Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-local

(This used to be commit a555334db67527b57bc6172e3d08f65caf1e6760)

54 files changed, 2080 insertions, 1213 deletions

diff --git a/source4/cldap_server/netlogon.c b/source4/cldap_server/netlogon.c
index f263f33d48..0b146b3c7d 100644
--- a/source4/cldap_server/netlogon.c
+++ b/source4/cldap_server/netlogon.c
@@ -71,6 +71,7 @@ NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
 	struct ldb_dn *partitions_basedn;
 	struct interface *ifaces;
 	bool user_known;
+	NTSTATUS status;
 
 	partitions_basedn = samdb_partitions_dn(sam_ctx, mem_ctx);
 
@@ -87,7 +88,7 @@ NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
 					 partitions_basedn, LDB_SCOPE_ONELEVEL, 
 					 ref_attrs, 
 					 "(&(&(objectClass=crossRef)(dnsRoot=%s))(nETBIOSName=*))",
-					 domain);
+					 ldb_binary_encode_string(mem_ctx, domain));
 	
 		if (ret != LDB_SUCCESS) {
 			DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
@@ -126,7 +127,7 @@ NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
 					 partitions_basedn, LDB_SCOPE_ONELEVEL, 
 					 ref_attrs, 
 					 "(&(objectClass=crossRef)(ncName=*)(nETBIOSName=%s))",
-					 netbios_domain);
+					 ldb_binary_encode_string(mem_ctx, netbios_domain));
 	
 		if (ret != LDB_SUCCESS) {
 			DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
@@ -161,17 +162,45 @@ NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
 		ref_res = NULL;
 
 		if (domain_guid) {
+			struct GUID binary_guid;
+			struct ldb_val guid_val;
+			enum ndr_err_code ndr_err;
+
+			/* By this means, we ensure we don't have funny stuff in the GUID */
+
+			status = GUID_from_string(domain_guid, &binary_guid);
+			if (!NT_STATUS_IS_OK(status)) {
+				return status;
+			}
+
+			/* And this gets the result into the binary format we want anyway */
+			ndr_err = ndr_push_struct_blob(&guid_val, mem_ctx, NULL, &binary_guid,
+						       (ndr_push_flags_fn_t)ndr_push_GUID);
+			if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+				return NT_STATUS_INVALID_PARAMETER;
+			}
 			ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &dom_res,
 						 NULL, LDB_SCOPE_SUBTREE, 
 						 dom_attrs, 
-						 "(&(objectClass=domainDNS)(objectGUID=%s))", 
-						 domain_guid);
+						 "(&(objectCategory=DomainDNS)(objectGUID=%s))", 
+						 ldb_binary_encode(mem_ctx, guid_val));
 		} else { /* domain_sid case */
+			struct dom_sid *sid;
+			struct ldb_val sid_val;
+			enum ndr_err_code ndr_err;
+			
+			/* Rather than go via the string, just push into the NDR form */
+			ndr_err = ndr_push_struct_blob(&sid_val, mem_ctx, NULL, &sid,
+						       (ndr_push_flags_fn_t)ndr_push_dom_sid);
+			if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+				return NT_STATUS_INVALID_PARAMETER;
+			}
+
 			ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &dom_res,
 						 NULL, LDB_SCOPE_SUBTREE, 
 						 dom_attrs, 
-						 "(&(objectClass=domainDNS)(objectSID=%s))", 
-						 dom_sid_string(mem_ctx, domain_sid));
+						 "(&(objectCategory=DomainDNS)(objectSID=%s))", 
+						 ldb_binary_encode(mem_ctx, sid_val));
 		}
 		
 		if (ret != LDB_SUCCESS) {
@@ -237,7 +266,8 @@ NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
 					 "(&(objectClass=user)(samAccountName=%s)"
 					 "(!(userAccountControl:" LDB_OID_COMPARATOR_AND ":=%u))"
 					 "(userAccountControl:" LDB_OID_COMPARATOR_OR ":=%u))", 
-					 user, UF_ACCOUNTDISABLE, samdb_acb2uf(acct_control));
+					 ldb_binary_encode_string(mem_ctx, user),
+					 UF_ACCOUNTDISABLE, samdb_acb2uf(acct_control));
 		if (ret != LDB_SUCCESS) {
 			DEBUG(2,("Unable to find referece to user '%s' with ACB 0x%8x under %s: %s\n",
 				 user, acct_control, ldb_dn_get_linearized(dom_res->msgs[0]->dn),
@@ -256,7 +286,8 @@ NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
 	server_type      = 
 		NBT_SERVER_DS | NBT_SERVER_TIMESERV |
 		NBT_SERVER_CLOSEST | NBT_SERVER_WRITABLE | 
-		NBT_SERVER_GOOD_TIMESERV;
+		NBT_SERVER_GOOD_TIMESERV | NBT_SERVER_DS_DNS_CONTR |
+		NBT_SERVER_DS_DNS_DOMAIN;
 
 	if (samdb_is_pdc(sam_ctx)) {
 		server_type |= NBT_SERVER_PDC;
@@ -274,6 +305,10 @@ NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
 		server_type |= NBT_SERVER_KDC;
 	}
 
+	if (!ldb_dn_compare_base(ldb_get_root_basedn(sam_ctx), ldb_get_default_basedn(sam_ctx))) {
+		server_type |= NBT_SERVER_DS_DNS_FOREST;
+	}
+
 	pdc_name         = talloc_asprintf(mem_ctx, "\\\\%s", lp_netbios_name(lp_ctx));
 	domain_uuid      = samdb_result_guid(dom_res->msgs[0], "objectGUID");
 	realm            = samdb_result_string(ref_res->msgs[0], "dnsRoot", lp_realm(lp_ctx));
@@ -285,6 +320,7 @@ NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
 
 	flatname         = samdb_result_string(ref_res->msgs[0], "nETBIOSName", 
 					       lp_workgroup(lp_ctx));
+	/* FIXME: Hardcoded site names */
 	server_site      = "Default-First-Site-Name";
 	client_site      = "Default-First-Site-Name";
 	load_interfaces(mem_ctx, lp_interfaces(lp_ctx), &ifaces);
diff --git a/source4/dsdb/common/flags.h b/source4/dsdb/common/flags.h
index e8802fdf9c..bdd61a363c 100644
--- a/source4/dsdb/common/flags.h
+++ b/source4/dsdb/common/flags.h
@@ -119,6 +119,17 @@
 #define SYSTEM_FLAG_CONFIG_ALLOW_RENAME		0x40000000
 #define SYSTEM_FLAG_DISALLOW_DELTE		0x80000000
 
+#define SEARCH_FLAG_ATTINDEX            0x0000001
+#define SEARCH_FLAG_PDNTATTINDEX        0x0000002
+#define SEARCH_FLAG_ANR                 0x0000004
+#define SEARCH_FLAG_PRESERVEONDELETE    0x0000008
+#define SEARCH_FLAG_COPY                0x0000010
+#define SEARCH_FLAG_TUPLEINDEX          0x0000020
+#define SEARCH_FLAG_SUBTREEATTRINDEX    0x0000040
+#define SEARCH_FLAG_CONFIDENTIAL        0x0000080
+#define SEARCH_FLAG_NEVERVALUEAUDIT     0x0000100
+#define SEARCH_FLAG_RODC_ATTRIBUTE      0x0000200
+
 #define DS_BEHAVIOR_WIN2000		0
 #define DS_BEHAVIOR_WIN2003_INTERIM	1
 #define DS_BEHAVIOR_WIN2003		2
diff --git a/source4/dsdb/config.mk b/source4/dsdb/config.mk
index ae35078537..63e8a77ce4 100644
--- a/source4/dsdb/config.mk
+++ b/source4/dsdb/config.mk
@@ -34,6 +34,8 @@ PRIVATE_DEPENDENCIES = SAMDB_COMMON NDR_DRSUAPI NDR_DRSBLOBS
 
 SAMDB_SCHEMA_OBJ_FILES = $(addprefix $(dsdbsrcdir)/schema/, \
 		schema_init.o \
+		schema_set.o \
+		schema_query.o \
 		schema_syntax.o \
 		schema_description.o)
 
diff --git a/source4/dsdb/repl/drepl_out_helpers.c b/source4/dsdb/repl/drepl_out_helpers.c
index 3629a3b92b..80b398ef5c 100644
--- a/source4/dsdb/repl/drepl_out_helpers.c
+++ b/source4/dsdb/repl/drepl_out_helpers.c
@@ -314,27 +314,35 @@ static void dreplsrv_op_pull_source_get_changes_recv(struct rpc_request *req)
 	if (*r->out.level == 1) {
 		ctr_level = 1;
 		ctr1 = &r->out.ctr.ctr1;
-	} else if (*r->out.level == 2) {
+	} else if (*r->out.level == 2 &&
+		   r->out.ctr.ctr2.mszip1.ts) {
 		ctr_level = 1;
-		ctr1 = r->out.ctr.ctr2.mszip1.ctr1;
+		ctr1 = &r->out.ctr.ctr2.mszip1.ts->ctr1;
 	} else if (*r->out.level == 6) {
 		ctr_level = 6;
 		ctr6 = &r->out.ctr.ctr6;
 	} else if (*r->out.level == 7 &&
 		   r->out.ctr.ctr7.level == 6 &&
-		   r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP) {
+		   r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP &&
+		   r->out.ctr.ctr7.ctr.mszip6.ts) {
 		ctr_level = 6;
-		ctr6 = r->out.ctr.ctr7.ctr.mszip6.ctr6;
+		ctr6 = &r->out.ctr.ctr7.ctr.mszip6.ts->ctr6;
 	} else if (*r->out.level == 7 &&
 		   r->out.ctr.ctr7.level == 6 &&
-		   r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS) {
+		   r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS &&
+		   r->out.ctr.ctr7.ctr.xpress6.ts) {
 		ctr_level = 6;
-		ctr6 = r->out.ctr.ctr7.ctr.xpress6.ctr6;
+		ctr6 = &r->out.ctr.ctr7.ctr.xpress6.ts->ctr6;
 	} else {
 		composite_error(c, werror_to_ntstatus(WERR_BAD_NET_RESP));
 		return;
 	}
 
+	if (!ctr1 && !ctr6) {
+		composite_error(c, werror_to_ntstatus(WERR_BAD_NET_RESP));
+		return;
+	}
+
 	if (ctr_level == 6) {
 		if (!W_ERROR_IS_OK(ctr6->drs_error)) {
 			composite_error(c, werror_to_ntstatus(ctr6->drs_error));
diff --git a/source4/dsdb/samdb/ldb_modules/anr.c b/source4/dsdb/samdb/ldb_modules/anr.c
index 1252c9ee42..4e2c527fe9 100644
--- a/source4/dsdb/samdb/ldb_modules/anr.c
+++ b/source4/dsdb/samdb/ldb_modules/anr.c
@@ -146,7 +146,7 @@ struct ldb_parse_tree *anr_replace_callback(TALLOC_CTX *mem_ctx,
 		op = LDB_OP_SUBSTRING;
 	}
 	for (cur = schema->attributes; cur; cur = cur->next) {
-		if (!(cur->searchFlags & 0x4)) continue;
+		if (!(cur->searchFlags & SEARCH_FLAG_ANR)) continue;
 		match_tree = make_match_tree(module, mem_ctx, op, cur->lDAPDisplayName, match);
 
 		if (tree) {
@@ -224,30 +224,26 @@ struct ldb_parse_tree *anr_replace_subtrees(struct ldb_parse_tree *tree,
 					    void *context)
 {
 	int i;
+	struct ldb_parse_tree *tmp;
+
 	switch (tree->operation) {
 	case LDB_OP_AND:
 	case LDB_OP_OR:
 		for (i=0;i<tree->u.list.num_elements;i++) {
-			tree->u.list.elements[i] = anr_replace_subtrees(tree->u.list.elements[i],
-									attr, callback, context);
-			if (!tree->u.list.elements[i]) {
-				return NULL;
-			}
+			tmp = anr_replace_subtrees(tree->u.list.elements[i],
+						   attr, callback, context);
+			if (tmp) tree->u.list.elements[i] = tmp;
 		}
 		break;
 	case LDB_OP_NOT:
-		tree->u.isnot.child = anr_replace_subtrees(tree->u.isnot.child, attr, callback, context);
-			if (!tree->u.isnot.child) {
-				return NULL;
-			}
+		tmp = anr_replace_subtrees(tree->u.isnot.child, attr, callback, context);
+		if (tmp) tree->u.isnot.child = tmp;
 		break;
 	case LDB_OP_EQUALITY:
 		if (ldb_attr_cmp(tree->u.equality.attr, attr) == 0) {
-			tree = callback(tree, &tree->u.equality.value, 
+			tmp = callback(tree, &tree->u.equality.value, 
 					context);
-			if (!tree) {
-				return NULL;
-			}
+			if (tmp) tree = tmp;
 		}
 		break;
 	case LDB_OP_SUBSTRING:
@@ -256,10 +252,8 @@ struct ldb_parse_tree *anr_replace_subtrees(struct ldb_parse_tree *tree,
 			    tree->u.substring.end_with_wildcard == 1 && 
 			    tree->u.substring.chunks[0] != NULL && 
 			    tree->u.substring.chunks[1] == NULL) {
-				tree = callback(tree, tree->u.substring.chunks[0], context);
-				if (!tree) {
-					return NULL;
-				}
+				tmp = callback(tree, tree->u.substring.chunks[0], context);
+				if (tmp) tree = tmp;
 			}
 		}
 		break;
@@ -280,17 +274,29 @@ static int anr_search(struct ldb_module *module, struct ldb_request *req)
 	context->module = module;
 	context->found_anr = false;
 
+#if 0
+	printf("oldanr : %s\n", ldb_filter_from_tree (0, req->op.search.tree));
+#endif
+
 	/* Yes, this is a problem with req->op.search.tree being const... */
 	anr_tree = anr_replace_subtrees(req->op.search.tree, "anr", anr_replace_callback, context);
 	if (!anr_tree) {
+		talloc_free(context);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	if (context->found_anr) {
 		/* The above function modifies the tree if it finds "anr", so no
 		 * point just setting this on the down_req */
+#if 0
+		printf("newtree: %s\n", ldb_filter_from_tree (0, anr_tree));
+#endif
 		req->op.search.tree = talloc_steal(req, anr_tree);
-
+	} else {
+		if (anr_tree != req->op.search.tree) {
+			talloc_free(anr_tree);
+		}
+		talloc_free(context);
 	}
 	return ldb_next_request(module, req);
 }
diff --git a/source4/dsdb/samdb/ldb_modules/linked_attributes.c b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
index 04b9987071..e64472432d 100644
--- a/source4/dsdb/samdb/ldb_modules/linked_attributes.c
+++ b/source4/dsdb/samdb/ldb_modules/linked_attributes.c
@@ -160,7 +160,7 @@ static int setup_modifies(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
 				ldb_oom(ldb);
 				return LDB_ERR_OPERATIONS_ERROR;
 			}
-			new_msg->dn = ldb_dn_new(new_msg, ldb, (char *)el->values[j].data);
+			new_msg->dn = ldb_dn_from_ldb_val(new_msg, ldb, &el->values[j]);
 			if (!new_msg->dn) {
 				ldb_asprintf_errstring(ldb, 
 						       "attribute %s value %s was not a valid DN", msg->elements[i].name,
@@ -330,7 +330,7 @@ static int linked_attributes_mod_replace_search_callback(struct ldb_context *ldb
 			/* Add all the existing elements, marking as 'proposed for delete' by setting .add = false */
 			for (i=0; i < search_el->num_values; i++) {
 				merged_list = talloc_realloc(ares, merged_list, struct merge, size + 1);
-				merged_list[size].dn = ldb_dn_new(merged_list, ldb, (char *)search_el->values[i].data);
+				merged_list[size].dn = ldb_dn_from_ldb_val(merged_list, ldb, &search_el->values[i]);
 				merged_list[size].add = false;
 				merged_list[size].ignore = false;
 				size++;
@@ -339,7 +339,7 @@ static int linked_attributes_mod_replace_search_callback(struct ldb_context *ldb
 			/* Add all the new replacement elements, marking as 'proposed for add' by setting .add = true */
 			for (i=0; i < ac2->el->num_values; i++) {
 				merged_list = talloc_realloc(ares, merged_list, struct merge, size + 1);
-				merged_list[size].dn = ldb_dn_new(merged_list, ldb, (char *)ac2->el->values[i].data);
+				merged_list[size].dn = ldb_dn_from_ldb_val(merged_list, ldb, &ac2->el->values[i]);
 				merged_list[size].add = true;
 				merged_list[size].ignore = false;
 				size++;
@@ -610,7 +610,7 @@ static int linked_attributes_modify(struct ldb_module *module, struct ldb_reques
 				ldb_oom(module->ldb);
 				return LDB_ERR_OPERATIONS_ERROR;
 			}
-			new_msg->dn = ldb_dn_new(new_msg, module->ldb, (char *)el->values[j].data);
+			new_msg->dn = ldb_dn_from_ldb_val(new_msg, module->ldb, &el->values[j]);
 			if (!new_msg->dn) {
 				ldb_asprintf_errstring(module->ldb, 
 					       "attribute %s value %s was not a valid DN", req->op.mod.message->elements[i].name,
diff --git a/source4/dsdb/samdb/ldb_modules/normalise.c b/source4/dsdb/samdb/ldb_modules/normalise.c
index 8de9e33002..3306fd3c33 100644
--- a/source4/dsdb/samdb/ldb_modules/normalise.c
+++ b/source4/dsdb/samdb/ldb_modules/normalise.c
@@ -112,7 +112,7 @@ static int normalise_search_callback(struct ldb_context *ldb, void *context, str
 		}
 		for (j = 0; j < ares->message->elements[i].num_values; j++) {
 			const char *dn_str;
-			struct ldb_dn *dn = ldb_dn_new(mem_ctx, ldb, (const char *)ares->message->elements[i].values[j].data);
+			struct ldb_dn *dn = ldb_dn_from_ldb_val(mem_ctx, ldb, &ares->message->elements[i].values[j]);
 			if (!dn) {
 				talloc_free(mem_ctx);
 				return LDB_ERR_OPERATIONS_ERROR;
diff --git a/source4/dsdb/samdb/ldb_modules/partition.c b/source4/dsdb/samdb/ldb_modules/partition.c
index 9285d6d0d8..9cae6ab7b5 100644
--- a/source4/dsdb/samdb/ldb_modules/partition.c
+++ b/source4/dsdb/samdb/ldb_modules/partition.c
@@ -925,7 +925,7 @@ static int partition_init(struct ldb_module *module)
 		}
 		
 		for (i=0; i < replicate_attributes->num_values; i++) {
-			data->replicate[i] = ldb_dn_new(data->replicate, module->ldb, (const char *)replicate_attributes->values[i].data);
+			data->replicate[i] = ldb_dn_from_ldb_val(data->replicate, module->ldb, &replicate_attributes->values[i]);
 			if (!ldb_dn_validate(data->replicate[i])) {
 				ldb_asprintf_errstring(module->ldb, 
 							"partition_init: "
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index 88590f306b..bd491bd011 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -768,6 +768,10 @@ static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
 	struct ldb_message_element *el, *el2;
 	int ret;
 	unsigned int group_type, user_account_control, account_type;
+	if (ldb_dn_is_special(req->op.mod.message->dn)) { /* do not manipulate our control entries */
+		return ldb_next_request(module, req);
+	}
+
 	if (ldb_msg_find_element(req->op.mod.message, "sAMAccountType") != NULL) {
 		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
 		return LDB_ERR_UNWILLING_TO_PERFORM;
diff --git a/source4/dsdb/samdb/ldb_modules/schema_syntax.c b/source4/dsdb/samdb/ldb_modules/schema_syntax.c
index d800e4b6d2..ab9f32c913 100644
--- a/source4/dsdb/samdb/ldb_modules/schema_syntax.c
+++ b/source4/dsdb/samdb/ldb_modules/schema_syntax.c
@@ -248,7 +248,7 @@ static int schema_validate_dn(struct ldb_context *ldb, struct ldb_val *val, int
 	struct ldb_dn *dn;
 	int ret = LDB_SUCCESS;
 
-	dn = ldb_dn_new(ldb, ldb, (const char *)val->data);
+	dn = ldb_dn_from_ldb_val(ldb, ldb, val);
 	if ( ! ldb_dn_validate(dn)) {
 		ret = LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
 	}
diff --git a/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c b/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c
index 6e967aab2f..8f92995145 100644
--- a/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c
+++ b/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c
@@ -154,7 +154,7 @@ static struct ldb_val objectCategory_always_dn(struct ldb_module *module, TALLOC
 	struct ldb_val out = data_blob(NULL, 0);
 	const struct ldb_schema_attribute *a = ldb_schema_attribute_by_name(module->ldb, "objectCategory");
 
-	dn = ldb_dn_new(ctx, module->ldb, val->data);
+	dn = ldb_dn_from_ldb_val(ctx, module->ldb, val);
 	if (dn && ldb_dn_validate(dn)) {
 		talloc_free(dn);
 		return val_copy(module, ctx, val);
diff --git a/source4/dsdb/schema/schema_init.c b/source4/dsdb/schema/schema_init.c
index 73be580347..3ed7daee59 100644
--- a/source4/dsdb/schema/schema_init.c
+++ b/source4/dsdb/schema/schema_init.c
@@ -1409,548 +1409,3 @@ WERROR dsdb_class_from_drsuapi(struct dsdb_schema *schema,
 	return WERR_OK;
 }
 
