",
-				 reg_val_data_string(ctx, REG_BINARY, db),
+				 reg_val_data_string(ctx, lp_iconv_convenience(ctx->lp_ctx), REG_BINARY, db),
 				 "empty failed");
 	return true;
 }
@@ -93,7 +93,7 @@ static bool test_reg_val_description(struct torture_context *ctx)
 					    strlen("stationary traveller"),
 					    (void **)&data.data);
 	torture_assert_str_equal(ctx, "camel = REG_SZ : stationary traveller",
-				 reg_val_description(ctx, "camel", REG_SZ, data),
+				 reg_val_description(ctx, lp_iconv_convenience(ctx->lp_ctx), "camel", REG_SZ, data),
 				 "reg_val_description failed");
 	return true;
 }
@@ -107,7 +107,7 @@ static bool test_reg_val_description_nullname(struct torture_context *ctx)
 					    strlen("west berlin"),
 					    (void **)&data.data);
 	torture_assert_str_equal(ctx, "<No Name> = REG_SZ : west berlin",
-				 reg_val_description(ctx, NULL, REG_SZ, data),
+				 reg_val_description(ctx, lp_iconv_convenience(ctx->lp_ctx), NULL, REG_SZ, data),
 				 "description with null name failed");
 	return true;
 }
diff --git a/source4/lib/registry/tools/regshell.c b/source4/lib/registry/tools/regshell.c
index d5c506ab31..58f64cb049 100644
--- a/source4/lib/registry/tools/regshell.c
+++ b/source4/lib/registry/tools/regshell.c
@@ -141,7 +141,8 @@ static WERROR cmd_set(struct regshell_context *ctx, int argc, char **argv)
 		return WERR_INVALID_PARAM;
 	}
 
-	if (!reg_string_to_val(ctx, argv[2], argv[3], &val.data_type,
+	if (!reg_string_to_val(ctx, lp_iconv_convenience(cmdline_lp_ctx), 
+			       argv[2], argv[3], &val.data_type,
 			       &val.data)) {
 		fprintf(stderr, "Unable to interpret data\n");
 		return WERR_INVALID_PARAM;
@@ -199,7 +200,7 @@ static WERROR cmd_print(struct regshell_context *ctx, int argc, char **argv)
 	}
 
 	printf("%s\n%s\n", str_regtype(value_type),
-		   reg_val_data_string(ctx, value_type, value_data));
+		   reg_val_data_string(ctx, lp_iconv_convenience(cmdline_lp_ctx), value_type, value_data));
 
 	return WERR_OK;
 }
@@ -233,7 +234,7 @@ static WERROR cmd_ls(struct regshell_context *ctx, int argc, char **argv)
 								     &data_type,
 								     &data)); i++) {
 		printf("V \"%s\" %s %s\n", name, str_regtype(data_type),
-			   reg_val_data_string(ctx, data_type, data));
+			   reg_val_data_string(ctx, lp_iconv_convenience(cmdline_lp_ctx), data_type, data));
 	}
 
 	return WERR_OK;
diff --git a/source4/lib/registry/tools/regtree.c b/source4/lib/registry/tools/regtree.c
index 0f47d8f8dd..424d3515e0 100644
--- a/source4/lib/registry/tools/regtree.c
+++ b/source4/lib/registry/tools/regtree.c
@@ -82,7 +82,7 @@ static void print_tree(int level, struct registry_key *p,
 			int j;
 			char *desc;
 			for(j = 0; j < level+1; j++) putchar(' ');
-			desc = reg_val_description(mem_ctx, valuename,
+			desc = reg_val_description(mem_ctx, lp_iconv_convenience(cmdline_lp_ctx), valuename,
 						   value_type, value_data);
 			printf("%s\n", desc);
 		}
diff --git a/source4/lib/registry/util.c b/source4/lib/registry/util.c
index a251ae49a5..68efd56a86 100644
--- a/source4/lib/registry/util.c
+++ b/source4/lib/registry/util.c
@@ -51,7 +51,9 @@ _PUBLIC_ const char *str_regtype(int type)
 	return "Unknown";
 }
 
-_PUBLIC_ char *reg_val_data_string(TALLOC_CTX *mem_ctx, uint32_t type,
+_PUBLIC_ char *reg_val_data_string(TALLOC_CTX *mem_ctx, 
+				   struct smb_iconv_convenience *iconv_convenience,
+				   uint32_t type,
 				   const DATA_BLOB data)
 {
 	char *ret = NULL;
@@ -62,7 +64,7 @@ _PUBLIC_ char *reg_val_data_string(TALLOC_CTX *mem_ctx, uint32_t type,
 	switch (type) {
 		case REG_EXPAND_SZ:
 		case REG_SZ:
-			convert_string_talloc(mem_ctx, lp_iconv_convenience(global_loadparm), CH_UTF16, CH_UNIX,
+			convert_string_talloc(mem_ctx, iconv_convenience, CH_UTF16, CH_UNIX,
 					      data.data, data.length,
 					      (void **)&ret);
 			return ret;
@@ -85,16 +87,20 @@ _PUBLIC_ char *reg_val_data_string(TALLOC_CTX *mem_ctx, uint32_t type,
 }
 
 /** Generate a string that describes a registry value */
-_PUBLIC_ char *reg_val_description(TALLOC_CTX *mem_ctx, const char *name,
+_PUBLIC_ char *reg_val_description(TALLOC_CTX *mem_ctx, 
+				   struct smb_iconv_convenience *iconv_convenience, 
+				   const char *name,
 				   uint32_t data_type,
 				   const DATA_BLOB data)
 {
 	return talloc_asprintf(mem_ctx, "%s = %s : %s", name?name:"<No Name>",
 			       str_regtype(data_type),
-			       reg_val_data_string(mem_ctx, data_type, data));
+			       reg_val_data_string(mem_ctx, iconv_convenience, data_type, data));
 }
 
-_PUBLIC_ bool reg_string_to_val(TALLOC_CTX *mem_ctx, const char *type_str,
+_PUBLIC_ bool reg_string_to_val(TALLOC_CTX *mem_ctx, 
+				struct smb_iconv_convenience *iconv_convenience,
+				const char *type_str,
 				const char *data_str, uint32_t *type,
 				DATA_BLOB *data)
 {
@@ -118,7 +124,7 @@ _PUBLIC_ bool reg_string_to_val(TALLOC_CTX *mem_ctx, const char *type_str,
 	{
 		case REG_SZ:
 		case REG_EXPAND_SZ:
-      		data->length = convert_string_talloc(mem_ctx, lp_iconv_convenience(global_loadparm), CH_UNIX, CH_UTF16,
+      		data->length = convert_string_talloc(mem_ctx, iconv_convenience, CH_UNIX, CH_UTF16,
 						     data_str, strlen(data_str),
 						     (void **)&data->data);
 			break;
diff --git a/source4/lib/replace/dlfcn.c b/source4/lib/replace/dlfcn.c
index 42848848e8..3b109d7e40 100644
--- a/source4/lib/replace/dlfcn.c
+++ b/source4/lib/replace/dlfcn.c
@@ -35,6 +35,8 @@ void *rep_dlopen(const char *name, int flags)
 #endif
 {
 #ifdef HAVE_SHL_LOAD
+	if (name == NULL)
+		return PROG_HANDLE;
 	return (void *)shl_load(name, flags, 0);
 #else
 	return NULL;
diff --git a/source4/lib/replace/getifaddrs.c b/source4/lib/replace/getifaddrs.c
index 4037d647d7..053657475d 100644
--- a/source4/lib/replace/getifaddrs.c
+++ b/source4/lib/replace/getifaddrs.c
@@ -19,6 +19,8 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#define SOCKET_WRAPPER_NOT_REPLACE
+
 #include "replace.h"
 #include "system/network.h"
 
@@ -81,11 +83,11 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 	char buff[8192];
 	int fd, i, n;
 	struct ifreq *ifr=NULL;
-	int total = 0;
 	struct in_addr ipaddr;
 	struct in_addr nmask;
 	char *iname;
-	struct ifaddrs *curif, *lastif;
+	struct ifaddrs *curif;
+	struct ifaddrs *lastif = NULL;
 
 	*ifap = NULL;
 
@@ -106,7 +108,7 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 	n = ifc.ifc_len / sizeof(struct ifreq);
 
 	/* Loop through interfaces, looking for given IP address */
-	for (i=n-1;i>=0 && total < max_interfaces;i--) {
+	for (i=n-1; i>=0; i--) {
 		if (ioctl(fd, SIOCGIFADDR, &ifr[i]) != 0) {
 			freeifaddrs(*ifap);
 		}
@@ -115,7 +117,7 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 		if (lastif == NULL) {
 			*ifap = curif;
 		} else {
-			lastif->ifa_next = (*ifap);
+			lastif->ifa_next = curif;
 		}
 
 		curif->ifa_name = strdup(ifr[i].ifr_name);
@@ -166,11 +168,11 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 	char buff[8192];
 	int fd, i, n;
 	struct ifreq *ifr=NULL;
-	int total = 0;
 	struct in_addr ipaddr;
 	struct in_addr nmask;
 	char *iname;
 	struct ifaddrs *curif;
+	struct ifaddrs *lastif = NULL;
 
 	*ifap = NULL;
 
@@ -201,14 +203,14 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 
 	/* Loop through interfaces */
 
-	for (i = 0; i<n && total < max_interfaces; i++) {
+	for (i = 0; i<n; i++) {
 		ifreq = ifr[i];
   
 		curif = calloc(1, sizeof(struct ifaddrs));
 		if (lastif == NULL) {
 			*ifap = curif;
 		} else {
-			lastif->ifa_next = (*ifap);
+			lastif->ifa_next = curif;
 		}
 
 		strioctl.ic_cmd = SIOCGIFFLAGS;
@@ -270,8 +272,8 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 	struct in_addr ipaddr;
 	struct in_addr nmask;
 	char *iname;
-	int total = 0;
-	struct ifaddrs *curif, *lastif;
+	struct ifaddrs *curif;
+	struct ifaddrs *lastif = NULL;
 
 	*ifap = NULL;
 
@@ -306,7 +308,7 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 		if (lastif == NULL) {
 			*ifap = curif;
 		} else {
-			lastif->ifa_next = (*ifap);
+			lastif->ifa_next = curif;
 		}
 
 		curif->ifa_name = strdup(ifr->ifr_name);
@@ -363,7 +365,7 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 #endif
 
 #ifdef AUTOCONF_TEST
-/* this is the autoconf driver to test get_interfaces() */
+/* this is the autoconf driver to test getifaddrs() */
 
  int main()
 {
diff --git a/source4/lib/replace/getifaddrs.m4 b/source4/lib/replace/getifaddrs.m4
index 297a82d0c3..dd2a95cb81 100644
--- a/source4/lib/replace/getifaddrs.m4
+++ b/source4/lib/replace/getifaddrs.m4
@@ -7,7 +7,7 @@ AC_CHECK_MEMBERS([struct sockaddr.sa_len],
 	 [#include <sys/socket.h>])
 
 dnl test for getifaddrs and freeifaddrs
-AC_CACHE_CHECK([for getifaddrs and freeifaddrs],samba_cv_HAVE_GETIFADDRS,[
+AC_CACHE_CHECK([for getifaddrs and freeifaddrs],libreplace_cv_HAVE_GETIFADDRS,[
 AC_TRY_COMPILE([
 #include <sys/types.h>
 #if STDC_HEADERS
@@ -24,8 +24,8 @@ struct ifaddrs *ifp = NULL;
 int ret = getifaddrs (&ifp);
 freeifaddrs(ifp);
 ],
-samba_cv_HAVE_GETIFADDRS=yes,samba_cv_HAVE_GETIFADDRS=no)])
-if test x"$samba_cv_HAVE_GETIFADDRS" = x"yes"; then
+libreplace_cv_HAVE_GETIFADDRS=yes,libreplace_cv_HAVE_GETIFADDRS=no)])
+if test x"$libreplace_cv_HAVE_GETIFADDRS" = x"yes"; then
     AC_DEFINE(HAVE_GETIFADDRS,1,[Whether the system has getifaddrs])
     AC_DEFINE(HAVE_FREEIFADDRS,1,[Whether the system has freeifaddrs])
 	AC_DEFINE(HAVE_STRUCT_IFADDRS,1,[Whether struct ifaddrs is available])
@@ -42,18 +42,16 @@ iface=no;
 ##################
 # look for a method of finding the list of network interfaces
 iface=no;
-AC_CACHE_CHECK([for iface getifaddrs],samba_cv_HAVE_IFACE_GETIFADDRS,[
-SAVE_CPPFLAGS="$CPPFLAGS"
-CPPFLAGS="$CPPFLAGS ${SAMBA_CONFIGURE_CPPFLAGS}"
+AC_CACHE_CHECK([for iface getifaddrs],libreplace_cv_HAVE_IFACE_GETIFADDRS,[
 AC_TRY_RUN([
-#define NO_CONFIG_H 1
 #define HAVE_IFACE_GETIFADDRS 1
+#define NO_CONFIG_H 1
 #define AUTOCONF_TEST 1
+#define SOCKET_WRAPPER_NOT_REPLACE
 #include "$libreplacedir/replace.c"
 #include "$libreplacedir/getifaddrs.c"],
-           samba_cv_HAVE_IFACE_GETIFADDRS=yes,samba_cv_HAVE_IFACE_GETIFADDRS=no,samba_cv_HAVE_IFACE_GETIFADDRS=cross)])
-CPPFLAGS="$SAVE_CPPFLAGS"
-if test x"$samba_cv_HAVE_IFACE_GETIFADDRS" = x"yes"; then
+           libreplace_cv_HAVE_IFACE_GETIFADDRS=yes,libreplace_cv_HAVE_IFACE_GETIFADDRS=no,libreplace_cv_HAVE_IFACE_GETIFADDRS=cross)])
+if test x"$libreplace_cv_HAVE_IFACE_GETIFADDRS" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_GETIFADDRS,1,[Whether iface getifaddrs is available])
 else
 	LIBREPLACEOBJ="${LIBREPLACEOBJ} getifaddrs.o"
@@ -61,39 +59,48 @@ fi
 
 
 if test $iface = no; then
-AC_CACHE_CHECK([for iface AIX],samba_cv_HAVE_IFACE_AIX,[
+AC_CACHE_CHECK([for iface AIX],libreplace_cv_HAVE_IFACE_AIX,[
 AC_TRY_RUN([
 #define HAVE_IFACE_AIX 1
+#define NO_CONFIG_H 1
 #define AUTOCONF_TEST 1
 #undef _XOPEN_SOURCE_EXTENDED
+#define SOCKET_WRAPPER_NOT_REPLACE
+#include "$libreplacedir/replace.c"
 #include "$libreplacedir/getifaddrs.c"],
-           samba_cv_HAVE_IFACE_AIX=yes,samba_cv_HAVE_IFACE_AIX=no,samba_cv_HAVE_IFACE_AIX=cross)])
-if test x"$samba_cv_HAVE_IFACE_AIX" = x"yes"; then
+           libreplace_cv_HAVE_IFACE_AIX=yes,libreplace_cv_HAVE_IFACE_AIX=no,libreplace_cv_HAVE_IFACE_AIX=cross)])
+if test x"$libreplace_cv_HAVE_IFACE_AIX" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_AIX,1,[Whether iface AIX is available])
 fi
 fi
 
 
 if test $iface = no; then
-AC_CACHE_CHECK([for iface ifconf],samba_cv_HAVE_IFACE_IFCONF,[
+AC_CACHE_CHECK([for iface ifconf],libreplace_cv_HAVE_IFACE_IFCONF,[
 AC_TRY_RUN([
 #define HAVE_IFACE_IFCONF 1
+#define NO_CONFIG_H 1
 #define AUTOCONF_TEST 1
+#define SOCKET_WRAPPER_NOT_REPLACE
+#include "$libreplacedir/replace.c"
 #include "$libreplacedir/getifaddrs.c"],
-           samba_cv_HAVE_IFACE_IFCONF=yes,samba_cv_HAVE_IFACE_IFCONF=no,samba_cv_HAVE_IFACE_IFCONF=cross)])
-if test x"$samba_cv_HAVE_IFACE_IFCONF" = x"yes"; then
+           libreplace_cv_HAVE_IFACE_IFCONF=yes,libreplace_cv_HAVE_IFACE_IFCONF=no,libreplace_cv_HAVE_IFACE_IFCONF=cross)])
+if test x"$libreplace_cv_HAVE_IFACE_IFCONF" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_IFCONF,1,[Whether iface ifconf is available])
 fi
 fi
 
 if test $iface = no; then
-AC_CACHE_CHECK([for iface ifreq],samba_cv_HAVE_IFACE_IFREQ,[
+AC_CACHE_CHECK([for iface ifreq],libreplace_cv_HAVE_IFACE_IFREQ,[
 AC_TRY_RUN([
 #define HAVE_IFACE_IFREQ 1
+#define NO_CONFIG_H 1
 #define AUTOCONF_TEST 1
+#define SOCKET_WRAPPER_NOT_REPLACE
+#include "$libreplacedir/replace.c"
 #include "$libreplacedir/getifaddrs.c"],
-           samba_cv_HAVE_IFACE_IFREQ=yes,samba_cv_HAVE_IFACE_IFREQ=no,samba_cv_HAVE_IFACE_IFREQ=cross)])
-if test x"$samba_cv_HAVE_IFACE_IFREQ" = x"yes"; then
+           libreplace_cv_HAVE_IFACE_IFREQ=yes,libreplace_cv_HAVE_IFACE_IFREQ=no,libreplace_cv_HAVE_IFACE_IFREQ=cross)])
+if test x"$libreplace_cv_HAVE_IFACE_IFREQ" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_IFREQ,1,[Whether iface ifreq is available])
 fi
 fi
diff --git a/source4/lib/replace/getpass.m4 b/source4/lib/replace/getpass.m4
index c4da9aae59..b93817f9d3 100644
--- a/source4/lib/replace/getpass.m4
+++ b/source4/lib/replace/getpass.m4
@@ -1,22 +1,22 @@
-AC_CHECK_FUNC(getpass, samba_cv_HAVE_GETPASS=yes)
-AC_CHECK_FUNC(getpassphrase, samba_cv_HAVE_GETPASSPHRASE=yes)
-if test x"$samba_cv_HAVE_GETPASS" = x"yes" -a x"$samba_cv_HAVE_GETPASSPHRASE" = x"yes"; then
+AC_CHECK_FUNC(getpass, libreplace_cv_HAVE_GETPASS=yes)
+AC_CHECK_FUNC(getpassphrase, libreplace_cv_HAVE_GETPASSPHRASE=yes)
+if test x"$libreplace_cv_HAVE_GETPASS" = x"yes" -a x"$libreplace_cv_HAVE_GETPASSPHRASE" = x"yes"; then
         AC_DEFINE(REPLACE_GETPASS_BY_GETPASSPHRASE, 1, [getpass returns <9 chars where getpassphrase returns <265 chars])
 	AC_DEFINE(REPLACE_GETPASS,1,[Whether getpass should be replaced])
 	LIBREPLACEOBJ="${LIBREPLACEOBJ} getpass.o"
 else
 
-AC_CACHE_CHECK([whether getpass should be replaced],samba_cv_REPLACE_GETPASS,[
+AC_CACHE_CHECK([whether getpass should be replaced],libreplace_cv_REPLACE_GETPASS,[
 SAVE_CPPFLAGS="$CPPFLAGS"
 CPPFLAGS="$CPPFLAGS -I$libreplacedir/"
 AC_TRY_COMPILE([
 #include "confdefs.h"
 #define NO_CONFIG_H
 #include "$libreplacedir/getpass.c"
-],[],samba_cv_REPLACE_GETPASS=yes,samba_cv_REPLACE_GETPASS=no)
+],[],libreplace_cv_REPLACE_GETPASS=yes,libreplace_cv_REPLACE_GETPASS=no)
 CPPFLAGS="$SAVE_CPPFLAGS"
 ])
-if test x"$samba_cv_REPLACE_GETPASS" = x"yes"; then
+if test x"$libreplace_cv_REPLACE_GETPASS" = x"yes"; then
 	AC_DEFINE(REPLACE_GETPASS,1,[Whether getpass should be replaced])
 	LIBREPLACEOBJ="${LIBREPLACEOBJ} getpass.o"
 fi
diff --git a/source4/lib/replace/libreplace.m4 b/source4/lib/replace/libreplace.m4
index 6d1d6b8afc..2e0cd34f4a 100644
--- a/source4/lib/replace/libreplace.m4
+++ b/source4/lib/replace/libreplace.m4
@@ -85,10 +85,10 @@ AC_INCLUDES_DEFAULT
 #endif]
 )
 
-AC_CACHE_CHECK([for working mmap],samba_cv_HAVE_MMAP,[
+AC_CACHE_CHECK([for working mmap],libreplace_cv_HAVE_MMAP,[
 AC_TRY_RUN([#include "$libreplacedir/test/shared_mmap.c"],
-           samba_cv_HAVE_MMAP=yes,samba_cv_HAVE_MMAP=no,samba_cv_HAVE_MMAP=cross)])
-if test x"$samba_cv_HAVE_MMAP" = x"yes"; then
+           libreplace_cv_HAVE_MMAP=yes,libreplace_cv_HAVE_MMAP=no,libreplace_cv_HAVE_MMAP=cross)])
+if test x"$libreplace_cv_HAVE_MMAP" = x"yes"; then
     AC_DEFINE(HAVE_MMAP,1,[Whether mmap works])
 fi
 
@@ -120,7 +120,7 @@ if test x"$libreplace_cv_USABLE_NET_IF_H" = x"yes";then
 	AC_DEFINE(HAVE_NET_IF_H, 1, usability of net/if.h)
 fi
 
-AC_CACHE_CHECK([for broken inet_ntoa],samba_cv_REPLACE_INET_NTOA,[
+AC_CACHE_CHECK([for broken inet_ntoa],libreplace_cv_REPLACE_INET_NTOA,[
 AC_TRY_RUN([
 #include <stdio.h>
 #include <unistd.h>
@@ -133,8 +133,8 @@ main() { struct in_addr ip; ip.s_addr = 0x12345678;
 if (strcmp(inet_ntoa(ip),"18.52.86.120") &&
     strcmp(inet_ntoa(ip),"120.86.52.18")) { exit(0); } 
 exit(1);}],
-           samba_cv_REPLACE_INET_NTOA=yes,samba_cv_REPLACE_INET_NTOA=no,samba_cv_REPLACE_INET_NTOA=cross)])
-if test x"$samba_cv_REPLACE_INET_NTOA" = x"yes"; then
+           libreplace_cv_REPLACE_INET_NTOA=yes,libreplace_cv_REPLACE_INET_NTOA=no,libreplace_cv_REPLACE_INET_NTOA=cross)])
+if test x"$libreplace_cv_REPLACE_INET_NTOA" = x"yes"; then
     AC_DEFINE(REPLACE_INET_NTOA,1,[Whether inet_ntoa should be replaced])
 fi
 
@@ -182,7 +182,7 @@ AC_HAVE_DECL(setresuid, [#include <unistd.h>])
 AC_HAVE_DECL(setresgid, [#include <unistd.h>])
 AC_HAVE_DECL(errno, [#include <errno.h>])
 
-AC_CACHE_CHECK([for secure mkstemp],samba_cv_HAVE_SECURE_MKSTEMP,[
+AC_CACHE_CHECK([for secure mkstemp],libreplace_cv_HAVE_SECURE_MKSTEMP,[
 AC_TRY_RUN([#include <stdlib.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -197,10 +197,10 @@ main() {
   if ((st.st_mode & 0777) != 0600) exit(1);
   exit(0);
 }],
-samba_cv_HAVE_SECURE_MKSTEMP=yes,
-samba_cv_HAVE_SECURE_MKSTEMP=no,
-samba_cv_HAVE_SECURE_MKSTEMP=cross)])
-if test x"$samba_cv_HAVE_SECURE_MKSTEMP" = x"yes"; then
+libreplace_cv_HAVE_SECURE_MKSTEMP=yes,
+libreplace_cv_HAVE_SECURE_MKSTEMP=no,
+libreplace_cv_HAVE_SECURE_MKSTEMP=cross)])
+if test x"$libreplace_cv_HAVE_SECURE_MKSTEMP" = x"yes"; then
     AC_DEFINE(HAVE_SECURE_MKSTEMP,1,[Whether mkstemp is secure])
 fi
 
@@ -209,7 +209,7 @@ AC_CHECK_HEADERS(stdio.h strings.h)
 AC_CHECK_DECLS([snprintf, vsnprintf, asprintf, vasprintf])
 AC_CHECK_FUNCS(snprintf vsnprintf asprintf vasprintf)
 
-AC_CACHE_CHECK([for C99 vsnprintf],samba_cv_HAVE_C99_VSNPRINTF,[
+AC_CACHE_CHECK([for C99 vsnprintf],libreplace_cv_HAVE_C99_VSNPRINTF,[
 AC_TRY_RUN([
 #include <sys/types.h>
 #include <stdio.h>
@@ -243,43 +243,43 @@ void foo(const char *format, ...) {
 }
 main() { foo("hello"); }
 ],
-samba_cv_HAVE_C99_VSNPRINTF=yes,samba_cv_HAVE_C99_VSNPRINTF=no,samba_cv_HAVE_C99_VSNPRINTF=cross)])
-if test x"$samba_cv_HAVE_C99_VSNPRINTF" = x"yes"; then
+libreplace_cv_HAVE_C99_VSNPRINTF=yes,libreplace_cv_HAVE_C99_VSNPRINTF=no,libreplace_cv_HAVE_C99_VSNPRINTF=cross)])
+if test x"$libreplace_cv_HAVE_C99_VSNPRINTF" = x"yes"; then
     AC_DEFINE(HAVE_C99_VSNPRINTF,1,[Whether there is a C99 compliant vsnprintf])
 fi
 
 
 dnl VA_COPY
-AC_CACHE_CHECK([for va_copy],samba_cv_HAVE_VA_COPY,[
+AC_CACHE_CHECK([for va_copy],libreplace_cv_HAVE_VA_COPY,[
 AC_TRY_LINK([#include <stdarg.h>
 va_list ap1,ap2;], [va_copy(ap1,ap2);],
-samba_cv_HAVE_VA_COPY=yes,samba_cv_HAVE_VA_COPY=no)])
-if test x"$samba_cv_HAVE_VA_COPY" = x"yes"; then
+libreplace_cv_HAVE_VA_COPY=yes,libreplace_cv_HAVE_VA_COPY=no)])
+if test x"$libreplace_cv_HAVE_VA_COPY" = x"yes"; then
     AC_DEFINE(HAVE_VA_COPY,1,[Whether va_copy() is available])
 fi
 
-if test x"$samba_cv_HAVE_VA_COPY" != x"yes"; then
-AC_CACHE_CHECK([for __va_copy],samba_cv_HAVE___VA_COPY,[
+if test x"$libreplace_cv_HAVE_VA_COPY" != x"yes"; then
+AC_CACHE_CHECK([for __va_copy],libreplace_cv_HAVE___VA_COPY,[
 AC_TRY_LINK([#include <stdarg.h>
 va_list ap1,ap2;], [__va_copy(ap1,ap2);],
-samba_cv_HAVE___VA_COPY=yes,samba_cv_HAVE___VA_COPY=no)])
-if test x"$samba_cv_HAVE___VA_COPY" = x"yes"; then
+libreplace_cv_HAVE___VA_COPY=yes,libreplace_cv_HAVE___VA_COPY=no)])
+if test x"$libreplace_cv_HAVE___VA_COPY" = x"yes"; then
     AC_DEFINE(HAVE___VA_COPY,1,[Whether __va_copy() is available])
 fi
 fi
 
 dnl __FUNCTION__ macro
-AC_CACHE_CHECK([for __FUNCTION__ macro],samba_cv_HAVE_FUNCTION_MACRO,[
+AC_CACHE_CHECK([for __FUNCTION__ macro],libreplace_cv_HAVE_FUNCTION_MACRO,[
 AC_TRY_COMPILE([#include <stdio.h>], [printf("%s\n", __FUNCTION__);],
-samba_cv_HAVE_FUNCTION_MACRO=yes,samba_cv_HAVE_FUNCTION_MACRO=no)])
-if test x"$samba_cv_HAVE_FUNCTION_MACRO" = x"yes"; then
+libreplace_cv_HAVE_FUNCTION_MACRO=yes,libreplace_cv_HAVE_FUNCTION_MACRO=no)])
+if test x"$libreplace_cv_HAVE_FUNCTION_MACRO" = x"yes"; then
     AC_DEFINE(HAVE_FUNCTION_MACRO,1,[Whether there is a __FUNCTION__ macro])
 else
     dnl __func__ macro
-    AC_CACHE_CHECK([for __func__ macro],samba_cv_HAVE_func_MACRO,[
+    AC_CACHE_CHECK([for __func__ macro],libreplace_cv_HAVE_func_MACRO,[
     AC_TRY_COMPILE([#include <stdio.h>], [printf("%s\n", __func__);],
-    samba_cv_HAVE_func_MACRO=yes,samba_cv_HAVE_func_MACRO=no)])
-    if test x"$samba_cv_HAVE_func_MACRO" = x"yes"; then
+    libreplace_cv_HAVE_func_MACRO=yes,libreplace_cv_HAVE_func_MACRO=no)])
+    if test x"$libreplace_cv_HAVE_func_MACRO" = x"yes"; then
        AC_DEFINE(HAVE_func_MACRO,1,[Whether there is a __func__ macro])
     fi
 fi
@@ -302,7 +302,7 @@ eprintf("bla", "bar");
 ], AC_DEFINE(HAVE__VA_ARGS__MACRO, 1, [Whether the __VA_ARGS__ macro is available]))
 
 
-AC_CACHE_CHECK([for sig_atomic_t type],samba_cv_sig_atomic_t, [
+AC_CACHE_CHECK([for sig_atomic_t type],libreplace_cv_sig_atomic_t, [
     AC_TRY_COMPILE([
 #include <sys/types.h>
 #if STDC_HEADERS
@@ -310,30 +310,30 @@ AC_CACHE_CHECK([for sig_atomic_t type],samba_cv_sig_atomic_t, [
 #include <stddef.h>
 #endif
 #include <signal.h>],[sig_atomic_t i = 0],
-	samba_cv_sig_atomic_t=yes,samba_cv_sig_atomic_t=no)])
-if test x"$samba_cv_sig_atomic_t" = x"yes"; then
+	libreplace_cv_sig_atomic_t=yes,libreplace_cv_sig_atomic_t=no)])
+if test x"$libreplace_cv_sig_atomic_t" = x"yes"; then
    AC_DEFINE(HAVE_SIG_ATOMIC_T_TYPE,1,[Whether we have the atomic_t variable type])
 fi
 
