Changeset 745 for trunk/server/source4/rpc_server

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/rpc_server/backupkey (copied) (copied from vendor/current/source4/rpc_server/backupkey )
• source4/rpc_server/backupkey/dcesrv_backupkey.c (copied) (copied from vendor/current/source4/rpc_server/backupkey/dcesrv_backupkey.c )
• source4/rpc_server/browser/dcesrv_browser.c (modified) (1 diff)
• source4/rpc_server/common/common.h (modified) (2 diffs)
• source4/rpc_server/common/forward.c (modified) (5 diffs)
• source4/rpc_server/common/reply.c (copied) (copied from vendor/current/source4/rpc_server/common/reply.c )
• source4/rpc_server/common/server_info.c (modified) (7 diffs)
• source4/rpc_server/config.mk (deleted)
• source4/rpc_server/dcerpc_server.c (modified) (26 diffs)
• source4/rpc_server/dcerpc_server.h (modified) (6 diffs)
• source4/rpc_server/dcerpc_server.pc.in (copied) (copied from vendor/current/source4/rpc_server/dcerpc_server.pc.in )
• source4/rpc_server/dcesrv_auth.c (modified) (23 diffs)
• source4/rpc_server/drsuapi/addentry.c (modified) (9 diffs)
• source4/rpc_server/drsuapi/dcesrv_drsuapi.c (modified) (28 diffs)
• source4/rpc_server/drsuapi/dcesrv_drsuapi.h (modified) (4 diffs)
• source4/rpc_server/drsuapi/drsutil.c (modified) (6 diffs)
• source4/rpc_server/drsuapi/getncchanges.c (modified) (23 diffs)
• source4/rpc_server/drsuapi/updaterefs.c (modified) (8 diffs)
• source4/rpc_server/drsuapi/writespn.c (copied) (copied from vendor/current/source4/rpc_server/drsuapi/writespn.c )
• source4/rpc_server/echo/rpc_echo.c (modified) (2 diffs)
• source4/rpc_server/epmapper/rpc_epmapper.c (modified) (3 diffs)
• source4/rpc_server/eventlog (copied) (copied from vendor/current/source4/rpc_server/eventlog )
• source4/rpc_server/eventlog/dcesrv_eventlog6.c (copied) (copied from vendor/current/source4/rpc_server/eventlog/dcesrv_eventlog6.c )
• source4/rpc_server/handles.c (modified) (3 diffs)
• source4/rpc_server/lsa/dcesrv_lsa.c (modified) (89 diffs)
• source4/rpc_server/lsa/lsa.h (modified) (2 diffs)
• source4/rpc_server/lsa/lsa_init.c (modified) (3 diffs)
• source4/rpc_server/lsa/lsa_lookup.c (modified) (31 diffs)
• source4/rpc_server/netlogon/dcerpc_netlogon.c (modified) (87 diffs)
• source4/rpc_server/remote/dcesrv_remote.c (modified) (11 diffs)
• source4/rpc_server/samr/dcesrv_samr.c (modified) (204 diffs)
• source4/rpc_server/samr/dcesrv_samr.h (modified) (2 diffs)
• source4/rpc_server/samr/samr_password.c (modified) (34 diffs)
• source4/rpc_server/service_rpc.c (modified) (4 diffs)
• source4/rpc_server/spoolss/dcesrv_spoolss.c (modified) (28 diffs)
• source4/rpc_server/srvsvc/dcesrv_srvsvc.c (modified) (43 diffs)
• source4/rpc_server/srvsvc/srvsvc_ntvfs.c (modified) (4 diffs)
• source4/rpc_server/unixinfo/dcesrv_unixinfo.c (modified) (9 diffs)
• source4/rpc_server/winreg/rpc_winreg.c (modified) (20 diffs)
• source4/rpc_server/wkssvc/dcesrv_wkssvc.c (modified) (7 diffs)
• source4/rpc_server/wscript_build (copied) (copied from vendor/current/source4/rpc_server/wscript_build )

trunk/server/source4/rpc_server/browser/dcesrv_browser.c

@@ -73 +73 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_INVALID_PARAM;
 }
 

trunk/server/source4/rpc_server/common/common.h

@@ -25 +25 @@
 
 struct share_config;
+struct dcesrv_connection;
 struct dcesrv_context;
 struct dcesrv_context;
+struct dcesrv_call_state;
+struct ndr_interface_table;
+struct ncacn_packet;
 
 struct dcerpc_server_info { 
@@ -35 +39 @@
 };
 
-struct ndr_interface_table;
-struct dcesrv_call_state;
 #include "rpc_server/common/proto.h"
 

trunk/server/source4/rpc_server/common/forward.c

@@ -21 +21 @@
 
 #include "includes.h"
+#include <tevent.h>
 #include "rpc_server/dcerpc_server.h"
+#include "librpc/gen_ndr/dcerpc.h"
+#include "rpc_server/common/common.h"
 #include "messaging/irpc.h"
+#include "auth/auth.h"
+
 
 struct dcesrv_forward_state {
@@ -32 +37 @@
   called when the forwarded rpc request is finished
  */
-static void dcesrv_irpc_forward_callback(struct irpc_request *ireq)
+static void dcesrv_irpc_forward_callback(struct tevent_req *subreq)
 {
-        struct dcesrv_forward_state *st = talloc_get_type(ireq->async.private_data, 
-                                                          struct dcesrv_forward_state);
+        struct dcesrv_forward_state *st =
+                tevent_req_callback_data(subreq,
+                struct dcesrv_forward_state);
         const char *opname = st->opname;
         NTSTATUS status;
-        if (!NT_STATUS_IS_OK(ireq->status)) {
+
+        status = dcerpc_binding_handle_call_recv(subreq);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0,("IRPC callback failed for %s - %s\n",
-                         opname, nt_errstr(ireq->status)));
+                         opname, nt_errstr(status)));
                 st->dce_call->fault_code = DCERPC_FAULT_CANT_PERFORM;
         }
-        talloc_free(ireq);
         status = dcesrv_reply(st->dce_call);
         if (!NT_STATUS_IS_OK(status)) {
@@ -53 +61 @@
 
 
-/*
-  forward a RPC call using IRPC to another task
+/**
+ * Forward a RPC call using IRPC to another task
  */
 void dcesrv_irpc_forward_rpc_call(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                                   void *r, uint32_t callid,
                                   const struct ndr_interface_table *ndr_table,
-                                  const char *dest_task, const char *opname)
+                                  const char *dest_task, const char *opname,
+                                  uint32_t timeout)
 {
-        struct server_id *sid;
-        struct irpc_request *ireq;
         struct dcesrv_forward_state *st;
+        struct dcerpc_binding_handle *binding_handle;
+        struct tevent_req *subreq;
+        struct security_token *token;
 
         st = talloc(mem_ctx, struct dcesrv_forward_state);
@@ -83 +93 @@
         }
 
-        /* find the server task */
-        sid = irpc_servers_byname(dce_call->msg_ctx, mem_ctx, dest_task);
-        if (sid == NULL || sid[0].id == 0) {
-                DEBUG(0,("%s: Unable to find %s task\n", dest_task, opname));
+        binding_handle = irpc_binding_handle_by_name(st, dce_call->msg_ctx,
+                                                     dest_task, ndr_table);
+        if (binding_handle == NULL) {
+                DEBUG(0,("%s: Failed to forward request to %s task\n",
+                         opname, dest_task));
                 dce_call->fault_code = DCERPC_FAULT_CANT_PERFORM;
                 return;
         }
 