-const struct dsdb_attribute *dsdb_attribute_by_attributeID_id(const struct dsdb_schema *schema,
-							      uint32_t id)
-{
-	struct dsdb_attribute *cur;
-
-	/*
-	 * 0xFFFFFFFF is used as value when no mapping table is available,
-	 * so don't try to match with it
-	 */
-	if (id == 0xFFFFFFFF) return NULL;
-
-	/* TODO: add binary search */
-	for (cur = schema->attributes; cur; cur = cur->next) {
-		if (cur->attributeID_id != id) continue;
-
-		return cur;
-	}
-
-	return NULL;
-}
-
-const struct dsdb_attribute *dsdb_attribute_by_attributeID_oid(const struct dsdb_schema *schema,
-							       const char *oid)
-{
-	struct dsdb_attribute *cur;
-
-	if (!oid) return NULL;
-
-	/* TODO: add binary search */
-	for (cur = schema->attributes; cur; cur = cur->next) {
-		if (strcmp(cur->attributeID_oid, oid) != 0) continue;
-
-		return cur;
-	}
-
-	return NULL;
-}
-
-const struct dsdb_attribute *dsdb_attribute_by_lDAPDisplayName(const struct dsdb_schema *schema,
-							       const char *name)
-{
-	struct dsdb_attribute *cur;
-
-	if (!name) return NULL;
-
-	/* TODO: add binary search */
-	for (cur = schema->attributes; cur; cur = cur->next) {
-		if (strcasecmp(cur->lDAPDisplayName, name) != 0) continue;
-
-		return cur;
-	}
-
-	return NULL;
-}
-
-const struct dsdb_attribute *dsdb_attribute_by_linkID(const struct dsdb_schema *schema,
-						      int linkID)
-{
-	struct dsdb_attribute *cur;
-
-	/* TODO: add binary search */
-	for (cur = schema->attributes; cur; cur = cur->next) {
-		if (cur->linkID != linkID) continue;
-
-		return cur;
-	}
-
-	return NULL;
-}
-
-const struct dsdb_class *dsdb_class_by_governsID_id(const struct dsdb_schema *schema,
-						    uint32_t id)
-{
-	struct dsdb_class *cur;
-
-	/*
-	 * 0xFFFFFFFF is used as value when no mapping table is available,
-	 * so don't try to match with it
-	 */
-	if (id == 0xFFFFFFFF) return NULL;
-
-	/* TODO: add binary search */
-	for (cur = schema->classes; cur; cur = cur->next) {
-		if (cur->governsID_id != id) continue;
-
-		return cur;
-	}
-
-	return NULL;
-}
-
-const struct dsdb_class *dsdb_class_by_governsID_oid(const struct dsdb_schema *schema,
-						     const char *oid)
-{
-	struct dsdb_class *cur;
-
-	if (!oid) return NULL;
-
-	/* TODO: add binary search */
-	for (cur = schema->classes; cur; cur = cur->next) {
-		if (strcmp(cur->governsID_oid, oid) != 0) continue;
-
-		return cur;
-	}
-
-	return NULL;
-}
-
-const struct dsdb_class *dsdb_class_by_lDAPDisplayName(const struct dsdb_schema *schema,
-						       const char *name)
-{
-	struct dsdb_class *cur;
-
-	if (!name) return NULL;
-
-	/* TODO: add binary search */
-	for (cur = schema->classes; cur; cur = cur->next) {
-		if (strcasecmp(cur->lDAPDisplayName, name) != 0) continue;
-
-		return cur;
-	}
-
-	return NULL;
-}
-
-const struct dsdb_class *dsdb_class_by_cn(const struct dsdb_schema *schema,
-					  const char *cn)
-{
-	struct dsdb_class *cur;
-
-	if (!cn) return NULL;
-
-	/* TODO: add binary search */
-	for (cur = schema->classes; cur; cur = cur->next) {
-		if (strcasecmp(cur->cn, cn) != 0) continue;
-
-		return cur;
-	}
-
-	return NULL;
-}
-
-const char *dsdb_lDAPDisplayName_by_id(const struct dsdb_schema *schema,
-				       uint32_t id)
-{
-	const struct dsdb_attribute *a;
-	const struct dsdb_class *c;
-
-	/* TODO: add binary search */
-	a = dsdb_attribute_by_attributeID_id(schema, id);
-	if (a) {
-		return a->lDAPDisplayName;
-	}
-
-	c = dsdb_class_by_governsID_id(schema, id);
-	if (c) {
-		return c->lDAPDisplayName;
-	}
-
-	return NULL;
-}
-
-/** 
-    Return a list of linked attributes, in lDAPDisplayName format.
-
-    This may be used to determine if a modification would require
-    backlinks to be updated, for example
-*/
-
-WERROR dsdb_linked_attribute_lDAPDisplayName_list(const struct dsdb_schema *schema, TALLOC_CTX *mem_ctx, const char ***attr_list_ret)
-{
-	const char **attr_list = NULL;
-	struct dsdb_attribute *cur;
-	int i = 0;
-	for (cur = schema->attributes; cur; cur = cur->next) {
-		if (cur->linkID == 0) continue;
-		
-		attr_list = talloc_realloc(mem_ctx, attr_list, const char *, i+2);
-		if (!attr_list) {
-			return WERR_NOMEM;
-		}
-		attr_list[i] = cur->lDAPDisplayName;
-		i++;
-	}
-	attr_list[i] = NULL;
-	*attr_list_ret = attr_list;
-	return WERR_OK;
-}
-
-char **merge_attr_list(TALLOC_CTX *mem_ctx, 
-		       char **attrs, const char **new_attrs) 
-{
-	char **ret_attrs;
-	int i;
-	size_t new_len, orig_len = str_list_length((const char **)attrs);
-	if (!new_attrs) {
-		return attrs;
-	}
-
-	ret_attrs = talloc_realloc(mem_ctx, 
-				   attrs, char *, orig_len + str_list_length(new_attrs) + 1);
-	if (ret_attrs) {
-		for (i=0; i < str_list_length(new_attrs); i++) {
-			ret_attrs[orig_len + i] = new_attrs[i];
-		}
-		new_len = orig_len + str_list_length(new_attrs);
-
-		ret_attrs[new_len] = NULL;
-	}
-
-	return ret_attrs;
-}
-
-/*
-  Return a merged list of the attributes of exactly one class (not
-  considering subclasses, auxillary classes etc)
-*/
-
-char **dsdb_attribute_list(TALLOC_CTX *mem_ctx, const struct dsdb_class *class, enum dsdb_attr_list_query query)
-{
-	char **attr_list = NULL;
-	switch (query) {
-	case DSDB_SCHEMA_ALL_MAY:
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->mayContain);
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMayContain);
-		break;
-		
-	case DSDB_SCHEMA_ALL_MUST:
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->mustContain);
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMustContain);
-		break;
-		
-	case DSDB_SCHEMA_SYS_MAY:
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMayContain);
-		break;
-		
-	case DSDB_SCHEMA_SYS_MUST:
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMustContain);
-		break;
-		
-	case DSDB_SCHEMA_MAY:
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->mayContain);
-		break;
-		
-	case DSDB_SCHEMA_MUST:
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->mustContain);
-		break;
-		
-	case DSDB_SCHEMA_ALL:
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->mayContain);
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMayContain);
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->mustContain);
-		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMustContain);
-		break;
-	}
-	return attr_list;
-}
-
-static char **dsdb_full_attribute_list_internal(TALLOC_CTX *mem_ctx, 
-						const struct dsdb_schema *schema, 
-						const char **class_list,
-						enum dsdb_attr_list_query query)
-{
-	int i;
-	const struct dsdb_class *class;
-	
-	char **attr_list = NULL;
-	char **this_class_list;
-	char **recursive_list;
-
-	for (i=0; class_list && class_list[i]; i++) {
-		class = dsdb_class_by_lDAPDisplayName(schema, class_list[i]);
-		
-		this_class_list = dsdb_attribute_list(mem_ctx, class, query);
-		attr_list = merge_attr_list(mem_ctx, attr_list, (const char **)this_class_list);
-
-		recursive_list = dsdb_full_attribute_list_internal(mem_ctx, schema, 
-								   class->systemAuxiliaryClass, 
-								   query);
-		
-		attr_list = merge_attr_list(mem_ctx, attr_list, (const char **)recursive_list);
-		
-		recursive_list = dsdb_full_attribute_list_internal(mem_ctx, schema, 
-								   class->auxiliaryClass, 
-								   query);
-		
-		attr_list = merge_attr_list(mem_ctx, attr_list, (const char **)recursive_list);
-		
-	}
-	return attr_list;
-}
-
-char **dsdb_full_attribute_list(TALLOC_CTX *mem_ctx, 
-				const struct dsdb_schema *schema, 
-				const char **class_list,
-				enum dsdb_attr_list_query query)
-{
-	char **attr_list = dsdb_full_attribute_list_internal(mem_ctx, schema, class_list, query);
-	size_t new_len = str_list_length((const char **)attr_list);
-
-	/* Remove duplicates */
-	if (new_len > 1) {
-		int i;
-		qsort(attr_list, new_len,
-		      sizeof(*attr_list),
-		      (comparison_fn_t)strcasecmp);
-		
-		for (i=1 ; i < new_len; i++) {
-			char **val1 = &attr_list[i-1];
-			char **val2 = &attr_list[i];
-			if (ldb_attr_cmp(*val1, *val2) == 0) {
-				memmove(val1, val2, (new_len - i) * sizeof( *attr_list)); 
-				new_len--;
-				i--;
-			}
-		}
-	}
-	return attr_list;
-}
-/**
- * Attach the schema to an opaque pointer on the ldb, so ldb modules
- * can find it 
- */
-
-int dsdb_set_schema(struct ldb_context *ldb, struct dsdb_schema *schema)
-{
-	int ret;
-
-	ret = ldb_set_opaque(ldb, "dsdb_schema", schema);
-	if (ret != LDB_SUCCESS) {
-		return ret;
-	}
-
-	talloc_steal(ldb, schema);
-
-	return LDB_SUCCESS;
-}
-
-/**
- * Global variable to hold one copy of the schema, used to avoid memory bloat
- */
-static struct dsdb_schema *global_schema;
-
-/**
- * Make this ldb use the 'global' schema, setup to avoid having multiple copies in this process
- */
-int dsdb_set_global_schema(struct ldb_context *ldb)
-{
-	int ret;
-	if (!global_schema) {
-		return LDB_SUCCESS;
-	}
-	ret = ldb_set_opaque(ldb, "dsdb_schema", global_schema);
-	if (ret != LDB_SUCCESS) {
-		return ret;
-	}
-
-	/* Keep a reference to this schema, just incase the global copy is replaced */
-	if (talloc_reference(ldb, global_schema) == NULL) {
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
-
-	return LDB_SUCCESS;
-}
-
-/**
- * Find the schema object for this ldb
- */
-
-struct dsdb_schema *dsdb_get_schema(struct ldb_context *ldb)
-{
-	const void *p;
-	struct dsdb_schema *schema;
-
-	/* see if we have a cached copy */
-	p = ldb_get_opaque(ldb, "dsdb_schema");
-	if (!p) {
-		return NULL;
-	}
-
-	schema = talloc_get_type(p, struct dsdb_schema);
-	if (!schema) {
-		return NULL;
-	}
-
-	return schema;
-}
-
-/**
- * Make the schema found on this ldb the 'global' schema
- */
-
-void dsdb_make_schema_global(struct ldb_context *ldb)
-{
-	struct dsdb_schema *schema = dsdb_get_schema(ldb);
-	if (!schema) {
-		return;
-	}
-
-	if (global_schema) {
-		talloc_unlink(talloc_autofree_context(), schema);
-	}
-
-	talloc_steal(talloc_autofree_context(), schema);
-	global_schema = schema;
-
-	dsdb_set_global_schema(ldb);
-}
-
-
-/**
- * Rather than read a schema from the LDB itself, read it from an ldif
- * file.  This allows schema to be loaded and used while adding the
- * schema itself to the directory.
- */
-
-WERROR dsdb_attach_schema_from_ldif_file(struct ldb_context *ldb, const char *pf, const char *df)
-{
-	struct ldb_ldif *ldif;
-	struct ldb_message *msg;
-	TALLOC_CTX *mem_ctx;
-	WERROR status;
-	int ret;
-	struct dsdb_schema *schema;
-	const struct ldb_val *prefix_val;
-	const struct ldb_val *info_val;
-	struct ldb_val info_val_default;
-
-	mem_ctx = talloc_new(ldb);
-	if (!mem_ctx) {
-		goto nomem;
-	}
-
-	schema = dsdb_new_schema(mem_ctx, lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")));
-
-	schema->fsmo.we_are_master = true;
-	schema->fsmo.master_dn = ldb_dn_new_fmt(schema, ldb, "@PROVISION_SCHEMA_MASTER");
-	if (!schema->fsmo.master_dn) {
-		goto nomem;
-	}
-
-	/*
-	 * load the prefixMap attribute from pf
-	 */
-	ldif = ldb_ldif_read_string(ldb, &pf);
-	if (!ldif) {
-		status = WERR_INVALID_PARAM;
-		goto failed;
-	}
-	talloc_steal(mem_ctx, ldif);
-
-	msg = ldb_msg_canonicalize(ldb, ldif->msg);
-	if (!msg) {
-		goto nomem;
-	}
-	talloc_steal(mem_ctx, msg);
-	talloc_free(ldif);
-
-	prefix_val = ldb_msg_find_ldb_val(msg, "prefixMap");
-	if (!prefix_val) {
-	    	status = WERR_INVALID_PARAM;
-		goto failed;
-	}
-
-	info_val = ldb_msg_find_ldb_val(msg, "schemaInfo");
-	if (!info_val) {
-		info_val_default = strhex_to_data_blob("FF0000000000000000000000000000000000000000");
-		if (!info_val_default.data) {
-			goto nomem;
-		}
-		talloc_steal(mem_ctx, info_val_default.data);
-		info_val = &info_val_default;
-	}
-
-	status = dsdb_load_oid_mappings_ldb(schema, prefix_val, info_val);
-	if (!W_ERROR_IS_OK(status)) {
-		goto failed;
-	}
-
-	/*
-	 * load the attribute and class definitions outof df
-	 */
-	while ((ldif = ldb_ldif_read_string(ldb, &df))) {
-		bool is_sa;
-		bool is_sc;
-
-		talloc_steal(mem_ctx, ldif);
-
-		msg = ldb_msg_canonicalize(ldb, ldif->msg);
-		if (!msg) {
-			goto nomem;
-		}
-
-		talloc_steal(mem_ctx, msg);
-		talloc_free(ldif);
-
-		is_sa = ldb_msg_check_string_attribute(msg, "objectClass", "attributeSchema");
-		is_sc = ldb_msg_check_string_attribute(msg, "objectClass", "classSchema");
-
-		if (is_sa) {
-			struct dsdb_attribute *sa;
-
-			sa = talloc_zero(schema, struct dsdb_attribute);
-			if (!sa) {
-				goto nomem;
-			}
-
-			status = dsdb_attribute_from_ldb(schema, msg, sa, sa);
-			if (!W_ERROR_IS_OK(status)) {
-				goto failed;
-			}
-
-			DLIST_ADD_END(schema->attributes, sa, struct dsdb_attribute *);
-		} else if (is_sc) {
-			struct dsdb_class *sc;
-
-			sc = talloc_zero(schema, struct dsdb_class);
-			if (!sc) {
-				goto nomem;
-			}
-
-			status = dsdb_class_from_ldb(schema, msg, sc, sc);
-			if (!W_ERROR_IS_OK(status)) {
-				goto failed;
-			}
-
-			DLIST_ADD_END(schema->classes, sc, struct dsdb_class *);
-		}
-	}
-
-	ret = dsdb_set_schema(ldb, schema);
-	if (ret != LDB_SUCCESS) {
-		status = WERR_FOOBAR;
-		goto failed;
-	}
-
-	goto done;
-
-nomem:
-	status = WERR_NOMEM;
-failed:
-done:
-	talloc_free(mem_ctx);
-	return status;
-}
diff --git a/source4/dsdb/schema/schema_query.c b/source4/dsdb/schema/schema_query.c
new file mode 100644
index 0000000000..ca26ffd206
--- /dev/null
+++ b/source4/dsdb/schema/schema_query.c
@@ -0,0 +1,344 @@
+/* 
+   Unix SMB/CIFS mplementation.
+   DSDB schema header
+   
+   Copyright (C) Stefan Metzmacher <metze@samba.org> 2006-2007
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2008
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+   
+*/
+
+#include "includes.h"
+#include "dsdb/samdb/samdb.h"
+
+const struct dsdb_attribute *dsdb_attribute_by_attributeID_id(const struct dsdb_schema *schema,
+							      uint32_t id)
+{
+	struct dsdb_attribute *cur;
+
+	/*
+	 * 0xFFFFFFFF is used as value when no mapping table is available,
+	 * so don't try to match with it
+	 */
+	if (id == 0xFFFFFFFF) return NULL;
+
+	/* TODO: add binary search */
+	for (cur = schema->attributes; cur; cur = cur->next) {
+		if (cur->attributeID_id != id) continue;
+
+		return cur;
+	}
+
+	return NULL;
+}
+
+const struct dsdb_attribute *dsdb_attribute_by_attributeID_oid(const struct dsdb_schema *schema,
+							       const char *oid)
+{
+	struct dsdb_attribute *cur;
+
+	if (!oid) return NULL;
+
+	/* TODO: add binary search */
+	for (cur = schema->attributes; cur; cur = cur->next) {
+		if (strcmp(cur->attributeID_oid, oid) != 0) continue;
+
+		return cur;
+	}
+
+	return NULL;
+}
+
+const struct dsdb_attribute *dsdb_attribute_by_lDAPDisplayName(const struct dsdb_schema *schema,
+							       const char *name)
+{
+	struct dsdb_attribute *cur;
+
+	if (!name) return NULL;
+
+	/* TODO: add binary search */
+	for (cur = schema->attributes; cur; cur = cur->next) {
+		if (strcasecmp(cur->lDAPDisplayName, name) != 0) continue;
+
+		return cur;
+	}
+
+	return NULL;
+}
+
+const struct dsdb_attribute *dsdb_attribute_by_linkID(const struct dsdb_schema *schema,
+						      int linkID)
+{
+	struct dsdb_attribute *cur;
+
+	/* TODO: add binary search */
+	for (cur = schema->attributes; cur; cur = cur->next) {
+		if (cur->linkID != linkID) continue;
+
+		return cur;
+	}
+
+	return NULL;
+}
+
+const struct dsdb_class *dsdb_class_by_governsID_id(const struct dsdb_schema *schema,
+						    uint32_t id)
+{
+	struct dsdb_class *cur;
+
+	/*
+	 * 0xFFFFFFFF is used as value when no mapping table is available,
+	 * so don't try to match with it
+	 */
+	if (id == 0xFFFFFFFF) return NULL;
+
+	/* TODO: add binary search */
+	for (cur = schema->classes; cur; cur = cur->next) {
+		if (cur->governsID_id != id) continue;
+
+		return cur;
+	}
+
+	return NULL;
+}
+
+const struct dsdb_class *dsdb_class_by_governsID_oid(const struct dsdb_schema *schema,
+						     const char *oid)
+{
+	struct dsdb_class *cur;
+
+	if (!oid) return NULL;
+
+	/* TODO: add binary search */
+	for (cur = schema->classes; cur; cur = cur->next) {
+		if (strcmp(cur->governsID_oid, oid) != 0) continue;
+
+		return cur;
+	}
+
+	return NULL;
+}
+
+const struct dsdb_class *dsdb_class_by_lDAPDisplayName(const struct dsdb_schema *schema,
+						       const char *name)
+{
+	struct dsdb_class *cur;
+
+	if (!name) return NULL;
+
+	/* TODO: add binary search */
+	for (cur = schema->classes; cur; cur = cur->next) {
+		if (strcasecmp(cur->lDAPDisplayName, name) != 0) continue;
+
+		return cur;
+	}
+
+	return NULL;
+}
+
+const struct dsdb_class *dsdb_class_by_cn(const struct dsdb_schema *schema,
+					  const char *cn)
+{
+	struct dsdb_class *cur;
+
+	if (!cn) return NULL;
+
+	/* TODO: add binary search */
+	for (cur = schema->classes; cur; cur = cur->next) {
+		if (strcasecmp(cur->cn, cn) != 0) continue;
+
+		return cur;
+	}
+
+	return NULL;
+}
+
+const char *dsdb_lDAPDisplayName_by_id(const struct dsdb_schema *schema,
+				       uint32_t id)
+{
+	const struct dsdb_attribute *a;
+	const struct dsdb_class *c;
+
+	/* TODO: add binary search */
+	a = dsdb_attribute_by_attributeID_id(schema, id);
+	if (a) {
+		return a->lDAPDisplayName;
+	}
+
+	c = dsdb_class_by_governsID_id(schema, id);
+	if (c) {
+		return c->lDAPDisplayName;
+	}
+
+	return NULL;
+}
+
+/** 
+    Return a list of linked attributes, in lDAPDisplayName format.
+
+    This may be used to determine if a modification would require
+    backlinks to be updated, for example
+*/
+
+WERROR dsdb_linked_attribute_lDAPDisplayName_list(const struct dsdb_schema *schema, TALLOC_CTX *mem_ctx, const char ***attr_list_ret)
+{
+	const char **attr_list = NULL;
+	struct dsdb_attribute *cur;
+	int i = 0;
+	for (cur = schema->attributes; cur; cur = cur->next) {
+		if (cur->linkID == 0) continue;
+		
+		attr_list = talloc_realloc(mem_ctx, attr_list, const char *, i+2);
+		if (!attr_list) {
+			return WERR_NOMEM;
+		}
+		attr_list[i] = cur->lDAPDisplayName;
+		i++;
+	}
+	attr_list[i] = NULL;
+	*attr_list_ret = attr_list;
+	return WERR_OK;
+}
+
+char **merge_attr_list(TALLOC_CTX *mem_ctx, 
+		       char **attrs, const char **new_attrs) 
+{
+	char **ret_attrs;
+	int i;
+	size_t new_len, orig_len = str_list_length((const char **)attrs);
+	if (!new_attrs) {
+		return attrs;
+	}
+
+	ret_attrs = talloc_realloc(mem_ctx, 
+				   attrs, char *, orig_len + str_list_length(new_attrs) + 1);
+	if (ret_attrs) {
+		for (i=0; i < str_list_length(new_attrs); i++) {
+			ret_attrs[orig_len + i] = new_attrs[i];
+		}
+		new_len = orig_len + str_list_length(new_attrs);
+
+		ret_attrs[new_len] = NULL;
+	}
+
+	return ret_attrs;
+}
+
+/*
+  Return a merged list of the attributes of exactly one class (not
+  considering subclasses, auxillary classes etc)
+*/
+
+char **dsdb_attribute_list(TALLOC_CTX *mem_ctx, const struct dsdb_class *class, enum dsdb_attr_list_query query)
+{
+	char **attr_list = NULL;
+	switch (query) {
+	case DSDB_SCHEMA_ALL_MAY:
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->mayContain);
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMayContain);
+		break;
+		
+	case DSDB_SCHEMA_ALL_MUST:
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->mustContain);
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMustContain);
+		break;
+		
+	case DSDB_SCHEMA_SYS_MAY:
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMayContain);
+		break;
+		
+	case DSDB_SCHEMA_SYS_MUST:
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMustContain);
+		break;
+		
+	case DSDB_SCHEMA_MAY:
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->mayContain);
+		break;
+		
+	case DSDB_SCHEMA_MUST:
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->mustContain);
+		break;
+		
+	case DSDB_SCHEMA_ALL:
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->mayContain);
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMayContain);
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->mustContain);
+		attr_list = merge_attr_list(mem_ctx, attr_list, class->systemMustContain);
+		break;
+	}
+	return attr_list;
+}
+
+static char **dsdb_full_attribute_list_internal(TALLOC_CTX *mem_ctx, 
+						const struct dsdb_schema *schema, 
+						const char **class_list,
+						enum dsdb_attr_list_query query)
+{
+	int i;
+	const struct dsdb_class *class;
+	
+	char **attr_list = NULL;
+	char **this_class_list;
+	char **recursive_list;
+
+	for (i=0; class_list && class_list[i]; i++) {
+		class = dsdb_class_by_lDAPDisplayName(schema, class_list[i]);
+		
+		this_class_list = dsdb_attribute_list(mem_ctx, class, query);
+		attr_list = merge_attr_list(mem_ctx, attr_list, (const char **)this_class_list);
+
+		recursive_list = dsdb_full_attribute_list_internal(mem_ctx, schema, 
+								   class->systemAuxiliaryClass, 
+								   query);
+		
+		attr_list = merge_attr_list(mem_ctx, attr_list, (const char **)recursive_list);
+		
+		recursive_list = dsdb_full_attribute_list_internal(mem_ctx, schema, 
+								   class->auxiliaryClass, 
+								   query);
+		
+		attr_list = merge_attr_list(mem_ctx, attr_list, (const char **)recursive_list);
+		
+	}
+	return attr_list;
+}
+
+char **dsdb_full_attribute_list(TALLOC_CTX *mem_ctx, 
+				const struct dsdb_schema *schema, 
+				const char **class_list,
+				enum dsdb_attr_list_query query)
+{
+	char **attr_list = dsdb_full_attribute_list_internal(mem_ctx, schema, class_list, query);
+	size_t new_len = str_list_length((const char **)attr_list);
+
+	/* Remove duplicates */
+	if (new_len > 1) {
+		int i;
+		qsort(attr_list, new_len,
+		      sizeof(*attr_list),
+		      (comparison_fn_t)strcasecmp);
+		
+		for (i=1 ; i < new_len; i++) {
+			char **val1 = &attr_list[i-1];
+			char **val2 = &attr_list[i];
+			if (ldb_attr_cmp(*val1, *val2) == 0) {
+				memmove(val1, val2, (new_len - i) * sizeof( *attr_list)); 
+				new_len--;
+				i--;
+			}
+		}
+	}
+	return attr_list;
+}
diff --git a/source4/dsdb/schema/schema_set.c b/source4/dsdb/schema/schema_set.c
new file mode 100644
index 0000000000..0ca26c0fc7
--- /dev/null
+++ b/source4/dsdb/schema/schema_set.c
@@ -0,0 +1,434 @@
+/* 
+   Unix SMB/CIFS mplementation.
+   DSDB schema header
+   
+   Copyright (C) Stefan Metzmacher <metze@samba.org> 2006-2007
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2008
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+   
+*/
+
+#include "includes.h"
+#include "dsdb/samdb/samdb.h"
+#include "lib/ldb/include/ldb_errors.h"
+#include "lib/ldb/include/ldb_private.h"
+#include "lib/util/dlinklist.h"
+#include "param/param.h"
+
+
+static int dsdb_schema_set_attributes(struct ldb_context *ldb, struct dsdb_schema *schema, bool write_attributes)
+{
+	int ret = LDB_SUCCESS;
+	struct ldb_result *res;
+	struct ldb_result *res_idx;
+	struct dsdb_attribute *attr;
+	struct ldb_message *mod_msg;
+	TALLOC_CTX *mem_ctx = talloc_new(ldb);
+	
+	struct ldb_message *msg;
+	struct ldb_message *msg_idx;
+
+	if (!mem_ctx) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	msg = ldb_msg_new(mem_ctx);
+	if (!msg) {
+		ldb_oom(ldb);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	msg_idx = ldb_msg_new(mem_ctx);
+	if (!msg_idx) {
+		ldb_oom(ldb);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	msg->dn = ldb_dn_new(msg, ldb, "@ATTRIBUTES");
+	if (!msg->dn) {
+		ldb_oom(ldb);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	msg_idx->dn = ldb_dn_new(msg, ldb, "@INDEXLIST");
+	if (!msg_idx->dn) {
+		ldb_oom(ldb);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	for (attr = schema->attributes; attr; attr = attr->next) {
+		const struct ldb_schema_syntax *s;
+		const char *syntax = attr->syntax->ldb_syntax;
+		if (!syntax) {
+			syntax = attr->syntax->ldap_oid;
+		}
+
+		/* Write out a rough approximation of the schema as an @ATTRIBUTES value, for bootstrapping */
+		if (strcmp(syntax, LDB_SYNTAX_INTEGER) == 0) {
+			ret = ldb_msg_add_string(msg, attr->lDAPDisplayName, "INTEGER");
+		} else if (strcmp(syntax, LDB_SYNTAX_DIRECTORY_STRING) == 0) {
+			ret = ldb_msg_add_string(msg, attr->lDAPDisplayName, "CASE_INSENSITIVE");
+		} 
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+
+		if (attr->searchFlags & SEARCH_FLAG_ATTINDEX) {
+			ret = ldb_msg_add_string(msg_idx, "@IDXATTR", attr->lDAPDisplayName);
+			if (ret != LDB_SUCCESS) {
+				return ret;
+			}
+		}
+
+		if (!attr->syntax) {
+			continue;
+		}
+
+		ret = ldb_schema_attribute_add(ldb, attr->lDAPDisplayName, LDB_ATTR_FLAG_FIXED,
+					       syntax);
+		if (ret != LDB_SUCCESS) {
+			s = ldb_samba_syntax_by_name(ldb, attr->syntax->ldap_oid);
+			if (s) {
+				ret = ldb_schema_attribute_add_with_syntax(ldb, attr->lDAPDisplayName, LDB_ATTR_FLAG_FIXED, s);
+			} else {
+				ret = LDB_SUCCESS; /* Nothing to do here */
+			}
+		}
+		
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+	}
+
+	if (!write_attributes) {
+		talloc_free(mem_ctx);
+		return ret;
+	}
+
+
+	ret = ldb_transaction_start(ldb);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	/* Try to avoid churning the attributes too much - we only want to do this if they have changed */
+	ret = ldb_search_exp_fmt(ldb, mem_ctx, &res, msg->dn, LDB_SCOPE_BASE, NULL, "dn=%s", ldb_dn_get_linearized(msg->dn));
+	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+		ret = ldb_add(ldb, msg);
+	} else if (ret != LDB_SUCCESS) {
+		talloc_free(mem_ctx);
+		ldb_transaction_cancel(ldb);
+		return ret;
+	} else {
+
+		if (res->count != 1) {
+			talloc_free(mem_ctx);
+			ldb_transaction_cancel(ldb);
+			return LDB_ERR_NO_SUCH_OBJECT;
+		}
+		
+		ret = LDB_SUCCESS;
+		/* Annoyingly added to our search results */
+		ldb_msg_remove_attr(res->msgs[0], "distinguishedName");
+
+		mod_msg = ldb_msg_diff(ldb, res->msgs[0], msg);
+		if (mod_msg->num_elements > 0) {
+			ret = ldb_modify(ldb, mod_msg);
+		}
+	}
+
+	if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
+		/* We might be on a read-only DB */
+		talloc_free(mem_ctx);
+		ret = ldb_transaction_cancel(ldb);
+		return ret;
+	} else if (ret != LDB_SUCCESS) {
+		ldb_transaction_cancel(ldb);
+		return ret;
+	}
+
+	/* Now write out the indexs, as found in the schema (if they have changed) */
+
+	ret = ldb_search_exp_fmt(ldb, mem_ctx, &res_idx, msg_idx->dn, LDB_SCOPE_BASE, NULL, "dn=%s", ldb_dn_get_linearized(msg_idx->dn));
+	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+		ret = ldb_add(ldb, msg_idx);
+	} else if (ret != LDB_SUCCESS) {
+		talloc_free(mem_ctx);
+		ldb_transaction_cancel(ldb);
+		return ret;
+	} else {
+		if (res_idx->count != 1) {
+			talloc_free(mem_ctx);
+			ldb_transaction_cancel(ldb);
+			return LDB_ERR_NO_SUCH_OBJECT;
+		}
+		
+		/* Annoyingly added to our search results */
+		ldb_msg_remove_attr(res_idx->msgs[0], "distinguishedName");
+
+		mod_msg = ldb_msg_diff(ldb, res_idx->msgs[0], msg_idx);
+		if (mod_msg->num_elements > 0) {
+			ret = ldb_modify(ldb, mod_msg);
+		}
+	}
+	if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
+		/* We might be on a read-only DB */
+		talloc_free(mem_ctx);
+		return ldb_transaction_cancel(ldb);
+	} else if (ret == LDB_SUCCESS) {
+		ret = ldb_transaction_commit(ldb);
+	} else {
+		ldb_transaction_cancel(ldb);
+	}
+	talloc_free(mem_ctx);
+	return ret;
+}
+
+
+/**
+ * Attach the schema to an opaque pointer on the ldb, so ldb modules
+ * can find it 
+ */
+
+int dsdb_set_schema(struct ldb_context *ldb, struct dsdb_schema *schema)
+{
+	int ret;
+
+	ret = ldb_set_opaque(ldb, "dsdb_schema", schema);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	/* Set the new attributes based on the new schema */
+	ret = dsdb_schema_set_attributes(ldb, schema, true);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	talloc_steal(ldb, schema);
+
+	return LDB_SUCCESS;
+}
+
+/**
+ * Global variable to hold one copy of the schema, used to avoid memory bloat
+ */
+static struct dsdb_schema *global_schema;
+
+/**
+ * Make this ldb use the 'global' schema, setup to avoid having multiple copies in this process
+ */
+int dsdb_set_global_schema(struct ldb_context *ldb)
+{
+	int ret;
+	if (!global_schema) {
+		return LDB_SUCCESS;
+	}
+	ret = ldb_set_opaque(ldb, "dsdb_schema", global_schema);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	/* Set the new attributes based on the new schema */
+	ret = dsdb_schema_set_attributes(ldb, global_schema, false);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	/* Keep a reference to this schema, just incase the global copy is replaced */
+	if (talloc_reference(ldb, global_schema) == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	return LDB_SUCCESS;
+}
+
+/**
+ * Find the schema object for this ldb
+ */
+
+struct dsdb_schema *dsdb_get_schema(struct ldb_context *ldb)
+{
+	const void *p;
+	struct dsdb_schema *schema;
+
+	/* see if we have a cached copy */
+	p = ldb_get_opaque(ldb, "dsdb_schema");
+	if (!p) {
+		return NULL;
+	}
+
+	schema = talloc_get_type(p, struct dsdb_schema);
+	if (!schema) {
+		return NULL;
+	}
+
+	return schema;
+}
+
+/**
+ * Make the schema found on this ldb the 'global' schema
+ */
+
+void dsdb_make_schema_global(struct ldb_context *ldb)
+{
+	struct dsdb_schema *schema = dsdb_get_schema(ldb);
+	if (!schema) {
+		return;
+	}
+
+	if (global_schema) {
+		talloc_unlink(talloc_autofree_context(), schema);
+	}
+
+	talloc_steal(talloc_autofree_context(), schema);
+	global_schema = schema;
+
+	dsdb_set_global_schema(ldb);
+}
+
+
+/**
+ * Rather than read a schema from the LDB itself, read it from an ldif
+ * file.  This allows schema to be loaded and used while adding the
+ * schema itself to the directory.
+ */
+
+WERROR dsdb_attach_schema_from_ldif_file(struct ldb_context *ldb, const char *pf, const char *df)
+{
+	struct ldb_ldif *ldif;
+	struct ldb_message *msg;
+	TALLOC_CTX *mem_ctx;
+	WERROR status;
+	int ret;
+	struct dsdb_schema *schema;
+	const struct ldb_val *prefix_val;
+	const struct ldb_val *info_val;
+	struct ldb_val info_val_default;
+
+	mem_ctx = talloc_new(ldb);
+	if (!mem_ctx) {
+		goto nomem;
+	}
+
+	schema = dsdb_new_schema(mem_ctx, lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")));
+
+	schema->fsmo.we_are_master = true;
+	schema->fsmo.master_dn = ldb_dn_new_fmt(schema, ldb, "@PROVISION_SCHEMA_MASTER");
+	if (!schema->fsmo.master_dn) {
+		goto nomem;
+	}
+
+	/*
+	 * load the prefixMap attribute from pf
+	 */
+	ldif = ldb_ldif_read_string(ldb, &pf);
+	if (!ldif) {
+		status = WERR_INVALID_PARAM;
+		goto failed;
+	}
+	talloc_steal(mem_ctx, ldif);
+
+	msg = ldb_msg_canonicalize(ldb, ldif->msg);
+	if (!msg) {
+		goto nomem;
+	}
+	talloc_steal(mem_ctx, msg);
+	talloc_free(ldif);
+
+	prefix_val = ldb_msg_find_ldb_val(msg, "prefixMap");
+	if (!prefix_val) {
+	    	status = WERR_INVALID_PARAM;
+		goto failed;
+	}
+
+	info_val = ldb_msg_find_ldb_val(msg, "schemaInfo");
+	if (!info_val) {
+		info_val_default = strhex_to_data_blob("FF0000000000000000000000000000000000000000");
+		if (!info_val_default.data) {
+			goto nomem;
+		}
+		talloc_steal(mem_ctx, info_val_default.data);
+		info_val = &info_val_default;
+	}
+
+	status = dsdb_load_oid_mappings_ldb(schema, prefix_val, info_val);
+	if (!W_ERROR_IS_OK(status)) {
+		goto failed;
+	}
+
+	/*
+	 * load the attribute and class definitions outof df
+	 */
+	while ((ldif = ldb_ldif_read_string(ldb, &df))) {
+		bool is_sa;
+		bool is_sc;
+
+		talloc_steal(mem_ctx, ldif);
+
+		msg = ldb_msg_canonicalize(ldb, ldif->msg);
+		if (!msg) {
+			goto nomem;
+		}
+
+		talloc_steal(mem_ctx, msg);
+		talloc_free(ldif);
+
+		is_sa = ldb_msg_check_string_attribute(msg, "objectClass", "attributeSchema");
+		is_sc = ldb_msg_check_string_attribute(msg, "objectClass", "classSchema");
+
+		if (is_sa) {
+			struct dsdb_attribute *sa;
+
+			sa = talloc_zero(schema, struct dsdb_attribute);
+			if (!sa) {
+				goto nomem;
+			}
+
+			status = dsdb_attribute_from_ldb(schema, msg, sa, sa);
+			if (!W_ERROR_IS_OK(status)) {
+				goto failed;
+			}
+
+			DLIST_ADD_END(schema->attributes, sa, struct dsdb_attribute *);
+		} else if (is_sc) {
+			struct dsdb_class *sc;
+
+			sc = talloc_zero(schema, struct dsdb_class);
+			if (!sc) {
+				goto nomem;
+			}
+
+			status = dsdb_class_from_ldb(schema, msg, sc, sc);
+			if (!W_ERROR_IS_OK(status)) {
+				goto failed;
+			}
+
+			DLIST_ADD_END(schema->classes, sc, struct dsdb_class *);
+		}
+	}
+
+	ret = dsdb_set_schema(ldb, schema);
+	if (ret != LDB_SUCCESS) {
+		status = WERR_FOOBAR;
+		goto failed;
+	}
+
+	goto done;
+
+nomem:
+	status = WERR_NOMEM;
+failed:
+done:
+	talloc_free(mem_ctx);
+	return status;
+}
diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index cab1446ff3..bee271eaa9 100644
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -51,7 +51,7 @@ static krb5_error_code make_pac(krb5_context context,
 				struct auth_serversupplied_info *server_info,
 				krb5_pac *pac) 
 {
-	struct PAC_LOGON_INFO_CTR logon_info;
+	union PAC_INFO info;
 	struct netr_SamInfo3 *info3;
 	krb5_data pac_data;
 	NTSTATUS nt_status;
@@ -59,7 +59,7 @@ static krb5_error_code make_pac(krb5_context context,
 	DATA_BLOB pac_out;
 	krb5_error_code ret;
 