 
-AC_CACHE_CHECK([for O_DIRECT flag to open(2)],samba_cv_HAVE_OPEN_O_DIRECT,[
+AC_CACHE_CHECK([for O_DIRECT flag to open(2)],libreplace_cv_HAVE_OPEN_O_DIRECT,[
 AC_TRY_COMPILE([
 #include <unistd.h>
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif],
 [int fd = open("/dev/null", O_DIRECT);],
-samba_cv_HAVE_OPEN_O_DIRECT=yes,samba_cv_HAVE_OPEN_O_DIRECT=no)])
-if test x"$samba_cv_HAVE_OPEN_O_DIRECT" = x"yes"; then
+libreplace_cv_HAVE_OPEN_O_DIRECT=yes,libreplace_cv_HAVE_OPEN_O_DIRECT=no)])
+if test x"$libreplace_cv_HAVE_OPEN_O_DIRECT" = x"yes"; then
     AC_DEFINE(HAVE_OPEN_O_DIRECT,1,[Whether the open(2) accepts O_DIRECT])
 fi
 
 
 dnl Check if the C compiler understands volatile (it should, being ANSI).
-AC_CACHE_CHECK([that the C compiler understands volatile],samba_cv_volatile, [
+AC_CACHE_CHECK([that the C compiler understands volatile],libreplace_cv_volatile, [
 	AC_TRY_COMPILE([#include <sys/types.h>],[volatile int i = 0],
-		samba_cv_volatile=yes,samba_cv_volatile=no)])
-if test x"$samba_cv_volatile" = x"yes"; then
+		libreplace_cv_volatile=yes,libreplace_cv_volatile=no)])
+if test x"$libreplace_cv_volatile" = x"yes"; then
 	AC_DEFINE(HAVE_VOLATILE, 1, [Whether the C compiler understands volatile])
 fi
 
diff --git a/source4/lib/replace/libreplace_ld.m4 b/source4/lib/replace/libreplace_ld.m4
index 2aec698967..f0d10c1e3e 100644
--- a/source4/lib/replace/libreplace_ld.m4
+++ b/source4/lib/replace/libreplace_ld.m4
@@ -289,6 +289,9 @@ AC_DEFUN([AC_LIBREPLACE_RUNTIME_LIB_PATH_VAR],
 		*linux*)
 			LIB_PATH_VAR=LD_LIBRARY_PATH
 		;;
+		*netbsd*)
+			LIB_PATH_VAR=LD_LIBRARY_PATH
+		;;
 		*solaris*)
 			LIB_PATH_VAR=LD_LIBRARY_PATH
 		;;
diff --git a/source4/lib/replace/system/config.m4 b/source4/lib/replace/system/config.m4
index 1c05733126..66c2bd652a 100644
--- a/source4/lib/replace/system/config.m4
+++ b/source4/lib/replace/system/config.m4
@@ -18,7 +18,7 @@ AC_CHECK_HEADERS(sys/capability.h)
 
 case "$host_os" in
 *linux*)
-AC_CACHE_CHECK([for broken RedHat 7.2 system header files],samba_cv_BROKEN_REDHAT_7_SYSTEM_HEADERS,[
+AC_CACHE_CHECK([for broken RedHat 7.2 system header files],libreplace_cv_BROKEN_REDHAT_7_SYSTEM_HEADERS,[
 AC_TRY_COMPILE([
 	#ifdef HAVE_SYS_VFS_H
 	#include <sys/vfs.h>
@@ -29,14 +29,14 @@ AC_TRY_COMPILE([
 	],[
 	int i;
 	],
-	samba_cv_BROKEN_REDHAT_7_SYSTEM_HEADERS=no,
-	samba_cv_BROKEN_REDHAT_7_SYSTEM_HEADERS=yes
+	libreplace_cv_BROKEN_REDHAT_7_SYSTEM_HEADERS=no,
+	libreplace_cv_BROKEN_REDHAT_7_SYSTEM_HEADERS=yes
 )])
-if test x"$samba_cv_BROKEN_REDHAT_7_SYSTEM_HEADERS" = x"yes"; then
+if test x"$libreplace_cv_BROKEN_REDHAT_7_SYSTEM_HEADERS" = x"yes"; then
 	AC_DEFINE(BROKEN_REDHAT_7_SYSTEM_HEADERS,1,[Broken RedHat 7.2 system header files])
 fi
 
-AC_CACHE_CHECK([for broken RHEL5 sys/capability.h],samba_cv_BROKEN_RHEL5_SYS_CAP_HEADER,[
+AC_CACHE_CHECK([for broken RHEL5 sys/capability.h],libreplace_cv_BROKEN_RHEL5_SYS_CAP_HEADER,[
 AC_TRY_COMPILE([
 	#ifdef HAVE_SYS_CAPABILITY_H
 	#include <sys/capability.h>
@@ -45,10 +45,10 @@ AC_TRY_COMPILE([
 	],[
 	__s8 i;
 	],
-	samba_cv_BROKEN_RHEL5_SYS_CAP_HEADER=no,
-	samba_cv_BROKEN_RHEL5_SYS_CAP_HEADER=yes
+	libreplace_cv_BROKEN_RHEL5_SYS_CAP_HEADER=no,
+	libreplace_cv_BROKEN_RHEL5_SYS_CAP_HEADER=yes
 )])
-if test x"$samba_cv_BROKEN_RHEL5_SYS_CAP_HEADER" = x"yes"; then
+if test x"$libreplace_cv_BROKEN_RHEL5_SYS_CAP_HEADER" = x"yes"; then
 	AC_DEFINE(BROKEN_RHEL5_SYS_CAP_HEADER,1,[Broken RHEL5 sys/capability.h])
 fi
 ;;
diff --git a/source4/lib/replace/system/network.h b/source4/lib/replace/system/network.h
index 53bef66d48..d09e3f71f8 100644
--- a/source4/lib/replace/system/network.h
+++ b/source4/lib/replace/system/network.h
@@ -163,8 +163,15 @@ void rep_freeifaddrs(struct ifaddrs *);
 #endif
 
 #ifndef AI_ADDRCONFIG
+/*
+ * logic copied from AI_NUMERICHOST
+ */
+#if defined(HAVE_STRUCT_ADDRINFO) && defined(HAVE_GETADDRINFO)
+#define AI_ADDRCONFIG	0
+#else
 #define AI_ADDRCONFIG	0x0020
 #endif
+#endif
 
 #ifndef AI_NUMERICSERV
 /*
diff --git a/source4/lib/socket/socket_ip.c b/source4/lib/socket/socket_ip.c
index e61b6d82fc..bca0aab924 100644
--- a/source4/lib/socket/socket_ip.c
+++ b/source4/lib/socket/socket_ip.c
@@ -540,7 +540,7 @@ static const struct socket_ops ipv4_ops = {
 	.fn_get_fd		= ip_get_fd
 };
 
-const struct socket_ops *socket_ipv4_ops(enum socket_type type)
+_PUBLIC_ const struct socket_ops *socket_ipv4_ops(enum socket_type type)
 {
 	return &ipv4_ops;
 }
@@ -977,7 +977,7 @@ static const struct socket_ops ipv6_tcp_ops = {
 	.fn_get_fd		= ip_get_fd
 };
 
-const struct socket_ops *socket_ipv6_ops(enum socket_type type)
+_PUBLIC_ const struct socket_ops *socket_ipv6_ops(enum socket_type type)
 {
 	return &ipv6_tcp_ops;
 }
diff --git a/source4/lib/socket/socket_unix.c b/source4/lib/socket/socket_unix.c
index cac4b8e913..af7d2bb79f 100644
--- a/source4/lib/socket/socket_unix.c
+++ b/source4/lib/socket/socket_unix.c
@@ -414,7 +414,7 @@ static const struct socket_ops unixdom_ops = {
 	.fn_get_fd		= unixdom_get_fd
 };
 
-const struct socket_ops *socket_unixdom_ops(enum socket_type type)
+_PUBLIC_ const struct socket_ops *socket_unixdom_ops(enum socket_type type)
 {
 	return &unixdom_ops;
 }
diff --git a/source4/lib/socket_wrapper/config.m4 b/source4/lib/socket_wrapper/config.m4
index f3ffb895a9..8ff91075bb 100644
--- a/source4/lib/socket_wrapper/config.m4
+++ b/source4/lib/socket_wrapper/config.m4
@@ -20,3 +20,10 @@ fi
 AC_SUBST(DEFAULT_TEST_OPTIONS)
 AC_SUBST(HAVE_SOCKET_WRAPPER)
 AC_SUBST(SOCKET_WRAPPER_OBJS)
+
+# Look for the vdeplug library
+AC_CHECK_HEADERS(libvdeplug.h)
+if test x"$ac_cv_header_libvdeplug_h" = xyes; then
+	AC_DEFINE(HAVE_VDEPLUG, 1, [Whether the VDE plug library is available])
+	SMB_EXT_LIB(VDEPLUG,[-lvdeplug],[],[],[])
+fi
diff --git a/source4/lib/socket_wrapper/socket_wrapper.c b/source4/lib/socket_wrapper/socket_wrapper.c
index 574d8ec5e4..644365a665 100644
--- a/source4/lib/socket_wrapper/socket_wrapper.c
+++ b/source4/lib/socket_wrapper/socket_wrapper.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) Jelmer Vernooij 2005 <jelmer@samba.org>
+ * Copyright (C) Jelmer Vernooij 2005,2008 <jelmer@samba.org>
  * Copyright (C) Stefan Metzmacher 2006 <metze@samba.org>
  *
  * All rights reserved.
@@ -212,7 +212,6 @@ struct socket_info
 
 static struct socket_info *sockets;
 
-
 const char *socket_wrapper_dir(void)
 {
 	const char *s = getenv("SOCKET_WRAPPER_DIR");
@@ -908,40 +907,31 @@ static int swrap_get_pcap_fd(const char *fname)
 	return fd;
 }
 
-static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *addr,
-			      enum swrap_packet_type type,
-			      const void *buf, size_t len)
+static struct swrap_packet *swrap_marshall_packet(struct socket_info *si,
+								  const struct sockaddr *addr,
+								  enum swrap_packet_type type,
+								  const void *buf, size_t len,
+								  size_t *packet_len)
 {
 	const struct sockaddr_in *src_addr;
 	const struct sockaddr_in *dest_addr;
-	const char *file_name;
 	unsigned long tcp_seq = 0;
 	unsigned long tcp_ack = 0;
 	unsigned char tcp_ctl = 0;
 	int unreachable = 0;
-	struct timeval tv;
-	struct swrap_packet *packet;
-	size_t packet_len = 0;
-	int fd;
 
-	file_name = socket_wrapper_pcap_file();
-	if (!file_name) {
-		return;
-	}
+	struct timeval tv;
 
 	switch (si->family) {
 	case AF_INET:
-#ifdef HAVE_IPV6
-	case AF_INET6:
-#endif
 		break;
 	default:
-		return;
+		return NULL;
 	}
 
 	switch (type) {
 	case SWRAP_CONNECT_SEND:
-		if (si->type != SOCK_STREAM) return;
+		if (si->type != SOCK_STREAM) return NULL;
 
 		src_addr = (const struct sockaddr_in *)si->myname;
 		dest_addr = (const struct sockaddr_in *)addr;
@@ -955,7 +945,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		break;
 
 	case SWRAP_CONNECT_RECV:
-		if (si->type != SOCK_STREAM) return;
+		if (si->type != SOCK_STREAM) return NULL;
 
 		dest_addr = (const struct sockaddr_in *)si->myname;
 		src_addr = (const struct sockaddr_in *)addr;
@@ -969,7 +959,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		break;
 
 	case SWRAP_CONNECT_UNREACH:
-		if (si->type != SOCK_STREAM) return;
+		if (si->type != SOCK_STREAM) return NULL;
 
 		dest_addr = (const struct sockaddr_in *)si->myname;
 		src_addr = (const struct sockaddr_in *)addr;
@@ -983,7 +973,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		break;
 
 	case SWRAP_CONNECT_ACK:
-		if (si->type != SOCK_STREAM) return;
+		if (si->type != SOCK_STREAM) return NULL;
 
 		src_addr = (const struct sockaddr_in *)si->myname;
 		dest_addr = (const struct sockaddr_in *)addr;
@@ -995,7 +985,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		break;
 
 	case SWRAP_ACCEPT_SEND:
-		if (si->type != SOCK_STREAM) return;
+		if (si->type != SOCK_STREAM) return NULL;
 
 		dest_addr = (const struct sockaddr_in *)si->myname;
 		src_addr = (const struct sockaddr_in *)addr;
@@ -1009,7 +999,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		break;
 
 	case SWRAP_ACCEPT_RECV:
-		if (si->type != SOCK_STREAM) return;
+		if (si->type != SOCK_STREAM) return NULL;
 
 		src_addr = (const struct sockaddr_in *)si->myname;
 		dest_addr = (const struct sockaddr_in *)addr;
@@ -1023,7 +1013,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		break;
 
 	case SWRAP_ACCEPT_ACK:
-		if (si->type != SOCK_STREAM) return;
+		if (si->type != SOCK_STREAM) return NULL;
 
 		dest_addr = (const struct sockaddr_in *)si->myname;
 		src_addr = (const struct sockaddr_in *)addr;
@@ -1051,10 +1041,9 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		src_addr = (const struct sockaddr_in *)si->peername;
 
 		if (si->type == SOCK_DGRAM) {
-			swrap_dump_packet(si, si->peername,
+			return swrap_marshall_packet(si, si->peername,
 					  SWRAP_SENDTO_UNREACH,
-			      		  buf, len);
-			return;
+			      		  buf, len, packet_len);
 		}
 
 		tcp_seq = si->io.pck_rcv;
@@ -1068,7 +1057,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		src_addr = (const struct sockaddr_in *)si->peername;
 
 		if (si->type == SOCK_DGRAM) {
-			return;
+			return NULL;
 		}
 
 		tcp_seq = si->io.pck_rcv;
@@ -1094,7 +1083,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		src_addr = (const struct sockaddr_in *)si->peername;
 
 		if (si->type == SOCK_DGRAM) {
-			return;
+			return NULL;
 		}
 
 		tcp_seq = si->io.pck_rcv;
@@ -1128,7 +1117,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		break;
 
 	case SWRAP_CLOSE_SEND:
-		if (si->type != SOCK_STREAM) return;
+		if (si->type != SOCK_STREAM) return NULL;
 
 		src_addr = (const struct sockaddr_in *)si->myname;
 		dest_addr = (const struct sockaddr_in *)si->peername;
@@ -1142,7 +1131,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		break;
 
 	case SWRAP_CLOSE_RECV:
-		if (si->type != SOCK_STREAM) return;
+		if (si->type != SOCK_STREAM) return NULL;
 
 		dest_addr = (const struct sockaddr_in *)si->myname;
 		src_addr = (const struct sockaddr_in *)si->peername;
@@ -1156,7 +1145,7 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 		break;
 
 	case SWRAP_CLOSE_ACK:
-		if (si->type != SOCK_STREAM) return;
+		if (si->type != SOCK_STREAM) return NULL;
 
 		src_addr = (const struct sockaddr_in *)si->myname;
 		dest_addr = (const struct sockaddr_in *)si->peername;
@@ -1167,15 +1156,33 @@ static void swrap_dump_packet(struct socket_info *si, const struct sockaddr *add
 
 		break;
 	default:
-		return;
+		return NULL;
 	}
 
 	swrapGetTimeOfDay(&tv);
 
-	packet = swrap_packet_init(&tv, src_addr, dest_addr, si->type,
+	return swrap_packet_init(&tv, src_addr, dest_addr, si->type,
 				   (const unsigned char *)buf, len,
 				   tcp_seq, tcp_ack, tcp_ctl, unreachable,
-				   &packet_len);
+				   packet_len);
+}
+
+static void swrap_dump_packet(struct socket_info *si, 
+							  const struct sockaddr *addr,
+							  enum swrap_packet_type type,
+							  const void *buf, size_t len)
+{
+	const char *file_name;
+	struct swrap_packet *packet;
+	size_t packet_len = 0;
+	int fd;
+
+	file_name = socket_wrapper_pcap_file();
+	if (!file_name) {
+		return;
+	}
+
+	packet = swrap_marshall_packet(si, addr, type, buf, len, &packet_len);
 	if (!packet) {
 		return;
 	}
diff --git a/source4/lib/talloc/web/index.html b/source4/lib/talloc/web/index.html
index e53e8960a8..628030ad4c 100644
--- a/source4/lib/talloc/web/index.html
+++ b/source4/lib/talloc/web/index.html
@@ -24,19 +24,20 @@ bugzilla</a> bug tracking system.
 
 <h2>Download</h2>
 
-You can download the latest release either via rsync or anonymous
-svn. To fetch via svn use the following command:
+You can download the latest release either via rsync or git.
+To fetch via git use the following command:
 
 <pre>
-  svn co svn://svnanon.samba.org/samba/branches/SAMBA_4_0/source/lib/talloc talloc
-  svn co svn://svnanon.samba.org/samba/branches/SAMBA_4_0/source/lib/replace libreplace
+  git-clone git://git.samba.org/samba.git samba
+  cd samba
+  git checkout -b samba4 origin/v4-0-test
 </pre>
 
 To fetch via rsync use this command:
 
 <pre>
-  rsync -Pavz samba.org::ftp/unpacked/samba4/source/lib/talloc .
-  rsync -Pavz samba.org::ftp/unpacked/samba4/source/lib/libreplace .
+  rsync -Pavz samba.org::ftp/unpacked/samba_4_0_test/source/lib/talloc .
+  rsync -Pavz samba.org::ftp/unpacked/samba_4_0_test/source/lib/libreplace .
 </pre>
 
 <hr>
diff --git a/source4/lib/tdr/tdr.c b/source4/lib/tdr/tdr.c
index f75cac9810..2ad099174d 100644
--- a/source4/lib/tdr/tdr.c
+++ b/source4/lib/tdr/tdr.c
@@ -154,7 +154,7 @@ NTSTATUS tdr_pull_charset(struct tdr_pull *tdr, TALLOC_CTX *ctx, const char **v,
 
 	TDR_PULL_NEED_BYTES(tdr, el_size*length);
 	
-	ret = convert_string_talloc(ctx, lp_iconv_convenience(global_loadparm), chset, CH_UNIX, tdr->data.data+tdr->offset, el_size*length, discard_const_p(void *, v));
+	ret = convert_string_talloc(ctx, tdr->iconv_convenience, chset, CH_UNIX, tdr->data.data+tdr->offset, el_size*length, discard_const_p(void *, v));
 
 	if (ret == -1) {
 		return NT_STATUS_INVALID_PARAMETER;
diff --git a/source4/lib/util/attr.h b/source4/lib/util/attr.h
index 8f6c4f5d8a..f64b272a67 100644
--- a/source4/lib/util/attr.h
+++ b/source4/lib/util/attr.h
@@ -29,13 +29,11 @@
 /** Feel free to add definitions for other compilers here. */
 #endif
 
-#ifndef _PUBLIC_
 #ifdef HAVE_VISIBILITY_ATTR
 #  define _PUBLIC_ __attribute__((visibility("default")))
 #else
 #  define _PUBLIC_
 #endif
-#endif
 
 #ifndef _DEPRECATED_
 #if (__GNUC__ >= 3) && (__GNUC_MINOR__ >= 1 )
diff --git a/source4/lib/util/ms_fnmatch.c b/source4/lib/util/ms_fnmatch.c
index 1fb57b07a4..5e04ec1f4b 100644
--- a/source4/lib/util/ms_fnmatch.c
+++ b/source4/lib/util/ms_fnmatch.c
@@ -64,8 +64,9 @@ static int ms_fnmatch_core(const char *p, const char *n,
 	codepoint_t c, c2;
 	int i;
 	size_t size, size_n;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
-	while ((c = next_codepoint(lp_iconv_convenience(global_loadparm), p, &size))) {
+	while ((c = next_codepoint(iconv_convenience, p, &size))) {
 		p += size;
 
 		switch (c) {
@@ -75,7 +76,7 @@ static int ms_fnmatch_core(const char *p, const char *n,
 				return null_match(p);
 			}
 			for (i=0; n[i]; i += size_n) {
-				next_codepoint(lp_iconv_convenience(global_loadparm), n+i, &size_n);
+				next_codepoint(iconv_convenience, n+i, &size_n);
 				if (ms_fnmatch_core(p, n+i, max_n+1, ldot) == 0) {
 					return 0;
 				}
@@ -94,7 +95,7 @@ static int ms_fnmatch_core(const char *p, const char *n,
 				return -1;
 			}
 			for (i=0; n[i]; i += size_n) {
-				next_codepoint(lp_iconv_convenience(global_loadparm), n+i, &size_n);
+				next_codepoint(iconv_convenience, n+i, &size_n);
 				if (ms_fnmatch_core(p, n+i, max_n+1, ldot) == 0) return 0;
 				if (n+i == ldot) {
 					if (ms_fnmatch_core(p, n+i+size_n, max_n+1, ldot) == 0) return 0;
@@ -110,7 +111,7 @@ static int ms_fnmatch_core(const char *p, const char *n,
 			if (! *n) {
 				return -1;
 			}
-			next_codepoint(lp_iconv_convenience(global_loadparm), n, &size_n);
+			next_codepoint(iconv_convenience, n, &size_n);
 			n += size_n;
 			break;
 
@@ -124,7 +125,7 @@ static int ms_fnmatch_core(const char *p, const char *n,
 				break;
 			}
 			if (! *n) return null_match(p);
-			next_codepoint(lp_iconv_convenience(global_loadparm), n, &size_n);
+			next_codepoint(iconv_convenience, n, &size_n);
 			n += size_n;
 			break;
 
@@ -134,12 +135,12 @@ static int ms_fnmatch_core(const char *p, const char *n,
 				return 0;
 			}
 			if (*n != '.') return -1;
-			next_codepoint(lp_iconv_convenience(global_loadparm), n, &size_n);
+			next_codepoint(iconv_convenience, n, &size_n);
 			n += size_n;
 			break;
 
 		default:
-			c2 = next_codepoint(lp_iconv_convenience(global_loadparm), n, &size_n);
+			c2 = next_codepoint(iconv_convenience, n, &size_n);
 			if (c != c2 && codepoint_cmpi(c, c2) != 0) {
 				return -1;
 			}
diff --git a/source4/lib/util/util.h b/source4/lib/util/util.h
index 9e106052f2..550b60c625 100644
--- a/source4/lib/util/util.h
+++ b/source4/lib/util/util.h
@@ -21,6 +21,8 @@
 #ifndef _SAMBA_UTIL_H_
 #define _SAMBA_UTIL_H_
 
+#include "util/attr.h"
+
 #include "charset/charset.h"
 
 /* for TALLOC_CTX */
@@ -36,7 +38,6 @@ struct smbsrv_tcon;
 extern const char *logfile;
 extern const char *panic_action;
 
-#include "util/attr.h"
 #include "util/time.h"
 #include "util/data_blob.h"
 #include "util/xfile.h"
diff --git a/source4/libcli/auth/smbencrypt.c b/source4/libcli/auth/smbencrypt.c
index 4ccf568d8c..cefb55e205 100644
--- a/source4/libcli/auth/smbencrypt.c
+++ b/source4/libcli/auth/smbencrypt.c
@@ -100,7 +100,7 @@ _PUBLIC_ bool E_deshash(const char *passwd, uint8_t p16[16])
 	/* Password must be converted to DOS charset - null terminated, uppercase. */
 	push_string(lp_iconv_convenience(global_loadparm), dospwd, passwd, sizeof(dospwd), STR_ASCII|STR_UPPER|STR_TERMINATE);
 
-	/* Only the fisrt 14 chars are considered, password need not be null terminated. */
+	/* Only the first 14 chars are considered, password need not be null terminated. */
 	E_P16((const uint8_t *)dospwd, p16);
 
 	if (strlen(dospwd) > 14) {
@@ -125,6 +125,8 @@ bool ntv2_owf_gen(const uint8_t owf[16],
 
 	HMACMD5Context ctx;
 	TALLOC_CTX *mem_ctx = talloc_init("ntv2_owf_gen for %s\\%s", domain_in, user_in); 
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
+
 	if (!mem_ctx) {
 		return false;
 	}
@@ -151,14 +153,14 @@ bool ntv2_owf_gen(const uint8_t owf[16],
 		}
 	}
 
-	user_byte_len = push_ucs2_talloc(mem_ctx, lp_iconv_convenience(global_loadparm), &user, user_in);
+	user_byte_len = push_ucs2_talloc(mem_ctx, iconv_convenience, &user, user_in);
 	if (user_byte_len == (ssize_t)-1) {
 		DEBUG(0, ("push_uss2_talloc() for user returned -1 (probably talloc() failure)\n"));
 		talloc_free(mem_ctx);
 		return false;
 	}
 
-	domain_byte_len = push_ucs2_talloc(mem_ctx, lp_iconv_convenience(global_loadparm), &domain, domain_in);
+	domain_byte_len = push_ucs2_talloc(mem_ctx, iconv_convenience, &domain, domain_in);
 	if (domain_byte_len == (ssize_t)-1) {
 		DEBUG(0, ("push_ucs2_talloc() for domain returned -1 (probably talloc() failure)\n"));
 		talloc_free(mem_ctx);
@@ -294,12 +296,13 @@ void SMBsesskeygen_lm_sess_key(const uint8_t lm_hash[16],
 }
 
 DATA_BLOB NTLMv2_generate_names_blob(TALLOC_CTX *mem_ctx, 
+				     struct smb_iconv_convenience *iconv_convenience,
 				     const char *hostname, 
 				     const char *domain)
 {
 	DATA_BLOB names_blob = data_blob_talloc(mem_ctx, NULL, 0);
 	
-	msrpc_gen(mem_ctx, lp_iconv_convenience(global_loadparm), &names_blob, 
+	msrpc_gen(mem_ctx, iconv_convenience, &names_blob, 
 		  "aaa", 
 		  NTLMSSP_NAME_TYPE_DOMAIN, domain,
 		  NTLMSSP_NAME_TYPE_SERVER, hostname,
diff --git a/source4/libcli/dgram/browse.c b/source4/libcli/dgram/browse.c
index eb19555d15..14d8278635 100644
--- a/source4/libcli/dgram/browse.c
+++ b/source4/libcli/dgram/browse.c
@@ -38,7 +38,7 @@ NTSTATUS dgram_mailslot_browse_send(struct nbt_dgram_socket *dgmsock,
 	DATA_BLOB blob;
 	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
 
-	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, lp_iconv_convenience(global_loadparm), request,
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, dgmsock->iconv_convenience, request,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_browse_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
@@ -66,7 +66,7 @@ NTSTATUS dgram_mailslot_browse_reply(struct nbt_dgram_socket *dgmsock,
 	struct nbt_name myname;
 	struct socket_address *dest;
 
-	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, lp_iconv_convenience(global_loadparm), reply,
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, dgmsock->iconv_convenience, reply,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_browse_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
@@ -99,7 +99,7 @@ NTSTATUS dgram_mailslot_browse_parse(struct dgram_mailslot_handler *dgmslot,
 	DATA_BLOB data = dgram_mailslot_data(dgram);
 	enum ndr_err_code ndr_err;
 
-	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, lp_iconv_convenience(global_loadparm), pkt,
+	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, dgmslot->dgmsock->iconv_convenience, pkt,
 				      (ndr_pull_flags_fn_t)ndr_pull_nbt_browse_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
diff --git a/source4/libcli/dgram/dgramsocket.c b/source4/libcli/dgram/dgramsocket.c
index 032d9de67b..7d6f5627c5 100644
--- a/source4/libcli/dgram/dgramsocket.c
+++ b/source4/libcli/dgram/dgramsocket.c
@@ -72,7 +72,7 @@ static void dgm_socket_recv(struct nbt_dgram_socket *dgmsock)
 	}
 
 	/* parse the request */
-	ndr_err = ndr_pull_struct_blob(&blob, packet, lp_iconv_convenience(global_loadparm), packet,
+	ndr_err = ndr_pull_struct_blob(&blob, packet, dgmsock->iconv_convenience, packet,
 				      (ndr_pull_flags_fn_t)ndr_pull_nbt_dgram_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		status = ndr_map_error2ntstatus(ndr_err);
@@ -187,6 +187,7 @@ struct nbt_dgram_socket *nbt_dgram_socket_init(TALLOC_CTX *mem_ctx,
 	dgmsock->send_queue = NULL;
 	dgmsock->incoming.handler = NULL;
 	dgmsock->mailslot_handlers = NULL;
+	dgmsock->iconv_convenience = lp_iconv_convenience(global_loadparm);
 	
 	return dgmsock;
 
@@ -229,7 +230,7 @@ NTSTATUS nbt_dgram_send(struct nbt_dgram_socket *dgmsock,
 	req->dest = dest;
 	if (talloc_reference(req, dest) == NULL) goto failed;
 
-	ndr_err = ndr_push_struct_blob(&req->encoded, req, lp_iconv_convenience(global_loadparm), packet,
+	ndr_err = ndr_push_struct_blob(&req->encoded, req, dgmsock->iconv_convenience, packet,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_dgram_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		status = ndr_map_error2ntstatus(ndr_err);
diff --git a/source4/libcli/dgram/libdgram.h b/source4/libcli/dgram/libdgram.h
index 6d4cdb2bdf..4645840971 100644
--- a/source4/libcli/dgram/libdgram.h
+++ b/source4/libcli/dgram/libdgram.h
@@ -40,6 +40,7 @@ struct nbt_dgram_request {
 struct nbt_dgram_socket {
 	struct socket_context *sock;
 	struct event_context *event_ctx;
+	struct smb_iconv_convenience *iconv_convenience;
 
 	/* the fd event */
 	struct fd_event *fde;
diff --git a/source4/libcli/dgram/netlogon.c b/source4/libcli/dgram/netlogon.c
index 670af4ea63..5c7dedc7bb 100644
--- a/source4/libcli/dgram/netlogon.c
+++ b/source4/libcli/dgram/netlogon.c
@@ -41,7 +41,7 @@ NTSTATUS dgram_mailslot_netlogon_send(struct nbt_dgram_socket *dgmsock,
 	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
 
 	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, 
-				       lp_iconv_convenience(global_loadparm),
+				       dgmsock->iconv_convenience,
 				       request,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_netlogon_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -76,7 +76,7 @@ NTSTATUS dgram_mailslot_netlogon_reply(struct nbt_dgram_socket *dgmsock,
 	struct socket_address *dest;
 
 	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, 
-				       lp_iconv_convenience(global_loadparm),
+				       dgmsock->iconv_convenience,
 				       reply,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_netlogon_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -114,7 +114,7 @@ NTSTATUS dgram_mailslot_netlogon_parse(struct dgram_mailslot_handler *dgmslot,
 	DATA_BLOB data = dgram_mailslot_data(dgram);
 	enum ndr_err_code ndr_err;
 
-	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, lp_iconv_convenience(global_loadparm), netlogon,
+	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, dgmslot->dgmsock->iconv_convenience, netlogon,
 				      (ndr_pull_flags_fn_t)ndr_pull_nbt_netlogon_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
diff --git a/source4/libcli/dgram/ntlogon.c b/source4/libcli/dgram/ntlogon.c
index 98aad1af8c..7b26ed7c00 100644
--- a/source4/libcli/dgram/ntlogon.c
+++ b/source4/libcli/dgram/ntlogon.c
@@ -41,7 +41,7 @@ NTSTATUS dgram_mailslot_ntlogon_send(struct nbt_dgram_socket *dgmsock,
 	DATA_BLOB blob;
 	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
 
-	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, lp_iconv_convenience(global_loadparm), 
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, dgmsock->iconv_convenience, 
 				       request,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_ntlogon_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -75,7 +75,7 @@ NTSTATUS dgram_mailslot_ntlogon_reply(struct nbt_dgram_socket *dgmsock,
 	struct nbt_name myname;
 	struct socket_address *dest;
 
-	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, lp_iconv_convenience(global_loadparm), reply,
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, dgmsock->iconv_convenience, reply,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_ntlogon_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
@@ -113,7 +113,7 @@ NTSTATUS dgram_mailslot_ntlogon_parse(struct dgram_mailslot_handler *dgmslot,
 	DATA_BLOB data = dgram_mailslot_data(dgram);
 	enum ndr_err_code ndr_err;
 
-	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, lp_iconv_convenience(global_loadparm), ntlogon,
+	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, dgmslot->dgmsock->iconv_convenience, ntlogon,
 				      (ndr_pull_flags_fn_t)ndr_pull_nbt_ntlogon_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
diff --git a/source4/libcli/nbt/nbtname.c b/source4/libcli/nbt/nbtname.c
index 142dad0296..ae9f3f6b05 100644
--- a/source4/libcli/nbt/nbtname.c
+++ b/source4/libcli/nbt/nbtname.c
@@ -381,11 +381,11 @@ _PUBLIC_ NTSTATUS nbt_name_dup(TALLOC_CTX *mem_ctx, struct nbt_name *name, struc
 /**
   push a nbt name into a blob
 */
-_PUBLIC_ NTSTATUS nbt_name_to_blob(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, struct nbt_name *name)
+_PUBLIC_ NTSTATUS nbt_name_to_blob(TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, DATA_BLOB *blob, struct nbt_name *name)
 {
 	enum ndr_err_code ndr_err;
 
-	ndr_err = ndr_push_struct_blob(blob, mem_ctx, lp_iconv_convenience(global_loadparm), name, (ndr_push_flags_fn_t)ndr_push_nbt_name);
+	ndr_err = ndr_push_struct_blob(blob, mem_ctx, iconv_convenience, name, (ndr_push_flags_fn_t)ndr_push_nbt_name);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return ndr_map_error2ntstatus(ndr_err);
 	}
diff --git a/source4/libcli/raw/clitransport.c b/source4/libcli/raw/clitransport.c
index 288f0612de..5c14e9f9b8 100644
--- a/source4/libcli/raw/clitransport.c
+++ b/source4/libcli/raw/clitransport.c
@@ -164,14 +164,15 @@ struct smbcli_request *smbcli_transport_connect_send(struct smbcli_transport *tr
 	DATA_BLOB calling_blob, called_blob;
 	TALLOC_CTX *tmp_ctx = talloc_new(transport);
 	NTSTATUS status;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	status = nbt_name_dup(transport, called, &transport->called);
 	if (!NT_STATUS_IS_OK(status)) goto failed;
 	
-	status = nbt_name_to_blob(tmp_ctx, &calling_blob, calling);
+	status = nbt_name_to_blob(tmp_ctx, iconv_convenience, &calling_blob, calling);
 	if (!NT_STATUS_IS_OK(status)) goto failed;
 
-	status = nbt_name_to_blob(tmp_ctx, &called_blob, called);
+	status = nbt_name_to_blob(tmp_ctx, iconv_convenience, &called_blob, called);
 	if (!NT_STATUS_IS_OK(status)) goto failed;
 
