Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-gmake3

Conflicts:

	source/scripting/python/config.mk
(This used to be commit 0ac0ea660ab63eca764149f1d2828d0238a57289)

136 files changed, 2095 insertions, 801 deletions

diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 9189640150..4cb8d2b304 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -226,7 +226,9 @@ static NTSTATUS authsam_authenticate(struct auth_context *auth_context,
 {
 	struct samr_Password *lm_pwd, *nt_pwd;
 	NTSTATUS nt_status;
-	uint16_t acct_flags = samdb_result_acct_flags(msgs[0], "userAccountControl");
+	struct ldb_dn *domain_dn = samdb_result_dn(sam_ctx, mem_ctx, msgs_domain_ref[0], "nCName", NULL);
+
+	uint16_t acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msgs[0], domain_dn);
 	
 	/* Quit if the account was locked out. */
 	if (acct_flags & ACB_AUTOLOCK) {
diff --git a/source4/auth/sam.c b/source4/auth/sam.c
index fdd7de7c71..9a8045f62d 100644
--- a/source4/auth/sam.c
+++ b/source4/auth/sam.c
@@ -149,19 +149,20 @@ _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
 	const char *workstation_list;
 	NTTIME acct_expiry;
 	NTTIME must_change_time;
-	NTTIME last_set_time;
 
 	struct ldb_dn *domain_dn = samdb_result_dn(sam_ctx, mem_ctx, msg_domain_ref, "nCName", ldb_dn_new(mem_ctx, sam_ctx, NULL));
 
 	NTTIME now;
 	DEBUG(4,("authsam_account_ok: Checking SMB password for user %s\n", name_for_logs));
 
-	acct_flags = samdb_result_acct_flags(msg, "userAccountControl");
+	acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, domain_dn);
 	
 	acct_expiry = samdb_result_nttime(msg, "accountExpires", 0);
+
+	/* Check for when we must change this password, taking the
+	 * userAccountControl flags into account */
 	must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx, 
 							      domain_dn, msg);
-	last_set_time = samdb_result_nttime(msg, "pwdLastSet", 0);
 
 	workstation_list = samdb_result_string(msg, "userWorkstations", NULL);
 
@@ -186,22 +187,20 @@ _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_ACCOUNT_EXPIRED;
 	}
 
-	if (!(acct_flags & ACB_PWNOEXP)) {
-		/* check for immediate expiry "must change at next logon" */
-		if (must_change_time == 0 && last_set_time != 0) {
-			DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", 
-				 name_for_logs));
-			return NT_STATUS_PASSWORD_MUST_CHANGE;
-		}
+	/* check for immediate expiry "must change at next logon" */
+	if (must_change_time == 0) {
+		DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", 
+			 name_for_logs));
+		return NT_STATUS_PASSWORD_MUST_CHANGE;
+	}
 
-		/* check for expired password */
-		if ((must_change_time != 0) && (must_change_time < now)) {
-			DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", 
-				 name_for_logs));
-			DEBUG(1,("sam_account_ok: Password expired at '%s' unix time.\n", 
-				 nt_time_string(mem_ctx, must_change_time)));
-			return NT_STATUS_PASSWORD_EXPIRED;
-		}
+	/* check for expired password */
+	if (must_change_time < now) {
+		DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", 
+			 name_for_logs));
+		DEBUG(1,("sam_account_ok: Password expired at '%s' unix time.\n", 
+			 nt_time_string(mem_ctx, must_change_time)));
+		return NT_STATUS_PASSWORD_EXPIRED;
 	}
 
 	/* Test workstation. Workstation list is comma separated. */
@@ -267,6 +266,7 @@ _PUBLIC_ NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_conte
 	struct dom_sid **groupSIDs = NULL;
 	struct dom_sid *account_sid;
 	struct dom_sid *primary_group_sid;
+	struct ldb_dn *domain_dn;
 	const char *str;
 	struct ldb_dn *ncname;
 	int i;
@@ -368,7 +368,10 @@ _PUBLIC_ NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_conte
 	server_info->logon_count = samdb_result_uint(msg, "logonCount", 0);
 	server_info->bad_password_count = samdb_result_uint(msg, "badPwdCount", 0);
 
-	server_info->acct_flags = samdb_result_acct_flags(msg, "userAccountControl");
+	domain_dn = samdb_result_dn(sam_ctx, mem_ctx, msg_domain_ref, "nCName", NULL);
+
+	server_info->acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, 
+							  msg, domain_dn);
 
 	server_info->user_session_key = user_sess_key;
 	server_info->lm_session_key = lm_sess_key;
diff --git a/source4/cldap_server/cldap_server.c b/source4/cldap_server/cldap_server.c
index 7858ee2cf0..783e31d1ae 100644
--- a/source4/cldap_server/cldap_server.c
+++ b/source4/cldap_server/cldap_server.c
@@ -92,7 +92,7 @@ static NTSTATUS cldapd_add_socket(struct cldapd_server *cldapd, struct loadparm_
 	NTSTATUS status;
 
 	/* listen for unicasts on the CLDAP port (389) */
-	cldapsock = cldap_socket_init(cldapd, cldapd->task->event_ctx);
+	cldapsock = cldap_socket_init(cldapd, cldapd->task->event_ctx, lp_iconv_convenience(cldapd->task->lp_ctx));
 	NT_STATUS_HAVE_NO_MEMORY(cldapsock);
 
 	socket_address = socket_address_from_strings(cldapsock, cldapsock->sock->backend_name, 
diff --git a/source4/cluster/ctdb/opendb_ctdb.c b/source4/cluster/ctdb/opendb_ctdb.c
index 3dfc6819b7..3d67162d6d 100644
--- a/source4/cluster/ctdb/opendb_ctdb.c
+++ b/source4/cluster/ctdb/opendb_ctdb.c
@@ -409,10 +409,12 @@ static NTSTATUS odb_ctdb_open_file_pending(struct odb_lock *lck, void *private)
 /*
   remove a opendb entry
 */
-static NTSTATUS odb_ctdb_close_file(struct odb_lock *lck, void *file_handle)
+static NTSTATUS odb_ctdb_close_file(struct odb_lock *lck, void *file_handle,
+				    const char **_delete_path)
 {
 	struct odb_context *odb = lck->odb;
 	struct opendb_file file;
+	const char *delete_path = NULL;
 	int i;
 	NTSTATUS status;
 
@@ -448,6 +450,15 @@ static NTSTATUS odb_ctdb_close_file(struct odb_lock *lck, void *file_handle)
 	file.num_pending = 0;
 
 	file.num_entries--;
+
+	if (file.num_entries == 0 && file.delete_on_close) {
+		delete_path = talloc_strdup(lck, file.path);
+		NT_STATUS_HAVE_NO_MEMORY(delete_path);
+	}
+
+	if (_delete_path) {
+		*_delete_path = delete_path;
+	}
 	
 	return odb_push_record(lck, &file);
 }
@@ -552,20 +563,20 @@ static NTSTATUS odb_ctdb_set_delete_on_close(struct odb_lock *lck, bool del_on_c
   people still have the file open
 */
 static NTSTATUS odb_ctdb_get_delete_on_close(struct odb_context *odb, 
-					    DATA_BLOB *key, bool *del_on_close, 
-					    int *open_count, char **path)
+					    DATA_BLOB *key, bool *del_on_close)
 {
 	NTSTATUS status;
 	struct opendb_file file;
 	struct odb_lock *lck;
 
+	(*del_on_close) = false;
+
 	lck = odb_lock(odb, odb, key);
 	NT_STATUS_HAVE_NO_MEMORY(lck);
 
 	status = odb_pull_record(lck, &file);
 	if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_NOT_FOUND, status)) {
 		talloc_free(lck);
-		(*del_on_close) = false;
 		return NT_STATUS_OK;
 	}
 	if (!NT_STATUS_IS_OK(status)) {
@@ -574,16 +585,6 @@ static NTSTATUS odb_ctdb_get_delete_on_close(struct odb_context *odb,
 	}
 
 	(*del_on_close) = file.delete_on_close;
-	if (open_count != NULL) {
-		(*open_count) = file.num_entries;
-	}
-	if (path != NULL) {
-		*path = talloc_strdup(odb, file.path);
-		NT_STATUS_HAVE_NO_MEMORY(*path);
-		if (file.num_entries == 1 && file.entries[0].delete_on_close) {
-			(*del_on_close) = true;
-		}
-	}
 
 	talloc_free(lck);
 
diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
index bee1eac480..ace5e0edaf 100644
--- a/source4/dsdb/common/util.c
+++ b/source4/dsdb/common/util.c
@@ -469,8 +469,8 @@ NTTIME samdb_result_allow_password_change(struct ldb_context *sam_ldb,
 }
 
 /*
-  construct the force_password_change field from the PwdLastSet attribute and the 
-  domain password settings
+  construct the force_password_change field from the PwdLastSet
+  attribute, the userAccountControl and the domain password settings
 */
 NTTIME samdb_result_force_password_change(struct ldb_context *sam_ldb, 
 					  TALLOC_CTX *mem_ctx, 
@@ -478,10 +478,12 @@ NTTIME samdb_result_force_password_change(struct ldb_context *sam_ldb,
 					  struct ldb_message *msg)
 {
 	uint64_t attr_time = samdb_result_uint64(msg, "pwdLastSet", 0);
-	uint32_t user_flags = samdb_result_uint64(msg, "userAccountControl", 0);
+	uint32_t userAccountControl = samdb_result_uint64(msg, "userAccountControl", 0);
 	int64_t maxPwdAge;
 
-	if (user_flags & UF_DONT_EXPIRE_PASSWD) {
+	/* Machine accounts don't expire, and there is a flag for 'no expiry' */
+	if (!(userAccountControl & UF_NORMAL_ACCOUNT)
+	    || (userAccountControl & UF_DONT_EXPIRE_PASSWD)) {
 		return 0x7FFFFFFFFFFFFFFFULL;
 	}
 
@@ -596,11 +598,30 @@ struct samr_LogonHours samdb_result_logon_hours(TALLOC_CTX *mem_ctx, struct ldb_
 
 /*
   pull a set of account_flags from a result set. 
+
+  This requires that the attributes: 
+   pwdLastSet
+   userAccountControl
+  be included in 'msg'
 */
-uint16_t samdb_result_acct_flags(struct ldb_message *msg, const char *attr)
+uint32_t samdb_result_acct_flags(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
+				 struct ldb_message *msg, struct ldb_dn *domain_dn)
 {
-	uint_t userAccountControl = ldb_msg_find_attr_as_uint(msg, attr, 0);
-	return samdb_uf2acb(userAccountControl);
+	uint32_t userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
+	uint32_t acct_flags = samdb_uf2acb(userAccountControl); 
+	NTTIME must_change_time;
+	NTTIME now;
+	
+	must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx, 
+							      domain_dn, msg);
+	
+	/* Test account expire time */
+	unix_to_nt_time(&now, time(NULL));
+	/* check for expired password */
+	if (must_change_time < now) {
+		acct_flags |= ACB_PW_EXPIRED;
+	}
+	return acct_flags;
 }
 
 
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index 178149a886..905cd4a995 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -396,6 +396,7 @@ static int samldb_fill_group_object(struct ldb_module *module, const struct ldb_
 						    struct ldb_message **ret_msg)
 {
 	int ret;
+	unsigned int group_type;
 	char *name;
 	struct ldb_message *msg2;
 	struct ldb_dn *dom_dn;
@@ -452,6 +453,26 @@ static int samldb_fill_group_object(struct ldb_module *module, const struct ldb_
 		}
 	}
 	
+	if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
+		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+		talloc_free(mem_ctx);
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+	group_type = samdb_result_uint(msg2, "groupType", 0);
+	if (group_type == 0) {
+		ldb_asprintf_errstring(module->ldb, "groupType invalid");
+		talloc_free(mem_ctx);
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	} else {
+		unsigned int account_type = samdb_gtype2atype(group_type);
+		ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
+					 "sAMAccountType",
+					 account_type);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+	}
+
 	/* Manage SID allocation, conflicts etc */
 	ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn); 
 
@@ -473,6 +494,7 @@ static int samldb_fill_user_or_computer_object(struct ldb_module *module, const
 	const char *rdn_name;
 	TALLOC_CTX *mem_ctx = talloc_new(msg);
 	const char *errstr;
+	unsigned int user_account_control;
 	if (!mem_ctx) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
@@ -485,36 +507,15 @@ static int samldb_fill_user_or_computer_object(struct ldb_module *module, const
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	if (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL) {
-
-		ret = samdb_copy_template(module->ldb, msg2, 
-					  "computer",
-					  &errstr);
-		if (ret) {
-			ldb_asprintf_errstring(module->ldb, 
-					       "samldb_fill_user_or_computer_object: "
-					       "Error copying computer template: %s",
-					       errstr);
-			talloc_free(mem_ctx);
-			return ret;
-		}
-	} else {
-		ret = samdb_copy_template(module->ldb, msg2, 
-					  "user",
-					  &errstr);
-		if (ret) {
-			ldb_asprintf_errstring(module->ldb, 
-					       "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
-					       errstr);
-			talloc_free(mem_ctx);
-			return ret;
-		}
-		/* readd user objectclass */
-		ret = samdb_find_or_add_value(module->ldb, msg2, "objectclass", "user");
-		if (ret) {
-			talloc_free(mem_ctx);
-			return ret;
-		}
+	ret = samdb_copy_template(module->ldb, msg2, 
+				  "user",
+				  &errstr);
+	if (ret) {
+		ldb_asprintf_errstring(module->ldb, 
+				       "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
+				       errstr);
+		talloc_free(mem_ctx);
+		return ret;
 	}
 
 	rdn_name = ldb_dn_get_rdn_name(msg2->dn);
@@ -545,14 +546,30 @@ static int samldb_fill_user_or_computer_object(struct ldb_module *module, const
 		}
 	}
 
-	/*
-	  TODO: useraccountcontrol: setting value 0 gives 0x200 for users
-	*/
+	if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
+		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+		talloc_free(mem_ctx);
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+	user_account_control = samdb_result_uint(msg2, "userAccountControl", 0);
+	if (user_account_control == 0) {
+		ldb_asprintf_errstring(module->ldb, "userAccountControl invalid");
+		talloc_free(mem_ctx);
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	} else {
+		unsigned int account_type = samdb_uf2atype(user_account_control);
+		ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
+					 "sAMAccountType",
+					 account_type);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+	}
 
 	/* Manage SID allocation, conflicts etc */
 	ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn); 
 
-	/* TODO: objectCategory, userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
+	/* TODO: userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
 
 	if (ret == 0) {
 		*ret_msg = msg2;
@@ -689,7 +706,7 @@ static int samldb_add(struct ldb_module *module, struct ldb_request *req)
 	}
 
 	/* is user or computer? */
-	if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) ||
+	if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) || 
 	    (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL)) {
 		/*  add all relevant missing objects */
 		ret = samldb_fill_user_or_computer_object(module, msg, &msg2);
@@ -745,6 +762,53 @@ static int samldb_add(struct ldb_module *module, struct ldb_request *req)
 	return ret;
 }
 
+/* modify */
+static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
+{
+	struct ldb_message *msg;
+	struct ldb_message_element *el, *el2;
+	int ret;
+	unsigned int group_type, user_account_control, account_type;
+	if (ldb_msg_find_element(req->op.mod.message, "sAMAccountType") != NULL) {
+		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+
+	el = ldb_msg_find_element(req->op.mod.message, "groupType");
+	if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+		req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
+
+		group_type = strtoul((const char *)el->values[0].data, NULL, 0);
+		account_type =  samdb_gtype2atype(group_type);
+		ret = samdb_msg_add_uint(module->ldb, msg, msg,
+					 "sAMAccountType",
+					 account_type);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+		el2 = ldb_msg_find_element(msg, "sAMAccountType");
+		el2->flags = LDB_FLAG_MOD_REPLACE;
+	}
+
+	el = ldb_msg_find_element(req->op.mod.message, "userAccountControl");
+	if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+		req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
+
+		user_account_control = strtoul((const char *)el->values[0].data, NULL, 0);
+		account_type = samdb_uf2atype(user_account_control);
+		ret = samdb_msg_add_uint(module->ldb, msg, msg,
+					 "sAMAccountType",
+					 account_type);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+		el2 = ldb_msg_find_element(msg, "sAMAccountType");
+		el2->flags = LDB_FLAG_MOD_REPLACE;
+	}
+	return ldb_next_request(module, req);
+}
+
+
 static int samldb_init(struct ldb_module *module)
 {
 	return ldb_next_init(module);
@@ -754,4 +818,5 @@ _PUBLIC_ const struct ldb_module_ops ldb_samldb_module_ops = {
 	.name          = "samldb",
 	.init_context  = samldb_init,
 	.add           = samldb_add,
+	.modify        = samldb_modify
 };
diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c
index ff226e5b46..9a17e581e3 100644
--- a/source4/kdc/hdb-ldb.c
+++ b/source4/kdc/hdb-ldb.c
@@ -1168,8 +1168,8 @@ NTSTATUS kdc_hdb_ldb_create(TALLOC_CTX *mem_ctx,
 krb5_error_code hdb_ldb_create(krb5_context context, struct HDB **db, const char *arg)
 {
 	NTSTATUS nt_status;
-	/* The global kdc_mem_ctx, Disgusting, ugly hack, but it means one less private hook */
-	nt_status = kdc_hdb_ldb_create(kdc_mem_ctx, global_loadparm, 
+	/* The global kdc_mem_ctx and kdc_lp_ctx, Disgusting, ugly hack, but it means one less private hook */
+	nt_status = kdc_hdb_ldb_create(kdc_mem_ctx, kdc_lp_ctx, 
 				       context, db, arg);
 
 	if (NT_STATUS_IS_OK(nt_status)) {
diff --git a/source4/kdc/kdc.c b/source4/kdc/kdc.c
index 52ee475862..92a5dc26e0 100644
--- a/source4/kdc/kdc.c
+++ b/source4/kdc/kdc.c
@@ -41,8 +41,10 @@
 #include "param/param.h"
 
 
-/* Disgusting hack to get a mem_ctx into the hdb plugin, when used as a keytab */
+/* Disgusting hack to get a mem_ctx and lp_ctx into the hdb plugin, when 
+ * used as a keytab */
 TALLOC_CTX *kdc_mem_ctx;
+struct loadparm_context *kdc_lp_ctx;
 
 /* hold all the info needed to send a reply */
 struct kdc_reply {
@@ -648,6 +650,7 @@ static void kdc_task_init(struct task_server *task)
 	krb5_kdc_windc_init(kdc->smb_krb5_context->krb5_context);
 
 	kdc_mem_ctx = kdc->smb_krb5_context;
+	kdc_lp_ctx = task->lp_ctx;
 
 	/* start listening on the configured network interfaces */
 	status = kdc_startup_interfaces(kdc, task->lp_ctx, ifaces);
diff --git a/source4/kdc/kdc.h b/source4/kdc/kdc.h
index 3a1f9bd34e..9be15115d1 100644
--- a/source4/kdc/kdc.h
+++ b/source4/kdc/kdc.h
@@ -30,6 +30,7 @@ struct kdc_server;
 struct socket_address;
 
 extern TALLOC_CTX *kdc_mem_ctx;
+extern struct loadparm_context *kdc_lp_ctx;
 
 bool kpasswdd_process(struct kdc_server *kdc,
 		      TALLOC_CTX *mem_ctx, 
diff --git a/source4/lib/appweb/mpr/miniMpr.c b/source4/lib/appweb/mpr/miniMpr.c
index 949d64fcf1..52b23608aa 100644
--- a/source4/lib/appweb/mpr/miniMpr.c
+++ b/source4/lib/appweb/mpr/miniMpr.c
@@ -30,6 +30,7 @@
  */
 
 #include	"miniMpr.h"
+#include "param/param.h"
 
 /************************************ Code ************************************/
 #if !BLD_APPWEB
@@ -49,6 +50,12 @@ void *mprMemCtx(void)
 	return mpr_ctx;
 }
 
+/* return the loadparm context being used for all ejs variables */
+struct loadparm_context *mprLpCtx(void)
+{
+	return global_loadparm;
+}
+
 void mprFree(void *ptr)
 {
 	talloc_free(ptr);
diff --git a/source4/lib/appweb/mpr/miniMpr.h b/source4/lib/appweb/mpr/miniMpr.h
index 836fdab9f2..15ce30c8df 100644
--- a/source4/lib/appweb/mpr/miniMpr.h
+++ b/source4/lib/appweb/mpr/miniMpr.h
@@ -272,6 +272,8 @@ extern int 		mprMemcpy(char *dest, int destMax, const char *src, int nbytes);
 
 extern void mprSetCtx(void *ctx);
 extern void *mprMemCtx(void);
+struct loadparm_context;
+extern struct loadparm_context *mprLpCtx(void);
 
 /* This function needs to be provided by anyone using ejs */
 void ejs_exception(const char *reason);
diff --git a/source4/lib/charset/util_unistr.c b/source4/lib/charset/util_unistr.c
index e0e1aed222..9b87f49800 100644
--- a/source4/lib/charset/util_unistr.c
+++ b/source4/lib/charset/util_unistr.c
@@ -123,6 +123,7 @@ _PUBLIC_ int strcasecmp_m(const char *s1, const char *s2)
 {
 	codepoint_t c1=0, c2=0;
 	size_t size1, size2;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	/* handle null ptr comparisons to simplify the use in qsort */
 	if (s1 == s2) return 0;
@@ -130,8 +131,8 @@ _PUBLIC_ int strcasecmp_m(const char *s1, const char *s2)
 	if (s2 == NULL) return 1;
 
 	while (*s1 && *s2) {
-		c1 = next_codepoint(lp_iconv_convenience(global_loadparm), s1, &size1);
-		c2 = next_codepoint(lp_iconv_convenience(global_loadparm), s2, &size2);
+		c1 = next_codepoint(iconv_convenience, s1, &size1);
+		c2 = next_codepoint(iconv_convenience, s2, &size2);
 
 		s1 += size1;
 		s2 += size2;
@@ -207,6 +208,7 @@ _PUBLIC_ int strncasecmp_m(const char *s1, const char *s2, size_t n)
 {
 	codepoint_t c1=0, c2=0;
 	size_t size1, size2;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	/* handle null ptr comparisons to simplify the use in qsort */
 	if (s1 == s2) return 0;
@@ -216,8 +218,8 @@ _PUBLIC_ int strncasecmp_m(const char *s1, const char *s2, size_t n)
 	while (*s1 && *s2 && n) {
 		n--;
 
-		c1 = next_codepoint(lp_iconv_convenience(global_loadparm), s1, &size1);
-		c2 = next_codepoint(lp_iconv_convenience(global_loadparm), s2, &size2);
+		c1 = next_codepoint(iconv_convenience, s1, &size1);
+		c2 = next_codepoint(iconv_convenience, s2, &size2);
 
 		s1 += size1;
 		s2 += size2;
@@ -480,6 +482,7 @@ _PUBLIC_ char *strlower_talloc(TALLOC_CTX *ctx, const char *src)
 {
 	size_t size=0;
 	char *dest;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	/* this takes advantage of the fact that upper/lower can't
 	   change the length of a character by more than 1 byte */
@@ -490,12 +493,12 @@ _PUBLIC_ char *strlower_talloc(TALLOC_CTX *ctx, const char *src)
 
 	while (*src) {
 		size_t c_size;
-		codepoint_t c = next_codepoint(lp_iconv_convenience(global_loadparm), src, &c_size);
+		codepoint_t c = next_codepoint(iconv_convenience, src, &c_size);
 		src += c_size;
 
 		c = tolower_w(c);
 
-		c_size = push_codepoint(lp_iconv_convenience(global_loadparm), dest+size, c);
+		c_size = push_codepoint(iconv_convenience, dest+size, c);
 		if (c_size == -1) {
 			talloc_free(dest);
 			return NULL;
@@ -520,6 +523,7 @@ _PUBLIC_ char *strupper_talloc(TALLOC_CTX *ctx, const char *src)
 {
 	size_t size=0;
 	char *dest;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 	
 	if (!src) {
 		return NULL;
@@ -534,12 +538,12 @@ _PUBLIC_ char *strupper_talloc(TALLOC_CTX *ctx, const char *src)
 
 	while (*src) {
 		size_t c_size;
-		codepoint_t c = next_codepoint(lp_iconv_convenience(global_loadparm), src, &c_size);
+		codepoint_t c = next_codepoint(iconv_convenience, src, &c_size);
 		src += c_size;
 
 		c = toupper_w(c);
 
-		c_size = push_codepoint(lp_iconv_convenience(global_loadparm), dest+size, c);
+		c_size = push_codepoint(iconv_convenience, dest+size, c);
 		if (c_size == -1) {
 			talloc_free(dest);
 			return NULL;
@@ -563,6 +567,7 @@ _PUBLIC_ char *strupper_talloc(TALLOC_CTX *ctx, const char *src)
 _PUBLIC_ void strlower_m(char *s)
 {
 	char *d;
+	struct smb_iconv_convenience *iconv_convenience;
 
 	/* this is quite a common operation, so we want it to be
 	   fast. We optimise for the ascii case, knowing that all our
@@ -576,12 +581,14 @@ _PUBLIC_ void strlower_m(char *s)
 	if (!*s)
 		return;
 
+	iconv_convenience = lp_iconv_convenience(global_loadparm);
+
 	d = s;
 
 	while (*s) {
 		size_t c_size, c_size2;
-		codepoint_t c = next_codepoint(lp_iconv_convenience(global_loadparm), s, &c_size);
-		c_size2 = push_codepoint(lp_iconv_convenience(global_loadparm), d, tolower_w(c));
+		codepoint_t c = next_codepoint(iconv_convenience, s, &c_size);
+		c_size2 = push_codepoint(iconv_convenience, d, tolower_w(c));
 		if (c_size2 > c_size) {
 			DEBUG(0,("FATAL: codepoint 0x%x (0x%x) expanded from %d to %d bytes in strlower_m\n",
 				 c, tolower_w(c), (int)c_size, (int)c_size2));
@@ -599,6 +606,7 @@ _PUBLIC_ void strlower_m(char *s)
 _PUBLIC_ void strupper_m(char *s)
 {
 	char *d;
+	struct smb_iconv_convenience *iconv_convenience;
 
 	/* this is quite a common operation, so we want it to be
 	   fast. We optimise for the ascii case, knowing that all our
@@ -612,12 +620,14 @@ _PUBLIC_ void strupper_m(char *s)
 	if (!*s)
 		return;
 
+	iconv_convenience = lp_iconv_convenience(global_loadparm);
+
 	d = s;
 
 	while (*s) {
 		size_t c_size, c_size2;
-		codepoint_t c = next_codepoint(lp_iconv_convenience(global_loadparm), s, &c_size);
-		c_size2 = push_codepoint(lp_iconv_convenience(global_loadparm), d, toupper_w(c));
+		codepoint_t c = next_codepoint(iconv_convenience, s, &c_size);
+		c_size2 = push_codepoint(iconv_convenience, d, toupper_w(c));
 		if (c_size2 > c_size) {
 			DEBUG(0,("FATAL: codepoint 0x%x (0x%x) expanded from %d to %d bytes in strupper_m\n",
 				 c, toupper_w(c), (int)c_size, (int)c_size2));
diff --git a/source4/lib/ldb/ldb_ildap/ldb_ildap.c b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
index 995b584f51..79958a86eb 100644
--- a/source4/lib/ldb/ldb_ildap/ldb_ildap.c
+++ b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
@@ -816,8 +816,8 @@ _PUBLIC_ const struct ldb_backend_ops ldb_ldap_backend_ops = {
 	.connect_fn = ildb_connect
 };
 
-_PUBLIC_ const struct ldb_backend_ops ldb_ildap_backend_ops = {
-	.name = "ildap",
+_PUBLIC_ const struct ldb_backend_ops ldb_ldapi_backend_ops = {
+	.name = "ldapi",
 	.connect_fn = ildb_connect
 };
 
diff --git a/source4/lib/ldb/modules/rdn_name.c b/source4/lib/ldb/modules/rdn_name.c
index c4de8e8da8..65c044c0f4 100644
--- a/source4/lib/ldb/modules/rdn_name.c
+++ b/source4/lib/ldb/modules/rdn_name.c
@@ -119,7 +119,8 @@ static int rdn_name_add(struct ldb_module *module, struct ldb_request *req)
 				      "RDN mismatch on %s: %s (%s)", 
 				      ldb_dn_get_linearized(msg->dn), rdn_name, rdn_val.data);
 			talloc_free(down_req);
-			return LDB_ERR_OPERATIONS_ERROR;
+			/* Match AD's error here */
+			return LDB_ERR_INVALID_DN_SYNTAX;
 		}
 	}
 
diff --git a/source4/lib/registry/hive.c b/source4/lib/registry/hive.c
index 5d56a30b3e..ad6a6421ab 100644
--- a/source4/lib/registry/hive.c
+++ b/source4/lib/registry/hive.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "hive.h"
 #include "system/filesys.h"
+#include "param/param.h"
 
 /** Open a registry file/host/etc */
 _PUBLIC_ WERROR reg_open_hive(TALLOC_CTX *parent_ctx, const char *location,
@@ -52,7 +53,7 @@ _PUBLIC_ WERROR reg_open_hive(TALLOC_CTX *parent_ctx, const char *location,
 
 	if (!strncmp(peek, "regf", 4)) {
 		close(fd);
-		return reg_open_regf_file(parent_ctx, location, lp_ctx, root);
+		return reg_open_regf_file(parent_ctx, location, lp_iconv_convenience(lp_ctx), root);
 	} else if (!strncmp(peek, "TDB file", 8)) {
 		close(fd);
 		return reg_open_ldb_file(parent_ctx, location, session_info,
diff --git a/source4/lib/registry/hive.h b/source4/lib/registry/hive.h
index 6d9a69c7c5..87f335663d 100644
--- a/source4/lib/registry/hive.h
+++ b/source4/lib/registry/hive.h
@@ -188,7 +188,7 @@ WERROR hive_key_flush(struct hive_key *key);
 WERROR reg_open_directory(TALLOC_CTX *parent_ctx,
 			  const char *location, struct hive_key **key);
 WERROR reg_open_regf_file(TALLOC_CTX *parent_ctx,
-			  const char *location, struct loadparm_context *lp_ctx,
+			  const char *location, struct smb_iconv_convenience *iconv_convenience,
 			  struct hive_key **key);
 WERROR reg_open_ldb_file(TALLOC_CTX *parent_ctx, const char *location,
 			 struct auth_session_info *session_info,
@@ -200,6 +200,7 @@ WERROR reg_open_ldb_file(TALLOC_CTX *parent_ctx, const char *location,
 WERROR reg_create_directory(TALLOC_CTX *parent_ctx,
 			    const char *location, struct hive_key **key);
 WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx,
+			    struct smb_iconv_convenience *iconv_convenience,
 			    const char *location,
 			    int major_version,
 			    struct hive_key **key);
diff --git a/source4/lib/registry/ldb.c b/source4/lib/registry/ldb.c
index 0c8a55396e..dfd368ea80 100644
--- a/source4/lib/registry/ldb.c
+++ b/source4/lib/registry/ldb.c
@@ -36,7 +36,9 @@ struct ldb_key_data
 	int subkey_count, value_count;
 };
 
-static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx, struct ldb_message *msg,
+static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx, 
+				 struct smb_iconv_convenience *iconv_convenience,
+				 struct ldb_message *msg,
 				 const char **name, uint32_t *type,
 				 DATA_BLOB *data)
 {
@@ -57,7 +59,7 @@ static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx, struct ldb_message *msg,
 	{
 	case REG_SZ:
 	case REG_EXPAND_SZ:
-		data->length = convert_string_talloc(mem_ctx, lp_iconv_convenience(global_loadparm), CH_UTF8, CH_UTF16,
+		data->length = convert_string_talloc(mem_ctx, iconv_convenience, CH_UTF8, CH_UTF16,
 						     val->data, val->length,
 						     (void **)&data->data);
 		break;
@@ -281,7 +283,7 @@ static WERROR ldb_get_value_by_id(TALLOC_CTX *mem_ctx, struct hive_key *k,
 	if (idx >= kd->value_count)
 		return WERR_NO_MORE_ITEMS;
 
-	reg_ldb_unpack_value(mem_ctx, kd->values[idx],
+	reg_ldb_unpack_value(mem_ctx, lp_iconv_convenience(global_loadparm), kd->values[idx],
 			     name, data_type, data);
 
 	return WERR_OK;
@@ -310,7 +312,7 @@ static WERROR ldb_get_value(TALLOC_CTX *mem_ctx, struct hive_key *k,
 	if (res->count == 0)
 		return WERR_BADFILE;
 
-	reg_ldb_unpack_value(mem_ctx, res->msgs[0], NULL, data_type, data);
+	reg_ldb_unpack_value(mem_ctx, lp_iconv_convenience(global_loadparm), res->msgs[0], NULL, data_type, data);
 
 	return WERR_OK;
 }
@@ -607,7 +609,9 @@ static WERROR ldb_get_key_info(TALLOC_CTX *mem_ctx,
 
 			if (max_valbufsize != NULL) {
 				DATA_BLOB data;
-				reg_ldb_unpack_value(mem_ctx, kd->values[i], NULL, 
+				reg_ldb_unpack_value(mem_ctx, 
+						     lp_iconv_convenience(global_loadparm),
+						     kd->values[i], NULL, 
 						     NULL, &data);
 				*max_valbufsize = MAX(*max_valbufsize, data.length);
 				talloc_free(data.data);
diff --git a/source4/lib/registry/patchfile.c b/source4/lib/registry/patchfile.c
index a4579010cd..687fd4b91b 100644
--- a/source4/lib/registry/patchfile.c
+++ b/source4/lib/registry/patchfile.c
@@ -27,6 +27,7 @@
 
 
 _PUBLIC_ WERROR reg_preg_diff_load(int fd,
+				   struct smb_iconv_convenience *iconv_convenience, 
 				   const struct reg_diff_callbacks *callbacks,
 				   void *callback_data);
 
@@ -273,6 +274,7 @@ _PUBLIC_ WERROR reg_generate_diff(struct registry_context *ctx1,
  * Load diff file
  */
 _PUBLIC_ WERROR reg_diff_load(const char *filename,
+			      struct smb_iconv_convenience *iconv_convenience,
 			      const struct reg_diff_callbacks *callbacks,
 			      void *callback_data)
 {
@@ -305,10 +307,10 @@ _PUBLIC_ WERROR reg_diff_load(const char *filename,
 #endif
 	if (strncmp(hdr, "PReg", 4) == 0) {
 		/* Must be a GPO Registry.pol file */
-		return reg_preg_diff_load(fd, callbacks, callback_data);
+		return reg_preg_diff_load(fd, iconv_convenience, callbacks, callback_data);
 	} else {
 		/* Must be a normal .REG file */
-		return reg_dotreg_diff_load(fd, lp_iconv_convenience(global_loadparm), callbacks, callback_data);
+		return reg_dotreg_diff_load(fd, iconv_convenience, callbacks, callback_data);
 	}
 }
 