-	ZERO_STRUCT(logon_info);
+	ZERO_STRUCT(info);
 
 	nt_status = auth_convert_server_info_saminfo3(mem_ctx, server_info, &info3);
 	if (!NT_STATUS_IS_OK(nt_status)) {
@@ -67,15 +67,16 @@ static krb5_error_code make_pac(krb5_context context,
 		return EINVAL;
 	}
 
-	logon_info.info = talloc_zero(mem_ctx, struct PAC_LOGON_INFO);
+	info.logon_info.info = talloc_zero(mem_ctx, struct PAC_LOGON_INFO);
 	if (!mem_ctx) {
 		return ENOMEM;
 	}
 
-	logon_info.info->info3 = *info3;
+	info.logon_info.info->info3 = *info3;
 
-	ndr_err = ndr_push_struct_blob(&pac_out, mem_ctx, iconv_convenience, &logon_info,
-				       (ndr_push_flags_fn_t)ndr_push_PAC_LOGON_INFO_CTR);
+	ndr_err = ndr_push_union_blob(&pac_out, mem_ctx, iconv_convenience, &info,
+				      PAC_TYPE_LOGON_INFO,
+				      (ndr_push_flags_fn_t)ndr_push_PAC_INFO);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		nt_status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(1, ("PAC (presig) push failed: %s\n", nt_errstr(nt_status)));
@@ -162,7 +163,7 @@ krb5_error_code samba_kdc_reget_pac(void *priv, krb5_context context,
 	krb5_data k5pac_in;
 	DATA_BLOB pac_in;
 
-	struct PAC_LOGON_INFO_CTR logon_info;
+	union PAC_INFO info;
 	union netr_Validation validation;
 	struct auth_serversupplied_info *server_info_out;
 
@@ -191,9 +192,10 @@ krb5_error_code samba_kdc_reget_pac(void *priv, krb5_context context,
 		return ENOMEM;
 	}
 		
-	ndr_err = ndr_pull_struct_blob(&pac_in, mem_ctx, private->iconv_convenience, &logon_info,
-				       (ndr_pull_flags_fn_t)ndr_pull_PAC_LOGON_INFO_CTR);
-	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err) || !logon_info.info) {
+	ndr_err = ndr_pull_union_blob(&pac_in, mem_ctx, private->iconv_convenience, &info,
+				      PAC_TYPE_LOGON_INFO,
+				      (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err) || !info.logon_info.info) {
 		nt_status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(0,("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status)));
 		talloc_free(mem_ctx);
@@ -201,7 +203,7 @@ krb5_error_code samba_kdc_reget_pac(void *priv, krb5_context context,
 	}
 
 	/* Pull this right into the normal auth sysstem structures */
-	validation.sam3 = &logon_info.info->info3;
+	validation.sam3 = &info.logon_info.info->info3;
 	nt_status = make_server_info_netlogon_validation(mem_ctx,
 							 "",
 							 3, &validation,
diff --git a/source4/lib/charset/charset.h b/source4/lib/charset/charset.h
index baa7df532b..c49745cd7f 100644
--- a/source4/lib/charset/charset.h
+++ b/source4/lib/charset/charset.h
@@ -97,6 +97,7 @@ size_t count_chars_w(const char *s, char c);
 void strupper_m(char *s);
 void strlower_m(char *s);
 char *strupper_talloc(TALLOC_CTX *ctx, const char *src);
+char *strupper_talloc_n(TALLOC_CTX *ctx, const char *src, size_t n);
 char *strlower_talloc(TALLOC_CTX *ctx, const char *src);
 bool strhasupper(const char *string);
 bool strhaslower(const char *string);
diff --git a/source4/lib/charset/iconv.c b/source4/lib/charset/iconv.c
index 4f4bc8fd2d..d4f930b462 100644
--- a/source4/lib/charset/iconv.c
+++ b/source4/lib/charset/iconv.c
@@ -469,6 +469,9 @@ static size_t iconv_copy(void *cd, const char **inbuf, size_t *inbytesleft,
 	return 0;
 }
 
+/*
+  this takes a UTF8 sequence and produces a UTF16 sequence
+ */
 static size_t utf8_pull(void *cd, const char **inbuf, size_t *inbytesleft,
 			 char **outbuf, size_t *outbytesleft)
 {
@@ -586,6 +589,10 @@ error:
 	return -1;
 }
 
+
+/*
+  this takes a UTF16 sequence and produces a UTF8 sequence
+ */
 static size_t utf8_push(void *cd, const char **inbuf, size_t *inbytesleft,
 			char **outbuf, size_t *outbytesleft)
 {
diff --git a/source4/lib/charset/util_unistr.c b/source4/lib/charset/util_unistr.c
index 19a4f3236c..09ec7b0471 100644
--- a/source4/lib/charset/util_unistr.c
+++ b/source4/lib/charset/util_unistr.c
@@ -518,8 +518,9 @@ _PUBLIC_ char *strlower_talloc(TALLOC_CTX *ctx, const char *src)
 
 /**
  Convert a string to UPPER case, allocated with talloc
+ source length limited to n bytes
 **/
-_PUBLIC_ char *strupper_talloc(TALLOC_CTX *ctx, const char *src)
+_PUBLIC_ char *strupper_talloc_n(TALLOC_CTX *ctx, const char *src, size_t n)
 {
 	size_t size=0;
 	char *dest;
@@ -531,12 +532,12 @@ _PUBLIC_ char *strupper_talloc(TALLOC_CTX *ctx, const char *src)
 
 	/* this takes advantage of the fact that upper/lower can't
 	   change the length of a character by more than 1 byte */
-	dest = talloc_array(ctx, char, 2*(strlen(src))+1);
+	dest = talloc_array(ctx, char, 2*(n+1));
 	if (dest == NULL) {
 		return NULL;
 	}
 
-	while (*src) {
+	while (*src && n--) {
 		size_t c_size;
 		codepoint_t c = next_codepoint(iconv_convenience, src, &c_size);
 		src += c_size;
@@ -562,6 +563,16 @@ _PUBLIC_ char *strupper_talloc(TALLOC_CTX *ctx, const char *src)
 }
 
 /**
+ Convert a string to UPPER case, allocated with talloc
+**/
+_PUBLIC_ char *strupper_talloc(TALLOC_CTX *ctx, const char *src)
+{
+	return strupper_talloc_n(ctx, src, src?strlen(src):0);
+}
+
+
+
+/**
  Convert a string to lower case.
 **/
 _PUBLIC_ void strlower_m(char *s)
diff --git a/source4/lib/ldb-samba/ldif_handlers.c b/source4/lib/ldb-samba/ldif_handlers.c
index 22a57da10b..a16582d294 100644
--- a/source4/lib/ldb-samba/ldif_handlers.c
+++ b/source4/lib/ldb-samba/ldif_handlers.c
@@ -38,7 +38,7 @@ static int ldif_read_objectSid(struct ldb_context *ldb, void *mem_ctx,
 {
 	enum ndr_err_code ndr_err;
 	struct dom_sid *sid;
-	sid = dom_sid_parse_talloc(mem_ctx, (const char *)in->data);
+	sid = dom_sid_parse_length(mem_ctx, in);
 	if (sid == NULL) {
 		return -1;
 	}
@@ -70,12 +70,11 @@ static int ldif_write_objectSid(struct ldb_context *ldb, void *mem_ctx,
 		talloc_free(sid);
 		return -1;
 	}
-	out->data = (uint8_t *)dom_sid_string(mem_ctx, sid);
+	*out = data_blob_string_const(dom_sid_string(mem_ctx, sid));
 	talloc_free(sid);
 	if (out->data == NULL) {
 		return -1;
 	}
-	out->length = strlen((const char *)out->data);
 	return 0;
 }
 
@@ -97,13 +96,14 @@ static int ldb_comparison_objectSid(struct ldb_context *ldb, void *mem_ctx,
 				    const struct ldb_val *v1, const struct ldb_val *v2)
 {
 	if (ldb_comparision_objectSid_isString(v1) && ldb_comparision_objectSid_isString(v2)) {
-		return strcmp((const char *)v1->data, (const char *)v2->data);
+		return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
 	} else if (ldb_comparision_objectSid_isString(v1)
 		   && !ldb_comparision_objectSid_isString(v2)) {
 		struct ldb_val v;
 		int ret;
 		if (ldif_read_objectSid(ldb, mem_ctx, v1, &v) != 0) {
-			return -1;
+			/* Perhaps not a string after all */
+			return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
 		}
 		ret = ldb_comparison_binary(ldb, mem_ctx, &v, v2);
 		talloc_free(v.data);
@@ -113,7 +113,8 @@ static int ldb_comparison_objectSid(struct ldb_context *ldb, void *mem_ctx,
 		struct ldb_val v;
 		int ret;
 		if (ldif_read_objectSid(ldb, mem_ctx, v2, &v) != 0) {
-			return -1;
+			/* Perhaps not a string after all */
+			return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
 		}
 		ret = ldb_comparison_binary(ldb, mem_ctx, v1, &v);
 		talloc_free(v.data);
@@ -129,7 +130,11 @@ static int ldb_canonicalise_objectSid(struct ldb_context *ldb, void *mem_ctx,
 				      const struct ldb_val *in, struct ldb_val *out)
 {
 	if (ldb_comparision_objectSid_isString(in)) {
-		return ldif_read_objectSid(ldb, mem_ctx, in, out);
+		if (ldif_read_objectSid(ldb, mem_ctx, in, out) != 0) {
+			/* Perhaps not a string after all */
+			return ldb_handler_copy(ldb, mem_ctx, in, out);
+		}
+		return 0;
 	}
 	return ldb_handler_copy(ldb, mem_ctx, in, out);
 }
@@ -141,10 +146,16 @@ static int ldif_read_objectGUID(struct ldb_context *ldb, void *mem_ctx,
 			        const struct ldb_val *in, struct ldb_val *out)
 {
 	struct GUID guid;
+	char *guid_string;
 	NTSTATUS status;
 	enum ndr_err_code ndr_err;
+	guid_string = talloc_strndup(mem_ctx, (const char *)in->data, in->length);
+	if (!guid_string) {
+		return -1;
+	}
 
-	status = GUID_from_string((const char *)in->data, &guid);
+	status = GUID_from_string(guid_string, &guid);
+	talloc_free(guid_string);
 	if (!NT_STATUS_IS_OK(status)) {
 		return -1;
 	}
@@ -203,13 +214,14 @@ static int ldb_comparison_objectGUID(struct ldb_context *ldb, void *mem_ctx,
 				     const struct ldb_val *v1, const struct ldb_val *v2)
 {
 	if (ldb_comparision_objectGUID_isString(v1) && ldb_comparision_objectGUID_isString(v2)) {
-		return strcmp((const char *)v1->data, (const char *)v2->data);
+		return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
 	} else if (ldb_comparision_objectGUID_isString(v1)
 		   && !ldb_comparision_objectGUID_isString(v2)) {
 		struct ldb_val v;
 		int ret;
 		if (ldif_read_objectGUID(ldb, mem_ctx, v1, &v) != 0) {
-			return -1;
+			/* Perhaps it wasn't a valid string after all */
+			return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
 		}
 		ret = ldb_comparison_binary(ldb, mem_ctx, &v, v2);
 		talloc_free(v.data);
@@ -219,7 +231,8 @@ static int ldb_comparison_objectGUID(struct ldb_context *ldb, void *mem_ctx,
 		struct ldb_val v;
 		int ret;
 		if (ldif_read_objectGUID(ldb, mem_ctx, v2, &v) != 0) {
-			return -1;
+			/* Perhaps it wasn't a valid string after all */
+			return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
 		}
 		ret = ldb_comparison_binary(ldb, mem_ctx, v1, &v);
 		talloc_free(v.data);
@@ -235,7 +248,11 @@ static int ldb_canonicalise_objectGUID(struct ldb_context *ldb, void *mem_ctx,
 				       const struct ldb_val *in, struct ldb_val *out)
 {
 	if (ldb_comparision_objectGUID_isString(in)) {
-		return ldif_read_objectGUID(ldb, mem_ctx, in, out);
+		if (ldif_read_objectGUID(ldb, mem_ctx, in, out) != 0) {
+			/* Perhaps it wasn't a valid string after all */
+			return ldb_handler_copy(ldb, mem_ctx, in, out);
+		}
+		return 0;
 	}
 	return ldb_handler_copy(ldb, mem_ctx, in, out);
 }
@@ -314,7 +331,7 @@ static int ldif_canonicalise_objectCategory(struct ldb_context *ldb, void *mem_c
 		}
 		return LDB_SUCCESS;
 	}
-	dn1 = ldb_dn_new(tmp_ctx, ldb, (char *)in->data);
+	dn1 = ldb_dn_from_ldb_val(tmp_ctx, ldb, in);
 	if ( ! ldb_dn_validate(dn1)) {
 		const char *lDAPDisplayName = talloc_strndup(tmp_ctx, (char *)in->data, in->length);
 		class = dsdb_class_by_lDAPDisplayName(schema, lDAPDisplayName);
@@ -617,19 +634,6 @@ static const struct {
 	{ "fRSReplicaSetGUID",		LDB_SYNTAX_SAMBA_GUID },
 	{ "netbootGUID",		LDB_SYNTAX_SAMBA_GUID },
 	{ "objectCategory",		LDB_SYNTAX_SAMBA_OBJECT_CATEGORY },
-	{ "member",			LDB_SYNTAX_DN },
-	{ "memberOf",			LDB_SYNTAX_DN },
-	{ "nCName",			LDB_SYNTAX_DN },
-	{ "schemaNamingContext",	LDB_SYNTAX_DN },
-	{ "configurationNamingContext",	LDB_SYNTAX_DN },
-	{ "rootDomainNamingContext",	LDB_SYNTAX_DN },
-	{ "defaultNamingContext",	LDB_SYNTAX_DN },
-	{ "subRefs",			LDB_SYNTAX_DN },
-	{ "dMDLocation",		LDB_SYNTAX_DN },
-	{ "serverReference",		LDB_SYNTAX_DN },
-	{ "masteredBy",			LDB_SYNTAX_DN },
-	{ "msDs-masteredBy",		LDB_SYNTAX_DN },
-	{ "fSMORoleOwner",		LDB_SYNTAX_DN },
 	{ "prefixMap",                  LDB_SYNTAX_SAMBA_PREFIX_MAP }
 };
 
@@ -669,7 +673,7 @@ int ldb_register_samba_handlers(struct ldb_context *ldb)
 			return -1;
 		}
 
-		ret = ldb_schema_attribute_add_with_syntax(ldb, samba_attributes[i].name, 0, s);
+		ret = ldb_schema_attribute_add_with_syntax(ldb, samba_attributes[i].name, LDB_ATTR_FLAG_FIXED, s);
 		if (ret != LDB_SUCCESS) {
 			return ret;
 		}
diff --git a/source4/lib/ldb/common/attrib_handlers.c b/source4/lib/ldb/common/attrib_handlers.c
index 8ed2763d4d..fb57e2dadc 100644
--- a/source4/lib/ldb/common/attrib_handlers.c
+++ b/source4/lib/ldb/common/attrib_handlers.c
@@ -55,11 +55,12 @@ int ldb_handler_fold(struct ldb_context *ldb, void *mem_ctx,
 {
 	char *s, *t;
 	int l;
+
 	if (!in || !out || !(in->data)) {
 		return -1;
 	}
 
-	out->data = (uint8_t *)ldb_casefold(ldb, mem_ctx, (const char *)(in->data));
+	out->data = (uint8_t *)ldb_casefold(ldb, mem_ctx, (const char *)(in->data), in->length);
 	if (out->data == NULL) {
 		ldb_debug(ldb, LDB_DEBUG_ERROR, "ldb_handler_fold: unable to casefold string [%s]", in->data);
 		return -1;
@@ -153,13 +154,14 @@ int ldb_comparison_fold(struct ldb_context *ldb, void *mem_ctx,
 			       const struct ldb_val *v1, const struct ldb_val *v2)
 {
 	const char *s1=(const char *)v1->data, *s2=(const char *)v2->data;
+	size_t n1 = v1->length, n2 = v2->length;
 	const char *u1, *u2;
 	char *b1, *b2;
 	int ret;
-	while (*s1 == ' ') s1++;
-	while (*s2 == ' ') s2++;
+	while (*s1 == ' ' && n1) { s1++; n1--; };
+	while (*s2 == ' ' && n2) { s2++; n2--; };
 	/* TODO: make utf8 safe, possibly with helper function from application */
-	while (*s1 && *s2) {
+	while (*s1 && *s2 && n1 && n2) {
 		/* the first 127 (0x7F) chars are ascii and utf8 guarantes they
 		 * never appear in multibyte sequences */
 		if (((unsigned char)s1[0]) & 0x80) goto utf8str;
@@ -167,10 +169,11 @@ int ldb_comparison_fold(struct ldb_context *ldb, void *mem_ctx,
 		if (toupper((unsigned char)*s1) != toupper((unsigned char)*s2))
 			break;
 		if (*s1 == ' ') {
-			while (s1[0] == s1[1]) s1++;
-			while (s2[0] == s2[1]) s2++;
+			while (s1[0] == s1[1] && n1) { s1++; n1--; }
+			while (s2[0] == s2[1] && n2) { s2++; n2--; }
 		}
 		s1++; s2++;
+		n1--; n2--;
 	}
 	if (! (*s1 && *s2)) {
 		/* check for trailing spaces only if one of the pointers
@@ -178,15 +181,18 @@ int ldb_comparison_fold(struct ldb_context *ldb, void *mem_ctx,
 		 * can mistakenly match.
 		 * ex. "domain users" <-> "domainUpdates"
 		 */
-		while (*s1 == ' ') s1++;
-		while (*s2 == ' ') s2++;
+		while (*s1 == ' ') { s1++; n1--; }
+		while (*s2 == ' ') { s2++; n2--; }
+	}
+	if (n1 != n2) {
+		return n1 - n2;
 	}
 	return (int)(toupper(*s1)) - (int)(toupper(*s2));
 
 utf8str:
 	/* no need to recheck from the start, just from the first utf8 char found */
-	b1 = ldb_casefold(ldb, mem_ctx, s1);
-	b2 = ldb_casefold(ldb, mem_ctx, s2);
+	b1 = ldb_casefold(ldb, mem_ctx, s1, n1);
+	b2 = ldb_casefold(ldb, mem_ctx, s2, n2);
 
 	if (b1 && b2) {
 		/* Both strings converted correctly */
@@ -221,6 +227,7 @@ utf8str:
 	return ret;
 }
 
+
 /*
   canonicalise a attribute in DN format
 */
diff --git a/source4/lib/ldb/common/ldb_attributes.c b/source4/lib/ldb/common/ldb_attributes.c
index ab6aa0b734..747f241781 100644
--- a/source4/lib/ldb/common/ldb_attributes.c
+++ b/source4/lib/ldb/common/ldb_attributes.c
@@ -51,6 +51,10 @@ int ldb_schema_attribute_add_with_syntax(struct ldb_context *ldb,
 	int i, n;
 	struct ldb_schema_attribute *a;
 
+	if (!syntax) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
 	n = ldb->schema.num_attributes + 1;
 
 	a = talloc_realloc(ldb, ldb->schema.attributes,
@@ -64,6 +68,10 @@ int ldb_schema_attribute_add_with_syntax(struct ldb_context *ldb,
 	for (i = 0; i < ldb->schema.num_attributes; i++) {
 		int cmp = ldb_attr_cmp(attribute, a[i].name);
 		if (cmp == 0) {
+			/* silently ignore attempts to overwrite fixed attributes */
+			if (a[i].flags & LDB_ATTR_FLAG_FIXED) {
+				return 0;
+			}
 			if (a[i].flags & LDB_ATTR_FLAG_ALLOCATED) {
 				talloc_free(discard_const_p(char, a[i].name));
 			}
@@ -157,6 +165,11 @@ void ldb_schema_attribute_remove(struct ldb_context *ldb, const char *name)
 		return;
 	}
 
+	/* FIXED attributes are never removed */
+	if (a->flags & LDB_ATTR_FLAG_FIXED) {
+		return;
+	}
+
 	if (a->flags & LDB_ATTR_FLAG_ALLOCATED) {
 		talloc_free(discard_const_p(char, a->name));
 	}
diff --git a/source4/lib/ldb/common/ldb_dn.c b/source4/lib/ldb/common/ldb_dn.c
index 08911344b7..c0d36cfbf3 100644
--- a/source4/lib/ldb/common/ldb_dn.c
+++ b/source4/lib/ldb/common/ldb_dn.c
@@ -71,7 +71,7 @@ struct ldb_dn {
 };
 
 /* strdn may be NULL */
-struct ldb_dn *ldb_dn_new(void *mem_ctx, struct ldb_context *ldb, const char *strdn)
+struct ldb_dn *ldb_dn_from_ldb_val(void *mem_ctx, struct ldb_context *ldb, const struct ldb_val *strdn)
 {
 	struct ldb_dn *dn;
 
@@ -82,27 +82,27 @@ struct ldb_dn *ldb_dn_new(void *mem_ctx, struct ldb_context *ldb, const char *st
 
 	dn->ldb = ldb;
 
-	if (strdn) {
-		if (strdn[0] == '@') {
+	if (strdn->data && strdn->length) {
+		if (strdn->data[0] == '@') {
 			dn->special = true;
 		}
-		if (strncasecmp(strdn, "<GUID=", 6) == 0) {
+		if (strdn->length >= 6 && strncasecmp((const char *)strdn->data, "<GUID=", 6) == 0) {
 			/* this is special DN returned when the
 			 * exploded_dn control is used */
 			dn->special = true;
 			/* FIXME: add a GUID string to ldb_dn structure */
-		} else if (strncasecmp(strdn, "<SID=", 8) == 0) {
+		} else if (strdn->length >= 8 && strncasecmp((const char *)strdn->data, "<SID=", 8) == 0) {
 			/* this is special DN returned when the
 			 * exploded_dn control is used */
 			dn->special = true;
 			/* FIXME: add a SID string to ldb_dn structure */
-		} else if (strncasecmp(strdn, "<WKGUID=", 8) == 0) {
+		} else if (strdn->length >= 8 && strncasecmp((const char *)strdn->data, "<WKGUID=", 8) == 0) {
 			/* this is special DN returned when the
 			 * exploded_dn control is used */
 			dn->special = true;
 			/* FIXME: add a WKGUID string to ldb_dn structure */
 		}
-		dn->linearized = talloc_strdup(dn, strdn);
+		dn->linearized = talloc_strndup(dn, (const char *)strdn->data, strdn->length);
 	} else {
 		dn->linearized = talloc_strdup(dn, "");
 	}
@@ -115,6 +115,15 @@ failed:
 	return NULL;
 }
 
+/* strdn may be NULL */
+struct ldb_dn *ldb_dn_new(void *mem_ctx, struct ldb_context *ldb, const char *strdn)
+{
+	struct ldb_val blob;
+	blob.data = strdn;
+	blob.length = strdn ? strlen(strdn) : 0;
+	return ldb_dn_from_ldb_val(mem_ctx, ldb, &blob);
+}
+
 struct ldb_dn *ldb_dn_new_fmt(void *mem_ctx, struct ldb_context *ldb, const char *new_fmt, ...)
 {
 	struct ldb_dn *dn;
diff --git a/source4/lib/ldb/common/ldb_msg.c b/source4/lib/ldb/common/ldb_msg.c
index c1ea9db56b..2f5fe1d18c 100644
--- a/source4/lib/ldb/common/ldb_msg.c
+++ b/source4/lib/ldb/common/ldb_msg.c
@@ -389,10 +389,10 @@ int ldb_msg_find_attr_as_bool(const struct ldb_message *msg,
 	if (!v || !v->data) {
 		return default_value;
 	}
-	if (strcasecmp((const char *)v->data, "FALSE") == 0) {
+	if (v->length == 5 && strncasecmp((const char *)v->data, "FALSE", 5) == 0) {
 		return 0;
 	}
-	if (strcasecmp((const char *)v->data, "TRUE") == 0) {
+	if (v->length == 4 && strncasecmp((const char *)v->data, "TRUE", 4) == 0) {
 		return 1;
 	}
 	return default_value;
@@ -421,7 +421,7 @@ struct ldb_dn *ldb_msg_find_attr_as_dn(struct ldb_context *ldb,
 	if (!v || !v->data) {
 		return NULL;
 	}
-	res_dn = ldb_dn_new(mem_ctx, ldb, (const char *)v->data);
+	res_dn = ldb_dn_from_ldb_val(mem_ctx, ldb, v);
 	if ( ! ldb_dn_validate(res_dn)) {
 		talloc_free(res_dn);
 		return NULL;
diff --git a/source4/lib/ldb/common/ldb_utf8.c b/source4/lib/ldb/common/ldb_utf8.c
index b7b4a60122..69ee2b6964 100644
--- a/source4/lib/ldb/common/ldb_utf8.c
+++ b/source4/lib/ldb/common/ldb_utf8.c
@@ -40,8 +40,8 @@
   function to handle utf8 caseless comparisons
  */
 void ldb_set_utf8_fns(struct ldb_context *ldb,
-			void *context,
-			char *(*casefold)(void *, void *, const char *))
+		      void *context,
+		      char *(*casefold)(void *, void *, const char *, size_t))
 {
 	if (context)
 		ldb->utf8_fns.context = context;
@@ -53,10 +53,10 @@ void ldb_set_utf8_fns(struct ldb_context *ldb,
   a simple case folding function
   NOTE: does not handle UTF8
 */
-char *ldb_casefold_default(void *context, void *mem_ctx, const char *s)
+char *ldb_casefold_default(void *context, void *mem_ctx, const char *s, size_t n)
 {
 	int i;
-	char *ret = talloc_strdup(mem_ctx, s);
+	char *ret = talloc_strndup(mem_ctx, s, n);
 	if (!s) {
 		errno = ENOMEM;
 		return NULL;
@@ -72,9 +72,9 @@ void ldb_set_utf8_default(struct ldb_context *ldb)
 	ldb_set_utf8_fns(ldb, NULL, ldb_casefold_default);
 }
 
-char *ldb_casefold(struct ldb_context *ldb, void *mem_ctx, const char *s)
+char *ldb_casefold(struct ldb_context *ldb, void *mem_ctx, const char *s, size_t n)
 {
-	return ldb->utf8_fns.casefold(ldb->utf8_fns.context, mem_ctx, s);
+	return ldb->utf8_fns.casefold(ldb->utf8_fns.context, mem_ctx, s, n);
 }
 
 /*
diff --git a/source4/lib/ldb/include/ldb.h b/source4/lib/ldb/include/ldb.h
index 0338ae1d93..937029f52c 100644
--- a/source4/lib/ldb/include/ldb.h
+++ b/source4/lib/ldb/include/ldb.h
@@ -203,7 +203,7 @@ struct ldb_debug_ops {
 */
 struct ldb_utf8_fns {
 	void *context;
-	char *(*casefold)(void *context, TALLOC_CTX *mem_ctx, const char *s);
+	char *(*casefold)(void *context, TALLOC_CTX *mem_ctx, const char *s, size_t n);
 };
 
 /**
@@ -358,9 +358,9 @@ const struct ldb_schema_attribute *ldb_schema_attribute_by_name(struct ldb_conte
 #define LDB_ATTR_FLAG_ALLOCATED    (1<<1) 
 
 /**
-   The attribute is constructed from other attributes
+   The attribute is supplied by the application and should not be removed
 */
-#define LDB_ATTR_FLAG_CONSTRUCTED  (1<<1) 
+#define LDB_ATTR_FLAG_FIXED        (1<<2) 
 
 /**
   LDAP attribute syntax for a DN
@@ -1216,7 +1216,7 @@ void ldb_set_utf8_default(struct ldb_context *ldb);
    \note The default function is not yet UTF8 aware. Provide your own
          set of functions through ldb_set_utf8_fns()
 */
-char *ldb_casefold(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const char *s);
+char *ldb_casefold(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const char *s, size_t n);
 
 /**
    Check the attribute name is valid according to rfc2251
@@ -1381,6 +1381,7 @@ int ldb_base64_decode(char *s);
 
 struct ldb_dn *ldb_dn_new(TALLOC_CTX *mem_ctx, struct ldb_context *ldb, const char *dn);
 struct ldb_dn *ldb_dn_new_fmt(TALLOC_CTX *mem_ctx, struct ldb_context *ldb, const char *new_fmt, ...) PRINTF_ATTRIBUTE(3,4);
+struct ldb_dn *ldb_dn_from_ldb_val(void *mem_ctx, struct ldb_context *ldb, const struct ldb_val *strdn);
 bool ldb_dn_validate(struct ldb_dn *dn);
 
 char *ldb_dn_escape_value(TALLOC_CTX *mem_ctx, struct ldb_val value);
@@ -1602,8 +1603,8 @@ int ldb_set_debug(struct ldb_context *ldb,
   this allows the user to set custom utf8 function for error reporting
 */
 void ldb_set_utf8_fns(struct ldb_context *ldb,
-			void *context,
-			char *(*casefold)(void *, void *, const char *));
+		      void *context,
+		      char *(*casefold)(void *, void *, const char *, size_t n));
 