+        /* reset timeout for the handle */
+        dcerpc_binding_handle_set_timeout(binding_handle, timeout);
+
+        /* add security token to the handle*/
+        token = dce_call->conn->auth_state.session_info->security_token;
+        irpc_binding_handle_add_security_token(binding_handle, token);
+
         /* forward the call */
-        ireq = irpc_call_send(dce_call->msg_ctx, sid[0], ndr_table, callid, r, mem_ctx);
-        if (ireq == NULL) {
+        subreq = dcerpc_binding_handle_call_send(st, dce_call->event_ctx,
+                                                 binding_handle,
+                                                 NULL, ndr_table,
+                                                 callid,
+                                                 dce_call, r);
+        if (subreq == NULL) {
                 DEBUG(0,("%s: Failed to forward request to %s task\n", 
                          opname, dest_task));
@@ -104 +126 @@
 
         /* setup the callback */
-        ireq->async.fn = dcesrv_irpc_forward_callback;
-        ireq->async.private_data = st;
+        tevent_req_set_callback(subreq, dcesrv_irpc_forward_callback, st);
 }

trunk/server/source4/rpc_server/common/server_info.c

@@ -21 +21 @@
 
 #include "includes.h"
-#include "librpc/gen_ndr/ndr_srvsvc.h"
+#include "librpc/gen_ndr/srvsvc.h"
 #include "rpc_server/dcerpc_server.h"
 #include "dsdb/samdb/samdb.h"
 #include "auth/auth.h"
 #include "param/param.h"
-#include "rpc_server/common/common.h"
 
 /* 
@@ -37 +36 @@
         enum srvsvc_PlatformId id;
 
-        id = lp_parm_int(dce_ctx->lp_ctx, NULL, "server_info", "platform_id", PLATFORM_ID_NT);
+        id = lpcfg_parm_int(dce_ctx->lp_ctx, NULL, "server_info", "platform_id", PLATFORM_ID_NT);
 
         return id;
@@ -48 +47 @@
         /* if there's no string return our NETBIOS name */
         if (!p) {
-                return talloc_strdup(mem_ctx, lp_netbios_name(dce_ctx->lp_ctx));
+                return talloc_strdup(mem_ctx, lpcfg_netbios_name(dce_ctx->lp_ctx));
         }
 
@@ -68 +67 @@
         default_server_announce |= SV_TYPE_SERVER_UNIX;
 
-        switch (lp_announce_as(dce_ctx->lp_ctx)) {
+        switch (lpcfg_announce_as(dce_ctx->lp_ctx)) {
                 case ANNOUNCE_AS_NT_SERVER:
                         default_server_announce |= SV_TYPE_SERVER_NT;
@@ -85 +84 @@
         }
 
-        switch (lp_server_role(dce_ctx->lp_ctx)) {
+        switch (lpcfg_server_role(dce_ctx->lp_ctx)) {
                 case ROLE_DOMAIN_MEMBER:
                         default_server_announce |= SV_TYPE_DOMAIN_MEMBER;
@@ -97 +96 @@
                         }
                         /* open main ldb */
-                        samctx = samdb_connect(tmp_ctx, event_ctx, dce_ctx->lp_ctx, anonymous_session(tmp_ctx, event_ctx, dce_ctx->lp_ctx));
+                        samctx = samdb_connect(tmp_ctx, event_ctx, dce_ctx->lp_ctx, anonymous_session(tmp_ctx, dce_ctx->lp_ctx), 0);
                         if (samctx == NULL) {
                                 DEBUG(2,("Unable to open samdb in determining server announce flags\n"));
@@ -117 +116 @@
                         break;
         }
-        if (lp_time_server(dce_ctx->lp_ctx))
+        if (lpcfg_time_server(dce_ctx->lp_ctx))
                 default_server_announce |= SV_TYPE_TIME_SOURCE;
 
-        if (lp_host_msdfs(dce_ctx->lp_ctx))
+        if (lpcfg_host_msdfs(dce_ctx->lp_ctx))
                 default_server_announce |= SV_TYPE_DFS_SERVER;
 

trunk/server/source4/rpc_server/dcerpc_server.c

@@ -22 +22 @@
 
 #include "includes.h"
-#include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "auth/auth.h"
 #include "auth/gensec/gensec.h"
@@ -28 +27 @@
 #include "rpc_server/dcerpc_server.h"
 #include "rpc_server/dcerpc_server_proto.h"
+#include "rpc_server/common/proto.h"
 #include "librpc/rpc/dcerpc_proto.h"
-#include "lib/events/events.h"
-#include "smbd/service_task.h"
-#include "smbd/service_stream.h"
-#include "smbd/service.h"
 #include "system/filesys.h"
 #include "libcli/security/security.h"
 #include "param/param.h"
+#include "../lib/tsocket/tsocket.h"
+#include "../libcli/named_pipe_auth/npa_tstream.h"
+#include "smbd/service_stream.h"
+#include "../lib/tsocket/tsocket.h"
+#include "lib/socket/socket.h"
+#include "smbd/process_model.h"
+#include "lib/messaging/irpc.h"
+#include "librpc/rpc/rpc_common.h"
 
 /* this is only used when the client asks for an unknown interface */
@@ -337 +341 @@
 }
 
-NTSTATUS dcesrv_generic_session_key(struct dcesrv_connection *p,
-                                    DATA_BLOB *session_key)
-{
-        /* this took quite a few CPU cycles to find ... */
-        session_key->data = discard_const_p(uint8_t, "SystemLibraryDTC");
-        session_key->length = 16;
-        return NT_STATUS_OK;
-}
-
 /*
   fetch the user session key - may be default (above) or the SMB session key
@@ -395 +390 @@
         p->contexts = NULL;
         p->call_list = NULL;
-        p->packet_log_dir = lp_lockdir(dce_ctx->lp_ctx);
+        p->packet_log_dir = lpcfg_lockdir(dce_ctx->lp_ctx);
         p->incoming_fragmented_call_list = NULL;
         p->pending_call_list = NULL;
@@ -415 +410 @@
 }
 
-static void dcesrv_init_hdr(struct ncacn_packet *pkt, bool bigendian)
-{
-        pkt->rpc_vers = 5;
-        pkt->rpc_vers_minor = 0;
-        if (bigendian) {
-                pkt->drep[0] = 0;
-        } else {
-                pkt->drep[0] = DCERPC_DREP_LE;
-        }
-        pkt->drep[1] = 0;
-        pkt->drep[2] = 0;
-        pkt->drep[3] = 0;
-}
-
 /*
   move a call from an existing linked list to the specified list. This
@@ -466 +447 @@
 }
 