   	/* allocate output buffer */
diff --git a/source4/libcli/smb_composite/fetchfile.c b/source4/libcli/smb_composite/fetchfile.c
index c7d02e323c..e4312794c9 100644
--- a/source4/libcli/smb_composite/fetchfile.c
+++ b/source4/libcli/smb_composite/fetchfile.c
@@ -147,8 +147,8 @@ struct composite_context *smb_composite_fetchfile_send(struct smb_composite_fetc
 	state->connect->in.fallback_to_anonymous = false;
 	state->connect->in.workgroup    = io->in.workgroup;
 
-	lp_smbcli_options(global_loadparm, &state->connect->in.options);
-	
+	state->connect->in.options	= io->in.options;
+
 	state->creq = smb_composite_connect_send(state->connect, state, 
 						 lp_resolve_context(global_loadparm), event_ctx);
 	if (state->creq == NULL) goto failed;
diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c
index ce7bcc143e..f5a976958d 100644
--- a/source4/libcli/smb_composite/sesssetup.c
+++ b/source4/libcli/smb_composite/sesssetup.c
@@ -223,7 +223,7 @@ static NTSTATUS session_setup_nt1(struct composite_context *c,
 	NTSTATUS nt_status;
 	struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
 	const char *password = cli_credentials_get_password(io->in.credentials);
-	DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, session->transport->socket->hostname, lp_workgroup(global_loadparm));
+	DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, lp_iconv_convenience(global_loadparm), session->transport->socket->hostname, lp_workgroup(global_loadparm));
 	DATA_BLOB session_key;
 	int flags = CLI_CRED_NTLM_AUTH;
 	if (lp_client_lanman_auth(global_loadparm)) {
@@ -290,7 +290,7 @@ static NTSTATUS session_setup_old(struct composite_context *c,
 	NTSTATUS nt_status;
 	struct sesssetup_state *state = talloc_get_type(c->private_data, struct sesssetup_state);
 	const char *password = cli_credentials_get_password(io->in.credentials);
-	DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, session->transport->socket->hostname, lp_workgroup(global_loadparm));
+	DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, lp_iconv_convenience(global_loadparm), session->transport->socket->hostname, lp_workgroup(global_loadparm));
 	DATA_BLOB session_key;
 	int flags = 0;
 	if (lp_client_lanman_auth(global_loadparm)) {
diff --git a/source4/libcli/smb_composite/smb_composite.h b/source4/libcli/smb_composite/smb_composite.h
index a732617f80..964ffb0936 100644
--- a/source4/libcli/smb_composite/smb_composite.h
+++ b/source4/libcli/smb_composite/smb_composite.h
@@ -55,6 +55,7 @@ struct smb_composite_fetchfile {
 		struct cli_credentials *credentials;
 		const char *workgroup;
 		const char *filename;
+		struct smbcli_options options;
 	} in;
 	struct {
 		uint8_t *data;
diff --git a/source4/librpc/idl/drsblobs.idl b/source4/librpc/idl/drsblobs.idl
index 1e80597f4a..eaea6aa30e 100644
--- a/source4/librpc/idl/drsblobs.idl
+++ b/source4/librpc/idl/drsblobs.idl
@@ -85,12 +85,13 @@ interface drsblobs {
 	 * w2k3 uses version 1
 	 */
 	typedef [public,gensize] struct {
-		asclstr dns_name;
+		[value(strlen(dns_name)+1)] uint32 __dns_name_size;
+		[charset(DOS)] uint8 dns_name[__dns_name_size];
 	} repsFromTo1OtherInfo;
 
 	typedef [public,gensize,flag(NDR_PAHEX)] struct {
 		/* this includes the 8 bytes of the repsFromToBlob header */
-		[value(ndr_size_repsFromTo1(r, ndr->flags)+8)] uint32 blobsize;
+		[value(ndr_size_repsFromTo1(this, ndr->flags)+8)] uint32 blobsize;
 		uint32 consecutive_sync_failures;
 		NTTIME_1sec last_success;
 		NTTIME_1sec last_attempt;
diff --git a/source4/librpc/idl/initshutdown.idl b/source4/librpc/idl/initshutdown.idl
index 868e48e28a..ac30be70dd 100644
--- a/source4/librpc/idl/initshutdown.idl
+++ b/source4/librpc/idl/initshutdown.idl
@@ -4,6 +4,8 @@
   initshutdown interface definition
 */
 
+import "lsa.idl";
+
 [ 
   uuid("894de0c0-0d55-11d3-a322-00c04fa321a1"),
   version(1.0),
@@ -12,20 +14,13 @@
   helpstring("Init shutdown service")
 ] interface initshutdown
 {
-	typedef struct {
-		[value(strlen_m_term(name))] uint32 name_size;
-		[flag(STR_LEN4|STR_NOTERM)] string name;
-	} initshutdown_String_sub;
-
-	typedef [public] struct {
-		[value(strlen_m(name->name)*2)] uint16 name_len;
-		[value(strlen_m_term(name->name)*2)] uint16 name_size;
-		initshutdown_String_sub *name;
-	} initshutdown_String;
-
 	WERROR initshutdown_Init(
 		[in,unique] uint16 *hostname,
-		[in,unique] initshutdown_String *message,
+		/*
+		 * Note: lsa_String and winreg_String both result
+		 *       in WERR_INVALID_PARAM
+		 */
+		[in,unique] lsa_StringLarge *message,
 		[in] uint32 timeout,
 		[in] uint8 force_apps,
 		[in] uint8 reboot
@@ -37,7 +32,11 @@
 
 	WERROR initshutdown_InitEx(
   		[in,unique] uint16 *hostname,
-		[in,unique] initshutdown_String *message,
+		/*
+		 * Note: lsa_String and winreg_String both result
+		 *       in WERR_INVALID_PARAM
+		 */
+		[in,unique] lsa_StringLarge *message,
 		[in] uint32 timeout,
 		[in] uint8 force_apps,
 		[in] uint8 reboot,
diff --git a/source4/librpc/idl/lsa.idl b/source4/librpc/idl/lsa.idl
index bc5ccaa78a..3159a7d16d 100644
--- a/source4/librpc/idl/lsa.idl
+++ b/source4/librpc/idl/lsa.idl
@@ -23,7 +23,7 @@ import "security.idl";
 
 	typedef [public] struct {
 		[value(2*strlen_m(string))] uint16 length;
-		[value(2*(strlen_m(string)+1))] uint16 size;
+		[value(2*strlen_m_term(string))] uint16 size;
 		[charset(UTF16),size_is(size/2),length_is(length/2)] uint16 *string;
 	} lsa_StringLarge;
 
@@ -33,14 +33,14 @@ import "security.idl";
 	} lsa_Strings;
 
 	typedef [public] struct {
-		[value(strlen(string))] uint16 length;
-		[value(strlen(string))] uint16 size;
+		[value(strlen_m(string))] uint16 length;
+		[value(strlen_m(string))] uint16 size;
 		[charset(DOS),size_is(size),length_is(length)] uint8 *string;
 	} lsa_AsciiString;
 
 	typedef [public] struct {
-		[value(strlen(string))] uint16 length;
-		[value(strlen(string)+1)] uint16 size;
+		[value(strlen_m(string))] uint16 length;
+		[value(strlen_m_term(string))] uint16 size;
 		[charset(DOS),size_is(size),length_is(length)] uint8 *string;
 	} lsa_AsciiStringLarge;
 
diff --git a/source4/librpc/idl/samr.idl b/source4/librpc/idl/samr.idl
index 2dc33fa9b9..3a11ab752c 100644
--- a/source4/librpc/idl/samr.idl
+++ b/source4/librpc/idl/samr.idl
@@ -960,7 +960,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 
 	typedef struct {
 		uint32    idx;
-		lsa_AsciiString account_name;
+		lsa_AsciiStringLarge account_name;
 	} samr_DispEntryAscii;
 
 	typedef struct {
diff --git a/source4/librpc/idl/srvsvc.idl b/source4/librpc/idl/srvsvc.idl
index 66c52fa43f..8ef49413bc 100644
--- a/source4/librpc/idl/srvsvc.idl
+++ b/source4/librpc/idl/srvsvc.idl
@@ -1127,7 +1127,16 @@ import "security.idl", "svcctl.idl";
 /* srvsvc_NetDisk         */
 /**************************/
 	typedef struct {
-		[flag(STR_LEN4)] string disk;
+		/*
+		 * In theory this should be:
+		 *      [charset(UTF16),string] uint16 annotation[3]
+		 * But midl treats this as:
+		 *      [charset(UTF16),string] uint16 annotation[]
+		 * and pidl doesn't support this yet
+		 */
+		[value(0)] uint32 __disk_offset;
+		[value(strlen(disk)+1)] uint32 __disk_length;
+		[charset(UTF16)] uint16 disk[__disk_length];
 	} srvsvc_NetDiskInfo0;
 
 	typedef struct {
diff --git a/source4/librpc/idl/winreg.idl b/source4/librpc/idl/winreg.idl
index b489e86c38..5e5d5542b6 100644
--- a/source4/librpc/idl/winreg.idl
+++ b/source4/librpc/idl/winreg.idl
@@ -2,7 +2,7 @@
   winreg interface definition
 */
 
-import "lsa.idl", "initshutdown.idl", "security.idl";
+import "lsa.idl", "security.idl";
 
 [ 
   uuid("338cd001-2244-31f1-aaaa-900038001003"),
@@ -302,7 +302,11 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/* Function: 0x18 */
 	WERROR winreg_InitiateSystemShutdown(
 		[in,unique] uint16 *hostname,
-		[in,unique] initshutdown_String *message,
+		/*
+		 * Note: lsa_String and winreg_String both result
+		 *       in WERR_INVALID_PARAM
+		 */
+		[in,unique] lsa_StringLarge *message,
 		[in]	uint32 timeout,
 		[in]	uint8 force_apps,
 		[in]	uint8 reboot
@@ -358,7 +362,11 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/* Function: 0x1e */
 	WERROR winreg_InitiateSystemShutdownEx(
 		[in,unique] uint16 *hostname,
-		[in,unique] initshutdown_String *message,
+		/*
+		 * Note: lsa_String and winreg_String both result
+		 *       in WERR_INVALID_PARAM
+		 */
+		[in,unique] lsa_StringLarge *message,
 		[in] uint32 timeout,
 		[in] uint8 force_apps,
 		[in] uint8 reboot,
diff --git a/source4/nbt_server/config.mk b/source4/nbt_server/config.mk
index 68ef56c11e..9285044768 100644
--- a/source4/nbt_server/config.mk
+++ b/source4/nbt_server/config.mk
@@ -17,7 +17,7 @@ PUBLIC_DEPENDENCIES = \
 [MODULE::ldb_wins_ldb]
 SUBSYSTEM = LIBLDB
 OUTPUT_TYPE = SHARED_LIBRARY
-INIT_FUNCTION = wins_ldb_module_init
+INIT_FUNCTION = &ldb_wins_ldb_module_ops
 OBJ_FILES = \
 		wins/wins_ldb.o
 PRIVATE_DEPENDENCIES = \
diff --git a/source4/nbt_server/wins/wins_ldb.c b/source4/nbt_server/wins/wins_ldb.c
index 47aa415667..02ea306243 100644
--- a/source4/nbt_server/wins/wins_ldb.c
+++ b/source4/nbt_server/wins/wins_ldb.c
@@ -112,16 +112,9 @@ failed:
 	return LDB_ERR_OTHER;
 }
 
-static const struct ldb_module_ops wins_ldb_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_wins_ldb_module_ops = {
 	.name          = "wins_ldb",
 	.add           = wins_ldb_verify,
 	.modify        = wins_ldb_verify,
 	.init_context  = wins_ldb_init
 };
-
-
-/* the init function */
-int wins_ldb_module_init(void)
-{
-	return ldb_register_module(&wins_ldb_ops);
-}
diff --git a/source4/nsswitch/wbinfo.c b/source4/nsswitch/wbinfo.c
index b2748833e6..7ead27939e 100644
--- a/source4/nsswitch/wbinfo.c
+++ b/source4/nsswitch/wbinfo.c
@@ -837,7 +837,7 @@ static bool wbinfo_auth_crap(struct loadparm_context *lp_ctx, char *username)
 		server_chal = data_blob(request.data.auth_crap.chal, 8); 
 		
 		/* Pretend this is a login to 'us', for blob purposes */
-		names_blob = NTLMv2_generate_names_blob(mem_ctx, lp_netbios_name(lp_ctx), lp_workgroup(lp_ctx));
+		names_blob = NTLMv2_generate_names_blob(mem_ctx, lp_iconv_convenience(lp_ctx), lp_netbios_name(lp_ctx), lp_workgroup(lp_ctx));
 		
 		if (!SMBNTLMv2encrypt(mem_ctx, name_user, name_domain, pass, &server_chal, 
 				      &names_blob,
diff --git a/source4/ntvfs/common/opendb.c b/source4/ntvfs/common/opendb.c
index 4826ca5c26..4ac10806e1 100644
--- a/source4/ntvfs/common/opendb.c
+++ b/source4/ntvfs/common/opendb.c
@@ -81,6 +81,10 @@ _PUBLIC_ struct odb_lock *odb_lock(TALLOC_CTX *mem_ctx,
 	return ops->odb_lock(mem_ctx, odb, file_key);
 }
 
+_PUBLIC_ DATA_BLOB odb_get_key(TALLOC_CTX *mem_ctx, struct odb_lock *lck)
+{
+	return ops->odb_get_key(mem_ctx, lck);
+}
 
 /*
   register an open file in the open files database. This implements the share_access
@@ -166,3 +170,9 @@ _PUBLIC_ NTSTATUS odb_can_open(struct odb_lock *lck,
 {
 	return ops->odb_can_open(lck, share_access, create_options, access_mask);
 }
+
+_PUBLIC_ NTSTATUS odb_update_oplock(struct odb_lock *lck, void *file_handle,
+				    uint32_t oplock_level)
+{
+	return ops->odb_update_oplock(lck, file_handle, oplock_level);
+}
diff --git a/source4/ntvfs/common/opendb.h b/source4/ntvfs/common/opendb.h
index 231ae3d7de..c34a07d6fa 100644
--- a/source4/ntvfs/common/opendb.h
+++ b/source4/ntvfs/common/opendb.h
@@ -24,6 +24,7 @@ struct opendb_ops {
 					struct ntvfs_context *ntvfs_ctx);
 	struct odb_lock *(*odb_lock)(TALLOC_CTX *mem_ctx,
 				     struct odb_context *odb, DATA_BLOB *file_key);
+	DATA_BLOB (*odb_get_key)(TALLOC_CTX *mem_ctx, struct odb_lock *lck);
 	NTSTATUS (*odb_open_file)(struct odb_lock *lck, void *file_handle,
 				  uint32_t stream_id, uint32_t share_access, 
 				  uint32_t access_mask, bool delete_on_close,
@@ -40,8 +41,14 @@ struct opendb_ops {
 	NTSTATUS (*odb_can_open)(struct odb_lock *lck,
 				 uint32_t share_access, uint32_t create_options, 
 				 uint32_t access_mask);
+	NTSTATUS (*odb_update_oplock)(struct odb_lock *lck, void *file_handle,
+				      uint32_t oplock_level);
 };
 
+struct opendb_oplock_break {
+	void *file_handle;
+	uint8_t level;
+};
 
 void odb_set_ops(const struct opendb_ops *new_ops);
 void odb_tdb_init_ops(void);
diff --git a/source4/ntvfs/common/opendb_tdb.c b/source4/ntvfs/common/opendb_tdb.c
index abd9ca708b..3d4a760e2e 100644
--- a/source4/ntvfs/common/opendb_tdb.c
+++ b/source4/ntvfs/common/opendb_tdb.c
@@ -2,7 +2,8 @@
    Unix SMB/CIFS implementation.
 
    Copyright (C) Andrew Tridgell 2004
-   
+   Copyright (C) Stefan Metzmacher 2008
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
@@ -134,6 +135,12 @@ static struct odb_lock *odb_tdb_lock(TALLOC_CTX *mem_ctx,
 	return lck;
 }
 
+static DATA_BLOB odb_tdb_get_key(TALLOC_CTX *mem_ctx, struct odb_lock *lck)
+{
+	return data_blob_talloc(mem_ctx, lck->key.dptr, lck->key.dsize);
+}
+
+
 /*
   determine if two odb_entry structures conflict
 
@@ -253,12 +260,28 @@ static NTSTATUS odb_push_record(struct odb_lock *lck, struct opendb_file *file)
 /*
   send an oplock break to a client
 */
-static NTSTATUS odb_oplock_break_send(struct odb_context *odb, struct opendb_entry *e)
+static NTSTATUS odb_oplock_break_send(struct odb_context *odb,
+				      struct opendb_entry *e,
+				      uint8_t level)
 {
+	NTSTATUS status;
+	struct opendb_oplock_break op_break;
+	DATA_BLOB blob;
+
+	ZERO_STRUCT(op_break);
+
 	/* tell the server handling this open file about the need to send the client
 	   a break */
-	return messaging_send_ptr(odb->ntvfs_ctx->msg_ctx, e->server, 
-				  MSG_NTVFS_OPLOCK_BREAK, e->file_handle);
+	op_break.file_handle	= e->file_handle;
+	op_break.level		= level;
+
+	blob = data_blob_const(&op_break, sizeof(op_break));
+
+	status = messaging_send(odb->ntvfs_ctx->msg_ctx, e->server,
+				MSG_NTVFS_OPLOCK_BREAK, &blob);
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	return NT_STATUS_OK;
 }
 
 /*
@@ -312,7 +335,8 @@ static NTSTATUS odb_tdb_open_file(struct odb_lock *lck, void *file_handle,
 			   break request and suspending this call
 			   until the break is acknowledged or the file
 			   is closed */
-			odb_oplock_break_send(odb, &file.entries[i]);
+			odb_oplock_break_send(odb, &file.entries[i],
+					      OPLOCK_BREAK_TO_LEVEL_II/*TODO*/);
 			return NT_STATUS_OPLOCK_NOT_GRANTED;
 		}
 	}
@@ -336,7 +360,8 @@ static NTSTATUS odb_tdb_open_file(struct odb_lock *lck, void *file_handle,
 	   exclusive oplocks afterwards. */
 	for (i=0;i<file.num_entries;i++) {
 		if (file.entries[i].oplock_level == OPLOCK_EXCLUSIVE) {
-			odb_oplock_break_send(odb, &file.entries[i]);
+			odb_oplock_break_send(odb, &file.entries[i],
+					      OPLOCK_BREAK_TO_NONE/*TODO*/);
 			return NT_STATUS_OPLOCK_NOT_GRANTED;
 		}
 	}
@@ -439,6 +464,45 @@ static NTSTATUS odb_tdb_close_file(struct odb_lock *lck, void *file_handle)
 	return odb_push_record(lck, &file);
 }
 
+/*
+  update the oplock level of the client
+*/
+static NTSTATUS odb_tdb_update_oplock(struct odb_lock *lck, void *file_handle,
+				      uint32_t oplock_level)
+{
+	struct odb_context *odb = lck->odb;
+	struct opendb_file file;
+	int i;
+	NTSTATUS status;
+
+	status = odb_pull_record(lck, &file);
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	/* find the entry, and update it */
+	for (i=0;i<file.num_entries;i++) {
+		if (file_handle == file.entries[i].file_handle &&
+		    cluster_id_equal(&odb->ntvfs_ctx->server_id, &file.entries[i].server)) {
+			file.entries[i].oplock_level = oplock_level;
+			break;
+		}
+	}
+
+	if (i == file.num_entries) {
+		return NT_STATUS_UNSUCCESSFUL;
+	}
+
+	/* send any pending notifications, removing them once sent */
+	for (i=0;i<file.num_pending;i++) {
+		messaging_send_ptr(odb->ntvfs_ctx->msg_ctx,
+				   file.pending[i].server,
+				   MSG_PVFS_RETRY_OPEN,
+				   file.pending[i].notify_ptr);
+	}
+	file.num_pending = 0;
+
+	return odb_push_record(lck, &file);
+}
+
 
 /*
   remove a pending opendb entry
@@ -609,6 +673,7 @@ static NTSTATUS odb_tdb_can_open(struct odb_lock *lck,
 static const struct opendb_ops opendb_tdb_ops = {
 	.odb_init                = odb_tdb_init,
 	.odb_lock                = odb_tdb_lock,
+	.odb_get_key             = odb_tdb_get_key,
 	.odb_open_file           = odb_tdb_open_file,
 	.odb_open_file_pending   = odb_tdb_open_file_pending,
 	.odb_close_file          = odb_tdb_close_file,
@@ -616,7 +681,8 @@ static const struct opendb_ops opendb_tdb_ops = {
 	.odb_rename              = odb_tdb_rename,
 	.odb_set_delete_on_close = odb_tdb_set_delete_on_close,
 	.odb_get_delete_on_close = odb_tdb_get_delete_on_close,
-	.odb_can_open            = odb_tdb_can_open
+	.odb_can_open            = odb_tdb_can_open,
+	.odb_update_oplock       = odb_tdb_update_oplock
 };
 
 
diff --git a/source4/ntvfs/posix/pvfs_lock.c b/source4/ntvfs/posix/pvfs_lock.c
index b9bb58c71d..df85b2b775 100644
--- a/source4/ntvfs/posix/pvfs_lock.c
+++ b/source4/ntvfs/posix/pvfs_lock.c
@@ -53,7 +53,7 @@ struct pvfs_pending_lock {
 	struct pvfs_file *f;
 	struct ntvfs_request *req;
 	int pending_lock;
-	void *wait_handle;
+	struct pvfs_wait *wait_handle;
 	struct timeval end_time;
 };
 
diff --git a/source4/ntvfs/posix/pvfs_notify.c b/source4/ntvfs/posix/pvfs_notify.c
index 210f949395..06d2bc8e0c 100644
--- a/source4/ntvfs/posix/pvfs_notify.c
+++ b/source4/ntvfs/posix/pvfs_notify.c
@@ -268,9 +268,11 @@ NTSTATUS pvfs_notify(struct ntvfs_module_context *ntvfs,
 
 	/* if the buffer is empty then start waiting */
 	if (f->notify_buffer->num_changes == 0) {
-		void *wait_handle =
-			pvfs_wait_message(pvfs, req, -1, timeval_zero(), 
-					  pvfs_notify_end, f->notify_buffer);
+		struct pvfs_wait *wait_handle;
+		wait_handle = pvfs_wait_message(pvfs, req, -1,
+						timeval_zero(),
+						pvfs_notify_end,
+						f->notify_buffer);
 		NT_STATUS_HAVE_NO_MEMORY(wait_handle);
 		talloc_steal(req, wait_handle);
 		return NT_STATUS_OK;
diff --git a/source4/ntvfs/posix/pvfs_open.c b/source4/ntvfs/posix/pvfs_open.c
index 8558f0476a..3a8b17ab16 100644
--- a/source4/ntvfs/posix/pvfs_open.c
+++ b/source4/ntvfs/posix/pvfs_open.c
@@ -756,7 +756,7 @@ struct pvfs_open_retry {
 	struct ntvfs_module_context *ntvfs;
 	struct ntvfs_request *req;
 	union smb_open *io;
-	void *wait_handle;
+	struct pvfs_wait *wait_handle;
 	DATA_BLOB odb_locking_key;
 };
 
@@ -1447,10 +1447,24 @@ NTSTATUS pvfs_can_delete(struct pvfs_state *pvfs,
 		status = pvfs_access_check_simple(pvfs, req, name, SEC_STD_DELETE);
 	}
 
-	if (!NT_STATUS_IS_OK(status)) {
+	/*
+	 * if it's a sharing violation or we got no oplock
+	 * only keep the lock if the caller requested access
+	 * to the lock
+	 */
+	if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION) ||
+	    NT_STATUS_EQUAL(status, NT_STATUS_OPLOCK_NOT_GRANTED)) {
+		if (lckp) {
+			*lckp = lck;
+		} else {
+			talloc_free(lck);
+		}
+	} else if (!NT_STATUS_IS_OK(status)) {
 		talloc_free(lck);
-		*lckp = lck;
-	} else if (lckp != NULL) {
+		if (lckp) {
+			*lckp = NULL;
+		}
+	} else if (lckp) {
 		*lckp = lck;
 	}
 
@@ -1487,10 +1501,24 @@ NTSTATUS pvfs_can_rename(struct pvfs_state *pvfs,
 			      0,
 			      SEC_STD_DELETE);
 
-	if (!NT_STATUS_IS_OK(status)) {
+	/*
+	 * if it's a sharing violation or we got no oplock
+	 * only keep the lock if the caller requested access
+	 * to the lock
+	 */
+	if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION) ||
+	    NT_STATUS_EQUAL(status, NT_STATUS_OPLOCK_NOT_GRANTED)) {
+		if (lckp) {
+			*lckp = lck;
+		} else {
+			talloc_free(lck);
+		}
+	} else if (!NT_STATUS_IS_OK(status)) {
 		talloc_free(lck);
-		*lckp = lck;
-	} else if (lckp != NULL) {
+		if (lckp) {
+			*lckp = NULL;
+		}
+	} else if (lckp) {
 		*lckp = lck;
 	}
 
@@ -1525,6 +1553,10 @@ NTSTATUS pvfs_can_stat(struct pvfs_state *pvfs,
 			      NTCREATEX_SHARE_ACCESS_WRITE,
 			      0, 0);
 
+	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(lck);
+	}
+
 	return status;
 }
 
diff --git a/source4/ntvfs/posix/pvfs_rename.c b/source4/ntvfs/posix/pvfs_rename.c
index 3b9842db7f..5693e79314 100644
--- a/source4/ntvfs/posix/pvfs_rename.c
+++ b/source4/ntvfs/posix/pvfs_rename.c
@@ -89,6 +89,7 @@ NTSTATUS pvfs_do_rename(struct pvfs_state *pvfs, const struct pvfs_filename *nam
   resolve a wildcard rename pattern. This works on one component of the name
 */
 static const char *pvfs_resolve_wildcard_component(TALLOC_CTX *mem_ctx, 
+						   struct smb_iconv_convenience *iconv_convenience,
 						   const char *fname, 
 						   const char *pattern)
 {
@@ -108,16 +109,16 @@ static const char *pvfs_resolve_wildcard_component(TALLOC_CTX *mem_ctx,
 	while (*p2) {
 		codepoint_t c1, c2;
 		size_t c_size1, c_size2;
-		c1 = next_codepoint(lp_iconv_convenience(global_loadparm), p1, &c_size1);
-		c2 = next_codepoint(lp_iconv_convenience(global_loadparm), p2, &c_size2);
+		c1 = next_codepoint(iconv_convenience, p1, &c_size1);
+		c2 = next_codepoint(iconv_convenience, p2, &c_size2);
 		if (c2 == '?') {
-			d += push_codepoint(lp_iconv_convenience(global_loadparm), d, c1);
+			d += push_codepoint(iconv_convenience, d, c1);
 		} else if (c2 == '*') {
 			memcpy(d, p1, strlen(p1));
 			d += strlen(p1);
 			break;
 		} else {
-			d += push_codepoint(lp_iconv_convenience(global_loadparm), d, c2);
+			d += push_codepoint(iconv_convenience, d, c2);
 		}
 
 		p1 += c_size1;
@@ -138,6 +139,7 @@ static const char *pvfs_resolve_wildcard(TALLOC_CTX *mem_ctx,
 {
 	const char *base1, *base2;
 	const char *ext1, *ext2;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 	char *p;
 
 	/* break into base part plus extension */
@@ -165,8 +167,8 @@ static const char *pvfs_resolve_wildcard(TALLOC_CTX *mem_ctx,
 		return NULL;
 	}
 
-	base1 = pvfs_resolve_wildcard_component(mem_ctx, base1, base2);
-	ext1 = pvfs_resolve_wildcard_component(mem_ctx, ext1, ext2);
+	base1 = pvfs_resolve_wildcard_component(mem_ctx, iconv_convenience, base1, base2);
+	ext1 = pvfs_resolve_wildcard_component(mem_ctx, iconv_convenience, ext1, ext2);
 	if (base1 == NULL || ext1 == NULL) {
 		return NULL;
 	}
@@ -190,8 +192,8 @@ static NTSTATUS pvfs_rename_one(struct pvfs_state *pvfs,
 {
 	struct pvfs_filename *name1, *name2;
 	TALLOC_CTX *mem_ctx = talloc_new(req);
+	struct odb_lock *lck = NULL;
 	NTSTATUS status;
-	struct odb_lock *lck, *lck2;
 
 	/* resolve the wildcard pattern for this name */
 	fname2 = pvfs_resolve_wildcard(mem_ctx, fname1, fname2);
@@ -214,6 +216,7 @@ static NTSTATUS pvfs_rename_one(struct pvfs_state *pvfs,
 
 	status = pvfs_can_rename(pvfs, req, name1, &lck);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(lck);
 		goto failed;
 	}
 
@@ -221,7 +224,7 @@ static NTSTATUS pvfs_rename_one(struct pvfs_state *pvfs,
 	status = pvfs_resolve_partial(pvfs, mem_ctx, 
 				      dir_path, fname2, &name2);
 	if (NT_STATUS_IS_OK(status)) {
-		status = pvfs_can_delete(pvfs, req, name2, &lck2);
+		status = pvfs_can_delete(pvfs, req, name2, NULL);
 		if (!NT_STATUS_IS_OK(status)) {
 			goto failed;
 		}
@@ -309,7 +312,7 @@ static NTSTATUS pvfs_rename_mv(struct ntvfs_module_context *ntvfs,
 	struct pvfs_state *pvfs = ntvfs->private_data;
 	NTSTATUS status;
 	struct pvfs_filename *name1, *name2;
-	struct odb_lock *lck;
+	struct odb_lock *lck = NULL;
 
 	/* resolve the cifs name to a posix name */
 	status = pvfs_resolve_name(pvfs, req, ren->rename.in.pattern1, 
@@ -352,6 +355,7 @@ static NTSTATUS pvfs_rename_mv(struct ntvfs_module_context *ntvfs,
 
 	status = pvfs_can_rename(pvfs, req, name1, &lck);
 	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(lck);
 		return status;
 	}
 
@@ -373,7 +377,6 @@ static NTSTATUS pvfs_rename_nt(struct ntvfs_module_context *ntvfs,
 	struct pvfs_state *pvfs = ntvfs->private_data;
 	NTSTATUS status;
 	struct pvfs_filename *name1, *name2;
-	struct odb_lock *lck;
 
 	switch (ren->ntrename.in.flags) {
 	case RENAME_FLAG_RENAME:
@@ -419,7 +422,7 @@ static NTSTATUS pvfs_rename_nt(struct ntvfs_module_context *ntvfs,
 		return status;
 	}
 
-	status = pvfs_can_rename(pvfs, req, name1, &lck);
+	status = pvfs_can_rename(pvfs, req, name1, NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
diff --git a/source4/ntvfs/posix/pvfs_resolve.c b/source4/ntvfs/posix/pvfs_resolve.c
index 949fa131a4..cf74816391 100644
--- a/source4/ntvfs/posix/pvfs_resolve.c
+++ b/source4/ntvfs/posix/pvfs_resolve.c
@@ -336,12 +336,13 @@ static NTSTATUS pvfs_reduce_name(TALLOC_CTX *mem_ctx, const char **fname, uint_t
 	int i, num_components, err_count;
 	char **components;
 	char *p, *s, *ret;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	s = talloc_strdup(mem_ctx, *fname);
 	if (s == NULL) return NT_STATUS_NO_MEMORY;
 
 	for (num_components=1, p=s; *p; p += c_size) {
-		c = next_codepoint(lp_iconv_convenience(global_loadparm), p, &c_size);
+		c = next_codepoint(iconv_convenience, p, &c_size);
 		if (c == '\\') num_components++;
 	}
 
@@ -353,7 +354,7 @@ static NTSTATUS pvfs_reduce_name(TALLOC_CTX *mem_ctx, const char **fname, uint_t
 
 	components[0] = s;
 	for (i=0, p=s; *p; p += c_size) {
-		c = next_codepoint(lp_iconv_convenience(global_loadparm), p, &c_size);
+		c = next_codepoint(iconv_convenience, p, &c_size);
 		if (c == '\\') {
 			*p = 0;
 			components[++i] = p+1;
diff --git a/source4/ntvfs/posix/pvfs_setfileinfo.c b/source4/ntvfs/posix/pvfs_setfileinfo.c
index 9c78699edb..fbbb8c2d4b 100644
--- a/source4/ntvfs/posix/pvfs_setfileinfo.c
+++ b/source4/ntvfs/posix/pvfs_setfileinfo.c
@@ -142,8 +142,6 @@ static NTSTATUS pvfs_setfileinfo_rename(struct pvfs_state *pvfs,
 