 /**
    this sets up debug to print messages on stderr
diff --git a/source4/lib/ldb/include/ldb_private.h b/source4/lib/ldb/include/ldb_private.h
index d7c2efe8a1..e1026ab781 100644
--- a/source4/lib/ldb/include/ldb_private.h
+++ b/source4/lib/ldb/include/ldb_private.h
@@ -91,13 +91,6 @@ struct ldb_schema {
 	/* attribute handling table */
 	unsigned num_attributes;
 	struct ldb_schema_attribute *attributes;
-
-	/* objectclass information */
-	unsigned num_classes;
-	struct ldb_subclass {
-		char *name;
-		char **subclasses;
-	} *classes;
 };
 
 /*
@@ -242,7 +235,7 @@ int save_controls(struct ldb_control *exclude, struct ldb_request *req, struct l
 int check_critical_controls(struct ldb_control **controls);
 
 /* The following definitions come from lib/ldb/common/ldb_utf8.c */
-char *ldb_casefold_default(void *context, void *mem_ctx, const char *s);
+char *ldb_casefold_default(void *context, void *mem_ctx, const char *s, size_t n);
 
 void ldb_msg_remove_element(struct ldb_message *msg, struct ldb_message_element *el);
 
diff --git a/source4/lib/ldb/ldb_tdb/ldb_index.c b/source4/lib/ldb/ldb_tdb/ldb_index.c
index 1b6d9feed6..269305a468 100644
--- a/source4/lib/ldb/ldb_tdb/ldb_index.c
+++ b/source4/lib/ldb/ldb_tdb/ldb_index.c
@@ -767,7 +767,7 @@ int ltdb_search_indexed(struct ldb_handle *handle)
 
 	if ((ac->scope == LDB_SCOPE_ONELEVEL && (idxattr+idxone == 0)) ||
 	    (ac->scope == LDB_SCOPE_SUBTREE && idxattr == 0)) {
-		/* no indexs? must do full search */
+		/* no indexes? must do full search */
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
diff --git a/source4/lib/ldb/modules/operational.c b/source4/lib/ldb/modules/operational.c
index 7dc4ae08c3..a59e81becd 100644
--- a/source4/lib/ldb/modules/operational.c
+++ b/source4/lib/ldb/modules/operational.c
@@ -291,12 +291,6 @@ static int operational_init(struct ldb_module *ctx)
 {
 	int ret = 0;
 
-	/* setup some standard attribute handlers */
-	ret |= ldb_schema_attribute_add(ctx->ldb, "whenCreated", 0, LDB_SYNTAX_UTC_TIME);
-	ret |= ldb_schema_attribute_add(ctx->ldb, "whenChanged", 0, LDB_SYNTAX_UTC_TIME);
-	ret |= ldb_schema_attribute_add(ctx->ldb, "subschemaSubentry", 0, LDB_SYNTAX_DN);
-	ret |= ldb_schema_attribute_add(ctx->ldb, "structuralObjectClass", 0, LDB_SYNTAX_OBJECTCLASS);
-
 	if (ret != 0) {
 		return ret;
 	}
diff --git a/source4/lib/ldb/tests/python/ldap.py b/source4/lib/ldb/tests/python/ldap.py
index 13d4adf6d4..bc6f80e856 100755
--- a/source4/lib/ldb/tests/python/ldap.py
+++ b/source4/lib/ldb/tests/python/ldap.py
@@ -331,15 +331,15 @@ servicePrincipalName: host/ldaptest2computer29
         print "Testing Ambigious Name Resolution"
         # Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
         res = ldb.search(expression="(&(anr=ldap testy)(objectClass=user))")
-        self.assertEquals(len(res), 3, "Could not find (&(anr=ldap testy)(objectClass=user))")
+        self.assertEquals(len(res), 3, "Found only %d of 3 for (&(anr=ldap testy)(objectClass=user))" % len(res))
 
         # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
         res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
-        self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res))
+        self.assertEquals(len(res), 2, "Found only %d of 2 for (&(anr=testy ldap)(objectClass=user))" % len(res))
 
         # Testing ldb.search for (&(anr=ldap)(objectClass=user))
         res = ldb.search(expression="(&(anr=ldap)(objectClass=user))")
-        self.assertEquals(len(res), 4, "Found only %d for (&(anr=ldap)(objectClass=user))" % len(res))
+        self.assertEquals(len(res), 4, "Found only %d of 4 for (&(anr=ldap)(objectClass=user))" % len(res))
 
         # Testing ldb.search for (&(anr==ldap)(objectClass=user))
         res = ldb.search(expression="(&(anr==ldap)(objectClass=user))")
@@ -353,21 +353,22 @@ servicePrincipalName: host/ldaptest2computer29
         res = ldb.search(expression="(&(anr=testy)(objectClass=user))")
         self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy)(objectClass=user))" % len(res))
 
-        # Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
+        # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
         res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
-        self.assertEquals(len(res), 2, "Found only %d for (&(anr=ldap testy)(objectClass=user))" % len(res))
+        self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res))
 
-        # Testing ldb.search for (&(anr==ldap testy)(objectClass=user))
-        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
-        self.assertEquals(len(res), 1, "Found only %d for (&(anr==ldap testy)(objectClass=user))" % len(res))
+        # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
+# this test disabled for the moment, as anr with == tests are not understood
+#        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
+#        self.assertEquals(len(res), 1, "Found only %d for (&(anr==testy ldap)(objectClass=user))" % len(res))
 
         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
         self.assertEquals(res[0]["cn"][0], "ldaptestuser")
         self.assertEquals(res[0]["name"][0], "ldaptestuser")
 
         # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
-        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
-        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap)(objectClass=user))")
+#        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
+#        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap)(objectClass=user))")
 
         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
         self.assertEquals(res[0]["cn"][0], "ldaptestuser")
@@ -382,32 +383,32 @@ servicePrincipalName: host/ldaptest2computer29
         self.assertEquals(res[0]["name"], "ldaptestuser2")
 
         # Testing ldb.search for (&(anr==testy ldap user2)(objectClass=user))
-        res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
-        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))")
+#        res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
+#        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))")
 
         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
         self.assertEquals(res[0]["cn"], "ldaptestuser2")
         self.assertEquals(res[0]["name"], "ldaptestuser2")
 
         # Testing ldb.search for (&(anr==ldap user2)(objectClass=user))
-        res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
-        self.assertEquals(len(res), 1, "Could not find (&(anr==ldap user2)(objectClass=user))")
+#        res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
+#        self.assertEquals(len(res), 1, "Could not find (&(anr==ldap user2)(objectClass=user))")
 
         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
         self.assertEquals(res[0]["cn"], "ldaptestuser2")
         self.assertEquals(res[0]["name"], "ldaptestuser2")
 
         # Testing ldb.search for (&(anr==not ldap user2)(objectClass=user))
-        res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
-        self.assertEquals(len(res), 0, "Must not find (&(anr==not ldap user2)(objectClass=user))")
+#        res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
+#        self.assertEquals(len(res), 0, "Must not find (&(anr==not ldap user2)(objectClass=user))")
 
         # Testing ldb.search for (&(anr=not ldap user2)(objectClass=user))
         res = ldb.search(expression="(&(anr=not ldap user2)(objectClass=user))")
         self.assertEquals(len(res), 0, "Must not find (&(anr=not ldap user2)(objectClass=user))")
 
         # Testing ldb.search for (&(anr="testy ldap")(objectClass=user)) (ie, with quotes)
-        res = ldb.search(expression="(&(anr==\"testy ldap\")(objectClass=user))")
-        self.assertEquals(len(res), 0, "Found (&(anr==\"testy ldap\")(objectClass=user))")
+#        res = ldb.search(expression="(&(anr==\"testy ldap\")(objectClass=user))")
+#        self.assertEquals(len(res), 0, "Found (&(anr==\"testy ldap\")(objectClass=user))")
 
         print "Testing Group Modifies"
         ldb.modify_ldif("""
diff --git a/source4/lib/ldb/tools/ldbtest.c b/source4/lib/ldb/tools/ldbtest.c
index 6d141478ad..169ff02da1 100644
--- a/source4/lib/ldb/tools/ldbtest.c
+++ b/source4/lib/ldb/tools/ldbtest.c
@@ -93,7 +93,7 @@ static void add_records(struct ldb_context *ldb,
 		el[2].name = talloc_strdup(tmp_ctx, "uid");
 		el[2].num_values = 1;
 		el[2].values = vals[2];
-		vals[2][0].data = (uint8_t *)ldb_casefold(ldb, tmp_ctx, name);
+		vals[2][0].data = (uint8_t *)ldb_casefold(ldb, tmp_ctx, name, strlen(name));
 		vals[2][0].length = strlen((char *)vals[2][0].data);
 
 		el[3].flags = 0;
diff --git a/source4/lib/ldb_wrap.c b/source4/lib/ldb_wrap.c
index 883597108a..6c683a1e33 100644
--- a/source4/lib/ldb_wrap.c
+++ b/source4/lib/ldb_wrap.c
@@ -147,17 +147,21 @@ struct ldb_context *ldb_wrap_connect(TALLOC_CTX *mem_ctx,
 		talloc_free(ldb);
 		return NULL;
 	}
-	
-	if (lp_ctx != NULL && strcmp(lp_sam_url(lp_ctx), url) == 0) {
-		dsdb_set_global_schema(ldb);
-	}
 
+	/* This must be done before we load the schema, as these
+	 * handlers for objectSid and objectGUID etc must take
+	 * precedence over the 'binary attribute' declaration in the
+	 * schema */
 	ret = ldb_register_samba_handlers(ldb);
 	if (ret == -1) {
 		talloc_free(ldb);
 		return NULL;
 	}
 
+	if (lp_ctx != NULL && strcmp(lp_sam_url(lp_ctx), url) == 0) {
+		dsdb_set_global_schema(ldb);
+	}
+
 	ldb_set_debug(ldb, ldb_wrap_debug, NULL);
 
 	ldb_set_utf8_fns(ldb, NULL, wrap_casefold);
diff --git a/source4/lib/ldb_wrap.h b/source4/lib/ldb_wrap.h
index e626b6ef8a..f2982302ab 100644
--- a/source4/lib/ldb_wrap.h
+++ b/source4/lib/ldb_wrap.h
@@ -29,7 +29,7 @@ struct cli_credentials;
 struct loadparm_context;
 struct event_context;
 
-char *wrap_casefold(void *context, void *mem_ctx, const char *s);
+char *wrap_casefold(void *context, void *mem_ctx, const char *s, size_t n);
 
 struct ldb_context *ldb_wrap_connect(TALLOC_CTX *mem_ctx,
 				     struct event_context *ev,
diff --git a/source4/lib/util/data_blob.c b/source4/lib/util/data_blob.c
index b258e47bba..57b34b7ae7 100644
--- a/source4/lib/util/data_blob.c
+++ b/source4/lib/util/data_blob.c
@@ -176,7 +176,7 @@ _PUBLIC_ DATA_BLOB data_blob_string_const(const char *str)
 {
 	DATA_BLOB blob;
 	blob.data = discard_const_p(uint8_t, str);
-	blob.length = strlen(str);
+	blob.length = str ? strlen(str) : 0;
 	return blob;
 }
 
diff --git a/source4/lib/util/util_ldb.c b/source4/lib/util/util_ldb.c
index 0a7433696e..fab729c036 100644
--- a/source4/lib/util/util_ldb.c
+++ b/source4/lib/util/util_ldb.c
@@ -125,9 +125,9 @@ int gendb_add_ldif(struct ldb_context *ldb, const char *ldif_string)
 	return ret;
 }
 
-char *wrap_casefold(void *context, void *mem_ctx, const char *s)
+char *wrap_casefold(void *context, void *mem_ctx, const char *s, size_t n)
 {
-	return strupper_talloc(mem_ctx, s);
+	return strupper_talloc_n(mem_ctx, s, n);
 }
 
 
diff --git a/source4/lib/util/util_ldb.h b/source4/lib/util/util_ldb.h
index 030ba7ebee..43f98ae1a9 100644
--- a/source4/lib/util/util_ldb.h
+++ b/source4/lib/util/util_ldb.h
@@ -22,6 +22,6 @@ int gendb_search_dn(struct ldb_context *ldb,
 		 struct ldb_message ***res,
 		 const char * const *attrs);
 int gendb_add_ldif(struct ldb_context *ldb, const char *ldif_string);
-char *wrap_casefold(void *context, void *mem_ctx, const char *s);
+char *wrap_casefold(void *context, void *mem_ctx, const char *s, size_t n);
 
 #endif /* __LIB_UTIL_UTIL_LDB_H__ */
diff --git a/source4/libcli/security/dom_sid.c b/source4/libcli/security/dom_sid.c
index f5457e7e0e..1a7519e362 100644
--- a/source4/libcli/security/dom_sid.c
+++ b/source4/libcli/security/dom_sid.c
@@ -152,6 +152,21 @@ struct dom_sid *dom_sid_parse_talloc(TALLOC_CTX *mem_ctx, const char *sidstr)
 }
 
 /*
+  convert a string to a dom_sid, returning a talloc'd dom_sid
+*/
+struct dom_sid *dom_sid_parse_length(TALLOC_CTX *mem_ctx, const DATA_BLOB *sid)
+{
+	struct dom_sid *ret;
+	char *p = talloc_strndup(mem_ctx, sid->data, sid->length);
+	if (!p) {
+		return NULL;
+	}
+	ret = dom_sid_parse_talloc(mem_ctx, p);
+	talloc_free(p);
+	return ret;
+}
+
+/*
   copy a dom_sid structure
 */
 struct dom_sid *dom_sid_dup(TALLOC_CTX *mem_ctx, const struct dom_sid *dom_sid)
diff --git a/source4/libnet/libnet_become_dc.c b/source4/libnet/libnet_become_dc.c
index 19391e7983..332b041e36 100644
--- a/source4/libnet/libnet_become_dc.c
+++ b/source4/libnet/libnet_become_dc.c
@@ -2465,26 +2465,33 @@ static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state
 	if (*r->out.level == 1) {
 		ctr_level = 1;
 		ctr1 = &r->out.ctr.ctr1;
-	} else if (*r->out.level == 2) {
+	} else if (*r->out.level == 2 &&
+		   r->out.ctr.ctr2.mszip1.ts) {
 		ctr_level = 1;
-		ctr1 = r->out.ctr.ctr2.mszip1.ctr1;
+		ctr1 = &r->out.ctr.ctr2.mszip1.ts->ctr1;
 	} else if (*r->out.level == 6) {
 		ctr_level = 6;
 		ctr6 = &r->out.ctr.ctr6;
 	} else if (*r->out.level == 7 &&
 		   r->out.ctr.ctr7.level == 6 &&
-		   r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP) {
+		   r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP &&
+		   r->out.ctr.ctr7.ctr.mszip6.ts) {
 		ctr_level = 6;
-		ctr6 = r->out.ctr.ctr7.ctr.mszip6.ctr6;
+		ctr6 = &r->out.ctr.ctr7.ctr.mszip6.ts->ctr6;
 	} else if (*r->out.level == 7 &&
 		   r->out.ctr.ctr7.level == 6 &&
-		   r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS) {
+		   r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS &&
+		   r->out.ctr.ctr7.ctr.xpress6.ts) {
 		ctr_level = 6;
-		ctr6 = r->out.ctr.ctr7.ctr.xpress6.ctr6;
+		ctr6 = &r->out.ctr.ctr7.ctr.xpress6.ts->ctr6;
 	} else {
 		return WERR_BAD_NET_RESP;
 	}
 
+	if (!ctr1 && ! ctr6) {
+		return WERR_BAD_NET_RESP;
+	}
+
 	if (ctr_level == 6) {
 		if (!W_ERROR_IS_OK(ctr6->drs_error)) {
 			return ctr6->drs_error;
diff --git a/source4/librpc/idl/drsuapi.idl b/source4/librpc/idl/drsuapi.idl
index 88d2126d0b..cc76599be6 100644
--- a/source4/librpc/idl/drsuapi.idl
+++ b/source4/librpc/idl/drsuapi.idl
@@ -617,36 +617,44 @@ interface drsuapi
 		WERROR drs_error;
 	} drsuapi_DsGetNCChangesCtr6;
 
-	typedef struct {
+	typedef [public] struct {
+		[subcontext(0xFFFFFC01)] drsuapi_DsGetNCChangesCtr1 ctr1;
+	} drsuapi_DsGetNCChangesCtr1TS;
+
+	typedef [public] struct {
+		[subcontext(0xFFFFFC01)] drsuapi_DsGetNCChangesCtr6 ctr6;
+	} drsuapi_DsGetNCChangesCtr6TS;
+
+	typedef [nopush] struct {
 		uint32 decompressed_length;
 		uint32 compressed_length;
 		[subcontext(4),subcontext_size(compressed_length),
 		 compression(NDR_COMPRESSION_MSZIP,compressed_length,decompressed_length)]
-		 drsuapi_DsGetNCChangesCtr1 *ctr1;
+		 drsuapi_DsGetNCChangesCtr1TS *ts;
 	} drsuapi_DsGetNCChangesMSZIPCtr1;
 
-	typedef struct {
+	typedef [nopush] struct {
 		uint32 decompressed_length;
 		uint32 compressed_length;
 		[subcontext(4),subcontext_size(compressed_length),
 		 compression(NDR_COMPRESSION_MSZIP,compressed_length,decompressed_length)]
-		 drsuapi_DsGetNCChangesCtr6 *ctr6;
+		 drsuapi_DsGetNCChangesCtr6TS *ts;
 	} drsuapi_DsGetNCChangesMSZIPCtr6;
 
-	typedef struct {
+	typedef [nopush] struct {
 		uint32 decompressed_length;
 		uint32 compressed_length;
 		[subcontext(4),subcontext_size(compressed_length),
 		 compression(NDR_COMPRESSION_XPRESS,compressed_length,decompressed_length)]
-		 drsuapi_DsGetNCChangesCtr1 *ctr1;
+		 drsuapi_DsGetNCChangesCtr1TS *ts;
 	} drsuapi_DsGetNCChangesXPRESSCtr1;
 
-	typedef struct {
+	typedef [nopush] struct {
 		uint32 decompressed_length;
 		uint32 compressed_length;
 		[subcontext(4),subcontext_size(compressed_length),
 		 compression(NDR_COMPRESSION_XPRESS,compressed_length,decompressed_length)]
-		 drsuapi_DsGetNCChangesCtr6 *ctr6;
+		 drsuapi_DsGetNCChangesCtr6TS *ts;
 	} drsuapi_DsGetNCChangesXPRESSCtr6;
 
 	typedef [enum16bit] enum {
diff --git a/source4/librpc/idl/krb5pac.idl b/source4/librpc/idl/krb5pac.idl
index b450908915..ca0efaed3e 100644
--- a/source4/librpc/idl/krb5pac.idl
+++ b/source4/librpc/idl/krb5pac.idl
@@ -45,10 +45,6 @@ interface krb5pac
 	} PAC_UNKNOWN_12;
 
 	typedef [public] struct {
-		[value(0x00081001)] uint32 unknown1;
-		[value(0xCCCCCCCC)] uint32 unknown2;
-		[value(NDR_ROUND(ndr_size_PAC_LOGON_INFO(info, ndr->flags)+4,8))] uint32 _ndr_size;
-		[value(0x00000000)] uint32 unknown3;
 		PAC_LOGON_INFO *info;
     	} PAC_LOGON_INFO_CTR;
 
@@ -66,7 +62,7 @@ interface krb5pac
 	} DATA_BLOB_REM;
 
 	typedef [public,nodiscriminant,gensize] union {
-		[case(PAC_TYPE_LOGON_INFO)]	PAC_LOGON_INFO_CTR logon_info;
+		[case(PAC_TYPE_LOGON_INFO)][subcontext(0xFFFFFC01)] PAC_LOGON_INFO_CTR logon_info;
 		[case(PAC_TYPE_SRV_CHECKSUM)]	PAC_SIGNATURE_DATA srv_cksum;
 		[case(PAC_TYPE_KDC_CHECKSUM)]	PAC_SIGNATURE_DATA kdc_cksum;
 		[case(PAC_TYPE_LOGON_NAME)]	PAC_LOGON_NAME logon_name;
diff --git a/source4/librpc/idl/nbt.idl b/source4/librpc/idl/nbt.idl
index a6d0245455..63be489e0d 100644
--- a/source4/librpc/idl/nbt.idl
+++ b/source4/librpc/idl/nbt.idl
@@ -353,7 +353,13 @@ interface nbt
 		NBT_SERVER_TIMESERV      = 0x00000040,
 		NBT_SERVER_CLOSEST       = 0x00000080,
 		NBT_SERVER_WRITABLE      = 0x00000100, 
-		NBT_SERVER_GOOD_TIMESERV = 0x00000200
+		NBT_SERVER_GOOD_TIMESERV = 0x00000200,
+		NBT_SERVER_NDNC          = 0x00000400,
+		NBT_SERVER_SEL_SEC_DOM_6 = 0x00000800,
+		NBT_SERVER_FUL_SEC_DOM_6 = 0x00001000,
+		NBT_SERVER_DS_DNS_CONTR  = 0x04000000,
+		NBT_SERVER_DS_DNS_DOMAIN = 0x02000000,
+		NBT_SERVER_DS_DNS_FOREST = 0x01000000
 	} nbt_server_type;
 
 	typedef [bitmap32bit,public] bitmap {
diff --git a/source4/librpc/ndr/ndr.c b/source4/librpc/ndr/ndr.c
index 40852456bc..c5e4c44794 100644
--- a/source4/librpc/ndr/ndr.c
+++ b/source4/librpc/ndr/ndr.c
@@ -394,6 +394,8 @@ _PUBLIC_ enum ndr_err_code ndr_pull_subcontext_start(struct ndr_pull *ndr,
 {
 	struct ndr_pull *subndr;
 	uint32_t r_content_size;
+	bool force_le = false;
+	bool force_be = false;
 
 	switch (header_size) {
 	case 0: {
@@ -426,6 +428,74 @@ _PUBLIC_ enum ndr_err_code ndr_pull_subcontext_start(struct ndr_pull *ndr,
 		r_content_size = content_size;
 		break;
 	}
+	case 0xFFFFFC01: {
+		/*
+		 * Common Type Header for the Serialization Stream
+		 * See [MS-RPCE] 2.2.6 Type Serialization Version 1
+		 */
+		uint8_t version;
+		uint8_t drep;
+		uint16_t hdrlen;
+		uint32_t filler;
+		uint32_t content_size;
+		uint32_t reserved;
+
+		/* version */
+		NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &version));
+
+		if (version != 1) {
+			return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT,
+					      "Bad subcontext (PULL) Common Type Header version %d != 1",
+					      (int)version);
+		}
+
+		/*
+		 * 0x10 little endian
+		 * 0x00 big endian
+		 */
+		NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &drep));
+		if (drep == 0x10) {
+			force_le = true;
+		} else if (drep == 0x00) {
+			force_be = true;
+		} else {
+			return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT,
+					      "Bad subcontext (PULL) Common Type Header invalid drep 0x%02X",
+					      (unsigned int)drep);
+		}
+
+		/* length of the "Private Header for Constructed Type" */
+		NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &hdrlen));
+		if (hdrlen != 8) {
+			return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT,
+					      "Bad subcontext (PULL) Common Type Header length %d != 8",
+					      (int)hdrlen);
+		}
+
+		/* filler should be ignored */
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &filler));
+
+		/*
+		 * Private Header for Constructed Type
+		 */
+		/* length - will be updated latter */
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &content_size));
+		if (size_is >= 0 && size_is != content_size) {
+			return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext (PULL) size_is(%d) mismatch content_size %d",
+					      (int)size_is, (int)content_size);
+		}
+		/* the content size must be a multiple of 8 */
+		if ((content_size % 8) != 0) {
+			return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT,
+					      "Bad subcontext (PULL) size_is(%d) not padded to 8 content_size %d",
+					      (int)size_is, (int)content_size);
+		}
+		r_content_size = content_size;
+
+		/* reserved */
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &reserved));
+		break;
+	}
 	default:
 		return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext (PULL) header_size %d", 
 				      (int)header_size);
@@ -443,6 +513,12 @@ _PUBLIC_ enum ndr_err_code ndr_pull_subcontext_start(struct ndr_pull *ndr,
 	subndr->data_size = r_content_size;
 	subndr->iconv_convenience = talloc_reference(subndr, ndr->iconv_convenience);
 
+	if (force_le) {
+		ndr_set_flags(&ndr->flags, LIBNDR_FLAG_LITTLE_ENDIAN);
+	} else if (force_be) {
+		ndr_set_flags(&ndr->flags, LIBNDR_FLAG_BIGENDIAN);
+	}
+
 	*_subndr = subndr;
 	return NDR_ERR_SUCCESS;
 }
@@ -487,8 +563,10 @@ _PUBLIC_ enum ndr_err_code ndr_push_subcontext_end(struct ndr_push *ndr,
 				 size_t header_size,
 				 ssize_t size_is)
 {
+	ssize_t padding_len;
+
 	if (size_is >= 0) {
-		ssize_t padding_len = size_is - subndr->offset;
+		padding_len = size_is - subndr->offset;
 		if (padding_len > 0) {
 			NDR_CHECK(ndr_push_zero(subndr, padding_len));
 		} else if (padding_len < 0) {
@@ -509,6 +587,41 @@ _PUBLIC_ enum ndr_err_code ndr_push_subcontext_end(struct ndr_push *ndr,
 		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, subndr->offset));
 		break;
 
+	case 0xFFFFFC01:
+		/*
+		 * Common Type Header for the Serialization Stream
+		 * See [MS-RPCE] 2.2.6 Type Serialization Version 1
+		 */
+		padding_len = NDR_ROUND(subndr->offset, 8) - subndr->offset;
+		if (padding_len > 0) {
+			NDR_CHECK(ndr_push_zero(subndr, padding_len));
+		}
+
+		/* version */
+		NDR_CHECK(ndr_push_uint8(ndr, NDR_SCALARS, 1));
+
+		/*
+		 * 0x10 little endian
+		 * 0x00 big endian
+		 */
+		NDR_CHECK(ndr_push_uint8(ndr, NDR_SCALARS, NDR_BE(ndr)?0x00:0x10));
+
+		/* length of the "Private Header for Constructed Type" */
+		NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, 8));
+
+		/* filler */
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0xCCCCCCCC));
+
+		/*
+		 * Private Header for Constructed Type
+		 */
+		/* length - will be updated latter */
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, subndr->offset));
+
+		/* reserved */
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
+		break;
+
 	default:
 		return ndr_push_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext header size %d", 
 				      (int)header_size);
diff --git a/source4/librpc/ndr/ndr_compression.c b/source4/librpc/ndr/ndr_compression.c
index 7c2aca72e9..37f95bb1b6 100644
--- a/source4/librpc/ndr/ndr_compression.c
+++ b/source4/librpc/ndr/ndr_compression.c
@@ -145,86 +145,111 @@ static enum ndr_err_code ndr_pull_compression_mszip_chunk(struct ndr_pull *ndrpu
 	return NDR_ERR_SUCCESS;
 }
 
-static enum ndr_err_code ndr_pull_compression_mszip(struct ndr_pull *subndr,
-					   struct ndr_pull **_comndr,
-					   ssize_t decompressed_len)
+static enum ndr_err_code ndr_push_compression_mszip_chunk(struct ndr_push *ndrpush,
+							  struct ndr_pull *ndrpull,
+							  z_stream *z,
+							  bool *last)
 {
-	struct ndr_push *ndrpush;
-	struct ndr_pull *comndr;
-	DATA_BLOB uncompressed;
-	uint32_t payload_header[4];
-	uint32_t payload_size;
-	uint32_t payload_offset;
-	uint8_t *payload;
-	z_stream z;
-	bool last = false;
+	DATA_BLOB comp_chunk;
+	uint32_t comp_chunk_size;
+	uint32_t comp_chunk_size_offset;
+	DATA_BLOB plain_chunk;
+	uint32_t plain_chunk_size;
+	uint32_t plain_chunk_offset;
+	uint32_t max_plain_size = 0x00008000;
+	uint32_t max_comp_size = 0x00008000 + 2 + 12 /*TODO: what value do we really need here?*/;
+	uint32_t tmp_offset;
+	int z_ret;
 
-	ndrpush = ndr_push_init_ctx(subndr, subndr->iconv_convenience);
-	NDR_ERR_HAVE_NO_MEMORY(ndrpush);
+	plain_chunk_size = MIN(max_plain_size, ndrpull->data_size - ndrpull->offset);
+	plain_chunk_offset = ndrpull->offset;
+	NDR_CHECK(ndr_pull_advance(ndrpull, plain_chunk_size));
 
-	ZERO_STRUCT(z);
+	plain_chunk.data = ndrpull->data + plain_chunk_offset;
+	plain_chunk.length = plain_chunk_size;
 
-	while (!last) {
-		NDR_CHECK(ndr_pull_compression_mszip_chunk(subndr, ndrpush, &z, &last));
+	if (plain_chunk_size < max_plain_size) {
+		*last = true;
 	}
 
-	uncompressed = ndr_push_blob(ndrpush);
+	NDR_CHECK(ndr_push_uint32(ndrpush, NDR_SCALARS, plain_chunk_size));
+	comp_chunk_size_offset = ndrpush->offset;
+	NDR_CHECK(ndr_push_uint32(ndrpush, NDR_SCALARS, 0xFEFEFEFE));
 