@@ -442,5 +444,6 @@ _PUBLIC_ WERROR reg_diff_apply(struct registry_context *ctx, const char *filenam
 	callbacks.del_all_values = reg_diff_apply_del_all_values;
 	callbacks.done = NULL;
 
-	return reg_diff_load(filename, &callbacks, ctx);
+	return reg_diff_load(filename, lp_iconv_convenience(global_loadparm), 
+			     &callbacks, ctx);
 }
diff --git a/source4/lib/registry/patchfile.h b/source4/lib/registry/patchfile.h
index 08a977d9cd..9289390685 100644
--- a/source4/lib/registry/patchfile.h
+++ b/source4/lib/registry/patchfile.h
@@ -43,6 +43,7 @@ WERROR reg_generate_diff(struct registry_context *ctx1,
 			 const struct reg_diff_callbacks *callbacks,
 			 void *callback_data);
 WERROR reg_dotreg_diff_save(TALLOC_CTX *ctx, const char *filename,
+			    struct smb_iconv_convenience *iconv_convenience,
 			    struct reg_diff_callbacks **callbacks,
 			    void **callback_data);
 WERROR reg_generate_diff_key(struct registry_key *oldkey,
diff --git a/source4/lib/registry/patchfile_dotreg.c b/source4/lib/registry/patchfile_dotreg.c
index 46ea7c0008..6de642ecb8 100644
--- a/source4/lib/registry/patchfile_dotreg.c
+++ b/source4/lib/registry/patchfile_dotreg.c
@@ -101,6 +101,7 @@ static WERROR reg_dotreg_diff_del_all_values(void *callback_data,
  * Save registry diff
  */
 _PUBLIC_ WERROR reg_dotreg_diff_save(TALLOC_CTX *ctx, const char *filename,
+				     struct smb_iconv_convenience *iconv_convenience,
 				     struct reg_diff_callbacks **callbacks,
 				     void **callback_data)
 {
@@ -109,7 +110,7 @@ _PUBLIC_ WERROR reg_dotreg_diff_save(TALLOC_CTX *ctx, const char *filename,
 	data = talloc_zero(ctx, struct dotreg_data);
 	*callback_data = data;
 
-	data->iconv_convenience = lp_iconv_convenience(global_loadparm);
+	data->iconv_convenience = iconv_convenience;
 
 	if (filename) {
 		data->fd = open(filename, O_CREAT, 0755);
diff --git a/source4/lib/registry/patchfile_preg.c b/source4/lib/registry/patchfile_preg.c
index 9cc9a5dec2..0d39e67450 100644
--- a/source4/lib/registry/patchfile_preg.c
+++ b/source4/lib/registry/patchfile_preg.c
@@ -29,14 +29,14 @@ struct preg_data {
 	int fd;
 };
 
-static WERROR preg_read_utf16(int fd, char *c)
+static WERROR preg_read_utf16(struct smb_iconv_convenience *ic, int fd, char *c)
 {
 	uint16_t v;
 
 	if (read(fd, &v, 2) < 2) {
 		return WERR_GENERAL_FAILURE;
 	}
-	push_codepoint(lp_iconv_convenience(global_loadparm), c, v);
+	push_codepoint(ic, c, v);
 	return WERR_OK;
 }
 
@@ -123,6 +123,7 @@ _PUBLIC_ WERROR reg_preg_diff_save(TALLOC_CTX *ctx, const char *filename,
  * Load diff file
  */
 _PUBLIC_ WERROR reg_preg_diff_load(int fd,
+				   struct smb_iconv_convenience *iconv_convenience, 
 				   const struct reg_diff_callbacks *callbacks,
 				   void *callback_data)
 {
@@ -162,7 +163,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 	while(1) {
 		uint32_t value_type, length;
 
-		if (!W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr))) {
+		if (!W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr))) {
 			break;
 		}
 		if (*buf_ptr != '[') {
@@ -173,7 +174,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 
 		/* Get the path */
 		buf_ptr = buf;
-		while (W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr)) &&
+		while (W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr)) &&
 		       *buf_ptr != ';' && buf_ptr-buf < buf_size) {
 			buf_ptr++;
 		}
@@ -181,7 +182,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 
 		/* Get the name */
 		buf_ptr = buf;
-		while (W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr)) &&
+		while (W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr)) &&
 		       *buf_ptr != ';' && buf_ptr-buf < buf_size) {
 			buf_ptr++;
 		}
@@ -195,7 +196,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 		}
 		/* Read past delimiter */
 		buf_ptr = buf;
-		if (!(W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr)) &&
+		if (!(W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr)) &&
 		    *buf_ptr == ';') && buf_ptr-buf < buf_size) {
 			DEBUG(0, ("Error in PReg file.\n"));
 			ret = WERR_GENERAL_FAILURE;
@@ -209,7 +210,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 		}
 		/* Read past delimiter */
 		buf_ptr = buf;
-		if (!(W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr)) &&
+		if (!(W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr)) &&
 		    *buf_ptr == ';') && buf_ptr-buf < buf_size) {
 			DEBUG(0, ("Error in PReg file.\n"));
 			ret = WERR_GENERAL_FAILURE;
@@ -227,7 +228,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 
 		/* Check if delimiter is in place (whine if it isn't) */
 		buf_ptr = buf;
-		if (!(W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr)) &&
+		if (!(W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr)) &&
 		    *buf_ptr == ']') && buf_ptr-buf < buf_size) {
 			DEBUG(0, ("Warning: Missing ']' in PReg file, expected ']', got '%c' 0x%x.\n",
 				*buf_ptr, *buf_ptr));
diff --git a/source4/lib/registry/regf.c b/source4/lib/registry/regf.c
index 15b60745f0..cf3e564c0e 100644
--- a/source4/lib/registry/regf.c
+++ b/source4/lib/registry/regf.c
@@ -1863,7 +1863,9 @@ static WERROR regf_save_hbin(struct regf_data *regf)
 	return WERR_OK;
 }
 
-WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx, const char *location,
+WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx, 
+			    struct smb_iconv_convenience *iconv_convenience,
+			    const char *location,
 			    int minor_version, struct hive_key **key)
 {
 	struct regf_data *regf;
@@ -1874,7 +1876,7 @@ WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx, const char *location,
 
 	regf = (struct regf_data *)talloc_zero(NULL, struct regf_data);
 
-	regf->iconv_convenience = lp_iconv_convenience(global_loadparm);
+	regf->iconv_convenience = iconv_convenience;
 
 	W_ERROR_HAVE_NO_MEMORY(regf);
 
@@ -1950,7 +1952,7 @@ WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx, const char *location,
 }
 
 WERROR reg_open_regf_file(TALLOC_CTX *parent_ctx, const char *location, 
-			  struct loadparm_context *lp_ctx, struct hive_key **key)
+			  struct smb_iconv_convenience *iconv_convenience, struct hive_key **key)
 {
 	struct regf_data *regf;
 	struct regf_hdr *regf_hdr;
@@ -1959,7 +1961,7 @@ WERROR reg_open_regf_file(TALLOC_CTX *parent_ctx, const char *location,
 
 	regf = (struct regf_data *)talloc_zero(NULL, struct regf_data);
 
-	regf->iconv_convenience = lp_iconv_convenience(lp_ctx);
+	regf->iconv_convenience = iconv_convenience;
 
 	W_ERROR_HAVE_NO_MEMORY(regf);
 
diff --git a/source4/lib/registry/tests/hive.c b/source4/lib/registry/tests/hive.c
index 4d27e83a74..1dcb464d80 100644
--- a/source4/lib/registry/tests/hive.c
+++ b/source4/lib/registry/tests/hive.c
@@ -25,6 +25,7 @@
 #include "torture/torture.h"
 #include "librpc/gen_ndr/winreg.h"
 #include "system/filesys.h"
+#include "param/param.h"
 
 static bool test_del_nonexistant_key(struct torture_context *tctx,
 				     const void *test_data)
@@ -349,7 +350,8 @@ static bool hive_setup_regf(struct torture_context *tctx, void **data)
 
 	rmdir(dirname);
 
-	error = reg_create_regf_file(tctx, dirname, 5, &key);
+	error = reg_create_regf_file(tctx, lp_iconv_convenience(tctx->lp_ctx),
+				     dirname, 5, &key);
 	if (!W_ERROR_IS_OK(error)) {
 		fprintf(stderr, "Unable to create new regf file\n");
 		return false;
diff --git a/source4/lib/registry/tools/regdiff.c b/source4/lib/registry/tools/regdiff.c
index 406eaeea3d..c94380efd2 100644
--- a/source4/lib/registry/tools/regdiff.c
+++ b/source4/lib/registry/tools/regdiff.c
@@ -126,7 +126,7 @@ int main(int argc, const char **argv)
 
 	poptFreeContext(pc);
 
-	error = reg_dotreg_diff_save(ctx, outputfile, &callbacks,
+	error = reg_dotreg_diff_save(ctx, outputfile, lp_iconv_convenience(cmdline_lp_ctx), &callbacks,
 				     &callback_data);
 	if (!W_ERROR_IS_OK(error)) {
 		fprintf(stderr, "Problem saving registry diff to '%s': %s\n",
diff --git a/source4/lib/replace/Makefile.in b/source4/lib/replace/Makefile.in
index af9522f3a6..c989835a8d 100644
--- a/source4/lib/replace/Makefile.in
+++ b/source4/lib/replace/Makefile.in
@@ -40,7 +40,7 @@ test: all
 
 installcheck: install test
 
-TEST_OBJS = test/testsuite.o test/os2_delete.o test/strptime.o
+TEST_OBJS = test/testsuite.o test/os2_delete.o test/strptime.o test/getifaddrs.o
 
 testsuite: libreplace.a $(TEST_OBJS)
 	$(CC) -o testsuite $(TEST_OBJS) -L. -lreplace $(LDFLAGS) $(LIBS)
diff --git a/source4/lib/replace/getifaddrs.c b/source4/lib/replace/getifaddrs.c
index 053657475d..f6f0ec080c 100644
--- a/source4/lib/replace/getifaddrs.c
+++ b/source4/lib/replace/getifaddrs.c
@@ -44,13 +44,14 @@
 
 void rep_freeifaddrs(struct ifaddrs *ifp)
 {
-	free(ifp->ifa_name);
-	free(ifp->ifa_addr);
-	free(ifp->ifa_netmask);
-	free(ifp->ifa_dstaddr);
-	if (ifp->ifa_next != NULL)
+	if (ifp != NULL) {
+		free(ifp->ifa_name);
+		free(ifp->ifa_addr);
+		free(ifp->ifa_netmask);
+		free(ifp->ifa_dstaddr);
 		freeifaddrs(ifp->ifa_next);
-	free(ifp);
+		free(ifp);
+	}
 }
 
 static struct sockaddr *sockaddr_dup(struct sockaddr *sa)
@@ -109,38 +110,33 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 
 	/* Loop through interfaces, looking for given IP address */
 	for (i=n-1; i>=0; i--) {
-		if (ioctl(fd, SIOCGIFADDR, &ifr[i]) != 0) {
+		if (ioctl(fd, SIOCGIFFLAGS, &ifr[i]) == -1) {
 			freeifaddrs(*ifap);
+			return -1;
 		}
 
 		curif = calloc(1, sizeof(struct ifaddrs));
-		if (lastif == NULL) {
-			*ifap = curif;
-		} else {
-			lastif->ifa_next = curif;
-		}
-
 		curif->ifa_name = strdup(ifr[i].ifr_name);
-		curif->ifa_addr = sockaddr_dup(&ifr[i].ifr_addr);
+		curif->ifa_flags = ifr[i].ifr_flags;
 		curif->ifa_dstaddr = NULL;
 		curif->ifa_data = NULL;
 		curif->ifa_next = NULL;
-		curif->ifa_netmask = NULL;
 
-		if (ioctl(fd, SIOCGIFFLAGS, &ifr[i]) != 0) {
-			freeifaddrs(*ifap);
-			return -1;
-		}  
-
-		curif->ifa_flags = ifr[i].ifr_flags;
-
-		if (ioctl(fd, SIOCGIFNETMASK, &ifr[i]) != 0) {
-			freeifaddrs(*ifap);
-			return -1;
-		}  
+		curif->ifa_addr = NULL;
+		if (ioctl(fd, SIOCGIFADDR, &ifr[i]) != -1) {
+			curif->ifa_addr = sockaddr_dup(&ifr[i].ifr_addr);
+		}
 
-		curif->ifa_netmask = sockaddr_dup(&ifr[i].ifr_addr);
+		curif->ifa_netmask = NULL;
+		if (ioctl(fd, SIOCGIFNETMASK, &ifr[i]) != -1) {
+			curif->ifa_netmask = sockaddr_dup(&ifr[i].ifr_addr);
+		}
 
+		if (lastif == NULL) {
+			*ifap = curif;
+		} else {
+			lastif->ifa_next = curif;
+		}
 		lastif = curif;
 	}
 
@@ -363,32 +359,3 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 	return -1;
 }
 #endif
-
-#ifdef AUTOCONF_TEST
-/* this is the autoconf driver to test getifaddrs() */
-
- int main()
-{
-	struct ifaddrs *ifs = NULL;
-	int ret;
-	
-	ret = getifaddrs(&ifs);
-	if (ret != 0) {
-		perror("getifaddrs() failed");
-		return 1;
-	}
-
-	while (ifs) {
-		printf("%-10s ", ifs->ifa_name);
-		if (ifs->ifa_addr != NULL && 
-		    ifs->ifa_addr->sa_family == AF_INET) {
-			printf("IP=%s ", inet_ntoa(((struct sockaddr_in *)ifs->ifa_addr)->sin_addr));
-			if (ifs->ifa_netmask != NULL)
-				printf("NETMASK=%s", inet_ntoa(((struct sockaddr_in *)ifs->ifa_netmask)->sin_addr));
-		}
-		printf("\n");
-		ifs = ifs->ifa_next;
-	}
-	return 0;
-}
-#endif
diff --git a/source4/lib/replace/getifaddrs.m4 b/source4/lib/replace/getifaddrs.m4
index 767797e8d2..6cca155de3 100644
--- a/source4/lib/replace/getifaddrs.m4
+++ b/source4/lib/replace/getifaddrs.m4
@@ -49,7 +49,11 @@ AC_TRY_RUN([
 #define AUTOCONF_TEST 1
 #define SOCKET_WRAPPER_NOT_REPLACE
 #include "$libreplacedir/replace.c"
-#include "$libreplacedir/getifaddrs.c"],
+#include "$libreplacedir/inet_ntop.c"
+#include "$libreplacedir/snprintf.c"
+#include "$libreplacedir/getifaddrs.c"
+#define getifaddrs_test main
+#include "$libreplacedir/test/getifaddrs.c"],
            libreplace_cv_HAVE_IFACE_GETIFADDRS=yes,libreplace_cv_HAVE_IFACE_GETIFADDRS=no,libreplace_cv_HAVE_IFACE_GETIFADDRS=cross)])
 if test x"$libreplace_cv_HAVE_IFACE_GETIFADDRS" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_GETIFADDRS,1,[Whether iface getifaddrs is available])
@@ -67,7 +71,11 @@ AC_TRY_RUN([
 #undef _XOPEN_SOURCE_EXTENDED
 #define SOCKET_WRAPPER_NOT_REPLACE
 #include "$libreplacedir/replace.c"
-#include "$libreplacedir/getifaddrs.c"],
+#include "$libreplacedir/inet_ntop.c"
+#include "$libreplacedir/snprintf.c"
+#include "$libreplacedir/getifaddrs.c"
+#define getifaddrs_test main
+#include "$libreplacedir/test/getifaddrs.c"],
            libreplace_cv_HAVE_IFACE_AIX=yes,libreplace_cv_HAVE_IFACE_AIX=no,libreplace_cv_HAVE_IFACE_AIX=cross)])
 if test x"$libreplace_cv_HAVE_IFACE_AIX" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_AIX,1,[Whether iface AIX is available])
@@ -84,7 +92,11 @@ AC_TRY_RUN([
 #define AUTOCONF_TEST 1
 #define SOCKET_WRAPPER_NOT_REPLACE
 #include "$libreplacedir/replace.c"
-#include "$libreplacedir/getifaddrs.c"],
+#include "$libreplacedir/inet_ntop.c"
+#include "$libreplacedir/snprintf.c"
+#include "$libreplacedir/getifaddrs.c"
+#define getifaddrs_test main
+#include "$libreplacedir/test/getifaddrs.c"],
            libreplace_cv_HAVE_IFACE_IFCONF=yes,libreplace_cv_HAVE_IFACE_IFCONF=no,libreplace_cv_HAVE_IFACE_IFCONF=cross)])
 if test x"$libreplace_cv_HAVE_IFACE_IFCONF" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_IFCONF,1,[Whether iface ifconf is available])
@@ -100,7 +112,11 @@ AC_TRY_RUN([
 #define AUTOCONF_TEST 1
 #define SOCKET_WRAPPER_NOT_REPLACE
 #include "$libreplacedir/replace.c"
-#include "$libreplacedir/getifaddrs.c"],
+#include "$libreplacedir/inet_ntop.c"
+#include "$libreplacedir/snprintf.c"
+#include "$libreplacedir/getifaddrs.c"
+#define getifaddrs_test main
+#include "$libreplacedir/test/getifaddrs.c"],
            libreplace_cv_HAVE_IFACE_IFREQ=yes,libreplace_cv_HAVE_IFACE_IFREQ=no,libreplace_cv_HAVE_IFACE_IFREQ=cross)])
 if test x"$libreplace_cv_HAVE_IFACE_IFREQ" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_IFREQ,1,[Whether iface ifreq is available])
diff --git a/source4/lib/replace/test/getifaddrs.c b/source4/lib/replace/test/getifaddrs.c
new file mode 100644
index 0000000000..8b00ac2f40
--- /dev/null
+++ b/source4/lib/replace/test/getifaddrs.c
@@ -0,0 +1,100 @@
+/*
+ * Unix SMB/CIFS implementation.
+ *
+ * libreplace getifaddrs test
+ *
+ * Copyright (C) Michael Adam <obnox@samba.org> 2008
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef AUTOCONF_TEST
+#include "replace.h"
+#include "system/network.h"
+#endif
+
+#ifdef HAVE_INET_NTOP
+#define rep_inet_ntop inet_ntop
+#endif
+
+static const char *format_sockaddr(struct sockaddr *addr,
+				   char *addrstring,
+				   socklen_t addrlen)
+{
+	const char *result = NULL;
+
+	if (addr->sa_family == AF_INET) {
+		result = rep_inet_ntop(AF_INET,
+				       &((struct sockaddr_in *)addr)->sin_addr,
+				       addrstring,
+				       addrlen);
+#ifdef HAVE_STRUCT_SOCKADDR_IN6
+	} else if (addr->sa_family == AF_INET6) {
+		result = rep_inet_ntop(AF_INET6,
+				       &((struct sockaddr_in6 *)addr)->sin6_addr,
+				       addrstring,
+				       addrlen);
+#endif
+	}
+	return result;
+}
+
+int getifaddrs_test(void)
+{
+	struct ifaddrs *ifs = NULL;
+	struct ifaddrs *ifs_head = NULL;
+	int ret;
+
+	ret = getifaddrs(&ifs);
+	ifs_head = ifs;
+	if (ret != 0) {
+		fprintf(stderr, "getifaddrs() failed: %s\n", strerror(errno));
+		return 1;
+	}
+
+	while (ifs) {
+		printf("%-10s ", ifs->ifa_name);
+		if (ifs->ifa_addr != NULL) {
+			char addrstring[INET6_ADDRSTRLEN];
+			const char *result;
+
+			result = format_sockaddr(ifs->ifa_addr,
+						 addrstring,
+						 sizeof(addrstring));
+			if (result != NULL) {
+				printf("IP=%s ", addrstring);
+			}
+
+			if (ifs->ifa_netmask != NULL) {
+				result = format_sockaddr(ifs->ifa_netmask,
+							 addrstring,
+							 sizeof(addrstring));
+				if (result != NULL) {
+					printf("NETMASK=%s", addrstring);
+				}
+			} else {
+				printf("AF=%d ", ifs->ifa_addr->sa_family);
+			}
+		} else {
+			printf("<no address>");
+		}
+
+		printf("\n");
+		ifs = ifs->ifa_next;
+	}
+
+	freeifaddrs(ifs_head);
+
+	return 0;
+}
diff --git a/source4/lib/replace/test/testsuite.c b/source4/lib/replace/test/testsuite.c
index c9f3301005..b538360365 100644
--- a/source4/lib/replace/test/testsuite.c
+++ b/source4/lib/replace/test/testsuite.c
@@ -856,21 +856,18 @@ static int test_strptime(void)
 	return libreplace_test_strptime();
 }
 
+extern int getifaddrs_test(void);
+
 static int test_getifaddrs(void)
 {
-	struct ifaddrs *ifa;
-	int ret;
 
 	printf("test: getifaddrs\n");
 
-	ret = getifaddrs(&ifa);
-	if (ret != 0) {
+	if (getifaddrs_test() != 0) {
 		printf("failure: getifaddrs\n");
 		return false;
 	}
 
-	freeifaddrs(ifa);
-
 	printf("success: getifaddrs\n");
 	return true;
 }
diff --git a/source4/libcli/cldap/cldap.c b/source4/libcli/cldap/cldap.c
index 7c8d40e608..d10eeb8ffd 100644
--- a/source4/libcli/cldap/cldap.c
+++ b/source4/libcli/cldap/cldap.c
@@ -241,7 +241,8 @@ static void cldap_socket_handler(struct event_context *ev, struct fd_event *fde,
   then operations will use that event context
 */
 struct cldap_socket *cldap_socket_init(TALLOC_CTX *mem_ctx, 
-				       struct event_context *event_ctx)
+				       struct event_context *event_ctx,
+				       struct smb_iconv_convenience *iconv_convenience)
 {
 	struct cldap_socket *cldap;
 	NTSTATUS status;
@@ -270,6 +271,7 @@ struct cldap_socket *cldap_socket_init(TALLOC_CTX *mem_ctx,
 
 	cldap->send_queue = NULL;
 	cldap->incoming.handler = NULL;
+	cldap->iconv_convenience = iconv_convenience;
 	
 	return cldap;
 
@@ -618,7 +620,7 @@ NTSTATUS cldap_netlogon_recv(struct cldap_request *req,
 	data = search.out.response->attributes[0].values;
 
 	ndr_err = ndr_pull_union_blob_all(data, mem_ctx, 
-					  lp_iconv_convenience(global_loadparm),
+					  req->cldap->iconv_convenience,
 					  &io->out.netlogon,
 					  io->in.version & 0xF,
 					  (ndr_pull_flags_fn_t)ndr_pull_nbt_cldap_netlogon);
@@ -714,7 +716,7 @@ NTSTATUS cldap_netlogon_reply(struct cldap_socket *cldap,
 	DATA_BLOB blob;
 
 	ndr_err = ndr_push_union_blob(&blob, tmp_ctx, 
-				      lp_iconv_convenience(global_loadparm),
+				      cldap->iconv_convenience,
 				      netlogon, version & 0xF,
 				     (ndr_push_flags_fn_t)ndr_push_nbt_cldap_netlogon);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
diff --git a/source4/libcli/cldap/cldap.h b/source4/libcli/cldap/cldap.h
index 7a222e0652..eb0191d0f4 100644
--- a/source4/libcli/cldap/cldap.h
+++ b/source4/libcli/cldap/cldap.h
@@ -73,6 +73,7 @@ struct cldap_request {
 struct cldap_socket {
 	struct socket_context *sock;
 	struct event_context *event_ctx;
+	struct smb_iconv_convenience *iconv_convenience;
 
 	/* the fd event */
 	struct fd_event *fde;
@@ -111,7 +112,8 @@ struct cldap_search {
 };
 
 struct cldap_socket *cldap_socket_init(TALLOC_CTX *mem_ctx, 
-				       struct event_context *event_ctx);
+				       struct event_context *event_ctx, 
+				       struct smb_iconv_convenience *iconv_convenience);
 NTSTATUS cldap_set_incoming_handler(struct cldap_socket *cldap,
 				    void (*handler)(struct cldap_socket *, struct ldap_message *, 
 						    struct socket_address *),
diff --git a/source4/libcli/dgram/dgramsocket.c b/source4/libcli/dgram/dgramsocket.c
index 7d6f5627c5..130d8ae870 100644
--- a/source4/libcli/dgram/dgramsocket.c
+++ b/source4/libcli/dgram/dgramsocket.c
@@ -158,7 +158,8 @@ static void dgm_socket_handler(struct event_context *ev, struct fd_event *fde,
   then operations will use that event context
 */
 struct nbt_dgram_socket *nbt_dgram_socket_init(TALLOC_CTX *mem_ctx, 
-					      struct event_context *event_ctx)
+					      struct event_context *event_ctx,
+					      struct smb_iconv_convenience *iconv_convenience)
 {
 	struct nbt_dgram_socket *dgmsock;
 	NTSTATUS status;
@@ -187,7 +188,7 @@ struct nbt_dgram_socket *nbt_dgram_socket_init(TALLOC_CTX *mem_ctx,
 	dgmsock->send_queue = NULL;
 	dgmsock->incoming.handler = NULL;
 	dgmsock->mailslot_handlers = NULL;
-	dgmsock->iconv_convenience = lp_iconv_convenience(global_loadparm);
+	dgmsock->iconv_convenience = iconv_convenience;
 	
 	return dgmsock;
 
diff --git a/source4/libcli/dgram/libdgram.h b/source4/libcli/dgram/libdgram.h
index 4645840971..707cca8cc5 100644
--- a/source4/libcli/dgram/libdgram.h
+++ b/source4/libcli/dgram/libdgram.h
@@ -93,7 +93,8 @@ NTSTATUS dgram_set_incoming_handler(struct nbt_dgram_socket *dgmsock,
 						    struct socket_address *),
 				    void *private);
 struct nbt_dgram_socket *nbt_dgram_socket_init(TALLOC_CTX *mem_ctx, 
-					       struct event_context *event_ctx);
+					       struct event_context *event_ctx,
+					       struct smb_iconv_convenience *);
 
 const char *dgram_mailslot_name(struct nbt_dgram_packet *packet);
 struct dgram_mailslot_handler *dgram_mailslot_find(struct nbt_dgram_socket *dgmsock,
diff --git a/source4/libcli/finddcs.c b/source4/libcli/finddcs.c
index 606809751e..56f931ce19 100644
--- a/source4/libcli/finddcs.c
+++ b/source4/libcli/finddcs.c
@@ -28,6 +28,7 @@
 #include "libcli/libcli.h"
 #include "libcli/resolve/resolve.h"
 #include "libcli/finddcs.h"
+#include "param/param.h"
 
 struct finddcs_state {
 	struct composite_context *ctx;
@@ -40,6 +41,8 @@ struct finddcs_state {
 	struct nbtd_getdcname r;
 	struct nbt_name_status node_status;
 
+	struct smb_iconv_convenience *iconv_convenience;
+
 	int num_dcs;
 	struct nbt_dc_name *dcs;
 	uint16_t nbt_port;
@@ -66,6 +69,7 @@ struct composite_context *finddcs_send(TALLOC_CTX *mem_ctx,
 				       const char *domain_name,
 				       int name_type,
 				       struct dom_sid *domain_sid,
+				       struct smb_iconv_convenience *iconv_convenience,
 				       struct resolve_context *resolve_ctx,
 				       struct event_context *event_ctx,
 				       struct messaging_context *msg_ctx)
@@ -86,6 +90,7 @@ struct composite_context *finddcs_send(TALLOC_CTX *mem_ctx,
 	state->nbt_port = nbt_port;
 	state->my_netbios_name = talloc_strdup(state, my_netbios_name);
 	state->domain_name = talloc_strdup(state, domain_name);
+	state->iconv_convenience = iconv_convenience;
 	if (composite_nomem(state->domain_name, c)) return c;
 
 	if (domain_sid) {
@@ -195,7 +200,8 @@ static void fallback_node_status(struct finddcs_state *state)
 	state->node_status.in.timeout = 1;
 	state->node_status.in.retries = 2;
 
-	nbtsock = nbt_name_socket_init(state, state->ctx->event_ctx);
+	nbtsock = nbt_name_socket_init(state, state->ctx->event_ctx, 
+				       state->iconv_convenience);
 	if (composite_nomem(nbtsock, state->ctx)) return;
 	
 	name_req = nbt_name_status_send(nbtsock, &state->node_status);
@@ -253,6 +259,7 @@ NTSTATUS finddcs(TALLOC_CTX *mem_ctx,
 		 uint16_t nbt_port,
 		 const char *domain_name, int name_type, 
 		 struct dom_sid *domain_sid,
+		 struct smb_iconv_convenience *iconv_convenience,
 		 struct resolve_context *resolve_ctx,
 		 struct event_context *event_ctx,
 		 struct messaging_context *msg_ctx,
@@ -262,7 +269,9 @@ NTSTATUS finddcs(TALLOC_CTX *mem_ctx,
 						   my_netbios_name,
 						   nbt_port,
 						   domain_name, name_type,
-						   domain_sid, resolve_ctx,
+						   domain_sid, 
+						   iconv_convenience,
+						   resolve_ctx,
 						   event_ctx, msg_ctx);
 	return finddcs_recv(c, mem_ctx, num_dcs, dcs);
 }
diff --git a/source4/libcli/nbt/libnbt.h b/source4/libcli/nbt/libnbt.h
index c95d99db54..bc85d87b89 100644
--- a/source4/libcli/nbt/libnbt.h
+++ b/source4/libcli/nbt/libnbt.h
@@ -94,6 +94,7 @@ struct nbt_name_request {
 struct nbt_name_socket {
 	struct socket_context *sock;
 	struct event_context *event_ctx;
+	struct smb_iconv_convenience *iconv_convenience;
 
 	/* a queue of requests pending to be sent */
 	struct nbt_name_request *send_queue;
diff --git a/source4/libcli/nbt/nbtsocket.c b/source4/libcli/nbt/nbtsocket.c
index 8bfe746294..95a1643efc 100644
--- a/source4/libcli/nbt/nbtsocket.c
+++ b/source4/libcli/nbt/nbtsocket.c
@@ -190,7 +190,7 @@ static void nbt_name_socket_recv(struct nbt_name_socket *nbtsock)
 	}
 
 	/* parse the request */
-	ndr_err = ndr_pull_struct_blob(&blob, packet, lp_iconv_convenience(global_loadparm), packet,
+	ndr_err = ndr_pull_struct_blob(&blob, packet, nbtsock->iconv_convenience, packet,
 				       (ndr_pull_flags_fn_t)ndr_pull_nbt_name_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		status = ndr_map_error2ntstatus(ndr_err);
@@ -309,7 +309,8 @@ static void nbt_name_socket_handler(struct event_context *ev, struct fd_event *f
   then operations will use that event context
 */
 _PUBLIC_ struct nbt_name_socket *nbt_name_socket_init(TALLOC_CTX *mem_ctx, 
-					     struct event_context *event_ctx)
+					     struct event_context *event_ctx,
+					     struct smb_iconv_convenience *iconv_convenience)
 {
 	struct nbt_name_socket *nbtsock;
 	NTSTATUS status;
@@ -338,6 +339,7 @@ _PUBLIC_ struct nbt_name_socket *nbt_name_socket_init(TALLOC_CTX *mem_ctx,
 	nbtsock->num_pending = 0;
 	nbtsock->incoming.handler = NULL;
 	nbtsock->unexpected.handler = NULL;
+	nbtsock->iconv_convenience = iconv_convenience;
 
 	nbtsock->fde = event_add_fd(nbtsock->event_ctx, nbtsock, 
 				    socket_get_fd(nbtsock->sock), 0,
@@ -395,7 +397,7 @@ struct nbt_name_request *nbt_name_request_send(struct nbt_name_socket *nbtsock,
 	talloc_set_destructor(req, nbt_name_request_destructor);	
 
 	ndr_err = ndr_push_struct_blob(&req->encoded, req, 
-				       lp_iconv_convenience(global_loadparm),
+				       req->nbtsock->iconv_convenience,
 				       request,
 				       (ndr_push_flags_fn_t)ndr_push_nbt_name_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) goto failed;
@@ -444,7 +446,7 @@ NTSTATUS nbt_name_reply_send(struct nbt_name_socket *nbtsock,
 	}
 
 	ndr_err = ndr_push_struct_blob(&req->encoded, req, 
-				       lp_iconv_convenience(global_loadparm),
+				       req->nbtsock->iconv_convenience,
 				       request,
 				       (ndr_push_flags_fn_t)ndr_push_nbt_name_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
diff --git a/source4/libcli/raw/clisession.c b/source4/libcli/raw/clisession.c
index 55cb3ef305..5a33d9cffc 100644
--- a/source4/libcli/raw/clisession.c
+++ b/source4/libcli/raw/clisession.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
 #include "system/filesys.h"
+#include "param/param.h"
 
 #define SETUP_REQUEST_SESSION(cmd, wct, buflen) do { \
 	req = smbcli_request_setup_session(session, cmd, wct, buflen); \
@@ -51,6 +52,9 @@ struct smbcli_session *smbcli_session_init(struct smbcli_transport *transport,
 	}
 	session->pid = (uint16_t)getpid();
 	session->vuid = UID_FIELD_INVALID;
+	session->options.lanman_auth = lp_client_lanman_auth(global_loadparm);
+	session->options.ntlmv2_auth = lp_client_ntlmv2_auth(global_loadparm);
+	session->options.plaintext_auth = lp_client_plaintext_auth(global_loadparm);
 	
 	capabilities = transport->negotiate.capabilities;
 
diff --git a/source4/libcli/raw/clisocket.c b/source4/libcli/raw/clisocket.c
index 8fcb8bb48c..eaa02e1047 100644
--- a/source4/libcli/raw/clisocket.c
+++ b/source4/libcli/raw/clisocket.c
@@ -33,6 +33,7 @@ struct sock_connect_state {
 	const char *host_name;
 	int num_ports;
 	uint16_t *ports;
+	const char *socket_options;
 	struct smbcli_socket *result;
 };
 
@@ -80,6 +81,7 @@ struct composite_context *smbcli_sock_connect_send(TALLOC_CTX *mem_ctx,
 	for (i=0;ports[i];i++) {
 		state->ports[i] = atoi(ports[i]);
 	}
+	state->socket_options = lp_socket_options(global_loadparm);
 
 	ctx = socket_connect_multi_send(state, host_addr,
 					state->num_ports, state->ports,
@@ -108,7 +110,7 @@ static void smbcli_sock_connect_recv_conn(struct composite_context *ctx)
 	if (!composite_is_ok(state->ctx)) return;
 
 	state->ctx->status =
-		socket_set_option(sock, lp_socket_options(global_loadparm), NULL);
+		socket_set_option(sock, state->socket_options, NULL);
 	if (!composite_is_ok(state->ctx)) return;
 
 
diff --git a/source4/libcli/raw/libcliraw.h b/source4/libcli/raw/libcliraw.h
index 7111649fc1..0578a9eab1 100644
--- a/source4/libcli/raw/libcliraw.h
+++ b/source4/libcli/raw/libcliraw.h
@@ -186,6 +186,12 @@ struct smbcli_session {
 