-/*
-  return a dcerpc fault
-*/
-static NTSTATUS dcesrv_fault(struct dcesrv_call_state *call, uint32_t fault_code)
-{
-        struct ncacn_packet pkt;
-        struct data_blob_list_item *rep;
-        uint8_t zeros[4];
-        NTSTATUS status;
-
-        /* setup a bind_ack */
-        dcesrv_init_hdr(&pkt, lp_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
-        pkt.auth_length = 0;
-        pkt.call_id = call->pkt.call_id;
-        pkt.ptype = DCERPC_PKT_FAULT;
-        pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
-        pkt.u.fault.alloc_hint = 0;
-        pkt.u.fault.context_id = 0;
-        pkt.u.fault.cancel_count = 0;
-        pkt.u.fault.status = fault_code;
-
-        ZERO_STRUCT(zeros);
-        pkt.u.fault._pad = data_blob_const(zeros, sizeof(zeros));
-
-        rep = talloc(call, struct data_blob_list_item);
-        if (!rep) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, NULL);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        dcerpc_set_frag_length(&rep->blob, rep->blob.length);
-
-        DLIST_ADD_END(call->replies, rep, struct data_blob_list_item *);
-        dcesrv_call_set_list(call, DCESRV_LIST_CALL_LIST);
-
-        if (call->conn->call_list && call->conn->call_list->replies) {
-                if (call->conn->transport.report_output_data) {
-                        call->conn->transport.report_output_data(call->conn);
-                }
-        }
-
-        return NT_STATUS_OK;    
-}
-
 
 /*
@@ -525 +458 @@
 
         /* setup a bind_nak */
-        dcesrv_init_hdr(&pkt, lp_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
+        dcesrv_init_hdr(&pkt, lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
         pkt.auth_length = 0;
         pkt.call_id = call->pkt.call_id;
@@ -540 +473 @@
         }
 
-        status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, NULL);
+        status = ncacn_push_auth(&rep->blob, call, &pkt, NULL);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -563 +496 @@
         DLIST_REMOVE(c->conn->contexts, c);
 
-        if (c->iface) {
+        if (c->iface && c->iface->unbind) {
                 c->iface->unbind(c, c->iface);
         }
@@ -589 +522 @@
          */
         if (call->pkt.u.bind.assoc_group_id != 0 &&
-            lp_parm_bool(call->conn->dce_ctx->lp_ctx, NULL, "dcesrv","assoc group checking", true) &&
+            lpcfg_parm_bool(call->conn->dce_ctx->lp_ctx, NULL, "dcesrv","assoc group checking", true) &&
             dcesrv_assoc_group_find(call->conn->dce_ctx, call->pkt.u.bind.assoc_group_id) == NULL) {
                 return dcesrv_bind_nak(call, 0);        
@@ -657 +590 @@
                 talloc_set_destructor(context, dcesrv_connection_context_destructor);
 
-                status = iface->bind(call, iface);
+                status = iface->bind(call, iface, if_version);
                 if (!NT_STATUS_IS_OK(status)) {
                         char *uuid_str = GUID_string(call, &uuid);
@@ -676 +609 @@
 
         if ((call->pkt.pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN) &&
-            lp_parm_bool(call->conn->dce_ctx->lp_ctx, NULL, "dcesrv","header signing", false)) {
+            lpcfg_parm_bool(call->conn->dce_ctx->lp_ctx, NULL, "dcesrv","header signing", false)) {
                 call->conn->state_flags |= DCESRV_CALL_STATE_FLAG_HEADER_SIGNING;
                 extra_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
@@ -689 +622 @@
 
         /* setup a bind_ack */
-        dcesrv_init_hdr(&pkt, lp_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
+        dcesrv_init_hdr(&pkt, lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
         pkt.auth_length = 0;
         pkt.call_id = call->pkt.call_id;
@@ -741 +674 @@
         }
 
-        status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, call->conn->auth_state.auth_info);
+        status = ncacn_push_auth(&rep->blob, call, &pkt,
+                                                         call->conn->auth_state.auth_info);
         if (!NT_STATUS_IS_OK(status)) {
                 talloc_free(call->context);
@@ -836 +770 @@
         talloc_set_destructor(context, dcesrv_connection_context_destructor);
 
-        status = iface->bind(call, iface);
+        status = iface->bind(call, iface, if_version);
         if (!NT_STATUS_IS_OK(status)) {
                 /* we don't want to trigger the iface->unbind() hook */
@@ -883 +817 @@
         if (result == 0 &&
             call->pkt.u.alter.assoc_group_id != 0 &&
-            lp_parm_bool(call->conn->dce_ctx->lp_ctx, NULL, "dcesrv","assoc group checking", true) &&
+            lpcfg_parm_bool(call->conn->dce_ctx->lp_ctx, NULL, "dcesrv","assoc group checking", true) &&
             call->pkt.u.alter.assoc_group_id != call->context->assoc_group->id) {
                 DEBUG(0,(__location__ ": Failed attempt to use new assoc_group in alter context (0x%08x 0x%08x)\n",
@@ -893 +827 @@
 
         /* setup a alter_resp */
-        dcesrv_init_hdr(&pkt, lp_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
+        dcesrv_init_hdr(&pkt, lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
         pkt.auth_length = 0;
         pkt.call_id = call->pkt.call_id;
@@ -932 +866 @@
         }
 
-        status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, call->conn->auth_state.auth_info);
+        status = ncacn_push_auth(&rep->blob, call, &pkt, call->conn->auth_state.auth_info);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -949 +883 @@
 
         return NT_STATUS_OK;
+}
+
+/*
+  possibly save the call for inspection with ndrdump
+ */
+static void dcesrv_save_call(struct dcesrv_call_state *call, const char *why)
+{
+#ifdef DEVELOPER
+        char *fname;
+        const char *dump_dir;
+        dump_dir = lpcfg_parm_string(call->conn->dce_ctx->lp_ctx, NULL, "dcesrv", "stubs directory");
+        if (!dump_dir) {
+                return;
+        }
+        fname = talloc_asprintf(call, "%s/RPC-%s-%u-%s.dat",
+                                dump_dir,
+                                call->context->iface->name,
+                                call->pkt.u.request.opnum,
+                                why);
+        if (file_save(fname, call->pkt.u.request.stub_and_verifier.data, call->pkt.u.request.stub_and_verifier.length)) {
+                DEBUG(0,("RPC SAVED %s\n", fname));
+        }
+        talloc_free(fname);
+#endif
 }
 
@@ -971 +929 @@
         }
 
-        pull = ndr_pull_init_blob(&call->pkt.u.request.stub_and_verifier, call,
-                                  lp_iconv_convenience(call->conn->dce_ctx->lp_ctx));
+        pull = ndr_pull_init_blob(&call->pkt.u.request.stub_and_verifier, call);
         NT_STATUS_HAVE_NO_MEMORY(pull);
 
@@ -987 +944 @@
         status = context->iface->ndr_pull(call, call, pull, &call->r);
         if (!NT_STATUS_IS_OK(status)) {
+                if (call->fault_code == DCERPC_FAULT_OP_RNG_ERROR) {
+                        /* we got an unknown call */
+                        DEBUG(3,(__location__ ": Unknown RPC call %u on %s\n",
+                                 call->pkt.u.request.opnum, context->iface->name));
+                        dcesrv_save_call(call, "unknown");
+                } else {
+                        dcesrv_save_call(call, "pullfail");
+                }
                 return dcesrv_fault(call, call->fault_code);
         }
 
         if (pull->offset != pull->data_size) {
+                dcesrv_save_call(call, "extrabytes");
                 DEBUG(3,("Warning: %d extra bytes in incoming RPC request\n", 
                          pull->data_size - pull->offset));
-                dump_data(10, pull->data+pull->offset, pull->data_size - pull->offset);
         }
 