-	if (uncompressed.length != decompressed_len) {
-		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION, "Bad MSZIP uncompressed_len [%u] != [%d] (PULL)",
-				      (int)uncompressed.length, (int)decompressed_len);
-	}
+	NDR_CHECK(ndr_push_expand(ndrpush, max_comp_size));
 
-	comndr = talloc_zero(subndr, struct ndr_pull);
-	NDR_ERR_HAVE_NO_MEMORY(comndr);
-	comndr->flags		= subndr->flags;
-	comndr->current_mem_ctx	= subndr->current_mem_ctx;
+	comp_chunk.data = ndrpush->data + ndrpush->offset;
+	comp_chunk.length = max_comp_size;
 
-	comndr->data		= uncompressed.data;
-	comndr->data_size	= uncompressed.length;
-	comndr->offset		= 0;
+	/* CK = Chris Kirmse, official Microsoft purloiner */
+	comp_chunk.data[0] = 'C';
+	comp_chunk.data[1] = 'K';
 
-	comndr->iconv_convenience = talloc_reference(comndr, subndr->iconv_convenience);
+	z->next_in	= plain_chunk.data;
+	z->avail_in	= plain_chunk.length;
+	z->total_in	= 0;
 
-	NDR_CHECK(ndr_pull_uint32(comndr, NDR_SCALARS, &payload_header[0]));
-	NDR_CHECK(ndr_pull_uint32(comndr, NDR_SCALARS, &payload_header[1]));
-	NDR_CHECK(ndr_pull_uint32(comndr, NDR_SCALARS, &payload_header[2]));
-	NDR_CHECK(ndr_pull_uint32(comndr, NDR_SCALARS, &payload_header[3]));
+	z->next_out	= comp_chunk.data + 2;
+	z->avail_out	= comp_chunk.length - 2;
+	z->total_out	= 0;
 
-	if (payload_header[0] != 0x00081001) {
-		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION, "Bad MSZIP payload_header[0] [0x%08X] != [0x00081001] (PULL)",
-				      payload_header[0]);
-	}
-	if (payload_header[1] != 0xCCCCCCCC) {
-		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION, "Bad MSZIP payload_header[1] [0x%08X] != [0xCCCCCCCC] (PULL)",
-				      payload_header[1]);
+	if (!z->opaque) {
+		/* the first time we need to intialize completely */
+		z->zalloc	= ndr_zlib_alloc;
+		z->zfree	= ndr_zlib_free;
+		z->opaque	= ndrpull;
+
+		/* TODO: find how to trigger the same parameters windows uses */
+		z_ret = deflateInit2(z,
+				     Z_DEFAULT_COMPRESSION,
+				     Z_DEFLATED,
+				     -15,
+				     9,
+				     Z_DEFAULT_STRATEGY);
+		if (z_ret != Z_OK) {
+			return ndr_push_error(ndrpush, NDR_ERR_COMPRESSION,
+					      "Bad deflateInit2 error %s(%d) (PUSH)",
+					      zError(z_ret), z_ret);
+
+		}
+	} else {
+		/* TODO: keep the window */
+		z_ret = deflateReset(z);
+		if (z_ret != Z_OK) {
+			return ndr_push_error(ndrpush, NDR_ERR_COMPRESSION,
+					      "Bad delateReset2 error %s(%d) (PUSH)",
+					      zError(z_ret), z_ret);
+		}
 	}
 
-	payload_size = payload_header[2];
+	/* call deflate untill we get Z_STREAM_END or an error */
+	while (true) {
+		z_ret = deflate(z, Z_FINISH);
+		if (z_ret != Z_OK) break;
+	}
+	if (z_ret != Z_STREAM_END) {
+		return ndr_push_error(ndrpush, NDR_ERR_COMPRESSION,
+				      "Bad delate(Z_BLOCK) error %s(%d) (PUSH)",
+				      zError(z_ret), z_ret);
+	}
 
-	if (payload_header[3] != 0x00000000) {
-		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION, "Bad MSZIP payload_header[3] [0x%08X] != [0x00000000] (PULL)",
-				      payload_header[3]);
+	if (z->avail_in) {
+		return ndr_push_error(ndrpush, NDR_ERR_COMPRESSION,
+				      "MSZIP not all avail_in[%u] bytes consumed (PUSH)",
+				      z->avail_in);
 	}
 
-	payload_offset = comndr->offset;
-	NDR_CHECK(ndr_pull_advance(comndr, payload_size));
-	payload = comndr->data + payload_offset;
+	comp_chunk_size = 2 + z->total_out;
 
-	comndr->data		= payload;
-	comndr->data_size	= payload_size;
-	comndr->offset		= 0;
+	tmp_offset = ndrpush->offset;
+	ndrpush->offset = comp_chunk_size_offset;
+	NDR_CHECK(ndr_push_uint32(ndrpush, NDR_SCALARS, comp_chunk_size));
+	ndrpush->offset = tmp_offset;
 
-	*_comndr = comndr;
+	ndrpush->offset += comp_chunk_size;
 	return NDR_ERR_SUCCESS;
 }
 
-static enum ndr_err_code ndr_push_compression_mszip(struct ndr_push *subndr,
-					   struct ndr_push *comndr)
-{
-	return ndr_push_error(subndr, NDR_ERR_COMPRESSION, "Sorry MSZIP compression is not supported yet (PUSH)");
-}
-
 static enum ndr_err_code ndr_pull_compression_xpress_chunk(struct ndr_pull *ndrpull,
 						  struct ndr_push *ndrpush,
 						  bool *last)
@@ -268,30 +293,54 @@ static enum ndr_err_code ndr_pull_compression_xpress_chunk(struct ndr_pull *ndrp
 	return NDR_ERR_SUCCESS;
 }
 
-static enum ndr_err_code ndr_pull_compression_xpress(struct ndr_pull *subndr,
-					    struct ndr_pull **_comndr,
-					    ssize_t decompressed_len)
+static enum ndr_err_code ndr_push_compression_xpress_chunk(struct ndr_push *ndrpush,
+							   struct ndr_pull *ndrpull,
+							   bool *last)
+{
+	return ndr_push_error(ndrpush, NDR_ERR_COMPRESSION, "XPRESS compression is not supported yet (PUSH)");
+}
+
+/*
+  handle compressed subcontext buffers, which in midl land are user-marshalled, but
+  we use magic in pidl to make them easier to cope with
+*/
+enum ndr_err_code ndr_pull_compression_start(struct ndr_pull *subndr,
+				    struct ndr_pull **_comndr,
+				    enum ndr_compression_alg compression_alg,
+				    ssize_t decompressed_len)
 {
 	struct ndr_push *ndrpush;
 	struct ndr_pull *comndr;
 	DATA_BLOB uncompressed;
-	uint32_t payload_header[4];
-	uint32_t payload_size;
-	uint32_t payload_offset;
-	uint8_t *payload;
 	bool last = false;
+	z_stream z;
 
 	ndrpush = ndr_push_init_ctx(subndr, subndr->iconv_convenience);
 	NDR_ERR_HAVE_NO_MEMORY(ndrpush);
 
-	while (!last) {
-		NDR_CHECK(ndr_pull_compression_xpress_chunk(subndr, ndrpush, &last));
+	switch (compression_alg) {
+	case NDR_COMPRESSION_MSZIP:
+		ZERO_STRUCT(z);
+		while (!last) {
+			NDR_CHECK(ndr_pull_compression_mszip_chunk(subndr, ndrpush, &z, &last));
+		}
+		break;
+
+	case NDR_COMPRESSION_XPRESS:
+		while (!last) {
+			NDR_CHECK(ndr_pull_compression_xpress_chunk(subndr, ndrpush, &last));
+		}
+		break;
+
+	default:
+		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION, "Bad compression algorithm %d (PULL)",
+				      compression_alg);
 	}
 
 	uncompressed = ndr_push_blob(ndrpush);
 	if (uncompressed.length != decompressed_len) {
 		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION,
-				      "Bad XPRESS uncompressed_len [%u] != [%u](0x%08X) (PULL)",
+				      "Bad uncompressed_len [%u] != [%u](0x%08X) (PULL)",
 				      (int)uncompressed.length,
 				      (int)decompressed_len,
 				      (int)decompressed_len);
@@ -308,69 +357,10 @@ static enum ndr_err_code ndr_pull_compression_xpress(struct ndr_pull *subndr,
 
 	comndr->iconv_convenience = talloc_reference(comndr, subndr->iconv_convenience);
 
-	NDR_CHECK(ndr_pull_uint32(comndr, NDR_SCALARS, &payload_header[0]));
-	NDR_CHECK(ndr_pull_uint32(comndr, NDR_SCALARS, &payload_header[1]));
-	NDR_CHECK(ndr_pull_uint32(comndr, NDR_SCALARS, &payload_header[2]));
-	NDR_CHECK(ndr_pull_uint32(comndr, NDR_SCALARS, &payload_header[3]));
-
-	if (payload_header[0] != 0x00081001) {
-		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION,
-				      "Bad XPRESS payload_header[0] [0x%08X] != [0x00081001] (PULL)",
-				      payload_header[0]);
-	}
-	if (payload_header[1] != 0xCCCCCCCC) {
-		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION,
-				      "Bad XPRESS payload_header[1] [0x%08X] != [0xCCCCCCCC] (PULL)",
-				      payload_header[1]);
-	}
-
-	payload_size = payload_header[2];
-
-	if (payload_header[3] != 0x00000000) {
-		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION,
-				      "Bad XPRESS payload_header[3] [0x%08X] != [0x00000000] (PULL)",
-				      payload_header[3]);
-	}
-
-	payload_offset = comndr->offset;
-	NDR_CHECK(ndr_pull_advance(comndr, payload_size));
-	payload = comndr->data + payload_offset;
-
-	comndr->data		= payload;
-	comndr->data_size	= payload_size;
-	comndr->offset		= 0;
-
 	*_comndr = comndr;
 	return NDR_ERR_SUCCESS;
 }
 
-static enum ndr_err_code ndr_push_compression_xpress(struct ndr_push *subndr,
-					    struct ndr_push *comndr)
-{
-	return ndr_push_error(subndr, NDR_ERR_COMPRESSION, "XPRESS compression is not supported yet (PUSH)");
-}
-
-/*
-  handle compressed subcontext buffers, which in midl land are user-marshalled, but
-  we use magic in pidl to make them easier to cope with
-*/
-enum ndr_err_code ndr_pull_compression_start(struct ndr_pull *subndr,
-				    struct ndr_pull **_comndr,
-				    enum ndr_compression_alg compression_alg,
-				    ssize_t decompressed_len)
-{
-	switch (compression_alg) {
-	case NDR_COMPRESSION_MSZIP:
-		return ndr_pull_compression_mszip(subndr, _comndr, decompressed_len);
-	case NDR_COMPRESSION_XPRESS:
-		return ndr_pull_compression_xpress(subndr, _comndr, decompressed_len);
-	default:
-		return ndr_pull_error(subndr, NDR_ERR_COMPRESSION, "Bad compression algorithm %d (PULL)", 
-				      compression_alg);
-	}
-	return NDR_ERR_SUCCESS;
-}
-
 enum ndr_err_code ndr_pull_compression_end(struct ndr_pull *subndr,
 				  struct ndr_pull *comndr,
 				  enum ndr_compression_alg compression_alg,
@@ -383,17 +373,27 @@ enum ndr_err_code ndr_pull_compression_end(struct ndr_pull *subndr,
   push a compressed subcontext
 */
 enum ndr_err_code ndr_push_compression_start(struct ndr_push *subndr,
-				    struct ndr_push **_comndr,
+				    struct ndr_push **_uncomndr,
 				    enum ndr_compression_alg compression_alg,
 				    ssize_t decompressed_len)
 {
-	struct ndr_push *comndr;
+	struct ndr_push *uncomndr;
 
-	comndr = ndr_push_init_ctx(subndr, subndr->iconv_convenience);
-	NDR_ERR_HAVE_NO_MEMORY(comndr);
-	comndr->flags	= subndr->flags;
+	switch (compression_alg) {
+	case NDR_COMPRESSION_MSZIP:
+	case NDR_COMPRESSION_XPRESS:
+		break;
+	default:
+		return ndr_push_error(subndr, NDR_ERR_COMPRESSION,
+				      "Bad compression algorithm %d (PUSH)",
+				      compression_alg);
+	}
 
-	*_comndr = comndr;
+	uncomndr = ndr_push_init_ctx(subndr, subndr->iconv_convenience);
+	NDR_ERR_HAVE_NO_MEMORY(uncomndr);
+	uncomndr->flags	= subndr->flags;
+
+	*_uncomndr = uncomndr;
 	return NDR_ERR_SUCCESS;
 }
 
@@ -401,18 +401,42 @@ enum ndr_err_code ndr_push_compression_start(struct ndr_push *subndr,
   push a compressed subcontext
 */
 enum ndr_err_code ndr_push_compression_end(struct ndr_push *subndr,
-				  struct ndr_push *comndr,
+				  struct ndr_push *uncomndr,
 				  enum ndr_compression_alg compression_alg,
 				  ssize_t decompressed_len)
 {
+	struct ndr_pull *ndrpull;
+	bool last = false;
+	z_stream z;
+
+	ndrpull = talloc_zero(uncomndr, struct ndr_pull);
+	NDR_ERR_HAVE_NO_MEMORY(ndrpull);
+	ndrpull->flags		= uncomndr->flags;
+	ndrpull->data		= uncomndr->data;
+	ndrpull->data_size	= uncomndr->offset;
+	ndrpull->offset		= 0;
+
+	ndrpull->iconv_convenience = talloc_reference(ndrpull, subndr->iconv_convenience);
+
 	switch (compression_alg) {
 	case NDR_COMPRESSION_MSZIP:
-		return ndr_push_compression_mszip(subndr, comndr);
+		ZERO_STRUCT(z);
+		while (!last) {
+			NDR_CHECK(ndr_push_compression_mszip_chunk(subndr, ndrpull, &z, &last));
+		}
+		break;
+
 	case NDR_COMPRESSION_XPRESS:
-		return ndr_push_compression_xpress(subndr, comndr);
+		while (!last) {
+			NDR_CHECK(ndr_push_compression_xpress_chunk(subndr, ndrpull, &last));
+		}
+		break;
+
 	default:
 		return ndr_push_error(subndr, NDR_ERR_COMPRESSION, "Bad compression algorithm %d (PUSH)", 
 				      compression_alg);
 	}
+
+	talloc_free(uncomndr);
 	return NDR_ERR_SUCCESS;
 }
diff --git a/source4/librpc/ndr/ndr_drsuapi.c b/source4/librpc/ndr/ndr_drsuapi.c
index 1b6be9ed8e..e77ab54071 100644
--- a/source4/librpc/ndr/ndr_drsuapi.c
+++ b/source4/librpc/ndr/ndr_drsuapi.c
@@ -24,6 +24,7 @@
 #include "librpc/gen_ndr/ndr_drsuapi.h"
 #include "librpc/gen_ndr/ndr_misc.h"
 #include "lib/util/asn1.h"
+#include "librpc/ndr/ndr_compression.h"
 
 void ndr_print_drsuapi_DsReplicaObjectListItem(struct ndr_print *ndr, const char *name, 
 					       const struct drsuapi_DsReplicaObjectListItem *r)
@@ -176,3 +177,175 @@ size_t ndr_size_drsuapi_DsReplicaOID_oid(const char *oid, int flags)
 	data_blob_free(&_blob);
 	return ret;
 }
+
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesMSZIPCtr1(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesMSZIPCtr1 *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		uint32_t decompressed_length = 0;
+		uint32_t compressed_length = 0;
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					decompressed_length = _ndr_ts_compressed->offset;
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+				}
+				compressed_length = _ndr_ts->offset;
+				talloc_free(_ndr_ts);
+			}
+		}
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, decompressed_length));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, compressed_length));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ts));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+				}
+				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ts, 4, -1));
+			}
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesMSZIPCtr6(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesMSZIPCtr6 *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		uint32_t decompressed_length = 0;
+		uint32_t compressed_length = 0;
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					decompressed_length = _ndr_ts_compressed->offset;
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+				}
+				compressed_length = _ndr_ts->offset;
+				talloc_free(_ndr_ts);
+			}
+		}
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, decompressed_length));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, compressed_length));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ts));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+				}
+				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ts, 4, -1));
+			}
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesXPRESSCtr1(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesXPRESSCtr1 *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		uint32_t decompressed_length = 0;
+		uint32_t compressed_length = 0;
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					decompressed_length = _ndr_ts_compressed->offset;
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+				}
+				compressed_length = _ndr_ts->offset;
+				talloc_free(_ndr_ts);
+			}
+		}
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, decompressed_length));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, compressed_length));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ts));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+				}
+				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ts, 4, -1));
+			}
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesXPRESSCtr6(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesXPRESSCtr6 *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		uint32_t decompressed_length = 0;
+		uint32_t compressed_length = 0;
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					decompressed_length = _ndr_ts_compressed->offset;
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+				}
+				compressed_length = _ndr_ts->offset;
+				talloc_free(_ndr_ts);
+			}
+		}
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, decompressed_length));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, compressed_length));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ts));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+				}
+				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ts, 4, -1));
+			}
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
diff --git a/source4/pidl/lib/Parse/Pidl/NDR.pm b/source4/pidl/lib/Parse/Pidl/NDR.pm
index 1e4504764a..10bd29715b 100644
--- a/source4/pidl/lib/Parse/Pidl/NDR.pm
+++ b/source4/pidl/lib/Parse/Pidl/NDR.pm
@@ -287,6 +287,22 @@ sub GetElementLevelTable($$)
 	return $order;
 }
 
+sub GetTypedefLevelTable($$$)
+{
+	my ($e, $data, $pointer_default) = @_;
+
+	my $order = [];
+
+	push (@$order, {
+		TYPE => "TYPEDEF"
+	});
+
+	my $i = 0;
+	foreach (@$order) { $_->{LEVEL_INDEX} = $i; $i+=1; }
+
+	return $order;
+}
+
 #####################################################################
 # see if a type contains any deferred data 
 sub can_contain_deferred($)
@@ -575,6 +591,7 @@ sub ParseTypedef($$)
 		NAME => $d->{NAME},
 		TYPE => $d->{TYPE},
 		PROPERTIES => $d->{PROPERTIES},
+		LEVELS => GetTypedefLevelTable($d, $data, $pointer_default),
 		DATA => $data,
 		ORIGINAL => $d
 	};
@@ -795,20 +812,21 @@ sub ContainsDeferred($$)
 sub el_name($)
 {
 	my $e = shift;
+	my $name = "<ANONYMOUS>";
 
-	if ($e->{PARENT} && $e->{PARENT}->{NAME}) {
-		return "$e->{PARENT}->{NAME}.$e->{NAME}";
-	}
+	$name = $e->{NAME} if defined($e->{NAME});
 
-	if ($e->{PARENT} && $e->{PARENT}->{PARENT}->{NAME}) {
-		return "$e->{PARENT}->{PARENT}->{NAME}.$e->{NAME}";
+	if (defined($e->{PARENT}) and defined($e->{PARENT}->{NAME})) {
+		return "$e->{PARENT}->{NAME}.$name";
 	}
 
-	if ($e->{PARENT}) {
-		return "$e->{PARENT}->{NAME}.$e->{NAME}";
+	if (defined($e->{PARENT}) and
+	    defined($e->{PARENT}->{PARENT}) and
+	    defined($e->{PARENT}->{PARENT}->{NAME})) {
+		return "$e->{PARENT}->{PARENT}->{NAME}.$name";
 	}
 
-	return $e->{NAME};
+	return $name;
 }
 
 ###################################
@@ -858,25 +876,25 @@ my %property_list = (
 	"unique"		=> ["ELEMENT"],
 	"ignore"		=> ["ELEMENT"],
 	"relative"		=> ["ELEMENT"],
-	"relative_base"		=> ["TYPEDEF"],
+	"relative_base"		=> ["TYPEDEF", "STRUCT", "UNION"],
 
-	"gensize"		=> ["TYPEDEF"],
+	"gensize"		=> ["TYPEDEF", "STRUCT", "UNION"],
 	"value"			=> ["ELEMENT"],
-	"flag"			=> ["ELEMENT", "TYPEDEF"],
+	"flag"			=> ["ELEMENT", "TYPEDEF", "STRUCT", "UNION", "ENUM", "BITMAP"],
 
 	# generic
-	"public"		=> ["FUNCTION", "TYPEDEF"],
-	"nopush"		=> ["FUNCTION", "TYPEDEF"],
-	"nopull"		=> ["FUNCTION", "TYPEDEF"],
-	"nosize"		=> ["FUNCTION", "TYPEDEF"],
-	"noprint"		=> ["FUNCTION", "TYPEDEF"],
-	"noejs"			=> ["FUNCTION", "TYPEDEF"],
+	"public"		=> ["FUNCTION", "TYPEDEF", "STRUCT", "UNION", "ENUM", "BITMAP"],
+	"nopush"		=> ["FUNCTION", "TYPEDEF", "STRUCT", "UNION", "ENUM", "BITMAP"],
+	"nopull"		=> ["FUNCTION", "TYPEDEF", "STRUCT", "UNION", "ENUM", "BITMAP"],
+	"nosize"		=> ["FUNCTION", "TYPEDEF", "STRUCT", "UNION", "ENUM", "BITMAP"],
+	"noprint"		=> ["FUNCTION", "TYPEDEF", "STRUCT", "UNION", "ENUM", "BITMAP", "ELEMENT"],
+	"noejs"			=> ["FUNCTION", "TYPEDEF", "STRUCT", "UNION", "ENUM", "BITMAP"],
 	"todo"			=> ["FUNCTION"],
 
 	# union
 	"switch_is"		=> ["ELEMENT"],
-	"switch_type"		=> ["ELEMENT", "TYPEDEF"],
-	"nodiscriminant"	=> ["TYPEDEF"],
+	"switch_type"		=> ["ELEMENT", "UNION"],
+	"nodiscriminant"	=> ["UNION"],
 	"case"			=> ["ELEMENT"],
 	"default"		=> ["ELEMENT"],
 
@@ -889,15 +907,15 @@ my %property_list = (
 	"compression"		=> ["ELEMENT"],
 
 	# enum
-	"enum8bit"		=> ["TYPEDEF"],
-	"enum16bit"		=> ["TYPEDEF"],
-	"v1_enum"		=> ["TYPEDEF"],
+	"enum8bit"		=> ["ENUM"],
+	"enum16bit"		=> ["ENUM"],
+	"v1_enum"		=> ["ENUM"],
 
 	# bitmap
-	"bitmap8bit"		=> ["TYPEDEF"],
-	"bitmap16bit"		=> ["TYPEDEF"],
-	"bitmap32bit"		=> ["TYPEDEF"],
-	"bitmap64bit"		=> ["TYPEDEF"],
+	"bitmap8bit"		=> ["BITMAP"],
+	"bitmap16bit"		=> ["BITMAP"],
+	"bitmap32bit"		=> ["BITMAP"],
+	"bitmap64bit"		=> ["BITMAP"],
 
 	# array
 	"range"			=> ["ELEMENT"],
@@ -921,7 +939,7 @@ sub ValidProperties($$)
 			unless defined($property_list{$key});
 
    		fatal($e, el_name($e) . ": property '$key' not allowed on '$t'")
-			unless grep($t, @{$property_list{$key}});
+			unless grep(/^$t$/, @{$property_list{$key}});
 	}
 }
 
@@ -1101,6 +1119,9 @@ sub ValidTypedef($)
 
 	$data->{PARENT} = $typedef;
 
+	$data->{FILE} = $typedef->{FILE} unless defined($data->{FILE});
+	$data->{LINE} = $typedef->{LINE} unless defined($data->{LINE});
+
 	ValidType($data) if (ref($data) eq "HASH");
 }
 
diff --git a/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm b/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
index a0de1f127a..745777d012 100644
--- a/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
+++ b/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
@@ -158,26 +158,26 @@ sub fn_declare($$$$)
 
 ###################################################################
 # setup any special flags for an element or structure
-sub start_flags($$)
+sub start_flags($$$)
 {
-	my ($self, $e) = @_;
+	my ($self, $e, $ndr) = @_;
 	my $flags = has_property($e, "flag");
 	if (defined $flags) {
 		$self->pidl("{");
 		$self->indent;
-		$self->pidl("uint32_t _flags_save_$e->{TYPE} = ndr->flags;");
-		$self->pidl("ndr_set_flags(&ndr->flags, $flags);");
+		$self->pidl("uint32_t _flags_save_$e->{TYPE} = $ndr->flags;");
+		$self->pidl("ndr_set_flags(&$ndr->flags, $flags);");
 	}
 }
 
 ###################################################################
 # end any special flags for an element or structure
-sub end_flags($$)
+sub end_flags($$$)
 {
-	my ($self, $e) = @_;
+	my ($self, $e, $ndr) = @_;
 	my $flags = has_property($e, "flag");
 	if (defined $flags) {
-		$self->pidl("ndr->flags = _flags_save_$e->{TYPE};");
+		$self->pidl("$ndr->flags = _flags_save_$e->{TYPE};");
 		$self->deindent;
 		$self->pidl("}");
 	}
@@ -331,12 +331,12 @@ sub ParseArrayPullHeader($$$$$$)
 	} else {
 		$length = $size = ParseExprExt($l->{SIZE_IS}, $env, $e->{ORIGINAL},
 			check_null_pointer($e, $env, sub { $self->pidl(shift); },
-					   "return ndr_pull_error(ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for size_is()\");"),
+					   "return ndr_pull_error($ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for size_is()\");"),
 			check_fully_dereferenced($e, $env));
 	}
 
 	if ((!$l->{IS_SURROUNDING}) and $l->{IS_CONFORMANT}) {
-		$self->pidl("NDR_CHECK(ndr_pull_array_size(ndr, " . get_pointer_to($var_name) . "));");
+		$self->pidl("NDR_CHECK(ndr_pull_array_size($ndr, " . get_pointer_to($var_name) . "));");
 	}
 
 	if ($l->{IS_VARYING}) {
@@ -357,9 +357,9 @@ sub ParseArrayPullHeader($$$$$$)
 		$self->defer_indent;
 		my $size = ParseExprExt($l->{SIZE_IS}, $env, $e->{ORIGINAL},
 			check_null_pointer($e, $env, sub { $self->defer(shift); },
-					   "return ndr_pull_error(ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for size_is()\");"),
+					   "return ndr_pull_error($ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for size_is()\");"),
 			check_fully_dereferenced($e, $env));
-		$self->defer("NDR_CHECK(ndr_check_array_size(ndr, (void*)" . get_pointer_to($var_name) . ", $size));");
+		$self->defer("NDR_CHECK(ndr_check_array_size($ndr, (void*)" . get_pointer_to($var_name) . ", $size));");
 		$self->defer_deindent;
 		$self->defer("}");
 	}
@@ -369,9 +369,9 @@ sub ParseArrayPullHeader($$$$$$)
 		$self->defer_indent;
 		my $length = ParseExprExt($l->{LENGTH_IS}, $env, $e->{ORIGINAL}, 
 			check_null_pointer($e, $env, sub { $self->defer(shift); },
-					   "return ndr_pull_error(ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for length_is()\");"),
+					   "return ndr_pull_error($ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for length_is()\");"),
 			check_fully_dereferenced($e, $env));
-		$self->defer("NDR_CHECK(ndr_check_array_length(ndr, (void*)" . get_pointer_to($var_name) . ", $length));");
+		$self->defer("NDR_CHECK(ndr_check_array_length($ndr, (void*)" . get_pointer_to($var_name) . ", $length));");
 		$self->defer_deindent;
 		$self->defer("}");
 	}
@@ -543,7 +543,7 @@ sub ParseElementPushLevel
 			$self->ParseElementPushLevel($e, GetNextLevel($e, $l), $subndr, $var_name, $env, 1, 1);
 			$self->ParseSubcontextPushEnd($e, $l, $ndr, $env);
 		} elsif ($l->{TYPE} eq "POINTER") {
-			$self->ParsePtrPush($e, $l, $var_name);
+			$self->ParsePtrPush($e, $l, $ndr, $var_name);
 		} elsif ($l->{TYPE} eq "ARRAY") {
 			my $length = $self->ParseArrayPushHeader($e, $l, $ndr, $var_name, $env); 
 
@@ -561,6 +561,8 @@ sub ParseElementPushLevel
 			$self->ParseSwitchPush($e, $l, $ndr, $var_name, $env);
 		} elsif ($l->{TYPE} eq "DATA") {
 			$self->ParseDataPush($e, $l, $ndr, $var_name, $primitives, $deferred);
+		} elsif ($l->{TYPE} eq "TYPEDEF") {
+			$typefamily{$e->{DATA}->{TYPE}}->{PUSH_FN_BODY}->($self, $e->{DATA}, $ndr, $var_name);
 		}
 	}
 
@@ -569,7 +571,7 @@ sub ParseElementPushLevel
 			$self->pidl("if ($var_name) {");
 			$self->indent;
 			if ($l->{POINTER_TYPE} eq "relative") {
-				$self->pidl("NDR_CHECK(ndr_push_relative_ptr2(ndr, $var_name));");
+				$self->pidl("NDR_CHECK(ndr_push_relative_ptr2($ndr, $var_name));");
 			}
 		}
 		$var_name = get_value_of($var_name);
@@ -629,7 +631,7 @@ sub ParseElementPush($$$$$$)
 
 	$var_name = append_prefix($e, $var_name);
 
-	$self->start_flags($e);
+	$self->start_flags($e, $ndr);
 
 	if (defined(my $value = has_property($e, "value"))) {
 		$var_name = ParseExpr($value, $env, $e->{ORIGINAL});
@@ -637,7 +639,7 @@ sub ParseElementPush($$$$$$)
 
 	$self->ParseElementPushLevel($e, $e->{LEVELS}[0], $ndr, $var_name, $env, $primitives, $deferred);
 