 	/* the spnego context if we use extented security */
 	struct gensec_security *gensec;
+
+	struct smbcli_session_options {
+		uint_t lanman_auth:1;
+		uint_t ntlmv2_auth:1;
+		uint_t plaintext_auth:1;
+	} options;
 };
 
 /* 
diff --git a/source4/libcli/resolve/bcast.c b/source4/libcli/resolve/bcast.c
index c8d4ab2df3..2e2eb05397 100644
--- a/source4/libcli/resolve/bcast.c
+++ b/source4/libcli/resolve/bcast.c
@@ -29,6 +29,7 @@
 struct resolve_bcast_data {
 	struct interface *ifaces;
 	uint16_t nbt_port;
+	int nbt_timeout;
 };
 
 /**
@@ -62,7 +63,7 @@ struct composite_context *resolve_name_bcast_send(TALLOC_CTX *mem_ctx,
 	}
 	address_list[count] = NULL;
 
-	c = resolve_name_nbtlist_send(mem_ctx, event_ctx, name, address_list, data->ifaces, data->nbt_port, true, false);
+	c = resolve_name_nbtlist_send(mem_ctx, event_ctx, name, address_list, data->ifaces, data->nbt_port, data->nbt_timeout, true, false);
 	talloc_free(address_list);
 
 	return c;	
@@ -84,22 +85,25 @@ NTSTATUS resolve_name_bcast(struct nbt_name *name,
 			    TALLOC_CTX *mem_ctx,
 			    struct interface *ifaces,
 			    uint16_t nbt_port,
+			    int nbt_timeout,
 			    const char **reply_addr)
 {
 	struct resolve_bcast_data *data = talloc(mem_ctx, struct resolve_bcast_data);
 	struct composite_context *c;
 	data->ifaces = talloc_reference(data, ifaces);
 	data->nbt_port = nbt_port;
+	data->nbt_timeout = nbt_timeout;
 	
 	c = resolve_name_bcast_send(mem_ctx, NULL, data, name);
 	return resolve_name_bcast_recv(c, mem_ctx, reply_addr);
 }
 
-bool resolve_context_add_bcast_method(struct resolve_context *ctx, struct interface *ifaces, uint16_t nbt_port)
+bool resolve_context_add_bcast_method(struct resolve_context *ctx, struct interface *ifaces, uint16_t nbt_port, int nbt_timeout)
 {
 	struct resolve_bcast_data *data = talloc(ctx, struct resolve_bcast_data);
 	data->ifaces = ifaces;
 	data->nbt_port = nbt_port;
+	data->nbt_timeout = nbt_timeout;
 	return resolve_context_add_method(ctx, resolve_name_bcast_send, resolve_name_bcast_recv, data);
 }
 
@@ -107,5 +111,5 @@ bool resolve_context_add_bcast_method_lp(struct resolve_context *ctx, struct loa
 {
 	struct interface *ifaces;
 	load_interfaces(ctx, lp_interfaces(lp_ctx), &ifaces);
-	return resolve_context_add_bcast_method(ctx, ifaces, lp_nbt_port(lp_ctx));
+	return resolve_context_add_bcast_method(ctx, ifaces, lp_nbt_port(lp_ctx), lp_parm_int(lp_ctx, NULL, "nbt", "timeout", 1));
 }
diff --git a/source4/libcli/resolve/nbtlist.c b/source4/libcli/resolve/nbtlist.c
index e1452c09d2..887bdd7ecf 100644
--- a/source4/libcli/resolve/nbtlist.c
+++ b/source4/libcli/resolve/nbtlist.c
@@ -102,6 +102,7 @@ struct composite_context *resolve_name_nbtlist_send(TALLOC_CTX *mem_ctx,
 						    const char **address_list,
 						    struct interface *ifaces,
 						    uint16_t nbt_port,
+						    int nbt_timeout,
 						    bool broadcast,
 						    bool wins_lookup)
 {
@@ -140,7 +141,8 @@ struct composite_context *resolve_name_nbtlist_send(TALLOC_CTX *mem_ctx,
 		return c;
 	}
 
-	state->nbtsock = nbt_name_socket_init(state, event_ctx);
+	state->nbtsock = nbt_name_socket_init(state, event_ctx, 
+					      lp_iconv_convenience(global_loadparm));
 	if (composite_nomem(state->nbtsock, c)) return c;
 
 	/* count the address_list size */
@@ -161,7 +163,7 @@ struct composite_context *resolve_name_nbtlist_send(TALLOC_CTX *mem_ctx,
 
 		state->io_queries[i].in.broadcast   = broadcast;
 		state->io_queries[i].in.wins_lookup = wins_lookup;
-		state->io_queries[i].in.timeout     = lp_parm_int(global_loadparm, NULL, "nbt", "timeout", 1);
+		state->io_queries[i].in.timeout     = nbt_timeout;
 		state->io_queries[i].in.retries     = 2;
 
 		state->queries[i] = nbt_name_query_send(state->nbtsock, &state->io_queries[i]);
@@ -201,12 +203,14 @@ NTSTATUS resolve_name_nbtlist(struct nbt_name *name,
 			      const char **address_list,
 			      struct interface *ifaces, 
 			      uint16_t nbt_port,
+			      int nbt_timeout,
 			      bool broadcast, bool wins_lookup,
 			      const char **reply_addr)
 {
 	struct composite_context *c = resolve_name_nbtlist_send(mem_ctx, NULL, 
 								name, address_list, 
 								ifaces, nbt_port,
+								nbt_timeout,
 							        broadcast, wins_lookup);
 	return resolve_name_nbtlist_recv(c, mem_ctx, reply_addr);
 }
diff --git a/source4/libcli/resolve/wins.c b/source4/libcli/resolve/wins.c
index 78624ad81a..3ec180f332 100644
--- a/source4/libcli/resolve/wins.c
+++ b/source4/libcli/resolve/wins.c
@@ -29,6 +29,7 @@ struct resolve_wins_data {
 	const char **address_list;
 	struct interface *ifaces;
 	uint16_t nbt_port;
+	int nbt_timeout;
 };
 
 /**
@@ -42,7 +43,7 @@ struct composite_context *resolve_name_wins_send(
 {
 	struct resolve_wins_data *wins_data = talloc_get_type(userdata, struct resolve_wins_data);
 	if (wins_data->address_list == NULL) return NULL;
-	return resolve_name_nbtlist_send(mem_ctx, event_ctx, name, wins_data->address_list, wins_data->ifaces, wins_data->nbt_port, false, true);
+	return resolve_name_nbtlist_send(mem_ctx, event_ctx, name, wins_data->address_list, wins_data->ifaces, wins_data->nbt_port, wins_data->nbt_timeout, false, true);
 }
 
 /*
@@ -62,6 +63,7 @@ NTSTATUS resolve_name_wins(struct nbt_name *name,
 			    const char **address_list,
 			    struct interface *ifaces,
 			    uint16_t nbt_port,
+			    int nbt_timeout,
 			    const char **reply_addr)
 {
 	struct composite_context *c;
@@ -69,16 +71,18 @@ NTSTATUS resolve_name_wins(struct nbt_name *name,
 	wins_data->address_list = address_list;
 	wins_data->ifaces = ifaces;
 	wins_data->nbt_port = nbt_port;
+	wins_data->nbt_timeout = nbt_timeout;
 	c = resolve_name_wins_send(mem_ctx, NULL, wins_data, name);
 	return resolve_name_wins_recv(c, mem_ctx, reply_addr);
 }
 
-bool resolve_context_add_wins_method(struct resolve_context *ctx, const char **address_list, struct interface *ifaces, uint16_t nbt_port)
+bool resolve_context_add_wins_method(struct resolve_context *ctx, const char **address_list, struct interface *ifaces, uint16_t nbt_port, int nbt_timeout)
 {
 	struct resolve_wins_data *wins_data = talloc(ctx, struct resolve_wins_data);
 	wins_data->address_list = str_list_copy(wins_data, address_list);
 	wins_data->ifaces = talloc_reference(wins_data, ifaces);
 	wins_data->nbt_port = nbt_port;
+	wins_data->nbt_timeout = nbt_timeout;
 	return resolve_context_add_method(ctx, resolve_name_wins_send, resolve_name_wins_recv,
 					  wins_data);
 }
@@ -87,5 +91,5 @@ bool resolve_context_add_wins_method_lp(struct resolve_context *ctx, struct load
 {
 	struct interface *ifaces;
 	load_interfaces(ctx, lp_interfaces(lp_ctx), &ifaces);
-	return resolve_context_add_wins_method(ctx, lp_wins_server_list(lp_ctx), ifaces, lp_nbt_port(lp_ctx));
+	return resolve_context_add_wins_method(ctx, lp_wins_server_list(lp_ctx), ifaces, lp_nbt_port(lp_ctx), lp_parm_int(lp_ctx, NULL, "nbt", "timeout", 1));
 }
diff --git a/source4/libcli/smb_composite/fetchfile.c b/source4/libcli/smb_composite/fetchfile.c
index e4312794c9..d8d7481270 100644
--- a/source4/libcli/smb_composite/fetchfile.c
+++ b/source4/libcli/smb_composite/fetchfile.c
@@ -150,7 +150,7 @@ struct composite_context *smb_composite_fetchfile_send(struct smb_composite_fetc
 	state->connect->in.options	= io->in.options;
 
 	state->creq = smb_composite_connect_send(state->connect, state, 
-						 lp_resolve_context(global_loadparm), event_ctx);
+						 io->in.resolve_ctx, event_ctx);
 	if (state->creq == NULL) goto failed;
 
 	state->creq->async.private_data = c;
diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c
index f5a976958d..75a2a579a2 100644
--- a/source4/libcli/smb_composite/sesssetup.c
+++ b/source4/libcli/smb_composite/sesssetup.c
@@ -226,11 +226,11 @@ static NTSTATUS session_setup_nt1(struct composite_context *c,
 	DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, lp_iconv_convenience(global_loadparm), session->transport->socket->hostname, lp_workgroup(global_loadparm));
 	DATA_BLOB session_key;
 	int flags = CLI_CRED_NTLM_AUTH;
-	if (lp_client_lanman_auth(global_loadparm)) {
+	if (session->options.lanman_auth) {
 		flags |= CLI_CRED_LANMAN_AUTH;
 	}
 
-	if (lp_client_ntlmv2_auth(global_loadparm)) {
+	if (session->options.ntlmv2_auth) {
 		flags |= CLI_CRED_NTLMv2_AUTH;
 	}
 
@@ -263,7 +263,7 @@ static NTSTATUS session_setup_nt1(struct composite_context *c,
 		set_user_session_key(session, &session_key);
 		
 		data_blob_free(&session_key);
-	} else if (lp_client_plaintext_auth(global_loadparm)) {
+	} else if (session->options.plaintext_auth) {
 		state->setup.nt1.in.password1 = data_blob_talloc(state, password, strlen(password));
 		state->setup.nt1.in.password2 = data_blob(NULL, 0);
 	} else {
@@ -293,11 +293,11 @@ static NTSTATUS session_setup_old(struct composite_context *c,
 	DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, lp_iconv_convenience(global_loadparm), session->transport->socket->hostname, lp_workgroup(global_loadparm));
 	DATA_BLOB session_key;
 	int flags = 0;
-	if (lp_client_lanman_auth(global_loadparm)) {
+	if (session->options.lanman_auth) {
 		flags |= CLI_CRED_LANMAN_AUTH;
 	}
 
-	if (lp_client_ntlmv2_auth(global_loadparm)) {
+	if (session->options.ntlmv2_auth) {
 		flags |= CLI_CRED_NTLMv2_AUTH;
 	}
 
@@ -324,7 +324,7 @@ static NTSTATUS session_setup_old(struct composite_context *c,
 		set_user_session_key(session, &session_key);
 		
 		data_blob_free(&session_key);
-	} else if (lp_client_plaintext_auth(global_loadparm)) {
+	} else if (session->options.plaintext_auth) {
 		state->setup.old.in.password = data_blob_talloc(state, password, strlen(password));
 	} else {
 		/* could match windows client and return 'cannot logon from this workstation', but it just confuses everybody */
diff --git a/source4/libcli/smb_composite/smb_composite.h b/source4/libcli/smb_composite/smb_composite.h
index 964ffb0936..e7e131869c 100644
--- a/source4/libcli/smb_composite/smb_composite.h
+++ b/source4/libcli/smb_composite/smb_composite.h
@@ -56,6 +56,7 @@ struct smb_composite_fetchfile {
 		const char *workgroup;
 		const char *filename;
 		struct smbcli_options options;
+		struct resolve_context *resolve_ctx;
 	} in;
 	struct {
 		uint8_t *data;
diff --git a/source4/libcli/swig/libcli_nbt.i b/source4/libcli/swig/libcli_nbt.i
index 827230b113..e4e366873f 100644
--- a/source4/libcli/swig/libcli_nbt.i
+++ b/source4/libcli/swig/libcli_nbt.i
@@ -46,7 +46,8 @@
 
 /* Function prototypes */
 struct nbt_name_socket *nbt_name_socket_init(TALLOC_CTX *mem_ctx, 
-					     struct event_context *event_ctx);
+					     struct event_context *event_ctx,
+                         struct smb_iconv_convenience *iconv_convenience);
 
 enum nbt_name_type {
 	NBT_NAME_CLIENT=0x00,
diff --git a/source4/libcli/swig/libcli_nbt_wrap.c b/source4/libcli/swig/libcli_nbt_wrap.c
index 6c1b501359..f67e6dd0e3 100644
--- a/source4/libcli/swig/libcli_nbt_wrap.c
+++ b/source4/libcli/swig/libcli_nbt_wrap.c
@@ -2469,12 +2469,13 @@ SWIG_Python_MustGetPtr(PyObject *obj, swig_type_info *ty, int argnum, int flags)
 #define SWIGTYPE_p_p_char swig_types[10]
 #define SWIGTYPE_p_short swig_types[11]
 #define SWIGTYPE_p_signed_char swig_types[12]
-#define SWIGTYPE_p_unsigned_char swig_types[13]
-#define SWIGTYPE_p_unsigned_int swig_types[14]
-#define SWIGTYPE_p_unsigned_long_long swig_types[15]
-#define SWIGTYPE_p_unsigned_short swig_types[16]
-static swig_type_info *swig_types[18];
-static swig_module_info swig_module = {swig_types, 17, 0, 0, 0, 0};
+#define SWIGTYPE_p_smb_iconv_convenience swig_types[13]
+#define SWIGTYPE_p_unsigned_char swig_types[14]
+#define SWIGTYPE_p_unsigned_int swig_types[15]
+#define SWIGTYPE_p_unsigned_long_long swig_types[16]
+#define SWIGTYPE_p_unsigned_short swig_types[17]
+static swig_type_info *swig_types[19];
+static swig_module_info swig_module = {swig_types, 18, 0, 0, 0, 0};
 #define SWIG_TypeQuery(name) SWIG_TypeQueryModule(&swig_module, &swig_module, name)
 #define SWIG_MangledTypeQuery(name) SWIG_MangledTypeQueryModule(&swig_module, &swig_module, name)
 
@@ -2918,17 +2919,21 @@ SWIGINTERN PyObject *_wrap_nbt_name_socket_init(PyObject *SWIGUNUSEDPARM(self),
   PyObject *resultobj = 0;
   TALLOC_CTX *arg1 = (TALLOC_CTX *) 0 ;
   struct event_context *arg2 = (struct event_context *) 0 ;
+  struct smb_iconv_convenience *arg3 = (struct smb_iconv_convenience *) 0 ;
   struct nbt_name_socket *result = 0 ;
   void *argp2 = 0 ;
   int res2 = 0 ;
+  void *argp3 = 0 ;
+  int res3 = 0 ;
   PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
   char *  kwnames[] = {
-    (char *) "event_ctx", NULL 
+    (char *) "event_ctx",(char *) "iconv_convenience", NULL 
   };
   
   arg2 = event_context_init(NULL);
   arg1 = NULL;
-  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"|O:nbt_name_socket_init",kwnames,&obj0)) SWIG_fail;
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"|OO:nbt_name_socket_init",kwnames,&obj0,&obj1)) SWIG_fail;
   if (obj0) {
     res2 = SWIG_ConvertPtr(obj0, &argp2,SWIGTYPE_p_event_context, 0 |  0 );
     if (!SWIG_IsOK(res2)) {
@@ -2936,7 +2941,14 @@ SWIGINTERN PyObject *_wrap_nbt_name_socket_init(PyObject *SWIGUNUSEDPARM(self),
     }
     arg2 = (struct event_context *)(argp2);
   }
-  result = (struct nbt_name_socket *)nbt_name_socket_init(arg1,arg2);
+  if (obj1) {
+    res3 = SWIG_ConvertPtr(obj1, &argp3,SWIGTYPE_p_smb_iconv_convenience, 0 |  0 );
+    if (!SWIG_IsOK(res3)) {
+      SWIG_exception_fail(SWIG_ArgError(res3), "in method '" "nbt_name_socket_init" "', argument " "3"" of type '" "struct smb_iconv_convenience *""'"); 
+    }
+    arg3 = (struct smb_iconv_convenience *)(argp3);
+  }
+  result = (struct nbt_name_socket *)nbt_name_socket_init(arg1,arg2,arg3);
   resultobj = SWIG_NewPointerObj(SWIG_as_voidptr(result), SWIGTYPE_p_nbt_name_socket, 0 |  0 );
   return resultobj;
 fail:
@@ -4135,6 +4147,7 @@ static swig_type_info _swigt__p_nbt_name_socket = {"_p_nbt_name_socket", "struct
 static swig_type_info _swigt__p_p_char = {"_p_p_char", "char **", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_short = {"_p_short", "short *|int_least16_t *|int16_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_signed_char = {"_p_signed_char", "signed char *|int_least8_t *|int_fast8_t *|int8_t *", 0, 0, (void*)0, 0};
+static swig_type_info _swigt__p_smb_iconv_convenience = {"_p_smb_iconv_convenience", "struct smb_iconv_convenience *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_unsigned_char = {"_p_unsigned_char", "unsigned char *|uint_least8_t *|uint_fast8_t *|uint8_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_unsigned_int = {"_p_unsigned_int", "uintptr_t *|uint_least32_t *|uint_fast32_t *|uint32_t *|unsigned int *|uint_fast16_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_unsigned_long_long = {"_p_unsigned_long_long", "uint_least64_t *|uint_fast64_t *|uint64_t *|unsigned long long *|uintmax_t *", 0, 0, (void*)0, 0};
@@ -4154,6 +4167,7 @@ static swig_type_info *swig_type_initial[] = {
   &_swigt__p_p_char,
   &_swigt__p_short,
   &_swigt__p_signed_char,
+  &_swigt__p_smb_iconv_convenience,
   &_swigt__p_unsigned_char,
   &_swigt__p_unsigned_int,
   &_swigt__p_unsigned_long_long,
@@ -4173,6 +4187,7 @@ static swig_cast_info _swigc__p_nbt_name_socket[] = {  {&_swigt__p_nbt_name_sock
 static swig_cast_info _swigc__p_p_char[] = {  {&_swigt__p_p_char, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_short[] = {  {&_swigt__p_short, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_signed_char[] = {  {&_swigt__p_signed_char, 0, 0, 0},{0, 0, 0, 0}};
+static swig_cast_info _swigc__p_smb_iconv_convenience[] = {  {&_swigt__p_smb_iconv_convenience, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_unsigned_char[] = {  {&_swigt__p_unsigned_char, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_unsigned_int[] = {  {&_swigt__p_unsigned_int, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_unsigned_long_long[] = {  {&_swigt__p_unsigned_long_long, 0, 0, 0},{0, 0, 0, 0}};
@@ -4192,6 +4207,7 @@ static swig_cast_info *swig_cast_initial[] = {
   _swigc__p_p_char,
   _swigc__p_short,
   _swigc__p_signed_char,
+  _swigc__p_smb_iconv_convenience,
   _swigc__p_unsigned_char,
   _swigc__p_unsigned_int,
   _swigc__p_unsigned_long_long,
diff --git a/source4/libcli/wrepl/winsrepl.c b/source4/libcli/wrepl/winsrepl.c
index d027e88396..3e7793c0c7 100644
--- a/source4/libcli/wrepl/winsrepl.c
+++ b/source4/libcli/wrepl/winsrepl.c
@@ -102,7 +102,7 @@ static NTSTATUS wrepl_finish_recv(void *private, DATA_BLOB packet_blob_in)
 	blob.length = packet_blob_in.length - 4;
 	
 	/* we have a full request - parse it */
-	ndr_err = ndr_pull_struct_blob(&blob, req->packet, lp_iconv_convenience(global_loadparm), req->packet,
+	ndr_err = ndr_pull_struct_blob(&blob, req->packet, wrepl_socket->iconv_convenience, req->packet,
 				       (ndr_pull_flags_fn_t)ndr_pull_wrepl_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
@@ -163,7 +163,8 @@ static int wrepl_socket_destructor(struct wrepl_socket *sock)
   operations will use that event context
 */
 struct wrepl_socket *wrepl_socket_init(TALLOC_CTX *mem_ctx, 
-				       struct event_context *event_ctx)
+				       struct event_context *event_ctx,
+				       struct smb_iconv_convenience *iconv_convenience)
 {
 	struct wrepl_socket *wrepl_socket;
 	NTSTATUS status;
@@ -178,6 +179,8 @@ struct wrepl_socket *wrepl_socket_init(TALLOC_CTX *mem_ctx,
 	}
 	if (!wrepl_socket->event.ctx) goto failed;
 
+	wrepl_socket->iconv_convenience = iconv_convenience;
+
 	status = socket_create("ip", SOCKET_TYPE_STREAM, &wrepl_socket->sock, 0);
 	if (!NT_STATUS_IS_OK(status)) goto failed;
 
@@ -308,6 +311,14 @@ static void wrepl_connect_handler(struct composite_context *creq)
 	composite_done(result);
 }
 
+const char *wrepl_best_ip(struct loadparm_context *lp_ctx, const char *peer_ip)
+{
+	struct interface *ifaces;
+	load_interfaces(lp_ctx, lp_interfaces(lp_ctx), &ifaces);
+	return iface_best_ip(ifaces, peer_ip);
+}
+
+
 /*
   connect a wrepl_socket to a WINS server
 */
@@ -331,12 +342,6 @@ struct composite_context *wrepl_connect_send(struct wrepl_socket *wrepl_socket,
 	state->result		= result;
 	state->wrepl_socket	= wrepl_socket;
 
-	if (!our_ip) {
-		struct interface *ifaces;
-		load_interfaces(state, lp_interfaces(global_loadparm), &ifaces);
-		our_ip = iface_best_ip(ifaces, peer_ip);
-	}
-
 	us = socket_address_from_strings(state, wrepl_socket->sock->backend_name, 
 					 our_ip, 0);
 	if (composite_nomem(us, result)) return result;
@@ -493,7 +498,7 @@ struct wrepl_request *wrepl_request_send(struct wrepl_socket *wrepl_socket,
 	}
 
 	wrap.packet = *packet;
-	ndr_err = ndr_push_struct_blob(&blob, req, lp_iconv_convenience(global_loadparm), &wrap, 
+	ndr_err = ndr_push_struct_blob(&blob, req, wrepl_socket->iconv_convenience, &wrap, 
 				       (ndr_push_flags_fn_t)ndr_push_wrepl_wrap);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		status = ndr_map_error2ntstatus(ndr_err);
diff --git a/source4/libcli/wrepl/winsrepl.h b/source4/libcli/wrepl/winsrepl.h
index 52b0bee69e..f33e63119d 100644
--- a/source4/libcli/wrepl/winsrepl.h
+++ b/source4/libcli/wrepl/winsrepl.h
@@ -49,6 +49,8 @@ struct wrepl_socket {
 
 	/* remember if we need to free the wrepl_socket at the end of wrepl_socket_dead() */
 	bool free_skipped;
+
+	struct smb_iconv_convenience *iconv_convenience;
 };
 
 struct wrepl_send_ctrl {
diff --git a/source4/libnet/libnet_become_dc.c b/source4/libnet/libnet_become_dc.c
index c9185c749b..c4f9cabb11 100644
--- a/source4/libnet/libnet_become_dc.c
+++ b/source4/libnet/libnet_become_dc.c
@@ -747,7 +747,8 @@ static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s)
 	s->cldap.io.in.acct_control	= -1;
 	s->cldap.io.in.version		= 6;
 
-	s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx);
+	s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx, 
+					  lp_iconv_convenience(s->libnet->lp_ctx));
 	if (composite_nomem(s->cldap.sock, c)) return;
 
 	req = cldap_netlogon_send(s->cldap.sock, &s->cldap.io);
diff --git a/source4/libnet/libnet_lookup.c b/source4/libnet/libnet_lookup.c
index 409cc7575b..cab4d9e73f 100644
--- a/source4/libnet/libnet_lookup.c
+++ b/source4/libnet/libnet_lookup.c
@@ -197,7 +197,8 @@ struct composite_context* libnet_LookupDCs_send(struct libnet_context *ctx,
 
 	c = finddcs_send(mem_ctx, lp_netbios_name(ctx->lp_ctx), lp_nbt_port(ctx->lp_ctx),
 			 io->in.domain_name, io->in.name_type,
-			 NULL, ctx->resolve_ctx, ctx->event_ctx, msg_ctx);
+			 NULL, lp_iconv_convenience(ctx->lp_ctx), 
+			 ctx->resolve_ctx, ctx->event_ctx, msg_ctx);
 	return c;
 }
 
diff --git a/source4/libnet/libnet_site.c b/source4/libnet/libnet_site.c
index 9db9494865..dabd23a5be 100644
--- a/source4/libnet/libnet_site.c
+++ b/source4/libnet/libnet_site.c
@@ -55,7 +55,7 @@ NTSTATUS libnet_FindSite(TALLOC_CTX *ctx, struct libnet_JoinSite *r)
 	search.in.acct_control = -1;
 	search.in.version = 6;
 
-	cldap = cldap_socket_init(tmp_ctx, NULL);
+	cldap = cldap_socket_init(tmp_ctx, NULL, lp_iconv_convenience(global_loadparm));
 	status = cldap_netlogon(cldap, tmp_ctx, &search);
 	if (!NT_STATUS_IS_OK(status)) {
 		/*
diff --git a/source4/libnet/libnet_unbecome_dc.c b/source4/libnet/libnet_unbecome_dc.c
index 415912e34d..5d346ac166 100644
--- a/source4/libnet/libnet_unbecome_dc.c
+++ b/source4/libnet/libnet_unbecome_dc.c
@@ -267,7 +267,8 @@ static void unbecomeDC_send_cldap(struct libnet_UnbecomeDC_state *s)
 	s->cldap.io.in.acct_control	= -1;
 	s->cldap.io.in.version		= 6;
 
-	s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx);
+	s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx,
+					  lp_iconv_convenience(s->libnet->lp_ctx));
 	if (composite_nomem(s->cldap.sock, c)) return;
 
 	req = cldap_netlogon_send(s->cldap.sock, &s->cldap.io);
diff --git a/source4/libnet/libnet_user.c b/source4/libnet/libnet_user.c
index d5ccf34a57..678c7a226e 100644
--- a/source4/libnet/libnet_user.c
+++ b/source4/libnet/libnet_user.c
@@ -534,7 +534,7 @@ static NTSTATUS set_user_changes(TALLOC_CTX *mem_ctx, struct usermod_change *mod
 	SET_FIELD_NTTIME(r->in, user, mod, acct_expiry, USERMOD_FIELD_ACCT_EXPIRY);
 
 	/* account flags change */
-	SET_FIELD_UINT32(r->in, user, mod, acct_flags, USERMOD_FIELD_ACCT_FLAGS);
+	SET_FIELD_ACCT_FLAGS(r->in, user, mod, acct_flags, USERMOD_FIELD_ACCT_FLAGS);
 
 	return NT_STATUS_OK;
 }
diff --git a/source4/libnet/libnet_user.h b/source4/libnet/libnet_user.h
index ece06f08fc..94aa38464f 100644
--- a/source4/libnet/libnet_user.h
+++ b/source4/libnet/libnet_user.h
@@ -91,6 +91,14 @@ struct libnet_ModifyUser {
 		mod->fields |= flag; \
 	}
 
+#define SET_FIELD_ACCT_FLAGS(new, current, mod, field, flag) \
+	if (new.field) { \
+		if (current->field != new.field) {	\
+			mod->field = new.field;		\
+			mod->fields |= flag;		\
+		}					\
+	}
+
 
 struct libnet_UserInfo {
 	struct {
diff --git a/source4/librpc/idl/unixinfo.idl b/source4/librpc/idl/unixinfo.idl
index 48bc565fff..6929e86e61 100644
--- a/source4/librpc/idl/unixinfo.idl
+++ b/source4/librpc/idl/unixinfo.idl
@@ -42,8 +42,8 @@ import "security.idl";
 
 	typedef struct {
 		NTSTATUS status;
-		utf8string homedir;
-		utf8string shell;
+		[charset(UTF8),string] uint8 homedir[];
+		[charset(UTF8),string] uint8 shell[];
 	} unixinfo_GetPWUidInfo;
 
 	/******************/
diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index b19a5d7160..a379398f19 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -351,7 +351,7 @@ static NTSTATUS ncacn_push_request_sign(struct dcerpc_connection *c,
 	/* non-signed packets are simpler */
 	if (!c->security_state.auth_info || 
 	    !c->security_state.generic_state) {
-		return ncacn_push_auth(blob, mem_ctx, pkt, c->security_state.auth_info);
+		return ncacn_push_auth(blob, mem_ctx, c->iconv_convenience, pkt, c->security_state.auth_info);
 	}
 
 	ndr = ndr_push_init_ctx(mem_ctx, c->iconv_convenience);
@@ -750,7 +750,7 @@ struct composite_context *dcerpc_bind_send(struct dcerpc_pipe *p,
 	pkt.u.bind.auth_info = data_blob(NULL, 0);
 
 	/* construct the NDR form of the packet */
-	c->status = ncacn_push_auth(&blob, c, &pkt,
+	c->status = ncacn_push_auth(&blob, c, p->conn->iconv_convenience, &pkt,
 				    p->conn->security_state.auth_info);
 	if (!composite_is_ok(c)) return c;
 
@@ -813,7 +813,7 @@ NTSTATUS dcerpc_auth3(struct dcerpc_connection *c,
 	pkt.u.auth3.auth_info = data_blob(NULL, 0);
 
 	/* construct the NDR form of the packet */
-	status = ncacn_push_auth(&blob, mem_ctx, &pkt, c->security_state.auth_info);
+	status = ncacn_push_auth(&blob, mem_ctx, c->iconv_convenience, &pkt, c->security_state.auth_info);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -1646,7 +1646,7 @@ struct composite_context *dcerpc_alter_context_send(struct dcerpc_pipe *p,
 	pkt.u.alter.auth_info = data_blob(NULL, 0);
 
 	/* construct the NDR form of the packet */
-	c->status = ncacn_push_auth(&blob, mem_ctx, &pkt,
+	c->status = ncacn_push_auth(&blob, mem_ctx, p->conn->iconv_convenience, &pkt,
 				    p->conn->security_state.auth_info);
 	if (!composite_is_ok(c)) return c;
 
diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c
index 4e5d049d66..b8128baf43 100644
--- a/source4/librpc/rpc/dcerpc_util.c
+++ b/source4/librpc/rpc/dcerpc_util.c
@@ -50,13 +50,14 @@ const struct ndr_interface_call *dcerpc_iface_find_call(const struct ndr_interfa
    push a ncacn_packet into a blob, potentially with auth info
 */
 NTSTATUS ncacn_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, 
+			 struct smb_iconv_convenience *iconv_convenience,
 			  struct ncacn_packet *pkt,
 			  struct dcerpc_auth *auth_info)
 {
 	struct ndr_push *ndr;
 	enum ndr_err_code ndr_err;
 
-	ndr = ndr_push_init_ctx(mem_ctx, lp_iconv_convenience(global_loadparm));
+	ndr = ndr_push_init_ctx(mem_ctx, iconv_convenience);
 	if (!ndr) {
 		return NT_STATUS_NO_MEMORY;
 	}
diff --git a/source4/nbt_server/dgram/request.c b/source4/nbt_server/dgram/request.c
index 45426c31ba..205a544209 100644
--- a/source4/nbt_server/dgram/request.c
+++ b/source4/nbt_server/dgram/request.c
@@ -73,7 +73,9 @@ NTSTATUS nbtd_dgram_setup(struct nbtd_interface *iface, const char *bind_address
 
 	if (strcmp("0.0.0.0", iface->netmask) != 0) {
 		/* listen for broadcasts on port 138 */
-		bcast_dgmsock = nbt_dgram_socket_init(iface, nbtsrv->task->event_ctx);
+		bcast_dgmsock = nbt_dgram_socket_init(iface, 
+						      nbtsrv->task->event_ctx,
+						      lp_iconv_convenience(nbtsrv->task->lp_ctx));
 		if (!bcast_dgmsock) {
 			talloc_free(tmp_ctx);
 			return NT_STATUS_NO_MEMORY;
@@ -100,7 +102,8 @@ NTSTATUS nbtd_dgram_setup(struct nbtd_interface *iface, const char *bind_address
 	}
 
 	/* listen for unicasts on port 138 */
-	iface->dgmsock = nbt_dgram_socket_init(iface, nbtsrv->task->event_ctx);
+	iface->dgmsock = nbt_dgram_socket_init(iface, nbtsrv->task->event_ctx,
+					       lp_iconv_convenience(nbtsrv->task->lp_ctx));
 	if (!iface->dgmsock) {
 		talloc_free(tmp_ctx);
 		return NT_STATUS_NO_MEMORY;
diff --git a/source4/nbt_server/interfaces.c b/source4/nbt_server/interfaces.c
index 486acfbad5..e59475051b 100644
--- a/source4/nbt_server/interfaces.c
+++ b/source4/nbt_server/interfaces.c
@@ -130,7 +130,7 @@ static NTSTATUS nbtd_add_socket(struct nbtd_server *nbtsrv,
 		struct nbt_name_socket *bcast_nbtsock;
 