@@ -1016 +981 @@
 }
 
-_PUBLIC_ NTSTATUS dcesrv_reply(struct dcesrv_call_state *call)
-{
-        struct ndr_push *push;
-        NTSTATUS status;
-        DATA_BLOB stub;
-        uint32_t total_length, chunk_size;
-        struct dcesrv_connection_context *context = call->context;
-        size_t sig_size = 0;
-
-        /* call the reply function */
-        status = context->iface->reply(call, call, call->r);
-        if (!NT_STATUS_IS_OK(status)) {
-                return dcesrv_fault(call, call->fault_code);
-        }
-
-        /* form the reply NDR */
-        push = ndr_push_init_ctx(call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx));
-        NT_STATUS_HAVE_NO_MEMORY(push);
-
-        /* carry over the pointer count to the reply in case we are
-           using full pointer. See NDR specification for full
-           pointers */
-        push->ptr_count = call->ndr_pull->ptr_count;
-
-        if (lp_rpc_big_endian(call->conn->dce_ctx->lp_ctx)) {
-                push->flags |= LIBNDR_FLAG_BIGENDIAN;
-        }
-
-        status = context->iface->ndr_push(call, call, push, call->r);
-        if (!NT_STATUS_IS_OK(status)) {
-                return dcesrv_fault(call, call->fault_code);
-        }
-
-        stub = ndr_push_blob(push);
-
-        total_length = stub.length;
-
-        /* we can write a full max_recv_frag size, minus the dcerpc
-           request header size */
-        chunk_size = call->conn->cli_max_recv_frag;
-        chunk_size -= DCERPC_REQUEST_LENGTH;
-        if (call->conn->auth_state.auth_info &&
-            call->conn->auth_state.gensec_security) {
-                sig_size = gensec_sig_size(call->conn->auth_state.gensec_security,
-                                           call->conn->cli_max_recv_frag);
-                if (sig_size) {
-                        chunk_size -= DCERPC_AUTH_TRAILER_LENGTH;
-                        chunk_size -= sig_size;
-                }
-        }
-        chunk_size -= (chunk_size % 16);
-
-        do {
-                uint32_t length;
-                struct data_blob_list_item *rep;
-                struct ncacn_packet pkt;
-
-                rep = talloc(call, struct data_blob_list_item);
-                NT_STATUS_HAVE_NO_MEMORY(rep);
-
-                length = MIN(chunk_size, stub.length);
-
-                /* form the dcerpc response packet */
-                dcesrv_init_hdr(&pkt, lp_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
-                pkt.auth_length = 0;
-                pkt.call_id = call->pkt.call_id;
-                pkt.ptype = DCERPC_PKT_RESPONSE;
-                pkt.pfc_flags = 0;
-                if (stub.length == total_length) {
-                        pkt.pfc_flags |= DCERPC_PFC_FLAG_FIRST;
-                }
-                if (length == stub.length) {
-                        pkt.pfc_flags |= DCERPC_PFC_FLAG_LAST;
-                }
-                pkt.u.response.alloc_hint = stub.length;
-                pkt.u.response.context_id = call->pkt.u.request.context_id;
-                pkt.u.response.cancel_count = 0;
-                pkt.u.response.stub_and_verifier.data = stub.data;
-                pkt.u.response.stub_and_verifier.length = length;
-
-                if (!dcesrv_auth_response(call, &rep->blob, sig_size, &pkt)) {
-                        return dcesrv_fault(call, DCERPC_FAULT_OTHER);          
-                }
-
-                dcerpc_set_frag_length(&rep->blob, rep->blob.length);
-
-                DLIST_ADD_END(call->replies, rep, struct data_blob_list_item *);
-                
-                stub.data += length;
-                stub.length -= length;
-        } while (stub.length != 0);
-
-        /* move the call from the pending to the finished calls list */
-        dcesrv_call_set_list(call, DCESRV_LIST_CALL_LIST);
-
-        if (call->conn->call_list && call->conn->call_list->replies) {
-                if (call->conn->transport.report_output_data) {
-                        call->conn->transport.report_output_data(call->conn);
-                }
-        }
-
-        return NT_STATUS_OK;
-}
-
-_PUBLIC_ struct socket_address *dcesrv_connection_get_my_addr(struct dcesrv_connection *conn, TALLOC_CTX *mem_ctx)
-{
-        if (!conn->transport.get_my_addr) {
-                return NULL;
-        }
-
-        return conn->transport.get_my_addr(conn, mem_ctx);
-}
-
-_PUBLIC_ struct socket_address *dcesrv_connection_get_peer_addr(struct dcesrv_connection *conn, TALLOC_CTX *mem_ctx)
-{
-        if (!conn->transport.get_peer_addr) {
-                return NULL;
-        }
-
-        return conn->transport.get_peer_addr(conn, mem_ctx);
-}
-
 
 /*
@@ -1146 +989 @@
         dcesrv_call_set_list(call, DCESRV_LIST_NONE);
         return 0;
+}
+
+_PUBLIC_ const struct tsocket_address *dcesrv_connection_get_local_address(struct dcesrv_connection *conn)
+{
+        return conn->local_address;
+}
+
+_PUBLIC_ const struct tsocket_address *dcesrv_connection_get_remote_address(struct dcesrv_connection *conn)
+{
+        return conn->remote_address;
 }
 
@@ -1195 +1048 @@
                 }
 
-                /* this is a continuation of an existing call - find the call then
-                   tack it on the end */
+                /* this is a continuation of an existing call - find the call
+                   then tack it on the end */
                 call = dcesrv_find_fragmented_call(dce_conn, call2->pkt.call_id);
                 if (!call) {
@@ -1373 +1226 @@
 {
         static bool initialized;
-        extern NTSTATUS dcerpc_server_wkssvc_init(void);
-        extern NTSTATUS dcerpc_server_drsuapi_init(void);
-        extern NTSTATUS dcerpc_server_winreg_init(void);
-        extern NTSTATUS dcerpc_server_spoolss_init(void);
-        extern NTSTATUS dcerpc_server_epmapper_init(void);
-        extern NTSTATUS dcerpc_server_srvsvc_init(void);
-        extern NTSTATUS dcerpc_server_netlogon_init(void);
-        extern NTSTATUS dcerpc_server_rpcecho_init(void);
-        extern NTSTATUS dcerpc_server_unixinfo_init(void);
-        extern NTSTATUS dcerpc_server_samr_init(void);
-        extern NTSTATUS dcerpc_server_remote_init(void);
-        extern NTSTATUS dcerpc_server_lsa_init(void);
-        extern NTSTATUS dcerpc_server_browser_init(void);
+#define _MODULE_PROTO(init) extern NTSTATUS init(void);
+        STATIC_dcerpc_server_MODULES_PROTO;
         init_module_fn static_init[] = { STATIC_dcerpc_server_MODULES };
         init_module_fn *shared_init;
@@ -1425 +1267 @@
 }
 