-	$self->end_flags($e);
+	$self->end_flags($e, $ndr);
 
 	if ($e->{REPRESENTATION_TYPE} ne $e->{TYPE}) {
 		$self->deindent;
@@ -647,25 +649,25 @@ sub ParseElementPush($$$$$$)
 
 #####################################################################
 # parse a pointer in a struct element or function
-sub ParsePtrPush($$$$)
+sub ParsePtrPush($$$$$)
 {
-	my ($self,$e,$l,$var_name) = @_;
+	my ($self,$e,$l,$ndr,$var_name) = @_;
 
 	if ($l->{POINTER_TYPE} eq "ref") {
 		$self->pidl("if ($var_name == NULL) {");
 		$self->indent;
-		$self->pidl("return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, \"NULL [ref] pointer\");");
+		$self->pidl("return ndr_push_error($ndr, NDR_ERR_INVALID_POINTER, \"NULL [ref] pointer\");");
 		$self->deindent;
 		$self->pidl("}");
 		if ($l->{LEVEL} eq "EMBEDDED") {
 			$self->pidl("NDR_CHECK(ndr_push_ref_ptr(ndr));");
 		}
 	} elsif ($l->{POINTER_TYPE} eq "relative") {
-		$self->pidl("NDR_CHECK(ndr_push_relative_ptr1(ndr, $var_name));");
+		$self->pidl("NDR_CHECK(ndr_push_relative_ptr1($ndr, $var_name));");
 	} elsif ($l->{POINTER_TYPE} eq "unique") {
-		$self->pidl("NDR_CHECK(ndr_push_unique_ptr(ndr, $var_name));");
+		$self->pidl("NDR_CHECK(ndr_push_unique_ptr($ndr, $var_name));");
 	} elsif ($l->{POINTER_TYPE} eq "full") {
-		$self->pidl("NDR_CHECK(ndr_push_full_ptr(ndr, $var_name));");
+		$self->pidl("NDR_CHECK(ndr_push_full_ptr($ndr, $var_name));");
 	} else {
 		die("Unhandled pointer type $l->{POINTER_TYPE}");
 	}
@@ -702,45 +704,45 @@ sub need_pointer_to($$$)
 	return 0;
 }
 
-sub ParseDataPrint($$$$)
+sub ParseDataPrint($$$$$)
 {
-	my ($self, $e, $l, $var_name) = @_;
-	
+	my ($self, $e, $l, $ndr, $var_name) = @_;
+
 	if (not ref($l->{DATA_TYPE}) or defined($l->{DATA_TYPE}->{NAME})) {
 
 		if (need_pointer_to($e, $l, 1)) {
 			$var_name = get_pointer_to($var_name);
 		}
 
-		$self->pidl(TypeFunctionName("ndr_print", $l->{DATA_TYPE})."(ndr, \"$e->{NAME}\", $var_name);");
+		$self->pidl(TypeFunctionName("ndr_print", $l->{DATA_TYPE})."($ndr, \"$e->{NAME}\", $var_name);");
 	} else {
-		$self->ParseTypePrint($l->{DATA_TYPE}, $var_name);
+		$self->ParseTypePrint($l->{DATA_TYPE}, $ndr, $var_name);
 	}
 }
 
 #####################################################################
 # print scalars in a structure element
-sub ParseElementPrint($$$$)
+sub ParseElementPrint($$$$$)
 {
-	my($self, $e, $var_name, $env) = @_;
+	my($self, $e, $ndr, $var_name, $env) = @_;
 
 	return if (has_property($e, "noprint"));
 
 	if ($e->{REPRESENTATION_TYPE} ne $e->{TYPE}) {
-		$self->pidl("ndr_print_$e->{REPRESENTATION_TYPE}(ndr, \"$e->{NAME}\", $var_name);");
+		$self->pidl("ndr_print_$e->{REPRESENTATION_TYPE}($ndr, \"$e->{NAME}\", $var_name);");
 		return;
 	}
 
 	$var_name = append_prefix($e, $var_name);
 
 	if (defined(my $value = has_property($e, "value"))) {
-		$var_name = "(ndr->flags & LIBNDR_PRINT_SET_VALUES)?" . ParseExpr($value,$env, $e->{ORIGINAL}) . ":$var_name";
+		$var_name = "($ndr->flags & LIBNDR_PRINT_SET_VALUES)?" . ParseExpr($value,$env, $e->{ORIGINAL}) . ":$var_name";
 	}
 
 	foreach my $l (@{$e->{LEVELS}}) {
 		if ($l->{TYPE} eq "POINTER") {
-			$self->pidl("ndr_print_ptr(ndr, \"$e->{NAME}\", $var_name);");
-			$self->pidl("ndr->depth++;");
+			$self->pidl("ndr_print_ptr($ndr, \"$e->{NAME}\", $var_name);");
+			$self->pidl("$ndr->depth++;");
 			if ($l->{POINTER_TYPE} ne "ref") {
 				$self->pidl("if ($var_name) {");
 				$self->indent;
@@ -761,17 +763,17 @@ sub ParseElementPrint($$$$)
 			}
 
 			if (is_charset_array($e,$l)) {
-				$self->pidl("ndr_print_string(ndr, \"$e->{NAME}\", $var_name);");
+				$self->pidl("ndr_print_string($ndr, \"$e->{NAME}\", $var_name);");
 				last;
 			} elsif (has_fast_array($e, $l)) {
 				my $nl = GetNextLevel($e, $l);
-				$self->pidl("ndr_print_array_$nl->{DATA_TYPE}(ndr, \"$e->{NAME}\", $var_name, $length);");
+				$self->pidl("ndr_print_array_$nl->{DATA_TYPE}($ndr, \"$e->{NAME}\", $var_name, $length);");
 				last;
 			} else {
 				my $counter = "cntr_$e->{NAME}_$l->{LEVEL_INDEX}";
 
-				$self->pidl("ndr->print(ndr, \"\%s: ARRAY(\%d)\", \"$e->{NAME}\", (int)$length);");
-				$self->pidl("ndr->depth++;");
+				$self->pidl("$ndr->print($ndr, \"\%s: ARRAY(\%d)\", \"$e->{NAME}\", (int)$length);");
+				$self->pidl("$ndr->depth++;");
 				$self->pidl("for ($counter=0;$counter<$length;$counter++) {");
 				$self->indent;
 				$self->pidl("char *idx_$l->{LEVEL_INDEX}=NULL;");
@@ -781,11 +783,11 @@ sub ParseElementPrint($$$$)
 				$var_name = get_array_element($var_name, $counter);
 			}
 		} elsif ($l->{TYPE} eq "DATA") {
-			$self->ParseDataPrint($e, $l, $var_name);
+			$self->ParseDataPrint($e, $l, $ndr, $var_name);
 		} elsif ($l->{TYPE} eq "SWITCH") {
 			my $switch_var = ParseExprExt($l->{SWITCH_IS}, $env, $e->{ORIGINAL}, 
 						check_null_pointer($e, $env, sub { $self->pidl(shift); }, "return;"), check_fully_dereferenced($e, $env));
-			$self->pidl("ndr_print_set_switch_value(ndr, " . get_pointer_to($var_name) . ", $switch_var);");
+			$self->pidl("ndr_print_set_switch_value($ndr, " . get_pointer_to($var_name) . ", $switch_var);");
 		} 
 	}
 
@@ -795,7 +797,7 @@ sub ParseElementPrint($$$$)
 				$self->deindent;
 				$self->pidl("}");
 			}
-			$self->pidl("ndr->depth--;");
+			$self->pidl("$ndr->depth--;");
 		} elsif (($l->{TYPE} eq "ARRAY")
 			and not is_charset_array($e,$l)
 			and not has_fast_array($e,$l)) {
@@ -804,7 +806,7 @@ sub ParseElementPrint($$$$)
 			$self->pidl("}");
 			$self->deindent;
 			$self->pidl("}");
-			$self->pidl("ndr->depth--;");
+			$self->pidl("$ndr->depth--;");
 		}
 	}
 }
@@ -816,7 +818,7 @@ sub ParseSwitchPull($$$$$$)
 	my($self,$e,$l,$ndr,$var_name,$env) = @_;
 	my $switch_var = ParseExprExt($l->{SWITCH_IS}, $env, $e->{ORIGINAL}, 
 		check_null_pointer($e, $env, sub { $self->pidl(shift); },
-				   "return ndr_pull_error(ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for switch_is()\");"),
+				   "return ndr_pull_error($ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for switch_is()\");"),
 		check_fully_dereferenced($e, $env));
 
 	$var_name = get_pointer_to($var_name);
@@ -830,7 +832,7 @@ sub ParseSwitchPush($$$$$$)
 	my($self,$e,$l,$ndr,$var_name,$env) = @_;
 	my $switch_var = ParseExprExt($l->{SWITCH_IS}, $env, $e->{ORIGINAL}, 
 		check_null_pointer($e, $env, sub { $self->pidl(shift); },
-				   "return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for switch_is()\");"),
+				   "return ndr_push_error($ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for switch_is()\");"),
 		check_fully_dereferenced($e, $env));
 
 	$var_name = get_pointer_to($var_name);
@@ -861,7 +863,7 @@ sub ParseDataPull($$$$$$$)
 			$self->pidl("}");
 		}
 	} else {
-		$self->ParseTypePull($l->{DATA_TYPE}, $var_name, $primitives, $deferred);
+		$self->ParseTypePull($l->{DATA_TYPE}, $ndr, $var_name, $primitives, $deferred);
 	}
 }
 
@@ -880,7 +882,7 @@ sub ParseDataPush($$$$$$$)
 
 		$self->pidl("NDR_CHECK(".TypeFunctionName("ndr_push", $l->{DATA_TYPE})."($ndr, $ndr_flags, $var_name));");
 	} else {
-		$self->ParseTypePush($l->{DATA_TYPE}, $var_name, $primitives, $deferred);
+		$self->ParseTypePush($l->{DATA_TYPE}, $ndr, $var_name, $primitives, $deferred);
 	}
 }
 
@@ -936,9 +938,9 @@ sub ParseMemCtxPullFlags($$$$)
 	return $mem_flags;
 }
 
-sub ParseMemCtxPullStart($$$$)
+sub ParseMemCtxPullStart($$$$$)
 {
-	my ($self, $e, $l, $ptr_name) = @_;
+	my ($self, $e, $l, $ndr, $ptr_name) = @_;
 
 	my $mem_r_ctx = "_mem_save_$e->{NAME}_$l->{LEVEL_INDEX}";
 	my $mem_c_ctx = $ptr_name;
@@ -946,20 +948,20 @@ sub ParseMemCtxPullStart($$$$)
 
 	return unless defined($mem_c_flags);
 
-	$self->pidl("$mem_r_ctx = NDR_PULL_GET_MEM_CTX(ndr);");
-	$self->pidl("NDR_PULL_SET_MEM_CTX(ndr, $mem_c_ctx, $mem_c_flags);");
+	$self->pidl("$mem_r_ctx = NDR_PULL_GET_MEM_CTX($ndr);");
+	$self->pidl("NDR_PULL_SET_MEM_CTX($ndr, $mem_c_ctx, $mem_c_flags);");
 }
 
-sub ParseMemCtxPullEnd($$$)
+sub ParseMemCtxPullEnd($$$$)
 {
-	my ($self, $e, $l) = @_;
+	my ($self, $e, $l, $ndr) = @_;
 
 	my $mem_r_ctx = "_mem_save_$e->{NAME}_$l->{LEVEL_INDEX}";
 	my $mem_r_flags = $self->ParseMemCtxPullFlags($e, $l);
 
 	return unless defined($mem_r_flags);
 
-	$self->pidl("NDR_PULL_SET_MEM_CTX(ndr, $mem_r_ctx, $mem_r_flags);");
+	$self->pidl("NDR_PULL_SET_MEM_CTX($ndr, $mem_r_ctx, $mem_r_flags);");
 }
 
 sub CheckStringTerminator($$$$$)
@@ -1011,6 +1013,8 @@ sub ParseElementPullLevel
 			$self->ParseSwitchPull($e, $l, $ndr, $var_name, $env);
 		} elsif ($l->{TYPE} eq "DATA") {
 			$self->ParseDataPull($e, $l, $ndr, $var_name, $primitives, $deferred);
+		} elsif ($l->{TYPE} eq "TYPEDEF") {
+			$typefamily{$e->{DATA}->{TYPE}}->{PULL_FN_BODY}->($self, $e->{DATA}, $ndr, $var_name);
 		}
 	}
 
@@ -1022,21 +1026,21 @@ sub ParseElementPullLevel
 
 			if ($l->{POINTER_TYPE} eq "relative") {
 				$self->pidl("uint32_t _relative_save_offset;");
-				$self->pidl("_relative_save_offset = ndr->offset;");
-				$self->pidl("NDR_CHECK(ndr_pull_relative_ptr2(ndr, $var_name));");
+				$self->pidl("_relative_save_offset = $ndr->offset;");
+				$self->pidl("NDR_CHECK(ndr_pull_relative_ptr2($ndr, $var_name));");
 			}
 		}
 
-		$self->ParseMemCtxPullStart($e, $l, $var_name);
+		$self->ParseMemCtxPullStart($e, $l, $ndr, $var_name);
 
 		$var_name = get_value_of($var_name);
 		$self->ParseElementPullLevel($e, GetNextLevel($e,$l), $ndr, $var_name, $env, 1, 1);
 
-		$self->ParseMemCtxPullEnd($e,$l);
+		$self->ParseMemCtxPullEnd($e, $l, $ndr);
 
 		if ($l->{POINTER_TYPE} ne "ref") {
     			if ($l->{POINTER_TYPE} eq "relative") {
-				$self->pidl("ndr->offset = _relative_save_offset;");
+				$self->pidl("$ndr->offset = _relative_save_offset;");
 			}
 			$self->deindent;
 			$self->pidl("}");
@@ -1049,7 +1053,7 @@ sub ParseElementPullLevel
 
 		$var_name = get_array_element($var_name, $counter);
 
-		$self->ParseMemCtxPullStart($e, $l, $array_name);
+		$self->ParseMemCtxPullStart($e, $l, $ndr, $array_name);
 
 		if (($primitives and not $l->{IS_DEFERRED}) or ($deferred and $l->{IS_DEFERRED})) {
 			my $nl = GetNextLevel($e,$l);
@@ -1073,7 +1077,7 @@ sub ParseElementPullLevel
 			$self->pidl("}");
 		}
 
-		$self->ParseMemCtxPullEnd($e, $l);
+		$self->ParseMemCtxPullEnd($e, $l, $ndr);
 
 	} elsif ($l->{TYPE} eq "SWITCH") {
 		$self->ParseElementPullLevel($e, GetNextLevel($e,$l), $ndr, $var_name, $env, $primitives, $deferred);
@@ -1103,11 +1107,11 @@ sub ParseElementPull($$$$$$)
 
 	$var_name = append_prefix($e, $var_name);
 
-	$self->start_flags($e);
+	$self->start_flags($e, $ndr);
 
 	$self->ParseElementPullLevel($e,$e->{LEVELS}[0],$ndr,$var_name,$env,$primitives,$deferred);
 
-	$self->end_flags($e);
+	$self->end_flags($e, $ndr);
 
 	# Representation type is different from transmit_as
 	if ($e->{REPRESENTATION_TYPE} ne $e->{TYPE}) {
@@ -1131,7 +1135,7 @@ sub ParsePtrPull($$$$$)
 	if ($l->{POINTER_TYPE} eq "ref" and $l->{LEVEL} eq "TOP") {
 
 		if (!$next_is_array and !$next_is_string) {
-			$self->pidl("if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {");
+			$self->pidl("if ($ndr->flags & LIBNDR_FLAG_REF_ALLOC) {");
 			$self->pidl("\tNDR_PULL_ALLOC($ndr, $var_name);"); 
 			$self->pidl("}");
 		}
@@ -1172,9 +1176,9 @@ sub ParsePtrPull($$$$$)
 	$self->pidl("}");
 }
 
-sub ParseStructPushPrimitives($$$$)
+sub ParseStructPushPrimitives($$$$$)
 {
-	my ($self, $struct, $varname, $env) = @_;
+	my ($self, $struct, $ndr, $varname, $env) = @_;
 
 	# see if the structure contains a conformant array. If it
 	# does, then it must be the last element of the structure, and
@@ -1198,39 +1202,39 @@ sub ParseStructPushPrimitives($$$$)
 				$size = ParseExpr($e->{LEVELS}[0]->{SIZE_IS}, $env, $e->{ORIGINAL});
 			}
 
-			$self->pidl("NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, $size));");
+			$self->pidl("NDR_CHECK(ndr_push_uint32($ndr, NDR_SCALARS, $size));");
 		} else {
-			$self->pidl("NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_string_array_size(ndr, $varname->$e->{NAME})));");
+			$self->pidl("NDR_CHECK(ndr_push_uint32($ndr, NDR_SCALARS, ndr_string_array_size($ndr, $varname->$e->{NAME})));");
 		}
 	}
 
-	$self->pidl("NDR_CHECK(ndr_push_align(ndr, $struct->{ALIGN}));");
+	$self->pidl("NDR_CHECK(ndr_push_align($ndr, $struct->{ALIGN}));");
 
 	if (defined($struct->{PROPERTIES}{relative_base})) {
 		# set the current offset as base for relative pointers
 		# and store it based on the toplevel struct/union
-		$self->pidl("NDR_CHECK(ndr_push_setup_relative_base_offset1(ndr, $varname, ndr->offset));");
+		$self->pidl("NDR_CHECK(ndr_push_setup_relative_base_offset1($ndr, $varname, $ndr->offset));");
 	}
 
-	$self->ParseElementPush($_, "ndr", $env, 1, 0) foreach (@{$struct->{ELEMENTS}});
+	$self->ParseElementPush($_, $ndr, $env, 1, 0) foreach (@{$struct->{ELEMENTS}});
 }
 
-sub ParseStructPushDeferred($$$)
+sub ParseStructPushDeferred($$$$)
 {
-	my ($self, $struct, $varname, $env) = @_;
+	my ($self, $struct, $ndr, $varname, $env) = @_;
 	if (defined($struct->{PROPERTIES}{relative_base})) {
 		# retrieve the current offset as base for relative pointers
 		# based on the toplevel struct/union
-		$self->pidl("NDR_CHECK(ndr_push_setup_relative_base_offset2(ndr, $varname));");
+		$self->pidl("NDR_CHECK(ndr_push_setup_relative_base_offset2($ndr, $varname));");
 	}
-	$self->ParseElementPush($_, "ndr", $env, 0, 1) foreach (@{$struct->{ELEMENTS}});
+	$self->ParseElementPush($_, $ndr, $env, 0, 1) foreach (@{$struct->{ELEMENTS}});
 }
 
 #####################################################################
 # parse a struct
-sub ParseStructPush($$$)
+sub ParseStructPush($$$$)
 {
-	my ($self, $struct, $varname) = @_;
+	my ($self, $struct, $ndr, $varname) = @_;
 	
 	return unless defined($struct->{ELEMENTS});
 
@@ -1240,61 +1244,61 @@ sub ParseStructPush($$$)
 
 	$self->DeclareArrayVariables($_) foreach (@{$struct->{ELEMENTS}});
 
-	$self->start_flags($struct);
+	$self->start_flags($struct, $ndr);
 
 	$self->pidl("if (ndr_flags & NDR_SCALARS) {");
 	$self->indent;
-	$self->ParseStructPushPrimitives($struct, $varname, $env);
+	$self->ParseStructPushPrimitives($struct, $ndr, $varname, $env);
 	$self->deindent;
 	$self->pidl("}");
 
 	$self->pidl("if (ndr_flags & NDR_BUFFERS) {");
 	$self->indent;
-	$self->ParseStructPushDeferred($struct, $varname, $env);
+	$self->ParseStructPushDeferred($struct, $ndr, $varname, $env);
 	$self->deindent;
 	$self->pidl("}");
 
-	$self->end_flags($struct);
+	$self->end_flags($struct, $ndr);
 }
 
 #####################################################################
 # generate a push function for an enum
-sub ParseEnumPush($$$)
+sub ParseEnumPush($$$$)
 {
-	my($self,$enum,$varname) = @_;
+	my($self,$enum,$ndr,$varname) = @_;
 	my($type_fn) = $enum->{BASE_TYPE};
 
-	$self->start_flags($enum);
-	$self->pidl("NDR_CHECK(ndr_push_$type_fn(ndr, NDR_SCALARS, $varname));");
-	$self->end_flags($enum);
+	$self->start_flags($enum, $ndr);
+	$self->pidl("NDR_CHECK(ndr_push_$type_fn($ndr, NDR_SCALARS, $varname));");
+	$self->end_flags($enum, $ndr);
 }
 
 #####################################################################
 # generate a pull function for an enum
-sub ParseEnumPull($$$)
+sub ParseEnumPull($$$$)
 {
-	my($self,$enum,$varname) = @_;
+	my($self,$enum,$ndr,$varname) = @_;
 	my($type_fn) = $enum->{BASE_TYPE};
 	my($type_v_decl) = mapTypeName($type_fn);
 
 	$self->pidl("$type_v_decl v;");
-	$self->start_flags($enum);
-	$self->pidl("NDR_CHECK(ndr_pull_$type_fn(ndr, NDR_SCALARS, &v));");
+	$self->start_flags($enum, $ndr);
+	$self->pidl("NDR_CHECK(ndr_pull_$type_fn($ndr, NDR_SCALARS, &v));");
 	$self->pidl("*$varname = v;");
 
-	$self->end_flags($enum);
+	$self->end_flags($enum, $ndr);
 }
 
 #####################################################################
 # generate a print function for an enum
-sub ParseEnumPrint($$$$)
+sub ParseEnumPrint($$$$$)
 {
-	my($self,$enum,$name,$varname) = @_;
+	my($self,$enum,$ndr,$name,$varname) = @_;
 
 	$self->pidl("const char *val = NULL;");
 	$self->pidl("");
 
-	$self->start_flags($enum);
+	$self->start_flags($enum, $ndr);
 
 	$self->pidl("switch ($varname) {");
 	$self->indent;
@@ -1311,9 +1315,9 @@ sub ParseEnumPrint($$$$)
 	$self->deindent;
 	$self->pidl("}");
 	
-	$self->pidl("ndr_print_enum(ndr, name, \"$enum->{TYPE}\", val, $varname);");
+	$self->pidl("ndr_print_enum($ndr, name, \"$enum->{TYPE}\", val, $varname);");
 
-	$self->end_flags($enum);
+	$self->end_flags($enum, $ndr);
 }
 
 sub DeclEnum($$$$)
@@ -1332,39 +1336,39 @@ $typefamily{ENUM} = {
 
 #####################################################################
 # generate a push function for a bitmap
-sub ParseBitmapPush($$$)
+sub ParseBitmapPush($$$$)
 {
-	my($self,$bitmap,$varname) = @_;
+	my($self,$bitmap,$ndr,$varname) = @_;
 	my($type_fn) = $bitmap->{BASE_TYPE};
 
-	$self->start_flags($bitmap);
+	$self->start_flags($bitmap, $ndr);
 
-	$self->pidl("NDR_CHECK(ndr_push_$type_fn(ndr, NDR_SCALARS, $varname));");
+	$self->pidl("NDR_CHECK(ndr_push_$type_fn($ndr, NDR_SCALARS, $varname));");
 
-	$self->end_flags($bitmap);
+	$self->end_flags($bitmap, $ndr);
 }
 
 #####################################################################
 # generate a pull function for an bitmap
-sub ParseBitmapPull($$$)
+sub ParseBitmapPull($$$$)
 {
-	my($self,$bitmap,$varname) = @_;
+	my($self,$bitmap,$ndr,$varname) = @_;
 	my $type_fn = $bitmap->{BASE_TYPE};
 	my($type_decl) = mapTypeName($bitmap->{BASE_TYPE});
 
 	$self->pidl("$type_decl v;");
-	$self->start_flags($bitmap);
-	$self->pidl("NDR_CHECK(ndr_pull_$type_fn(ndr, NDR_SCALARS, &v));");
+	$self->start_flags($bitmap, $ndr);
+	$self->pidl("NDR_CHECK(ndr_pull_$type_fn($ndr, NDR_SCALARS, &v));");
 	$self->pidl("*$varname = v;");
 
-	$self->end_flags($bitmap);
+	$self->end_flags($bitmap, $ndr);
 }
 
 #####################################################################
 # generate a print function for an bitmap
-sub ParseBitmapPrintElement($$$$$)
+sub ParseBitmapPrintElement($$$$$$)
 {
-	my($self,$e,$bitmap,$name,$varname) = @_;
+	my($self,$e,$bitmap,$ndr,$name,$varname) = @_;
 	my($type_decl) = mapTypeName($bitmap->{BASE_TYPE});
 	my($type_fn) = $bitmap->{BASE_TYPE};
 	my($flag);
@@ -1375,28 +1379,28 @@ sub ParseBitmapPrintElement($$$$$)
 		die "Bitmap: \"$name\" invalid Flag: \"$e\"";
 	}
 
-	$self->pidl("ndr_print_bitmap_flag(ndr, sizeof($type_decl), \"$flag\", $flag, $varname);");
+	$self->pidl("ndr_print_bitmap_flag($ndr, sizeof($type_decl), \"$flag\", $flag, $varname);");
 }
 
 #####################################################################
 # generate a print function for an bitmap
-sub ParseBitmapPrint($$$$)
+sub ParseBitmapPrint($$$$$)
 {
-	my($self,$bitmap,$name,$varname) = @_;
+	my($self,$bitmap,$ndr,$name,$varname) = @_;
 	my($type_decl) = mapTypeName($bitmap->{TYPE});
 	my($type_fn) = $bitmap->{BASE_TYPE};
 
-	$self->start_flags($bitmap);
+	$self->start_flags($bitmap, $ndr);
 
-	$self->pidl("ndr_print_$type_fn(ndr, name, $varname);");
+	$self->pidl("ndr_print_$type_fn($ndr, name, $varname);");
 
-	$self->pidl("ndr->depth++;");
+	$self->pidl("$ndr->depth++;");
 	foreach my $e (@{$bitmap->{ELEMENTS}}) {
-		$self->ParseBitmapPrintElement($e, $bitmap, $name, $varname);
+		$self->ParseBitmapPrintElement($e, $bitmap, $ndr, $name, $varname);
 	}
-	$self->pidl("ndr->depth--;");
+	$self->pidl("$ndr->depth--;");
 
-	$self->end_flags($bitmap);
+	$self->end_flags($bitmap, $ndr);
 }
 
 sub DeclBitmap($$$$)
@@ -1415,9 +1419,9 @@ $typefamily{BITMAP} = {
 
 #####################################################################
 # generate a struct print function
-sub ParseStructPrint($$$$)
+sub ParseStructPrint($$$$$)
 {
-	my($self,$struct,$name,$varname) = @_;
+	my($self,$struct,$ndr,$name,$varname) = @_;
 
 	return unless defined $struct->{ELEMENTS};
 
@@ -1425,17 +1429,17 @@ sub ParseStructPrint($$$$)
 
 	$self->DeclareArrayVariables($_) foreach (@{$struct->{ELEMENTS}});
 
-	$self->pidl("ndr_print_struct(ndr, name, \"$name\");");
+	$self->pidl("ndr_print_struct($ndr, name, \"$name\");");
 
-	$self->start_flags($struct);
+	$self->start_flags($struct, $ndr);
 
-	$self->pidl("ndr->depth++;");
+	$self->pidl("$ndr->depth++;");
 	
-	$self->ParseElementPrint($_, $env->{$_->{NAME}}, $env) 
+	$self->ParseElementPrint($_, $ndr, $env->{$_->{NAME}}, $env)
 		foreach (@{$struct->{ELEMENTS}});
-	$self->pidl("ndr->depth--;");
+	$self->pidl("$ndr->depth--;");
 
-	$self->end_flags($struct);
+	$self->end_flags($struct, $ndr);
 }
 
 sub DeclarePtrVariables($$)
@@ -1474,38 +1478,38 @@ sub DeclareMemCtxVariables($$)
 	}
 }
 
-sub ParseStructPullPrimitives($$$$)
+sub ParseStructPullPrimitives($$$$$)
 {
-	my($self,$struct,$varname,$env) = @_;
+	my($self,$struct,$ndr,$varname,$env) = @_;
 
 	if (defined $struct->{SURROUNDING_ELEMENT}) {
-		$self->pidl("NDR_CHECK(ndr_pull_array_size(ndr, &$varname->$struct->{SURROUNDING_ELEMENT}->{NAME}));");
+		$self->pidl("NDR_CHECK(ndr_pull_array_size($ndr, &$varname->$struct->{SURROUNDING_ELEMENT}->{NAME}));");
 	}
 
-	$self->pidl("NDR_CHECK(ndr_pull_align(ndr, $struct->{ALIGN}));");
+	$self->pidl("NDR_CHECK(ndr_pull_align($ndr, $struct->{ALIGN}));");
 
 	if (defined($struct->{PROPERTIES}{relative_base})) {
 		# set the current offset as base for relative pointers
 		# and store it based on the toplevel struct/union
-		$self->pidl("NDR_CHECK(ndr_pull_setup_relative_base_offset1(ndr, $varname, ndr->offset));");
+		$self->pidl("NDR_CHECK(ndr_pull_setup_relative_base_offset1($ndr, $varname, $ndr->offset));");
 	}
 
-	$self->ParseElementPull($_, "ndr", $env, 1, 0) foreach (@{$struct->{ELEMENTS}});
+	$self->ParseElementPull($_, $ndr, $env, 1, 0) foreach (@{$struct->{ELEMENTS}});
 
 	$self->add_deferred();
 }
 
-sub ParseStructPullDeferred($$$$)
+sub ParseStructPullDeferred($$$$$)
 {
-	my ($self,$struct,$varname,$env) = @_;
+	my ($self,$struct,$ndr,$varname,$env) = @_;
 
 	if (defined($struct->{PROPERTIES}{relative_base})) {
 		# retrieve the current offset as base for relative pointers
 		# based on the toplevel struct/union
-		$self->pidl("NDR_CHECK(ndr_pull_setup_relative_base_offset2(ndr, $varname));");
+		$self->pidl("NDR_CHECK(ndr_pull_setup_relative_base_offset2($ndr, $varname));");
 	}
 	foreach my $e (@{$struct->{ELEMENTS}}) {
-		$self->ParseElementPull($e, "ndr", $env, 0, 1);
+		$self->ParseElementPull($e, $ndr, $env, 0, 1);
 	}
 