 		/* listen for broadcasts on port 137 */
-		bcast_nbtsock = nbt_name_socket_init(iface, nbtsrv->task->event_ctx);
+		bcast_nbtsock = nbt_name_socket_init(iface, nbtsrv->task->event_ctx, lp_iconv_convenience(nbtsrv->task->lp_ctx));
 		if (!bcast_nbtsock) {
 			talloc_free(iface);
 			return NT_STATUS_NO_MEMORY;
@@ -156,7 +156,8 @@ static NTSTATUS nbtd_add_socket(struct nbtd_server *nbtsrv,
 	}
 
 	/* listen for unicasts on port 137 */
-	iface->nbtsock = nbt_name_socket_init(iface, nbtsrv->task->event_ctx);
+	iface->nbtsock = nbt_name_socket_init(iface, nbtsrv->task->event_ctx, 
+					      lp_iconv_convenience(nbtsrv->task->lp_ctx));
 	if (!iface->nbtsock) {
 		talloc_free(iface);
 		return NT_STATUS_NO_MEMORY;
diff --git a/source4/ntvfs/common/notify.c b/source4/ntvfs/common/notify.c
index 94d32488eb..23aa3fb668 100644
--- a/source4/ntvfs/common/notify.c
+++ b/source4/ntvfs/common/notify.c
@@ -45,6 +45,7 @@ struct notify_context {
 	struct notify_array *array;
 	int seqnum;
 	struct sys_notify_context *sys_notify_ctx;
+	struct smb_iconv_convenience *iconv_convenience;
 };
 
 
@@ -107,6 +108,7 @@ struct notify_context *notify_init(TALLOC_CTX *mem_ctx, struct server_id server,
 	notify->messaging_ctx = messaging_ctx;
 	notify->list = NULL;
 	notify->array = NULL;
+	notify->iconv_convenience = lp_iconv_convenience(lp_ctx);
 	notify->seqnum = tdb_get_seqnum(notify->w->tdb);
 
 	talloc_set_destructor(notify, notify_destructor);
@@ -171,7 +173,7 @@ static NTSTATUS notify_load(struct notify_context *notify)
 	blob.data = dbuf.dptr;
 	blob.length = dbuf.dsize;
 
-	ndr_err = ndr_pull_struct_blob(&blob, notify->array, lp_iconv_convenience(global_loadparm),
+	ndr_err = ndr_pull_struct_blob(&blob, notify->array, notify->iconv_convenience,
 				       notify->array,
 				       (ndr_pull_flags_fn_t)ndr_pull_notify_array);
 	free(dbuf.dptr);
@@ -220,7 +222,7 @@ static NTSTATUS notify_save(struct notify_context *notify)
 	tmp_ctx = talloc_new(notify);
 	NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 
-	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, lp_iconv_convenience(global_loadparm), notify->array,
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, notify->iconv_convenience, notify->array,
 				       (ndr_push_flags_fn_t)ndr_push_notify_array);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
@@ -256,7 +258,7 @@ static void notify_handler(struct messaging_context *msg_ctx, void *private_data
 		return;
 	}
 
-	ndr_err = ndr_pull_struct_blob(data, tmp_ctx, lp_iconv_convenience(global_loadparm), &ev,
+	ndr_err = ndr_pull_struct_blob(data, tmp_ctx, notify->iconv_convenience, &ev,
 				      (ndr_pull_flags_fn_t)ndr_pull_notify_event);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
@@ -555,7 +557,7 @@ static void notify_send(struct notify_context *notify, struct notify_entry *e,
 
 	tmp_ctx = talloc_new(notify);
 
-	ndr_err = ndr_push_struct_blob(&data, tmp_ctx, lp_iconv_convenience(global_loadparm), &ev, (ndr_push_flags_fn_t)ndr_push_notify_event);
+	ndr_err = ndr_push_struct_blob(&data, tmp_ctx, notify->iconv_convenience, &ev, (ndr_push_flags_fn_t)ndr_push_notify_event);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
 		return;
diff --git a/source4/ntvfs/common/opendb.c b/source4/ntvfs/common/opendb.c
index 36144d0406..d8cb67686b 100644
--- a/source4/ntvfs/common/opendb.c
+++ b/source4/ntvfs/common/opendb.c
@@ -118,9 +118,10 @@ _PUBLIC_ NTSTATUS odb_open_file_pending(struct odb_lock *lck, void *private)
 /*
   remove a opendb entry
 */
-_PUBLIC_ NTSTATUS odb_close_file(struct odb_lock *lck, void *file_handle)
+_PUBLIC_ NTSTATUS odb_close_file(struct odb_lock *lck, void *file_handle,
+				 const char **delete_path)
 {
-	return ops->odb_close_file(lck, file_handle);
+	return ops->odb_close_file(lck, file_handle, delete_path);
 }
 
 
@@ -154,10 +155,9 @@ _PUBLIC_ NTSTATUS odb_set_delete_on_close(struct odb_lock *lck, bool del_on_clos
   people still have the file open
 */
 _PUBLIC_ NTSTATUS odb_get_delete_on_close(struct odb_context *odb, 
-					  DATA_BLOB *key, bool *del_on_close, 
-					  int *open_count, char **path)
+					  DATA_BLOB *key, bool *del_on_close)
 {
-	return ops->odb_get_delete_on_close(odb, key, del_on_close, open_count, path);
+	return ops->odb_get_delete_on_close(odb, key, del_on_close);
 }
 
 
diff --git a/source4/ntvfs/common/opendb.h b/source4/ntvfs/common/opendb.h
index 9591bcf6b9..33f2e1c88d 100644
--- a/source4/ntvfs/common/opendb.h
+++ b/source4/ntvfs/common/opendb.h
@@ -32,13 +32,13 @@ struct opendb_ops {
 				  uint32_t open_disposition, bool break_to_none,
 				  uint32_t oplock_level, uint32_t *oplock_granted);
 	NTSTATUS (*odb_open_file_pending)(struct odb_lock *lck, void *private);
-	NTSTATUS (*odb_close_file)(struct odb_lock *lck, void *file_handle);
+	NTSTATUS (*odb_close_file)(struct odb_lock *lck, void *file_handle,
+				   const char **delete_path);
 	NTSTATUS (*odb_remove_pending)(struct odb_lock *lck, void *private);
 	NTSTATUS (*odb_rename)(struct odb_lock *lck, const char *path);
 	NTSTATUS (*odb_set_delete_on_close)(struct odb_lock *lck, bool del_on_close);
 	NTSTATUS (*odb_get_delete_on_close)(struct odb_context *odb, 
-					    DATA_BLOB *key, bool *del_on_close, 
-					    int *open_count, char **path);
+					    DATA_BLOB *key, bool *del_on_close);
 	NTSTATUS (*odb_can_open)(struct odb_lock *lck,
 				 uint32_t stream_id, uint32_t share_access,
 				 uint32_t access_mask, bool delete_on_close,
diff --git a/source4/ntvfs/common/opendb_tdb.c b/source4/ntvfs/common/opendb_tdb.c
index fe5a0a8864..37c1c0850b 100644
--- a/source4/ntvfs/common/opendb_tdb.c
+++ b/source4/ntvfs/common/opendb_tdb.c
@@ -376,8 +376,26 @@ static NTSTATUS odb_tdb_open_can_internal(struct odb_context *odb,
 	   exclusive oplocks afterwards. */
 	for (i=0;i<file->num_entries;i++) {
 		if (file->entries[i].oplock_level == OPLOCK_EXCLUSIVE) {
+			bool oplock_return = OPLOCK_BREAK_TO_LEVEL_II;
+			/* if this is an attribute only access
+			 * it doesn't conflict with an EXCLUSIVE oplock
+			 * but we'll not grant the oplock below
+			 */
+			attrs_only = access_attributes_only(access_mask,
+							    open_disposition,
+							    break_to_none);
+			if (attrs_only) {
+				break;
+			}
+			/*
+			 * send an oplock break to the holder of the
+			 * oplock and tell caller to retry later
+			 */
+			if (break_to_none) {
+				oplock_return = OPLOCK_BREAK_TO_NONE;
+			}
 			odb_oplock_break_send(odb, &file->entries[i],
-					      OPLOCK_BREAK_TO_NONE);
+					      oplock_return);
 			return NT_STATUS_OPLOCK_NOT_GRANTED;
 		}
 	}
@@ -449,8 +467,8 @@ static NTSTATUS odb_tdb_open_file(struct odb_lock *lck,
 				e.oplock_level	= OPLOCK_EXCLUSIVE;
 				*oplock_granted	= EXCLUSIVE_OPLOCK_RETURN;
 			} else {
-				e.oplock_level	= OPLOCK_NONE;
-				*oplock_granted	= NO_OPLOCK_RETURN;
+				e.oplock_level	= OPLOCK_LEVEL_II;
+				*oplock_granted	= LEVEL_II_OPLOCK_RETURN;
 			}
 		} else if (oplock_level == OPLOCK_BATCH) {
 			if (file.num_entries == 0) {
@@ -509,10 +527,12 @@ static NTSTATUS odb_tdb_open_file_pending(struct odb_lock *lck, void *private)
 /*
   remove a opendb entry
 */
-static NTSTATUS odb_tdb_close_file(struct odb_lock *lck, void *file_handle)
+static NTSTATUS odb_tdb_close_file(struct odb_lock *lck, void *file_handle,
+				   const char **_delete_path)
 {
 	struct odb_context *odb = lck->odb;
 	struct opendb_file file;
+	const char *delete_path = NULL;
 	int i;
 	NTSTATUS status;
 
@@ -548,7 +568,16 @@ static NTSTATUS odb_tdb_close_file(struct odb_lock *lck, void *file_handle)
 	file.num_pending = 0;
 
 	file.num_entries--;
-	
+
+	if (file.num_entries == 0 && file.delete_on_close) {
+		delete_path = talloc_strdup(lck, file.path);
+		NT_STATUS_HAVE_NO_MEMORY(delete_path);
+	}
+
+	if (_delete_path) {
+		*_delete_path = delete_path;
+	}
+
 	return odb_push_record(lck, &file);
 }
 
@@ -705,20 +734,20 @@ static NTSTATUS odb_tdb_set_delete_on_close(struct odb_lock *lck, bool del_on_cl
   people still have the file open
 */
 static NTSTATUS odb_tdb_get_delete_on_close(struct odb_context *odb, 
-					    DATA_BLOB *key, bool *del_on_close, 
-					    int *open_count, char **path)
+					    DATA_BLOB *key, bool *del_on_close)
 {
 	NTSTATUS status;
 	struct opendb_file file;
 	struct odb_lock *lck;
 
+	(*del_on_close) = false;
+
 	lck = odb_lock(odb, odb, key);
 	NT_STATUS_HAVE_NO_MEMORY(lck);
 
 	status = odb_pull_record(lck, &file);
 	if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_NOT_FOUND, status)) {
 		talloc_free(lck);
-		(*del_on_close) = false;
 		return NT_STATUS_OK;
 	}
 	if (!NT_STATUS_IS_OK(status)) {
@@ -727,16 +756,6 @@ static NTSTATUS odb_tdb_get_delete_on_close(struct odb_context *odb,
 	}
 
 	(*del_on_close) = file.delete_on_close;
-	if (open_count != NULL) {
-		(*open_count) = file.num_entries;
-	}
-	if (path != NULL) {
-		*path = talloc_strdup(odb, file.path);
-		NT_STATUS_HAVE_NO_MEMORY(*path);
-		if (file.num_entries == 1 && file.entries[0].delete_on_close) {
-			(*del_on_close) = true;
-		}
-	}
 
 	talloc_free(lck);
 
diff --git a/source4/ntvfs/posix/pvfs_open.c b/source4/ntvfs/posix/pvfs_open.c
index a01352f60c..740a0a9d13 100644
--- a/source4/ntvfs/posix/pvfs_open.c
+++ b/source4/ntvfs/posix/pvfs_open.c
@@ -50,29 +50,10 @@ struct pvfs_file *pvfs_find_fd(struct pvfs_state *pvfs,
 */
 static int pvfs_dir_handle_destructor(struct pvfs_file_handle *h)
 {
-	int open_count;
-	char *path = NULL;
-
-	if (h->name->stream_name == NULL && 
-	    pvfs_delete_on_close_set(h->pvfs, h, &open_count, &path) &&
-	    open_count == 1) {
-		NTSTATUS status;
-		status = pvfs_xattr_unlink_hook(h->pvfs, path);
-		if (!NT_STATUS_IS_OK(status)) {
-			DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
-				 path, nt_errstr(status)));
-		}
-		if (rmdir(path) != 0) {
-			DEBUG(0,("pvfs_dir_handle_destructor: failed to rmdir '%s' - %s\n", 
-				 path, strerror(errno)));
-		}
-	}
-
-	talloc_free(path);
-
 	if (h->have_opendb_entry) {
 		struct odb_lock *lck;
 		NTSTATUS status;
+		const char *delete_path = NULL;
 
 		lck = odb_lock(h, h->pvfs->odb_context, &h->odb_locking_key);
 		if (lck == NULL) {
@@ -80,12 +61,24 @@ static int pvfs_dir_handle_destructor(struct pvfs_file_handle *h)
 			return 0;
 		}
 
-		status = odb_close_file(lck, h);
+		status = odb_close_file(lck, h, &delete_path);
 		if (!NT_STATUS_IS_OK(status)) {
-			DEBUG(0,("Unable to remove opendb entry for '%s' - %s\n", 
+			DEBUG(0,("Unable to remove opendb entry for '%s' - %s\n",
 				 h->name->full_name, nt_errstr(status)));
 		}
 
+		if (h->name->stream_name == NULL && delete_path) {
+			status = pvfs_xattr_unlink_hook(h->pvfs, delete_path);
+			if (!NT_STATUS_IS_OK(status)) {
+				DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
+					 delete_path, nt_errstr(status)));
+			}
+			if (rmdir(delete_path) != 0) {
+				DEBUG(0,("pvfs_dir_handle_destructor: failed to rmdir '%s' - %s\n",
+					 delete_path, strerror(errno)));
+			}
+		}
+
 		talloc_free(lck);
 	}
 
@@ -410,9 +403,6 @@ cleanup_delete:
 */
 static int pvfs_handle_destructor(struct pvfs_file_handle *h)
 {
-	int open_count;
-	char *path = NULL;
-
 	/* the write time is no longer sticky */
 	if (h->sticky_write_time) {
 		NTSTATUS status;
@@ -441,32 +431,10 @@ static int pvfs_handle_destructor(struct pvfs_file_handle *h)
 		h->fd = -1;
 	}
 
-	if (h->name->stream_name == NULL && 
-	    h->open_completed &&
-	    pvfs_delete_on_close_set(h->pvfs, h, &open_count, &path) &&
-	    open_count == 1) {
-		NTSTATUS status;
-		status = pvfs_xattr_unlink_hook(h->pvfs, path);
-		if (!NT_STATUS_IS_OK(status)) {
-			DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
-				 path, nt_errstr(status)));
-		}
-		if (unlink(path) != 0) {
-			DEBUG(0,("pvfs_close: failed to delete '%s' - %s\n", 
-				 path, strerror(errno)));
-		} else {
-			notify_trigger(h->pvfs->notify_context, 
-				       NOTIFY_ACTION_REMOVED, 
-				       FILE_NOTIFY_CHANGE_FILE_NAME,
-				       path);
-		}
-	}
-
-	talloc_free(path);
-
 	if (h->have_opendb_entry) {
 		struct odb_lock *lck;
 		NTSTATUS status;
+		const char *delete_path = NULL;
 
 		lck = odb_lock(h, h->pvfs->odb_context, &h->odb_locking_key);
 		if (lck == NULL) {
@@ -474,12 +442,30 @@ static int pvfs_handle_destructor(struct pvfs_file_handle *h)
 			return 0;
 		}
 
-		status = odb_close_file(lck, h);
+		status = odb_close_file(lck, h, &delete_path);
 		if (!NT_STATUS_IS_OK(status)) {
 			DEBUG(0,("Unable to remove opendb entry for '%s' - %s\n", 
 				 h->name->full_name, nt_errstr(status)));
 		}
 
+		if (h->name->stream_name == NULL &&
+		    h->open_completed && delete_path) {
+			status = pvfs_xattr_unlink_hook(h->pvfs, delete_path);
+			if (!NT_STATUS_IS_OK(status)) {
+				DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
+					 delete_path, nt_errstr(status)));
+			}
+			if (unlink(delete_path) != 0) {
+				DEBUG(0,("pvfs_close: failed to delete '%s' - %s\n",
+					 delete_path, strerror(errno)));
+			} else {
+				notify_trigger(h->pvfs->notify_context,
+					       NOTIFY_ACTION_REMOVED,
+					       FILE_NOTIFY_CHANGE_FILE_NAME,
+					       delete_path);
+			}
+		}
+
 		talloc_free(lck);
 	}
 
@@ -574,7 +560,7 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
 		status = pvfs_locking_key(parent, req, &locking_key);
 		NT_STATUS_NOT_OK_RETURN(status);
 		status = odb_get_delete_on_close(pvfs->odb_context, &locking_key, 
-						 &del_on_close, NULL, NULL);
+						 &del_on_close);
 		NT_STATUS_NOT_OK_RETURN(status);
 		if (del_on_close) {
 			return NT_STATUS_DELETE_PENDING;
@@ -1738,14 +1724,13 @@ NTSTATUS pvfs_can_stat(struct pvfs_state *pvfs,
 /*
   determine if delete on close is set on 
 */
-bool pvfs_delete_on_close_set(struct pvfs_state *pvfs, struct pvfs_file_handle *h, 
-			      int *open_count, char **path)
+bool pvfs_delete_on_close_set(struct pvfs_state *pvfs, struct pvfs_file_handle *h)
 {
 	NTSTATUS status;
 	bool del_on_close;
 
 	status = odb_get_delete_on_close(pvfs->odb_context, &h->odb_locking_key, 
-					 &del_on_close, open_count, path);
+					 &del_on_close);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(1,("WARNING: unable to determine delete on close status for open file\n"));
 		return false;
diff --git a/source4/ntvfs/posix/pvfs_qfileinfo.c b/source4/ntvfs/posix/pvfs_qfileinfo.c
index 8d23d707a4..6ed729541f 100644
--- a/source4/ntvfs/posix/pvfs_qfileinfo.c
+++ b/source4/ntvfs/posix/pvfs_qfileinfo.c
@@ -380,7 +380,7 @@ NTSTATUS pvfs_qfileinfo(struct ntvfs_module_context *ntvfs,
 	switch (info->generic.level) {
 	case RAW_FILEINFO_STANDARD_INFO:
 	case RAW_FILEINFO_STANDARD_INFORMATION:
-		if (pvfs_delete_on_close_set(pvfs, h, NULL, NULL)) {
+		if (pvfs_delete_on_close_set(pvfs, h)) {
 			info->standard_info.out.delete_pending = 1;
 			info->standard_info.out.nlink--;
 		}
@@ -388,7 +388,7 @@ NTSTATUS pvfs_qfileinfo(struct ntvfs_module_context *ntvfs,
 
 	case RAW_FILEINFO_ALL_INFO:
 	case RAW_FILEINFO_ALL_INFORMATION:
-		if (pvfs_delete_on_close_set(pvfs, h, NULL, NULL)) {
+		if (pvfs_delete_on_close_set(pvfs, h)) {
 			info->all_info.out.delete_pending = 1;
 			info->all_info.out.nlink--;
 		}
@@ -407,7 +407,7 @@ NTSTATUS pvfs_qfileinfo(struct ntvfs_module_context *ntvfs,
 		break;
 
 	case RAW_FILEINFO_SMB2_ALL_INFORMATION:
-		if (pvfs_delete_on_close_set(pvfs, h, NULL, NULL)) {
+		if (pvfs_delete_on_close_set(pvfs, h)) {
 			info->all_info2.out.delete_pending = 1;
 			info->all_info2.out.nlink--;
 		}
diff --git a/source4/ntvfs/posix/pvfs_rename.c b/source4/ntvfs/posix/pvfs_rename.c
index 5693e79314..185e35f800 100644
--- a/source4/ntvfs/posix/pvfs_rename.c
+++ b/source4/ntvfs/posix/pvfs_rename.c
@@ -134,12 +134,12 @@ static const char *pvfs_resolve_wildcard_component(TALLOC_CTX *mem_ctx,
   resolve a wildcard rename pattern.
 */
 static const char *pvfs_resolve_wildcard(TALLOC_CTX *mem_ctx, 
+					 struct smb_iconv_convenience *iconv_convenience,
 					 const char *fname, 
 					 const char *pattern)
 {
 	const char *base1, *base2;
 	const char *ext1, *ext2;
-	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 	char *p;
 
 	/* break into base part plus extension */
@@ -181,6 +181,84 @@ static const char *pvfs_resolve_wildcard(TALLOC_CTX *mem_ctx,
 }
 
 /*
+  retry an rename after a sharing violation
+*/
+static void pvfs_retry_rename(struct pvfs_odb_retry *r,
+			      struct ntvfs_module_context *ntvfs,
+			      struct ntvfs_request *req,
+			      void *_io,
+			      void *private_data,
+			      enum pvfs_wait_notice reason)
+{
+	union smb_rename *io = talloc_get_type(_io, union smb_rename);
+	NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
+
+	talloc_free(r);
+
+	switch (reason) {
+	case PVFS_WAIT_CANCEL:
+/*TODO*/
+		status = NT_STATUS_CANCELLED;
+		break;
+	case PVFS_WAIT_TIMEOUT:
+		/* if it timed out, then give the failure
+		   immediately */
+/*TODO*/
+		status = NT_STATUS_SHARING_VIOLATION;
+		break;
+	case PVFS_WAIT_EVENT:
+
+		/* try the open again, which could trigger another retry setup
+		   if it wants to, so we have to unmark the async flag so we
+		   will know if it does a second async reply */
+		req->async_states->state &= ~NTVFS_ASYNC_STATE_ASYNC;
+
+		status = pvfs_rename(ntvfs, req, io);
+		if (req->async_states->state & NTVFS_ASYNC_STATE_ASYNC) {
+			/* the 2nd try also replied async, so we don't send
+			   the reply yet */
+			return;
+		}
+
+		/* re-mark it async, just in case someone up the chain does
+		   paranoid checking */
+		req->async_states->state |= NTVFS_ASYNC_STATE_ASYNC;
+		break;
+	}
+
+	/* send the reply up the chain */
+	req->async_states->status = status;
+	req->async_states->send_fn(req);
+}
+
+/*
+  setup for a rename retry after a sharing violation
+  or a non granted oplock
+*/
+static NTSTATUS pvfs_rename_setup_retry(struct ntvfs_module_context *ntvfs,
+					struct ntvfs_request *req,
+					union smb_rename *io,
+					struct odb_lock *lck,
+					NTSTATUS status)
+{
+	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct timeval end_time;
+
+	if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
+		end_time = timeval_add(&req->statistics.request_time,
+				       0, pvfs->sharing_violation_delay);
+	} else if (NT_STATUS_EQUAL(status, NT_STATUS_OPLOCK_NOT_GRANTED)) {
+		end_time = timeval_add(&req->statistics.request_time,
+				       pvfs->oplock_break_timeout, 0);
+	} else {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	return pvfs_odb_retry_setup(ntvfs, req, lck, end_time, io, NULL,
+				    pvfs_retry_rename);
+}
+
+/*
   rename one file from a wildcard set
 */
 static NTSTATUS pvfs_rename_one(struct pvfs_state *pvfs, 
@@ -196,7 +274,7 @@ static NTSTATUS pvfs_rename_one(struct pvfs_state *pvfs,
 	NTSTATUS status;
 
 	/* resolve the wildcard pattern for this name */
-	fname2 = pvfs_resolve_wildcard(mem_ctx, fname1, fname2);
+	fname2 = pvfs_resolve_wildcard(mem_ctx, lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), fname1, fname2);
 	if (fname2 == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -354,8 +432,19 @@ static NTSTATUS pvfs_rename_mv(struct ntvfs_module_context *ntvfs,
 	}
 
 	status = pvfs_can_rename(pvfs, req, name1, &lck);
+	/*
+	 * on a sharing violation we need to retry when the file is closed by
+	 * the other user, or after 1 second
+	 * on a non granted oplock we need to retry when the file is closed by
+	 * the other user, or after 30 seconds
+	 */
+	if ((NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION) ||
+	     NT_STATUS_EQUAL(status, NT_STATUS_OPLOCK_NOT_GRANTED)) &&
+	    (req->async_states->state & NTVFS_ASYNC_STATE_MAY_ASYNC)) {
+		return pvfs_rename_setup_retry(pvfs->ntvfs, req, ren, lck, status);
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
-		talloc_free(lck);
 		return status;
 	}
 
@@ -377,6 +466,7 @@ static NTSTATUS pvfs_rename_nt(struct ntvfs_module_context *ntvfs,
 	struct pvfs_state *pvfs = ntvfs->private_data;
 	NTSTATUS status;
 	struct pvfs_filename *name1, *name2;
+	struct odb_lock *lck = NULL;
 
 	switch (ren->ntrename.in.flags) {
 	case RENAME_FLAG_RENAME:
@@ -422,7 +512,18 @@ static NTSTATUS pvfs_rename_nt(struct ntvfs_module_context *ntvfs,
 		return status;
 	}
 
-	status = pvfs_can_rename(pvfs, req, name1, NULL);
+	status = pvfs_can_rename(pvfs, req, name1, &lck);
+	/*
+	 * on a sharing violation we need to retry when the file is closed by
+	 * the other user, or after 1 second
+	 * on a non granted oplock we need to retry when the file is closed by
+	 * the other user, or after 30 seconds
+	 */
+	if ((NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION) ||
+	     NT_STATUS_EQUAL(status, NT_STATUS_OPLOCK_NOT_GRANTED)) &&
+	    (req->async_states->state & NTVFS_ASYNC_STATE_MAY_ASYNC)) {
+		return pvfs_rename_setup_retry(pvfs->ntvfs, req, ren, lck, status);
+	}
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -432,6 +533,9 @@ static NTSTATUS pvfs_rename_nt(struct ntvfs_module_context *ntvfs,
 		status = pvfs_access_check_parent(pvfs, req, name2, SEC_DIR_ADD_FILE);
 		NT_STATUS_NOT_OK_RETURN(status);
 		status = pvfs_do_rename(pvfs, name1, name2->full_name);
+		if (NT_STATUS_IS_OK(status)) {
+			status = odb_rename(lck, name2->full_name);
+		}
 		NT_STATUS_NOT_OK_RETURN(status);
 		break;
 
diff --git a/source4/ntvfs/posix/pvfs_resolve.c b/source4/ntvfs/posix/pvfs_resolve.c
index cf74816391..2bfc47beff 100644
--- a/source4/ntvfs/posix/pvfs_resolve.c
+++ b/source4/ntvfs/posix/pvfs_resolve.c
@@ -329,14 +329,15 @@ static NTSTATUS pvfs_unix_path(struct pvfs_state *pvfs, const char *cifs_name,
   reduce a name that contains .. components or repeated \ separators
   return NULL if it can't be reduced
 */
-static NTSTATUS pvfs_reduce_name(TALLOC_CTX *mem_ctx, const char **fname, uint_t flags)
+static NTSTATUS pvfs_reduce_name(TALLOC_CTX *mem_ctx, 
+				 struct smb_iconv_convenience *iconv_convenience, 
+				 const char **fname, uint_t flags)
 {
 	codepoint_t c;
 	size_t c_size, len;
 	int i, num_components, err_count;
 	char **components;
 	char *p, *s, *ret;
-	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	s = talloc_strdup(mem_ctx, *fname);
 	if (s == NULL) return NT_STATUS_NO_MEMORY;
@@ -471,7 +472,7 @@ NTSTATUS pvfs_resolve_name(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
 
 	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD)) {
 		/* it might contain .. components which need to be reduced */
-		status = pvfs_reduce_name(*name, &cifs_name, flags);
+		status = pvfs_reduce_name(*name, lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), &cifs_name, flags);
 		if (!NT_STATUS_IS_OK(status)) {
 			return status;
 		}
diff --git a/source4/ntvfs/posix/pvfs_xattr.c b/source4/ntvfs/posix/pvfs_xattr.c
index 39090bf702..b66d252a45 100644
--- a/source4/ntvfs/posix/pvfs_xattr.c
+++ b/source4/ntvfs/posix/pvfs_xattr.c
@@ -140,7 +140,7 @@ _PUBLIC_ NTSTATUS pvfs_xattr_ndr_save(struct pvfs_state *pvfs,
 	NTSTATUS status;
 	enum ndr_err_code ndr_err;
 
-	ndr_err = ndr_push_struct_blob(&blob, mem_ctx, lp_iconv_convenience(global_loadparm), p, (ndr_push_flags_fn_t)push_fn);
+	ndr_err = ndr_push_struct_blob(&blob, mem_ctx, lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), p, (ndr_push_flags_fn_t)push_fn);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(mem_ctx);
 		return ndr_map_error2ntstatus(ndr_err);
diff --git a/source4/ntvfs/sysdep/inotify.c b/source4/ntvfs/sysdep/inotify.c
index 3fa710415b..093c15abab 100644
--- a/source4/ntvfs/sysdep/inotify.c
+++ b/source4/ntvfs/sysdep/inotify.c
@@ -244,11 +244,6 @@ static void inotify_handler(struct event_context *ev, struct fd_event *fde,
 static NTSTATUS inotify_setup(struct sys_notify_context *ctx)
 {
 	struct inotify_private *in;
-
-	if (!lp_parm_bool(global_loadparm, NULL, "notify", "inotify", true)) {
-		return NT_STATUS_INVALID_SYSTEM_SERVICE;
-	}
-
 	in = talloc(ctx, struct inotify_private);
 	NT_STATUS_HAVE_NO_MEMORY(in);
 	in->fd = inotify_init();
@@ -339,6 +334,10 @@ static NTSTATUS inotify_watch(struct sys_notify_context *ctx,
 	/* maybe setup the inotify fd */
 	if (ctx->private_data == NULL) {
 		NTSTATUS status;
+		if (!lp_parm_bool(global_loadparm, NULL, "notify", "inotify", true)) {
+			return NT_STATUS_INVALID_SYSTEM_SERVICE;
+		}
+
 		status = inotify_setup(ctx);
 		NT_STATUS_NOT_OK_RETURN(status);
 	}
diff --git a/source4/param/generic.c b/source4/param/generic.c
index 2327000fc9..b86e3ad234 100644
--- a/source4/param/generic.c
+++ b/source4/param/generic.c
@@ -259,11 +259,8 @@ int param_use(struct loadparm_context *lp_ctx, struct param_context *ctx)
 				struct loadparm_service *service = 
 							lp_service(lp_ctx, section->name);
 				if (service == NULL)
-					service = lp_add_service(lp_ctx, &sDefault, section->name);
-				lp_do_service_parameter(lp_ctx, 
-							service,
-							param->key,
-							param->value);
+					service = lp_add_service(lp_ctx, lp_default_service(lp_ctx), section->name);
+				lp_do_service_parameter(lp_ctx, service, param->key, param->value);
 			}
 		}
 	}
diff --git a/source4/param/loadparm.c b/source4/param/loadparm.c
index bad90fc74a..d94ab92ac9 100644
--- a/source4/param/loadparm.c
+++ b/source4/param/loadparm.c
@@ -224,44 +224,11 @@ struct loadparm_service
 };
 
 
-/* This is a default service used to prime a services structure */
-struct loadparm_service sDefault = {
-	.szService = NULL,
-	.szPath = NULL,
-	.szCopy = NULL,
-	.szInclude = NULL,
-	.szPrintername = NULL,
-	.szHostsallow = NULL,
-	.szHostsdeny = NULL,
-	.comment = NULL,
-	.volume = NULL,
-	.fstype = NULL,
-	.ntvfs_handler = NULL,
-	.iMaxPrintJobs = 1000,
-	.iMaxConnections = 0,
-	.iCSCPolicy = 0,
-	.bAvailable = true,
-	.bBrowseable = true,
-	.bRead_only = true,
-	.bPrint_ok = false,
-	.bMap_system = false,
-	.bMap_hidden = false,
-	.bMap_archive = true,
-	.bStrictLocking = true,
-	.iCreate_mask = 0744,
-	.iCreate_force_mode = 0000,
-	.iDir_mask = 0755,
-	.iDir_force_mode = 0000,
-	.copymap = NULL,
-	.bMSDfsRoot = false,
-	.bStrictSync = false,
-	.bCIFileSystem = false,
-};
-
 struct loadparm_context *global_loadparm = NULL;
 
 #define NUMPARAMETERS (sizeof(parm_table) / sizeof(struct parm_struct))
 
+
 /* prototypes for the special type handlers */
 static bool handle_include(struct loadparm_context *lp_ctx,
 			   const char *pszParmValue, char **ptr);
@@ -521,11 +488,13 @@ static struct parm_struct parm_table[] = {
 	{NULL, P_BOOL, P_NONE, 0, NULL, NULL}
 };
 
+
 /* local variables */
 struct loadparm_context {
 	const char *szConfigFile;
 	struct loadparm_global *globals;
 	struct loadparm_service **services;
+	struct loadparm_service *sDefault;
 	int iNumServices;
 	struct loadparm_service *currentService;
 	bool bInGlobalSection;
@@ -540,6 +509,10 @@ struct loadparm_context {
 };
 
 
+struct loadparm_service *lp_default_service(struct loadparm_context *lp_ctx)
+{
+	return lp_ctx->sDefault;
+}
 
 /*
   return the parameter table
@@ -619,15 +592,13 @@ static const char *lp_string(const char *s)
  int fn_name(struct loadparm_context *lp_ctx) {return lp_ctx->globals->var_name;}
 
 #define FN_LOCAL_STRING(fn_name,val) \
- const char *fn_name(struct loadparm_service *service) {return(lp_string((const char *)((service != NULL && service->val != NULL) ? service->val : sDefault.val)));}
-#define FN_LOCAL_CONST_STRING(fn_name,val) \
- const char *fn_name(struct loadparm_service *service) {return (const char *)(service != NULL && service->val != NULL) ? service->val : sDefault.val;}
+ const char *fn_name(struct loadparm_service *service, struct loadparm_service *sDefault) {return(lp_string((const char *)((service != NULL && service->val != NULL) ? service->val : sDefault->val)));}
 #define FN_LOCAL_LIST(fn_name,val) \
- const char **fn_name(struct loadparm_service *service) {return(const char **)(service != NULL && service->val != NULL? service->val : sDefault.val);}
+ const char **fn_name(struct loadparm_service *service, struct loadparm_service *sDefault) {return(const char **)(service != NULL && service->val != NULL? service->val : sDefault->val);}
 #define FN_LOCAL_BOOL(fn_name,val) \
- bool fn_name(struct loadparm_service *service) {return((service != NULL)? service->val : sDefault.val);}
+ bool fn_name(struct loadparm_service *service, struct loadparm_service *sDefault) {return((service != NULL)? service->val : sDefault->val);}
 #define FN_LOCAL_INTEGER(fn_name,val) \
- int fn_name(struct loadparm_service *service) {return((service != NULL)? service->val : sDefault.val);}
+ int fn_name(struct loadparm_service *service, struct loadparm_service *sDefault) {return((service != NULL)? service->val : sDefault->val);}
 