+static void dcesrv_terminate_connection(struct dcesrv_connection *dce_conn, const char *reason)
+{
+        struct stream_connection *srv_conn;
+        srv_conn = talloc_get_type(dce_conn->transport.private_data,
+                                   struct stream_connection);
+
+        stream_terminate_connection(srv_conn, reason);
+}
+/* We need this include to be able to compile on some plateforms
+ * (ie. freebsd 7.2) as it seems that <sys/uio.h> is not included
+ * correctly.
+ * It has to be that deep because otherwise we have a conflict on
+ * const struct dcesrv_interface declaration.
+ * This is mostly due to socket_wrapper defining #define bind swrap_bind
+ * which conflict with the bind used before.
+ */
+#include "system/network.h"
+
+struct dcesrv_sock_reply_state {
+        struct dcesrv_connection *dce_conn;
+        struct dcesrv_call_state *call;
+        struct iovec iov;
+};
+
+static void dcesrv_sock_reply_done(struct tevent_req *subreq);
+
+static void dcesrv_sock_report_output_data(struct dcesrv_connection *dce_conn)
+{
+        struct dcesrv_call_state *call;
+
+        call = dce_conn->call_list;
+        if (!call || !call->replies) {
+                return;
+        }
+
+        while (call->replies) {
+                struct data_blob_list_item *rep = call->replies;
+                struct dcesrv_sock_reply_state *substate;
+                struct tevent_req *subreq;
+
+                substate = talloc(call, struct dcesrv_sock_reply_state);
+                if (!substate) {
+                        dcesrv_terminate_connection(dce_conn, "no memory");
+                        return;
+                }
+
+                substate->dce_conn = dce_conn;
+                substate->call = NULL;
+
+                DLIST_REMOVE(call->replies, rep);
+
+                if (call->replies == NULL) {
+                        substate->call = call;
+                }
+
+                substate->iov.iov_base = (void *) rep->blob.data;
+                substate->iov.iov_len = rep->blob.length;
+
+                subreq = tstream_writev_queue_send(substate,
+                                                   dce_conn->event_ctx,
+                                                   dce_conn->stream,
+                                                   dce_conn->send_queue,
+                                                   &substate->iov, 1);
+                if (!subreq) {
+                        dcesrv_terminate_connection(dce_conn, "no memory");
+                        return;
+                }
+                tevent_req_set_callback(subreq, dcesrv_sock_reply_done,
+                                        substate);
+        }
+
+        DLIST_REMOVE(call->conn->call_list, call);
+        call->list = DCESRV_LIST_NONE;
+}
+
+static void dcesrv_sock_reply_done(struct tevent_req *subreq)
+{
+        struct dcesrv_sock_reply_state *substate = tevent_req_callback_data(subreq,
+                                                struct dcesrv_sock_reply_state);
+        int ret;
+        int sys_errno;
+        NTSTATUS status;
+        struct dcesrv_call_state *call = substate->call;
+
+        ret = tstream_writev_queue_recv(subreq, &sys_errno);
+        TALLOC_FREE(subreq);
+        if (ret == -1) {
+                status = map_nt_error_from_unix(sys_errno);
+                dcesrv_terminate_connection(substate->dce_conn, nt_errstr(status));
+                return;
+        }
+
+        talloc_free(substate);
+        if (call) {
+                talloc_free(call);
+        }
+}
+
+
+
+
+struct dcesrv_socket_context {
+        const struct dcesrv_endpoint *endpoint;
+        struct dcesrv_context *dcesrv_ctx;
+};
+
+
+static void dcesrv_read_fragment_done(struct tevent_req *subreq);
+
+static void dcesrv_sock_accept(struct stream_connection *srv_conn)
+{
+        NTSTATUS status;
+        struct dcesrv_socket_context *dcesrv_sock = 
+                talloc_get_type(srv_conn->private_data, struct dcesrv_socket_context);
+        struct dcesrv_connection *dcesrv_conn = NULL;
+        int ret;
+        struct tevent_req *subreq;
+        struct loadparm_context *lp_ctx = dcesrv_sock->dcesrv_ctx->lp_ctx;
+
+        if (!srv_conn->session_info) {
+                status = auth_anonymous_session_info(srv_conn,
+                                                     lp_ctx,
+                                                     &srv_conn->session_info);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0,("dcesrv_sock_accept: auth_anonymous_session_info failed: %s\n",
+                                nt_errstr(status)));
+                        stream_terminate_connection(srv_conn, nt_errstr(status));
+                        return;
+                }
+        }
+
+        status = dcesrv_endpoint_connect(dcesrv_sock->dcesrv_ctx,
+                                         srv_conn,
+                                         dcesrv_sock->endpoint,
+                                         srv_conn->session_info,
+                                         srv_conn->event.ctx,
+                                         srv_conn->msg_ctx,
+                                         srv_conn->server_id,
+                                         DCESRV_CALL_STATE_FLAG_MAY_ASYNC,
+                                         &dcesrv_conn);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("dcesrv_sock_accept: dcesrv_endpoint_connect failed: %s\n", 
+                        nt_errstr(status)));
+                stream_terminate_connection(srv_conn, nt_errstr(status));
+                return;
+        }
+
+        dcesrv_conn->transport.private_data             = srv_conn;
+        dcesrv_conn->transport.report_output_data       = dcesrv_sock_report_output_data;
+
+        TALLOC_FREE(srv_conn->event.fde);
+
+        dcesrv_conn->send_queue = tevent_queue_create(dcesrv_conn, "dcesrv send queue");
+        if (!dcesrv_conn->send_queue) {
+                status = NT_STATUS_NO_MEMORY;
+                DEBUG(0,("dcesrv_sock_accept: tevent_queue_create(%s)\n",
+                        nt_errstr(status)));
+                stream_terminate_connection(srv_conn, nt_errstr(status));
+                return;
+        }
+
+        if (dcesrv_sock->endpoint->ep_description->transport == NCACN_NP) {
+                dcesrv_conn->auth_state.session_key = dcesrv_inherited_session_key;
+                dcesrv_conn->stream = talloc_move(dcesrv_conn,
+                                                  &srv_conn->tstream);
+        } else {
+                ret = tstream_bsd_existing_socket(dcesrv_conn,
+                                                  socket_get_fd(srv_conn->socket),
+                                                  &dcesrv_conn->stream);
+                if (ret == -1) {
+                        status = map_nt_error_from_unix(errno);
+                        DEBUG(0, ("dcesrv_sock_accept: "
+                                  "failed to setup tstream: %s\n",
+                                  nt_errstr(status)));
+                        stream_terminate_connection(srv_conn, nt_errstr(status));
+                        return;
+                }
+                socket_set_flags(srv_conn->socket, SOCKET_FLAG_NOCLOSE);
+        }
+
+        dcesrv_conn->local_address = srv_conn->local_address;
+        dcesrv_conn->remote_address = srv_conn->remote_address;
+
+        srv_conn->private_data = dcesrv_conn;
+
+        irpc_add_name(srv_conn->msg_ctx, "rpc_server");
+
+        subreq = dcerpc_read_ncacn_packet_send(dcesrv_conn,
+                                               dcesrv_conn->event_ctx,
+                                               dcesrv_conn->stream);
+        if (!subreq) {
+                status = NT_STATUS_NO_MEMORY;
+                DEBUG(0,("dcesrv_sock_accept: dcerpc_read_fragment_buffer_send(%s)\n",
+                        nt_errstr(status)));
+                stream_terminate_connection(srv_conn, nt_errstr(status));
+                return;
+        }
+        tevent_req_set_callback(subreq, dcesrv_read_fragment_done, dcesrv_conn);
+
+        return;
+}
+
+static void dcesrv_read_fragment_done(struct tevent_req *subreq)
+{
+        struct dcesrv_connection *dce_conn = tevent_req_callback_data(subreq,
+                                             struct dcesrv_connection);
+        struct ncacn_packet *pkt;
+        DATA_BLOB buffer;
+        NTSTATUS status;
+
+        status = dcerpc_read_ncacn_packet_recv(subreq, dce_conn,
+                                               &pkt, &buffer);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                dcesrv_terminate_connection(dce_conn, nt_errstr(status));
+                return;
+        }
+
+        status = dcesrv_process_ncacn_packet(dce_conn, pkt, buffer);
+        if (!NT_STATUS_IS_OK(status)) {
+                dcesrv_terminate_connection(dce_conn, nt_errstr(status));
+                return;
+        }
+
+        subreq = dcerpc_read_ncacn_packet_send(dce_conn,
+                                               dce_conn->event_ctx,
+                                               dce_conn->stream);
+        if (!subreq) {
+                status = NT_STATUS_NO_MEMORY;
+                dcesrv_terminate_connection(dce_conn, nt_errstr(status));
+                return;
+        }
+        tevent_req_set_callback(subreq, dcesrv_read_fragment_done, dce_conn);
+}
+
+static void dcesrv_sock_recv(struct stream_connection *conn, uint16_t flags)
+{
+        struct dcesrv_connection *dce_conn = talloc_get_type(conn->private_data,
+                                             struct dcesrv_connection);
+        dcesrv_terminate_connection(dce_conn, "dcesrv_sock_recv triggered");