 	/* if the destination exists, then check the rename is allowed */
 	if (name2->exists) {
-		struct odb_lock *lck;
-
 		if (strcmp(name2->full_name, name->full_name) == 0) {
 			/* rename to same name is null-op */
 			return NT_STATUS_OK;
@@ -153,7 +151,7 @@ static NTSTATUS pvfs_setfileinfo_rename(struct pvfs_state *pvfs,
 			return NT_STATUS_OBJECT_NAME_COLLISION;
 		}
 
-		status = pvfs_can_delete(pvfs, req, name2, &lck);
+		status = pvfs_can_delete(pvfs, req, name2, NULL);
 		if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
 			return NT_STATUS_ACCESS_DENIED;
 		}
diff --git a/source4/ntvfs/posix/pvfs_shortname.c b/source4/ntvfs/posix/pvfs_shortname.c
index 083a281819..923887debd 100644
--- a/source4/ntvfs/posix/pvfs_shortname.c
+++ b/source4/ntvfs/posix/pvfs_shortname.c
@@ -104,6 +104,8 @@ struct pvfs_mangle_context {
 
 	/* this is used to reverse the base 36 mapping */
 	unsigned char base_reverse[256];
+
+	struct smb_iconv_convenience *iconv_convenience;
 };
 
 
@@ -388,7 +390,7 @@ static bool is_legal_name(struct pvfs_mangle_context *ctx, const char *name)
 {
 	while (*name) {
 		size_t c_size;
-		codepoint_t c = next_codepoint(lp_iconv_convenience(global_loadparm), name, &c_size);
+		codepoint_t c = next_codepoint(ctx->iconv_convenience, name, &c_size);
 		if (c == INVALID_CODEPOINT) {
 			return false;
 		}
@@ -613,6 +615,8 @@ NTSTATUS pvfs_mangle_init(struct pvfs_state *pvfs)
 		return NT_STATUS_NO_MEMORY;
 	}
 
+	ctx->iconv_convenience = lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx);
+
 	/* by default have a max of 512 entries in the cache. */
 	ctx->cache_size = lp_parm_int(pvfs->ntvfs->ctx->lp_ctx, NULL, "mangle", "cachesize", 512);
 
diff --git a/source4/ntvfs/posix/pvfs_unlink.c b/source4/ntvfs/posix/pvfs_unlink.c
index ef56d99fb5..bda4014bee 100644
--- a/source4/ntvfs/posix/pvfs_unlink.c
+++ b/source4/ntvfs/posix/pvfs_unlink.c
@@ -25,94 +25,70 @@
 
 
 /*
-  unlink a stream
- */
-static NTSTATUS pvfs_unlink_stream(struct pvfs_state *pvfs, 
-				   struct ntvfs_request *req,
-				   struct pvfs_filename *name, 
-				   uint16_t attrib)
+  unlink a file
+*/
+static NTSTATUS pvfs_unlink_file(struct pvfs_state *pvfs,
+				 struct pvfs_filename *name)
 {
 	NTSTATUS status;
-	struct odb_lock *lck;
 
-	if (!name->stream_exists) {
-		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+	if (name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY) {
+		return NT_STATUS_FILE_IS_A_DIRECTORY;
 	}
 
-	/* make sure its matches the given attributes */
-	status = pvfs_match_attrib(pvfs, name, attrib, 0);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
+	if (name->st.st_nlink == 1) {
+		status = pvfs_xattr_unlink_hook(pvfs, name->full_name);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
 	}
 
-	status = pvfs_can_delete(pvfs, req, name, &lck);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
+	/* finally try the actual unlink */
+	if (unlink(name->full_name) == -1) {
+		status = pvfs_map_errno(pvfs, errno);
 	}
 
-	return pvfs_stream_delete(pvfs, name, -1);
-}
+	if (NT_STATUS_IS_OK(status)) {
+		notify_trigger(pvfs->notify_context, 
+			       NOTIFY_ACTION_REMOVED, 
+			       FILE_NOTIFY_CHANGE_FILE_NAME,
+			       name->full_name);
+	}
 
+	return status;
+}
 
 /*
   unlink one file
 */
-static NTSTATUS pvfs_unlink_one(struct pvfs_state *pvfs, 
+static NTSTATUS pvfs_unlink_one(struct pvfs_state *pvfs,
 				struct ntvfs_request *req,
-				const char *unix_path, 
-				const char *fname, uint32_t attrib)
+				union smb_unlink *unl,
+				struct pvfs_filename *name)
 {
-	struct pvfs_filename *name;
 	NTSTATUS status;
-	struct odb_lock *lck;
-
-	/* get a pvfs_filename object */
-	status = pvfs_resolve_partial(pvfs, req, 
-				      unix_path, fname, &name);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
 
 	/* make sure its matches the given attributes */
-	status = pvfs_match_attrib(pvfs, name, attrib, 0);
+	status = pvfs_match_attrib(pvfs, name,
+				   unl->unlink.in.attrib, 0);
 	if (!NT_STATUS_IS_OK(status)) {
-		talloc_free(name);
 		return status;
 	}
 
-	status = pvfs_can_delete(pvfs, req, name, &lck);
+	status = pvfs_can_delete(pvfs, req, name, NULL);
 	if (!NT_STATUS_IS_OK(status)) {
-		talloc_free(name);
 		return status;
 	}
 
-	if (name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY) {
-		talloc_free(name);
-		return NT_STATUS_FILE_IS_A_DIRECTORY;
-	}
-
-	if (name->st.st_nlink == 1) {
-		status = pvfs_xattr_unlink_hook(pvfs, name->full_name);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
+	if (name->stream_name) {
+		if (!name->stream_exists) {
+			return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 		}
-	}
-
-	/* finally try the actual unlink */
-	if (unlink(name->full_name) == -1) {
-		status = pvfs_map_errno(pvfs, errno);
-	}
 
-	if (NT_STATUS_IS_OK(status)) {
-		notify_trigger(pvfs->notify_context, 
-			       NOTIFY_ACTION_REMOVED, 
-			       FILE_NOTIFY_CHANGE_FILE_NAME,
-			       name->full_name);
+		return pvfs_stream_delete(pvfs, name, -1);
 	}
 
-	talloc_free(name);
-
-	return status;
+	return pvfs_unlink_file(pvfs, name);
 }
 
 /*
@@ -147,8 +123,8 @@ NTSTATUS pvfs_unlink(struct ntvfs_module_context *ntvfs,
 		return NT_STATUS_FILE_IS_A_DIRECTORY;
 	}
 
-	if (name->stream_name) {
-		return pvfs_unlink_stream(pvfs, req, name, unl->unlink.in.attrib);
+	if (!name->has_wildcard) {
+		return pvfs_unlink_one(pvfs, req, unl, name);
 	}
 
 	/* get list of matching files */
@@ -158,6 +134,7 @@ NTSTATUS pvfs_unlink(struct ntvfs_module_context *ntvfs,
 	}
 
 	status = NT_STATUS_NO_SUCH_FILE;
+	talloc_free(name);
 
 	ofs = 0;
 
@@ -168,10 +145,20 @@ NTSTATUS pvfs_unlink(struct ntvfs_module_context *ntvfs,
 			return NT_STATUS_OBJECT_NAME_INVALID;
 		}
 
-		status = pvfs_unlink_one(pvfs, req, pvfs_list_unix_path(dir), fname, unl->unlink.in.attrib);
+		/* get a pvfs_filename object */
+		status = pvfs_resolve_partial(pvfs, req,
+					      pvfs_list_unix_path(dir),
+					      fname, &name);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+
+		status = pvfs_unlink_one(pvfs, req, unl, name);
 		if (NT_STATUS_IS_OK(status)) {
 			total_deleted++;
 		}
+
+		talloc_free(name);
 	}
 
 	if (total_deleted > 0) {
diff --git a/source4/ntvfs/posix/pvfs_wait.c b/source4/ntvfs/posix/pvfs_wait.c
index 989985a033..291250befd 100644
--- a/source4/ntvfs/posix/pvfs_wait.c
+++ b/source4/ntvfs/posix/pvfs_wait.c
@@ -31,7 +31,7 @@ struct pvfs_wait {
 	struct pvfs_wait *next, *prev;
 	struct pvfs_state *pvfs;
 	void (*handler)(void *, enum pvfs_wait_notice);
-	void *private;
+	void *private_data;
 	int msg_type;
 	struct messaging_context *msg_ctx;
 	struct event_context *ev;
@@ -45,20 +45,23 @@ struct pvfs_wait {
   previous ntvfs handlers in the chain (such as security context)
 */
 NTSTATUS pvfs_async_setup(struct ntvfs_module_context *ntvfs,
-			  struct ntvfs_request *req, void *private)
+			  struct ntvfs_request *req, void *private_data)
 {
-	struct pvfs_wait *pwait = private;
-	pwait->handler(pwait->private, pwait->reason);
+	struct pvfs_wait *pwait = talloc_get_type(private_data,
+						  struct pvfs_wait);
+	pwait->handler(pwait->private_data, pwait->reason);
 	return NT_STATUS_OK;
 }
 
 /*
   receive a completion message for a wait
 */
-static void pvfs_wait_dispatch(struct messaging_context *msg, void *private, uint32_t msg_type, 
+static void pvfs_wait_dispatch(struct messaging_context *msg,
+			       void *private_data, uint32_t msg_type,
 			       struct server_id src, DATA_BLOB *data)
 {
-	struct pvfs_wait *pwait = private;
+	struct pvfs_wait *pwait = talloc_get_type(private_data,
+						  struct pvfs_wait);
 	struct ntvfs_request *req;
 	void *p = NULL;
 
@@ -70,7 +73,7 @@ static void pvfs_wait_dispatch(struct messaging_context *msg, void *private, uin
 		pp = (void **)data->data;
 		p = *pp;
 	}
-	if (p == NULL || p != pwait->private) {
+	if (p == NULL || p != pwait->private_data) {
 		return;
 	}
 
@@ -91,9 +94,11 @@ static void pvfs_wait_dispatch(struct messaging_context *msg, void *private, uin
   receive a timeout on a message wait
 */
 static void pvfs_wait_timeout(struct event_context *ev, 
-			      struct timed_event *te, struct timeval t, void *private)
+			      struct timed_event *te, struct timeval t,
+			      void *private_data)
 {
-	struct pvfs_wait *pwait = talloc_get_type(private, struct pvfs_wait);
+	struct pvfs_wait *pwait = talloc_get_type(private_data,
+						  struct pvfs_wait);
 	struct ntvfs_request *req = pwait->req;
 
 	pwait->reason = PVFS_WAIT_TIMEOUT;
@@ -126,12 +131,12 @@ static int pvfs_wait_destructor(struct pvfs_wait *pwait)
   if msg_type == -1 then no message is registered, and it is assumed
   that the caller handles any messaging setup needed
 */
-void *pvfs_wait_message(struct pvfs_state *pvfs, 
-			struct ntvfs_request *req, 
-			int msg_type, 
-			struct timeval end_time,
-			void (*fn)(void *, enum pvfs_wait_notice),
-			void *private)
+struct pvfs_wait *pvfs_wait_message(struct pvfs_state *pvfs,
+				    struct ntvfs_request *req,
+				    int msg_type,
+				    struct timeval end_time,
+				    void (*fn)(void *, enum pvfs_wait_notice),
+				    void *private_data)
 {
 	struct pvfs_wait *pwait;
 
@@ -140,7 +145,7 @@ void *pvfs_wait_message(struct pvfs_state *pvfs,
 		return NULL;
 	}
 
-	pwait->private = private;
+	pwait->private_data = private_data;
 	pwait->handler = fn;
 	pwait->msg_ctx = pvfs->ntvfs->ctx->msg_ctx;
 	pwait->ev = pvfs->ntvfs->ctx->event_ctx;
diff --git a/source4/ntvfs/posix/vfs_posix.h b/source4/ntvfs/posix/vfs_posix.h
index a660da329a..84c456dcfe 100644
--- a/source4/ntvfs/posix/vfs_posix.h
+++ b/source4/ntvfs/posix/vfs_posix.h
@@ -28,6 +28,8 @@
 #include "ntvfs/common/ntvfs_common.h"
 #include "dsdb/samdb/samdb.h"
 
+struct pvfs_wait;
+
 /* this is the private structure for the posix vfs backend. It is used
    to hold per-connection (per tree connect) state information */
 struct pvfs_state {
diff --git a/source4/param/loadparm.c b/source4/param/loadparm.c
index e850d82193..bad90fc74a 100644
--- a/source4/param/loadparm.c
+++ b/source4/param/loadparm.c
@@ -91,6 +91,7 @@ struct loadparm_global
 	char *szPasswdChat;
 	char *szShareBackend;
 	char *szSAM_URL;
+	char *szIDMAP_URL;
 	char *szSECRETS_URL;
 	char *szSPOOLSS_URL;
 	char *szWINS_CONFIG_URL;
@@ -119,6 +120,7 @@ struct loadparm_global
 	char *szTemplateShell;
 	char *szTemplateHomedir;
 	int bWinbindSealedPipes;
+	int bIdmapTrustedOnly;
 	char *swat_directory;
 	int tls_enabled;
 	char *tls_keyfile;
@@ -384,6 +386,7 @@ static struct parm_struct parm_table[] = {
 	{"obey pam restrictions", P_BOOL, P_GLOBAL, GLOBAL_VAR(bObeyPamRestrictions), NULL, NULL},
 	{"password server", P_LIST, P_GLOBAL, GLOBAL_VAR(szPasswordServers), NULL, NULL},
 	{"sam database", P_STRING, P_GLOBAL, GLOBAL_VAR(szSAM_URL), NULL, NULL},
+	{"idmap database", P_STRING, P_GLOBAL, GLOBAL_VAR(szIDMAP_URL), NULL, NULL},
 	{"secrets database", P_STRING, P_GLOBAL, GLOBAL_VAR(szSECRETS_URL), NULL, NULL},
 	{"spoolss database", P_STRING, P_GLOBAL, GLOBAL_VAR(szSPOOLSS_URL), NULL, NULL},
 	{"wins config database", P_STRING, P_GLOBAL, GLOBAL_VAR(szWINS_CONFIG_URL), NULL, NULL},
@@ -513,6 +516,7 @@ static struct parm_struct parm_table[] = {
 	{"winbind sealed pipes", P_BOOL, P_GLOBAL, GLOBAL_VAR(bWinbindSealedPipes), NULL, NULL },
 	{"template shell", P_STRING, P_GLOBAL, GLOBAL_VAR(szTemplateShell), NULL, NULL },
 	{"template homedir", P_STRING, P_GLOBAL, GLOBAL_VAR(szTemplateHomedir), NULL, NULL },
+	{"idmap trusted only", P_BOOL, P_GLOBAL, GLOBAL_VAR(bIdmapTrustedOnly), NULL, NULL},
 
 	{NULL, P_BOOL, P_NONE, 0, NULL, NULL}
 };
@@ -642,6 +646,7 @@ _PUBLIC_ FN_GLOBAL_STRING(lp_tls_crlfile, tls_crlfile)
 _PUBLIC_ FN_GLOBAL_STRING(lp_tls_dhpfile, tls_dhpfile)
 _PUBLIC_ FN_GLOBAL_STRING(lp_share_backend, szShareBackend)
 _PUBLIC_ FN_GLOBAL_STRING(lp_sam_url, szSAM_URL)
+_PUBLIC_ FN_GLOBAL_STRING(lp_idmap_url, szIDMAP_URL)
 _PUBLIC_ FN_GLOBAL_STRING(lp_secrets_url, szSECRETS_URL)
 _PUBLIC_ FN_GLOBAL_STRING(lp_spoolss_url, szSPOOLSS_URL)
 _PUBLIC_ FN_GLOBAL_STRING(lp_wins_config_url, szWINS_CONFIG_URL)
@@ -651,6 +656,7 @@ _PUBLIC_ FN_GLOBAL_CONST_STRING(lp_winbindd_socket_directory, szWinbinddSocketDi
 _PUBLIC_ FN_GLOBAL_CONST_STRING(lp_template_shell, szTemplateShell)
 _PUBLIC_ FN_GLOBAL_CONST_STRING(lp_template_homedir, szTemplateHomedir)
 _PUBLIC_ FN_GLOBAL_BOOL(lp_winbind_sealed_pipes, bWinbindSealedPipes)
+_PUBLIC_ FN_GLOBAL_BOOL(lp_idmap_trusted_only, bIdmapTrustedOnly)
 _PUBLIC_ FN_GLOBAL_STRING(lp_private_dir, szPrivateDir)
 _PUBLIC_ FN_GLOBAL_STRING(lp_serverstring, szServerString)
 _PUBLIC_ FN_GLOBAL_STRING(lp_lockdir, szLockDir)
@@ -2305,6 +2311,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
 	lp_do_global_parameter(lp_ctx, "auth methods:standalone", "anonymous sam_ignoredomain");
 	lp_do_global_parameter(lp_ctx, "private dir", dyn_PRIVATE_DIR);
 	lp_do_global_parameter(lp_ctx, "sam database", "sam.ldb");
+	lp_do_global_parameter(lp_ctx, "idmap database", "idmap.ldb");
 	lp_do_global_parameter(lp_ctx, "secrets database", "secrets.ldb");
 	lp_do_global_parameter(lp_ctx, "spoolss database", "spoolss.ldb");
 	lp_do_global_parameter(lp_ctx, "wins config database", "wins_config.ldb");
@@ -2380,6 +2387,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
 	lp_do_global_parameter(lp_ctx, "winbindd socket directory", dyn_WINBINDD_SOCKET_DIR);
 	lp_do_global_parameter(lp_ctx, "template shell", "/bin/false");
 	lp_do_global_parameter(lp_ctx, "template homedir", "/home/%WORKGROUP%/%ACCOUNTNAME%");
+	lp_do_global_parameter(lp_ctx, "idmap trusted only", "False");
 
 	lp_do_global_parameter(lp_ctx, "client signing", "Yes");
 	lp_do_global_parameter(lp_ctx, "server signing", "auto");
diff --git a/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm b/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
index ef3eb3dbcf..a959dc84f6 100644
--- a/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
+++ b/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
@@ -775,8 +775,7 @@ sub ParseElementPrint($$$$)
 				$self->pidl("for ($counter=0;$counter<$length;$counter++) {");
 				$self->indent;
 				$self->pidl("char *idx_$l->{LEVEL_INDEX}=NULL;");
-				$self->pidl("asprintf(&idx_$l->{LEVEL_INDEX}, \"[\%d]\", $counter);");
-				$self->pidl("if (idx_$l->{LEVEL_INDEX}) {");
+				$self->pidl("if (asprintf(&idx_$l->{LEVEL_INDEX}, \"[\%d]\", $counter) != -1) {");
 				$self->indent;
 
 				$var_name = get_array_element($var_name, $counter);
diff --git a/source4/pidl/lib/Parse/Pidl/Wireshark/Conformance.pm b/source4/pidl/lib/Parse/Pidl/Wireshark/Conformance.pm
index a240bbf9cd..5c37b4a0c4 100644
--- a/source4/pidl/lib/Parse/Pidl/Wireshark/Conformance.pm
+++ b/source4/pidl/lib/Parse/Pidl/Wireshark/Conformance.pm
@@ -74,6 +74,10 @@ Change description for the specified header field. `field' is the hf name of the
 Code to insert when generating the specified dissector. @HF@ and 
 @PARAM@ will be substituted.
 
+=item I<INCLUDE> filename
+
+Include conformance data from the specified filename in the dissector.
+
 =item I<TFS> hf_name "true string" "false string"
 
 Override the text shown when a bitmap boolean value is enabled or disabled.
@@ -326,11 +330,25 @@ sub handle_ett_field
 	unless(defined($ett)) {
 		error($pos, "incomplete ETT_FIELD command");
 		return;
-	};
+	}
 
 	push (@{$data->{ett}}, $ett);
 }
 
+sub handle_include
+{
+	my $pos = shift @_;
+	my $data = shift @_;
+	my $fn = shift @_;
+
+	unless(defined($fn)) {
+		error($pos, "incomplete INCLUDE command");
+		return;
+	}
+
+	ReadConformance($fn, $data);
+}
+
 my %field_handlers = (
 	TYPE => \&handle_type,
 	NOEMIT => \&handle_noemit, 
@@ -343,7 +361,8 @@ my %field_handlers = (
 	STRIP_PREFIX => \&handle_strip_prefix,
 	PROTOCOL => \&handle_protocol,
 	FIELD_DESCRIPTION => \&handle_fielddescription,
-	IMPORT => \&handle_import
+	IMPORT => \&handle_import,
+	INCLUDE => \&handle_include
 );
 
 sub ReadConformance($$)
diff --git a/source4/pidl/tests/wireshark-conf.pl b/source4/pidl/tests/wireshark-conf.pl
index c06ac16de4..9da5c7d1ed 100755
--- a/source4/pidl/tests/wireshark-conf.pl
+++ b/source4/pidl/tests/wireshark-conf.pl
@@ -5,7 +5,7 @@
 use strict;
 use warnings;
 
-use Test::More tests => 48;
+use Test::More tests => 49;
 use FindBin qw($RealBin);
 use lib "$RealBin";
 use Util;
@@ -35,7 +35,6 @@ test_warnings("nofile:1: Unknown command `foobar'\n",
 test_warnings("nofile:1: incomplete HF_RENAME command\n",
 	sub { parse_conf("HF_RENAME\n"); });
 
-
 is_deeply(parse_conf("HF_RENAME foo bar\n")->{hf_renames}->{foo}, 
 	{ OLDNAME => "foo", NEWNAME => "bar", POS => {FILE => "nofile", LINE => 1}, USED => 0});
 
@@ -47,6 +46,9 @@ test_warnings("nofile:1: incomplete MANUAL command\n",
 
 is_deeply(parse_conf("MANUAL foo\n"), { manual => {foo => 1}});
 
+test_errors("nofile:1: incomplete INCLUDE command\n",
+	sub { parse_conf("INCLUDE\n"); } );
+
 test_warnings("nofile:1: incomplete FIELD_DESCRIPTION command\n",
 	sub { parse_conf("FIELD_DESCRIPTION foo\n"); });
 
diff --git a/source4/samba4-knownfail b/source4/samba4-knownfail
index 651111221f..18fb4b914b 100644
--- a/source4/samba4-knownfail
+++ b/source4/samba4-knownfail
@@ -34,6 +34,5 @@ rpc.netlogon.*.GetTrustPasswords
 base.charset.*.Testing partial surrogate
 .*net.api.delshare.*				# DelShare isn't implemented yet
 rap.*netservergetinfo
-kinit with pkinit # fails with: salt type 3 not supported
 samba4.blackbox.provision.py.reprovision # Fails with entry already exists
 local.torture.provision
diff --git a/source4/samba4-quick b/source4/samba4-quick
index 796435ee16..aec9098854 100644
--- a/source4/samba4-quick
+++ b/source4/samba4-quick
@@ -1,32 +1,32 @@
-BASE-UNLINK
-BASE-ATTR
-BASE-DELETE
-BASE-TCON
-BASE-OPEN
-BASE-CHKPATH
-RAW-QFSINFO
-RAW-QFILEINFO
-RAW-SFILEINFO
-RAW-MKDIR
-RAW-SEEK
-RAW-OPEN
-RAW-WRITE
-RAW-UNLINK
-RAW-READ
-RAW-CLOSE
-RAW-IOCTL
-RAW-RENAME
-RAW-EAS
-RAW-STREAMS
-BASE-OPEN 
-RPC-ALTERCONTEXT
-RPC-JOIN
-RPC-ECHO
-RPC-SCHANNEL
-RPC-NETLOGON
-RPC-UNIXINFO
-RPC-HANDLES
-RPC-ALTERCONTEXT
-RPC-JOIN
-RPC-HANDLES
-RPC-ECHO
+base.unlink
+base.attr
+base.delete
+base.tcon
+base.open
+base.chkpath
+raw.qfsinfo
+raw.qfileinfo
+raw.sfileinfo
+raw.mkdir
+raw.seek
+raw.open
+raw.write
+raw.unlink
+raw.read
+raw.close
+raw.ioctl
+raw.rename
+raw.eas
+raw.streams
+base.open 
+rpc.altercontext
+rpc.join
+rpc.echo
+rpc.schannel
+rpc.netlogon
+rpc.unixinfo
+rpc.handles
+rpc.altercontext
+rpc.join
+rpc.handles
+rpc.echo
diff --git a/source4/samba4-skip b/source4/samba4-skip
index e3d2b182d1..541738ecc4 100644
--- a/source4/samba4-skip
+++ b/source4/samba4-skip
@@ -1,4 +1,3 @@
-base.defer_open
 base.delaywrite
 raw.composite
 raw.oplock
@@ -18,7 +17,6 @@ base.smb
 smb2.notify
 smb2.scan
 ntvfs.cifs.base.charset
-ntvfs.cifs.base.defer_open
 ntvfs.cifs.base.delaywrite
 ntvfs.cifs.base.iometer
 ntvfs.cifs.base.casetable
diff --git a/source4/scripting/ejs/smbscript.c b/source4/scripting/ejs/smbscript.c
index a4f2e1cd43..9ed4aa490f 100644
--- a/source4/scripting/ejs/smbscript.c
+++ b/source4/scripting/ejs/smbscript.c
@@ -61,8 +61,6 @@ int main(int argc, const char **argv)
 		lp_load(lp_ctx, dyn_CONFIGFILE);
 	}
 
-	ldb_global_init();
-
 	gensec_init(lp_ctx);
 	mprSetCtx(mem_ctx);
 
diff --git a/source4/scripting/libjs/provision.js b/source4/scripting/libjs/provision.js
index dc9eae8e72..3ba93debf9 100644
--- a/source4/scripting/libjs/provision.js
+++ b/source4/scripting/libjs/provision.js
@@ -389,6 +389,7 @@ function provision_default_paths(subobj)
 	paths.smbconf = lp.filename()
 	paths.shareconf = lp.get("private dir") + "/" + "share.ldb";
 	paths.samdb = lp.get("sam database");
+	paths.idmapdb = lp.get("idmap database");
 	paths.secrets = lp.get("secrets database");
 	paths.templates = lp.get("private dir") + "/" + "templates.ldb";
 	paths.keytab = "secrets.keytab";
@@ -679,6 +680,9 @@ function provision(subobj, message, blank, paths, session_info, credentials, lda
 	message("Setting up templates into " + paths.templates + "\n");
 	setup_ldb("provision_templates.ldif", info, paths.templates);
 
+	message("Setting up " + paths.idmapdb +"\n");
+	setup_ldb("idmap_init.ldif", info, paths.idmapdb);
+
 	message("Setting up sam.ldb partitions\n");
 	/* Also wipes the database */
 	setup_ldb("provision_partitions.ldif", info, paths.samdb);
diff --git a/source4/scripting/python/config.m4 b/source4/scripting/python/config.m4
index 908efd1588..2142cd9abd 100644
--- a/source4/scripting/python/config.m4
+++ b/source4/scripting/python/config.m4
@@ -54,7 +54,7 @@ fi
 
 if test x$PYTHON != x
 then
-	DISTUTILS_CFLAGS=`$PYTHON -c "from distutils import sysconfig; print '-I%s -I%s %s' % (sysconfig.get_python_inc(), sysconfig.get_python_inc(plat_specific=True), sysconfig.get_config_var('CFLAGS'))"`
+	DISTUTILS_CFLAGS=`$PYTHON -c "from distutils import sysconfig; print '-I%s -I%s %s' % (sysconfig.get_python_inc(), sysconfig.get_python_inc(plat_specific=1), sysconfig.get_config_var('CFLAGS'))"`
 	DISTUTILS_LDFLAGS=`$PYTHON -c "from distutils import sysconfig; print '%s %s -lpython%s -L%s' % (sysconfig.get_config_var('LIBS'), sysconfig.get_config_var('SYSLIBS'), sysconfig.get_config_var('VERSION'), sysconfig.get_config_var('LIBPL'))"`
 	TRY_LINK_PYTHON($DISTUTILS_LDFLAGS, $DISTUTILS_CFLAGS)
 fi
diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py
index 3e88b68509..e3c47ff4a2 100644
--- a/source4/scripting/python/samba/provision.py
+++ b/source4/scripting/python/samba/provision.py
@@ -59,6 +59,7 @@ class ProvisionPaths:
         self.hkpd = None
         self.hkpt = None
         self.samdb = None
+        self.idmapdb = None
         self.secrets = None
         self.keytab = None
         self.dns_keytab = None
@@ -202,6 +203,7 @@ def provision_paths_from_lp(lp, dnsdomain):
 
     paths.shareconf = os.path.join(private_dir, "share.ldb")
     paths.samdb = os.path.join(private_dir, lp.get("sam database") or "samdb.ldb")
+    paths.idmapdb = os.path.join(private_dir, lp.get("idmap database") or "idmap.ldb")
     paths.secrets = os.path.join(private_dir, lp.get("secrets database") or "secrets.ldb")
     paths.templates = os.path.join(private_dir, "templates.ldb")
     paths.dns = os.path.join(private_dir, dnsdomain + ".zone")
@@ -471,6 +473,24 @@ def setup_registry(path, setup_path, session_info, credentials, lp):
     assert os.path.exists(provision_reg)
     reg.diff_apply(provision_reg)
 
+def setup_idmapdb(path, setup_path, session_info, credentials, lp):
+    """Setup the idmap database.
+
+    :param path: path to the idmap database
+    :param setup_path: Function that returns a path to a setup file
+    :param session_info: Session information
+    :param credentials: Credentials
+    :param lp: Loadparm context
+    """
+    if os.path.exists(path):
+        os.unlink(path)
+
+    idmap_ldb = Ldb(path, session_info=session_info, credentials=credentials,
+                    lp=lp)
+
+    idmap_ldb.erase()
+    idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
+    return idmap_ldb
 
 def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
                         dnsdomain, realm, rootdn, configdn, netbiosname,
@@ -844,6 +864,10 @@ def provision(lp, setup_dir, message, paths, session_info,
     setup_templatesdb(paths.templates, setup_path, session_info=session_info, 
                       credentials=credentials, lp=lp)
 
+    message("Setting up idmap db")
+    setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
+                  credentials=credentials, lp=lp)
+
     samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
                         credentials=credentials, lp=lp, schemadn=schemadn, 
                         configdn=configdn, domaindn=domaindn,
diff --git a/source4/selftest/config.mk b/source4/selftest/config.mk
index 7f8f211588..4e9d31b684 100644
--- a/source4/selftest/config.mk
+++ b/source4/selftest/config.mk
@@ -10,6 +10,12 @@ SELFTEST = $(LD_LIBPATH_OVERRIDE) $(PERL) $(srcdir)/selftest/selftest.pl --prefi
 test:: everything
 	$(SELFTEST) $(DEFAULT_TEST_OPTIONS) --immediate $(TESTS)
 
+kvmtest:: everything
+	$(SELFTEST) $(DEFAULT_TEST_OPTIONS) --immediate --target=kvm --image=$(KVM_IMAGE)
+
+kvmquicktest:: everything
+	$(SELFTEST) $(DEFAULT_TEST_OPTIONS) --immediate --quick --target=kvm --image=$(KVM_IMAGE)
+
 testone:: everything
 	$(SELFTEST) $(DEFAULT_TEST_OPTIONS) --one $(TESTS)
 
diff --git a/source4/selftest/samba4_tests.sh b/source4/selftest/samba4_tests.sh
index d86c46432e..32386e5b9e 100755
--- a/source4/selftest/samba4_tests.sh
+++ b/source4/selftest/samba4_tests.sh
@@ -50,8 +50,9 @@ plansmbtorturetest() {
 	name=$1
 	env=$2
 	shift 2
+	other_args="$*"
 	modname=`normalize_testname $name`
-	cmdline="$VALGRIND $smb4torture $* $name"
+	cmdline="$VALGRIND $smb4torture $other_args $name"
 	plantest "$modname" "$env" $cmdline
 }
 
@@ -215,12 +216,13 @@ done
 plantest "rpc.echo on ncacn_np over smb2" dc $smb4torture ncacn_np:"\$SERVER[smb2]" -U"\$USERNAME"%"\$PASSWORD" -W \$DOMAIN RPC-ECHO "$*"
 
 # Tests against the NTVFS POSIX backend
+NTVFSARGS="--option=torture:sharedelay=100000"
 smb2=`$smb4torture --list | grep "^SMB2-" | xargs`
 raw=`$smb4torture --list | grep "^RAW-" | xargs`
 base=`$smb4torture --list | grep "^BASE-" | xargs`
 
 for t in $base $raw $smb2; do
-    plansmbtorturetest "$t" dc $ADDARGS //\$SERVER/tmp -U"\$USERNAME"%"\$PASSWORD"
+    plansmbtorturetest "$t" dc $ADDARGS //\$SERVER/tmp -U"\$USERNAME"%"\$PASSWORD" $NTVFSARGS
 done
 
 rap=`$smb4torture --list | grep "^RAP-" | xargs`
@@ -230,13 +232,13 @@ done
 
 # Tests against the NTVFS CIFS backend
 for t in $base $raw; do
-    plantest "ntvfs.cifs.`normalize_testname $t`" dc $VALGRIND $smb4torture //\$NETBIOSNAME/cifs -U"\$USERNAME"%"\$PASSWORD" $t
+    plantest "ntvfs.cifs.`normalize_testname $t`" dc $VALGRIND $smb4torture //\$NETBIOSNAME/cifs -U"\$USERNAME"%"\$PASSWORD" $NTVFSARGS $t
 done
 
 # Local tests
 
 for t in `$smb4torture --list | grep "^LOCAL-" | xargs`; do
-	plansmbtorturetest "$t" none $VALGRIND $smb4torture ncalrpc: "$*"
+	plansmbtorturetest "$t" none ncalrpc: "$*"
 done
 
 if test -f $samba4bindir/tdbtorture
@@ -293,7 +295,7 @@ plantest "wbinfo -a against member server with domain creds" member $VALGRIND $s
 NBT_TESTS=`$smb4torture --list | grep "^NBT-" | xargs`
 
 for t in $NBT_TESTS; do
-	plansmbtorturetest "$t" dc //\$SERVER/_none_ $f -U\$USERNAME%\$PASSWORD 
+	plansmbtorturetest "$t" dc //\$SERVER/_none_ -U\$USERNAME%\$PASSWORD 
 done
 
 WB_OPTS="--option=\"torture:strict mode=yes\""
diff --git a/source4/selftest/selftest.pl b/source4/selftest/selftest.pl
index aab2ca8f07..73d03f3d4c 100755
--- a/source4/selftest/selftest.pl
+++ b/source4/selftest/selftest.pl
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 # Bootstrap Samba and run a number of tests against it.
-# Copyright (C) 2005-2007 Jelmer Vernooij <jelmer@samba.org>
+# Copyright (C) 2005-2008 Jelmer Vernooij <jelmer@samba.org>
 # Published under the GNU GPL, v3 or later.
 