 	$self->add_deferred();
@@ -1513,9 +1517,9 @@ sub ParseStructPullDeferred($$$$)
 
 #####################################################################
 # parse a struct - pull side
-sub ParseStructPull($$$)
+sub ParseStructPull($$$$)
 {
-	my($self,$struct,$varname) = @_;
+	my($self,$struct,$ndr,$varname) = @_;
 
 	return unless defined $struct->{ELEMENTS};
 
@@ -1526,22 +1530,22 @@ sub ParseStructPull($$$)
 		$self->DeclareMemCtxVariables($e);
 	}
 
-	$self->start_flags($struct);
+	$self->start_flags($struct, $ndr);
 
 	my $env = GenerateStructEnv($struct, $varname);
 
 	$self->pidl("if (ndr_flags & NDR_SCALARS) {");
 	$self->indent;
-	$self->ParseStructPullPrimitives($struct,$varname,$env);
+	$self->ParseStructPullPrimitives($struct,$ndr,$varname,$env);
 	$self->deindent;
 	$self->pidl("}");
 	$self->pidl("if (ndr_flags & NDR_BUFFERS) {");
 	$self->indent;
-	$self->ParseStructPullDeferred($struct,$varname,$env);
+	$self->ParseStructPullDeferred($struct,$ndr,$varname,$env);
 	$self->deindent;
 	$self->pidl("}");
 
-	$self->end_flags($struct);
+	$self->end_flags($struct, $ndr);
 }
 
 #####################################################################
@@ -1592,16 +1596,16 @@ sub ParseUnionNdrSize($$$)
 	$self->pidl("return ndr_size_union($varname, flags, level, (ndr_push_flags_fn_t)ndr_push_$name);");
 }
 
-sub ParseUnionPushPrimitives($$$)
+sub ParseUnionPushPrimitives($$$$)
 {
-	my ($self, $e, $varname) = @_;
+	my ($self, $e, $ndr ,$varname) = @_;
 
 	my $have_default = 0;
 
-	$self->pidl("int level = ndr_push_get_switch_value(ndr, $varname);");
+	$self->pidl("int level = ndr_push_get_switch_value($ndr, $varname);");
 
 	if (defined($e->{SWITCH_TYPE})) {
-		$self->pidl("NDR_CHECK(ndr_push_$e->{SWITCH_TYPE}(ndr, NDR_SCALARS, level));");
+		$self->pidl("NDR_CHECK(ndr_push_$e->{SWITCH_TYPE}($ndr, NDR_SCALARS, level));");
 	}
 
 	$self->pidl("switch (level) {");
@@ -1615,13 +1619,13 @@ sub ParseUnionPushPrimitives($$$)
 		if ($el->{TYPE} ne "EMPTY") {
 			$self->indent;
 			if (defined($e->{PROPERTIES}{relative_base})) {
-				$self->pidl("NDR_CHECK(ndr_push_align(ndr, $el->{ALIGN}));");
+				$self->pidl("NDR_CHECK(ndr_push_align($ndr, $el->{ALIGN}));");
 				# set the current offset as base for relative pointers
 				# and store it based on the toplevel struct/union
-				$self->pidl("NDR_CHECK(ndr_push_setup_relative_base_offset1(ndr, $varname, ndr->offset));");
+				$self->pidl("NDR_CHECK(ndr_push_setup_relative_base_offset1($ndr, $varname, $ndr->offset));");
 			}
 			$self->DeclareArrayVariables($el);
-			$self->ParseElementPush($el, "ndr", {$el->{NAME} => "$varname->$el->{NAME}"}, 1, 0);
+			$self->ParseElementPush($el, $ndr, {$el->{NAME} => "$varname->$el->{NAME}"}, 1, 0);
 			$self->deindent;
 		}
 		$self->pidl("break; }");
@@ -1629,23 +1633,23 @@ sub ParseUnionPushPrimitives($$$)
 	}
 	if (! $have_default) {
 		$self->pidl("default:");
-		$self->pidl("\treturn ndr_push_error(ndr, NDR_ERR_BAD_SWITCH, \"Bad switch value \%u\", level);");
+		$self->pidl("\treturn ndr_push_error($ndr, NDR_ERR_BAD_SWITCH, \"Bad switch value \%u\", level);");
 	}
 	$self->deindent;
 	$self->pidl("}");
 }
 
-sub ParseUnionPushDeferred($$$)
+sub ParseUnionPushDeferred($$$$)
 {
-	my ($self,$e,$varname) = @_;
+	my ($self,$e,$ndr,$varname) = @_;
 
 	my $have_default = 0;
 
-	$self->pidl("int level = ndr_push_get_switch_value(ndr, $varname);");
+	$self->pidl("int level = ndr_push_get_switch_value($ndr, $varname);");
 	if (defined($e->{PROPERTIES}{relative_base})) {
 		# retrieve the current offset as base for relative pointers
 		# based on the toplevel struct/union
-		$self->pidl("NDR_CHECK(ndr_push_setup_relative_base_offset2(ndr, $varname));");
+		$self->pidl("NDR_CHECK(ndr_push_setup_relative_base_offset2($ndr, $varname));");
 	}
 	$self->pidl("switch (level) {");
 	$self->indent;
@@ -1657,7 +1661,7 @@ sub ParseUnionPushDeferred($$$)
 		$self->pidl("$el->{CASE}:");
 		if ($el->{TYPE} ne "EMPTY") {
 			$self->indent;
-			$self->ParseElementPush($el, "ndr", {$el->{NAME} => "$varname->$el->{NAME}"}, 0, 1);
+			$self->ParseElementPush($el, $ndr, {$el->{NAME} => "$varname->$el->{NAME}"}, 0, 1);
 			$self->deindent;
 		}
 		$self->pidl("break;");
@@ -1665,7 +1669,7 @@ sub ParseUnionPushDeferred($$$)
 	}
 	if (! $have_default) {
 		$self->pidl("default:");
-		$self->pidl("\treturn ndr_push_error(ndr, NDR_ERR_BAD_SWITCH, \"Bad switch value \%u\", level);");
+		$self->pidl("\treturn ndr_push_error($ndr, NDR_ERR_BAD_SWITCH, \"Bad switch value \%u\", level);");
 	}
 	$self->deindent;
 	$self->pidl("}");
@@ -1673,31 +1677,31 @@ sub ParseUnionPushDeferred($$$)
 
 #####################################################################
 # parse a union - push side
-sub ParseUnionPush($$$)
+sub ParseUnionPush($$$$)
 {
-	my ($self,$e,$varname) = @_;
+	my ($self,$e,$ndr,$varname) = @_;
 	my $have_default = 0;
 
-	$self->start_flags($e);
+	$self->start_flags($e, $ndr);
 
 	$self->pidl("if (ndr_flags & NDR_SCALARS) {");
 	$self->indent;
-	$self->ParseUnionPushPrimitives($e, $varname);
+	$self->ParseUnionPushPrimitives($e, $ndr, $varname);
 	$self->deindent;
 	$self->pidl("}");
 	$self->pidl("if (ndr_flags & NDR_BUFFERS) {");
 	$self->indent;
-	$self->ParseUnionPushDeferred($e, $varname);
+	$self->ParseUnionPushDeferred($e, $ndr, $varname);
 	$self->deindent;
 	$self->pidl("}");
-	$self->end_flags($e);
+	$self->end_flags($e, $ndr);
 }
 
 #####################################################################
 # print a union
-sub ParseUnionPrint($$$$)
+sub ParseUnionPrint($$$$$)
 {
-	my ($self,$e,$name,$varname) = @_;
+	my ($self,$e,$ndr,$name,$varname) = @_;
 	my $have_default = 0;
 
 	$self->pidl("int level;");
@@ -1705,11 +1709,11 @@ sub ParseUnionPrint($$$$)
 		$self->DeclareArrayVariables($el);
 	}
 
-	$self->start_flags($e);
+	$self->start_flags($e, $ndr);
 
-	$self->pidl("level = ndr_print_get_switch_value(ndr, $varname);");
+	$self->pidl("level = ndr_print_get_switch_value($ndr, $varname);");
 
-	$self->pidl("ndr_print_union(ndr, name, level, \"$name\");");
+	$self->pidl("ndr_print_union($ndr, name, level, \"$name\");");
 
 	$self->pidl("switch (level) {");
 	$self->indent;
@@ -1720,7 +1724,7 @@ sub ParseUnionPrint($$$$)
 		$self->pidl("$el->{CASE}:");
 		if ($el->{TYPE} ne "EMPTY") {
 			$self->indent;
-			$self->ParseElementPrint($el, "$varname->$el->{NAME}", {});
+			$self->ParseElementPrint($el, $ndr, "$varname->$el->{NAME}", {});
 			$self->deindent;
 		}
 		$self->pidl("break;");
@@ -1728,23 +1732,23 @@ sub ParseUnionPrint($$$$)
 	}
 	if (! $have_default) {
 		$self->pidl("default:");
-		$self->pidl("\tndr_print_bad_level(ndr, name, level);");
+		$self->pidl("\tndr_print_bad_level($ndr, name, level);");
 	}
 	$self->deindent;
 	$self->pidl("}");
 
-	$self->end_flags($e);
+	$self->end_flags($e, $ndr);
 }
 
-sub ParseUnionPullPrimitives($$$$)
+sub ParseUnionPullPrimitives($$$$$)
 {
-	my ($self,$e,$varname,$switch_type) = @_;
+	my ($self,$e,$ndr,$varname,$switch_type) = @_;
 	my $have_default = 0;
 
 	if (defined($switch_type)) {
-		$self->pidl("NDR_CHECK(ndr_pull_$switch_type(ndr, NDR_SCALARS, &_level));");
+		$self->pidl("NDR_CHECK(ndr_pull_$switch_type($ndr, NDR_SCALARS, &_level));");
 		$self->pidl("if (_level != level) {"); 
-		$self->pidl("\treturn ndr_pull_error(ndr, NDR_ERR_BAD_SWITCH, \"Bad switch value %u for $varname\", _level);");
+		$self->pidl("\treturn ndr_pull_error($ndr, NDR_ERR_BAD_SWITCH, \"Bad switch value %u for $varname\", _level);");
 		$self->pidl("}");
 	}
 
@@ -1761,12 +1765,12 @@ sub ParseUnionPullPrimitives($$$$)
 			$self->DeclarePtrVariables($el);
 			$self->DeclareArrayVariables($el);
 			if (defined($e->{PROPERTIES}{relative_base})) {
-				$self->pidl("NDR_CHECK(ndr_pull_align(ndr, $el->{ALIGN}));");
+				$self->pidl("NDR_CHECK(ndr_pull_align($ndr, $el->{ALIGN}));");
 				# set the current offset as base for relative pointers
 				# and store it based on the toplevel struct/union
-				$self->pidl("NDR_CHECK(ndr_pull_setup_relative_base_offset1(ndr, $varname, ndr->offset));");
+				$self->pidl("NDR_CHECK(ndr_pull_setup_relative_base_offset1($ndr, $varname, $ndr->offset));");
 			}
-			$self->ParseElementPull($el, "ndr", {$el->{NAME} => "$varname->$el->{NAME}"}, 1, 0);
+			$self->ParseElementPull($el, $ndr, {$el->{NAME} => "$varname->$el->{NAME}"}, 1, 0);
 			$self->deindent;
 		}
 		$self->pidl("break; }");
@@ -1774,21 +1778,21 @@ sub ParseUnionPullPrimitives($$$$)
 	}
 	if (! $have_default) {
 		$self->pidl("default:");
-		$self->pidl("\treturn ndr_pull_error(ndr, NDR_ERR_BAD_SWITCH, \"Bad switch value \%u\", level);");
+		$self->pidl("\treturn ndr_pull_error($ndr, NDR_ERR_BAD_SWITCH, \"Bad switch value \%u\", level);");
 	}
 	$self->deindent;
 	$self->pidl("}");
 }
 
-sub ParseUnionPullDeferred($$$)
+sub ParseUnionPullDeferred($$$$)
 {
-	my ($self,$e,$varname) = @_;
+	my ($self,$e,$ndr,$varname) = @_;
 	my $have_default = 0;
 
 	if (defined($e->{PROPERTIES}{relative_base})) {
 		# retrieve the current offset as base for relative pointers
 		# based on the toplevel struct/union
-		$self->pidl("NDR_CHECK(ndr_pull_setup_relative_base_offset2(ndr, $varname));");
+		$self->pidl("NDR_CHECK(ndr_pull_setup_relative_base_offset2($ndr, $varname));");
 	}
 	$self->pidl("switch (level) {");
 	$self->indent;
@@ -1800,7 +1804,7 @@ sub ParseUnionPullDeferred($$$)
 		$self->pidl("$el->{CASE}:");
 		if ($el->{TYPE} ne "EMPTY") {
 			$self->indent;
-			$self->ParseElementPull($el, "ndr", {$el->{NAME} => "$varname->$el->{NAME}"}, 0, 1);
+			$self->ParseElementPull($el, $ndr, {$el->{NAME} => "$varname->$el->{NAME}"}, 0, 1);
 			$self->deindent;
 		}
 		$self->pidl("break;");
@@ -1808,7 +1812,7 @@ sub ParseUnionPullDeferred($$$)
 	}
 	if (! $have_default) {
 		$self->pidl("default:");
-		$self->pidl("\treturn ndr_pull_error(ndr, NDR_ERR_BAD_SWITCH, \"Bad switch value \%u\", level);");
+		$self->pidl("\treturn ndr_pull_error($ndr, NDR_ERR_BAD_SWITCH, \"Bad switch value \%u\", level);");
 	}
 	$self->deindent;
 	$self->pidl("}");
@@ -1818,9 +1822,9 @@ sub ParseUnionPullDeferred($$$)
 
 #####################################################################
 # parse a union - pull side
-sub ParseUnionPull($$$)
+sub ParseUnionPull($$$$)
 {
-	my ($self,$e,$varname) = @_;
+	my ($self,$e,$ndr,$varname) = @_;
 	my $switch_type = $e->{SWITCH_TYPE};
 
 	$self->pidl("int level;");
@@ -1839,25 +1843,25 @@ sub ParseUnionPull($$$)
 		$double_cases{"$el->{NAME}"} = 1;
 	}
 
-	$self->start_flags($e);
+	$self->start_flags($e, $ndr);
 
-	$self->pidl("level = ndr_pull_get_switch_value(ndr, $varname);");
+	$self->pidl("level = ndr_pull_get_switch_value($ndr, $varname);");
 
 	$self->pidl("if (ndr_flags & NDR_SCALARS) {");
 	$self->indent;
-	$self->ParseUnionPullPrimitives($e,$varname,$switch_type);
+	$self->ParseUnionPullPrimitives($e,$ndr,$varname,$switch_type);
 	$self->deindent;
 	$self->pidl("}");
 
 	$self->pidl("if (ndr_flags & NDR_BUFFERS) {");
 	$self->indent;
-	$self->ParseUnionPullDeferred($e,$varname);
+	$self->ParseUnionPullDeferred($e,$ndr,$varname);
 	$self->deindent;
 	$self->pidl("}");
 
 	$self->add_deferred();
 
-	$self->end_flags($e);
+	$self->end_flags($e, $ndr);
 }
 
 sub DeclUnion($$$$)
@@ -1883,29 +1887,37 @@ $typefamily{UNION} = {
 	
 #####################################################################
 # parse a typedef - push side
-sub ParseTypedefPush($$$)
+sub ParseTypedefPush($$$$)
 {
-	my($self,$e,$varname) = @_;
+	my($self,$e,$ndr,$varname) = @_;
+
+	my $env;
+
+	$env->{$e->{NAME}} = $varname;
 
-	$typefamily{$e->{DATA}->{TYPE}}->{PUSH_FN_BODY}->($self, $e->{DATA}, $varname);
+	$self->ParseElementPushLevel($e, $e->{LEVELS}[0], $ndr, $varname, $env, 1, 1);
 }
 
 #####################################################################
 # parse a typedef - pull side
-sub ParseTypedefPull($$$)
+sub ParseTypedefPull($$$$)
 {
-	my($self,$e,$varname) = @_;
+	my($self,$e,$ndr,$varname) = @_;
 
-	$typefamily{$e->{DATA}->{TYPE}}->{PULL_FN_BODY}->($self, $e->{DATA}, $varname);
+	my $env;
+
+	$env->{$e->{NAME}} = $varname;
+
+	$self->ParseElementPullLevel($e, $e->{LEVELS}[0], $ndr, $varname, $env, 1, 1);
 }
 
 #####################################################################
 # parse a typedef - print side
-sub ParseTypedefPrint($$$$)
+sub ParseTypedefPrint($$$$$)
 {
-	my($self,$e,$name,$varname) = @_;
+	my($self,$e,$ndr,$name,$varname) = @_;
 
-	$typefamily{$e->{DATA}->{TYPE}}->{PRINT_FN_BODY}->($self, $e->{DATA}, $name, $varname);
+	$typefamily{$e->{DATA}->{TYPE}}->{PRINT_FN_BODY}->($self, $e->{DATA}, $ndr, $name, $varname);
 }
 
 #####################################################################
@@ -1944,12 +1956,13 @@ $typefamily{TYPEDEF} = {
 sub ParseFunctionPrint($$)
 {
 	my($self, $fn) = @_;
+	my $ndr = "ndr";
 
-	$self->pidl_hdr("void ndr_print_$fn->{NAME}(struct ndr_print *ndr, const char *name, int flags, const struct $fn->{NAME} *r);");
+	$self->pidl_hdr("void ndr_print_$fn->{NAME}(struct ndr_print *$ndr, const char *name, int flags, const struct $fn->{NAME} *r);");
 
 	return if has_property($fn, "noprint");
 
-	$self->pidl("_PUBLIC_ void ndr_print_$fn->{NAME}(struct ndr_print *ndr, const char *name, int flags, const struct $fn->{NAME} *r)");
+	$self->pidl("_PUBLIC_ void ndr_print_$fn->{NAME}(struct ndr_print *$ndr, const char *name, int flags, const struct $fn->{NAME} *r)");
 	$self->pidl("{");
 	$self->indent;
 
@@ -1957,48 +1970,48 @@ sub ParseFunctionPrint($$)
 		$self->DeclareArrayVariables($e);
 	}
 
-	$self->pidl("ndr_print_struct(ndr, name, \"$fn->{NAME}\");");
-	$self->pidl("ndr->depth++;");
+	$self->pidl("ndr_print_struct($ndr, name, \"$fn->{NAME}\");");
+	$self->pidl("$ndr->depth++;");
 
 	$self->pidl("if (flags & NDR_SET_VALUES) {");
-	$self->pidl("\tndr->flags |= LIBNDR_PRINT_SET_VALUES;");
+	$self->pidl("\t$ndr->flags |= LIBNDR_PRINT_SET_VALUES;");
 	$self->pidl("}");
 
 	$self->pidl("if (flags & NDR_IN) {");
 	$self->indent;
-	$self->pidl("ndr_print_struct(ndr, \"in\", \"$fn->{NAME}\");");
-	$self->pidl("ndr->depth++;");
+	$self->pidl("ndr_print_struct($ndr, \"in\", \"$fn->{NAME}\");");
+	$self->pidl("$ndr->depth++;");
 
 	my $env = GenerateFunctionInEnv($fn);
 
 	foreach my $e (@{$fn->{ELEMENTS}}) {
 		if (grep(/in/,@{$e->{DIRECTION}})) {
-			$self->ParseElementPrint($e, $env->{$e->{NAME}}, $env);
+			$self->ParseElementPrint($e, $ndr, $env->{$e->{NAME}}, $env);
 		}
 	}
-	$self->pidl("ndr->depth--;");
+	$self->pidl("$ndr->depth--;");
 	$self->deindent;
 	$self->pidl("}");
 	
 	$self->pidl("if (flags & NDR_OUT) {");
 	$self->indent;
-	$self->pidl("ndr_print_struct(ndr, \"out\", \"$fn->{NAME}\");");
-	$self->pidl("ndr->depth++;");
+	$self->pidl("ndr_print_struct($ndr, \"out\", \"$fn->{NAME}\");");
+	$self->pidl("$ndr->depth++;");
 
 	$env = GenerateFunctionOutEnv($fn);
 	foreach my $e (@{$fn->{ELEMENTS}}) {
 		if (grep(/out/,@{$e->{DIRECTION}})) {
-			$self->ParseElementPrint($e, $env->{$e->{NAME}}, $env);
+			$self->ParseElementPrint($e, $ndr, $env->{$e->{NAME}}, $env);
 		}
 	}
 	if ($fn->{RETURN_TYPE}) {
-		$self->pidl("ndr_print_$fn->{RETURN_TYPE}(ndr, \"result\", r->out.result);");
+		$self->pidl("ndr_print_$fn->{RETURN_TYPE}($ndr, \"result\", r->out.result);");
 	}
-	$self->pidl("ndr->depth--;");
+	$self->pidl("$ndr->depth--;");
 	$self->deindent;
 	$self->pidl("}");
 	
-	$self->pidl("ndr->depth--;");
+	$self->pidl("$ndr->depth--;");
 	$self->deindent;
 	$self->pidl("}");
 	$self->pidl("");
@@ -2009,8 +2022,9 @@ sub ParseFunctionPrint($$)
 sub ParseFunctionPush($$)
 { 
 	my($self, $fn) = @_;
+	my $ndr = "ndr";
 
-	$self->fn_declare("push", $fn, "enum ndr_err_code ndr_push_$fn->{NAME}(struct ndr_push *ndr, int flags, const struct $fn->{NAME} *r)") or return;
+	$self->fn_declare("push", $fn, "enum ndr_err_code ndr_push_$fn->{NAME}(struct ndr_push *$ndr, int flags, const struct $fn->{NAME} *r)") or return;
 
 	return if has_property($fn, "nopush");
 
@@ -2030,7 +2044,7 @@ sub ParseFunctionPush($$)
 
 	foreach my $e (@{$fn->{ELEMENTS}}) {
 		if (grep(/in/,@{$e->{DIRECTION}})) {
-			$self->ParseElementPush($e, "ndr", $env, 1, 1);
+			$self->ParseElementPush($e, $ndr, $env, 1, 1);
 		}
 	}
 
@@ -2043,12 +2057,12 @@ sub ParseFunctionPush($$)
 	$env = GenerateFunctionOutEnv($fn);
 	foreach my $e (@{$fn->{ELEMENTS}}) {
 		if (grep(/out/,@{$e->{DIRECTION}})) {
-			$self->ParseElementPush($e, "ndr", $env, 1, 1);
+			$self->ParseElementPush($e, $ndr, $env, 1, 1);
 		}
 	}
 
 	if ($fn->{RETURN_TYPE}) {
-		$self->pidl("NDR_CHECK(ndr_push_$fn->{RETURN_TYPE}(ndr, NDR_SCALARS, r->out.result));");
+		$self->pidl("NDR_CHECK(ndr_push_$fn->{RETURN_TYPE}($ndr, NDR_SCALARS, r->out.result));");
 	}
     
 	$self->deindent;
@@ -2068,7 +2082,7 @@ sub AllocateArrayLevel($$$$$$)
 	    $pl->{TYPE} eq "POINTER" and 
 	    $pl->{POINTER_TYPE} eq "ref"
 	    and not $l->{IS_ZERO_TERMINATED}) {
-		$self->pidl("if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {");
+		$self->pidl("if ($ndr->flags & LIBNDR_FLAG_REF_ALLOC) {");
 		$self->pidl("\tNDR_PULL_ALLOC_N($ndr, $var, $size);");
 		$self->pidl("}");
 		if (grep(/in/,@{$e->{DIRECTION}}) and
@@ -2086,9 +2100,10 @@ sub AllocateArrayLevel($$$$$$)
 sub ParseFunctionPull($$)
 { 
 	my($self,$fn) = @_;
+	my $ndr = "ndr";
 
 	# pull function args
-	$self->fn_declare("pull", $fn, "enum ndr_err_code ndr_pull_$fn->{NAME}(struct ndr_pull *ndr, int flags, struct $fn->{NAME} *r)") or return;
+	$self->fn_declare("pull", $fn, "enum ndr_err_code ndr_pull_$fn->{NAME}(struct ndr_pull *$ndr, int flags, struct $fn->{NAME} *r)") or return;
 
 	$self->pidl("{");
 	$self->indent;
@@ -2125,7 +2140,7 @@ sub ParseFunctionPull($$)
 
 	foreach my $e (@{$fn->{ELEMENTS}}) {
 		next unless (grep(/in/, @{$e->{DIRECTION}}));
-		$self->ParseElementPull($e, "ndr", $env, 1, 1);
+		$self->ParseElementPull($e, $ndr, $env, 1, 1);
 	}
 
 	# allocate the "simple" out ref variables. FIXME: Shouldn't this have it's
@@ -2143,9 +2158,9 @@ sub ParseFunctionPull($$)
 		if ($e->{LEVELS}[1]->{TYPE} eq "ARRAY") {
 			my $size = ParseExprExt($e->{LEVELS}[1]->{SIZE_IS}, $env, $e->{ORIGINAL},
 				check_null_pointer($e, $env, sub { $self->pidl(shift); },
-						   "return ndr_pull_error(ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for size_is()\");"),
+						   "return ndr_pull_error($ndr, NDR_ERR_INVALID_POINTER, \"NULL Pointer for size_is()\");"),
 				check_fully_dereferenced($e, $env));
-			$self->pidl("NDR_PULL_ALLOC_N(ndr, r->out.$e->{NAME}, $size);");
+			$self->pidl("NDR_PULL_ALLOC_N($ndr, r->out.$e->{NAME}, $size);");
 
 			if (grep(/in/, @{$e->{DIRECTION}})) {
 				$self->pidl("memcpy(r->out.$e->{NAME}, r->in.$e->{NAME}, ($size) * sizeof(*r->in.$e->{NAME}));");
@@ -2153,7 +2168,7 @@ sub ParseFunctionPull($$)
 				$self->pidl("memset(r->out.$e->{NAME}, 0, ($size) * sizeof(*r->out.$e->{NAME}));");
 			}
 		} else {
-			$self->pidl("NDR_PULL_ALLOC(ndr, r->out.$e->{NAME});");
+			$self->pidl("NDR_PULL_ALLOC($ndr, r->out.$e->{NAME});");
 		
 			if (grep(/in/, @{$e->{DIRECTION}})) {
 				$self->pidl("*r->out.$e->{NAME} = *r->in.$e->{NAME};");
@@ -2173,11 +2188,11 @@ sub ParseFunctionPull($$)
 	$env = GenerateFunctionOutEnv($fn);
 	foreach my $e (@{$fn->{ELEMENTS}}) {
 		next unless grep(/out/, @{$e->{DIRECTION}});
-		$self->ParseElementPull($e, "ndr", $env, 1, 1);
+		$self->ParseElementPull($e, $ndr, $env, 1, 1);
 	}
 
 	if ($fn->{RETURN_TYPE}) {
-		$self->pidl("NDR_CHECK(ndr_pull_$fn->{RETURN_TYPE}(ndr, NDR_SCALARS, &r->out.result));");
+		$self->pidl("NDR_CHECK(ndr_pull_$fn->{RETURN_TYPE}($ndr, NDR_SCALARS, &r->out.result));");
 	}
 
 	$self->add_deferred();
@@ -2364,81 +2379,86 @@ sub HeaderInterface($$$)
 
 }
 
-sub ParseTypePush($$$$$)
+sub ParseTypePush($$$$$$)
 {
-	my ($self,$e,$varname, $primitives, $deferred) = @_;
+	my ($self,$e, $ndr, $varname, $primitives, $deferred) = @_;
 
 	# save the old relative_base_offset
-	$self->pidl("uint32_t _save_relative_base_offset = ndr_push_get_relative_base_offset(ndr);") if defined(has_property($e, "relative_base"));
-	$typefamily{$e->{TYPE}}->{PUSH_FN_BODY}->($self, $e, $varname);
+	$self->pidl("uint32_t _save_relative_base_offset = ndr_push_get_relative_base_offset($ndr);") if defined(has_property($e, "relative_base"));
+	$typefamily{$e->{TYPE}}->{PUSH_FN_BODY}->($self, $e, $ndr, $varname);
 	# restore the old relative_base_offset
-	$self->pidl("ndr_push_restore_relative_base_offset(ndr, _save_relative_base_offset);") if defined(has_property($e, "relative_base"));
+	$self->pidl("ndr_push_restore_relative_base_offset($ndr, _save_relative_base_offset);") if defined(has_property($e, "relative_base"));
 }
 
 sub ParseTypePushFunction($$$)
 {
 	my ($self, $e, $varname) = @_;
+	my $ndr = "ndr";
 
 	my $args = $typefamily{$e->{TYPE}}->{DECL}->($e, "push", $e->{NAME}, $varname);
-	$self->fn_declare("push", $e, "enum ndr_err_code ".TypeFunctionName("ndr_push", $e)."(struct ndr_push *ndr, int ndr_flags, $args)") or return;
+
+	$self->fn_declare("push", $e, "enum ndr_err_code ".TypeFunctionName("ndr_push", $e)."(struct ndr_push *$ndr, int ndr_flags, $args)") or return;
 
 	$self->pidl("{");
 	$self->indent;
-	$self->ParseTypePush($e, $varname, 1, 1);
+	$self->ParseTypePush($e, $ndr, $varname, 1, 1);
 	$self->pidl("return NDR_ERR_SUCCESS;");
 	$self->deindent;
 	$self->pidl("}");
 	$self->pidl("");;
 }
 