+}
+
+static void dcesrv_sock_send(struct stream_connection *conn, uint16_t flags)
+{
+        struct dcesrv_connection *dce_conn = talloc_get_type(conn->private_data,
+                                             struct dcesrv_connection);
+        dcesrv_terminate_connection(dce_conn, "dcesrv_sock_send triggered");
+}
+
+
+static const struct stream_server_ops dcesrv_stream_ops = {
+        .name                   = "rpc",
+        .accept_connection      = dcesrv_sock_accept,
+        .recv_handler           = dcesrv_sock_recv,
+        .send_handler           = dcesrv_sock_send,
+};
+
+static NTSTATUS dcesrv_add_ep_unix(struct dcesrv_context *dce_ctx, 
+                                   struct loadparm_context *lp_ctx,
+                                   struct dcesrv_endpoint *e,
+                            struct tevent_context *event_ctx, const struct model_ops *model_ops)
+{
+        struct dcesrv_socket_context *dcesrv_sock;
+        uint16_t port = 1;
+        NTSTATUS status;
+
+        dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
+        NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
+
+        /* remember the endpoint of this socket */
+        dcesrv_sock->endpoint           = e;
+        dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
+
+        status = stream_setup_socket(dcesrv_sock, event_ctx, lp_ctx,
+                                     model_ops, &dcesrv_stream_ops, 
+                                     "unix", e->ep_description->endpoint, &port, 
+                                     lpcfg_socket_options(lp_ctx),
+                                     dcesrv_sock);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("service_setup_stream_socket(path=%s) failed - %s\n",
+                         e->ep_description->endpoint, nt_errstr(status)));
+        }
+
+        return status;
+}
+
+static NTSTATUS dcesrv_add_ep_ncalrpc(struct dcesrv_context *dce_ctx, 
+                                      struct loadparm_context *lp_ctx,
+                                      struct dcesrv_endpoint *e,
+                                      struct tevent_context *event_ctx, const struct model_ops *model_ops)
+{
+        struct dcesrv_socket_context *dcesrv_sock;
+        uint16_t port = 1;
+        char *full_path;
+        NTSTATUS status;
+
+        if (!e->ep_description->endpoint) {
+                /* No identifier specified: use DEFAULT. 
+                 * DO NOT hardcode this value anywhere else. Rather, specify 
+                 * no endpoint and let the epmapper worry about it. */
+                e->ep_description->endpoint = talloc_strdup(dce_ctx, "DEFAULT");
+        }
+
+        full_path = talloc_asprintf(dce_ctx, "%s/%s", lpcfg_ncalrpc_dir(lp_ctx),
+                                    e->ep_description->endpoint);
+
+        dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
+        NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
+
+        /* remember the endpoint of this socket */
+        dcesrv_sock->endpoint           = e;
+        dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
+
+        status = stream_setup_socket(dcesrv_sock, event_ctx, lp_ctx,
+                                     model_ops, &dcesrv_stream_ops, 
+                                     "unix", full_path, &port, 
+                                     lpcfg_socket_options(lp_ctx),
+                                     dcesrv_sock);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("service_setup_stream_socket(identifier=%s,path=%s) failed - %s\n",
+                         e->ep_description->endpoint, full_path, nt_errstr(status)));
+        }
+        return status;
+}
+
+static NTSTATUS dcesrv_add_ep_np(struct dcesrv_context *dce_ctx,
+                                 struct loadparm_context *lp_ctx,
+                                 struct dcesrv_endpoint *e,
+                                 struct tevent_context *event_ctx, const struct model_ops *model_ops)
+{
+        struct dcesrv_socket_context *dcesrv_sock;
+        NTSTATUS status;
+                        
+        if (e->ep_description->endpoint == NULL) {
+                DEBUG(0, ("Endpoint mandatory for named pipes\n"));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
+        NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
+
+        /* remember the endpoint of this socket */
+        dcesrv_sock->endpoint           = e;
+        dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
+
+        status = tstream_setup_named_pipe(dce_ctx, event_ctx, lp_ctx,
+                                          model_ops, &dcesrv_stream_ops,
+                                          e->ep_description->endpoint,
+                                          dcesrv_sock);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("stream_setup_named_pipe(pipe=%s) failed - %s\n",
+                         e->ep_description->endpoint, nt_errstr(status)));
+                return status;
+        }
+
+        return NT_STATUS_OK;
+}
+
+/*
+  add a socket address to the list of events, one event per dcerpc endpoint
+*/
+static NTSTATUS add_socket_rpc_tcp_iface(struct dcesrv_context *dce_ctx, struct dcesrv_endpoint *e,
+                                         struct tevent_context *event_ctx, const struct model_ops *model_ops,
+                                         const char *address)
+{
+        struct dcesrv_socket_context *dcesrv_sock;
+        uint16_t port = 0;
+        NTSTATUS status;
+                        
+        if (e->ep_description->endpoint) {
+                port = atoi(e->ep_description->endpoint);
+        }
+
+        dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
+        NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
+
+        /* remember the endpoint of this socket */
+        dcesrv_sock->endpoint           = e;
+        dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
+
+        status = stream_setup_socket(dcesrv_sock, event_ctx, dce_ctx->lp_ctx,
+                                     model_ops, &dcesrv_stream_ops, 
+                                     "ipv4", address, &port, 
+                                     lpcfg_socket_options(dce_ctx->lp_ctx),
+                                     dcesrv_sock);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("service_setup_stream_socket(address=%s,port=%u) failed - %s\n", 
+                         address, port, nt_errstr(status)));
+        }
+
+        if (e->ep_description->endpoint == NULL) {
+                e->ep_description->endpoint = talloc_asprintf(dce_ctx, "%d", port);
+        }
+
+        return status;
+}
+
+#include "lib/socket/netif.h" /* Included here to work around the fact that socket_wrapper redefines bind() */
+
+static NTSTATUS dcesrv_add_ep_tcp(struct dcesrv_context *dce_ctx, 
+                                  struct loadparm_context *lp_ctx,
+                                  struct dcesrv_endpoint *e,
+                                  struct tevent_context *event_ctx, const struct model_ops *model_ops)
+{
+        NTSTATUS status;
+
+        /* Add TCP/IP sockets */
+        if (lpcfg_interfaces(lp_ctx) && lpcfg_bind_interfaces_only(lp_ctx)) {
+                int num_interfaces;
+                int i;
+                struct interface *ifaces;
+
+                load_interfaces(dce_ctx, lpcfg_interfaces(lp_ctx), &ifaces);
+
+                num_interfaces = iface_count(ifaces);
+                for(i = 0; i < num_interfaces; i++) {
+                        const char *address = iface_n_ip(ifaces, i);
+                        status = add_socket_rpc_tcp_iface(dce_ctx, e, event_ctx, model_ops, address);
+                        NT_STATUS_NOT_OK_RETURN(status);
+                }
+        } else {
+                status = add_socket_rpc_tcp_iface(dce_ctx, e, event_ctx, model_ops, 
+                                                  lpcfg_socket_address(lp_ctx));
+                NT_STATUS_NOT_OK_RETURN(status);
+        }
+
+        return NT_STATUS_OK;
+}
+
+NTSTATUS dcesrv_add_ep(struct dcesrv_context *dce_ctx,
+                       struct loadparm_context *lp_ctx,
+                       struct dcesrv_endpoint *e,
+                       struct tevent_context *event_ctx,
+                       const struct model_ops *model_ops)
+{
+        switch (e->ep_description->transport) {
+        case NCACN_UNIX_STREAM:
+                return dcesrv_add_ep_unix(dce_ctx, lp_ctx, e, event_ctx, model_ops);
+
+        case NCALRPC:
+                return dcesrv_add_ep_ncalrpc(dce_ctx, lp_ctx, e, event_ctx, model_ops);
+
+        case NCACN_IP_TCP:
+                return dcesrv_add_ep_tcp(dce_ctx, lp_ctx, e, event_ctx, model_ops);
+
+        case NCACN_NP:
+                return dcesrv_add_ep_np(dce_ctx, lp_ctx, e, event_ctx, model_ops);
+
+        default:
+                return NT_STATUS_NOT_SUPPORTED;
+        }
+}
+
+
+/**
+ * retrieve credentials from a dce_call
+ */
+_PUBLIC_ struct cli_credentials *dcesrv_call_credentials(struct dcesrv_call_state *dce_call)
+{
+        return dce_call->conn->auth_state.session_info->credentials;
+}
+
+/**
+ * returns true if this is an authenticated call
+ */
+_PUBLIC_ bool dcesrv_call_authenticated(struct dcesrv_call_state *dce_call)
+{
+        enum security_user_level level;
+        level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
+        return level >= SECURITY_USER;
+}
+
+/**
+ * retrieve account_name for a dce_call
+ */
+_PUBLIC_ const char *dcesrv_call_account_name(struct dcesrv_call_state *dce_call)
+{
+        return dce_call->context->conn->auth_state.session_info->info->account_name;
+}