 _PUBLIC_ FN_GLOBAL_INTEGER(lp_server_role, server_role)
 _PUBLIC_ FN_GLOBAL_LIST(lp_smb_ports, smb_ports)
@@ -722,8 +693,11 @@ _PUBLIC_ FN_GLOBAL_INTEGER(lp_security, security)
 _PUBLIC_ FN_GLOBAL_BOOL(lp_paranoid_server_security, paranoid_server_security)
 _PUBLIC_ FN_GLOBAL_INTEGER(lp_announce_as, announce_as)
 _PUBLIC_ FN_GLOBAL_LIST(lp_js_include, jsInclude)
-_PUBLIC_ FN_LOCAL_STRING(lp_servicename, szService)
-_PUBLIC_ FN_LOCAL_CONST_STRING(lp_const_servicename, szService)
+const char *lp_servicename(const struct loadparm_service *service)
+{
+	return lp_string((const char *)service->szService);
+}
+
 _PUBLIC_ FN_LOCAL_STRING(lp_pathname, szPath)
 static FN_LOCAL_STRING(_lp_printername, szPrintername)
 _PUBLIC_ FN_LOCAL_LIST(lp_hostsallow, szHostsallow)
@@ -999,11 +973,11 @@ bool lp_parm_bool(struct loadparm_context *lp_ctx,
  * Initialise a service to the defaults.
  */
 
-static struct loadparm_service *init_service(TALLOC_CTX *mem_ctx)
+static struct loadparm_service *init_service(TALLOC_CTX *mem_ctx, struct loadparm_service *sDefault)
 {
 	struct loadparm_service *pservice =
 		talloc_zero(mem_ctx, struct loadparm_service);
-	copy_service(pservice, &sDefault, NULL);
+	copy_service(pservice, sDefault, NULL);
 	return pservice;
 }
 
@@ -1085,7 +1059,7 @@ struct loadparm_service *lp_add_service(struct loadparm_context *lp_ctx,
 		lp_ctx->iNumServices++;
 	}
 
-	lp_ctx->services[i] = init_service(lp_ctx->services);
+	lp_ctx->services[i] = init_service(lp_ctx->services, lp_ctx->sDefault);
 	if (lp_ctx->services[i] == NULL) {
 		DEBUG(0,("lp_add_service: out of memory!\n"));
 		return NULL;
@@ -1114,10 +1088,10 @@ bool lp_add_home(struct loadparm_context *lp_ctx,
 		return false;
 
 	if (!(*(default_service->szPath))
-	    || strequal(default_service->szPath, sDefault.szPath)) {
+	    || strequal(default_service->szPath, lp_ctx->sDefault->szPath)) {
 		service->szPath = talloc_strdup(service, pszHomedir);
 	} else {
-		service->szPath = string_sub_talloc(service, lp_pathname(default_service),"%H", pszHomedir); 
+		service->szPath = string_sub_talloc(service, lp_pathname(default_service, lp_ctx->sDefault), "%H", pszHomedir); 
 	}
 
 	if (!(*(service->comment))) {
@@ -1139,7 +1113,7 @@ bool lp_add_home(struct loadparm_context *lp_ctx,
 static bool lp_add_hidden(struct loadparm_context *lp_ctx, const char *name,
 			  const char *fstype)
 {
-	struct loadparm_service *service = lp_add_service(lp_ctx, &sDefault, name);
+	struct loadparm_service *service = lp_add_service(lp_ctx, lp_ctx->sDefault, name);
 
 	if (service == NULL)
 		return false;
@@ -1243,7 +1217,7 @@ void *lp_parm_ptr(struct loadparm_context *lp_ctx,
 {
 	if (service == NULL) {
 		if (parm->class == P_LOCAL)
-			return ((char *)&sDefault)+parm->offset;
+			return ((char *)lp_ctx->sDefault)+parm->offset;
 		else if (parm->class == P_GLOBAL)
 			return ((char *)lp_ctx->globals)+parm->offset;
 		else return NULL;
@@ -2019,7 +1993,7 @@ static bool do_section(const char *pszSectionName, void *userdata)
 		/* issued by the post-processing of a previous section. */
 		DEBUG(2, ("Processing section \"[%s]\"\n", pszSectionName));
 
-		if ((lp_ctx->currentService = lp_add_service(lp_ctx, &sDefault,
+		if ((lp_ctx->currentService = lp_add_service(lp_ctx, lp_ctx->sDefault,
 							     pszSectionName))
 		    == NULL) {
 			DEBUG(0, ("Failed to add a new service\n"));
@@ -2032,12 +2006,12 @@ static bool do_section(const char *pszSectionName, void *userdata)
 
 
 /**
- * Determine if a partcular base parameter is currentl set to the default value.
+ * Determine if a particular base parameter is currently set to the default value.
  */
 
-static bool is_default(int i)
+static bool is_default(struct loadparm_service *sDefault, int i)
 {
-	void *def_ptr = ((char *)&sDefault) + parm_table[i].offset;
+	void *def_ptr = ((char *)sDefault) + parm_table[i].offset;
 	if (!defaults_saved)
 		return false;
 	switch (parm_table[i].type) {
@@ -2096,12 +2070,12 @@ static void dump_globals(struct loadparm_context *lp_ctx, FILE *f,
  * Display the contents of a single services record.
  */
 
-static void dump_a_service(struct loadparm_service * pService, FILE * f)
+static void dump_a_service(struct loadparm_service * pService, struct loadparm_service *sDefault, FILE * f)
 {
 	int i;
 	struct param_opt *data;
 
-	if (pService != &sDefault)
+	if (pService != sDefault)
 		fprintf(f, "\n[%s]\n", pService->szService);
 
 	for (i = 0; parm_table[i].label; i++)
@@ -2109,14 +2083,14 @@ static void dump_a_service(struct loadparm_service * pService, FILE * f)
 		    parm_table[i].offset != -1 &&
 		    (*parm_table[i].label != '-') &&
 		    (i == 0 || (parm_table[i].offset != parm_table[i - 1].offset))) {
-			if (pService == &sDefault) {
-				if (defaults_saved && is_default(i))
+			if (pService == sDefault) {
+				if (defaults_saved && is_default(sDefault, i))
 					continue;
 			} else {
 				if (equal_parameter(parm_table[i].type,
 						    ((char *)pService) +
 						    parm_table[i].offset,
-						    ((char *)&sDefault) +
+						    ((char *)sDefault) +
 						    parm_table[i].offset))
 					continue;
 			}
@@ -2189,7 +2163,7 @@ struct parm_struct *lp_next_parameter(struct loadparm_context *lp_ctx, int snum,
 				    !equal_parameter(parm_table[*i].type,
 						     ((char *)pService) +
 						     parm_table[*i].offset,
-						     ((char *)&sDefault) +
+						     ((char *)lp_ctx->sDefault) +
 						     parm_table[*i].offset))
 				{
 					return &parm_table[(*i)++];
@@ -2266,6 +2240,18 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
 	talloc_set_destructor(lp_ctx, lp_destructor);
 	lp_ctx->bInGlobalSection = true;
 	lp_ctx->globals = talloc_zero(lp_ctx, struct loadparm_global);
+	lp_ctx->sDefault = talloc_zero(lp_ctx, struct loadparm_service);
+
+	lp_ctx->sDefault->iMaxPrintJobs = 1000;
+	lp_ctx->sDefault->bAvailable = true;
+	lp_ctx->sDefault->bBrowseable = true;
+	lp_ctx->sDefault->bRead_only = true;
+	lp_ctx->sDefault->bMap_archive = true;
+	lp_ctx->sDefault->bStrictLocking = true;
+	lp_ctx->sDefault->iCreate_mask = 0744;
+	lp_ctx->sDefault->iCreate_force_mode = 0000;
+	lp_ctx->sDefault->iDir_mask = 0755;
+	lp_ctx->sDefault->iDir_force_mode = 0000;
 
 	DEBUG(3, ("Initialising global parameters\n"));
 
@@ -2276,7 +2262,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
 		    !(lp_ctx->flags[i] & FLAG_CMDLINE)) {
 			char **r;
 			if (parm_table[i].class == P_LOCAL) {
-				r = (char **)(((char *)&sDefault) + parm_table[i].offset);
+				r = (char **)(((char *)lp_ctx->sDefault) + parm_table[i].offset);
 			} else {
 				r = (char **)(((char *)lp_ctx->globals) + parm_table[i].offset);
 			}
@@ -2512,21 +2498,21 @@ void lp_dump(struct loadparm_context *lp_ctx, FILE *f, bool show_defaults,
 
 	dump_globals(lp_ctx, f, show_defaults);
 
-	dump_a_service(&sDefault, f);
+	dump_a_service(lp_ctx->sDefault, lp_ctx->sDefault, f);
 
 	for (iService = 0; iService < maxtoprint; iService++)
-		lp_dump_one(f, show_defaults, lp_ctx->services[iService]);
+		lp_dump_one(f, show_defaults, lp_ctx->services[iService], lp_ctx->sDefault);
 }
 
 /**
  * Display the contents of one service in human-readable form.
  */
-void lp_dump_one(FILE *f, bool show_defaults, struct loadparm_service *service)
+void lp_dump_one(FILE *f, bool show_defaults, struct loadparm_service *service, struct loadparm_service *sDefault)
 {
 	if (service != NULL) {
 		if (service->szService[0] == '\0')
 			return;
-		dump_a_service(service, f);
+		dump_a_service(service, sDefault, f);
 	}
 }
 
@@ -2565,9 +2551,9 @@ struct loadparm_service *lp_service(struct loadparm_context *lp_ctx,
 /**
  * A useful volume label function.
  */
-const char *volume_label(struct loadparm_service *service)
+const char *volume_label(struct loadparm_service *service, struct loadparm_service *sDefault)
 {
-	const char *ret = lp_volume(service);
+	const char *ret = lp_volume(service, sDefault);
 	if (!*ret)
 		return lp_servicename(service);
 	return ret;
@@ -2577,11 +2563,11 @@ const char *volume_label(struct loadparm_service *service)
 /**
  * If we are PDC then prefer us as DMB
  */
-const char *lp_printername(struct loadparm_service *service)
+const char *lp_printername(struct loadparm_service *service, struct loadparm_service *sDefault)
 {
-	const char *ret = _lp_printername(service);
+	const char *ret = _lp_printername(service, sDefault);
 	if (ret == NULL || (ret != NULL && *ret == '\0'))
-		ret = lp_const_servicename(service);
+		ret = lp_servicename(service);
 
 	return ret;
 }
@@ -2590,9 +2576,9 @@ const char *lp_printername(struct loadparm_service *service)
 /**
  * Return the max print jobs per queue.
  */
-int lp_maxprintjobs(struct loadparm_service *service)
+int lp_maxprintjobs(struct loadparm_service *service, struct loadparm_service *sDefault)
 {
-	int maxjobs = (service != NULL) ? service->iMaxPrintJobs : sDefault.iMaxPrintJobs;
+	int maxjobs = (service != NULL) ? service->iMaxPrintJobs : sDefault->iMaxPrintJobs;
 	if (maxjobs <= 0 || maxjobs >= PRINT_MAX_JOBID)
 		maxjobs = PRINT_MAX_JOBID - 1;
 
diff --git a/source4/param/loadparm.h b/source4/param/loadparm.h
index 842e1ce437..cd3c0b9595 100644
--- a/source4/param/loadparm.h
+++ b/source4/param/loadparm.h
@@ -59,6 +59,9 @@ struct parm_struct {
 	} def;
 };
 
+
+
+
 #define FLAG_DEFAULT    0x0001 /* this option was a default */
 #define FLAG_CMDLINE    0x0002 /* this option was set from the command line */
 
diff --git a/source4/param/param.h b/source4/param/param.h
index 098a73deec..84f864edaa 100644
--- a/source4/param/param.h
+++ b/source4/param/param.h
@@ -64,6 +64,5 @@ struct smbcli_options;
 #include "param/proto.h"
 
 extern struct loadparm_context *global_loadparm;
-extern struct loadparm_service sDefault;
 
 #endif /* _PARAM_H */
diff --git a/source4/param/param.i b/source4/param/param.i
index 7322302117..77d781d6ff 100644
--- a/source4/param/param.i
+++ b/source4/param/param.i
@@ -49,6 +49,7 @@ typedef struct param_opt param_opt;
 typedef struct loadparm_context {
     %extend {
         loadparm_context(TALLOC_CTX *mem_ctx) { return loadparm_init(mem_ctx); }
+        struct loadparm_service *default_service() { return lp_default_service($self); }
         bool load(const char *filename) { return lp_load($self, filename); }
         bool load_default() { return lp_load_default($self); }
 #ifdef SWIGPYTHON
@@ -167,9 +168,9 @@ typedef struct loadparm_context {
 
 typedef struct loadparm_service {
     %extend { 
-        const char *volume_label() { return volume_label($self); }
-        const char *printername() { return lp_printername($self); }
-        int maxprintjobs() { return lp_maxprintjobs($self); } 
+        const char *volume_label(struct loadparm_service *sDefault) { return volume_label($self, sDefault); }
+        const char *printername(struct loadparm_service *sDefault) { return lp_printername($self, sDefault); }
+        int maxprintjobs(struct loadparm_service *sDefault) { return lp_maxprintjobs($self, sDefault); } 
     }
 } loadparm_service;
 
diff --git a/source4/param/param.py b/source4/param/param.py
index 5adf7a4ecc..025acc6be1 100644
--- a/source4/param/param.py
+++ b/source4/param/param.py
@@ -63,6 +63,7 @@ class LoadParm(object):
     def __init__(self, *args, **kwargs): 
         _param.LoadParm_swiginit(self,_param.new_LoadParm(*args, **kwargs))
     __swig_destroy__ = _param.delete_LoadParm
+LoadParm.default_service = new_instancemethod(_param.LoadParm_default_service,None,LoadParm)
 LoadParm.load = new_instancemethod(_param.LoadParm_load,None,LoadParm)
 LoadParm.load_default = new_instancemethod(_param.LoadParm_load_default,None,LoadParm)
 LoadParm.__len__ = new_instancemethod(_param.LoadParm___len__,None,LoadParm)
diff --git a/source4/param/param_wrap.c b/source4/param/param_wrap.c
index 275e2d67ec..e74f902645 100644
--- a/source4/param/param_wrap.c
+++ b/source4/param/param_wrap.c
@@ -2526,6 +2526,7 @@ typedef struct param_section param_section;
 typedef struct param_opt param_opt;
 
 SWIGINTERN loadparm_context *new_loadparm_context(TALLOC_CTX *mem_ctx){ return loadparm_init(mem_ctx); }
+SWIGINTERN struct loadparm_service *loadparm_context_default_service(loadparm_context *self){ return lp_default_service(self); }
 
 SWIGINTERN swig_type_info*
 SWIG_pchar_descriptor(void)
@@ -2742,9 +2743,9 @@ SWIGINTERN PyObject *loadparm_context_get(loadparm_context *self,char const *par
             return Py_None;
         }
 SWIGINTERN void delete_loadparm_context(loadparm_context *self){ talloc_free(self); }
-SWIGINTERN char const *loadparm_service_volume_label(loadparm_service *self){ return volume_label(self); }
-SWIGINTERN char const *loadparm_service_printername(loadparm_service *self){ return lp_printername(self); }
-SWIGINTERN int loadparm_service_maxprintjobs(loadparm_service *self){ return lp_maxprintjobs(self); }
+SWIGINTERN char const *loadparm_service_volume_label(loadparm_service *self,struct loadparm_service *sDefault){ return volume_label(self, sDefault); }
+SWIGINTERN char const *loadparm_service_printername(loadparm_service *self,struct loadparm_service *sDefault){ return lp_printername(self, sDefault); }
+SWIGINTERN int loadparm_service_maxprintjobs(loadparm_service *self,struct loadparm_service *sDefault){ return lp_maxprintjobs(self, sDefault); }
 SWIGINTERN param *new_param(TALLOC_CTX *mem_ctx){ return param_init(mem_ctx); }
 SWIGINTERN int param_set(param *self,char const *parameter,PyObject *ob,char const *section_name){
             struct param_opt *opt = param_get_add(self, parameter, section_name);
@@ -2799,6 +2800,34 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_LoadParm_default_service(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  loadparm_context *arg1 = (loadparm_context *) 0 ;
+  struct loadparm_service *result = 0 ;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  PyObject * obj0 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self", NULL 
+  };
+  
+  arg1 = loadparm_init(NULL);
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"|O:LoadParm_default_service",kwnames,&obj0)) SWIG_fail;
+  if (obj0) {
+    res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_loadparm_context, 0 |  0 );
+    if (!SWIG_IsOK(res1)) {
+      SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "LoadParm_default_service" "', argument " "1"" of type '" "loadparm_context *""'"); 
+    }
+    arg1 = (loadparm_context *)(argp1);
+  }
+  result = (struct loadparm_service *)loadparm_context_default_service(arg1);
+  resultobj = SWIG_NewPointerObj(SWIG_as_voidptr(result), SWIGTYPE_p_loadparm_service, 0 |  0 );
+  return resultobj;
+fail:
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_LoadParm_load(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   loadparm_context *arg1 = (loadparm_context *) 0 ;
@@ -3241,22 +3270,33 @@ SWIGINTERN PyObject *LoadParm_swiginit(PyObject *SWIGUNUSEDPARM(self), PyObject
   return SWIG_Python_InitShadowInstance(args);
 }
 
-SWIGINTERN PyObject *_wrap_loadparm_service_volume_label(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
+SWIGINTERN PyObject *_wrap_loadparm_service_volume_label(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   loadparm_service *arg1 = (loadparm_service *) 0 ;
+  struct loadparm_service *arg2 = (struct loadparm_service *) 0 ;
   char *result = 0 ;
   void *argp1 = 0 ;
   int res1 = 0 ;
-  PyObject *swig_obj[1] ;
+  void *argp2 = 0 ;
+  int res2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "sDefault", NULL 
+  };
   
-  if (!args) SWIG_fail;
-  swig_obj[0] = args;
-  res1 = SWIG_ConvertPtr(swig_obj[0], &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:loadparm_service_volume_label",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
   if (!SWIG_IsOK(res1)) {
     SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "loadparm_service_volume_label" "', argument " "1"" of type '" "loadparm_service *""'"); 
   }
   arg1 = (loadparm_service *)(argp1);
-  result = (char *)loadparm_service_volume_label(arg1);
+  res2 = SWIG_ConvertPtr(obj1, &argp2,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "loadparm_service_volume_label" "', argument " "2"" of type '" "struct loadparm_service *""'"); 
+  }
+  arg2 = (struct loadparm_service *)(argp2);
+  result = (char *)loadparm_service_volume_label(arg1,arg2);
   resultobj = SWIG_FromCharPtr((const char *)result);
   return resultobj;
 fail:
@@ -3264,22 +3304,33 @@ fail:
 }
 
 
-SWIGINTERN PyObject *_wrap_loadparm_service_printername(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
+SWIGINTERN PyObject *_wrap_loadparm_service_printername(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   loadparm_service *arg1 = (loadparm_service *) 0 ;
+  struct loadparm_service *arg2 = (struct loadparm_service *) 0 ;
   char *result = 0 ;
   void *argp1 = 0 ;
   int res1 = 0 ;
-  PyObject *swig_obj[1] ;
+  void *argp2 = 0 ;
+  int res2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "sDefault", NULL 
+  };
   
-  if (!args) SWIG_fail;
-  swig_obj[0] = args;
-  res1 = SWIG_ConvertPtr(swig_obj[0], &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:loadparm_service_printername",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
   if (!SWIG_IsOK(res1)) {
     SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "loadparm_service_printername" "', argument " "1"" of type '" "loadparm_service *""'"); 
   }
   arg1 = (loadparm_service *)(argp1);
-  result = (char *)loadparm_service_printername(arg1);
+  res2 = SWIG_ConvertPtr(obj1, &argp2,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "loadparm_service_printername" "', argument " "2"" of type '" "struct loadparm_service *""'"); 
+  }
+  arg2 = (struct loadparm_service *)(argp2);
+  result = (char *)loadparm_service_printername(arg1,arg2);
   resultobj = SWIG_FromCharPtr((const char *)result);
   return resultobj;
 fail:
@@ -3287,22 +3338,33 @@ fail:
 }
 
 
-SWIGINTERN PyObject *_wrap_loadparm_service_maxprintjobs(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
+SWIGINTERN PyObject *_wrap_loadparm_service_maxprintjobs(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   loadparm_service *arg1 = (loadparm_service *) 0 ;
+  struct loadparm_service *arg2 = (struct loadparm_service *) 0 ;
   int result;
   void *argp1 = 0 ;
   int res1 = 0 ;
-  PyObject *swig_obj[1] ;
+  void *argp2 = 0 ;
+  int res2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "sDefault", NULL 
+  };
   
-  if (!args) SWIG_fail;
-  swig_obj[0] = args;
-  res1 = SWIG_ConvertPtr(swig_obj[0], &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:loadparm_service_maxprintjobs",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
   if (!SWIG_IsOK(res1)) {
     SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "loadparm_service_maxprintjobs" "', argument " "1"" of type '" "loadparm_service *""'"); 
   }
   arg1 = (loadparm_service *)(argp1);
-  result = (int)loadparm_service_maxprintjobs(arg1);
+  res2 = SWIG_ConvertPtr(obj1, &argp2,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "loadparm_service_maxprintjobs" "', argument " "2"" of type '" "struct loadparm_service *""'"); 
+  }
+  arg2 = (struct loadparm_service *)(argp2);
+  result = (int)loadparm_service_maxprintjobs(arg1,arg2);
   resultobj = SWIG_From_int((int)(result));
   return resultobj;
 fail:
@@ -4078,6 +4140,7 @@ SWIGINTERN PyObject *Swig_var_default_config_get(void) {
 
 static PyMethodDef SwigMethods[] = {
 	 { (char *)"new_LoadParm", (PyCFunction)_wrap_new_LoadParm, METH_NOARGS, NULL},
+	 { (char *)"LoadParm_default_service", (PyCFunction) _wrap_LoadParm_default_service, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm_load", (PyCFunction) _wrap_LoadParm_load, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm_load_default", (PyCFunction) _wrap_LoadParm_load_default, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm___len__", (PyCFunction) _wrap_LoadParm___len__, METH_VARARGS | METH_KEYWORDS, NULL},
@@ -4091,9 +4154,9 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"delete_LoadParm", (PyCFunction) _wrap_delete_LoadParm, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm_swigregister", LoadParm_swigregister, METH_VARARGS, NULL},
 	 { (char *)"LoadParm_swiginit", LoadParm_swiginit, METH_VARARGS, NULL},
-	 { (char *)"loadparm_service_volume_label", (PyCFunction)_wrap_loadparm_service_volume_label, METH_O, NULL},
-	 { (char *)"loadparm_service_printername", (PyCFunction)_wrap_loadparm_service_printername, METH_O, NULL},
-	 { (char *)"loadparm_service_maxprintjobs", (PyCFunction)_wrap_loadparm_service_maxprintjobs, METH_O, NULL},
+	 { (char *)"loadparm_service_volume_label", (PyCFunction) _wrap_loadparm_service_volume_label, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"loadparm_service_printername", (PyCFunction) _wrap_loadparm_service_printername, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"loadparm_service_maxprintjobs", (PyCFunction) _wrap_loadparm_service_maxprintjobs, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"loadparm_service_swigregister", loadparm_service_swigregister, METH_VARARGS, NULL},
 	 { (char *)"new_ParamFile", (PyCFunction)_wrap_new_ParamFile, METH_NOARGS, NULL},
 	 { (char *)"ParamFile_get_section", (PyCFunction) _wrap_ParamFile_get_section, METH_VARARGS | METH_KEYWORDS, NULL},
diff --git a/source4/param/share.c b/source4/param/share.c
index 2c97625bcc..bc2999b03d 100644
--- a/source4/param/share.c
+++ b/source4/param/share.c
@@ -1,7 +1,7 @@
 /* 
    Unix SMB/CIFS implementation.
    
-   Modular services configuration system
+   Modular shares configuration system
    
    Copyright (C) Simo Sorce	2006
    
diff --git a/source4/param/share_classic.c b/source4/param/share_classic.c
index b517c9c4c2..f5a6fa67a4 100644
--- a/source4/param/share_classic.c
+++ b/source4/param/share_classic.c
@@ -1,7 +1,7 @@
 /* 
    Unix SMB/CIFS implementation.
    
-   Classic file based services configuration
+   Classic file based shares configuration
    
    Copyright (C) Simo Sorce	2006
    
@@ -73,25 +73,25 @@ static const char *sclassic_string_option(struct share_config *scfg,
 	}
 
 	if (strcmp(opt_name, SHARE_PATH) == 0) {
-		return lp_pathname(s);
+		return lp_pathname(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_COMMENT) == 0) {
-		return lp_comment(s);
+		return lp_comment(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_VOLUME) == 0) {
-		return volume_label(s);
+		return volume_label(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_TYPE) == 0) {
-		if (lp_print_ok(s)) {
+		if (lp_print_ok(s, lp_default_service(lp_ctx))) {
 			return "PRINTER";
 		}
-		if (strcmp("NTFS", lp_fstype(s)) == 0) {
+		if (strcmp("NTFS", lp_fstype(s, lp_default_service(lp_ctx))) == 0) {
 			return "DISK";
 		}
-		return lp_fstype(s);
+		return lp_fstype(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_PASSWORD) == 0) {
@@ -131,27 +131,27 @@ static int sclassic_int_option(struct share_config *scfg, const char *opt_name,
 	}
 
 	if (strcmp(opt_name, SHARE_CSC_POLICY) == 0) {
-		return lp_csc_policy(s);
+		return lp_csc_policy(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_MAX_CONNECTIONS) == 0) {
-		return lp_max_connections(s);
+		return lp_max_connections(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_CREATE_MASK) == 0) {
-		return lp_create_mask(s);
+		return lp_create_mask(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_DIR_MASK) == 0) {
-		return lp_dir_mask(s);
+		return lp_dir_mask(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_FORCE_DIR_MODE) == 0) {
-		return lp_force_dir_mode(s);
+		return lp_force_dir_mode(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_FORCE_CREATE_MODE) == 0) {
-		return lp_force_create_mode(s);
+		return lp_force_create_mode(s, lp_default_service(lp_ctx));
 	}
 
 
@@ -190,39 +190,39 @@ static bool sclassic_bool_option(struct share_config *scfg, const char *opt_name
 	}
 
 	if (strcmp(opt_name, SHARE_BROWSEABLE) == 0) {
-		return lp_browseable(s);
+		return lp_browseable(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_READONLY) == 0) {
-		return lp_readonly(s);
+		return lp_readonly(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_MAP_SYSTEM) == 0) {
-		return lp_map_system(s);
+		return lp_map_system(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_MAP_HIDDEN) == 0) {
-		return lp_map_hidden(s);
+		return lp_map_hidden(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_MAP_ARCHIVE) == 0) {
-		return lp_map_archive(s);
+		return lp_map_archive(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_STRICT_LOCKING) == 0) {
-		return lp_strict_locking(s);
+		return lp_strict_locking(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_STRICT_SYNC) == 0) {
-		return lp_strict_sync(s);
+		return lp_strict_sync(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_MSDFS_ROOT) == 0) {
-		return lp_msdfs_root(s);
+		return lp_msdfs_root(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_CI_FILESYSTEM) == 0) {
-		return lp_ci_filesystem(s);
+		return lp_ci_filesystem(s, lp_default_service(lp_ctx));
 	}
 
 	DEBUG(0,("request for unknown share bool option '%s'\n",
@@ -255,15 +255,15 @@ static const char **sclassic_string_list_option(TALLOC_CTX *mem_ctx, struct shar
 	}
 
 	if (strcmp(opt_name, SHARE_HOSTS_ALLOW) == 0) {
-		return lp_hostsallow(s);
+		return lp_hostsallow(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_HOSTS_DENY) == 0) {
-		return lp_hostsdeny(s);
+		return lp_hostsdeny(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_NTVFS_HANDLER) == 0) {
-		return lp_ntvfs_handler(s);
+		return lp_ntvfs_handler(s, lp_default_service(lp_ctx));
 	}
 
 	DEBUG(0,("request for unknown share list option '%s'\n",
diff --git a/source4/param/share_ldb.c b/source4/param/share_ldb.c
index bdea94a5cd..fb40f1e9bf 100644
--- a/source4/param/share_ldb.c
+++ b/source4/param/share_ldb.c
@@ -1,7 +1,7 @@
 /* 
    Unix SMB/CIFS implementation.
    
-   LDB based services configuration
+   LDB based shares configuration
    
    Copyright (C) Simo Sorce	2006
    
diff --git a/source4/param/tests/loadparm.c b/source4/param/tests/loadparm.c
index 92871e043d..49fcdf7249 100644
--- a/source4/param/tests/loadparm.c
+++ b/source4/param/tests/loadparm.c
@@ -129,7 +129,7 @@ static bool test_lp_parm_bytes(struct torture_context *tctx)
 static bool test_lp_do_service_parameter(struct torture_context *tctx)
 {
 	struct loadparm_context *lp_ctx = loadparm_init(tctx);
-	struct loadparm_service *service = lp_add_service(lp_ctx, &sDefault, "foo");
+	struct loadparm_service *service = lp_add_service(lp_ctx, lp_default_service(lp_ctx), "foo");
 	torture_assert(tctx, lp_do_service_parameter(lp_ctx, service, 
 						     "some:thing", "foo"), "lp_set_option failed");
 	torture_assert_str_equal(tctx, lp_parm_string(lp_ctx, service, "some", "thing"), "foo",
@@ -140,7 +140,7 @@ static bool test_lp_do_service_parameter(struct torture_context *tctx)
 static bool test_lp_service(struct torture_context *tctx)
 {
 	struct loadparm_context *lp_ctx = loadparm_init(tctx);
-	struct loadparm_service *service = lp_add_service(lp_ctx, &sDefault, "foo");
+	struct loadparm_service *service = lp_add_service(lp_ctx, lp_default_service(lp_ctx), "foo");
 	torture_assert(tctx, service == lp_service(lp_ctx, "foo"), "invalid service");
 	return true;
 }
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index b043424faa..6e53c7c8ae 100644
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -462,7 +462,7 @@ static NTSTATUS dcesrv_fault(struct dcesrv_call_state *call, uint32_t fault_code
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = ncacn_push_auth(&rep->blob, call, &pkt, NULL);
+	status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -501,7 +501,7 @@ static NTSTATUS dcesrv_bind_nak(struct dcesrv_call_state *call, uint32_t reason)
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = ncacn_push_auth(&rep->blob, call, &pkt, NULL);
+	status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -642,8 +642,7 @@ static NTSTATUS dcesrv_bind(struct dcesrv_call_state *call)
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = ncacn_push_auth(&rep->blob, call, &pkt, 
-				  call->conn->auth_state.auth_info);
+	status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, call->conn->auth_state.auth_info);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -787,8 +786,7 @@ static NTSTATUS dcesrv_alter(struct dcesrv_call_state *call)
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = ncacn_push_auth(&rep->blob, call, &pkt, 
-				  call->conn->auth_state.auth_info);
+	status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, call->conn->auth_state.auth_info);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index dce775591b..75b13bb824 100644
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -402,7 +402,7 @@ bool dcesrv_auth_response(struct dcesrv_call_state *call,
 
 	/* non-signed packets are simple */
 	if (!dce_conn->auth_state.auth_info || !dce_conn->auth_state.gensec_security) {
-		status = ncacn_push_auth(blob, call, pkt, NULL);
+		status = ncacn_push_auth(blob, call, lp_iconv_convenience(dce_conn->dce_ctx->lp_ctx), pkt, NULL);
 		return NT_STATUS_IS_OK(status);
 	}
 
diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 4d38dc069e..37e6351864 100644
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -27,6 +27,7 @@
 #include "auth/auth.h"
 #include "auth/auth_sam_reply.h"
 #include "dsdb/samdb/samdb.h"
+#include "dsdb/common/flags.h"
 #include "rpc_server/samr/proto.h"
 #include "util/util_ldb.h"
 #include "libcli/auth/libcli_auth.h"
@@ -76,7 +77,7 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3(struct dcesrv_call_state *dce_ca
 	struct creds_CredentialState *creds;
 	void *sam_ctx;
 	struct samr_Password *mach_pwd;
-	uint16_t acct_flags;
+	uint32_t user_account_control;
 	int num_records;
 	struct ldb_message **msgs;
 	NTSTATUS nt_status;
@@ -113,27 +114,28 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3(struct dcesrv_call_state *dce_ca
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
-	acct_flags = samdb_result_acct_flags(msgs[0], 
-					     "userAccountControl");
+	
+	user_account_control = ldb_msg_find_attr_as_uint(msgs[0], "userAccountControl", 0);
 
-	if (acct_flags & ACB_DISABLED) {
+	if (user_account_control & UF_ACCOUNTDISABLE) {
 		DEBUG(1, ("Account [%s] is disabled\n", r->in.account_name));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
 	if (r->in.secure_channel_type == SEC_CHAN_WKSTA) {
-		if (!(acct_flags & ACB_WSTRUST)) {
-			DEBUG(1, ("Client asked for a workstation secure channel, but is not a workstation (member server) acb flags: 0x%x\n", acct_flags));
+		if (!(user_account_control & UF_WORKSTATION_TRUST_ACCOUNT)) {
+			DEBUG(1, ("Client asked for a workstation secure channel, but is not a workstation (member server) acb flags: 0x%x\n", user_account_control));
 			return NT_STATUS_ACCESS_DENIED;
 		}
 	} else if (r->in.secure_channel_type == SEC_CHAN_DOMAIN) {
-		if (!(acct_flags & ACB_DOMTRUST)) {
-			DEBUG(1, ("Client asked for a trusted domain secure channel, but is not a trusted domain: acb flags: 0x%x\n", acct_flags));
+		if (!(user_account_control & UF_INTERDOMAIN_TRUST_ACCOUNT)) {
+			DEBUG(1, ("Client asked for a trusted domain secure channel, but is not a trusted domain: acb flags: 0x%x\n", user_account_control));
+			
 			return NT_STATUS_ACCESS_DENIED;
 		}
 	} else if (r->in.secure_channel_type == SEC_CHAN_BDC) {
-		if (!(acct_flags & ACB_SVRTRUST)) {
-			DEBUG(1, ("Client asked for a server secure channel, but is not a server (domain controller): acb flags: 0x%x\n", acct_flags));
+		if (!(user_account_control & UF_SERVER_TRUST_ACCOUNT)) {
+			DEBUG(1, ("Client asked for a server secure channel, but is not a server (domain controller): acb flags: 0x%x\n", user_account_control));
 			return NT_STATUS_ACCESS_DENIED;
 		}
 	} else {
diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c
index 760d774f2e..8193e0a882 100644
--- a/source4/rpc_server/samr/dcesrv_samr.c
+++ b/source4/rpc_server/samr/dcesrv_samr.c
@@ -56,7 +56,7 @@
 #define QUERY_LHOURS(msg, field, attr) \
 	r->out.info->field = samdb_result_logon_hours(mem_ctx, msg, attr);
 #define QUERY_AFLAGS(msg, field, attr) \
-	r->out.info->field = samdb_result_acct_flags(msg, attr);
+	r->out.info->field = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, a_state->domain_state->domain_dn);
 