-sub ParseTypePull($$$$$)
+sub ParseTypePull($$$$$$)
 {
-	my ($self, $e, $varname, $primitives, $deferred) = @_;
+	my ($self, $e, $ndr, $varname, $primitives, $deferred) = @_;
 
 	# save the old relative_base_offset
-	$self->pidl("uint32_t _save_relative_base_offset = ndr_pull_get_relative_base_offset(ndr);") if defined(has_property($e, "relative_base"));
-	$typefamily{$e->{TYPE}}->{PULL_FN_BODY}->($self, $e, $varname);
+	$self->pidl("uint32_t _save_relative_base_offset = ndr_pull_get_relative_base_offset($ndr);") if defined(has_property($e, "relative_base"));
+	$typefamily{$e->{TYPE}}->{PULL_FN_BODY}->($self, $e, $ndr, $varname);
 	# restore the old relative_base_offset
-	$self->pidl("ndr_pull_restore_relative_base_offset(ndr, _save_relative_base_offset);") if defined(has_property($e, "relative_base"));
+	$self->pidl("ndr_pull_restore_relative_base_offset($ndr, _save_relative_base_offset);") if defined(has_property($e, "relative_base"));
 }
 
 sub ParseTypePullFunction($$)
 {
 	my ($self, $e, $varname) = @_;
+	my $ndr = "ndr";
 
 	my $args = $typefamily{$e->{TYPE}}->{DECL}->($e, "pull", $e->{NAME}, $varname);
 
-	$self->fn_declare("pull", $e, "enum ndr_err_code ".TypeFunctionName("ndr_pull", $e)."(struct ndr_pull *ndr, int ndr_flags, $args)") or return;
+	$self->fn_declare("pull", $e, "enum ndr_err_code ".TypeFunctionName("ndr_pull", $e)."(struct ndr_pull *$ndr, int ndr_flags, $args)") or return;
 
 	$self->pidl("{");
 	$self->indent;
-	$self->ParseTypePull($e, $varname, 1, 1);
+	$self->ParseTypePull($e, $ndr, $varname, 1, 1);
 	$self->pidl("return NDR_ERR_SUCCESS;");
 	$self->deindent;
 	$self->pidl("}");
 	$self->pidl("");
 }
 
-sub ParseTypePrint($$$)
+sub ParseTypePrint($$$$)
 {
-	my ($self, $e, $varname) = @_;
+	my ($self, $e, $ndr, $varname) = @_;
 
-	$typefamily{$e->{TYPE}}->{PRINT_FN_BODY}->($self, $e, $e->{NAME}, $varname);
+	$typefamily{$e->{TYPE}}->{PRINT_FN_BODY}->($self, $e, $ndr, $e->{NAME}, $varname);
 }
 
 sub ParseTypePrintFunction($$$)
 {
 	my ($self, $e, $varname) = @_;
+	my $ndr = "ndr";
+
 	my $args = $typefamily{$e->{TYPE}}->{DECL}->($e, "print", $e->{NAME}, $varname);
 
 	$self->pidl_hdr("void ".TypeFunctionName("ndr_print", $e)."(struct ndr_print *ndr, const char *name, $args);");
 
 	return if (has_property($e, "noprint"));
 
-	$self->pidl("_PUBLIC_ void ".TypeFunctionName("ndr_print", $e)."(struct ndr_print *ndr, const char *name, $args)");
+	$self->pidl("_PUBLIC_ void ".TypeFunctionName("ndr_print", $e)."(struct ndr_print *$ndr, const char *name, $args)");
 	$self->pidl("{");
 	$self->indent;
-	$self->ParseTypePrint($e, $varname);
+	$self->ParseTypePrint($e, $ndr, $varname);
 	$self->deindent;
 	$self->pidl("}");
 	$self->pidl("");
diff --git a/source4/pidl/tests/samba-ndr.pl b/source4/pidl/tests/samba-ndr.pl
index 114ca01cfa..cdfe0514f1 100755
--- a/source4/pidl/tests/samba-ndr.pl
+++ b/source4/pidl/tests/samba-ndr.pl
@@ -220,7 +220,7 @@ $generator->ParseStructPush({
 			TYPE => "STRUCT",
 			PROPERTIES => {},
 			ALIGN => 4,
-			ELEMENTS => [ ]}, "x");
+			ELEMENTS => [ ]}, "ndr", "x");
 is($generator->{res}, "if (ndr_flags & NDR_SCALARS) {
 	NDR_CHECK(ndr_push_align(ndr, 4));
 }
@@ -243,7 +243,7 @@ $generator->ParseStructPush({
 			PROPERTIES => {},
 			ALIGN => 4,
 			SURROUNDING_ELEMENT => $e,
-			ELEMENTS => [ $e ]}, "x");
+			ELEMENTS => [ $e ]}, "ndr", "x");
 is($generator->{res}, "if (ndr_flags & NDR_SCALARS) {
 	NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_string_array_size(ndr, x->el1)));
 	NDR_CHECK(ndr_push_align(ndr, 4));
@@ -262,20 +262,23 @@ is(TypeFunctionName("ndr_push", {TYPE => "STRUCT", NAME => "bar"}), "ndr_push_ST
 $generator = new Parse::Pidl::Samba4::NDR::Parser();
 $generator->ParseElementPrint({ NAME => "x", TYPE => "rt", REPRESENTATION_TYPE => "rt", 
 				    PROPERTIES => { noprint => 1},
-				    LEVELS => [ { TYPE => "DATA", DATA_TYPE => "rt"} ]}, "var", { "x" => "r->foobar" } );
+				    LEVELS => [ { TYPE => "DATA", DATA_TYPE => "rt"} ]},
+				    "ndr", "var", { "x" => "r->foobar" } );
 is($generator->{res}, "");
 
 $generator = new Parse::Pidl::Samba4::NDR::Parser();
 $generator->ParseElementPrint({ NAME => "x", TYPE => "rt", REPRESENTATION_TYPE => "rt", 
 				    PROPERTIES => {},
-				    LEVELS => [ { TYPE => "DATA", DATA_TYPE => "rt" }]}, "var", { "x" => "r->foobar" } );
+				    LEVELS => [ { TYPE => "DATA", DATA_TYPE => "rt" }]},
+				    "ndr", "var", { "x" => "r->foobar" } );
 is($generator->{res}, "ndr_print_rt(ndr, \"x\", &var);\n");
 
 # make sure that a print function for an element with value() set works
 $generator = new Parse::Pidl::Samba4::NDR::Parser();
 $generator->ParseElementPrint({ NAME => "x", TYPE => "uint32", REPRESENTATION_TYPE => "uint32", 
 				    PROPERTIES => { value => "23" },
-				    LEVELS => [ { TYPE => "DATA", DATA_TYPE => "uint32"} ]}, "var", { "x" => "r->foobar" } );
+				    LEVELS => [ { TYPE => "DATA", DATA_TYPE => "uint32"} ]},
+				    "ndr", "var", { "x" => "r->foobar" } );
 is($generator->{res}, "ndr_print_uint32(ndr, \"x\", (ndr->flags & LIBNDR_PRINT_SET_VALUES)?23:var);\n");
 
 $generator = new Parse::Pidl::Samba4::NDR::Parser();
diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py
index 0855efe3bb..9c2a208460 100644
--- a/source4/scripting/python/samba/provision.py
+++ b/source4/scripting/python/samba/provision.py
@@ -745,12 +745,6 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
     samdb = SamDB(path, session_info=session_info, 
                   credentials=credentials, lp=lp)
 
-    if fill == FILL_DRS:
-       # We want to finish here, but setup the index before we do so
-        message("Setting up sam.ldb index")
-        samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
-        return samdb
-
     message("Pre-loading the Samba 4 and AD schema")
     samdb.set_domain_sid(domainsid)
     if serverrole == "domain controller":
@@ -886,9 +880,6 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
                                 domainsid=domainsid, policyguid=policyguid,
                                 setup_path=setup_path)
 
-    #We want to setup the index last, as adds are faster unindexed
-        message("Setting up sam.ldb index")
-        samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
     except:
         samdb.transaction_cancel()
         raise
@@ -1281,39 +1272,38 @@ def provision_backend(setup_dir=None, message=None,
 	mmr_syncrepl_user_config = "" 
 	
 	if ol_mmr_urls is not None:
-		mmr_hosts=filter(None,ol_mmr_urls.split(' ')) 
-                if (len(mmr_hosts) == 1):
-                    mmr_hosts=filter(None,ol_mmr_urls.split(',')) 
+		url_list=filter(None,ol_mmr_urls.split(' ')) 
+                if (len(url_list) == 1):
+                    url_list=filter(None,ol_mmr_urls.split(',')) 
                      
 
 		mmr_on_config = "MirrorMode On"
- 		
-		z=0
-		for i in mmr_hosts:
-			z=z+1
+ 		serverid=0
+		for url in url_list:
+			serverid=serverid+1
 			mmr_serverids_config += read_and_sub_file(setup_path("mmr_serverids.conf"),
-								     { "SERVERID" : str(z),
-        		                                               "LDAPSERVER" : i })
-
-			z=z+1
+								     { "SERVERID" : str(serverid),
+        		                                               "LDAPSERVER" : url })
+                        rid=serverid*10
+			rid=rid+1
 			mmr_syncrepl_schema_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
-								     { 	"RID" : str(z),
+								     { 	"RID" : str(rid),
                     							"MMRDN": names.schemadn,
-        		                                               	"LDAPSERVER" : i,
+        		                                               	"LDAPSERVER" : url,
                                                                         "MMR_PASSWORD": adminpass})
 
-			z=z+1
+			rid=rid+1
 			mmr_syncrepl_config_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
-								     { 	"RID" : str(z),
+								     { 	"RID" : str(rid),
                     							"MMRDN": names.configdn,
-        		                                               	"LDAPSERVER" : i,
+        		                                               	"LDAPSERVER" : url,
                                                                         "MMR_PASSWORD": adminpass})
 
-			z=z+1
+			rid=rid+1
 			mmr_syncrepl_user_config += read_and_sub_file(setup_path("mmr_syncrepl.conf"),
-								     { 	"RID" : str(z),
+								     { 	"RID" : str(rid),
                     							"MMRDN": names.domaindn,
-        		                                               	"LDAPSERVER" : i,
+        		                                               	"LDAPSERVER" : url,
                                                                         "MMR_PASSWORD": adminpass })
 
 
diff --git a/source4/setup/provision-backend b/source4/setup/provision-backend
index 049b8752a6..0943da29b6 100755
--- a/source4/setup/provision-backend
+++ b/source4/setup/provision-backend
@@ -65,7 +65,7 @@ parser.add_option("--server-role", type="choice", metavar="ROLE",
 parser.add_option("--targetdir", type="string", metavar="DIR", 
 		          help="Set target directory")
 parser.add_option("--ol-mmr-urls", type="string", metavar="LDAPSERVER",
-                help="List of LDAP-URLS separated with whitespaces for Use with OpenLDAP-MMR")
+                help="List of LDAP-URLS [ ldap://<FQDN>:port/  (where port != 389) ] separated with whitespaces for use with OpenLDAP-MMR")
 
 
 opts = parser.parse_args()[0]
diff --git a/source4/setup/provision_index.ldif b/source4/setup/provision_index.ldif
deleted file mode 100644
index 95970817f3..0000000000
--- a/source4/setup/provision_index.ldif
+++ /dev/null
@@ -1,19 +0,0 @@
-dn: @INDEXLIST
-@IDXATTR: name
-@IDXATTR: cn
-@IDXATTR: userPrincipalName
-@IDXATTR: servicePrincipalName
-@IDXATTR: sAMAccountName
-@IDXATTR: objectSid
-@IDXATTR: objectCategory
-@IDXATTR: member
-@IDXATTR: uidNumber
-@IDXATTR: gidNumber
-@IDXATTR: unixName
-@IDXATTR: privilege
-@IDXATTR: nCName
-@IDXATTR: lDAPDisplayName
-@IDXATTR: subClassOf
-@IDXATTR: dnsRoot
-@IDXATTR: nETBIOSName
-@IDXATTR: objectGUID
diff --git a/source4/setup/provision_init.ldif b/source4/setup/provision_init.ldif
index 65a12f1afa..a6c591dd51 100644
--- a/source4/setup/provision_init.ldif
+++ b/source4/setup/provision_init.ldif
@@ -1,3 +1,8 @@
+#These attributes are only used as far as the bootstrapping of the
+# schema.  After that, the attributes from the schema are used.
+#
+# Therefore, they must strictly match the schema
+
 dn: @ATTRIBUTES
 userPrincipalName: CASE_INSENSITIVE
 servicePrincipalName: CASE_INSENSITIVE
@@ -7,6 +12,8 @@ nETBIOSName: CASE_INSENSITIVE
 cn: CASE_INSENSITIVE
 dc: CASE_INSENSITIVE
 name: CASE_INSENSITIVE
+lDAPDisplayName: CASE_INSENSITIVE
+subClassOf: CASE_INSENSITIVE
 dn: CASE_INSENSITIVE
 sAMAccountName: CASE_INSENSITIVE
 objectClass: CASE_INSENSITIVE
diff --git a/source4/setup/provision_users.ldif b/source4/setup/provision_users.ldif
index 641247cf22..854c42d07c 100644
--- a/source4/setup/provision_users.ldif
+++ b/source4/setup/provision_users.ldif
@@ -83,7 +83,7 @@ objectClass: top
 objectClass: group
 cn: Cert Publishers
 description: Members of this group are permitted to publish certificates to the Active Directory
-groupType: 2147483652
+groupType: -2147483644
 objectSid: ${DOMAINSID}-517
 sAMAccountName: Cert Publishers
 isCriticalSystemObject: TRUE
@@ -134,7 +134,7 @@ cn: RAS and IAS Servers
 description: Servers in this group can access remote access properties of users
 objectSid: ${DOMAINSID}-553
 sAMAccountName: RAS and IAS Servers
-groupType: 2147483652
+groupType: -2147483644
 isCriticalSystemObject: TRUE
 
 dn: CN=Administrators,CN=Builtin,${DOMAINDN}
@@ -149,7 +149,7 @@ objectSid: S-1-5-32-544
 adminCount: 1
 sAMAccountName: Administrators
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 privilege: SeSecurityPrivilege
 privilege: SeBackupPrivilege
@@ -185,7 +185,7 @@ member: CN=Domain Users,CN=Users,${DOMAINDN}
 objectSid: S-1-5-32-545
 sAMAccountName: Users
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=Guests,CN=Builtin,${DOMAINDN}
@@ -198,7 +198,7 @@ member: CN=Guest,CN=Users,${DOMAINDN}
 objectSid: S-1-5-32-546
 sAMAccountName: Guests
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=Print Operators,CN=Builtin,${DOMAINDN}
@@ -210,7 +210,7 @@ objectSid: S-1-5-32-550
 adminCount: 1
 sAMAccountName: Print Operators
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 privilege: SeLoadDriverPrivilege
 privilege: SeShutdownPrivilege
@@ -225,7 +225,7 @@ objectSid: S-1-5-32-551
 adminCount: 1
 sAMAccountName: Backup Operators
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 privilege: SeBackupPrivilege
 privilege: SeRestorePrivilege
@@ -241,7 +241,7 @@ objectSid: S-1-5-32-552
 adminCount: 1
 sAMAccountName: Replicator
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=Remote Desktop Users,CN=Builtin,${DOMAINDN}
@@ -252,7 +252,7 @@ description: Members in this group are granted the right to logon remotely
 objectSid: S-1-5-32-555
 sAMAccountName: Remote Desktop Users
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=Network Configuration Operators,CN=Builtin,${DOMAINDN}
@@ -263,7 +263,7 @@ description: Members in this group can have some administrative privileges to ma
 objectSid: S-1-5-32-556
 sAMAccountName: Network Configuration Operators
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=Performance Monitor Users,CN=Builtin,${DOMAINDN}
@@ -274,7 +274,7 @@ description: Members of this group have remote access to monitor this computer
 objectSid: S-1-5-32-558
 sAMAccountName: Performance Monitor Users
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=Performance Log Users,CN=Builtin,${DOMAINDN}
@@ -285,7 +285,7 @@ description: Members of this group have remote access to schedule logging of per
 objectSid: S-1-5-32-559
 sAMAccountName: Performance Log Users
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=Server Operators,CN=Builtin,${DOMAINDN}
@@ -297,7 +297,7 @@ objectSid: S-1-5-32-549
 adminCount: 1
 sAMAccountName: Server Operators
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 privilege: SeBackupPrivilege
 privilege: SeSystemtimePrivilege
@@ -315,7 +315,7 @@ objectSid: S-1-5-32-548
 adminCount: 1
 sAMAccountName: Account Operators
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 privilege: SeInteractiveLogonRight
 
@@ -327,7 +327,7 @@ description: A backward compatibility group which allows read access on all user
 objectSid: S-1-5-32-554
 sAMAccountName: Pre-Windows 2000 Compatible Access
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 privilege: SeRemoteInteractiveLogonRight
 privilege: SeChangeNotifyPrivilege
@@ -340,7 +340,7 @@ description: Members of this group can create incoming, one-way trusts to this f
 objectSid: S-1-5-32-557
 sAMAccountName: Incoming Forest Trust Builders
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=Windows Authorization Access Group,CN=Builtin,${DOMAINDN}
@@ -351,7 +351,7 @@ description: Members of this group have access to the computed tokenGroupsGlobal
 objectSid: S-1-5-32-560
 sAMAccountName: Windows Authorization Access Group
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=Terminal Server License Servers,CN=Builtin,${DOMAINDN}
@@ -362,7 +362,7 @@ description: Terminal Server License Servers
 objectSid: S-1-5-32-561
 sAMAccountName: Terminal Server License Servers
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=Distributed COM Users,CN=Builtin,${DOMAINDN}
@@ -373,7 +373,7 @@ description: Members are allowed to launch, activate and use Distributed COM obj
 objectSid: S-1-5-32-562
 sAMAccountName: Distributed COM Users
 systemFlags: 2348810240
-groupType: 2147483653
+groupType: -2147483643
 isCriticalSystemObject: TRUE
 
 dn: CN=WellKnown Security Principals,${CONFIGDN}
diff --git a/source4/torture/ldap/cldap.c b/source4/torture/ldap/cldap.c
index 1631297793..3730193c86 100644
--- a/source4/torture/ldap/cldap.c
+++ b/source4/torture/ldap/cldap.c
@@ -228,6 +228,75 @@ static bool test_cldap_netlogon(struct torture_context *tctx, const char *dest)
 }
 
 /*
+  test cldap netlogon server type flags
+*/
+static bool test_cldap_netlogon_flags(struct torture_context *tctx,
+	const char *dest)
+{
+	struct cldap_socket *cldap;
+	NTSTATUS status;
+	struct cldap_netlogon search;
+	struct netlogon_samlogon_response n1;
+	uint32_t server_type;
+
+	cldap = cldap_socket_init(tctx, tctx->ev, lp_iconv_convenience(tctx->lp_ctx));
+
+	printf("Printing out netlogon server type flags:\n");
+
+	ZERO_STRUCT(search);
+	search.in.dest_address = dest;
+	search.in.dest_port = lp_cldap_port(tctx->lp_ctx);
+	search.in.acct_control = -1;
+	search.in.version = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX;
+	search.in.map_response = true;
+
+	status = cldap_netlogon(cldap, tctx, &search);
+	CHECK_STATUS(status, NT_STATUS_OK);
+
+	n1 = search.out.netlogon;
+	if (n1.ntver == NETLOGON_NT_VERSION_5)
+		server_type = n1.nt5.server_type;
+	else if (n1.ntver == NETLOGON_NT_VERSION_5EX)
+		server_type = n1.nt5_ex.server_type;	
+
+	printf("The word is: %i\n", server_type);
+	if (server_type & NBT_SERVER_PDC)
+		printf("NBT_SERVER_PDC ");
+	if (server_type & NBT_SERVER_GC)
+		printf("NBT_SERVER_GC ");
+	if (server_type & NBT_SERVER_LDAP)
+		printf("NBT_SERVER_LDAP ");
+	if (server_type & NBT_SERVER_DS)
+		printf("NBT_SERVER_DS ");
+	if (server_type & NBT_SERVER_KDC)
+		printf("NBT_SERVER_KDC ");
+	if (server_type & NBT_SERVER_TIMESERV)
+		printf("NBT_SERVER_TIMESERV ");
+	if (server_type & NBT_SERVER_CLOSEST)
+		printf("NBT_SERVER_CLOSEST ");
+	if (server_type & NBT_SERVER_WRITABLE)
+		printf("NBT_SERVER_WRITABLE ");
+	if (server_type & NBT_SERVER_GOOD_TIMESERV)
+		printf("NBT_SERVER_GOOD_TIMESERV ");
+	if (server_type & NBT_SERVER_NDNC)
+		printf("NBT_SERVER_NDNC ");
+	if (server_type & NBT_SERVER_SEL_SEC_DOM_6)
+		printf("NBT_SERVER_SEL_SEC_DOM_6 ");
+	if (server_type & NBT_SERVER_FUL_SEC_DOM_6)
+		printf("NBT_SERVER_FUL_SEC_DOM_6 ");
+	if (server_type & NBT_SERVER_DS_DNS_CONTR)
+		printf("NBT_SERVER_DS_DNS_CONTR ");
+	if (server_type & NBT_SERVER_DS_DNS_DOMAIN)
+		printf("NBT_SERVER_DS_DNS_DOMAIN ");
+	if (server_type & NBT_SERVER_DS_DNS_FOREST)
+		printf("NBT_SERVER_DS_DNS_FOREST ");
+
+	printf("\n");
+
+	return true;
+}
+
+/*
   convert a ldap result message to a ldb message. This allows us to
   use the convenient ldif dump routines in ldb to print out cldap
   search results
@@ -266,6 +335,81 @@ static void cldap_dump_results(struct cldap_search *search)
 	talloc_free(ldb);
 }
 
+
+/*
+  test cldap netlogon server type flag "NBT_SERVER_DS_DNS_FOREST"
+*/
+static bool test_cldap_netlogon_flag_ds_dns_forest(struct torture_context *tctx,
+	const char *dest)
+{
+	struct cldap_socket *cldap;
+	NTSTATUS status;
+	struct cldap_netlogon search;
+	uint32_t server_type;
+	struct netlogon_samlogon_response n1;
+
+	bool result = true;
+
+	cldap = cldap_socket_init(tctx, tctx->ev, lp_iconv_convenience(tctx->lp_ctx));
+
+	printf("Testing netlogon server type flag NBT_SERVER_DS_DNS_FOREST: ");
+
+	ZERO_STRUCT(search);
+	search.in.dest_address = dest;
+	search.in.dest_port = lp_cldap_port(tctx->lp_ctx);
+	search.in.acct_control = -1;
+	search.in.version = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX;
+	search.in.map_response = true;
+
+	status = cldap_netlogon(cldap, tctx, &search);
+	CHECK_STATUS(status, NT_STATUS_OK);
+
+	n1 = search.out.netlogon;
+	if (n1.ntver == NETLOGON_NT_VERSION_5)
+		server_type = n1.nt5.server_type;
+	else if (n1.ntver == NETLOGON_NT_VERSION_5EX)
+		server_type = n1.nt5_ex.server_type;
+
+	if (server_type & NBT_SERVER_DS_DNS_FOREST) {
+		struct cldap_search search2;
+		const char *attrs[] = { "defaultNamingContext", "rootDomainNamingContext", 
+			NULL };
+		struct ldb_context *ldb;
+		struct ldb_message *msg;
+
+		/* Trying to fetch the attributes "defaultNamingContext" and
+		   "rootDomainNamingContext" */
+		ZERO_STRUCT(search2);
+		search2.in.dest_address = dest;
+		search2.in.dest_port = lp_cldap_port(tctx->lp_ctx);
+		search2.in.timeout = 10;
+		search2.in.retries = 3;
+		search2.in.filter = "(objectclass=*)";
+		search2.in.attributes = attrs;
+
+		status = cldap_search(cldap, tctx, &search2);
+		CHECK_STATUS(status, NT_STATUS_OK);
+
+		ldb = ldb_init(NULL, NULL);
+
+		msg = ldap_msg_to_ldb(ldb, ldb, search2.out.response);
+
+		/* Try to compare the two attributes */
+		if (ldb_msg_element_compare(ldb_msg_find_element(msg, attrs[0]),
+			ldb_msg_find_element(msg, attrs[1])))
+			result = false;
+
+		talloc_free(ldb);
+	}
+
+	if (result)
+		printf("passed\n");
+	else
+		printf("failed\n");
+
+	return result;
+}
+
 /*
   test generic cldap operations
 */
@@ -343,6 +487,8 @@ bool torture_cldap(struct torture_context *torture)
 	const char *host = torture_setting_string(torture, "host", NULL);
 
 	ret &= test_cldap_netlogon(torture, host);
+	ret &= test_cldap_netlogon_flags(torture, host);
+	ret &= test_cldap_netlogon_flag_ds_dns_forest(torture, host);
 	ret &= test_cldap_generic(torture, host);
 
 	return ret;
diff --git a/source4/torture/raw/offline.c b/source4/torture/raw/offline.c
index 9c66c3be9c..f2f0bf5d27 100644
--- a/source4/torture/raw/offline.c
+++ b/source4/torture/raw/offline.c
@@ -108,8 +108,11 @@ static void loadfile_callback(struct composite_context *ctx)
 	}
 
 	for (i=0;i<FILE_SIZE;i++) {
-		if (state->loadfile->out.data[i] != state->fnumber % 256) {
-			printf("Bad data in file %u\n", state->fnumber);
+		if (state->loadfile->out.data[i] != 1+(state->fnumber % 255)) {
+			printf("Bad data in file %u (got %u expected %u)\n", 
+			       state->fnumber, 
+			       state->loadfile->out.data[i],
+			       1+(state->fnumber % 255));
 			test_failed++;
 			return;
 		}
@@ -253,7 +256,7 @@ static void test_offline(struct offline_state *state)
 		state->savefile->in.fname = state->fname;
 		state->savefile->in.data  = talloc_size(state->savefile, FILE_SIZE);
 		state->savefile->in.size  = FILE_SIZE;
-		memset(state->savefile->in.data, state->fnumber, FILE_SIZE);
+		memset(state->savefile->in.data, 1+(state->fnumber%255), FILE_SIZE);
 	
 		ctx = smb_composite_savefile_send(state->tree, state->savefile);
 		if (ctx == NULL) {
@@ -344,12 +347,16 @@ static void report_rate(struct event_context *ev, struct timed_event *te,
 		total_online += state[i].online_count;
 		total_offline += state[i].offline_count;
 	}
-	printf("ops/s=%4u  offline=%5u online=%4u  set_lat=%.1f get_lat=%.1f save_lat=%.1f load_lat=%.1f\r",
+	printf("ops/s=%4u  offline=%5u online=%4u  set_lat=%.1f/%.1f get_lat=%.1f/%.1f save_lat=%.1f/%.1f load_lat=%.1f/%.1f\n",
 	       total, total_offline, total_online,
 	       latencies[OP_SETOFFLINE],
+	       worst_latencies[OP_SETOFFLINE],
 	       latencies[OP_GETOFFLINE],
+	       worst_latencies[OP_GETOFFLINE],
 	       latencies[OP_SAVEFILE],
-	       latencies[OP_LOADFILE]);
+	       worst_latencies[OP_SAVEFILE],
+	       latencies[OP_LOADFILE],
+	       worst_latencies[OP_LOADFILE]);
 	fflush(stdout);
 	event_add_timed(ev, state, timeval_current_ofs(1, 0), report_rate, state);
 
@@ -436,7 +443,7 @@ bool torture_test_offline(struct torture_context *torture)
 		char buf[FILE_SIZE];
 		NTSTATUS status;
 
-		memset(buf, i % 256, sizeof(buf));
+		memset(buf, 1+(i % 255), sizeof(buf));
 
 		fnum = smbcli_open(state[0].tree, fname, O_RDWR|O_CREAT, DENY_NONE);
 		if (fnum == -1) {
diff --git a/source4/torture/rpc/dssync.c b/source4/torture/rpc/dssync.c
index 2739081246..e9346f9605 100644
--- a/source4/torture/rpc/dssync.c
+++ b/source4/torture/rpc/dssync.c
@@ -747,9 +747,10 @@ static bool test_FetchData(struct torture_context *tctx, struct DsSyncTest *ctx)
 			if (ret == true && *r.out.level == 1) {
 				out_level = 1;
 				ctr1 = &r.out.ctr.ctr1;
-			} else if (ret == true && *r.out.level == 2) {
+			} else if (ret == true && *r.out.level == 2 &&
+				   r.out.ctr.ctr2.mszip1.ts) {
 				out_level = 1;
-				ctr1 = r.out.ctr.ctr2.mszip1.ctr1;
+				ctr1 = &r.out.ctr.ctr2.mszip1.ts->ctr1;
 			}
 
 			if (out_level == 1) {
@@ -770,14 +771,16 @@ static bool test_FetchData(struct torture_context *tctx, struct DsSyncTest *ctx)
 				ctr6 = &r.out.ctr.ctr6;
 			} else if (ret == true && *r.out.level == 7
 				   && r.out.ctr.ctr7.level == 6
-				   && r.out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP) {
+				   && r.out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP
+				   && r.out.ctr.ctr7.ctr.mszip6.ts) {
 				out_level = 6;
-				ctr6 = r.out.ctr.ctr7.ctr.mszip6.ctr6;
+				ctr6 = &r.out.ctr.ctr7.ctr.mszip6.ts->ctr6;
 			} else if (ret == true && *r.out.level == 7
 				   && r.out.ctr.ctr7.level == 6
-				   && r.out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS) {
+				   && r.out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS
+				   && r.out.ctr.ctr7.ctr.xpress6.ts) {
 				out_level = 6;
-				ctr6 = r.out.ctr.ctr7.ctr.xpress6.ctr6;
+				ctr6 = &r.out.ctr.ctr7.ctr.xpress6.ts->ctr6;
 			}
 
 			if (out_level == 6) {