trunk/server/source4/rpc_server/dcerpc_server.h

@@ -24 +24 @@
 #define SAMBA_DCERPC_SERVER_H
 
-#include "librpc/gen_ndr/server_id.h"
+#include "librpc/gen_ndr/server_id4.h"
 #include "librpc/rpc/dcerpc.h"
 #include "librpc/ndr/libndr.h"
@@ -45 +45 @@
 
         /* this function is called when the client binds to this interface  */
-        NTSTATUS (*bind)(struct dcesrv_call_state *, const struct dcesrv_interface *);
+        NTSTATUS (*bind)(struct dcesrv_call_state *, const struct dcesrv_interface *, uint32_t if_version);
 
         /* this function is called when the client disconnects the endpoint */
@@ -219 +219 @@
                 void *private_data;
                 void (*report_output_data)(struct dcesrv_connection *);
-                struct socket_address *(*get_my_addr)(struct dcesrv_connection *, TALLOC_CTX *mem_ctx);
-                struct socket_address *(*get_peer_addr)(struct dcesrv_connection *, TALLOC_CTX *mem_ctx);
         } transport;
 
         struct tstream_context *stream;
         struct tevent_queue *send_queue;
+
+        const struct tsocket_address *local_address;
+        const struct tsocket_address *remote_address;
 };
 
@@ -261 +262 @@
         /* parent context */
         struct dcesrv_context *dce_ctx;
+
+        /* Remote association group ID (if proxied) */
+        uint32_t proxied_id;
 };
 
@@ -332 +336 @@
 
 struct socket_address *dcesrv_connection_get_peer_addr(struct dcesrv_connection *conn, TALLOC_CTX *mem_ctx);
+const struct tsocket_address *dcesrv_connection_get_local_address(struct dcesrv_connection *conn);
+const struct tsocket_address *dcesrv_connection_get_remote_address(struct dcesrv_connection *conn);
 
 NTSTATUS dcesrv_fetch_session_key(struct dcesrv_connection *p, DATA_BLOB *session_key);
@@ -372 +378 @@
 #define DCESRV_PULL_HANDLE_WERR(h, inhandle, t) DCESRV_PULL_HANDLE_RETVAL(h, inhandle, t, WERR_BADFID)
 
+NTSTATUS dcesrv_add_ep(struct dcesrv_context *dce_ctx,
+                       struct loadparm_context *lp_ctx,
+                       struct dcesrv_endpoint *e,
+                       struct tevent_context *event_ctx,
+                       const struct model_ops *model_ops);
+
+/**
+ * retrieve credentials from a dce_call
+ */
+_PUBLIC_ struct cli_credentials *dcesrv_call_credentials(struct dcesrv_call_state *dce_call);
+
+/**
+ * returns true if this is an authenticated call
+ */
+_PUBLIC_ bool dcesrv_call_authenticated(struct dcesrv_call_state *dce_call);
+
+/**
+ * retrieve account_name for a dce_call
+ */
+_PUBLIC_ const char *dcesrv_call_account_name(struct dcesrv_call_state *dce_call);
 
 

trunk/server/source4/rpc_server/dcesrv_auth.c

@@ -24 +24 @@
 #include "rpc_server/dcerpc_server.h"
 #include "rpc_server/dcerpc_server_proto.h"
+#include "rpc_server/common/proto.h"
 #include "librpc/rpc/dcerpc_proto.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
@@ -30 +31 @@
 #include "auth/auth.h"
 #include "param/param.h"
+#include "librpc/rpc/rpc_common.h"
 
 /*
@@ -43 +45 @@
         struct dcesrv_auth *auth = &dce_conn->auth_state;
         NTSTATUS status;
-        enum ndr_err_code ndr_err;
+        uint32_t auth_length;
 
         if (pkt->u.bind.auth_info.length == 0) {
@@ -55 +57 @@
         }
 
-        ndr_err = ndr_pull_struct_blob(&pkt->u.bind.auth_info,
-                                       call, NULL,
-                                       dce_conn->auth_state.auth_info,
-                                       (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                return false;
-        }
-
+        status = dcerpc_pull_auth_trailer(pkt, call, &pkt->u.bind.auth_info,
+                                          dce_conn->auth_state.auth_info,
+                                          &auth_length, false);
         server_credentials 
                 = cli_credentials_init(call);
@@ -80 +77 @@
         status = samba_server_gensec_start(dce_conn, call->event_ctx, 
                                            call->msg_ctx,
-                                           call->conn->dce_ctx->lp_ctx, 
+                                           call->conn->dce_ctx->lp_ctx,
                                            server_credentials,
                                            NULL,
@@ -89 +86 @@
 