 =pod
@@ -13,7 +13,7 @@ selftest - Samba test runner
 
 selftest --help
 
-selftest [--srcdir=DIR] [--builddir=DIR] [--target=samba4|samba3|win] [--socket-wrapper] [--quick] [--exclude=FILE] [--include=FILE] [--one] [--prefix=prefix] [--immediate] [--testlist=FILE] [TESTS]
+selftest [--srcdir=DIR] [--builddir=DIR] [--target=samba4|samba3|win|kvm] [--socket-wrapper] [--quick] [--exclude=FILE] [--include=FILE] [--one] [--prefix=prefix] [--immediate] [--testlist=FILE] [TESTS]
 
 =head1 DESCRIPTION
 
@@ -43,7 +43,7 @@ Change directory to run tests in. Default is 'st'.
 
 Show errors as soon as they happen rather than at the end of the test run.
 		
-=item I<--target samba4|samba3|win>
+=item I<--target samba4|samba3|win|kvm>
 
 Specify test target against which to run. Default is 'samba4'.
 
@@ -144,6 +144,7 @@ my $opt_expected_failures = undef;
 my @opt_exclude = ();
 my @opt_include = ();
 my $opt_verbose = 0;
+my $opt_image = undef;
 my $opt_testenv = 0;
 my $ldap = undef;
 my $opt_analyse_cmd = undef;
@@ -203,7 +204,7 @@ sub getlog_env($);
 
 sub setup_pcap($)
 {
-	my ($state, $name) = @_;
+	my ($name) = @_;
 
 	return unless ($opt_socket_wrapper_pcap);
 	return unless defined($ENV{SOCKET_WRAPPER_PCAP_DIR});
@@ -280,7 +281,7 @@ Usage: $Script [OPTIONS] PREFIX
 
 Generic options:
  --help                     this help page
- --target=samba4|samba3|win Samba version to target
+ --target=samba[34]|win|kvm Samba version to target
  --testlist=FILE			file to read available tests from
 
 Paths:
@@ -301,6 +302,9 @@ Samba4 Specific:
 Samba3 Specific:
  --bindir=PATH              path to binaries
 
+Kvm Specific:
+ --image=PATH               path to KVM image
+
 Behaviour:
  --quick                    run quick overall test
  --one                      abort when the first test fails
@@ -334,6 +338,7 @@ my $result = GetOptions (
 		'resetup-environment' => \$opt_resetup_env,
 		'bindir:s' => \$opt_bindir,
 		'format=s' => \$opt_format,
+		'image=s' => \$opt_image,
 		'testlist=s' => \@testlists
 	    );
 
@@ -442,6 +447,37 @@ if ($opt_target eq "samba4") {
 	$testenv_default = "dc";
 	require target::Windows;
 	$target = new Windows();
+} elsif ($opt_target eq "kvm") {
+	die("Kvm tests will not run with socket wrapper enabled.") 
+		if ($opt_socket_wrapper);
+	require target::Kvm;
+	die("No image specified") unless ($opt_image);
+	$target = new Kvm($opt_image, undef);
+}
+
+#
+# Start a Virtual Distributed Ethernet Switch
+# Returns the pid of the switch.
+#
+sub start_vde_switch($)
+{
+	my ($path) = @_;
+
+	system("vde_switch --pidfile $path/vde.pid --sock $path/vde.sock --daemon");
+
+	open(PID, "$path/vde.pid");
+	<PID> =~ /([0-9]+)/;
+	my $pid = $1;
+	close(PID);
+
+	return $pid;
+}
+
+# Stop a Virtual Distributed Ethernet Switch
+sub stop_vde_switch($)
+{
+	my ($pid) = @_;
+	kill 9, $pid;
 }
 
 sub read_test_regexes($)
@@ -522,11 +558,13 @@ sub write_clientconf($$)
 	if (defined($vars->{WINBINDD_SOCKET_DIR})) {
 		print CF "\twinbindd socket directory = $vars->{WINBINDD_SOCKET_DIR}\n";
 	}
+	if ($opt_socket_wrapper) {
+		print CF "\tinterfaces = $interfaces\n";
+	}
 	print CF "
 	private dir = $prefix_abs/client/private
 	js include = $srcdir_abs/scripting/libjs
 	name resolve order = bcast
-	interfaces = $interfaces
 	panic action = $srcdir_abs/script/gdb_backtrace \%PID\% \%PROG\%
 	max xmit = 32K
 	notify:inotify = false
diff --git a/source4/selftest/target/Kvm.pm b/source4/selftest/target/Kvm.pm
new file mode 100644
index 0000000000..3b17a2909c
--- /dev/null
+++ b/source4/selftest/target/Kvm.pm
@@ -0,0 +1,167 @@
+#!/usr/bin/perl
+# Start a KVM machine and run a number of tests against it.
+# Copyright (C) 2005-2008 Jelmer Vernooij <jelmer@samba.org>
+# Published under the GNU GPL, v3 or later.
+
+package Kvm;
+
+use strict;
+use Cwd qw(abs_path);
+use FindBin qw($RealBin);
+use POSIX;
+
+sub new($$$$) {
+	my ($classname, $dc_image, $vdesocket) = @_;
+	my $self = { 
+		dc_image => $dc_image,
+		vdesocket => $vdesocket,
+	};
+	bless $self;
+	return $self;
+}
+
+sub write_kvm_ifup($$$)
+{
+	my ($self, $path, $ip_prefix) = @_;
+	open(SCRIPT, ">$path/kvm-ifup");
+
+	print SCRIPT <<__EOF__;
+#!/bin/sh
+
+PREFIX=$ip_prefix
+
+/sbin/ifconfig \$1 \$PREFIX.1 up
+
+cat <<EOF>$path/udhcpd.conf
+interface \$1
+start 		\$PREFIX.20
+end		\$PREFIX.20
+max_leases 1
+lease_file	$path/udhcpd.leases
+pidfile	$path/udhcpd.pid
+EOF
+
+touch $path/udhcpd.leases
+
+/usr/sbin/udhcpd $path/udhcpd.conf
+
+exit 0
+__EOF__
+	close(SCRIPT);
+	chmod(0755, "$path/kvm-ifup");
+
+	return ("$path/kvm-ifup", "$path/udhcpd.pid", "$ip_prefix.20");
+}
+
+sub teardown_env($$)
+{
+	my ($self, $envvars) = @_;
+
+	print "Killing kvm instance $envvars->{KVM_PID}\n";
+
+	kill 9, $envvars->{KVM_PID};
+
+	if (defined($envvars->{DHCPD_PID})) {
+		print "Killing dhcpd instance $envvars->{DHCPD_PID}\n";
+		kill 9, $envvars->{DHCPD_PID};
+	}
+
+	return 0;
+}
+
+sub getlog_env($$)
+{
+	my ($self, $envvars) = @_;
+
+	return "";
+}
+
+sub check_env($$)
+{
+	my ($self, $envvars) = @_;
+
+	# FIXME: Check whether $self->{pid} is still running
+
+	return 1;
+}
+
+sub read_pidfile($)
+{
+	my ($path) = @_;
+
+	open(PID, $path);
+	<PID> =~ /([0-9]+)/;
+	my ($pid) = $1;
+	close(PID);
+	return $pid;
+}
+
+sub start($$$)
+{
+	my ($self, $path, $image) = @_;
+
+	my $pidfile = "$path/kvm.pid";
+
+	my $opts = (defined($ENV{KVM_OPTIONS})?$ENV{KVM_OPTIONS}:"-nographic");
+
+	if (defined($ENV{KVM_SNAPSHOT})) {
+		$opts .= " -loadvm $ENV{KVM_SNAPSHOT}";
+	}
+
+	my $netopts;
+	my $dhcp_pid;
+	my $ip_address;
+
+	if ($self->{vdesocket}) {
+		$netopts = "vde,socket=$self->{vdesocket}";
+	} else {
+		my $ifup_script, $dhcpd_pidfile;
+		($ifup_script, $dhcpd_pidfile, $ip_address) = $self->write_kvm_ifup($path, "192.168.9");
+		$netopts = "tap,script=$ifup_script";
+		$dhcp_pid = read_pidfile($dhcpd_pidfile);
+	}
+
+	system("kvm -name \"Samba 4 Test Subject\" $opts -monitor unix:$path/kvm.monitor,server,nowait -daemonize -pidfile $pidfile -snapshot $image -net nic -net $netopts");
+
+	return (read_pidfile($pidfile), $dhcp_pid, $ip_address);
+}
+
+sub setup_env($$$)
+{
+	my ($self, $envname, $path) = @_;
+
+	if ($envname eq "dc") {
+		($self->{dc_pid}, $self->{dc_dhcpd_pid}, $self->{dc_ip}) = $self->start($path, $self->{dc_image});
+
+		sub choose_var($$) { 
+			my ($name, $default) = @_; 
+			return defined($ENV{"KVM_DC_$name"})?$ENV{"KVM_DC_$name"}:$default; 
+		}
+
+		if ($envname eq "dc") {
+			return {
+				KVM_PID => $self->{dc_pid},
+				DHCPD_PID => $self->{dc_dhcpd_pid},
+				USERNAME => choose_var("USERNAME", "Administrator"),
+				PASSWORD => choose_var("PASSWORD", "penguin"),
+				DOMAIN => choose_var("DOMAIN", "SAMBA"), 
+				REALM => choose_var("REALM", "SAMBA"), 
+				SERVER => choose_var("SERVER", "DC"), 
+				SERVER_IP => $self->{dc_ip},
+				NETBIOSNAME => choose_var("NETBIOSNAME", "DC"), 
+				NETBIOSALIAS => choose_var("NETBIOSALIAS", "DC"), 
+			};
+		} else {
+			return undef;
+		}
+	} else {
+		return undef;
+	}
+}
+
+sub stop($)
+{
+	my ($self) = @_;
+}
+
+1;
diff --git a/source4/selftest/target/Samba4.pm b/source4/selftest/target/Samba4.pm
index 563aca876e..37e3cbe354 100644
--- a/source4/selftest/target/Samba4.pm
+++ b/source4/selftest/target/Samba4.pm
@@ -676,10 +676,10 @@ nogroup:x:65534:nobody
 	push (@provision_options, "NSS_WRAPPER_GROUP=\"$nsswrap_group\"");
 	if (defined($ENV{PROVISION_EJS})) {
 		push (@provision_options, "$self->{bindir}/smbscript");
-		push (@provision_options, "$self->{setupdir}/provision");
+		push (@provision_options, "$self->{setupdir}/provision.js");
 	} else {
 		push (@provision_options, "$self->{bindir}/smbpython");
-		push (@provision_options, "$self->{setupdir}/provision.py");
+		push (@provision_options, "$self->{setupdir}/provision");
 	}
 	push (@provision_options, split(' ', $configuration));
 	push (@provision_options, "--host-name=$netbiosname");
@@ -729,9 +729,10 @@ nogroup:x:65534:nobody
 
 	        if ($self->{ldap} eq "openldap") {
 		       ($ret->{SLAPD_CONF}, $ret->{OPENLDAP_PIDFILE}) = $self->mk_openldap($ldapdir, $configuration) or die("Unable to create openldap directories");
+		       push (@provision_options, "--ldap-backend-type=openldap");
 	        } elsif ($self->{ldap} eq "fedora-ds") {
 		       ($ret->{FEDORA_DS_DIR}, $ret->{FEDORA_DS_PIDFILE}) = $self->mk_fedora_ds($ldapdir, $configuration) or die("Unable to create fedora ds directories");
-		       push (@provision_options, "--ldap-module=nsuniqueid");
+		       push (@provision_options, "--ldap-backend-type=fedora-ds");
 		       push (@provision_options, "'--aci=aci:: KHRhcmdldGF0dHIgPSAiKiIpICh2ZXJzaW9uIDMuMDthY2wgImZ1bGwgYWNjZXNzIHRvIGFsbCBieSBhbGwiO2FsbG93IChhbGwpKHVzZXJkbiA9ICJsZGFwOi8vL2FueW9uZSIpOykK'");
                  }
 
diff --git a/source4/setup/idmap_init.ldif b/source4/setup/idmap_init.ldif
new file mode 100644
index 0000000000..a397cfd0d2
--- /dev/null
+++ b/source4/setup/idmap_init.ldif
@@ -0,0 +1,5 @@
+dn: CN=CONFIG
+cn: CONFIG
+lowerBound: 10000
+upperBound: 20000
+
diff --git a/source4/setup/provision b/source4/setup/provision
index 9e135cddbb..033d2491f2 100755
--- a/source4/setup/provision
+++ b/source4/setup/provision
@@ -1,194 +1,170 @@
-#!/bin/sh
-exec smbscript "$0" ${1+"$@"}
-/*
-	provision a Samba4 server
-	Copyright Andrew Tridgell 2005
-	Released under the GNU GPL v2 or later
-*/
-
-options = GetOptions(ARGV,
-		"POPT_AUTOHELP",
-		"POPT_COMMON_SAMBA",
-		"POPT_COMMON_VERSION",
-		"POPT_COMMON_CREDENTIALS",
-		'realm=s',
-		'domain=s',
-		'domain-guid=s',
-		'domain-sid=s',
-		'policy-guid=s',
-		'host-name=s',
-		'host-ip=s',
-		'host-guid=s',
-		'invocationid=s',
-		'adminpass=s',
-		'krbtgtpass=s',
-		'machinepass=s',
-		'dnspass=s',
-		'root=s',
-		'nobody=s',
-		'nogroup=s',
-		'wheel=s',
-		'users=s',
-		'quiet',
-		'blank',
-		'server-role=s',
-		'partitions-only',
-		'ldap-base',
-		'ldap-backend=s',
-                'ldap-module=s',
-                'aci=s');
-
-if (options == undefined) {
-   println("Failed to parse options");
-   return -1;
-}
-
-libinclude("base.js");
-libinclude("provision.js");
-
-/*
-  print a message if quiet is not set
-*/
-function message()
-{
-	if (options["quiet"] == undefined) {
-		print(vsprintf(arguments));
-	}
-}
-
-/*
- show some help
-*/
-function ShowHelp()
-{
-	print("
-Samba4 provisioning
-
-provision [options]
- --realm	REALM		set realm
- --domain	DOMAIN		set domain
- --domain-guid	GUID		set domainguid (otherwise random)
- --domain-sid	SID		set domainsid (otherwise random)
- --host-name	HOSTNAME	set hostname
- --host-ip	IPADDRESS	set ipaddress
- --host-guid	GUID		set hostguid (otherwise random)
- --policy-guid  GUID            set group policy guid (otherwise random)
- --invocationid	GUID		set invocationid (otherwise random)
- --adminpass	PASSWORD	choose admin password (otherwise random)
- --krbtgtpass	PASSWORD	choose krbtgt password (otherwise random)
- --machinepass	PASSWORD	choose machine password (otherwise random)
- --root         USERNAME	choose 'root' unix username
- --nobody	USERNAME	choose 'nobody' user
- --nogroup	GROUPNAME	choose 'nogroup' group
- --wheel	GROUPNAME	choose 'wheel' privileged group
- --users	GROUPNAME	choose 'users' group
- --quiet			Be quiet
- --blank			do not add users or groups, just the structure
- --server-role  ROLE            Set server role to provision for (default standalone)
- --partitions-only              Configure Samba's partitions, but do not modify them (ie, join a BDC)
- --ldap-base			output only an LDIF file, suitable for creating an LDAP baseDN
- --ldap-backend LDAPSERVER      LDAP server to use for this provision
- --ldap-module  MODULE          LDB mapping module to use for the LDAP backend
- --aci          ACI             An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server
-You must provide at least a realm and domain
-
-");
-	exit(1);
-}
-
-if (options['host-name'] == undefined) {
-	options['host-name'] = hostname();
-}
-
-/*
-   main program
-*/
-if (options["realm"] == undefined ||
-    options["domain"] == undefined ||
-    options["host-name"] == undefined) {
-	ShowHelp();
-}
-
-/* cope with an initially blank smb.conf */
-var lp = loadparm_init();
-lp.set("realm", options.realm);
-lp.set("workgroup", options.domain);
-lp.set("server role", options["server-role"]);
-lp.reload();
-
-var subobj = provision_guess();
-for (r in options) {
-	var key = strupper(join("", split("-", r)));
-	subobj[key] = options[r];
-}
-
-var blank = (options["blank"] != undefined);
-var ldapbackend = (options["ldap-backend"] != undefined);
-var ldapmodule = (options["ldap-module"] != undefined);
-var partitions_only = (options["partitions-only"] != undefined);
-var paths = provision_default_paths(subobj);
-if (options["aci"] != undefined) {
-	message("set ACI: %s\n", subobj["ACI"]);
-}
-
-message("set DOMAIN SID: %s\n", subobj["DOMAINSID"]);
-
-provision_fix_subobj(subobj, paths);
-
-if (ldapbackend) {
-	if (options["ldap-backend"] == "ldapi") {
-		subobj.LDAPBACKEND = subobj.LDAPI_URI;
-	}
-	if (!ldapmodule) {
-		subobj.LDAPMODULE = "normalise,entryuuid";
-		subobj.TDB_MODULES_LIST = "";
-	}
-	subobj.BACKEND_MOD = subobj.LDAPMODULE + ",paged_searches";
-	subobj.DOMAINDN_LDB = subobj.LDAPBACKEND;
-	subobj.CONFIGDN_LDB = subobj.LDAPBACKEND;
-	subobj.SCHEMADN_LDB = subobj.LDAPBACKEND;
-	message("LDAP module: %s on backend: %s\n", subobj.LDAPMODULE, subobj.LDAPBACKEND);
-}
-
-if (!provision_validate(subobj, message)) {
-	return -1;
-}
-
-var system_session = system_session();
-var creds = options.get_credentials();
-message("Provisioning for %s in realm %s\n", subobj.DOMAIN, subobj.REALM);
-message("Using administrator password: %s\n", subobj.ADMINPASS);
-if (partitions_only) {
-	provision_become_dc(subobj, message, false, paths, system_session);
-} else {
-	provision(subobj, message, blank, paths, system_session, creds, ldapbackend);
-	provision_dns(subobj, message, paths, system_session, creds);
-	message("To reproduce this provision, run with:\n");
-/* 	There has to be a better way than this... */
-	message("--realm='%s' --domain='%s' \\\n", subobj.REALM_CONF, subobj.DOMAIN_CONF);
-	if (subobj.DOMAINGUID != undefined) {
-		 message("--domain-guid='%s' \\\n", subobj.DOMAINGUID);
-	}
-	if (subobj.HOSTGUID != undefined) {
-		 message("--host-guid='%s' \\\n", subobj.HOSTGUID);
-	}
-	message("--policy-guid='%s' --host-name='%s' --host-ip='%s' \\\n", subobj.POLICYGUID, subobj.HOSTNAME, subobj.HOSTIP);
-	if (subobj.INVOCATIONID != undefined) {
-		message("--invocationid='%s' \\\n", subobj.INVOCATIONID);
-	}
-	message("--adminpass='%s' --krbtgtpass='%s' \\\n", subobj.ADMINPASS, subobj.KRBTGTPASS);
-	message("--machinepass='%s' --dnspass='%s' \\\n", subobj.MACHINEPASS, subobj.DNSPASS);
-	message("--root='%s' --nobody='%s' --nogroup='%s' \\\n", subobj.ROOT, subobj.NOBODY, subobj.NOGROUP);
-	message("--wheel='%s' --users='%s' --server-role='%s' \\\n", subobj.WHEEL, subobj.USERS, subobj.SERVERROLE);
-	if (ldapbackend) {
-		message("--ldap-backend='%s' \\\n", subobj.LDAPBACKEND);
-	}
-	if (ldapmodule) {
-		message("--ldap-module='%s' \\\n", + subobj.LDAPMODULE);
-	}
-	message("--aci='" + subobj.ACI + "' \\\n")
-}
-
-
-message("All OK\n");
-return 0;
+#!/usr/bin/python
+#
+# Unix SMB/CIFS implementation.
+# provision a Samba4 server
+# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
+# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
+#
+# Based on the original in EJS:
+# Copyright (C) Andrew Tridgell 2005
+#   
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#   
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#   
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import getopt
+import optparse
+import os, sys
+
+import samba
+
+from auth import system_session
+import samba.getopt as options
+import param
+from samba.provision import (provision, 
+                             provision_paths_from_lp,
+                             FILL_FULL, FILL_NT4SYNC,
+                             FILL_DRS)
+
+parser = optparse.OptionParser("provision [options]")
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
+parser.add_option_group(options.VersionOptions(parser))
+credopts = options.CredentialsOptions(parser)
+parser.add_option_group(credopts)
+parser.add_option("--setupdir", type="string", metavar="DIR", 
+		help="directory with setup files")
+parser.add_option("--realm", type="string", metavar="REALM", help="set realm")
+parser.add_option("--domain", type="string", metavar="DOMAIN",
+				  help="set domain")
+parser.add_option("--domain-guid", type="string", metavar="GUID", 
+		help="set domainguid (otherwise random)")
+parser.add_option("--domain-sid", type="string", metavar="SID", 
+		help="set domainsid (otherwise random)")
+parser.add_option("--policy-guid", type="string", metavar="GUID",
+				  help="set policy guid")
+parser.add_option("--host-name", type="string", metavar="HOSTNAME", 
+		help="set hostname")
+parser.add_option("--host-ip", type="string", metavar="IPADDRESS", 
+		help="set ipaddress")
+parser.add_option("--host-guid", type="string", metavar="GUID", 
+		help="set hostguid (otherwise random)")
+parser.add_option("--invocationid", type="string", metavar="GUID", 
+		help="set invocationid (otherwise random)")
+parser.add_option("--adminpass", type="string", metavar="PASSWORD", 
+		help="choose admin password (otherwise random)")
+parser.add_option("--krbtgtpass", type="string", metavar="PASSWORD", 
+		help="choose krbtgt password (otherwise random)")
+parser.add_option("--machinepass", type="string", metavar="PASSWORD", 
+		help="choose machine password (otherwise random)")
+parser.add_option("--dnspass", type="string", metavar="PASSWORD", 
+		help="choose dns password (otherwise random)")
+parser.add_option("--root", type="string", metavar="USERNAME", 
+		help="choose 'root' unix username")
+parser.add_option("--nobody", type="string", metavar="USERNAME", 
+		help="choose 'nobody' user")
+parser.add_option("--nogroup", type="string", metavar="GROUPNAME", 
+		help="choose 'nogroup' group")
+parser.add_option("--wheel", type="string", metavar="GROUPNAME", 
+		help="choose 'wheel' privileged group")
+parser.add_option("--users", type="string", metavar="GROUPNAME", 
+		help="choose 'users' group")
+parser.add_option("--quiet", help="Be quiet", action="store_true")
+parser.add_option("--blank", action="store_true",
+		help="do not add users or groups, just the structure")
+parser.add_option("--ldap-backend", type="string", metavar="LDAPSERVER", 
+		help="LDAP server to use for this provision")
+parser.add_option("--ldap-backend-type", type="choice", metavar="LDAP-BACKEND-TYPE", 
+		help="LDB mapping module to use for the LDAP backend",
+		choices=["fedora-ds", "openldap"])
+parser.add_option("--aci", type="string", metavar="ACI", 
+		help="An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server. You must provide at least a realm and domain")
+parser.add_option("--server-role", type="choice", metavar="ROLE",
+		          choices=["domain controller", "member server"],
+		help="Set server role to provision for (default standalone)")
+parser.add_option("--partitions-only", 
+		help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action="store_true")
+parser.add_option("--targetdir", type="string", metavar="DIR", 
+		          help="Set target directory")
+
+opts = parser.parse_args()[0]
+
+def message(text):
+	"""print a message if quiet is not set."""
+	if not opts.quiet:
+		print text
+
+if opts.realm is None or opts.domain is None:
+	if opts.realm is None:
+		print >>sys.stderr, "No realm set"
+	if opts.domain is None:
+		print >>sys.stderr, "No domain set"
+	parser.print_usage()
+	sys.exit(1)
+
+# cope with an initially blank smb.conf 
+private_dir = None
+lp = sambaopts.get_loadparm()
+if opts.targetdir is not None:
+    if not os.path.exists(opts.targetdir):
+        os.mkdir(opts.targetdir)
+    private_dir = os.path.join(opts.targetdir, "private")
+    if not os.path.exists(private_dir):
+        os.mkdir(private_dir)
+    lp.set("private dir", os.path.abspath(private_dir))
+    lp.set("lock dir", os.path.abspath(opts.targetdir))
+lp.set("realm", opts.realm)
+lp.set("workgroup", opts.domain)
+lp.set("server role", opts.server_role or "domain controller")
+
+if opts.aci is not None:
+	print "set ACI: %s" % opts.aci
+
+paths = provision_paths_from_lp(lp, opts.realm.lower())
+if sambaopts.get_loadparm_path() is not None:
+    paths.smbconf = sambaopts.get_loadparm_path()
+
+creds = credopts.get_credentials()
+
+setup_dir = opts.setupdir
+if setup_dir is None:
+	setup_dir = "setup"
+
+samdb_fill = FILL_FULL
+if opts.blank:
+    samdb_fill = FILL_NT4SYNC
+elif opts.partitions_only:
+    samdb_fill = FILL_DRS
+
+provision(lp, setup_dir, message, paths, 
+          system_session(), creds, 
+          samdb_fill=samdb_fill, realm=opts.realm,
+          domainguid=opts.domain_guid, domainsid=opts.domain_sid,
+          policyguid=opts.policy_guid, hostname=opts.host_name,
+          hostip=opts.host_ip, hostguid=opts.host_guid, 
+          invocationid=opts.invocationid, adminpass=opts.adminpass,
+          krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass,
+          dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody,
+          nogroup=opts.nogroup, wheel=opts.wheel, users=opts.users,
+          aci=opts.aci, serverrole=opts.server_role, 
+          ldap_backend=opts.ldap_backend, 
+          ldap_backend_type=opts.ldap_backend_type)
+
+message("To reproduce this provision, run with:")
+def shell_escape(arg):
+    if " " in arg:
+        return '"%s"' % arg
+    return arg
+message(" ".join([shell_escape(arg) for arg in sys.argv]))
+
+message("All OK")
diff --git a/source4/setup/provision.js b/source4/setup/provision.js
new file mode 100755
index 0000000000..328754fd9c
--- /dev/null
+++ b/source4/setup/provision.js
@@ -0,0 +1,198 @@
+#!/bin/sh
+exec smbscript "$0" ${1+"$@"}
+/*
+	provision a Samba4 server
+	Copyright Andrew Tridgell 2005
+	Released under the GNU GPL v2 or later
+*/
+
+options = GetOptions(ARGV,
+		"POPT_AUTOHELP",
+		"POPT_COMMON_SAMBA",
+		"POPT_COMMON_VERSION",
+		"POPT_COMMON_CREDENTIALS",
+		'realm=s',
+		'domain=s',
+		'domain-guid=s',
+		'domain-sid=s',
+		'policy-guid=s',
+		'host-name=s',
+		'host-ip=s',
+		'host-guid=s',
+		'invocationid=s',
+		'adminpass=s',
+		'krbtgtpass=s',
+		'machinepass=s',
+		'dnspass=s',
+		'root=s',
+		'nobody=s',
+		'nogroup=s',
+		'wheel=s',
+		'users=s',
+		'quiet',
+		'blank',
+		'server-role=s',
+		'partitions-only',
+		'ldap-base',
+		'ldap-backend=s',
+                'ldap-backend-type=s',
+                'aci=s');
+
+if (options == undefined) {
+   println("Failed to parse options");
+   return -1;
+}
+
+libinclude("base.js");
+libinclude("provision.js");
+
+/*
+  print a message if quiet is not set
+*/
+function message()
+{
+	if (options["quiet"] == undefined) {
+		print(vsprintf(arguments));
+	}
+}
+
+/*
+ show some help
+*/
+function ShowHelp()
+{
+	print("
+Samba4 provisioning
+
+provision [options]
+ --realm	REALM		set realm
+ --domain	DOMAIN		set domain
+ --domain-guid	GUID		set domainguid (otherwise random)
+ --domain-sid	SID		set domainsid (otherwise random)
+ --host-name	HOSTNAME	set hostname
+ --host-ip	IPADDRESS	set ipaddress
+ --host-guid	GUID		set hostguid (otherwise random)
+ --policy-guid  GUID            set group policy guid (otherwise random)
+ --invocationid	GUID		set invocationid (otherwise random)
+ --adminpass	PASSWORD	choose admin password (otherwise random)
+ --krbtgtpass	PASSWORD	choose krbtgt password (otherwise random)
+ --machinepass	PASSWORD	choose machine password (otherwise random)
+ --root         USERNAME	choose 'root' unix username
+ --nobody	USERNAME	choose 'nobody' user
+ --nogroup	GROUPNAME	choose 'nogroup' group
+ --wheel	GROUPNAME	choose 'wheel' privileged group
+ --users	GROUPNAME	choose 'users' group
+ --quiet			Be quiet
+ --blank			do not add users or groups, just the structure
+ --server-role  ROLE            Set server role to provision for (default standalone)
+ --partitions-only              Configure Samba's partitions, but do not modify them (ie, join a BDC)
+ --ldap-base			output only an LDIF file, suitable for creating an LDAP baseDN
+ --ldap-backend LDAPSERVER      LDAP server to use for this provision
+ --ldap-backend-type  TYPE      OpenLDAP or Fedora DS
+ --aci          ACI             An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server
+You must provide at least a realm and domain
+
+");
+	exit(1);
+}
+
+if (options['host-name'] == undefined) {
+	options['host-name'] = hostname();
+}
+
+/*
+   main program
+*/
+if (options["realm"] == undefined ||
+    options["domain"] == undefined ||
+    options["host-name"] == undefined) {
+	ShowHelp();
+}
+
+/* cope with an initially blank smb.conf */
+var lp = loadparm_init();
+lp.set("realm", options.realm);
+lp.set("workgroup", options.domain);
+lp.set("server role", options["server-role"]);
+lp.reload();
+
+var subobj = provision_guess();
+for (r in options) {
+	var key = strupper(join("", split("-", r)));
+	subobj[key] = options[r];
+}
+
+var blank = (options["blank"] != undefined);
+var ldapbackend = (options["ldap-backend"] != undefined);
+var ldapbackendtype = options["ldap-backend-type"];
+var partitions_only = (options["partitions-only"] != undefined);
+var paths = provision_default_paths(subobj);
+if (options["aci"] != undefined) {
+	message("set ACI: %s\n", subobj["ACI"]);
+}
+
+message("set DOMAIN SID: %s\n", subobj["DOMAINSID"]);
+
+provision_fix_subobj(subobj, paths);
+
+if (ldapbackend) {
+	if (options["ldap-backend"] == "ldapi") {
+		subobj.LDAPBACKEND = subobj.LDAPI_URI;
+	}
+	if (ldapbackendtype == undefined) {
+	       
+	} else if (ldapbackendtype == "openldap") {
+		subobj.LDAPMODULE = "normalise,entryuuid";
+		subobj.TDB_MODULES_LIST = "";
+	} else if (ldapbackendtype == "fedora-ds") {
+		subobj.LDAPMODULE = "nsuniqueid";
+	}
+	subobj.BACKEND_MOD = subobj.LDAPMODULE + ",paged_searches";
+	subobj.DOMAINDN_LDB = subobj.LDAPBACKEND;
+	subobj.CONFIGDN_LDB = subobj.LDAPBACKEND;
+	subobj.SCHEMADN_LDB = subobj.LDAPBACKEND;
+	message("LDAP module: %s on backend: %s\n", subobj.LDAPMODULE, subobj.LDAPBACKEND);
+}
+
+if (!provision_validate(subobj, message)) {
+	return -1;
+}
+
+var system_session = system_session();
+var creds = options.get_credentials();
+message("Provisioning for %s in realm %s\n", subobj.DOMAIN, subobj.REALM);
+message("Using administrator password: %s\n", subobj.ADMINPASS);
+if (partitions_only) {
+	provision_become_dc(subobj, message, false, paths, system_session);
+} else {
+	provision(subobj, message, blank, paths, system_session, creds, ldapbackend);
+	provision_dns(subobj, message, paths, system_session, creds);
+	message("To reproduce this provision, run with:\n");
+/* 	There has to be a better way than this... */
+	message("--realm='%s' --domain='%s' \\\n", subobj.REALM_CONF, subobj.DOMAIN_CONF);
+	if (subobj.DOMAINGUID != undefined) {
+		 message("--domain-guid='%s' \\\n", subobj.DOMAINGUID);
+	}
+	if (subobj.HOSTGUID != undefined) {
+		 message("--host-guid='%s' \\\n", subobj.HOSTGUID);
+	}
+	message("--policy-guid='%s' --host-name='%s' --host-ip='%s' \\\n", subobj.POLICYGUID, subobj.HOSTNAME, subobj.HOSTIP);
+	if (subobj.INVOCATIONID != undefined) {
+		message("--invocationid='%s' \\\n", subobj.INVOCATIONID);
+	}
+	message("--adminpass='%s' --krbtgtpass='%s' \\\n", subobj.ADMINPASS, subobj.KRBTGTPASS);
+	message("--machinepass='%s' --dnspass='%s' \\\n", subobj.MACHINEPASS, subobj.DNSPASS);
+	message("--root='%s' --nobody='%s' --nogroup='%s' \\\n", subobj.ROOT, subobj.NOBODY, subobj.NOGROUP);
+	message("--wheel='%s' --users='%s' --server-role='%s' \\\n", subobj.WHEEL, subobj.USERS, subobj.SERVERROLE);
+	if (ldapbackend) {
+		message("--ldap-backend='%s' \\\n", subobj.LDAPBACKEND);
+	}
+	if (ldapbackendtype != undefined) {
+		message("--ldap-backend-type='%s' \\\n", + ldapbackendtype);
+	}
+	message("--aci='" + subobj.ACI + "' \\\n")
+}
+
+
+message("All OK\n");
+return 0;
diff --git a/source4/setup/provision.py b/source4/setup/provision.py
deleted file mode 100755
index 033d2491f2..0000000000
--- a/source4/setup/provision.py
+++ /dev/null
@@ -1,170 +0,0 @@
-#!/usr/bin/python
-#
-# Unix SMB/CIFS implementation.
-# provision a Samba4 server
-# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
-# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
-#
-# Based on the original in EJS:
-# Copyright (C) Andrew Tridgell 2005
-#   
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#   
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#   
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-
-import getopt
-import optparse
-import os, sys
-
-import samba
-
-from auth import system_session
-import samba.getopt as options
-import param
-from samba.provision import (provision, 
-                             provision_paths_from_lp,
-                             FILL_FULL, FILL_NT4SYNC,
-                             FILL_DRS)
-
-parser = optparse.OptionParser("provision [options]")
-sambaopts = options.SambaOptions(parser)
-parser.add_option_group(sambaopts)
-parser.add_option_group(options.VersionOptions(parser))
-credopts = options.CredentialsOptions(parser)
-parser.add_option_group(credopts)
-parser.add_option("--setupdir", type="string", metavar="DIR", 
-		help="directory with setup files")
-parser.add_option("--realm", type="string", metavar="REALM", help="set realm")
-parser.add_option("--domain", type="string", metavar="DOMAIN",
-				  help="set domain")
-parser.add_option("--domain-guid", type="string", metavar="GUID", 
-		help="set domainguid (otherwise random)")
-parser.add_option("--domain-sid", type="string", metavar="SID", 
-		help="set domainsid (otherwise random)")
-parser.add_option("--policy-guid", type="string", metavar="GUID",
-				  help="set policy guid")
-parser.add_option("--host-name", type="string", metavar="HOSTNAME", 
-		help="set hostname")
-parser.add_option("--host-ip", type="string", metavar="IPADDRESS", 
-		help="set ipaddress")
-parser.add_option("--host-guid", type="string", metavar="GUID", 
-		help="set hostguid (otherwise random)")
-parser.add_option("--invocationid", type="string", metavar="GUID", 
-		help="set invocationid (otherwise random)")
-parser.add_option("--adminpass", type="string", metavar="PASSWORD", 
-		help="choose admin password (otherwise random)")
-parser.add_option("--krbtgtpass", type="string", metavar="PASSWORD", 
-		help="choose krbtgt password (otherwise random)")
-parser.add_option("--machinepass", type="string", metavar="PASSWORD", 
-		help="choose machine password (otherwise random)")
-parser.add_option("--dnspass", type="string", metavar="PASSWORD", 
-		help="choose dns password (otherwise random)")
-parser.add_option("--root", type="string", metavar="USERNAME", 
-		help="choose 'root' unix username")
-parser.add_option("--nobody", type="string", metavar="USERNAME", 
-		help="choose 'nobody' user")
-parser.add_option("--nogroup", type="string", metavar="GROUPNAME", 
-		help="choose 'nogroup' group")
-parser.add_option("--wheel", type="string", metavar="GROUPNAME", 
-		help="choose 'wheel' privileged group")
-parser.add_option("--users", type="string", metavar="GROUPNAME", 
-		help="choose 'users' group")
-parser.add_option("--quiet", help="Be quiet", action="store_true")
-parser.add_option("--blank", action="store_true",
-		help="do not add users or groups, just the structure")
-parser.add_option("--ldap-backend", type="string", metavar="LDAPSERVER", 
-		help="LDAP server to use for this provision")
-parser.add_option("--ldap-backend-type", type="choice", metavar="LDAP-BACKEND-TYPE", 
-		help="LDB mapping module to use for the LDAP backend",
-		choices=["fedora-ds", "openldap"])
-parser.add_option("--aci", type="string", metavar="ACI", 
-		help="An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server. You must provide at least a realm and domain")
-parser.add_option("--server-role", type="choice", metavar="ROLE",
-		          choices=["domain controller", "member server"],
-		help="Set server role to provision for (default standalone)")
-parser.add_option("--partitions-only", 
-		help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action="store_true")
-parser.add_option("--targetdir", type="string", metavar="DIR", 
-		          help="Set target directory")
-
-opts = parser.parse_args()[0]
-
-def message(text):
-	"""print a message if quiet is not set."""
-	if not opts.quiet:
-		print text
-
-if opts.realm is None or opts.domain is None:
-	if opts.realm is None:
-		print >>sys.stderr, "No realm set"
-	if opts.domain is None:
-		print >>sys.stderr, "No domain set"
-	parser.print_usage()
-	sys.exit(1)
-
-# cope with an initially blank smb.conf 
-private_dir = None
-lp = sambaopts.get_loadparm()
-if opts.targetdir is not None:
-    if not os.path.exists(opts.targetdir):
-        os.mkdir(opts.targetdir)
-    private_dir = os.path.join(opts.targetdir, "private")
-    if not os.path.exists(private_dir):
-        os.mkdir(private_dir)
-    lp.set("private dir", os.path.abspath(private_dir))
-    lp.set("lock dir", os.path.abspath(opts.targetdir))
-lp.set("realm", opts.realm)
-lp.set("workgroup", opts.domain)
-lp.set("server role", opts.server_role or "domain controller")
-
-if opts.aci is not None:
-	print "set ACI: %s" % opts.aci
-
-paths = provision_paths_from_lp(lp, opts.realm.lower())
-if sambaopts.get_loadparm_path() is not None:
-    paths.smbconf = sambaopts.get_loadparm_path()
-
-creds = credopts.get_credentials()
-
-setup_dir = opts.setupdir
-if setup_dir is None:
-	setup_dir = "setup"
-
-samdb_fill = FILL_FULL
-if opts.blank:
-    samdb_fill = FILL_NT4SYNC
-elif opts.partitions_only:
-    samdb_fill = FILL_DRS
-
-provision(lp, setup_dir, message, paths, 
-          system_session(), creds, 
-          samdb_fill=samdb_fill, realm=opts.realm,
-          domainguid=opts.domain_guid, domainsid=opts.domain_sid,
-          policyguid=opts.policy_guid, hostname=opts.host_name,
-          hostip=opts.host_ip, hostguid=opts.host_guid, 
-          invocationid=opts.invocationid, adminpass=opts.adminpass,
-          krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass,
-          dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody,
-          nogroup=opts.nogroup, wheel=opts.wheel, users=opts.users,
-          aci=opts.aci, serverrole=opts.server_role, 
-          ldap_backend=opts.ldap_backend, 
-          ldap_backend_type=opts.ldap_backend_type)
-
-message("To reproduce this provision, run with:")
-def shell_escape(arg):
-    if " " in arg:
-        return '"%s"' % arg
-    return arg
-message(" ".join([shell_escape(arg) for arg in sys.argv]))
-
-message("All OK")
diff --git a/source4/setup/tests/blackbox_provision.sh b/source4/setup/tests/blackbox_provision.sh
index 57b11eae5f..0aed7bb8b7 100755
--- a/source4/setup/tests/blackbox_provision.sh
+++ b/source4/setup/tests/blackbox_provision.sh
@@ -27,11 +27,11 @@ testit() {
 	return $status
 }
 