 
 /* these are used to make the Set[User|Group]Info code easier to follow */
@@ -102,10 +102,25 @@
         set_el = ldb_msg_find_element(msg, attr);			\
  	set_el->flags = LDB_FLAG_MOD_REPLACE;				\
 } while (0)								
-									
+
+#define CHECK_FOR_MULTIPLES(value, flag, poss_flags)	\
+	do { \
+		if ((value & flag) && ((value & flag) != (value & (poss_flags)))) { \
+			return NT_STATUS_INVALID_PARAMETER;		\
+		}							\
+	} while (0)							\
+	
+/* Set account flags, discarding flags that cannot be set with SAMR */								
 #define SET_AFLAGS(msg, field, attr) do {				\
 	struct ldb_message_element *set_el;				\
-	if (samdb_msg_add_acct_flags(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != 0) { \
+	if ((r->in.info->field & (ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST)) == 0) { \
+		return NT_STATUS_INVALID_PARAMETER; \
+	}								\
+	CHECK_FOR_MULTIPLES(r->in.info->field, ACB_NORMAL, ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST); \
+	CHECK_FOR_MULTIPLES(r->in.info->field, ACB_DOMTRUST, ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST); \
+	CHECK_FOR_MULTIPLES(r->in.info->field, ACB_WSTRUST, ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST); \
+	CHECK_FOR_MULTIPLES(r->in.info->field, ACB_SVRTRUST, ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST); \
+	if (samdb_msg_add_acct_flags(sam_ctx, mem_ctx, msg, attr, (r->in.info->field & ~(ACB_AUTOLOCK|ACB_PW_EXPIRED))) != 0) { \
 		return NT_STATUS_NO_MEMORY;				\
 	}								\
         set_el = ldb_msg_find_element(msg, attr);			\
@@ -1484,8 +1499,8 @@ static NTSTATUS dcesrv_samr_EnumDomainUsers(struct dcesrv_call_state *dce_call,
 	for (i=0;i<count;i++) {
 		/* Check if a mask has been requested */
 		if (r->in.acct_flags
-		    && ((samdb_result_acct_flags(res[i], 
-						 "userAccountControl") & r->in.acct_flags) == 0)) {
+		    && ((samdb_result_acct_flags(d_state->sam_ctx, mem_ctx, res[i], 
+						 d_state->domain_dn) & r->in.acct_flags) == 0)) {
 			continue;
 		}
 		entries[num_filtered_entries].idx = samdb_result_rid_from_sid(mem_ctx, res[i], "objectSid", 0);
@@ -3066,7 +3081,7 @@ static NTSTATUS dcesrv_samr_QueryUserInfo(struct dcesrv_call_state *dce_call, TA
 	}
 	case 16:
 	{
-		static const char * const attrs2[] = {"userAccountControl", NULL};
+		static const char * const attrs2[] = {"userAccountControl", "pwdLastSet", NULL};
 		attrs = attrs2;
 		break;
 	}
@@ -3613,7 +3628,7 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
 	struct ldb_message **res;
 	int ldb_cnt, count, i;
 	const char * const attrs[] = { "objectSid", "sAMAccountName", "displayName",
-					"description", "userAccountControl", NULL };
+				       "description", "userAccountControl", "pwdLastSet", NULL };
 	struct samr_DispEntryFull *entriesFull = NULL;
 	struct samr_DispEntryFullGroup *entriesFullGroup = NULL;
 	struct samr_DispEntryAscii *entriesAscii = NULL;
@@ -3702,8 +3717,9 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
 			entriesGeneral[count].rid = 
 				objectsid->sub_auths[objectsid->num_auths-1];
 			entriesGeneral[count].acct_flags =
-				samdb_result_acct_flags(res[i], 
-							"userAccountControl");
+				samdb_result_acct_flags(d_state->sam_ctx, mem_ctx,
+							res[i], 
+							d_state->domain_dn);
 			entriesGeneral[count].account_name.string =
 				samdb_result_string(res[i],
 						    "sAMAccountName", "");
@@ -3719,8 +3735,9 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
 
 			/* No idea why we need to or in ACB_NORMAL here, but this is what Win2k3 seems to do... */
 			entriesFull[count].acct_flags =
-				samdb_result_acct_flags(res[i], 
-							"userAccountControl") | ACB_NORMAL;
+				samdb_result_acct_flags(d_state->sam_ctx, mem_ctx,
+							res[i], 
+							d_state->domain_dn) | ACB_NORMAL;
 			entriesFull[count].account_name.string =
 				samdb_result_string(res[i], "sAMAccountName",
 						    "");
@@ -3731,9 +3748,6 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
 			entriesFullGroup[count].idx = count + 1;
 			entriesFullGroup[count].rid =
 				objectsid->sub_auths[objectsid->num_auths-1];
-			entriesFullGroup[count].acct_flags =
-				samdb_result_acct_flags(res[i], 
-							"userAccountControl");
 			/* We get a "7" here for groups */
 			entriesFullGroup[count].acct_flags
 				= SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED;
diff --git a/source4/samba4-knownfail b/source4/samba4-knownfail
index 4d850caae5..aaa11774ae 100644
--- a/source4/samba4-knownfail
+++ b/source4/samba4-knownfail
@@ -3,6 +3,8 @@ local.iconv.*.next_codepoint()
 base.delaywrite.finfo update on close
 base.delete.*.deltest20a
 base.delete.*.deltest20b
+raw.oplock.*BATCH19
+raw.oplock.*BATCH20
 rpc.winreg
 local.registry.*.security # Not implemented yet
 rpc.wkssvc
diff --git a/source4/script/mkproto.pl b/source4/script/mkproto.pl
index d1f8f886f6..87a68e33fa 100755
--- a/source4/script/mkproto.pl
+++ b/source4/script/mkproto.pl
@@ -144,7 +144,7 @@ sub handle_loadparm($$)
 
 		my %smap = (
 			    "GLOBAL" => "struct loadparm_context *",
-			    "LOCAL" => "struct loadparm_service *"
+			    "LOCAL" => "struct loadparm_service *, struct loadparm_service *"
 			    );
 
 		$file->("$tmap{$type}$name($smap{$scope});\n");
diff --git a/source4/scripting/ejs/ejsnet/net_ctx.c b/source4/scripting/ejs/ejsnet/net_ctx.c
index 396718367a..99be1c4ef8 100644
--- a/source4/scripting/ejs/ejsnet/net_ctx.c
+++ b/source4/scripting/ejs/ejsnet/net_ctx.c
@@ -52,7 +52,7 @@ static int ejs_net_context(MprVarHandle eid, int argc, struct MprVar **argv)
 	}
 	ev = event_context_find(event_mem_ctx);
 
-	ctx = libnet_context_init(ev, global_loadparm);
+	ctx = libnet_context_init(ev, mprLpCtx());
 	/* IF we generated a new event context, it will be under here,
 	 * and we need it to last as long as the libnet context, so
 	 * make it a child */
@@ -68,7 +68,7 @@ static int ejs_net_context(MprVarHandle eid, int argc, struct MprVar **argv)
 			talloc_free(ctx);
 			return -1;
 		}
-		cli_credentials_set_conf(creds, global_loadparm);
+		cli_credentials_set_conf(creds, mprLpCtx());
 		cli_credentials_set_anonymous(creds);
 
 		mprCreds = mprCredentials(creds);
diff --git a/source4/scripting/ejs/smbcalls.c b/source4/scripting/ejs/smbcalls.c
index ac1c20008b..98d6be07bf 100644
--- a/source4/scripting/ejs/smbcalls.c
+++ b/source4/scripting/ejs/smbcalls.c
@@ -110,7 +110,7 @@ static int ejs_typeof_native(MprVarHandle eid, int argc, struct MprVar **argv)
 static int ejs_libinclude(int eid, int argc, char **argv)
 {
 	int i, j;
-	const char **js_include = lp_js_include(global_loadparm);
+	const char **js_include = lp_js_include(mprLpCtx());
 
 	if (js_include == NULL || js_include[0] == NULL) {
 		ejsSetErrorMsg(eid, "js include path not set");
@@ -209,7 +209,7 @@ void smb_setup_ejs_functions(void (*exception_handler)(const char *))
 	smb_setup_ejs_param();
         smb_setup_ejs_literal();
 	
-	shared_init = load_samba_modules(NULL, global_loadparm, "smbcalls");
+	shared_init = load_samba_modules(NULL, mprLpCtx(), "smbcalls");
 	
 	run_init_functions(static_init);
 	run_init_functions(shared_init);
diff --git a/source4/scripting/ejs/smbcalls_auth.c b/source4/scripting/ejs/smbcalls_auth.c
index 89370890c8..908a009159 100644
--- a/source4/scripting/ejs/smbcalls_auth.c
+++ b/source4/scripting/ejs/smbcalls_auth.c
@@ -56,14 +56,14 @@ static int ejs_doauth(MprVarHandle eid,
 	} else {
 		/* Hope we can find the event context somewhere up there... */
 		ev = event_context_find(tmp_ctx);
-		msg = messaging_client_init(tmp_ctx, lp_messaging_path(tmp_ctx, global_loadparm), 
-					    lp_iconv_convenience(global_loadparm), ev);
+		msg = messaging_client_init(tmp_ctx, lp_messaging_path(tmp_ctx, mprLpCtx()), 
+					    lp_iconv_convenience(mprLpCtx()), ev);
 	}
 
 	if (auth_types) {
-		nt_status = auth_context_create_methods(tmp_ctx, auth_types, ev, msg, global_loadparm, &auth_context);
+		nt_status = auth_context_create_methods(tmp_ctx, auth_types, ev, msg, mprLpCtx(), &auth_context);
 	} else {
-		nt_status = auth_context_create(tmp_ctx, ev, msg, global_loadparm, &auth_context);
+		nt_status = auth_context_create(tmp_ctx, ev, msg, mprLpCtx(), &auth_context);
 	}
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		mprSetPropertyValue(auth, "result", mprCreateBoolVar(false));
@@ -109,7 +109,7 @@ static int ejs_doauth(MprVarHandle eid,
 		goto done;
 	}
 
-	nt_status = auth_generate_session_info(tmp_ctx, global_loadparm, server_info, &session_info);
+	nt_status = auth_generate_session_info(tmp_ctx, mprLpCtx(), server_info, &session_info);
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		mprSetPropertyValue(auth, "report", mprString("Session Info generation failed"));
 		mprSetPropertyValue(auth, "result", mprCreateBoolVar(false));
@@ -222,7 +222,7 @@ static int ejs_userAuth(MprVarHandle eid, int argc, struct MprVar **argv)
 static int ejs_system_session(MprVarHandle eid, int argc, struct MprVar **argv)
 {
 	struct MprVar *obj = mprInitObject(eid, "session_info", argc, argv);
-	struct auth_session_info *session_info = system_session(mprMemCtx(), global_loadparm);
+	struct auth_session_info *session_info = system_session(mprMemCtx(), mprLpCtx());
 
 	if (session_info == NULL) {
 		return -1;
diff --git a/source4/scripting/ejs/smbcalls_cli.c b/source4/scripting/ejs/smbcalls_cli.c
index 8295a0879f..dbb36312da 100644
--- a/source4/scripting/ejs/smbcalls_cli.c
+++ b/source4/scripting/ejs/smbcalls_cli.c
@@ -432,23 +432,23 @@ static int ejs_tree_connect(MprVarHandle eid, int argc, char **argv)
 	/* Set up credentials */
 
 	creds = cli_credentials_init(NULL);
-	cli_credentials_set_conf(creds, global_loadparm);
+	cli_credentials_set_conf(creds, mprLpCtx());
 	cli_credentials_parse_string(creds, argv[1], CRED_SPECIFIED);
 
 	/* Do connect */
 
 	io.in.dest_host              = hostname;
-	io.in.dest_ports             = lp_smb_ports(global_loadparm);
+	io.in.dest_ports             = lp_smb_ports(mprLpCtx());
 	io.in.called_name            = strupper_talloc(mem_ctx, hostname);
 	io.in.service                = sharename;
 	io.in.service_type           = "?????";
 	io.in.credentials            = creds;
 	io.in.fallback_to_anonymous  = false;
-	io.in.workgroup              = lp_workgroup(global_loadparm);
-	lp_smbcli_options(global_loadparm, &io.in.options);
+	io.in.workgroup              = lp_workgroup(mprLpCtx());
+	lp_smbcli_options(mprLpCtx(), &io.in.options);
 
 	result = smb_composite_connect(&io, mem_ctx, 
-				       lp_resolve_context(global_loadparm), 
+				       lp_resolve_context(mprLpCtx()), 
 				       NULL);
 	tree = io.out.tree;
 
diff --git a/source4/scripting/ejs/smbcalls_config.c b/source4/scripting/ejs/smbcalls_config.c
index 07e0f479da..eb673b3a23 100644
--- a/source4/scripting/ejs/smbcalls_config.c
+++ b/source4/scripting/ejs/smbcalls_config.c
@@ -36,8 +36,8 @@ static int ejs_lpServices(MprVarHandle eid, int argc, char **argv)
 	const char **list = NULL;
 	if (argc != 0) return -1;
 	
-	for (i=0;i<lp_numservices(global_loadparm);i++) {
-		list = str_list_add(list, lp_servicename(lp_servicebynum(global_loadparm, i)));
+	for (i=0;i<lp_numservices(mprLpCtx());i++) {
+		list = str_list_add(list, lp_servicename(lp_servicebynum(mprLpCtx(), i)));
 	}
 	talloc_steal(mprMemCtx(), list);
 	mpr_Return(eid, mprList("services", list));
@@ -68,7 +68,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 	if (argc == 2) {
 		struct loadparm_service *service;
 		/* its a share parameter */
-		service = lp_service(global_loadparm, argv[0]);
+		service = lp_service(mprLpCtx(), argv[0]);
 		if (service == NULL) {
 			mpr_Return(eid, mprCreateUndefinedVar());
 			return 0;
@@ -84,7 +84,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 				mpr_Return(eid, mprCreateUndefinedVar());
 				return 0;
 			}
-			value = lp_get_parametric(global_loadparm, service, type, option);
+			value = lp_get_parametric(mprLpCtx(), service, type, option);
 			if (value == NULL) {
 				mpr_Return(eid, mprCreateUndefinedVar());
 				return 0;
@@ -98,7 +98,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 			mpr_Return(eid, mprCreateUndefinedVar());
 			return 0;
 		}
-		parm_ptr = lp_parm_ptr(global_loadparm, service, parm);
+		parm_ptr = lp_parm_ptr(mprLpCtx(), service, parm);
 	} else if (strchr(argv[0], ':')) {
 		/* its a global parametric option */
 		const char *type = talloc_strndup(mprMemCtx(), 
@@ -109,7 +109,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 			mpr_Return(eid, mprCreateUndefinedVar());
 			return 0;
 		}
-		value = lp_get_parametric(global_loadparm, NULL, type, option);
+		value = lp_get_parametric(mprLpCtx(), NULL, type, option);
 		if (value == NULL) {
 			mpr_Return(eid, mprCreateUndefinedVar());
 			return 0;
@@ -123,7 +123,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 			mpr_Return(eid, mprCreateUndefinedVar());
 			return 0;
 		}
-		parm_ptr = lp_parm_ptr(global_loadparm, NULL, parm);
+		parm_ptr = lp_parm_ptr(mprLpCtx(), NULL, parm);
 	}
 
 	if (parm == NULL || parm_ptr == NULL) {
@@ -166,7 +166,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 */
 static int ejs_lpFilename(MprVarHandle eid, int argc, char **argv)
 {
-	mpr_ReturnString(eid, lp_configfile(global_loadparm));
+	mpr_ReturnString(eid, lp_configfile(mprLpCtx()));
 	return 0;
 }
 
@@ -184,7 +184,7 @@ static int ejs_lpSet(MprVarHandle eid, int argc, char **argv)
 		return -1;
 	}
 
-	mpr_Return(eid, mprCreateBoolVar(lp_set_cmdline(global_loadparm, argv[0], argv[1])));
+	mpr_Return(eid, mprCreateBoolVar(lp_set_cmdline(mprLpCtx(), argv[0], argv[1])));
 	return 0;
 }
 
@@ -196,9 +196,9 @@ static int ejs_lpSet(MprVarHandle eid, int argc, char **argv)
 static int ejs_lpReload(MprVarHandle eid, int argc, char **argv)
 {
 	bool ret;
-	const char *filename = lp_configfile(global_loadparm);
+	const char *filename = lp_configfile(mprLpCtx());
 
-	ret = lp_load(global_loadparm, filename);
+	ret = lp_load(mprLpCtx(), filename);
 	mpr_Return(eid, mprCreateBoolVar(ret));
 	return 0;
 }
diff --git a/source4/scripting/ejs/smbcalls_creds.c b/source4/scripting/ejs/smbcalls_creds.c
index 6dfff8f925..fd73f0751f 100644
--- a/source4/scripting/ejs/smbcalls_creds.c
+++ b/source4/scripting/ejs/smbcalls_creds.c
@@ -192,7 +192,7 @@ static int ejs_creds_set_machine_account(MprVarHandle eid, int argc, struct MprV
 		return -1;
 	}
 	
-	if (NT_STATUS_IS_OK(cli_credentials_set_machine_account(creds, global_loadparm))) {
+	if (NT_STATUS_IS_OK(cli_credentials_set_machine_account(creds, mprLpCtx()))) {
 		mpr_Return(eid, mprCreateBoolVar(true));
 	} else {
 		mpr_Return(eid, mprCreateBoolVar(false));
@@ -248,7 +248,7 @@ static int ejs_credentials_init(MprVarHandle eid, int argc, struct MprVar **argv
 		return -1;
 	}
 
-	cli_credentials_set_conf(creds, global_loadparm);
+	cli_credentials_set_conf(creds, mprLpCtx());
 
 	return ejs_credentials_obj(obj, creds);
 }
diff --git a/source4/scripting/ejs/smbcalls_data.c b/source4/scripting/ejs/smbcalls_data.c
index 3ea41d46fb..19e1e173d6 100644
--- a/source4/scripting/ejs/smbcalls_data.c
+++ b/source4/scripting/ejs/smbcalls_data.c
@@ -177,7 +177,7 @@ static int ejs_regToVar(MprVarHandle eid, int argc, struct MprVar **argv)
 	case REG_EXPAND_SZ: {
 		char *s;
 		ssize_t len;
-		len = convert_string_talloc(mprMemCtx(), lp_iconv_convenience(global_loadparm), CH_UTF16, CH_UNIX, 
+		len = convert_string_talloc(mprMemCtx(), lp_iconv_convenience(mprLpCtx()), CH_UTF16, CH_UNIX, 
 					    blob->data, blob->length, (void **)&s);
 		if (len == -1) {
 			ejsSetErrorMsg(eid, "regToVar invalid REG_SZ string");
@@ -225,7 +225,7 @@ static int ejs_regToVar(MprVarHandle eid, int argc, struct MprVar **argv)
 			if (slen == 2 && b.length == 2 && SVAL(b.data, 0) == 0) {
 				break;
 			}
-			len = convert_string_talloc(mprMemCtx(), lp_iconv_convenience(global_loadparm), CH_UTF16, CH_UNIX, 
+			len = convert_string_talloc(mprMemCtx(), lp_iconv_convenience(mprLpCtx()), CH_UTF16, CH_UNIX, 
 						    b.data, slen, (void **)&s);
 			if (len == -1) {
 				ejsSetErrorMsg(eid, "regToVar invalid REG_MULTI_SZ string");
diff --git a/source4/scripting/ejs/smbcalls_ldb.c b/source4/scripting/ejs/smbcalls_ldb.c
index 7599cbf443..f47920b9bb 100644
--- a/source4/scripting/ejs/smbcalls_ldb.c
+++ b/source4/scripting/ejs/smbcalls_ldb.c
@@ -453,7 +453,7 @@ static int ejs_ldbConnect(MprVarHandle eid, int argc, char **argv)
 
 	dbfile = argv[0];
 
-	ldb = ldb_wrap_connect(mprMemCtx(), global_loadparm, dbfile, 
+	ldb = ldb_wrap_connect(mprMemCtx(), mprLpCtx(), dbfile, 
 			       session_info, creds,
 			       0, (const char **)(argv+1));
 	if (ldb == NULL) {
diff --git a/source4/scripting/ejs/smbcalls_nbt.c b/source4/scripting/ejs/smbcalls_nbt.c
index c3679b1ec7..67a85414ca 100644
--- a/source4/scripting/ejs/smbcalls_nbt.c
+++ b/source4/scripting/ejs/smbcalls_nbt.c
@@ -70,7 +70,7 @@ static int ejs_resolve_name(MprVarHandle eid, int argc, struct MprVar **argv)
 
 	result = 0;
 
-	nt_status = resolve_name(lp_resolve_context(global_loadparm), &name, tmp_ctx, &reply_addr, event_context_find(tmp_ctx));
+	nt_status = resolve_name(lp_resolve_context(mprLpCtx()), &name, tmp_ctx, &reply_addr, event_context_find(tmp_ctx));
 
 	if (NT_STATUS_IS_OK(nt_status)) {
 		mprSetPropertyValue(argv[0], "value", mprString(reply_addr));
diff --git a/source4/scripting/ejs/smbcalls_reg.c b/source4/scripting/ejs/smbcalls_reg.c
index 30e5357cfb..e20d91ad2e 100644
--- a/source4/scripting/ejs/smbcalls_reg.c
+++ b/source4/scripting/ejs/smbcalls_reg.c
@@ -70,7 +70,7 @@ static int ejs_reg_open(MprVarHandle eid, int argc, struct MprVar **argv)
 	struct registry_context *rctx;
 	WERROR error;
 
-	error = reg_open_samba(mprMemCtx(), &rctx, global_loadparm, NULL, NULL);
+	error = reg_open_samba(mprMemCtx(), &rctx, mprLpCtx(), NULL, NULL);
 	SMB_ASSERT(W_ERROR_IS_OK(error));
 
 	mprSetPtrChild(reg, "registry", rctx);
diff --git a/source4/scripting/ejs/smbcalls_rpc.c b/source4/scripting/ejs/smbcalls_rpc.c
index 44cfa16d7e..d1e49b4348 100644
--- a/source4/scripting/ejs/smbcalls_rpc.c
+++ b/source4/scripting/ejs/smbcalls_rpc.c
@@ -79,9 +79,9 @@ static int ejs_irpc_connect(MprVarHandle eid, int argc, char **argv)
 	   allocate temporary server ids automatically */
 	for (i=0;i<10000;i++) {
 		p->msg_ctx = messaging_init(p, 
-					    lp_messaging_path(p, global_loadparm),
+					    lp_messaging_path(p, mprLpCtx()),
 					    cluster_id(EJS_ID_BASE, i), 
-				            lp_iconv_convenience(global_loadparm),
+				            lp_iconv_convenience(mprLpCtx()),
 					    ev);
 		if (p->msg_ctx) break;
 	}
@@ -161,7 +161,7 @@ static int ejs_rpc_connect(MprVarHandle eid, int argc, char **argv)
 	ev = event_context_find(mprMemCtx());
 
 	status = dcerpc_pipe_connect(this, &p, binding, iface, creds, ev,
-				     global_loadparm);
+				     mprLpCtx());
 	if (!NT_STATUS_IS_OK(status)) goto done;
 
 	/* callers don't allocate ref vars in the ejs interface */
diff --git a/source4/scripting/ejs/smbcalls_sys.c b/source4/scripting/ejs/smbcalls_sys.c
index 72ddf90231..00599a55bc 100644
--- a/source4/scripting/ejs/smbcalls_sys.c
+++ b/source4/scripting/ejs/smbcalls_sys.c
@@ -36,7 +36,7 @@ static int ejs_sys_interfaces(MprVarHandle eid, int argc, struct MprVar **argv)
 	struct MprVar ret = mprArray("interfaces");
 	struct interface *ifaces;
 
-	load_interfaces(NULL, lp_interfaces(global_loadparm), &ifaces);
+	load_interfaces(NULL, lp_interfaces(mprLpCtx()), &ifaces);
 
 	count = iface_count(ifaces);
 	for (i=0;i<count;i++) {
diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py
index e3c47ff4a2..55935b0037 100644
--- a/source4/scripting/python/samba/provision.py
+++ b/source4/scripting/python/samba/provision.py
@@ -313,9 +313,9 @@ def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
                     "server_sort",
                     "extended_dn",
                     "asq",
-                    "samldb",
                     "rdn_name",
                     "objectclass",
+                    "samldb",
                     "kludge_acl",
                     "operational"]
     tdb_modules_list = [
diff --git a/source4/selftest/samba4_tests.sh b/source4/selftest/samba4_tests.sh
index 32386e5b9e..bea4173555 100755
--- a/source4/selftest/samba4_tests.sh
+++ b/source4/selftest/samba4_tests.sh
@@ -81,6 +81,7 @@ if grep ENABLE_GNUTLS.1 include/config.h > /dev/null; then
 	plantest "ldb.ldaps with options $options" dc $samba4srcdir/../testprogs/blackbox/test_ldb.sh ldaps \$SERVER_IP $options
     done
 fi
+plantest "ldb.ldapi with options $options" dc $samba4srcdir/../testprogs/blackbox/test_ldb.sh ldapi \$PREFIX_ABS/dc/private/ldapi $options
 for t in LDAP-CLDAP LDAP-BASIC LDAP-SCHEMA LDAP-UPTODATEVECTOR
 do
 	plansmbtorturetest "$t" dc "-U\$USERNAME%\$PASSWORD" //\$SERVER_IP/_none_
diff --git a/source4/setup/provision.reg b/source4/setup/provision.reg
index 892b5ec50c..b80db09c09 100644
--- a/source4/setup/provision.reg
+++ b/source4/setup/provision.reg
@@ -2,37 +2,46 @@ REGEDIT4
 
 [HKEY_LOCAL_MACHINE]
 
-[HKEY_LOCAL_MACHINE\System]
+[HKEY_LOCAL_MACHINE\SOFTWARE]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet]
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control]
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ProductOptions]
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
+CurrentVersion=5.2
+
+[HKEY_LOCAL_MACHINE\SYSTEM]
+
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet]
+
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
+
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions]
 ProductType=LanmanNT
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]
 
-[HKEY_LOCAL_MACHINE\System]
+[HKEY_LOCAL_MACHINE\SYSTEM]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]
 RefusePasswordChange=REG_DWORD:0
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\REPLICATOR]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\REPLICATOR]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\REPLICATOR\Parameters]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\REPLICATOR\Parameters]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Alerter]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Alerter\Parameters]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter\Parameters]
 
 [HKEY_USERS]
 
diff --git a/source4/setup/provision_self_join.ldif b/source4/setup/provision_self_join.ldif
index 58669660f4..503656a9bf 100644
--- a/source4/setup/provision_self_join.ldif
+++ b/source4/setup/provision_self_join.ldif
@@ -8,7 +8,6 @@ localPolicyFlags: 0
 primaryGroupID: 516
 accountExpires: 9223372036854775807
 sAMAccountName: ${NETBIOSNAME}$
-sAMAccountType: 805306369
 operatingSystem: Samba
 operatingSystemVersion: 4.0
 dNSHostName: ${DNSNAME}
@@ -33,7 +32,6 @@ description: DNS Service Account
 userAccountControl: 514
 accountExpires: 9223372036854775807
 sAMAccountName: dns
-sAMAccountType: 805306368
 servicePrincipalName: DNS/${DNSDOMAIN}
 isCriticalSystemObject: TRUE
 sambaPassword:: ${DNSPASS_B64}
diff --git a/source4/setup/provision_templates.ldif b/source4/setup/provision_templates.ldif
index fafedc6966..cc0ab212cd 100644
--- a/source4/setup/provision_templates.ldif
+++ b/source4/setup/provision_templates.ldif
@@ -18,7 +18,7 @@ objectClass: container
 description: Container for SAM account templates
 
 dn: CN=TemplateUser,CN=Templates
-userAccountControl: 514
+userAccountControl: 546
 badPwdCount: 0
 codePage: 0
 countryCode: 0
@@ -29,21 +29,6 @@ pwdLastSet: 0
 primaryGroupID: 513
 accountExpires: -1
 logonCount: 0
-sAMAccountType: 805306368
-
-dn: CN=TemplateComputer,CN=Templates
-userAccountControl: 4098
-badPwdCount: 0
-codePage: 0
-countryCode: 0
-badPasswordTime: 0
-lastLogoff: 0
-lastLogon: 0
-pwdLastSet: 0
-primaryGroupID: 513
-accountExpires: -1
-logonCount: 0
-sAMAccountType: 805306369
 
 dn: CN=TemplateTrustingDomain,CN=Templates
 userAccountControl: 2080
@@ -56,18 +41,9 @@ lastLogon: 0
 primaryGroupID: 513
 accountExpires: -1
 logonCount: 0
-sAMAccountType: 805306370
 
 dn: CN=TemplateGroup,CN=Templates
 groupType: -2147483646
-sAMAccountType: 268435456
-
-# Currently this isn't used, we don't have a way to detect it different from an incoming alias
-#
-# dn: CN=TemplateAlias,CN=Templates
-# cn: TemplateAlias
-# groupType: -2147483644
-# sAMAccountType: 268435456
 
 dn: CN=TemplateForeignSecurityPrincipal,CN=Templates
 
diff --git a/source4/setup/provision_users.ldif b/source4/setup/provision_users.ldif
index 05fde15974..4b053d9166 100644
--- a/source4/setup/provision_users.ldif
+++ b/source4/setup/provision_users.ldif
@@ -44,7 +44,6 @@ objectSid: ${DOMAINSID}-502
 adminCount: 1
 accountExpires: 9223372036854775807
 sAMAccountName: krbtgt
-sAMAccountType: 805306368
 servicePrincipalName: kadmin/changepw
 isCriticalSystemObject: TRUE
 sambaPassword:: ${KRBTGTPASS_B64}
@@ -85,7 +84,6 @@ objectClass: group
 cn: Cert Publishers
 description: Members of this group are permitted to publish certificates to the Active Directory
 groupType: 2147483652
-sAMAccountType: 536870912
 objectSid: ${DOMAINSID}-517
 sAMAccountName: Cert Publishers
 isCriticalSystemObject: TRUE
@@ -136,7 +134,6 @@ cn: RAS and IAS Servers
 description: Servers in this group can access remote access properties of users
 objectSid: ${DOMAINSID}-553
 sAMAccountName: RAS and IAS Servers
-sAMAccountType: 536870912
 groupType: 2147483652
 isCriticalSystemObject: TRUE
 
@@ -151,7 +148,6 @@ member: CN=Administrator,CN=Users,${DOMAINDN}
 objectSid: S-1-5-32-544
 adminCount: 1
 sAMAccountName: Administrators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -188,7 +184,6 @@ description: Users are prevented from making accidental or intentional system-wi
 member: CN=Domain Users,CN=Users,${DOMAINDN}
 objectSid: S-1-5-32-545
 sAMAccountName: Users
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -202,7 +197,6 @@ member: CN=Domain Guests,CN=Users,${DOMAINDN}
 member: CN=Guest,CN=Users,${DOMAINDN}
 objectSid: S-1-5-32-546
 sAMAccountName: Guests
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -215,7 +209,6 @@ description: Members can administer domain printers
 objectSid: S-1-5-32-550
 adminCount: 1
 sAMAccountName: Print Operators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -231,7 +224,6 @@ description: Backup Operators can override security restrictions for the sole pu
 objectSid: S-1-5-32-551
 adminCount: 1
 sAMAccountName: Backup Operators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -248,7 +240,6 @@ description: Supports file replication in a domain
 objectSid: S-1-5-32-552
 adminCount: 1
 sAMAccountName: Replicator
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -260,7 +251,6 @@ cn: Remote Desktop Users
 description: Members in this group are granted the right to logon remotely
 objectSid: S-1-5-32-555
 sAMAccountName: Remote Desktop Users
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -272,7 +262,6 @@ cn: Network Configuration Operators
 description: Members in this group can have some administrative privileges to manage configuration of networking features
 objectSid: S-1-5-32-556
 sAMAccountName: Network Configuration Operators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -284,7 +273,6 @@ cn: Performance Monitor Users
 description: Members of this group have remote access to monitor this computer
 objectSid: S-1-5-32-558
 sAMAccountName: Performance Monitor Users
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -296,7 +284,6 @@ cn: Performance Log Users
 description: Members of this group have remote access to schedule logging of performance counters on this computer
 objectSid: S-1-5-32-559
 sAMAccountName: Performance Log Users
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -309,7 +296,6 @@ description: Members can administer domain servers
 objectSid: S-1-5-32-549
 adminCount: 1
 sAMAccountName: Server Operators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -328,7 +314,6 @@ description: Members can administer domain user and group accounts
 objectSid: S-1-5-32-548
 adminCount: 1
 sAMAccountName: Account Operators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -341,7 +326,6 @@ cn: Pre-Windows 2000 Compatible Access
 description: A backward compatibility group which allows read access on all users and groups in the domain
 objectSid: S-1-5-32-554
 sAMAccountName: Pre-Windows 2000 Compatible Access
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -355,7 +339,6 @@ cn: Incoming Forest Trust Builders
 description: Members of this group can create incoming, one-way trusts to this forest
 objectSid: S-1-5-32-557
 sAMAccountName: Incoming Forest Trust Builders
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -367,7 +350,6 @@ cn: Windows Authorization Access Group
 description: Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects
 objectSid: S-1-5-32-560
 sAMAccountName: Windows Authorization Access Group
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -379,7 +361,6 @@ cn: Terminal Server License Servers
 description: Terminal Server License Servers
 objectSid: S-1-5-32-561
 sAMAccountName: Terminal Server License Servers
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -391,7 +372,6 @@ cn: Distributed COM Users
 description: Members are allowed to launch, activate and use Distributed COM objects on this machine.
 objectSid: S-1-5-32-562
 sAMAccountName: Distributed COM Users
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
diff --git a/source4/smb_server/smb/request.c b/source4/smb_server/smb/request.c
index d7f3793f23..87073517dd 100644
--- a/source4/smb_server/smb/request.c
+++ b/source4/smb_server/smb/request.c
@@ -423,7 +423,7 @@ size_t req_push_str(struct smbsrv_request *req, uint8_t *dest, const char *str,
 		dest = req->out.buffer + PTR_DIFF(dest, buf0);
 	}
 
-	len = push_string(lp_iconv_convenience(global_loadparm), dest, str, len, flags);
+	len = push_string(lp_iconv_convenience(req->smb_conn->lp_ctx), dest, str, len, flags);
 
 	grow_size = len + PTR_DIFF(dest, req->out.data);
 
diff --git a/source4/smb_server/smb_server.c b/source4/smb_server/smb_server.c
index 9a8a8cf5c4..4f8e628f74 100644
--- a/source4/smb_server/smb_server.c
+++ b/source4/smb_server/smb_server.c
@@ -146,7 +146,7 @@ static void smbsrv_accept(struct stream_connection *conn)
 	packet_set_fde(smb_conn->packet, conn->event.fde);
 	packet_set_serialise(smb_conn->packet);
 
-	smb_conn->lp_ctx = global_loadparm;
+	smb_conn->lp_ctx = conn->lp_ctx;
 	smb_conn->connection = conn;
 	conn->private = smb_conn;
 
@@ -253,5 +253,6 @@ failed:
 /* called at smbd startup - register ourselves as a server service */
 NTSTATUS server_service_smb_init(void)
 {
+	share_init();
 	return register_server_service("smb", smbsrv_task_init);
 }
diff --git a/source4/smbd/server.c b/source4/smbd/server.c
index fdeb541576..fe38a4e5ab 100644
--- a/source4/smbd/server.c
+++ b/source4/smbd/server.c
@@ -282,8 +282,6 @@ static int binary_smbd_main(const char *binary_name, int argc, const char *argv[
 		exit(1);
 	}
 
-	share_init();
-
 	gensec_init(cmdline_lp_ctx); /* FIXME: */
 
 	ntptr_init(cmdline_lp_ctx);	/* FIXME: maybe run this in the initialization function 
diff --git a/source4/smbd/service_stream.c b/source4/smbd/service_stream.c
index 7e1f6493ee..9f744efa81 100644
--- a/source4/smbd/service_stream.c
+++ b/source4/smbd/service_stream.c
@@ -174,10 +174,11 @@ static void stream_new_connection(struct event_context *ev,
 	srv_conn->server_id	= server_id;
 	srv_conn->ops           = stream_socket->ops;
 	srv_conn->event.ctx	= ev;
+	srv_conn->lp_ctx	= lp_ctx;
 	srv_conn->event.fde	= event_add_fd(ev, srv_conn, socket_get_fd(sock),
 					       0, stream_io_handler_fde, srv_conn);
 
-	if (!socket_check_access(sock, "smbd", lp_hostsallow(NULL), lp_hostsdeny(NULL))) {
+	if (!socket_check_access(sock, "smbd", lp_hostsallow(NULL, lp_default_service(lp_ctx)), lp_hostsdeny(NULL, lp_default_service(lp_ctx)))) {
 		stream_terminate_connection(srv_conn, "denied by access rules");
 		return;
 	}
diff --git a/source4/torture/ldap/cldap.c b/source4/torture/ldap/cldap.c
index 4e58059770..dbe9d2f9a4 100644
--- a/source4/torture/ldap/cldap.c
+++ b/source4/torture/ldap/cldap.c
@@ -38,7 +38,7 @@
 */
 static bool test_cldap_netlogon(struct torture_context *tctx, const char *dest)
 {
-	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL);
+	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	NTSTATUS status;
 	struct cldap_netlogon search, empty_search;
 	union nbt_cldap_netlogon n1;
@@ -244,7 +244,7 @@ static void cldap_dump_results(struct cldap_search *search)
 */
 static bool test_cldap_generic(struct torture_context *tctx, const char *dest)
 {
-	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL);
+	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	NTSTATUS status;
 	struct cldap_search search;
 	const char *attrs1[] = { "currentTime", "highestCommittedUSN", NULL };
diff --git a/source4/torture/ldap/cldapbench.c b/source4/torture/ldap/cldapbench.c
index c57ed6d48a..83e505e164 100644
--- a/source4/torture/ldap/cldapbench.c
+++ b/source4/torture/ldap/cldapbench.c
@@ -51,7 +51,7 @@ static void request_handler(struct cldap_request *req)
 */
 static bool bench_cldap(struct torture_context *tctx, const char *address)
 {
-	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL);
+	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	int num_sent=0;
 	struct timeval tv = timeval_current();
 	bool ret = true;
diff --git a/source4/torture/libnet/groupinfo.c b/source4/torture/libnet/groupinfo.c
index 55edb9d40d..4ddb1cefbe 100644
--- a/source4/torture/libnet/groupinfo.c
+++ b/source4/torture/libnet/groupinfo.c
@@ -96,7 +96,7 @@ bool torture_groupinfo(struct torture_context *torture)
 	/*
 	 * Testing synchronous version
 	 */
-	if (!test_opendomain(p, mem_ctx, &h, &name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &name, &sid)) {
 		ret = false;
 		goto done;
 	}
diff --git a/source4/torture/libnet/groupman.c b/source4/torture/libnet/groupman.c
index adb055c750..51b1c65b30 100644
--- a/source4/torture/libnet/groupman.c
+++ b/source4/torture/libnet/groupman.c
@@ -67,12 +67,10 @@ bool torture_groupadd(struct torture_context *torture)
 					&p,
 					&ndr_table_samr);
 	
-	if (!NT_STATUS_IS_OK(status)) {
-		return false;
-	}
+	torture_assert_ntstatus_ok(torture, status, "RPC connection");
 
 	domain_name.string = lp_workgroup(torture->lp_ctx);
-	if (!test_opendomain(p, mem_ctx, &h, &domain_name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &domain_name, &sid)) {
 		ret = false;
 		goto done;
 	}
diff --git a/source4/torture/libnet/libnet_user.c b/source4/torture/libnet/libnet_user.c
index 6ea670629e..31300a7937 100644
--- a/source4/torture/libnet/libnet_user.c
+++ b/source4/torture/libnet/libnet_user.c
@@ -339,12 +339,13 @@ static void set_test_changes(TALLOC_CTX *mem_ctx, struct libnet_ModifyUser *r,
 	const char* logon_scripts[] = { "start_login.cmd", "login.bat", "start.cmd" };
 	const char* home_dirs[] = { "\\\\srv\\home", "\\\\homesrv\\home\\user", "\\\\pdcsrv\\domain" };
 	const char* home_drives[] = { "H:", "z:", "I:", "J:", "n:" };
+	const uint32_t flags[] = { (ACB_DISABLED | ACB_NORMAL),
+				   (ACB_NORMAL | ACB_PWNOEXP),
+				   (ACB_NORMAL) };
 	const char *homedir, *homedrive, *logonscript;
 	struct timeval now;
 	int i, testfld;
 
-	srandom((unsigned)time(NULL));
-
 	printf("Fields to change: [");
 
 	for (i = 0; i < num_changes && i < FIELDS_NUM; i++) {
@@ -382,14 +383,14 @@ static void set_test_changes(TALLOC_CTX *mem_ctx, struct libnet_ModifyUser *r,
 
 		case home_directory:
 			continue_if_field_set(r->in.home_directory);
-			homedir = home_dirs[random() % (sizeof(home_dirs)/sizeof(char*))];
+			homedir = home_dirs[random() % ARRAY_SIZE(home_dirs)];
 			r->in.home_directory = talloc_strdup(mem_ctx, homedir);
 			fldname = "home_dir";
 			break;
 
 		case home_drive:
 			continue_if_field_set(r->in.home_drive);
-			homedrive = home_drives[random() % (sizeof(home_drives)/sizeof(char*))];
+			homedrive = home_drives[random() % ARRAY_SIZE(home_drives)];
 			r->in.home_drive = talloc_strdup(mem_ctx, homedrive);
 			fldname = "home_drive";
 			break;
@@ -403,7 +404,7 @@ static void set_test_changes(TALLOC_CTX *mem_ctx, struct libnet_ModifyUser *r,
 
 		case logon_script:
 			continue_if_field_set(r->in.logon_script);
-			logonscript = logon_scripts[random() % (sizeof(logon_scripts)/sizeof(char*))];
+			logonscript = logon_scripts[random() % ARRAY_SIZE(logon_scripts)];
 			r->in.logon_script = talloc_strdup(mem_ctx, logonscript);
 			fldname = "logon_script";
 			break;
@@ -422,6 +423,12 @@ static void set_test_changes(TALLOC_CTX *mem_ctx, struct libnet_ModifyUser *r,
 			fldname = "acct_expiry";
 			break;
 
+		case acct_flags:
+			continue_if_field_set(r->in.acct_flags);
+			r->in.acct_flags = flags[random() % ARRAY_SIZE(flags)];
+			fldname = "acct_flags";
+			break;
+
 		default:
 			fldname = "unknown_field";
 		}
diff --git a/source4/torture/libnet/userinfo.c b/source4/torture/libnet/userinfo.c
index e862435d20..11e57f852d 100644
--- a/source4/torture/libnet/userinfo.c
+++ b/source4/torture/libnet/userinfo.c
@@ -152,12 +152,12 @@ bool torture_userinfo(struct torture_context *torture)
 	/*
 	 * Testing synchronous version
 	 */
-	if (!test_opendomain(p, mem_ctx, &h, &name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &name, &sid)) {
 		ret = false;
 		goto done;
 	}
 
-	if (!test_user_create(p, mem_ctx, &h, TEST_USERNAME, &rid)) {
+	if (!test_user_create(torture, p, mem_ctx, &h, TEST_USERNAME, &rid)) {
 		ret = false;
 		goto done;
 	}
@@ -167,7 +167,7 @@ bool torture_userinfo(struct torture_context *torture)
 		goto done;
 	}
 
-	if (!test_user_cleanup(p, mem_ctx, &h, TEST_USERNAME)) {
+	if (!test_user_cleanup(torture, p, mem_ctx, &h, TEST_USERNAME)) {
 		ret = false;
 		goto done;
 	}
@@ -175,12 +175,12 @@ bool torture_userinfo(struct torture_context *torture)
 	/*
 	 * Testing asynchronous version and monitor messages
 	 */
-	if (!test_opendomain(p, mem_ctx, &h, &name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &name, &sid)) {
 		ret = false;
 		goto done;
 	}
 
-	if (!test_user_create(p, mem_ctx, &h, TEST_USERNAME, &rid)) {
+	if (!test_user_create(torture, p, mem_ctx, &h, TEST_USERNAME, &rid)) {
 		ret = false;
 		goto done;
 	}
@@ -190,7 +190,7 @@ bool torture_userinfo(struct torture_context *torture)
 		goto done;
 	}
 
-	if (!test_user_cleanup(p, mem_ctx, &h, TEST_USERNAME)) {
+	if (!test_user_cleanup(torture, p, mem_ctx, &h, TEST_USERNAME)) {
 		ret = false;
 		goto done;
 	}
diff --git a/source4/torture/libnet/userman.c b/source4/torture/libnet/userman.c
index 0d08284a9f..5ce0a64022 100644
--- a/source4/torture/libnet/userman.c
+++ b/source4/torture/libnet/userman.c
@@ -79,7 +79,8 @@ static bool test_useradd_async(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
 }
 
-static bool test_usermod(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+static bool test_usermod(struct torture_context *tctx, struct dcerpc_pipe *p, 
+			 TALLOC_CTX *mem_ctx,
 			 struct policy_handle *handle, int num_changes,
 			 struct libnet_rpc_usermod *mod, char **username)
 {
@@ -102,9 +103,10 @@ static bool test_usermod(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	mod->in.username = talloc_strdup(mem_ctx, *username);
 	mod->in.domain_handle = *handle;
 
-	printf("modifying user (%d simultaneous change(s))\n", num_changes);
+	torture_comment(tctx, "modifying user (%d simultaneous change(s))\n", 
+			num_changes);
 
-	printf("fields to change: [");
+	torture_comment(tctx, "fields to change: [");
 
 	for (i = 0; i < num_changes && i < FIELDS_NUM - 1; i++) {
 		const char *fldname;
@@ -189,7 +191,7 @@ static bool test_usermod(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
 		case acct_flags:
 			continue_if_field_set(mod->in.change.acct_flags);
-			mod->in.change.acct_flags = flags[random() % (sizeof(flags)/sizeof(uint32_t))];
+			mod->in.change.acct_flags = flags[random() % ARRAY_SIZE(flags)];
 			mod->in.change.fields |= USERMOD_FIELD_ACCT_FLAGS;
 			fldname = "acct_flags";
 			break;
@@ -201,13 +203,10 @@ static bool test_usermod(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
 		printf(((i < num_changes - 1) ? "%s," : "%s"), fldname);
 	}
-	printf("]\n");
+	torture_comment(tctx, "]\n");
 
 	status = libnet_rpc_usermod(p, mem_ctx, mod);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("Failed to call sync libnet_rpc_usermod - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "Failed to call sync libnet_rpc_usermod");
 
 	return true;
 }
@@ -266,7 +265,8 @@ static bool test_userdel(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	}
 
 
-static bool test_compare(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+static bool test_compare(struct torture_context *tctx, 
+			 struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			 struct policy_handle *handle, struct libnet_rpc_usermod *mod,
 			 const char *username)
 {
@@ -282,10 +282,7 @@ static bool test_compare(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	info.in.level = 21;             /* the most rich infolevel available */
 
 	status = libnet_rpc_userinfo(p, mem_ctx, &info);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("Failed to call sync libnet_rpc_userinfo - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "Failed to call sync libnet_rpc_userinfo");
 
 	i = &info.out.info.info21;
 
@@ -321,12 +318,10 @@ bool torture_useradd(struct torture_context *torture)
 					&p,
 					&ndr_table_samr);
 	
-	if (!NT_STATUS_IS_OK(status)) {
-		return false;
-	}
+	torture_assert_ntstatus_ok(torture, status, "RPC connect failed");
 
 	domain_name.string = lp_workgroup(torture->lp_ctx);
-	if (!test_opendomain(p, mem_ctx, &h, &domain_name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &domain_name, &sid)) {
 		ret = false;
 		goto done;
 	}
@@ -336,12 +331,12 @@ bool torture_useradd(struct torture_context *torture)
 		goto done;
 	}
 
-	if (!test_user_cleanup(p, mem_ctx, &h, name)) {
+	if (!test_user_cleanup(torture, p, mem_ctx, &h, name)) {
 		ret = false;
 		goto done;
 	}
 
-	if (!test_opendomain(p, mem_ctx, &h, &domain_name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &domain_name, &sid)) {
 		ret = false;
 		goto done;
 	}
@@ -351,7 +346,7 @@ bool torture_useradd(struct torture_context *torture)
 		goto done;
 	}
 
-	if (!test_user_cleanup(p, mem_ctx, &h, name)) {
+	if (!test_user_cleanup(torture, p, mem_ctx, &h, name)) {
 		ret = false;
 		goto done;
 	}
@@ -385,12 +380,12 @@ bool torture_userdel(struct torture_context *torture)
 	}
 
 	domain_name.string = lp_workgroup(torture->lp_ctx);
-	if (!test_opendomain(p, mem_ctx, &h, &domain_name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &domain_name, &sid)) {
 		ret = false;
 		goto done;
 	}
 
-	if (!test_user_create(p, mem_ctx, &h, name, &rid)) {
+	if (!test_user_create(torture, p, mem_ctx, &h, name, &rid)) {
 		ret = false;
 		goto done;
 	}
@@ -425,20 +420,17 @@ bool torture_usermod(struct torture_context *torture)
 					&p,
 					&ndr_table_samr);
 	
-	if (!NT_STATUS_IS_OK(status)) {
-		ret = false;
-		goto done;
-	}
+	torture_assert_ntstatus_ok(torture, status, "RPC connect");
 
 	domain_name.string = lp_workgroup(torture->lp_ctx);
 	name = talloc_strdup(mem_ctx, TEST_USERNAME);
 
-	if (!test_opendomain(p, mem_ctx, &h, &domain_name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &domain_name, &sid)) {
 		ret = false;
 		goto done;
 	}
 
-	if (!test_user_create(p, mem_ctx, &h, name, &rid)) {
+	if (!test_user_create(torture, p, mem_ctx, &h, name, &rid)) {
 		ret = false;
 		goto done;
 	}
@@ -446,19 +438,19 @@ bool torture_usermod(struct torture_context *torture)
 	for (i = 1; i < FIELDS_NUM; i++) {
 		struct libnet_rpc_usermod m;
 
-		if (!test_usermod(p, mem_ctx, &h, i, &m, &name)) {
+		if (!test_usermod(torture, p, mem_ctx, &h, i, &m, &name)) {
 			ret = false;
 			goto cleanup;
 		}
 
-		if (!test_compare(p, mem_ctx, &h, &m, name)) {
+		if (!test_compare(torture, p, mem_ctx, &h, &m, name)) {
 			ret = false;
 			goto cleanup;
 		}
 	}
 	
 cleanup:	
-	if (!test_user_cleanup(p, mem_ctx, &h, name)) {
+	if (!test_user_cleanup(torture, p, mem_ctx, &h, name)) {
 		ret = false;
 		goto done;
 	}
diff --git a/source4/torture/libnet/utils.c b/source4/torture/libnet/utils.c
index 47bb9315c7..d4124cc823 100644
--- a/source4/torture/libnet/utils.c
+++ b/source4/torture/libnet/utils.c
@@ -29,7 +29,8 @@
 #include "param/param.h"
 
 
-bool test_opendomain(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+bool test_opendomain(struct torture_context *tctx, 
+		     struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		     struct policy_handle *handle, struct lsa_String *domname,
 		     struct dom_sid2 *sid)
 {
@@ -39,51 +40,41 @@ bool test_opendomain(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	struct samr_LookupDomain r2;
 	struct samr_OpenDomain r3;
 	
-	printf("connecting\n");
+	torture_comment(tctx, "connecting\n");
 	
 	r1.in.system_name = 0;
 	r1.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 	r1.out.connect_handle = &h;
 	
 	status = dcerpc_samr_Connect(p, mem_ctx, &r1);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("Connect failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "Connect failed");
 	
 	r2.in.connect_handle = &h;
 	r2.in.domain_name = domname;
 
-	printf("domain lookup on %s\n", domname->string);
+	torture_comment(tctx, "domain lookup on %s\n", domname->string);
 
 	status = dcerpc_samr_LookupDomain(p, mem_ctx, &r2);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("LookupDomain failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "LookupDomain failed");
 
 	r3.in.connect_handle = &h;
 	r3.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 	r3.in.sid = r2.out.sid;
 	r3.out.domain_handle = &domain_handle;
 
-	printf("opening domain\n");
+	torture_comment(tctx, "opening domain\n");
 
 	status = dcerpc_samr_OpenDomain(p, mem_ctx, &r3);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("OpenDomain failed - %s\n", nt_errstr(status));
-		return false;
-	} else {
-		*handle = domain_handle;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "OpenDomain failed");
+	*handle = domain_handle;
 
 	*sid = *r2.out.sid;
 	return true;
 }
 
 
-bool test_user_cleanup(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
-		       struct policy_handle *domain_handle,
+bool test_user_cleanup(struct torture_context *tctx, struct dcerpc_pipe *p, 
+		       TALLOC_CTX *mem_ctx, struct policy_handle *domain_handle,
 		       const char *name)
 {
 	NTSTATUS status;
@@ -100,13 +91,10 @@ bool test_user_cleanup(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	r1.in.num_names      = 1;
 	r1.in.names          = names;
 	
-	printf("user account lookup '%s'\n", name);
+	torture_comment(tctx, "user account lookup '%s'\n", name);
 
 	status = dcerpc_samr_LookupNames(p, mem_ctx, &r1);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("LookupNames failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "LookupNames failed");
 
 	rid = r1.out.rids.ids[0];
 	
@@ -115,30 +103,25 @@ bool test_user_cleanup(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	r2.in.rid            = rid;
 	r2.out.user_handle   = &user_handle;
 
-	printf("opening user account\n");
+	torture_comment(tctx, "opening user account\n");
 
 	status = dcerpc_samr_OpenUser(p, mem_ctx, &r2);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("OpenUser failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "OpenUser failed");
 
 	r3.in.user_handle  = &user_handle;
 	r3.out.user_handle = &user_handle;
 
-	printf("deleting user account\n");
+	torture_comment(tctx, "deleting user account\n");
 	
 	status = dcerpc_samr_DeleteUser(p, mem_ctx, &r3);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("DeleteUser failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "DeleteUser failed");
 	
 	return true;
 }
 
 
-bool test_user_create(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+bool test_user_create(struct torture_context *tctx, 
+		      struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		      struct policy_handle *handle, const char *name,
 		      uint32_t *rid)
 {
@@ -155,25 +138,22 @@ bool test_user_create(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	r.out.user_handle  = &user_handle;
 	r.out.rid          = rid;
 
-	printf("creating user account %s\n", name);
+	torture_comment(tctx, "creating user account %s\n", name);
 
 	status = dcerpc_samr_CreateUser(p, mem_ctx, &r);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("CreateUser failed - %s\n", nt_errstr(status));
 
 		if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
-			printf("User (%s) already exists - attempting to delete and recreate account again\n", name);
-			if (!test_user_cleanup(p, mem_ctx, handle, name)) {
+			torture_comment(tctx, "User (%s) already exists - attempting to delete and recreate account again\n", name);
+			if (!test_user_cleanup(tctx, p, mem_ctx, handle, name)) {
 				return false;
 			}
 
-			printf("creating user account\n");
+			torture_comment(tctx, "creating user account\n");
 			
 			status = dcerpc_samr_CreateUser(p, mem_ctx, &r);
-			if (!NT_STATUS_IS_OK(status)) {
-				printf("CreateUser failed - %s\n", nt_errstr(status));
-				return false;
-			}
+			torture_assert_ntstatus_ok(tctx, status, "CreateUser failed");
 			return true;
 		}
 		return false;
diff --git a/source4/torture/libnet/utils.h b/source4/torture/libnet/utils.h
index ff94ec49e9..b513b1a29e 100644
--- a/source4/torture/libnet/utils.h
+++ b/source4/torture/libnet/utils.h
@@ -19,15 +19,18 @@
 */
 
 
-bool test_opendomain(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+bool test_opendomain(struct torture_context *tctx, 
+		     struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		     struct policy_handle *handle, struct lsa_String *domname,
 		     struct dom_sid2 *sid);
 
-bool test_user_create(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+bool test_user_create(struct torture_context *tctx, 
+		      struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		      struct policy_handle *handle, const char *name,
 		      uint32_t *rid);
 
-bool test_user_cleanup(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+bool test_user_cleanup(struct torture_context *tctx, 
+		       struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		       struct policy_handle *domain_handle,
 		       const char *name);
 
diff --git a/source4/torture/local/config.mk b/source4/torture/local/config.mk
index d0ba1f2782..4143d415cf 100644
--- a/source4/torture/local/config.mk
+++ b/source4/torture/local/config.mk
@@ -8,6 +8,7 @@ PRIVATE_PROTO_HEADER = \
 OBJ_FILES = \
 		../../lib/charset/tests/iconv.o \
 		../../lib/talloc/testsuite.o \
+		../../lib/replace/test/getifaddrs.o \
 		../../lib/replace/test/os2_delete.o \
 		../../lib/replace/test/strptime.o \
 		../../lib/replace/test/testsuite.o \
diff --git a/source4/torture/nbt/dgram.c b/source4/torture/nbt/dgram.c
index 0315989d66..e1680877e8 100644
--- a/source4/torture/nbt/dgram.c
+++ b/source4/torture/nbt/dgram.c
@@ -64,7 +64,8 @@ static void netlogon_handler(struct dgram_mailslot_handler *dgmslot,
 static bool nbt_test_netlogon(struct torture_context *tctx)
 {
 	struct dgram_mailslot_handler *dgmslot;
-	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL);
+	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL, 
+								 lp_iconv_convenience(tctx->lp_ctx));
 	struct socket_address *dest;
 	const char *myaddress;
 	struct nbt_netlogon_packet logon;
@@ -146,7 +147,8 @@ static bool nbt_test_netlogon(struct torture_context *tctx)
 static bool nbt_test_netlogon2(struct torture_context *tctx)
 {
 	struct dgram_mailslot_handler *dgmslot;
-	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL);
+	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL,
+								 lp_iconv_convenience(tctx->lp_ctx));
 	struct socket_address *dest;
 	const char *myaddress;
 	struct nbt_netlogon_packet logon;
@@ -255,7 +257,8 @@ static void ntlogon_handler(struct dgram_mailslot_handler *dgmslot,
 static bool nbt_test_ntlogon(struct torture_context *tctx)
 {
 	struct dgram_mailslot_handler *dgmslot;
-	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL);
+	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL,
+								 lp_iconv_convenience(tctx->lp_ctx));
 	struct socket_address *dest;
 	struct test_join *join_ctx;
 	struct cli_credentials *machine_credentials;
diff --git a/source4/torture/nbt/query.c b/source4/torture/nbt/query.c
index 78210a2a07..1ba6172e5c 100644
--- a/source4/torture/nbt/query.c
+++ b/source4/torture/nbt/query.c
@@ -47,7 +47,8 @@ static void increment_handler(struct nbt_name_request *req)
 */
 static bool bench_namequery(struct torture_context *tctx)
 {
-	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL);
+	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL,
+							       lp_iconv_convenience(tctx->lp_ctx));
 	int num_sent=0;
 	struct result_struct *result;
 	struct nbt_name_query io;
diff --git a/source4/torture/nbt/register.c b/source4/torture/nbt/register.c
index 508c6b4840..b9f06c479d 100644
--- a/source4/torture/nbt/register.c
+++ b/source4/torture/nbt/register.c
@@ -44,7 +44,8 @@ static bool nbt_register_own(struct torture_context *tctx)
 {
 	struct nbt_name_register io;
 	NTSTATUS status;
-	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL);
+	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL,
+							       lp_iconv_convenience(tctx->lp_ctx));
 	struct socket_address *socket_address;
 	struct nbt_name name;
 	const char *address;
@@ -113,7 +114,8 @@ static bool nbt_refresh_own(struct torture_context *tctx)
 {
 	struct nbt_name_refresh io;
 	NTSTATUS status;
-	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL);
+	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL,
+							       lp_iconv_convenience(tctx->lp_ctx));
 	const char *myaddress;
 	struct socket_address *socket_address;
 	struct nbt_name name;
diff --git a/source4/torture/nbt/wins.c b/source4/torture/nbt/wins.c
index cf115fcd75..059b2dc919 100644
--- a/source4/torture/nbt/wins.c
+++ b/source4/torture/nbt/wins.c
@@ -53,7 +53,7 @@ static bool nbt_test_wins_name(struct torture_context *tctx, const char *address
 	struct nbt_name_refresh_wins refresh;
 	struct nbt_name_release release;
 	NTSTATUS status;
-	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL);
+	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	const char *myaddress;
 	struct socket_address *socket_address;
 	struct interface *ifaces;
diff --git a/source4/torture/nbt/winsbench.c b/source4/torture/nbt/winsbench.c
index 1488c17757..ea4abaf21b 100644
--- a/source4/torture/nbt/winsbench.c
+++ b/source4/torture/nbt/winsbench.c
@@ -225,7 +225,7 @@ static void generate_request(struct nbt_name_socket *nbtsock, struct wins_state
 */
 static bool bench_wins(struct torture_context *tctx)
 {
-	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL);
+	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	int num_sent=0;
 	struct timeval tv = timeval_current();
 	bool ret = true;
diff --git a/source4/torture/nbt/winsreplication.c b/source4/torture/nbt/winsreplication.c
index d96ed3e931..470eee8310 100644
--- a/source4/torture/nbt/winsreplication.c
+++ b/source4/torture/nbt/winsreplication.c
@@ -103,14 +103,14 @@ static bool test_assoc_ctx1(struct torture_context *tctx)
 
 	torture_comment(tctx, "Test if assoc_ctx is only valid on the conection it was created on\n");
 
-	wrepl_socket1 = wrepl_socket_init(tctx, NULL);
-	wrepl_socket2 = wrepl_socket_init(tctx, NULL);
+	wrepl_socket1 = wrepl_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
+	wrepl_socket2 = wrepl_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 
 	torture_comment(tctx, "Setup 2 wrepl connections\n");
-	status = wrepl_connect(wrepl_socket1, lp_resolve_context(tctx->lp_ctx), NULL, address);
+	status = wrepl_connect(wrepl_socket1, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, address), address);
 	CHECK_STATUS(tctx, status, NT_STATUS_OK);
 
-	status = wrepl_connect(wrepl_socket2, lp_resolve_context(tctx->lp_ctx), NULL, address);
+	status = wrepl_connect(wrepl_socket2, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, address), address);
 	CHECK_STATUS(tctx, status, NT_STATUS_OK);
 
 	torture_comment(tctx, "Send a start association request (conn1)\n");
@@ -186,10 +186,10 @@ static bool test_assoc_ctx2(struct torture_context *tctx)
 
 	torture_comment(tctx, "Test if we always get back the same assoc_ctx\n");
 
-	wrepl_socket = wrepl_socket_init(tctx, NULL);
+	wrepl_socket = wrepl_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	
 	torture_comment(tctx, "Setup wrepl connections\n");
-	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), NULL, address);
+	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, address), address);
 	CHECK_STATUS(tctx, status, NT_STATUS_OK);
 
 	torture_comment(tctx, "Send 1st start association request\n");
@@ -255,10 +255,10 @@ static bool test_wins_replication(struct torture_context *tctx)
 
 	torture_comment(tctx, "Test one pull replication cycle\n");
 
-	wrepl_socket = wrepl_socket_init(tctx, NULL);
+	wrepl_socket = wrepl_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	
 	torture_comment(tctx, "Setup wrepl connections\n");
-	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), NULL, address);
+	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, address), address);
 	CHECK_STATUS(tctx, status, NT_STATUS_OK);
 
 	torture_comment(tctx, "Send a start association request\n");
@@ -553,11 +553,11 @@ static struct test_wrepl_conflict_conn *test_create_conflict_ctx(
 	if (!ctx) return NULL;
 
 	ctx->address	= address;
-	ctx->pull	= wrepl_socket_init(ctx, NULL);
+	ctx->pull	= wrepl_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	if (!ctx->pull) return NULL;
 
 	torture_comment(tctx, "Setup wrepl conflict pull connection\n");
-	status = wrepl_connect(ctx->pull, lp_resolve_context(tctx->lp_ctx), NULL, ctx->address);
+	status = wrepl_connect(ctx->pull, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, ctx->address), ctx->address);
 	if (!NT_STATUS_IS_OK(status)) return NULL;
 
 	status = wrepl_associate(ctx->pull, &associate);
@@ -610,7 +610,7 @@ static struct test_wrepl_conflict_conn *test_create_conflict_ctx(
 
 	talloc_free(pull_table.out.partners);
 
-	ctx->nbtsock = nbt_name_socket_init(ctx, NULL);
+	ctx->nbtsock = nbt_name_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	if (!ctx->nbtsock) return NULL;
 
 	load_interfaces(tctx, lp_interfaces(tctx->lp_ctx), &ifaces);
@@ -628,7 +628,7 @@ static struct test_wrepl_conflict_conn *test_create_conflict_ctx(
 	status = socket_listen(ctx->nbtsock->sock, ctx->myaddr, 0, 0);
 	if (!NT_STATUS_IS_OK(status)) return NULL;
 
-	ctx->nbtsock_srv = nbt_name_socket_init(ctx, NULL);
+	ctx->nbtsock_srv = nbt_name_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	if (!ctx->nbtsock_srv) return NULL;
 
 	/* Make a port 137 version of ctx->myaddr */
@@ -645,13 +645,13 @@ static struct test_wrepl_conflict_conn *test_create_conflict_ctx(
 	}
 
 	if (ctx->myaddr2 && ctx->nbtsock_srv) {
-		ctx->nbtsock2 = nbt_name_socket_init(ctx, NULL);
+		ctx->nbtsock2 = nbt_name_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 		if (!ctx->nbtsock2) return NULL;
 
 		status = socket_listen(ctx->nbtsock2->sock, ctx->myaddr2, 0, 0);
 		if (!NT_STATUS_IS_OK(status)) return NULL;
 
-		ctx->nbtsock_srv2 = nbt_name_socket_init(ctx, ctx->nbtsock_srv->event_ctx);
+		ctx->nbtsock_srv2 = nbt_name_socket_init(ctx, ctx->nbtsock_srv->event_ctx, lp_iconv_convenience(tctx->lp_ctx));
 		if (!ctx->nbtsock_srv2) return NULL;
 
 		/* Make a port 137 version of ctx->myaddr2 */
@@ -722,9 +722,9 @@ static bool test_wrepl_update_one(struct torture_context *tctx,
 	uint32_t assoc_ctx;
 	NTSTATUS status;
 
-	wrepl_socket = wrepl_socket_init(ctx, NULL);
+	wrepl_socket = wrepl_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 
-	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), NULL, ctx->address);
+	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, ctx->address), ctx->address);
 	CHECK_STATUS(tctx, status, NT_STATUS_OK);
 
 	status = wrepl_associate(wrepl_socket, &associate);
diff --git a/source4/torture/raw/composite.c b/source4/torture/raw/composite.c
index 7238a2fd46..1f31fbc515 100644
--- a/source4/torture/raw/composite.c
+++ b/source4/torture/raw/composite.c
@@ -31,6 +31,7 @@
 #include "lib/cmdline/popt_common.h"
 #include "torture/util.h"
 #include "param/param.h"
+#include "libcli/resolve/resolve.h"
 
 #define BASEDIR "\\composite"
 
@@ -161,6 +162,7 @@ static bool test_fetchfile(struct smbcli_state *cli, struct torture_context *tct
 	io2.in.credentials = cmdline_credentials;
 	io2.in.workgroup  = lp_workgroup(tctx->lp_ctx);
 	io2.in.filename = fname;
+	io2.in.resolve_ctx = lp_resolve_context(tctx->lp_ctx);
 	lp_smbcli_options(tctx->lp_ctx, &io2.in.options);
 
 	printf("testing parallel fetchfile with %d ops\n", torture_numops);
diff --git a/source4/torture/raw/oplock.c b/source4/torture/raw/oplock.c
index e81b634161..7ac88c0996 100644
--- a/source4/torture/raw/oplock.c
+++ b/source4/torture/raw/oplock.c
@@ -27,11 +27,19 @@
 
 #define CHECK_VAL(v, correct) do { \
 	if ((v) != (correct)) { \
-		torture_comment(tctx, "(%s): wrong value for %s got 0x%x - should be 0x%x\n", \
+		torture_result(tctx, TORTURE_FAIL, "(%s): wrong value for %s got 0x%x - should be 0x%x\n", \
 				__location__, #v, (int)v, (int)correct); \
 		ret = false; \
 	}} while (0)
 