-testit "simple" $PYTHON ./setup/provision.py $CONFIGURATION --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/simple
+testit "simple" $PYTHON ./setup/provision $CONFIGURATION --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/simple
 
 reprovision() {
-	$PYTHON ./setup/provision.py $CONFIGURATION --domain=FOO --realm=foo.example.com --targetdir="$PREFIX/reprovision"
-	$PYTHON ./setup/provision.py $CONFIGURATION --domain=FOO --realm=foo.example.com --targetdir="$PREFIX/reprovision"
+	$PYTHON ./setup/provision $CONFIGURATION --domain=FOO --realm=foo.example.com --targetdir="$PREFIX/reprovision"
+	$PYTHON ./setup/provision $CONFIGURATION --domain=FOO --realm=foo.example.com --targetdir="$PREFIX/reprovision"
 }
 
 testit "reprovision" reprovision
diff --git a/source4/smbd/server.c b/source4/smbd/server.c
index c256eed96c..fdeb541576 100644
--- a/source4/smbd/server.c
+++ b/source4/smbd/server.c
@@ -253,7 +253,7 @@ static int binary_smbd_main(const char *binary_name, int argc, const char *argv[
 	umask(0);
 
 	DEBUG(0,("%s version %s started.\n", binary_name, SAMBA_VERSION_STRING));
-	DEBUGADD(0,("Copyright Andrew Tridgell and the Samba Team 1992-2007\n"));
+	DEBUGADD(0,("Copyright Andrew Tridgell and the Samba Team 1992-2008\n"));
 
 	if (sizeof(uint16_t) < 2 || sizeof(uint32_t) < 4 || sizeof(uint64_t) < 8) {
 		DEBUG(0,("ERROR: Samba is not configured correctly for the word size on your machine\n"));
@@ -282,8 +282,6 @@ static int binary_smbd_main(const char *binary_name, int argc, const char *argv[
 		exit(1);
 	}
 
-	ldb_global_init(); /* FIXME: */
-
 	share_init();
 
 	gensec_init(cmdline_lp_ctx); /* FIXME: */
diff --git a/source4/torture/auth/pac.c b/source4/torture/auth/pac.c
index efb36e3ef8..68bbd3483a 100644
--- a/source4/torture/auth/pac.c
+++ b/source4/torture/auth/pac.c
@@ -112,7 +112,9 @@ static bool torture_pac_self_check(struct torture_context *tctx)
 	}
 
 	/* OK, go ahead and make a PAC */
-	ret = kerberos_create_pac(mem_ctx, server_info, 
+	ret = kerberos_create_pac(mem_ctx, 
+				  lp_iconv_convenience(tctx->lp_ctx),
+				  server_info, 
 				  smb_krb5_context->krb5_context,  
 				  &krbtgt_keyblock,
 				  &server_keyblock,
@@ -137,7 +139,9 @@ static bool torture_pac_self_check(struct torture_context *tctx)
 	dump_data(10,tmp_blob.data,tmp_blob.length);
 
 	/* Now check that we can read it back */
-	nt_status = kerberos_decode_pac(mem_ctx, &pac_data,
+	nt_status = kerberos_decode_pac(mem_ctx, 
+					lp_iconv_convenience(tctx->lp_ctx),
+					&pac_data,
 					tmp_blob,
 					smb_krb5_context->krb5_context,
 					&krbtgt_keyblock,
@@ -159,7 +163,9 @@ static bool torture_pac_self_check(struct torture_context *tctx)
 	}
 
 	/* Now check that we can read it back */
-	nt_status = kerberos_pac_logon_info(mem_ctx, &logon_info,
+	nt_status = kerberos_pac_logon_info(mem_ctx, 
+					    lp_iconv_convenience(tctx->lp_ctx),
+					    &logon_info,
 					    tmp_blob,
 					    smb_krb5_context->krb5_context,
 					    &krbtgt_keyblock,
@@ -367,7 +373,9 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
 	}
 
 	/* Decode and verify the signaure on the PAC */
-	nt_status = kerberos_decode_pac(mem_ctx, &pac_data,
+	nt_status = kerberos_decode_pac(mem_ctx, 
+					lp_iconv_convenience(tctx->lp_ctx),
+					&pac_data,
 					tmp_blob,
 					smb_krb5_context->krb5_context,
 					&krbtgt_keyblock,
@@ -386,7 +394,9 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
 	}
 
 	/* Parse the PAC again, for the logon info this time */
-	nt_status = kerberos_pac_logon_info(mem_ctx, &logon_info,
+	nt_status = kerberos_pac_logon_info(mem_ctx, 
+					    lp_iconv_convenience(tctx->lp_ctx),
+					    &logon_info,
 					    tmp_blob,
 					    smb_krb5_context->krb5_context,
 					    &krbtgt_keyblock,
@@ -442,6 +452,7 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
 	}
 
 	ret = kerberos_encode_pac(mem_ctx, 
+				  lp_iconv_convenience(tctx->lp_ctx),
 				  pac_data,
 				  smb_krb5_context->krb5_context,
 				  &krbtgt_keyblock,
@@ -493,6 +504,7 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
 	}
 
 	ret = kerberos_create_pac(mem_ctx, 
+				  lp_iconv_convenience(tctx->lp_ctx),
 				  server_info_out,
 				  smb_krb5_context->krb5_context,
 				  &krbtgt_keyblock,
@@ -565,7 +577,9 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
 	}
 
 	/* Break the auth time, to ensure we check this vital detail (not setting this caused all the pain in the first place... */
-	nt_status = kerberos_decode_pac(mem_ctx, &pac_data,
+	nt_status = kerberos_decode_pac(mem_ctx, 
+					lp_iconv_convenience(tctx->lp_ctx),
+					&pac_data,
 					tmp_blob,
 					smb_krb5_context->krb5_context,
 					&krbtgt_keyblock,
@@ -601,7 +615,9 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
 						   smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, mem_ctx)));
 	}
 
-	nt_status = kerberos_decode_pac(mem_ctx, &pac_data,
+	nt_status = kerberos_decode_pac(mem_ctx, 
+					lp_iconv_convenience(tctx->lp_ctx),
+					&pac_data,
 					tmp_blob,
 					smb_krb5_context->krb5_context,
 					&krbtgt_keyblock,
@@ -619,7 +635,9 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
 	/* Finally...  Bugger up the signature, and check we fail the checksum */
 	tmp_blob.data[tmp_blob.length - 2]++;
 
-	nt_status = kerberos_decode_pac(mem_ctx, &pac_data,
+	nt_status = kerberos_decode_pac(mem_ctx, 
+					lp_iconv_convenience(tctx->lp_ctx),
+					&pac_data,
 					tmp_blob,
 					smb_krb5_context->krb5_context,
 					&krbtgt_keyblock,
diff --git a/source4/torture/basic/base.c b/source4/torture/basic/base.c
index aa729ec0df..42d7ddaaa1 100644
--- a/source4/torture/basic/base.c
+++ b/source4/torture/basic/base.c
@@ -633,6 +633,13 @@ static bool run_deferopen(struct torture_context *tctx, struct smbcli_state *cli
 	int retries=4;
 	int i = 0;
 	bool correct = true;
+	int nsec;
+	int msec;
+	double sec;
+
+	nsec = torture_setting_int(tctx, "sharedelay", 1000000);
+	msec = nsec / 1000;
+	sec = ((double)nsec) / ((double) 1000000);
 
 	if (retries <= 0) {
 		torture_comment(tctx, "failed to connect\n");
@@ -657,9 +664,10 @@ static bool run_deferopen(struct torture_context *tctx, struct smbcli_state *cli
 			}
 			if (NT_STATUS_EQUAL(smbcli_nt_error(cli->tree),NT_STATUS_SHARING_VIOLATION)) {
 				double e = timeval_elapsed(&tv);
-				if (e < 0.5 || e > 1.5) {
-					torture_comment(tctx,"Timing incorrect %.2f violation\n",
-						e);
+				if (e < (0.5 * sec) || e > (1.5 * sec)) {
+					torture_comment(tctx,"Timing incorrect %.2f violation 1 sec == %.2f\n",
+						e, sec);
+					return false;
 				}
 			}
 		} while (NT_STATUS_EQUAL(smbcli_nt_error(cli->tree),NT_STATUS_SHARING_VIOLATION));
@@ -671,13 +679,13 @@ static bool run_deferopen(struct torture_context *tctx, struct smbcli_state *cli
 
 		torture_comment(tctx, "pid %u open %d\n", (unsigned)getpid(), i);
 
-		sleep(10);
+		msleep(10 * msec);
 		i++;
 		if (NT_STATUS_IS_ERR(smbcli_close(cli->tree, fnum))) {
 			torture_comment(tctx,"Failed to close %s, error=%s\n", fname, smbcli_errstr(cli->tree));
 			return false;
 		}
-		sleep(2);
+		msleep(2 * msec);
 	}
 
 	if (NT_STATUS_IS_ERR(smbcli_unlink(cli->tree, fname))) {
diff --git a/source4/torture/basic/utable.c b/source4/torture/basic/utable.c
index 112cf323a1..2b222d7c6e 100644
--- a/source4/torture/basic/utable.c
+++ b/source4/torture/basic/utable.c
@@ -98,7 +98,7 @@ bool torture_utable(struct torture_context *tctx,
 }
 
 
-static char *form_name(int c)
+static char *form_name(struct smb_iconv_convenience *iconv_convenience, int c)
 {
 	static fstring fname;
 	uint8_t c2[4];
@@ -109,7 +109,7 @@ static char *form_name(int c)
 	p = fname+strlen(fname);
 	SSVAL(c2, 0, c);
 
-	len = convert_string(lp_iconv_convenience(global_loadparm), CH_UTF16, CH_UNIX, 
+	len = convert_string(iconv_convenience, CH_UTF16, CH_UNIX, 
 			     c2, 2, 
 			     p, sizeof(fname)-strlen(fname));
 	p[len] = 0;
@@ -139,7 +139,7 @@ bool torture_casetable(struct torture_context *tctx,
 
 		torture_comment(tctx, "%04x (%c)\n", c, isprint(c)?c:'.');
 
-		fname = form_name(c);
+		fname = form_name(lp_iconv_convenience(tctx->lp_ctx), c);
 		fnum = smbcli_nt_create_full(cli->tree, fname, 0,
 #if 0
 					     SEC_RIGHT_MAXIMUM_ALLOWED, 
diff --git a/source4/torture/config.mk b/source4/torture/config.mk
index a1975a6caf..626349a45d 100644
--- a/source4/torture/config.mk
+++ b/source4/torture/config.mk
@@ -11,7 +11,8 @@ OBJ_FILES = \
 PUBLIC_DEPENDENCIES = \
 		LIBSAMBA-CONFIG \
 		LIBSAMBA-UTIL \
-		LIBTALLOC 
+		LIBTALLOC \
+		LIBPOPT
 
 [SUBSYSTEM::TORTURE_UTIL]
 OBJ_FILES = util_smb.o util_provision.o
@@ -369,21 +370,14 @@ MANPAGE = man/locktest.1
 # End BINARY locktest
 #################################
 
-GCOV_CFLAGS = -ftest-coverage -fprofile-arcs
-GCOV_LDFLAGS = $(GCOV_CFLAGS) -lgcov
-
 COV_TARGET = test
 
 COV_VARS = \
-	CFLAGS="$(CFLAGS) $(GCOV_CFLAGS)" \
-	BNLD_FLAGS="$(BNLD_FLAGS) $(GCOV_LDFLAGS)" \
-	SHLD_FLAGS="$(SHLD_FLAGS) $(GCOV_LDFLAGS)" \
-	MDLD_FLAGS="$(MDLD_FLAGS) $(GCOV_LDFLAGS)" \
-	HOSTCC_FLAGS="$(HOSTCC_FLAGS) $(GCOV_CFLAGS)" \
-	HOSTLD_FLAGS="$(HOSTLD_FLAGS) $(GCOV_LDFLAGS)"
+	CFLAGS="$(CFLAGS) --coverage" \
+	LDFLAGS="$(LDFLAGS) --coverage"
 
 test_cov:
-	@$(MAKE) $(COV_TARGET) $(COV_VARS)
+	-$(MAKE) $(COV_TARGET) $(COV_VARS)
 
 gcov: test_cov
 	for I in $(sort $(dir $(ALL_OBJS))); \
@@ -395,10 +389,12 @@ lcov-split:
 	@$(MAKE) $(COV_TARGET) $(COV_VARS) \
 		TEST_OPTIONS="--analyse-cmd=\"lcov --base-directory `pwd` --directory . --capture --output-file samba.info -t\""
 	-rm heimdal/lib/*/{lex,parse}.{gcda,gcno}
+	-rm lib/policy/*/{lex,parse}.{gcda,gcno}
 	genhtml -o coverage samba.info
 
 lcov: test_cov
 	-rm heimdal/lib/*/{lex,parse}.{gcda,gcno}
+	-rm lib/policy/*/{lex,parse}.{gcda,gcno}
 	lcov --base-directory `pwd` --directory . --capture --output-file samba.info
 	genhtml -o coverage samba.info
 
diff --git a/source4/torture/rap/rap.c b/source4/torture/rap/rap.c
index 71689786e8..edc74ee23e 100644
--- a/source4/torture/rap/rap.c
+++ b/source4/torture/rap/rap.c
@@ -73,7 +73,7 @@ struct rap_call {
 
 #define RAPNDR_FLAGS (LIBNDR_FLAG_NOALIGN|LIBNDR_FLAG_STR_ASCII|LIBNDR_FLAG_STR_NULLTERM);
 
-static struct rap_call *new_rap_cli_call(TALLOC_CTX *mem_ctx, uint16_t callno)
+static struct rap_call *new_rap_cli_call(TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, uint16_t callno)
 {
 	struct rap_call *call;
 
@@ -88,10 +88,10 @@ static struct rap_call *new_rap_cli_call(TALLOC_CTX *mem_ctx, uint16_t callno)
 	call->paramdesc = NULL;
 	call->datadesc = NULL;
 
-	call->ndr_push_param = ndr_push_init_ctx(mem_ctx, lp_iconv_convenience(global_loadparm));
+	call->ndr_push_param = ndr_push_init_ctx(mem_ctx, iconv_convenience);
 	call->ndr_push_param->flags = RAPNDR_FLAGS;
 
-	call->ndr_push_data = ndr_push_init_ctx(mem_ctx, lp_iconv_convenience(global_loadparm));
+	call->ndr_push_data = ndr_push_init_ctx(mem_ctx, iconv_convenience);
 	call->ndr_push_data->flags = RAPNDR_FLAGS;
 
 	return call;
@@ -189,14 +189,16 @@ static NTSTATUS rap_pull_string(TALLOC_CTX *mem_ctx, struct ndr_pull *ndr,
 	return NT_STATUS_OK;
 }
 
-static NTSTATUS rap_cli_do_call(struct smbcli_tree *tree, struct rap_call *call)
+static NTSTATUS rap_cli_do_call(struct smbcli_tree *tree, 
+				struct smb_iconv_convenience *iconv_convenience,
+				struct rap_call *call)
 {
 	NTSTATUS result;
 	DATA_BLOB param_blob;
 	struct ndr_push *params;
 	struct smb_trans2 trans;
 
-	params = ndr_push_init_ctx(call, lp_iconv_convenience(global_loadparm));
+	params = ndr_push_init_ctx(call, iconv_convenience);
 
 	if (params == NULL)
 		return NT_STATUS_NO_MEMORY;
@@ -231,11 +233,11 @@ static NTSTATUS rap_cli_do_call(struct smbcli_tree *tree, struct rap_call *call)
 		return result;
 
 	call->ndr_pull_param = ndr_pull_init_blob(&trans.out.params, call,
-						  lp_iconv_convenience(global_loadparm));
+						  iconv_convenience);
 	call->ndr_pull_param->flags = RAPNDR_FLAGS;
 
 	call->ndr_pull_data = ndr_pull_init_blob(&trans.out.data, call,
-						 lp_iconv_convenience(global_loadparm));
+						 iconv_convenience);
 	call->ndr_pull_data->flags = RAPNDR_FLAGS;
 
 	return result;
@@ -243,6 +245,7 @@ static NTSTATUS rap_cli_do_call(struct smbcli_tree *tree, struct rap_call *call)
 
 
 static NTSTATUS smbcli_rap_netshareenum(struct smbcli_tree *tree,
+					struct smb_iconv_convenience *iconv_convenience,
 					TALLOC_CTX *mem_ctx,
 					struct rap_NetShareEnum *r)
 {
@@ -250,7 +253,7 @@ static NTSTATUS smbcli_rap_netshareenum(struct smbcli_tree *tree,
 	NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 	int i;
 
-	call = new_rap_cli_call(tree, RAP_WshareEnum);
+	call = new_rap_cli_call(tree, iconv_convenience, RAP_WshareEnum);
 
 	if (call == NULL)
 		return NT_STATUS_NO_MEMORY;
@@ -268,7 +271,7 @@ static NTSTATUS smbcli_rap_netshareenum(struct smbcli_tree *tree,
 		break;
 	}
 
-	result = rap_cli_do_call(tree, call);
+	result = rap_cli_do_call(tree, iconv_convenience, call);
 
 	if (!NT_STATUS_IS_OK(result))
 		goto done;
@@ -322,7 +325,7 @@ static bool test_netshareenum(struct torture_context *tctx,
 	r.in.bufsize = 8192;
 
 	torture_assert_ntstatus_ok(tctx, 
-		smbcli_rap_netshareenum(cli->tree, tctx, &r), "");
+		smbcli_rap_netshareenum(cli->tree, lp_iconv_convenience(tctx->lp_ctx), tctx, &r), "");
 
 	for (i=0; i<r.out.count; i++) {
 		printf("%s %d %s\n", r.out.info[i].info1.name,
@@ -334,6 +337,7 @@ static bool test_netshareenum(struct torture_context *tctx,
 }
 
 static NTSTATUS smbcli_rap_netserverenum2(struct smbcli_tree *tree,
+					  struct smb_iconv_convenience *iconv_convenience, 
 					  TALLOC_CTX *mem_ctx,
 					  struct rap_NetServerEnum2 *r)
 {
@@ -341,7 +345,7 @@ static NTSTATUS smbcli_rap_netserverenum2(struct smbcli_tree *tree,
 	NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 	int i;
 
-	call = new_rap_cli_call(mem_ctx, RAP_NetServerEnum2);
+	call = new_rap_cli_call(mem_ctx, iconv_convenience, RAP_NetServerEnum2);
 
 	if (call == NULL)
 		return NT_STATUS_NO_MEMORY;
@@ -361,7 +365,7 @@ static NTSTATUS smbcli_rap_netserverenum2(struct smbcli_tree *tree,
 		break;
 	}
 
-	result = rap_cli_do_call(tree, call);
+	result = rap_cli_do_call(tree, iconv_convenience, call);
 
 	if (!NT_STATUS_IS_OK(result))
 		goto done;
@@ -421,7 +425,7 @@ static bool test_netserverenum(struct torture_context *tctx,
 	r.in.domain = NULL;
 
 	torture_assert_ntstatus_ok(tctx, 
-		   smbcli_rap_netserverenum2(cli->tree, tctx, &r), "");
+		   smbcli_rap_netserverenum2(cli->tree, lp_iconv_convenience(tctx->lp_ctx), tctx, &r), "");
 
 	for (i=0; i<r.out.count; i++) {
 		switch (r.in.level) {
@@ -440,13 +444,14 @@ static bool test_netserverenum(struct torture_context *tctx,
 }
 
 _PUBLIC_ NTSTATUS smbcli_rap_netservergetinfo(struct smbcli_tree *tree,
+					      struct smb_iconv_convenience *iconv_convenience, 
 				     TALLOC_CTX *mem_ctx,
 				     struct rap_WserverGetInfo *r)
 {
 	struct rap_call *call;
 	NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 
-	if (!(call = new_rap_cli_call(mem_ctx, RAP_WserverGetInfo))) {
+	if (!(call = new_rap_cli_call(mem_ctx, iconv_convenience, RAP_WserverGetInfo))) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
@@ -466,7 +471,7 @@ _PUBLIC_ NTSTATUS smbcli_rap_netservergetinfo(struct smbcli_tree *tree,
 		goto done;
 	}
 
-	result = rap_cli_do_call(tree, call);
+	result = rap_cli_do_call(tree, iconv_convenience, call);
 
 	if (!NT_STATUS_IS_OK(result))
 		goto done;
@@ -507,9 +512,9 @@ static bool test_netservergetinfo(struct torture_context *tctx,
 	r.in.bufsize = 0xffff;
 
 	r.in.level = 0;
-	torture_assert_ntstatus_ok(tctx, smbcli_rap_netservergetinfo(cli->tree, tctx, &r), "");
+	torture_assert_ntstatus_ok(tctx, smbcli_rap_netservergetinfo(cli->tree, lp_iconv_convenience(tctx->lp_ctx), tctx, &r), "");
 	r.in.level = 1;
-	torture_assert_ntstatus_ok(tctx, smbcli_rap_netservergetinfo(cli->tree, tctx, &r), "");
+	torture_assert_ntstatus_ok(tctx, smbcli_rap_netservergetinfo(cli->tree, lp_iconv_convenience(tctx->lp_ctx), tctx, &r), "");
 
 	return res;
 }
@@ -519,10 +524,10 @@ bool torture_rap_scan(struct torture_context *torture, struct smbcli_state *cli)
 	int callno;
 
 	for (callno = 0; callno < 0xffff; callno++) {
-		struct rap_call *call = new_rap_cli_call(torture, callno);
+		struct rap_call *call = new_rap_cli_call(torture, lp_iconv_convenience(torture->lp_ctx), callno);
 		NTSTATUS result;
 
-		result = rap_cli_do_call(cli->tree, call);
+		result = rap_cli_do_call(cli->tree, lp_iconv_convenience(torture->lp_ctx), call);
 
 		if (!NT_STATUS_EQUAL(result, NT_STATUS_INVALID_PARAMETER))
 			continue;
diff --git a/source4/torture/raw/composite.c b/source4/torture/raw/composite.c
index 0367110ddc..7238a2fd46 100644
--- a/source4/torture/raw/composite.c
+++ b/source4/torture/raw/composite.c
@@ -161,6 +161,7 @@ static bool test_fetchfile(struct smbcli_state *cli, struct torture_context *tct
 	io2.in.credentials = cmdline_credentials;
 	io2.in.workgroup  = lp_workgroup(tctx->lp_ctx);
 	io2.in.filename = fname;
+	lp_smbcli_options(tctx->lp_ctx, &io2.in.options);
 
 	printf("testing parallel fetchfile with %d ops\n", torture_numops);
 
diff --git a/source4/torture/raw/oplock.c b/source4/torture/raw/oplock.c
index 952088e46c..3edd0c6820 100644
--- a/source4/torture/raw/oplock.c
+++ b/source4/torture/raw/oplock.c
@@ -914,7 +914,7 @@ static bool test_raw_oplock_batch10(struct torture_context *tctx, struct smbcli_
 	CHECK_VAL(break_info.failures, 0);
 	CHECK_VAL(io.ntcreatex.out.oplock_level, 0);
 