+#define CHECK_STRMATCH(v, correct) do { \
+	if (!v || strstr((v),(correct)) == NULL) { \
+		torture_result(tctx, TORTURE_FAIL,  "(%s): wrong value for %s got '%s' - should be '%s'\n", \
+				__location__, #v, v?v:"NULL", correct); \
+		ret = false; \
+	} \
+} while (0)
+
 #define CHECK_STATUS(tctx, status, correct) do { \
 	if (!NT_STATUS_EQUAL(status, correct)) { \
 		torture_result(tctx, TORTURE_FAIL, __location__": Incorrect status %s - should be %s", \
@@ -123,9 +131,9 @@ static bool oplock_handler_close(struct smbcli_transport *transport, uint16_t ti
 	return true;
 }
 
-static bool test_raw_oplock_normal(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+static bool test_raw_oplock_exclusive1(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
 {
-	const char *fname = BASEDIR "\\test_normal.dat";
+	const char *fname = BASEDIR "\\test_exclusive1.dat";
 	NTSTATUS status;
 	bool ret = true;
 	union smb_open io;
@@ -156,7 +164,7 @@ static bool test_raw_oplock_normal(struct torture_context *tctx, struct smbcli_s
 	io.ntcreatex.in.security_flags = 0;
 	io.ntcreatex.in.fname = fname;
 
-	torture_comment(tctx, "open a file with a normal oplock\n");
+	torture_comment(tctx, "open a file with an exclusive oplock (share mode: none)\n");
 	ZERO_STRUCT(break_info);
 	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
 
@@ -188,6 +196,381 @@ done:
 	return ret;
 }
 
+static bool test_raw_oplock_exclusive2(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname = BASEDIR "\\test_exclusive2.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_unlink unl;
+	uint16_t fnum=0, fnum2=0;
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname;
+
+	torture_comment(tctx, "open a file with an exclusive oplock (share mode: all)\n");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, EXCLUSIVE_OPLOCK_RETURN);
+
+	torture_comment(tctx, "a 2nd open should cause a break to level 2\n");
+	status = smb_raw_open(cli2->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum2 = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, LEVEL_II_OPLOCK_RETURN);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.fnum, fnum);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_LEVEL_II);
+	CHECK_VAL(break_info.failures, 0);
+	ZERO_STRUCT(break_info);
+
+	/* now we have 2 level II oplocks... */
+	torture_comment(tctx, "try to unlink it - should not cause a break, but a sharing violation\n");
+	unl.unlink.in.pattern = fname;
+	unl.unlink.in.attrib = 0;
+	status = smb_raw_unlink(cli2->tree, &unl);
+	CHECK_STATUS(tctx, status, NT_STATUS_SHARING_VIOLATION);
+	CHECK_VAL(break_info.count, 0);
+	CHECK_VAL(break_info.failures, 0);
+
+	torture_comment(tctx, "close 1st handle\n");
+	smbcli_close(cli1->tree, fnum);
+
+	torture_comment(tctx, "try to unlink it - should not cause a break, but a sharing violation\n");
+	unl.unlink.in.pattern = fname;
+	unl.unlink.in.attrib = 0;
+	status = smb_raw_unlink(cli2->tree, &unl);
+	CHECK_STATUS(tctx, status, NT_STATUS_SHARING_VIOLATION);
+	CHECK_VAL(break_info.count, 0);
+	CHECK_VAL(break_info.failures, 0);
+
+	torture_comment(tctx, "close 1st handle\n");
+	smbcli_close(cli2->tree, fnum2);
+
+	torture_comment(tctx, "unlink it\n");
+	unl.unlink.in.pattern = fname;
+	unl.unlink.in.attrib = 0;
+	status = smb_raw_unlink(cli2->tree, &unl);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 0);
+	CHECK_VAL(break_info.failures, 0);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_exclusive3(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname = BASEDIR "\\test_exclusive3.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_setfileinfo sfi;
+	uint16_t fnum=0;
+	bool s3 = torture_setting_bool(tctx, "samba3", false);
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname;
+
+	torture_comment(tctx, "open a file with an exclusive oplock (share mode: %s)\n",
+			s3?"all":"none");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	if (s3) {
+		io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+			NTCREATEX_SHARE_ACCESS_WRITE|
+			NTCREATEX_SHARE_ACCESS_DELETE;
+	}
+
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, EXCLUSIVE_OPLOCK_RETURN);
+
+	torture_comment(tctx, "setpathinfo EOF should trigger a break to none\n");
+	ZERO_STRUCT(sfi);
+	sfi.generic.level = RAW_SFILEINFO_END_OF_FILE_INFORMATION;
+	sfi.generic.in.file.path = fname;
+	sfi.end_of_file_info.in.size = 100;
+
+	status = smb_raw_setpathinfo(cli2->tree, &sfi);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_NONE);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_exclusive4(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname = BASEDIR "\\test_exclusive4.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	uint16_t fnum=0, fnum2=0;
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname;
+
+	torture_comment(tctx, "open with exclusive oplock\n");
+	ZERO_STRUCT(break_info);
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, EXCLUSIVE_OPLOCK_RETURN);
+
+	ZERO_STRUCT(break_info);
+	torture_comment(tctx, "second open with attributes only shouldn't cause oplock break\n");
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	io.ntcreatex.in.access_mask = SEC_FILE_READ_ATTRIBUTE|SEC_FILE_WRITE_ATTRIBUTE|SEC_STD_SYNCHRONIZE;
+	status = smb_raw_open(cli2->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum2 = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, NO_OPLOCK_RETURN);
+	CHECK_VAL(break_info.count, 0);
+	CHECK_VAL(break_info.failures, 0);
+
+	smbcli_close(cli1->tree, fnum);
+	smbcli_close(cli2->tree, fnum2);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_exclusive5(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname = BASEDIR "\\test_exclusive5.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	uint16_t fnum=0, fnum2=0;
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+	smbcli_oplock_handler(cli2->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname;
+
+	torture_comment(tctx, "open with exclusive oplock\n");
+	ZERO_STRUCT(break_info);
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, EXCLUSIVE_OPLOCK_RETURN);
+
+	ZERO_STRUCT(break_info);
+
+	torture_comment(tctx, "second open with attributes only and NTCREATEX_DISP_OVERWRITE_IF dispostion causes oplock break\n");
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	io.ntcreatex.in.access_mask = SEC_FILE_READ_ATTRIBUTE|SEC_FILE_WRITE_ATTRIBUTE|SEC_STD_SYNCHRONIZE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OVERWRITE_IF;
+	status = smb_raw_open(cli2->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum2 = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, LEVEL_II_OPLOCK_RETURN);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+
+	smbcli_close(cli1->tree, fnum);
+	smbcli_close(cli2->tree, fnum2);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_exclusive6(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname1 = BASEDIR "\\test_exclusive6_1.dat";
+	const char *fname2 = BASEDIR "\\test_exclusive6_2.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_rename rn;
+	uint16_t fnum=0;
+	bool s3 = torture_setting_bool(tctx, "samba3", false);
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname1);
+	smbcli_unlink(cli1->tree, fname2);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname1;
+
+	/* we should use no share mode, when samba3 passes this */
+	torture_comment(tctx, "open a file with an exclusive oplock (share mode: %s)\n",
+			s3?"all":"none");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	if (s3) {
+		io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+			NTCREATEX_SHARE_ACCESS_WRITE|
+			NTCREATEX_SHARE_ACCESS_DELETE;
+	}
+
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, EXCLUSIVE_OPLOCK_RETURN);
+
+	torture_comment(tctx, "rename should not generate a break but get a sharing violation\n");
+	ZERO_STRUCT(rn);
+	rn.generic.level = RAW_RENAME_RENAME;
+	rn.rename.in.pattern1 = fname1;
+	rn.rename.in.pattern2 = fname2;
+	rn.rename.in.attrib = 0;
+
+	printf("trying rename while first file open\n");
+	status = smb_raw_rename(cli2->tree, &rn);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_SHARING_VIOLATION);
+	CHECK_VAL(break_info.count, 0);
+	CHECK_VAL(break_info.failures, 0);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
 static bool test_raw_oplock_batch1(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
 {
 	const char *fname = BASEDIR "\\test_batch1.dat";
@@ -1352,6 +1735,475 @@ done:
 	return ret;
 }
 
+static bool test_raw_oplock_batch16(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname = BASEDIR "\\test_batch16.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	uint16_t fnum=0, fnum2=0;
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+	smbcli_oplock_handler(cli2->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname;
+
+	torture_comment(tctx, "open with batch oplock\n");
+	ZERO_STRUCT(break_info);
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, BATCH_OPLOCK_RETURN);
+
+	ZERO_STRUCT(break_info);
+
+	torture_comment(tctx, "second open with attributes only and NTCREATEX_DISP_OVERWRITE_IF dispostion causes oplock break\n");
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	io.ntcreatex.in.access_mask = SEC_FILE_READ_ATTRIBUTE|SEC_FILE_WRITE_ATTRIBUTE|SEC_STD_SYNCHRONIZE;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OVERWRITE_IF;
+	status = smb_raw_open(cli2->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum2 = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, LEVEL_II_OPLOCK_RETURN);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+
+	smbcli_close(cli1->tree, fnum);
+	smbcli_close(cli2->tree, fnum2);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_batch17(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname1 = BASEDIR "\\test_batch17_1.dat";
+	const char *fname2 = BASEDIR "\\test_batch17_2.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_rename rn;
+	uint16_t fnum=0;
+	bool s3 = torture_setting_bool(tctx, "samba3", false);
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname1);
+	smbcli_unlink(cli1->tree, fname2);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname1;
+
+	/* we should use no share mode, when samba3 passes this */
+	torture_comment(tctx, "open a file with an batch oplock (share mode: %s)\n",
+			s3?"all":"none");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	if (s3) {
+		io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+			NTCREATEX_SHARE_ACCESS_WRITE|
+			NTCREATEX_SHARE_ACCESS_DELETE;
+	}
+
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, BATCH_OPLOCK_RETURN);
+
+	torture_comment(tctx, "rename should trigger a break\n");
+	ZERO_STRUCT(rn);
+	rn.generic.level = RAW_RENAME_RENAME;
+	rn.rename.in.pattern1 = fname1;
+	rn.rename.in.pattern2 = fname2;
+	rn.rename.in.attrib = 0;
+
+	printf("trying rename while first file open\n");
+	status = smb_raw_rename(cli2->tree, &rn);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_SHARING_VIOLATION);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_LEVEL_II);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_batch18(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname1 = BASEDIR "\\test_batch18_1.dat";
+	const char *fname2 = BASEDIR "\\test_batch18_2.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_rename rn;
+	uint16_t fnum=0;
+	bool s3 = torture_setting_bool(tctx, "samba3", false);
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname1);
+	smbcli_unlink(cli1->tree, fname2);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname1;
+
+	/* we should use no share mode, when samba3 passes this */
+	torture_comment(tctx, "open a file with an batch oplock (share mode: %s)\n",
+			s3?"all":"none");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	if (s3) {
+		io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+			NTCREATEX_SHARE_ACCESS_WRITE|
+			NTCREATEX_SHARE_ACCESS_DELETE;
+	}
+
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, BATCH_OPLOCK_RETURN);
+
+	torture_comment(tctx, "ntrename should trigger a break\n");
+	ZERO_STRUCT(rn);
+	rn.generic.level = RAW_RENAME_NTRENAME;
+	rn.ntrename.in.attrib	= 0;
+	rn.ntrename.in.flags	= RENAME_FLAG_RENAME;
+	rn.ntrename.in.old_name = fname1;
+	rn.ntrename.in.new_name = fname2;
+	printf("trying rename while first file open\n");
+	status = smb_raw_rename(cli2->tree, &rn);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_SHARING_VIOLATION);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_LEVEL_II);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_batch19(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname1 = BASEDIR "\\test_batch19_1.dat";
+	const char *fname2 = BASEDIR "\\test_batch19_2.dat";
+	const char *fname3 = BASEDIR "\\test_batch19_3.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_fileinfo qfi;
+	union smb_setfileinfo sfi;
+	uint16_t fnum=0;
+
+	if (torture_setting_bool(tctx, "samba3", false)) {
+		torture_skip(tctx, "BACHT19 disabled against samba3\n");
+	}
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname1);
+	smbcli_unlink(cli1->tree, fname2);
+	smbcli_unlink(cli1->tree, fname3);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname1;
+
+	torture_comment(tctx, "open a file with an batch oplock (share mode: none)\n");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, BATCH_OPLOCK_RETURN);
+
+	torture_comment(tctx, "setpathinfo rename info should not trigger a break nor a violation\n");
+	ZERO_STRUCT(sfi);
+	sfi.generic.level = RAW_SFILEINFO_RENAME_INFORMATION;
+	sfi.generic.in.file.path = fname1;
+	sfi.rename_information.in.overwrite	= 0;
+	sfi.rename_information.in.root_fid	= 0;
+	sfi.rename_information.in.new_name	= fname2+strlen(BASEDIR)+1;
+
+        status = smb_raw_setpathinfo(cli2->tree, &sfi);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 0);
+
+	ZERO_STRUCT(qfi);
+	qfi.generic.level = RAW_FILEINFO_ALL_INFORMATION;
+	qfi.generic.in.file.fnum = fnum;
+
+	status = smb_raw_fileinfo(cli1->tree, tctx, &qfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_STRMATCH(qfi.all_info.out.fname.s, fname2);
+
+	torture_comment(tctx, "setfileinfo rename info should not trigger a break nor a violation\n");
+	ZERO_STRUCT(sfi);
+	sfi.generic.level = RAW_SFILEINFO_RENAME_INFORMATION;
+	sfi.generic.in.file.fnum = fnum;
+	sfi.rename_information.in.overwrite	= 0;
+	sfi.rename_information.in.root_fid	= 0;
+	sfi.rename_information.in.new_name	= fname3+strlen(BASEDIR)+1;
+
+	status = smb_raw_setfileinfo(cli1->tree, &sfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 0);
+
+	ZERO_STRUCT(qfi);
+	qfi.generic.level = RAW_FILEINFO_ALL_INFORMATION;
+	qfi.generic.in.file.fnum = fnum;
+
+	status = smb_raw_fileinfo(cli1->tree, tctx, &qfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_STRMATCH(qfi.all_info.out.fname.s, fname3);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_batch20(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname1 = BASEDIR "\\test_batch20_1.dat";
+	const char *fname2 = BASEDIR "\\test_batch20_2.dat";
+	const char *fname3 = BASEDIR "\\test_batch20_3.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_fileinfo qfi;
+	union smb_setfileinfo sfi;
+	uint16_t fnum=0,fnum2=0;
+
+	if (torture_setting_bool(tctx, "samba3", false)) {
+		torture_skip(tctx, "BACHT20 disabled against samba3\n");
+	}
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname1);
+	smbcli_unlink(cli1->tree, fname2);
+	smbcli_unlink(cli1->tree, fname3);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname1;
+
+	torture_comment(tctx, "open a file with an batch oplock (share mode: all)\n");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, BATCH_OPLOCK_RETURN);
+
+	torture_comment(tctx, "setpathinfo rename info should not trigger a break nor a violation\n");
+	ZERO_STRUCT(sfi);
+	sfi.generic.level = RAW_SFILEINFO_RENAME_INFORMATION;
+	sfi.generic.in.file.path = fname1;
+	sfi.rename_information.in.overwrite	= 0;
+	sfi.rename_information.in.root_fid	= 0;
+	sfi.rename_information.in.new_name	= fname2+strlen(BASEDIR)+1;
+
+	status = smb_raw_setpathinfo(cli2->tree, &sfi);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 0);
+
+	ZERO_STRUCT(qfi);
+	qfi.generic.level = RAW_FILEINFO_ALL_INFORMATION;
+	qfi.generic.in.file.fnum = fnum;
+
+	status = smb_raw_fileinfo(cli1->tree, tctx, &qfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_STRMATCH(qfi.all_info.out.fname.s, fname2);
+
+	/* we should use no share mode, when samba3 passes this */
+	torture_comment(tctx, "open a file with the new name an batch oplock (share mode: all)\n");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+	io.ntcreatex.in.fname = fname2;
+	status = smb_raw_open(cli2->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum2 = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, LEVEL_II_OPLOCK_RETURN);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_LEVEL_II);
+
+	torture_comment(tctx, "setfileinfo rename info should not trigger a break nor a violation\n");
+	ZERO_STRUCT(sfi);
+	sfi.generic.level = RAW_SFILEINFO_RENAME_INFORMATION;
+	sfi.generic.in.file.fnum = fnum;
+	sfi.rename_information.in.overwrite	= 0;
+	sfi.rename_information.in.root_fid	= 0;
+	sfi.rename_information.in.new_name	= fname3+strlen(BASEDIR)+1;
+
+	status = smb_raw_setfileinfo(cli1->tree, &sfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_LEVEL_II);
+
+	ZERO_STRUCT(qfi);
+	qfi.generic.level = RAW_FILEINFO_ALL_INFORMATION;
+	qfi.generic.in.file.fnum = fnum;
+
+	status = smb_raw_fileinfo(cli1->tree, tctx, &qfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_STRMATCH(qfi.all_info.out.fname.s, fname3);
+
+	ZERO_STRUCT(qfi);
+	qfi.generic.level = RAW_FILEINFO_ALL_INFORMATION;
+	qfi.generic.in.file.fnum = fnum2;
+
+	status = smb_raw_fileinfo(cli2->tree, tctx, &qfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_STRMATCH(qfi.all_info.out.fname.s, fname3);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
 /* 
    basic testing of oplocks
 */
@@ -1359,7 +2211,12 @@ struct torture_suite *torture_raw_oplock(TALLOC_CTX *mem_ctx)
 {
 	struct torture_suite *suite = torture_suite_create(mem_ctx, "OPLOCK");
 
-	torture_suite_add_2smb_test(suite, "NORMAL", test_raw_oplock_normal);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE1", test_raw_oplock_exclusive1);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE2", test_raw_oplock_exclusive2);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE3", test_raw_oplock_exclusive3);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE4", test_raw_oplock_exclusive4);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE5", test_raw_oplock_exclusive5);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE6", test_raw_oplock_exclusive6);
 	torture_suite_add_2smb_test(suite, "BATCH1", test_raw_oplock_batch1);
 	torture_suite_add_2smb_test(suite, "BATCH2", test_raw_oplock_batch2);
 	torture_suite_add_2smb_test(suite, "BATCH3", test_raw_oplock_batch3);
@@ -1375,6 +2232,11 @@ struct torture_suite *torture_raw_oplock(TALLOC_CTX *mem_ctx)
 	torture_suite_add_2smb_test(suite, "BATCH13", test_raw_oplock_batch13);
 	torture_suite_add_2smb_test(suite, "BATCH14", test_raw_oplock_batch14);
 	torture_suite_add_2smb_test(suite, "BATCH15", test_raw_oplock_batch15);
+	torture_suite_add_2smb_test(suite, "BATCH16", test_raw_oplock_batch16);
+	torture_suite_add_2smb_test(suite, "BATCH17", test_raw_oplock_batch17);
+	torture_suite_add_2smb_test(suite, "BATCH18", test_raw_oplock_batch18);
+	torture_suite_add_2smb_test(suite, "BATCH19", test_raw_oplock_batch19);
+	torture_suite_add_2smb_test(suite, "BATCH20", test_raw_oplock_batch20);
 
 	return suite;
 }
diff --git a/source4/torture/raw/qfsinfo.c b/source4/torture/raw/qfsinfo.c
index 3207558624..c1c77edba9 100644
--- a/source4/torture/raw/qfsinfo.c
+++ b/source4/torture/raw/qfsinfo.c
@@ -38,7 +38,7 @@ static struct {
 	{"SIZE_INFO",             RAW_QFS_SIZE_INFO, },
 	{"DEVICE_INFO",           RAW_QFS_DEVICE_INFO, },
 	{"ATTRIBUTE_INFO",        RAW_QFS_ATTRIBUTE_INFO, },
-	{"UNIX_INFO",             RAW_QFS_UNIX_INFO,            CAP_UNIX},
+	{"UNIX_INFO",             RAW_QFS_UNIX_INFO, CAP_UNIX},
 	{"VOLUME_INFORMATION",    RAW_QFS_VOLUME_INFORMATION, },
 	{"SIZE_INFORMATION",      RAW_QFS_SIZE_INFORMATION, },
 	{"DEVICE_INFORMATION",    RAW_QFS_DEVICE_INFORMATION, },
@@ -130,7 +130,7 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 
 	/* scan all the levels, pulling the results */
 	for (i=0; levels[i].name; i++) {
-		printf("Running level %s\n", levels[i].name);
+		torture_comment(torture, "Running level %s\n", levels[i].name);
 		levels[i].fsinfo.generic.level = levels[i].level;
 		levels[i].status = smb_raw_fsinfo(cli->tree, torture, &levels[i].fsinfo);
 	}
@@ -151,14 +151,11 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 	}
 
 	if (count != 0) {
-		printf("%d levels failed\n", count);
-		if (count > 13) {
-			printf("too many level failures - giving up\n");
-			return false;
-		}
+		torture_comment(torture, "%d levels failed\n", count);
+		torture_assert(torture, count > 13, "too many level failures - giving up");
 	}
 
-	printf("check for correct aliases\n");
+	torture_comment(torture, "check for correct aliases\n");
 	s1 = find("SIZE_INFO");
 	s2 = find("SIZE_INFORMATION");
 	if (s1 && s2) {
@@ -181,7 +178,7 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 		STRUCT_EQUAL(volume_info, create_time,    volume_info, create_time);
 		VAL_EQUAL   (volume_info, serial_number,  volume_info, serial_number);
 		STR_EQUAL   (volume_info, volume_name.s,    volume_info, volume_name.s);
-		printf("volume_info.volume_name = '%s'\n", s1->volume_info.out.volume_name.s);
+		torture_comment(torture, "volume_info.volume_name = '%s'\n", s1->volume_info.out.volume_name.s);
 	}	
 
 	s1 = find("ATTRIBUTE_INFO");
@@ -192,10 +189,10 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 		VAL_EQUAL(attribute_info, max_file_component_length, 
 			  attribute_info, max_file_component_length);
 		STR_EQUAL(attribute_info, fs_type.s, attribute_info, fs_type.s);
-		printf("attribute_info.fs_type = '%s'\n", s1->attribute_info.out.fs_type.s);
+		torture_comment(torture, "attribute_info.fs_type = '%s'\n", s1->attribute_info.out.fs_type.s);
 	}	
 
-	printf("check for consistent disk sizes\n");
+	torture_comment(torture, "check for consistent disk sizes\n");
 	s1 = find("DSKATTR");
 	s2 = find("ALLOCATION");
 	if (s1 && s2) {
@@ -214,10 +211,10 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 			       size1, size2);
 			ret = false;
 		}
-		printf("total disk = %.0f MB\n", size1*scale/1.0e6);
+		torture_comment(torture, "total disk = %.0f MB\n", size1*scale/1.0e6);
 	}
 
-	printf("check consistent free disk space\n");
+	torture_comment(torture, "check consistent free disk space\n");
 	s1 = find("DSKATTR");
 	s2 = find("ALLOCATION");
 	if (s1 && s2) {
@@ -236,10 +233,10 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 			       size1, size2);
 			ret = false;
 		}
-		printf("free disk = %.0f MB\n", size1*scale/1.0e6);
+		torture_comment(torture, "free disk = %.0f MB\n", size1*scale/1.0e6);
 	}
 	
-	printf("volume info consistency\n");
+	torture_comment(torture, "volume info consistency\n");
 	s1 = find("VOLUME");
 	s2 = find("VOLUME_INFO");
 	if (s1 && s2) {
@@ -287,7 +284,7 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 		} \
 	}} while (0)
 
-	printf("check for correct termination\n");
+	torture_comment(torture, "check for correct termination\n");
 	
 	STR_CHECK("VOLUME",                volume,         volume_name, 0);
 	STR_CHECK("VOLUME_INFO",           volume_info,    volume_name, STR_UNICODE);
diff --git a/source4/torture/rpc/dssync.c b/source4/torture/rpc/dssync.c
index 4417285e04..b28e429a75 100644
--- a/source4/torture/rpc/dssync.c
+++ b/source4/torture/rpc/dssync.c
@@ -255,7 +255,7 @@ static bool test_GetInfo(struct torture_context *tctx, struct DsSyncTest *ctx)
 	struct drsuapi_DsNameString names[1];
 	bool ret = true;
 
-	struct cldap_socket *cldap = cldap_socket_init(ctx, NULL);
+	struct cldap_socket *cldap = cldap_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	struct cldap_netlogon search;
 	
 	r.in.bind_handle		= &ctx->admin.drsuapi.bind_handle;
diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
index 9d6c73891b..1d6ec43399 100644
--- a/source4/torture/rpc/samr.c
+++ b/source4/torture/rpc/samr.c
@@ -416,11 +416,6 @@ static bool test_SetUserInfo(struct dcerpc_pipe *p, struct torture_context *tctx
 	TEST_USERINFO_INT(21, logon_hours.bits[3], 21, logon_hours.bits[3], 4, 
 			  SAMR_FIELD_LOGON_HOURS);
 
-	if (torture_setting_bool(tctx, "samba4", false)) {
-		printf("skipping Set Account Flag tests against Samba4\n");
-		return ret;
-	}
-
 	TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags, 
 			      (base_acct_flags  | ACB_DISABLED | ACB_HOMDIRREQ), 
 			      (base_acct_flags  | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags), 
@@ -1989,9 +1984,12 @@ static bool test_user_ops(struct dcerpc_pipe *p,
 			  const char *base_acct_name, enum torture_samr_choice which_ops)
 {
 	char *password = NULL;
+	struct samr_QueryUserInfo q;
+	NTSTATUS status;
 
 	bool ret = true;
 	int i;
+	uint32_t rid;
 	const uint32_t password_fields[] = {
 		SAMR_FIELD_PASSWORD,
 		SAMR_FIELD_PASSWORD2,
@@ -1999,6 +1997,11 @@ static bool test_user_ops(struct dcerpc_pipe *p,
 		0
 	};
 	
+	status = test_LookupName(p, tctx, domain_handle, base_acct_name, &rid);
+	if (!NT_STATUS_IS_OK(status)) {
+		ret = false;
+	}
+
 	switch (which_ops) {
 	case TORTURE_SAMR_USER_ATTRIBUTES:
 		if (!test_QuerySecurity(p, tctx, user_handle)) {
@@ -2091,6 +2094,29 @@ static bool test_user_ops(struct dcerpc_pipe *p,
 			ret = false;
 		}	
 
+		q.in.user_handle = user_handle;
+		q.in.level = 5;
+		
+		status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
+		if (!NT_STATUS_IS_OK(status)) {
+			printf("QueryUserInfo level %u failed - %s\n", 
+			       q.in.level, nt_errstr(status));
+			ret = false;
+		} else {
+			uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
+			if ((q.out.info->info5.acct_flags) != expected_flags) {
+				printf("QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
+				       q.out.info->info5.acct_flags, 
+				       expected_flags);
+				ret = false;
+			}
+			if (q.out.info->info5.rid != rid) {
+				printf("QuerUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
+				       q.out.info->info5.rid, rid);
+
+			}
+		}
+
 		break;
 	case TORTURE_SAMR_OTHER:
 		/* We just need the account to exist */
@@ -2667,10 +2693,14 @@ static bool test_CreateUser2(struct dcerpc_pipe *p, struct torture_context *tctx
 				       q.in.level, nt_errstr(status));
 				ret = false;
 			} else {
-				if ((q.out.info->info5.acct_flags & acct_flags) != acct_flags) {
+				uint32_t expected_flags = (acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
+				if (acct_flags == ACB_NORMAL) {
+					expected_flags |= ACB_PW_EXPIRED;
+				}
+				if ((q.out.info->info5.acct_flags) != expected_flags) {
 					printf("QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
 					       q.out.info->info5.acct_flags, 
-					       acct_flags);
+					       expected_flags);
 					ret = false;
 				} 
 				switch (acct_flags) {
@@ -3887,7 +3917,6 @@ static bool test_GroupList(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			for (j=0; j<num_names; j++) {
 				if (names[j] == NULL)
 					continue;
-				/* Hmm. No strequal in samba4 */
 				if (strequal(names[j], name)) {
 					names[j] = NULL;
 					found = true;
diff --git a/source4/torture/t_strcmp.c b/source4/torture/t_strcmp.c
deleted file mode 100644
index 15d000c98f..0000000000
--- a/source4/torture/t_strcmp.c
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) 2003 by Martin Pool
- *
- * Test harness for strcasecmp_m
- */
-
-#include "includes.h"
-
-int main(int argc, char *argv[])
-{
-	if (argc != 3) {
-		fprintf(stderr, "usage: %s STRING1 STRING2\nCompares two strings\n",
-			argv[0]);
-		return 2;
-	}
-	
-	printf("%d\n", strcasecmp_m(argv[1], argv[2]));
-	
-	return 0;
-}
diff --git a/source4/utils/nmblookup.c b/source4/utils/nmblookup.c
index 7eae9c7765..fe03e0dbbe 100644
--- a/source4/utils/nmblookup.c
+++ b/source4/utils/nmblookup.c
@@ -211,7 +211,7 @@ static bool process_one(struct loadparm_context *lp_ctx,
 		node_name = talloc_strdup(tmp_ctx, name);
 	}
 
-	nbtsock = nbt_name_socket_init(tmp_ctx, NULL);
+	nbtsock = nbt_name_socket_init(tmp_ctx, NULL, lp_iconv_convenience(lp_ctx));
 	
 	if (options.root_port) {
 		all_zero_addr = socket_address_from_strings(tmp_ctx, nbtsock->sock->backend_name, 
diff --git a/source4/utils/testparm.c b/source4/utils/testparm.c
index a4ff522186..286a4a61fb 100644
--- a/source4/utils/testparm.c
+++ b/source4/utils/testparm.c
@@ -93,8 +93,8 @@ static int do_share_checks(struct loadparm_context *lp_ctx, const char *cname, c
 	for (s=0;s<lp_numservices(lp_ctx);s++) {
 		struct loadparm_service *service = lp_servicebynum(lp_ctx, s);
 		if (service != NULL) {
-			const char **deny_list = lp_hostsdeny(service);
-			const char **allow_list = lp_hostsallow(service);
+			const char **deny_list = lp_hostsdeny(service, lp_default_service(lp_ctx));
+			const char **allow_list = lp_hostsallow(service, lp_default_service(lp_ctx));
 			int i;
 			if(deny_list) {
 				for (i=0; deny_list[i]; i++) {
@@ -139,7 +139,7 @@ static int do_share_checks(struct loadparm_context *lp_ctx, const char *cname, c
 					return(1);
 			}
 			if (!parameter_name) {
-				lp_dump_one(stdout, show_defaults, service);
+				lp_dump_one(stdout, show_defaults, service, lp_default_service(lp_ctx));
 			} else {
 				ret = !lp_dump_a_parameter(lp_ctx, service, parameter_name, stdout);
 			}
@@ -154,8 +154,8 @@ static int do_share_checks(struct loadparm_context *lp_ctx, const char *cname, c
 		for (s=0;s<lp_numservices(lp_ctx);s++) {
 			struct loadparm_service *service = lp_servicebynum(lp_ctx, s);
 			if (service != NULL) {
-				if (allow_access(NULL, lp_hostsdeny(NULL), lp_hostsallow(NULL), cname, caddr)
-				    && allow_access(NULL, lp_hostsdeny(service), lp_hostsallow(service), cname, caddr)) {
+				if (allow_access(NULL, lp_hostsdeny(NULL, lp_default_service(lp_ctx)), lp_hostsallow(NULL, lp_default_service(lp_ctx)), cname, caddr)
+				    && allow_access(NULL, lp_hostsdeny(service, lp_default_service(lp_ctx)), lp_hostsallow(service, lp_default_service(lp_ctx)), cname, caddr)) {
 					fprintf(stderr,"Allow connection from %s (%s) to %s\n",
 						   cname,caddr,lp_servicename(service));
 				} else {
diff --git a/source4/winbind/wb_dom_info.c b/source4/winbind/wb_dom_info.c
index 7558fc9d62..4fcbf3a6e5 100644
--- a/source4/winbind/wb_dom_info.c
+++ b/source4/winbind/wb_dom_info.c
@@ -71,6 +71,7 @@ struct composite_context *wb_get_dom_info_send(TALLOC_CTX *mem_ctx,
 			   lp_nbt_port(service->task->lp_ctx),
 			   domain_name, NBT_NAME_LOGON, 
 			   dom_sid, 
+			   lp_iconv_convenience(service->task->lp_ctx),
 			   lp_resolve_context(service->task->lp_ctx), 
 			   service->task->event_ctx, 
 			   service->task->msg_ctx);
diff --git a/source4/winbind/wb_pam_auth.c b/source4/winbind/wb_pam_auth.c
index 0073e3fdf8..62744297c6 100644
--- a/source4/winbind/wb_pam_auth.c
+++ b/source4/winbind/wb_pam_auth.c
@@ -143,7 +143,7 @@ static void pam_auth_crap_recv_logon(struct composite_context *ctx)
 	if (!composite_is_ok(state->ctx)) return;
 
 	ndr_err = ndr_push_struct_blob(
-		&tmp_blob, state, lp_iconv_convenience(global_loadparm), 
+		&tmp_blob, state, lp_iconv_convenience(state->lp_ctx), 
 		state->req->out.validation.sam3,
 		(ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
diff --git a/source4/wrepl_server/wrepl_out_helpers.c b/source4/wrepl_server/wrepl_out_helpers.c
index f809095f22..12605196ab 100644
--- a/source4/wrepl_server/wrepl_out_helpers.c
+++ b/source4/wrepl_server/wrepl_out_helpers.c
@@ -30,6 +30,7 @@
 #include "libcli/composite/composite.h"
 #include "libcli/wrepl/winsrepl.h"
 #include "libcli/resolve/resolve.h"
+#include "param/param.h"
 
 enum wreplsrv_out_connect_stage {
 	WREPLSRV_OUT_CONNECT_STAGE_WAIT_SOCKET,
@@ -186,14 +187,14 @@ static struct composite_context *wreplsrv_out_connect_send(struct wreplsrv_partn
 
 	wreplconn->service	= service;
 	wreplconn->partner	= partner;
-	wreplconn->sock		= wrepl_socket_init(wreplconn, service->task->event_ctx);
+	wreplconn->sock		= wrepl_socket_init(wreplconn, service->task->event_ctx, lp_iconv_convenience(service->task->lp_ctx));
 	if (!wreplconn->sock) goto failed;
 
 	state->stage	= WREPLSRV_OUT_CONNECT_STAGE_WAIT_SOCKET;
 	state->wreplconn= wreplconn;
 	state->c_req	= wrepl_connect_send(wreplconn->sock,
 					     lp_resolve_context(service->task->lp_ctx),
-					     partner->our_address,
+					     partner->our_address?partner->our_address:wrepl_best_ip(service->task->lp_ctx, partner->address),
 					     partner->address);
 	if (!state->c_req) goto failed;