-	smbcli_oplock_handler(cli2->transport, oplock_handler_ack_to_levelII, cli1->tree);
+	smbcli_oplock_handler(cli2->transport, oplock_handler_ack_to_levelII, cli2->tree);
 
 	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
 		NTCREATEX_FLAGS_REQUEST_OPLOCK | 
@@ -1058,7 +1058,7 @@ static bool test_raw_oplock_batch12(struct torture_context *tctx, struct smbcli_
 	bool ret = true;
 	union smb_open io;
 	union smb_setfileinfo sfi;
-	uint16_t fnum=0, fnum2=0;
+	uint16_t fnum=0;
 
 	if (!torture_setup_dir(cli1, BASEDIR)) {
 		return false;
@@ -1118,7 +1118,6 @@ static bool test_raw_oplock_batch12(struct torture_context *tctx, struct smbcli_
 	CHECK_VAL(break_info.level, 0);
 
 	smbcli_close(cli1->tree, fnum);
-	smbcli_close(cli2->tree, fnum2);
 
 done:
 	smb_raw_exit(cli1->session);
diff --git a/source4/torture/rpc/initshutdown.c b/source4/torture/rpc/initshutdown.c
index 9f6f1735ee..92fec5be0c 100644
--- a/source4/torture/rpc/initshutdown.c
+++ b/source4/torture/rpc/initshutdown.c
@@ -24,10 +24,9 @@
 #include "librpc/gen_ndr/ndr_initshutdown_c.h"
 #include "torture/rpc/rpc.h"
 
-static void init_initshutdown_String(TALLOC_CTX *mem_ctx, struct initshutdown_String *name, const char *s)
+static void init_lsa_StringLarge(struct lsa_StringLarge *name, const char *s)
 {
-	name->name = talloc(mem_ctx, struct initshutdown_String_sub);
-	name->name->name = s;
+	name->string = s;
 }
 
 
@@ -58,8 +57,8 @@ static bool test_Init(struct torture_context *tctx,
 	uint16_t hostname = 0x0;
 
 	r.in.hostname = &hostname;
-	r.in.message = talloc(tctx, struct initshutdown_String);
-	init_initshutdown_String(tctx, r.in.message, "spottyfood");
+	r.in.message = talloc(tctx, struct lsa_StringLarge);
+	init_lsa_StringLarge(r.in.message, "spottyfood");
 	r.in.force_apps = 1;
 	r.in.timeout = 30;
 	r.in.reboot = 1;
@@ -80,8 +79,8 @@ static bool test_InitEx(struct torture_context *tctx,
 	uint16_t hostname = 0x0;
 
 	r.in.hostname = &hostname;
-	r.in.message = talloc(tctx, struct initshutdown_String);
-	init_initshutdown_String(tctx, r.in.message, "spottyfood");
+	r.in.message = talloc(tctx, struct lsa_StringLarge);
+	init_lsa_StringLarge(r.in.message, "spottyfood");
 	r.in.force_apps = 1;
 	r.in.timeout = 30;
 	r.in.reboot = 1;
diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c
index a13172b695..5b92ce1382 100644
--- a/source4/torture/rpc/netlogon.c
+++ b/source4/torture/rpc/netlogon.c
@@ -532,7 +532,7 @@ bool test_netlogon_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
 	chal = data_blob_const(ninfo.challenge, 
 			       sizeof(ninfo.challenge));
 
-	names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(credentials), 
+	names_blob = NTLMv2_generate_names_blob(tctx, lp_iconv_convenience(tctx->lp_ctx), cli_credentials_get_workstation(credentials), 
 						cli_credentials_get_domain(credentials));
 
 	status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx, 
diff --git a/source4/torture/rpc/samba3rpc.c b/source4/torture/rpc/samba3rpc.c
index b08cd05bdb..95252e7397 100644
--- a/source4/torture/rpc/samba3rpc.c
+++ b/source4/torture/rpc/samba3rpc.c
@@ -806,6 +806,7 @@ static bool join3(struct smbcli_state *cli,
  */
 
 static bool auth2(struct smbcli_state *cli,
+		  struct loadparm_context *lp_ctx,
 		  struct cli_credentials *wks_cred)
 {
 	TALLOC_CTX *mem_ctx;
@@ -829,7 +830,7 @@ static bool auth2(struct smbcli_state *cli,
 
 	net_pipe = dcerpc_pipe_init(mem_ctx,
 				    cli->transport->socket->event.ctx,
-				    lp_iconv_convenience(global_loadparm));
+				    lp_iconv_convenience(lp_ctx));
 	if (net_pipe == NULL) {
 		d_printf("dcerpc_pipe_init failed\n");
 		goto done;
@@ -984,7 +985,8 @@ static bool schan(struct smbcli_state *cli,
 
 		generate_random_buffer(chal.data, chal.length);
 		names_blob = NTLMv2_generate_names_blob(
-			mem_ctx, cli_credentials_get_workstation(user_creds),
+			mem_ctx, lp_iconv_convenience(lp_ctx), 
+			cli_credentials_get_workstation(user_creds),
 			cli_credentials_get_domain(user_creds));
 		status = cli_credentials_get_ntlm_response(
 			user_creds, mem_ctx, &flags, chal, names_blob,
@@ -1204,7 +1206,7 @@ bool torture_netlogon_samba3(struct torture_context *torture)
 
 		int j;
 
-		if (!auth2(cli, wks_creds)) {
+		if (!auth2(cli, torture->lp_ctx, wks_creds)) {
 			d_printf("auth2 failed\n");
 			goto done;
 		}
@@ -1283,7 +1285,7 @@ static bool test_join3(struct torture_context *tctx,
 		cmdline_credentials, cli_credentials_get_domain(wks_creds),
 		CRED_SPECIFIED);
 
-	if (!auth2(cli, wks_creds)) {
+	if (!auth2(cli, tctx->lp_ctx, wks_creds)) {
 		d_printf("auth2 failed\n");
 		goto done;
 	}
@@ -1381,6 +1383,7 @@ bool torture_samba3_sessionkey(struct torture_context *torture)
  */
 
 static NTSTATUS pipe_bind_smb(TALLOC_CTX *mem_ctx,
+			      struct loadparm_context *lp_ctx,
 			      struct smbcli_tree *tree,
 			      const char *pipe_name,
 			      const struct ndr_interface_table *iface,
@@ -1391,7 +1394,7 @@ static NTSTATUS pipe_bind_smb(TALLOC_CTX *mem_ctx,
 
 	if (!(result = dcerpc_pipe_init(
 		      mem_ctx, tree->session->transport->socket->event.ctx, 
-		      lp_iconv_convenience(global_loadparm)))) {
+		      lp_iconv_convenience(lp_ctx)))) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
@@ -1507,7 +1510,9 @@ static struct dom_sid *name2sid(TALLOC_CTX *mem_ctx,
  * Find out the user SID on this connection
  */
 
-static struct dom_sid *whoami(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree)
+static struct dom_sid *whoami(TALLOC_CTX *mem_ctx, 
+			      struct loadparm_context *lp_ctx, 
+			      struct smbcli_tree *tree)
 {
 	struct dcerpc_pipe *lsa;
 	struct lsa_GetUserName r;
@@ -1515,7 +1520,7 @@ static struct dom_sid *whoami(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree)
 	struct lsa_StringPointer authority_name_p;
 	struct dom_sid *result;
 
-	status = pipe_bind_smb(mem_ctx, tree, "\\pipe\\lsarpc",
+	status = pipe_bind_smb(mem_ctx, lp_ctx, tree, "\\pipe\\lsarpc",
 			       &ndr_table_lsarpc, &lsa);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("(%s) Could not bind to LSA: %s\n",
@@ -1631,7 +1636,7 @@ bool torture_samba3_rpc_getusername(struct torture_context *torture)
 		goto done;
 	}
 
-	if (!(user_sid = whoami(mem_ctx, cli->tree))) {
+	if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, cli->tree))) {
 		d_printf("(%s) whoami on auth'ed connection failed\n",
 			 __location__);
 		ret = false;
@@ -1658,7 +1663,7 @@ bool torture_samba3_rpc_getusername(struct torture_context *torture)
 		goto done;
 	}
 
-	if (!(user_sid = whoami(mem_ctx, cli->tree))) {
+	if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, cli->tree))) {
 		d_printf("(%s) whoami on anon connection failed\n",
 			 __location__);
 		ret = false;
@@ -1732,7 +1737,7 @@ bool torture_samba3_rpc_getusername(struct torture_context *torture)
 			goto done;
 		}
 
-		if (!(user_sid = whoami(mem_ctx, tree))) {
+		if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, tree))) {
 			d_printf("(%s) whoami on user connection failed\n",
 				 __location__);
 			ret = false;
@@ -1870,8 +1875,8 @@ bool torture_samba3_rpc_srvsvc(struct torture_context *torture)
 		return false;
 	}
 
-	status = pipe_bind_smb(mem_ctx, cli->tree, "\\pipe\\srvsvc",
-			       &ndr_table_srvsvc, &p);
+	status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree, 
+			       "\\pipe\\srvsvc", &ndr_table_srvsvc, &p);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("(%s) could not bind to srvsvc pipe: %s\n",
 			 __location__, nt_errstr(status));
@@ -2007,6 +2012,7 @@ bool torture_samba3_rpc_randomauth2(struct torture_context *torture)
 }
 
 static struct security_descriptor *get_sharesec(TALLOC_CTX *mem_ctx,
+						struct loadparm_context *lp_ctx,
 						struct smbcli_session *sess,
 						const char *sharename)
 {
@@ -2028,7 +2034,7 @@ static struct security_descriptor *get_sharesec(TALLOC_CTX *mem_ctx,
 		return NULL;
 	}
 
-	status = pipe_bind_smb(mem_ctx, tree, "\\pipe\\srvsvc",
+	status = pipe_bind_smb(mem_ctx, lp_ctx, tree, "\\pipe\\srvsvc",
 			       &ndr_table_srvsvc, &p);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("(%s) could not bind to srvsvc pipe: %s\n",
@@ -2060,6 +2066,7 @@ static struct security_descriptor *get_sharesec(TALLOC_CTX *mem_ctx,
 }
 
 static NTSTATUS set_sharesec(TALLOC_CTX *mem_ctx,
+			     struct loadparm_context *lp_ctx,
 			     struct smbcli_session *sess,
 			     const char *sharename,
 			     struct security_descriptor *sd)
@@ -2083,7 +2090,7 @@ static NTSTATUS set_sharesec(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
-	status = pipe_bind_smb(mem_ctx, tree, "\\pipe\\srvsvc",
+	status = pipe_bind_smb(mem_ctx, lp_ctx, tree, "\\pipe\\srvsvc",
 			       &ndr_table_srvsvc, &p);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("(%s) could not bind to srvsvc pipe: %s\n",
@@ -2115,6 +2122,7 @@ static NTSTATUS set_sharesec(TALLOC_CTX *mem_ctx,
 }
 
 bool try_tcon(TALLOC_CTX *mem_ctx,
+	      struct loadparm_context *lp_ctx,
 	      struct security_descriptor *orig_sd,
 	      struct smbcli_session *session,
 	      const char *sharename, const struct dom_sid *user_sid,
@@ -2162,7 +2170,7 @@ bool try_tcon(TALLOC_CTX *mem_ctx,
                 return false;
         }
 
-	status = set_sharesec(mem_ctx, session, sharename, sd);
+	status = set_sharesec(mem_ctx, lp_ctx, session, sharename, sd);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("custom set_sharesec failed: %s\n",
 			 nt_errstr(status));
@@ -2193,7 +2201,7 @@ bool try_tcon(TALLOC_CTX *mem_ctx,
  done:
 	smbcli_rmdir(rmdir_tree, "sharesec_testdir");
 
-	status = set_sharesec(mem_ctx, session, sharename, orig_sd);
+	status = set_sharesec(mem_ctx, lp_ctx, session, sharename, orig_sd);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("custom set_sharesec failed: %s\n",
 			 nt_errstr(status));
@@ -2225,25 +2233,25 @@ bool torture_samba3_rpc_sharesec(struct torture_context *torture)
 		return false;
 	}
 
-	if (!(user_sid = whoami(mem_ctx, cli->tree))) {
+	if (!(user_sid = whoami(mem_ctx, torture->lp_ctx, cli->tree))) {
 		d_printf("whoami failed\n");
 		talloc_free(mem_ctx);
 		return false;
 	}
 
-	sd = get_sharesec(mem_ctx, cli->session, torture_setting_string(torture,
-								"share", NULL));
+	sd = get_sharesec(mem_ctx, torture->lp_ctx, cli->session, 
+			  torture_setting_string(torture, "share", NULL));
 
-	ret &= try_tcon(mem_ctx, sd, cli->session,
+	ret &= try_tcon(mem_ctx, torture->lp_ctx, sd, cli->session,
 			torture_setting_string(torture, "share", NULL),
 			user_sid, 0, NT_STATUS_ACCESS_DENIED, NT_STATUS_OK);
 
-	ret &= try_tcon(mem_ctx, sd, cli->session,
+	ret &= try_tcon(mem_ctx, torture->lp_ctx, sd, cli->session,
 			torture_setting_string(torture, "share", NULL),
 			user_sid, SEC_FILE_READ_DATA, NT_STATUS_OK,
 			NT_STATUS_MEDIA_WRITE_PROTECTED);
 
-	ret &= try_tcon(mem_ctx, sd, cli->session,
+	ret &= try_tcon(mem_ctx, torture->lp_ctx, sd, cli->session,
 			torture_setting_string(torture, "share", NULL),
 			user_sid, SEC_FILE_ALL, NT_STATUS_OK, NT_STATUS_OK);
 
@@ -2273,7 +2281,7 @@ bool torture_samba3_rpc_lsa(struct torture_context *torture)
 		return false;
 	}
 
-	status = pipe_bind_smb(mem_ctx, cli->tree, "\\lsarpc",
+	status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree, "\\lsarpc",
 			       &ndr_table_lsarpc, &p);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("(%s) pipe_bind_smb failed: %s\n", __location__,
@@ -2330,6 +2338,7 @@ bool torture_samba3_rpc_lsa(struct torture_context *torture)
 }
 
 static NTSTATUS get_servername(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree,
+			       struct smb_iconv_convenience *iconv_convenience,
 			       char **name)
 {
 	struct rap_WserverGetInfo r;
@@ -2339,7 +2348,7 @@ static NTSTATUS get_servername(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree,
 	r.in.level = 0;
 	r.in.bufsize = 0xffff;
 
-	status = smbcli_rap_netservergetinfo(tree, mem_ctx, &r);
+	status = smbcli_rap_netservergetinfo(tree, iconv_convenience, mem_ctx, &r);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -2347,7 +2356,7 @@ static NTSTATUS get_servername(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree,
 	memcpy(servername, r.out.info.info0.name, 16);
 	servername[16] = '\0';
 
-	if (pull_ascii_talloc(mem_ctx, lp_iconv_convenience(global_loadparm), 
+	if (pull_ascii_talloc(mem_ctx, iconv_convenience, 
 			      name, servername) < 0) {
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -2356,7 +2365,8 @@ static NTSTATUS get_servername(TALLOC_CTX *mem_ctx, struct smbcli_tree *tree,
 }
 
 
-static NTSTATUS find_printers(TALLOC_CTX *ctx, struct smbcli_tree *tree,
+static NTSTATUS find_printers(TALLOC_CTX *ctx, struct loadparm_context *lp_ctx,
+			      struct smbcli_tree *tree,
 			      const char ***printers, int *num_printers)
 {
 	TALLOC_CTX *mem_ctx;
@@ -2372,7 +2382,8 @@ static NTSTATUS find_printers(TALLOC_CTX *ctx, struct smbcli_tree *tree,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = pipe_bind_smb(mem_ctx, tree, "\\srvsvc", &ndr_table_srvsvc,
+	status = pipe_bind_smb(mem_ctx, lp_ctx, 
+			       tree, "\\srvsvc", &ndr_table_srvsvc,
 			       &p);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("could not bind to srvsvc pipe\n");
@@ -2552,7 +2563,7 @@ bool torture_samba3_rpc_spoolss(struct torture_context *torture)
 		return false;
 	}
 
-	status = get_servername(mem_ctx, cli->tree, &servername);
+	status = get_servername(mem_ctx, cli->tree, lp_iconv_convenience(torture->lp_ctx), &servername);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_fprintf(stderr, "(%s) get_servername returned %s\n",
 			  __location__, nt_errstr(status));
@@ -2560,7 +2571,7 @@ bool torture_samba3_rpc_spoolss(struct torture_context *torture)
 		return false;
 	}
 
-	if (!NT_STATUS_IS_OK(find_printers(mem_ctx, cli->tree,
+	if (!NT_STATUS_IS_OK(find_printers(mem_ctx, torture->lp_ctx, cli->tree,
 					   &printers, &num_printers))) {
 		talloc_free(mem_ctx);
 		return false;
@@ -2572,7 +2583,7 @@ bool torture_samba3_rpc_spoolss(struct torture_context *torture)
 		return true;
 	}
 
-	status = pipe_bind_smb(mem_ctx, cli->tree, "\\spoolss",
+	status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree, "\\spoolss",
 			       &ndr_table_spoolss, &p);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("(%s) pipe_bind_smb failed: %s\n", __location__,
@@ -2738,7 +2749,7 @@ bool torture_samba3_rpc_wkssvc(struct torture_context *torture)
 		return false;
 	}
 
-	status = get_servername(mem_ctx, cli->tree, &servername);
+	status = get_servername(mem_ctx, cli->tree, lp_iconv_convenience(torture->lp_ctx), &servername);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_fprintf(stderr, "(%s) get_servername returned %s\n",
 			  __location__, nt_errstr(status));
@@ -2746,7 +2757,7 @@ bool torture_samba3_rpc_wkssvc(struct torture_context *torture)
 		return false;
 	}
 
-	status = pipe_bind_smb(mem_ctx, cli->tree, "\\wkssvc",
+	status = pipe_bind_smb(mem_ctx, torture->lp_ctx, cli->tree, "\\wkssvc",
 			       &ndr_table_wkssvc, &p);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("(%s) pipe_bind_smb failed: %s\n", __location__,
@@ -2995,6 +3006,7 @@ bool torture_samba3_rpc_winreg(struct torture_context *torture)
 }
 
 static NTSTATUS get_shareinfo(TALLOC_CTX *mem_ctx,
+			      struct loadparm_context *lp_ctx,
 			      struct smbcli_state *cli,
 			      const char *share,
 			      struct srvsvc_NetShareInfo502 **info)
@@ -3006,7 +3018,7 @@ static NTSTATUS get_shareinfo(TALLOC_CTX *mem_ctx,
 
 	if (!(p = dcerpc_pipe_init(cli,
 				   cli->transport->socket->event.ctx,
-				   lp_iconv_convenience(global_loadparm)))) {
+				   lp_iconv_convenience(lp_ctx)))) {
 		status = NT_STATUS_NO_MEMORY;
 		goto fail;
 	}
@@ -3056,6 +3068,7 @@ static NTSTATUS get_shareinfo(TALLOC_CTX *mem_ctx,
 
 static NTSTATUS get_hklm_handle(TALLOC_CTX *mem_ctx,
 				struct smbcli_state *cli,
+				struct smb_iconv_convenience *iconv_convenience,
 				struct dcerpc_pipe **pipe_p,
 				struct policy_handle **handle)
 {
@@ -3073,7 +3086,7 @@ static NTSTATUS get_hklm_handle(TALLOC_CTX *mem_ctx,
 
 	if (!(p = dcerpc_pipe_init(result,
 				   cli->transport->socket->event.ctx,
-				   lp_iconv_convenience(global_loadparm)))) {
+				   iconv_convenience))) {
 		status = NT_STATUS_NO_MEMORY;
 		goto fail;
 	}
@@ -3118,6 +3131,7 @@ static NTSTATUS get_hklm_handle(TALLOC_CTX *mem_ctx,
 }
 
 static NTSTATUS torture_samba3_createshare(struct smbcli_state *cli,
+					   struct smb_iconv_convenience *iconv_convenience,
 					   const char *sharename)
 {
 	struct dcerpc_pipe *p;
@@ -3132,7 +3146,7 @@ static NTSTATUS torture_samba3_createshare(struct smbcli_state *cli,
 	mem_ctx = talloc_new(cli);
 	NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
 
-	status = get_hklm_handle(mem_ctx, cli, &p, &hklm);
+	status = get_hklm_handle(mem_ctx, cli, iconv_convenience, &p, &hklm);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("get_hklm_handle failed: %s\n", nt_errstr(status));
 		goto fail;
@@ -3176,7 +3190,8 @@ static NTSTATUS torture_samba3_createshare(struct smbcli_state *cli,
 	return status;
 }
 
-static NTSTATUS torture_samba3_deleteshare(struct smbcli_state *cli,
+static NTSTATUS torture_samba3_deleteshare(struct torture_context *torture,
+					   struct smbcli_state *cli,
 					   const char *sharename)
 {
 	struct dcerpc_pipe *p;
@@ -3188,7 +3203,8 @@ static NTSTATUS torture_samba3_deleteshare(struct smbcli_state *cli,
 	mem_ctx = talloc_new(cli);
 	NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
 
-	status = get_hklm_handle(cli, cli, &p, &hklm);
+	status = get_hklm_handle(cli, cli, lp_iconv_convenience(torture->lp_ctx),
+				 &p, &hklm);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("get_hklm_handle failed: %s\n", nt_errstr(status));
 		goto fail;
@@ -3215,6 +3231,7 @@ static NTSTATUS torture_samba3_deleteshare(struct smbcli_state *cli,
 }
 
 static NTSTATUS torture_samba3_setconfig(struct smbcli_state *cli,
+					 struct loadparm_context *lp_ctx,
 					 const char *sharename,
 					 const char *parameter,
 					 const char *value)
@@ -3227,7 +3244,7 @@ static NTSTATUS torture_samba3_setconfig(struct smbcli_state *cli,
 	DATA_BLOB val;
 	NTSTATUS status;
 
-	status = get_hklm_handle(cli, cli, &p, &hklm);
+	status = get_hklm_handle(cli, cli, lp_iconv_convenience(lp_ctx), &p, &hklm);
 	if (!NT_STATUS_IS_OK(status)) {
 		d_printf("get_hklm_handle failed: %s\n", nt_errstr(status));
 		return status;;
@@ -3252,7 +3269,8 @@ static NTSTATUS torture_samba3_setconfig(struct smbcli_state *cli,
 		goto done;
 	}
 
-	if (!reg_string_to_val(hklm, "REG_SZ", value, &type, &val)) {
+	if (!reg_string_to_val(hklm, lp_iconv_convenience(lp_ctx), "REG_SZ", 
+			       value, &type, &val)) {
 		d_printf("(%s) reg_string_to_val failed\n", __location__);
 		goto done;
 	}
@@ -3287,21 +3305,21 @@ bool torture_samba3_regconfig(struct torture_context *torture)
 		return false;
 	}
 
-	status = torture_samba3_createshare(cli, "blubber");
+	status = torture_samba3_createshare(cli, lp_iconv_convenience(torture->lp_ctx), "blubber");
 	if (!NT_STATUS_IS_OK(status)) {
 		torture_warning(torture, "torture_samba3_createshare failed: "
 				"%s\n", nt_errstr(status));
 		goto done;
 	}
 
-	status = torture_samba3_setconfig(cli, "blubber", "comment", comment);
+	status = torture_samba3_setconfig(cli, torture->lp_ctx, "blubber", "comment", comment);
 	if (!NT_STATUS_IS_OK(status)) {
 		torture_warning(torture, "torture_samba3_setconfig failed: "
 				"%s\n", nt_errstr(status));
 		goto done;
 	}
 
-	status = get_shareinfo(torture, cli, "blubber", &i);
+	status = get_shareinfo(torture, torture->lp_ctx, cli, "blubber", &i);
 	if (!NT_STATUS_IS_OK(status)) {
 		torture_warning(torture, "get_shareinfo failed: "
 				"%s\n", nt_errstr(status));
@@ -3314,7 +3332,7 @@ bool torture_samba3_regconfig(struct torture_context *torture)
 		goto done;
 	}
 
-	status = torture_samba3_deleteshare(cli, "blubber");
+	status = torture_samba3_deleteshare(torture, cli, "blubber");
 	if (!NT_STATUS_IS_OK(status)) {
 		torture_warning(torture, "torture_samba3_deleteshare failed: "
 				"%s\n", nt_errstr(status));
diff --git a/source4/torture/rpc/samlogon.c b/source4/torture/rpc/samlogon.c
index 7fd5199908..aba7147716 100644
--- a/source4/torture/rpc/samlogon.c
+++ b/source4/torture/rpc/samlogon.c
@@ -64,6 +64,7 @@ struct samlogon_state {
 	NTSTATUS expected_error;
 	bool old_password; /* Allow an old password to be accepted or rejected without error, as well as session key bugs */
 	DATA_BLOB chall;
+	struct smb_iconv_convenience *iconv_convenience;
 };
 
 /* 
@@ -591,7 +592,7 @@ static bool test_lmv2_ntlmv2_broken(struct samlogon_state *samlogon_state,
 	DATA_BLOB lmv2_response = data_blob(NULL, 0);
 	DATA_BLOB lmv2_session_key = data_blob(NULL, 0);
 	DATA_BLOB ntlmv2_session_key = data_blob(NULL, 0);
-	DATA_BLOB names_blob = NTLMv2_generate_names_blob(samlogon_state->mem_ctx, TEST_MACHINE_NAME, lp_workgroup(global_loadparm));
+	DATA_BLOB names_blob = NTLMv2_generate_names_blob(samlogon_state->mem_ctx, samlogon_state->iconv_convenience, TEST_MACHINE_NAME, lp_workgroup(global_loadparm));
 
 	uint8_t lm_session_key[8];
 	uint8_t user_session_key[16];
@@ -739,7 +740,7 @@ static bool test_lmv2_ntlm_broken(struct samlogon_state *samlogon_state,
 	DATA_BLOB lmv2_response = data_blob(NULL, 0);
 	DATA_BLOB lmv2_session_key = data_blob(NULL, 0);
 	DATA_BLOB ntlmv2_session_key = data_blob(NULL, 0);
-	DATA_BLOB names_blob = NTLMv2_generate_names_blob(samlogon_state->mem_ctx, lp_netbios_name(global_loadparm), lp_workgroup(global_loadparm));
+	DATA_BLOB names_blob = NTLMv2_generate_names_blob(samlogon_state->mem_ctx, samlogon_state->iconv_convenience, lp_netbios_name(global_loadparm), lp_workgroup(global_loadparm));
 
 	DATA_BLOB ntlm_response = data_blob_talloc(samlogon_state->mem_ctx, NULL, 24);
 	DATA_BLOB ntlm_session_key = data_blob_talloc(samlogon_state->mem_ctx, NULL, 16);
@@ -1158,7 +1159,7 @@ static bool test_plaintext(struct samlogon_state *samlogon_state, enum ntlm_brea
 	ZERO_STRUCT(user_session_key);
 	
 	if ((push_ucs2_talloc(samlogon_state->mem_ctx, 
-			      lp_iconv_convenience(global_loadparm), 
+			      samlogon_state->iconv_convenience, 
 			      &unicodepw, samlogon_state->password)) == -1) {
 		DEBUG(0, ("push_ucs2_allocate failed!\n"));
 		exit(1);
@@ -1169,7 +1170,7 @@ static bool test_plaintext(struct samlogon_state *samlogon_state, enum ntlm_brea
 	password = strupper_talloc(samlogon_state->mem_ctx, samlogon_state->password);
 
 	if ((convert_string_talloc(samlogon_state->mem_ctx, 
-				   lp_iconv_convenience(global_loadparm),
+				   samlogon_state->iconv_convenience,
 				   CH_UNIX, CH_DOS, 
 				   password, strlen(password)+1, 
 				   (void**)&dospw)) == -1) {
@@ -1310,6 +1311,7 @@ static const struct ntlm_tests {
   try a netlogon SamLogon
 */
 static bool test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, 
+			  struct torture_context *tctx,
 			  struct creds_CredentialState *creds, 
 			  const char *comment,
 			  const char *account_domain, const char *account_name, 
@@ -1340,6 +1342,7 @@ static bool test_SamLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	samlogon_state.chall = data_blob_talloc(fn_ctx, NULL, 8);
 	samlogon_state.parameter_control = parameter_control;
 	samlogon_state.old_password = old_password;
+	samlogon_state.iconv_convenience = lp_iconv_convenience(tctx->lp_ctx);
 
 	generate_random_buffer(samlogon_state.chall.data, 8);
 	samlogon_state.r_flags.in.server_name = talloc_asprintf(fn_ctx, "\\\\%s", dcerpc_server_name(p));
@@ -1792,7 +1795,7 @@ bool torture_rpc_samlogon(struct torture_context *torture)
 			}
 		
 			if (usercreds[ci].network_login) {
-				if (!test_SamLogon(p, mem_ctx, creds, 
+				if (!test_SamLogon(p, mem_ctx, torture, creds, 
 						   usercreds[ci].comment,
 						   usercreds[ci].domain,
 						   usercreds[ci].username,
@@ -1825,7 +1828,7 @@ bool torture_rpc_samlogon(struct torture_context *torture)
 			}
 		
 			if (usercreds[0].network_login) {
-				if (!test_SamLogon(p, mem_ctx, creds,
+				if (!test_SamLogon(p, mem_ctx, torture, creds,
 						   usercreds[0].comment,
 						   usercreds[0].domain,
 						   usercreds[0].username,
diff --git a/source4/torture/rpc/samsync.c b/source4/torture/rpc/samsync.c
index 1f7f9f463e..865ebf9fd2 100644
--- a/source4/torture/rpc/samsync.c
+++ b/source4/torture/rpc/samsync.c
@@ -398,7 +398,7 @@ static bool samsync_handle_policy(TALLOC_CTX *mem_ctx, struct samsync_state *sam
 	return true;
 }
 
-static bool samsync_handle_user(TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
+static bool samsync_handle_user(struct torture_context *tctx, TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
 				int database_id, struct netr_DELTA_ENUM *delta) 
 {
 	uint32_t rid = delta->delta_id_union.rid;
@@ -548,7 +548,7 @@ static bool samsync_handle_user(TALLOC_CTX *mem_ctx, struct samsync_state *samsy
 		data.data = user->user_private_info.SensitiveData;
 		data.length = user->user_private_info.DataLength;
 		creds_arcfour_crypt(samsync_state->creds, data.data, data.length);
-		ndr_err = ndr_pull_struct_blob(&data, mem_ctx, lp_iconv_convenience(global_loadparm), &keys, (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
+		ndr_err = ndr_pull_struct_blob(&data, mem_ctx, lp_iconv_convenience(tctx->lp_ctx), &keys, (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
 		if (NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			if (keys.keys.keys2.lmpassword.length == 16) {
 				sam_rid_crypt(rid, keys.keys.keys2.lmpassword.pwd.hash, lm_hash.hash, 0);
@@ -1101,8 +1101,9 @@ static bool samsync_handle_account(TALLOC_CTX *mem_ctx, struct samsync_state *sa
 /*
   try a netlogon DatabaseSync
 */
-static bool test_DatabaseSync(struct samsync_state *samsync_state,
-			      TALLOC_CTX *mem_ctx)
+static bool test_DatabaseSync(struct torture_context *tctx, 
+							  struct samsync_state *samsync_state,
+							  TALLOC_CTX *mem_ctx)
 {
 	NTSTATUS status;
 	TALLOC_CTX *loop_ctx, *delta_ctx, *trustdom_ctx;
@@ -1162,7 +1163,7 @@ static bool test_DatabaseSync(struct samsync_state *samsync_state,
 					}
 					break;
 				case NETR_DELTA_USER:
-					if (!samsync_handle_user(delta_ctx, samsync_state, 
+					if (!samsync_handle_user(tctx, delta_ctx, samsync_state, 
 								 r.in.database_id, &r.out.delta_enum_array->delta_enum[d])) {
 						printf("Failed to handle DELTA_USER\n");
 						ret = false;
@@ -1611,7 +1612,7 @@ bool torture_rpc_samsync(struct torture_context *torture)
 		ret = false;
 	}
 
-	if (!test_DatabaseSync(samsync_state, mem_ctx)) {
+	if (!test_DatabaseSync(torture, samsync_state, mem_ctx)) {
 		printf("DatabaseSync failed\n");
 		ret = false;
 	}
diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c
index cb9b8be2c9..5a91366980 100644
--- a/source4/torture/rpc/schannel.c
+++ b/source4/torture/rpc/schannel.c
@@ -64,7 +64,7 @@ bool test_netlogon_ex_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
 	chal = data_blob_const(ninfo.challenge, 
 			       sizeof(ninfo.challenge));
 
-	names_blob = NTLMv2_generate_names_blob(tctx, cli_credentials_get_workstation(credentials), 
+	names_blob = NTLMv2_generate_names_blob(tctx, lp_iconv_convenience(tctx->lp_ctx), cli_credentials_get_workstation(credentials), 
 						cli_credentials_get_domain(credentials));
 
 	status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx, 
diff --git a/source4/torture/rpc/winreg.c b/source4/torture/rpc/winreg.c
index d77295605f..4695733671 100644
--- a/source4/torture/rpc/winreg.c
+++ b/source4/torture/rpc/winreg.c
@@ -38,12 +38,9 @@
 
 #define TEST_SID "S-1-5-21-1234567890-1234567890-1234567890-500"
 
-static void init_initshutdown_String(TALLOC_CTX *mem_ctx,
-				     struct initshutdown_String *name,
-				     const char *s)
+static void init_lsa_StringLarge(struct lsa_StringLarge *name, const char *s)
 {
-	name->name = talloc(mem_ctx, struct initshutdown_String_sub);
-	name->name->name = s;
+	name->string = s;
 }
 
 static void init_winreg_String(struct winreg_String *name, const char *s)
@@ -1636,8 +1633,8 @@ static bool test_InitiateSystemShutdown(struct torture_context *tctx,
 	uint16_t hostname = 0x0;
 
 	r.in.hostname = &hostname;
-	r.in.message = talloc(tctx, struct initshutdown_String);
-	init_initshutdown_String(tctx, r.in.message, "spottyfood");
+	r.in.message = talloc(tctx, struct lsa_StringLarge);
+	init_lsa_StringLarge(r.in.message, "spottyfood");
 	r.in.force_apps = 1;
 	r.in.timeout = 30;
 	r.in.reboot = 1;
@@ -1660,8 +1657,8 @@ static bool test_InitiateSystemShutdownEx(struct torture_context *tctx,
 	uint16_t hostname = 0x0;
 
 	r.in.hostname = &hostname;
-	r.in.message = talloc(tctx, struct initshutdown_String);
-	init_initshutdown_String(tctx, r.in.message, "spottyfood");
+	r.in.message = talloc(tctx, struct lsa_StringLarge);
+	init_lsa_StringLarge(r.in.message, "spottyfood");
 	r.in.force_apps = 1;
 	r.in.timeout = 30;
 	r.in.reboot = 1;
diff --git a/source4/torture/smbtorture.c b/source4/torture/smbtorture.c
index 371ddc7297..4eeea73003 100644
--- a/source4/torture/smbtorture.c
+++ b/source4/torture/smbtorture.c
@@ -615,8 +615,6 @@ int main(int argc,char *argv[])
 		alarm(max_runtime);
 	}
 
-	ldb_global_init();
-
 	if (extra_module != NULL) {
 	    init_module_fn fn = load_module(talloc_autofree_context(), poptGetOptArg(pc));
 
diff --git a/source4/utils/net/net.c b/source4/utils/net/net.c
index 2c95e9033d..e0865c4416 100644
--- a/source4/utils/net/net.c
+++ b/source4/utils/net/net.c
@@ -182,8 +182,6 @@ static int binary_net(int argc, const char **argv)
 
 	dcerpc_init();
 
-	ldb_global_init();
-
 	mem_ctx = talloc_init("net_context");
 	ctx = talloc(mem_ctx, struct net_context);
 	if (!ctx) {
diff --git a/source4/winbind/config.mk b/source4/winbind/config.mk
index da5b71f2ae..2567d617da 100644
--- a/source4/winbind/config.mk
+++ b/source4/winbind/config.mk
@@ -37,6 +37,7 @@ OBJ_FILES = \
 		wb_sam_logon.o
 PRIVATE_DEPENDENCIES = \
 		WB_HELPER \
+		IDMAP \
 		NDR_WINBIND \
 		process_model \
 		RPC_NDR_LSA \
@@ -56,3 +57,13 @@ OBJ_FILES = \
 PUBLIC_DEPENDENCIES = RPC_NDR_LSA dcerpc_samr
 # End SUBSYSTEM WB_HELPER
 ################################################
+
+################################################
+# Start SUBYSTEM IDMAP
+[SUBSYSTEM::IDMAP]
+PRIVATE_PROTO_HEADER = idmap_proto.h
+OBJ_FILES = \
+		idmap.o
+PUBLIC_DEPENDENCIES = SAMDB_COMMON
+# End SUBSYSTEM IDMAP
+################################################
diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
new file mode 100644
index 0000000000..3372ad51ee
--- /dev/null
+++ b/source4/winbind/idmap.c
@@ -0,0 +1,1072 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Map SIDs to uids/gids and back
+
+   Copyright (C) Kai Blin 2008
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "auth/auth.h"
+#include "librpc/gen_ndr/lsa.h"
+#include "librpc/gen_ndr/samr.h"
+#include "librpc/gen_ndr/ndr_security.h"
+#include "lib/ldb/include/ldb.h"
+#include "lib/ldb/include/ldb_errors.h"
+#include "lib/ldb_wrap.h"
+#include "param/param.h"
+#include "winbind/idmap.h"
+#include "libcli/security/proto.h"
+#include "libcli/ldap/ldap_ndr.h"
+
+/**
+ * Get uid/gid bounds from idmap database
+ *
+ * \param idmap_ctx idmap context to use
+ * \param low lower uid/gid bound is stored here
+ * \param high upper uid/gid bound is stored here
+ * \return 0 on success, nonzero on failure
+ */
+static int idmap_get_bounds(struct idmap_context *idmap_ctx, uint32_t *low,
+		uint32_t *high)
+{
+	int ret = -1;
+	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+	struct ldb_dn *dn;
+	struct ldb_result *res = NULL;
+	TALLOC_CTX *tmp_ctx = talloc_new(idmap_ctx);
+	uint32_t lower_bound = (uint32_t) -1;
+	uint32_t upper_bound = (uint32_t) -1;
+
+	dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
+	if (dn == NULL) goto failed;
+
+	ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+	if (ret != LDB_SUCCESS) goto failed;
+
+	talloc_steal(tmp_ctx, res);
+
+	if (res->count != 1) {
+		ret = -1;
+		goto failed;
+	}
+
+	lower_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "lowerBound", -1);
+	if (lower_bound != (uint32_t) -1) {
+		ret = LDB_SUCCESS;
+	} else {
+		ret = -1;
+		goto failed;
+	}
+
+	upper_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "upperBound", -1);
+	if (upper_bound != (uint32_t) -1) {
+		ret = LDB_SUCCESS;
+	} else {
+		ret = -1;
+	}
+
+failed:
+	talloc_free(tmp_ctx);
+	*low  = lower_bound;
+	*high = upper_bound;
+	return ret;
+}
+
+/**
+ * Add a dom_sid structure to a ldb_message
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context to use
+ * \param ldb_message ldb message to add dom_sid to
+ * \param attr_name name of the attribute to store the dom_sid in
+ * \param sid dom_sid to store
+ * \return 0 on success, an ldb error code on failure.
+ */
+static int idmap_msg_add_dom_sid(struct idmap_context *idmap_ctx,
+		TALLOC_CTX *mem_ctx, struct ldb_message *msg,
+		const char *attr_name, const struct dom_sid *sid)
+{
+	struct ldb_val val;
+	enum ndr_err_code ndr_err;
+
+	ndr_err = ndr_push_struct_blob(&val, mem_ctx,
+				       lp_iconv_convenience(idmap_ctx->lp_ctx),
+				       sid,
+				       (ndr_push_flags_fn_t)ndr_push_dom_sid);
+
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return -1;
+	}
+
+	return ldb_msg_add_value(msg, attr_name, &val, NULL);
+}
+
+/**
+ * Get a dom_sid structure from a ldb message.
+ *
+ * \param mem_ctx talloc context to allocate dom_sid memory in
+ * \param msg ldb_message to get dom_sid from
+ * \param attr_name key that has the dom_sid as data
+ * \return dom_sid structure on success, NULL on failure
+ */
+static struct dom_sid *idmap_msg_get_dom_sid(TALLOC_CTX *mem_ctx,
+		struct ldb_message *msg, const char *attr_name)
+{
+	struct dom_sid *sid;
+	const struct ldb_val *val;
+	enum ndr_err_code ndr_err;
+
+	val = ldb_msg_find_ldb_val(msg, attr_name);
+	if (val == NULL) {
+		return NULL;
+	}
+
+	sid = talloc(mem_ctx, struct dom_sid);
+	if (sid == NULL) {
+		return NULL;
+	}
+
+	ndr_err = ndr_pull_struct_blob(val, sid, NULL, sid,
+				       (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		talloc_free(sid);
+		return NULL;
+	}
+
+	return sid;
+}
+
+/**
+ * Initialize idmap context
+ *
+ * talloc_free to close.
+ *
+ * \param mem_ctx talloc context to use.
+ * \return allocated idmap_context on success, NULL on error
+ */
+struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx,
+		struct loadparm_context *lp_ctx)
+{
+	struct idmap_context *idmap_ctx;
+
+	idmap_ctx = talloc(mem_ctx, struct idmap_context);
+	if (idmap_ctx == NULL) {
+		return NULL;
+	}
+
+	idmap_ctx->lp_ctx = lp_ctx;
+
+	idmap_ctx->ldb_ctx = ldb_wrap_connect(mem_ctx, lp_ctx,
+					      lp_idmap_url(lp_ctx),
+					      system_session(mem_ctx, lp_ctx),
+					      NULL, 0, NULL);
+	if (idmap_ctx->ldb_ctx == NULL) {
+		return NULL;
+	}
+
+	return idmap_ctx;
+}
+
+/**
+ * Convert a uid to the corresponding SID
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
+ * from.
+ * \param uid Unix uid to map to a SID
+ * \param sid Pointer that will take the struct dom_sid pointer if the mapping
+ * succeeds.
+ * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
+ * possible or some other NTSTATUS that is more descriptive on failure.
+ */
+
+NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+		const uid_t uid, struct dom_sid **sid)
+{
+	int ret;
+	NTSTATUS status = NT_STATUS_NONE_MAPPED;
+	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+	struct ldb_message *msg;
+	struct ldb_result *res = NULL;
+	int trans = -1;
+	uid_t low, high;
+	char *sid_string, *uid_string;
+	struct dom_sid *unix_users_sid, *new_sid;
+	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
+				 uid);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count == 1) {
+		*sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0],
+					     "objectSid");
+		if (*sid == NULL) {
+			DEBUG(1, ("Failed to get sid from db: %u\n", ret));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+		talloc_free(tmp_ctx);
+		return NT_STATUS_OK;
+	}
+
+	DEBUG(6, ("uid not found in idmap db, trying to allocate SID.\n"));
+
+	trans = ldb_transaction_start(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	/* Now redo the search to make sure noone added a mapping for that SID
+	 * while we weren't looking.*/
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
+				 uid);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count > 0) {
+		DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
+		status = NT_STATUS_RETRY;
+		goto failed;
+	}
+
+	ret = idmap_get_bounds(idmap_ctx, &low, &high);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (uid >= low && uid <= high) {
+		/* An existing user would have been mapped before */
+		status = NT_STATUS_NO_SUCH_USER;
+		goto failed;
+	}
+
+	/* For local users, we just create a rid = uid +1, so root doesn't end
+	 * up with a 0 rid */
+	unix_users_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
+	if (unix_users_sid == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	new_sid = dom_sid_add_rid(mem_ctx, unix_users_sid, uid + 1);
+	if (new_sid == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	sid_string = dom_sid_string(tmp_ctx, new_sid);
+	if (sid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	uid_string = talloc_asprintf(tmp_ctx, "%u", uid);
+	if (uid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	msg = ldb_msg_new(tmp_ctx);
+	if (msg == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+	if (msg->dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "uidNumber", uid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
+				    new_sid);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "cn", sid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_add(ldb, msg);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	trans = ldb_transaction_commit(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	*sid = new_sid;
+	talloc_free(tmp_ctx);
+	return NT_STATUS_OK;
+
+failed:
+	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+	talloc_free(tmp_ctx);
+	return status;
+}
+
+/**
+ * Map a Unix gid to the corresponding SID
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
+ * from.
+ * \param gid Unix gid to map to a SID
+ * \param sid Pointer that will take the struct dom_sid pointer if mapping
+ * succeeds.
+ * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
+ * possible or some other NTSTATUS that is more descriptive on failure.
+ */
+NTSTATUS idmap_gid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+		const gid_t gid, struct dom_sid **sid)
+{
+	int ret;
+	NTSTATUS status = NT_STATUS_NONE_MAPPED;
+	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+	struct ldb_message *msg;
+	struct ldb_result *res = NULL;
+	int trans = -1;
+	gid_t low, high;
+	char *sid_string, *gid_string;
+	struct dom_sid *unix_groups_sid, *new_sid;
+	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+			NULL, "(&(objectClass=sidMap)(gidNumber=%u))", gid);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count == 1) {
+		*sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0],
+				"objectSid");
+		if (*sid == NULL) {
+			DEBUG(1, ("Failed to get sid from db: %u\n", ret));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+		/* No change, so cancel the transaction */
+		ldb_transaction_cancel(ldb);
+		talloc_free(tmp_ctx);
+		return NT_STATUS_OK;
+	}
+
+	DEBUG(6, ("gid not found in idmap db, trying to allocate SID.\n"));
+
+	trans = ldb_transaction_start(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	/* Now redo the search to make sure noone added a mapping for that SID
+	 * while we weren't looking.*/
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(gidNumber=%u))",
+				 gid);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count > 0) {
+		DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
+		status = NT_STATUS_RETRY;
+		goto failed;
+	}
+
+	ret = idmap_get_bounds(idmap_ctx, &low, &high);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (gid >= low && gid <= high) {
+		/* An existing group would have been mapped before */
+		status = NT_STATUS_NO_SUCH_USER;
+		goto failed;
+	}
+
+	/* For local groups, we just create a rid = gid +1, so root doesn't end
+	 * up with a 0 rid */
+	unix_groups_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-2");
+	if (unix_groups_sid == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	new_sid = dom_sid_add_rid(mem_ctx, unix_groups_sid, gid + 1);
+	if (new_sid == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	sid_string = dom_sid_string(tmp_ctx, new_sid);
+	if (sid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	gid_string = talloc_asprintf(tmp_ctx, "%u", gid);
+	if (gid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	msg = ldb_msg_new(tmp_ctx);
+	if (msg == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+	if (msg->dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "gidNumber", gid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
+			new_sid);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "cn", sid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_add(ldb, msg);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	trans = ldb_transaction_commit(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	*sid = new_sid;
+	talloc_free(tmp_ctx);
+	return NT_STATUS_OK;
+
+failed:
+	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+	talloc_free(tmp_ctx);
+	return status;
+}
+
+/**
+ * Map a SID to a Unix uid.
+ *
+ * If no mapping exists, a new mapping will be created.
+ *
+ * \todo Check if SIDs can be resolved if lp_idmap_trusted_only() == true
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context to use
+ * \param sid SID to map to a Unix uid
+ * \param uid pointer to receive the mapped uid
+ * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
+ * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
+ * mapping failed.
+ */
+NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+		const struct dom_sid *sid, uid_t *uid)
+{
+	int ret;
+	NTSTATUS status = NT_STATUS_NONE_MAPPED;
+	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+	struct ldb_dn *dn;
+	struct ldb_message *hwm_msg, *map_msg;
+	struct ldb_result *res = NULL;
+	int trans;
+	uid_t low, high, hwm, new_uid;
+	char *sid_string, *uid_string, *hwm_string;
+	bool hwm_entry_exists;
+	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count == 1) {
+		new_uid = ldb_msg_find_attr_as_uint(res->msgs[0], "uidNumber",
+						    -1);
+		if (new_uid == (uid_t) -1) {
+			DEBUG(1, ("Invalid uid mapping.\n"));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+		*uid = new_uid;
+		talloc_free(tmp_ctx);
+		return NT_STATUS_OK;
+	}
+
+	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
+
+	trans = ldb_transaction_start(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	/* Redo the search to make sure noone changed the mapping while we
+	 * weren't looking */
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count > 0) {
+		DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
+		status = NT_STATUS_RETRY;
+		goto failed;
+	}
+
+	/*FIXME: if lp_idmap_trusted_only() == true, check if SID can be
+	 * resolved here. */
+
+	ret = idmap_get_bounds(idmap_ctx, &low, &high);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
+	if (dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	talloc_steal(tmp_ctx, res);
+
+	if (res->count != 1) {
+		DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "uidNumber", -1);
+	if (hwm == (uid_t)-1) {
+		hwm = low;
+		hwm_entry_exists = false;
+	} else {
+		hwm_entry_exists = true;
+	}
+
+	if (hwm > high) {
+		DEBUG(1, ("Out of uids to allocate.\n"));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	hwm_msg = ldb_msg_new(tmp_ctx);
+	if (hwm_msg == NULL) {
+		DEBUG(1, ("Out of memory when creating ldb_message\n"));
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	hwm_msg->dn = dn;
+
+	new_uid = hwm;
+	hwm++;
+
+	hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
+	if (hwm_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	sid_string = dom_sid_string(tmp_ctx, sid);
+	if (sid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	uid_string = talloc_asprintf(tmp_ctx, "%u", new_uid);
+	if (uid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	if (hwm_entry_exists) {
+		struct ldb_message_element *els;
+		struct ldb_val *vals;
+
+		/* We're modifying the entry, not just adding a new one. */
+		els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
+		if (els == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		vals = talloc_array(tmp_ctx, struct ldb_val, 2);
+		if (els == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		hwm_msg->num_elements = 2;
+		hwm_msg->elements = els;
+
+		els[0].num_values = 1;
+		els[0].values = &vals[0];
+		els[0].flags = LDB_FLAG_MOD_DELETE;
+		els[0].name = talloc_strdup(tmp_ctx, "uidNumber");
+		if (els[0].name == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		els[1].num_values = 1;
+		els[1].values = &vals[1];
+		els[1].flags = LDB_FLAG_MOD_ADD;
+		els[1].name = els[0].name;
+
+		vals[0].data = (uint8_t *)uid_string;
+		vals[0].length = strlen(uid_string);
+		vals[1].data = (uint8_t *)hwm_string;
+		vals[1].length = strlen(hwm_string);
+	} else {
+		ret = ldb_msg_add_empty(hwm_msg, "uidNumber", LDB_FLAG_MOD_ADD,
+					NULL);
+		if (ret != LDB_SUCCESS) {
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+
+		ret = ldb_msg_add_string(hwm_msg, "uidNumber", hwm_string);
+		if (ret != LDB_SUCCESS)
+		{
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+	}
+
+	ret = ldb_modify(ldb, hwm_msg);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Updating the uid high water mark failed: %s\n",
+			  ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	map_msg = ldb_msg_new(tmp_ctx);
+	if (map_msg == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+	if (map_msg->dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "uidNumber", uid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
+			sid);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "cn", sid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_add(ldb, map_msg);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	trans = ldb_transaction_commit(ldb);
+	if (trans != LDB_SUCCESS) {
+		DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	*uid = new_uid;
+	talloc_free(tmp_ctx);
+	return NT_STATUS_OK;
+
+failed:
+	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+	talloc_free(tmp_ctx);
+	return status;
+}
+
+/**
+ * Map a SID to a Unix gid.
+ *
+ * If no mapping exist, a new mapping will be created.
+ *
+ * \todo Check if SID resolve when lp_idmap_trusted_only() == true
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context to use
+ * \param sid SID to map to a Unix gid
+ * \param gid pointer to receive the mapped gid
+ * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
+ * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
+ * mapping failed.
+ */
+NTSTATUS idmap_sid_to_gid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+		const struct dom_sid *sid, gid_t *gid)
+{
+	int ret;
+	NTSTATUS status = NT_STATUS_NONE_MAPPED;
+	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+	struct ldb_dn *dn;
+	struct ldb_message *hwm_msg, *map_msg;
+	struct ldb_result *res = NULL;
+	int trans = -1;
+	gid_t low, high, hwm, new_gid;
+	char *sid_string, *gid_string, *hwm_string;
+	bool hwm_entry_exists;
+	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count == 1) {
+		new_gid = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber",
+				-1);
+		if (new_gid == (gid_t) -1) {
+			DEBUG(1, ("Invalid gid mapping.\n"));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+		*gid = new_gid;
+		talloc_free(tmp_ctx);
+		return NT_STATUS_OK;
+	}
+
+	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
+
+	trans = ldb_transaction_start(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	/* Redo the search to make sure noone changed the mapping while we
+	 * weren't looking */
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count > 0) {
+		DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
+		status = NT_STATUS_RETRY;
+		goto failed;
+	}
+
+	/*FIXME: if lp_idmap_trusted_only() == true, check if SID can be
+	 * resolved here. */
+
+	ret = idmap_get_bounds(idmap_ctx, &low, &high);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
+	if (dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	talloc_steal(tmp_ctx, res);
+
+	if (res->count != 1) {
+		DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber", -1);
+	if (hwm == (gid_t)-1) {
+		hwm = low;
+		hwm_entry_exists = false;
+	} else {
+		hwm_entry_exists = true;
+	}
+
+	if (hwm > high) {
+		DEBUG(1, ("Out of gids to allocate.\n"));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	hwm_msg = ldb_msg_new(tmp_ctx);
+	if (hwm_msg == NULL) {
+		DEBUG(1, ("Out of memory when creating ldb_message\n"));
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	hwm_msg->dn = dn;
+
+	new_gid = hwm;
+	hwm++;
+
+	hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
+	if (hwm_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	sid_string = dom_sid_string(tmp_ctx, sid);
+	if (sid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	gid_string = talloc_asprintf(tmp_ctx, "%u", new_gid);
+	if (gid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	if (hwm_entry_exists) {
+		struct ldb_message_element *els;
+		struct ldb_val *vals;
+
+		/* We're modifying the entry, not just adding a new one. */
+		els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
+		if (els == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		vals = talloc_array(tmp_ctx, struct ldb_val, 2);
+		if (els == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		hwm_msg->num_elements = 2;
+		hwm_msg->elements = els;
+
+		els[0].num_values = 1;
+		els[0].values = &vals[0];
+		els[0].flags = LDB_FLAG_MOD_DELETE;
+		els[0].name = talloc_strdup(tmp_ctx, "gidNumber");
+		if (els[0].name == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		els[1].num_values = 1;
+		els[1].values = &vals[1];
+		els[1].flags = LDB_FLAG_MOD_ADD;
+		els[1].name = els[0].name;
+
+		vals[0].data = (uint8_t *)gid_string;
+		vals[0].length = strlen(gid_string);
+		vals[1].data = (uint8_t *)hwm_string;
+		vals[1].length = strlen(hwm_string);
+	} else {
+		ret = ldb_msg_add_empty(hwm_msg, "gidNumber", LDB_FLAG_MOD_ADD,
+					NULL);
+		if (ret != LDB_SUCCESS) {
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+
+		ret = ldb_msg_add_string(hwm_msg, "gidNumber", hwm_string);
+		if (ret != LDB_SUCCESS)
+		{
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+	}
+
+	ret = ldb_modify(ldb, hwm_msg);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Updating the gid high water mark failed: %s\n",
+			  ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	map_msg = ldb_msg_new(tmp_ctx);
+	if (map_msg == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+	if (map_msg->dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "gidNumber", gid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
+			sid);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "cn", sid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_add(ldb, map_msg);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	trans = ldb_transaction_commit(ldb);
+	if (trans != LDB_SUCCESS) {
+		DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	*gid = new_gid;
+	talloc_free(tmp_ctx);
+	return NT_STATUS_OK;
+
+failed:
+	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+	talloc_free(tmp_ctx);
+	return status;
+}
+
diff --git a/source4/winbind/idmap.h b/source4/winbind/idmap.h
new file mode 100644
index 0000000000..8781819be0
--- /dev/null
+++ b/source4/winbind/idmap.h
@@ -0,0 +1,33 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Map SIDs to uids/gids and back
+
+   Copyright (C) Kai Blin 2008
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _IDMAP_H_
+#define _IDMAP_H_
+
+struct idmap_context {
+	struct loadparm_context *lp_ctx;
+	struct ldb_context *ldb_ctx;
+};
+
+#include "winbind/idmap_proto.h"
+
+#endif
+
diff --git a/source4/winbind/wb_gid2sid.c b/source4/winbind/wb_gid2sid.c
index 5c0b87118d..f2577029aa 100644
--- a/source4/winbind/wb_gid2sid.c
+++ b/source4/winbind/wb_gid2sid.c
@@ -25,6 +25,7 @@
 #include "smbd/service_task.h"
 #include "winbind/wb_helper.h"
 #include "libcli/security/proto.h"
+#include "winbind/idmap.h"
 
 struct gid2sid_state {
 	struct composite_context *ctx;
@@ -50,10 +51,14 @@ struct composite_context *wb_gid2sid_send(TALLOC_CTX *mem_ctx,
 	result->private_data = state;
 	state->service = service;
 
-	/* FIXME: This is a stub so far.
-	 * We cheat by just using the gid as RID with the domain SID.*/
-	state->sid = dom_sid_add_rid(result, service->primary_sid, gid);
-	if (composite_nomem(state->sid, state->ctx)) return result;
+	state->ctx->status = idmap_gid_to_sid(service->idmap_ctx, mem_ctx, gid,
+					      &state->sid);
+	if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
+		state->ctx->status = idmap_gid_to_sid(service->idmap_ctx,
+						      mem_ctx, gid,
+						      &state->sid);
+	}
+	if (!composite_is_ok(state->ctx)) return result;
 
 	composite_done(state->ctx);
 	return result;
diff --git a/source4/winbind/wb_pam_auth.c b/source4/winbind/wb_pam_auth.c
index a34f3fbdd0..0073e3fdf8 100644
--- a/source4/winbind/wb_pam_auth.c
+++ b/source4/winbind/wb_pam_auth.c
@@ -258,6 +258,7 @@ struct composite_context *wb_cmd_pam_auth_send(TALLOC_CTX *mem_ctx,
 
 	names_blob = NTLMv2_generate_names_blob(
 		mem_ctx,
+		lp_iconv_convenience(service->task->lp_ctx),
 		cli_credentials_get_workstation(credentials), 
 		cli_credentials_get_domain(credentials));
 
diff --git a/source4/winbind/wb_server.c b/source4/winbind/wb_server.c
index 9b303f3615..99191f3c6c 100644
--- a/source4/winbind/wb_server.c
+++ b/source4/winbind/wb_server.c
@@ -149,6 +149,12 @@ static void winbind_task_init(struct task_server *task)
 		return;
 	}
 
+	service->idmap_ctx = idmap_init(service, task->lp_ctx);
+	if (service->idmap_ctx == NULL) {
+		task_server_terminate(task, "Failed to load idmap database");
+		return;
+	}
+
 	/* setup the unprivileged samba3 socket */
 	listen_socket = talloc(service, struct wbsrv_listen_socket);
 	if (!listen_socket) goto nomem;
diff --git a/source4/winbind/wb_server.h b/source4/winbind/wb_server.h
index f3cfc18565..ce972932f5 100644
--- a/source4/winbind/wb_server.h
+++ b/source4/winbind/wb_server.h
@@ -21,6 +21,7 @@
 
 #include "nsswitch/winbind_nss_config.h"
 #include "nsswitch/winbind_struct_protocol.h"
+#include "winbind/idmap.h"
 #include "libnet/libnet.h"
 
 #define WINBINDD_SAMBA3_SOCKET "pipe"
@@ -33,6 +34,7 @@ struct wbsrv_service {
 
 	const struct dom_sid *primary_sid;
 	struct wbsrv_domain *domains;
+	struct idmap_context *idmap_ctx;
 };
 
 struct wbsrv_samconn {
diff --git a/source4/winbind/wb_sid2gid.c b/source4/winbind/wb_sid2gid.c
index 8cb5608b2f..12129226be 100644
--- a/source4/winbind/wb_sid2gid.c
+++ b/source4/winbind/wb_sid2gid.c
@@ -25,6 +25,7 @@
 #include "smbd/service_task.h"
 #include "winbind/wb_helper.h"
 #include "libcli/security/proto.h"
+#include "winbind/idmap.h"
 
 struct sid2gid_state {
 	struct composite_context *ctx;
@@ -50,9 +51,13 @@ struct composite_context *wb_sid2gid_send(TALLOC_CTX *mem_ctx,
 	result->private_data = state;
 	state->service = service;
 
-	/*FIXME: This is a stub so far. */
-	state->ctx->status = dom_sid_split_rid(result, sid, NULL, &state->gid);
-	if(!composite_is_ok(state->ctx)) return result;
+	state->ctx->status = idmap_sid_to_gid(service->idmap_ctx, state, sid,
+					      &state->gid);
+	if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
+		state->ctx->status = idmap_sid_to_gid(service->idmap_ctx, state,
+						      sid, &state->gid);
+	}
+	if (!composite_is_ok(state->ctx)) return result;
 
 	composite_done(state->ctx);
 	return result;
diff --git a/source4/winbind/wb_sid2uid.c b/source4/winbind/wb_sid2uid.c
index 449596ef38..0de45fdea9 100644
--- a/source4/winbind/wb_sid2uid.c
+++ b/source4/winbind/wb_sid2uid.c
@@ -3,7 +3,7 @@
 
    Map a SID to a uid
 
-   Copyright (C) Kai Blin 2007
+   Copyright (C) Kai Blin 2007-2008
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -25,6 +25,7 @@
 #include "smbd/service_task.h"
 #include "winbind/wb_helper.h"
 #include "libcli/security/proto.h"
+#include "winbind/idmap.h"
 
 struct sid2uid_state {
 	struct composite_context *ctx;
@@ -50,11 +51,13 @@ struct composite_context *wb_sid2uid_send(TALLOC_CTX *mem_ctx,
 	result->private_data = state;
 	state->service = service;
 
-	/*FIXME: This is a stub so far. */
-	state->ctx->status = dom_sid_split_rid(result, sid, NULL, &state->uid);
-	if(!composite_is_ok(state->ctx)) return result;
-
-	DEBUG(5, ("Rid is %d\n", state->uid));
+	state->ctx->status = idmap_sid_to_uid(service->idmap_ctx, state, sid,
+					      &state->uid);
+	if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
+		state->ctx->status = idmap_sid_to_uid(service->idmap_ctx, state,
+						      sid, &state->uid);
+	}
+	if (!composite_is_ok(state->ctx)) return result;
 
 	composite_done(state->ctx);
 	return result;
diff --git a/source4/winbind/wb_uid2sid.c b/source4/winbind/wb_uid2sid.c
index d7a909fda2..e81d2e4671 100644
--- a/source4/winbind/wb_uid2sid.c
+++ b/source4/winbind/wb_uid2sid.c
@@ -3,7 +3,7 @@
 
    Command backend for wbinfo -U
 
-   Copyright (C) Kai Blin 2007
+   Copyright (C) Kai Blin 2007-2008
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -25,6 +25,7 @@
 #include "smbd/service_task.h"
 #include "winbind/wb_helper.h"
 #include "libcli/security/proto.h"
+#include "winbind/idmap.h"
 
 struct uid2sid_state {
 	struct composite_context *ctx;
@@ -50,10 +51,14 @@ struct composite_context *wb_uid2sid_send(TALLOC_CTX *mem_ctx,
 	result->private_data = state;
 	state->service = service;
 
-	/* FIXME: This is a stub so far.
-	 * We cheat by just using the uid as RID with the domain SID.*/
-	state->sid = dom_sid_add_rid(result, service->primary_sid, uid);
-	if (composite_nomem(state->sid, state->ctx)) return result;
+	state->ctx->status = idmap_uid_to_sid(service->idmap_ctx, mem_ctx, uid,
+					      &state->sid);
+	if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
+		state->ctx->status = idmap_uid_to_sid(service->idmap_ctx,
+						      mem_ctx, uid,
+						      &state->sid);
+	}
+	if (!composite_is_ok(state->ctx)) return result;
 
 	composite_done(state->ctx);
 	return result;
author	Jelmer Vernooij <jelmer@samba.org>	2008-02-25 12:58:09 +0100
committer	Jelmer Vernooij <jelmer@samba.org>	2008-02-25 12:58:09 +0100
commit	584c4a518f4d18452b6515db132e4f75fba733a1 (patch)
tree	bbe367f36f092f233d7aefb61d75d5d1e1e85031 /source4
parent	03ab8f9d79f2a06b357b2f5d392ea8b5be263c5e (diff)
parent	71943b209b181e1e4a65ab477b83780add7051ae (diff)
download	samba-584c4a518f4d18452b6515db132e4f75fba733a1.tar.gz samba-584c4a518f4d18452b6515db132e4f75fba733a1.tar.bz2 samba-584c4a518f4d18452b6515db132e4f75fba733a1.zip