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("Failed to start GENSEC mechanism for DCERPC server: auth_type=%d, auth_level=%d: %s\n", 
+                DEBUG(3, ("Failed to start GENSEC mechanism for DCERPC server: auth_type=%d, auth_level=%d: %s\n",
                           (int)auth->auth_info->auth_type,
                           (int)auth->auth_info->auth_level,
@@ -142 +139 @@
                 return NT_STATUS_OK;
         } else {
-                DEBUG(2, ("Failed to start dcesrv auth negotiate: %s\n", nt_errstr(status)));
+                DEBUG(4, ("GENSEC mech rejected the incoming authentication at bind_ack: %s\n",
+                          nt_errstr(status)));
                 return status;
         }
@@ -156 +154 @@
         struct dcesrv_connection *dce_conn = call->conn;
         NTSTATUS status;
-        enum ndr_err_code ndr_err;
+        uint32_t auth_length;
 
         /* We can't work without an existing gensec state, and an new blob to feed it */
@@ -165 +163 @@
         }
 
-        ndr_err = ndr_pull_struct_blob(&pkt->u.auth3.auth_info,
-                                       call, NULL,
-                                       dce_conn->auth_state.auth_info,
-                                       (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+        status = dcerpc_pull_auth_trailer(pkt, call, &pkt->u.auth3.auth_info,
+                                          dce_conn->auth_state.auth_info, &auth_length, true);
+        if (!NT_STATUS_IS_OK(status)) {
                 return false;
         }
@@ -189 +185 @@
                 return true;
         } else {
-                DEBUG(4, ("dcesrv_auth_auth3: failed to authenticate: %s\n", 
+                DEBUG(4, ("GENSEC mech rejected the incoming authentication at bind_auth3: %s\n",
                           nt_errstr(status)));
                 return false;
         }
-
-        return true;
 }
 
@@ -206 +200 @@
         struct ncacn_packet *pkt = &call->pkt;
         struct dcesrv_connection *dce_conn = call->conn;
-        enum ndr_err_code ndr_err;
+        NTSTATUS status;
+        uint32_t auth_length;
 
         /* on a pure interface change there is no auth blob */
@@ -223 +218 @@
         }
 
-        ndr_err = ndr_pull_struct_blob(&pkt->u.alter.auth_info,
-                                       call, NULL,
-                                       dce_conn->auth_state.auth_info,
-                                       (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+        status = dcerpc_pull_auth_trailer(pkt, call, &pkt->u.alter.auth_info,
+                                          dce_conn->auth_state.auth_info,
+                                          &auth_length, true);
+        if (!NT_STATUS_IS_OK(status)) {
                 return false;
         }
@@ -276 +270 @@
         }
 
-        DEBUG(2, ("Failed to finish dcesrv auth alter_ack: %s\n", nt_errstr(status)));
+        DEBUG(4, ("GENSEC mech rejected the incoming authentication at auth alter_ack: %s\n",
+                  nt_errstr(status)));
         return status;
 }
@@ -287 +282 @@
         struct ncacn_packet *pkt = &call->pkt;
         struct dcesrv_connection *dce_conn = call->conn;
-        DATA_BLOB auth_blob;
         struct dcerpc_auth auth;
-        struct ndr_pull *ndr;
-        NTSTATUS status;
-        enum ndr_err_code ndr_err;
+        NTSTATUS status;
+        uint32_t auth_length;
         size_t hdr_size = DCERPC_REQUEST_LENGTH;
 
@@ -297 +290 @@
             !dce_conn->auth_state.gensec_security) {
                 return true;
+        }
+
+        if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
+                hdr_size += 16;
         }
 
@@ -319 +316 @@
         }
 
-        auth_blob.length = 8 + pkt->auth_length;
-
-        /* check for a valid length */
-        if (pkt->u.request.stub_and_verifier.length < auth_blob.length) {
-                return false;
-        }
-
-        auth_blob.data = 
-                pkt->u.request.stub_and_verifier.data + 
-                pkt->u.request.stub_and_verifier.length - auth_blob.length;
-        pkt->u.request.stub_and_verifier.length -= auth_blob.length;
-
-        /* pull the auth structure */
-        ndr = ndr_pull_init_blob(&auth_blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx));
-        if (!ndr) {
-                return false;
-        }
-
-        if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
-                ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
-        }
-
-        if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
-                ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
-                hdr_size += 16;
-        }
-
-        ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                talloc_free(ndr);
-                return false;
-        }
+        status = dcerpc_pull_auth_trailer(pkt, call,
+                                          &pkt->u.request.stub_and_verifier,
+                                          &auth, &auth_length, false);
+        if (!NT_STATUS_IS_OK(status)) {
+                return false;
+        }
+
+        pkt->u.request.stub_and_verifier.length -= auth_length;
 
         /* check signature or unseal the packet */
@@ -389 +362 @@
         /* remove the indicated amount of padding */
         if (pkt->u.request.stub_and_verifier.length < auth.auth_pad_length) {
-                talloc_free(ndr);
                 return false;
         }
         pkt->u.request.stub_and_verifier.length -= auth.auth_pad_length;
-        talloc_free(ndr);
 
         return NT_STATUS_IS_OK(status);
@@ -415 +386 @@
         /* non-signed packets are simple */
         if (sig_size == 0) {
-                status = ncacn_push_auth(blob, call, lp_iconv_convenience(dce_conn->dce_ctx->lp_ctx), pkt, NULL);
+                status = ncacn_push_auth(blob, call, pkt, NULL);
                 return NT_STATUS_IS_OK(status);
         }
@@ -426 +397 @@
         case DCERPC_AUTH_LEVEL_CONNECT:
                 /*
-                 * TODO: let the gensec mech decide if it wants to generate a signature
-                 *       that might be needed for schannel...
+                 * TODO: let the gensec mech decide if it wants to generate a
+                 *       signature that might be needed for schannel...
                  */
-                status = ncacn_push_auth(blob, call, lp_iconv_convenience(dce_conn->dce_ctx->lp_ctx), pkt, NULL);
+                status = ncacn_push_auth(blob, call, pkt, NULL);
                 return NT_STATUS_IS_OK(status);
 
         case DCERPC_AUTH_LEVEL_NONE:
-                status = ncacn_push_auth(blob, call, lp_iconv_convenience(dce_conn->dce_ctx->lp_ctx), pkt, NULL);
+                status = ncacn_push_auth(blob, call, pkt, NULL);
                 return NT_STATUS_IS_OK(status);
 
@@ -440 +411 @@
         }
 
-        ndr = ndr_push_init_ctx(call, lp_iconv_convenience(dce_conn->dce_ctx->lp_ctx));
+        ndr = ndr_push_init_ctx(call);
         if (!ndr) {
                 return false;
@@ -454 +425 @@
         }
 
-        /* pad to 16 byte multiple, match win2k3 */
+        /* pad to 16 byte multiple in the payload portion of the
+           packet. This matches what w2k3 does. Note that we can't use
+           ndr_push_align() as that is relative to the start of the
+           whole packet, whereas w2k8 wants it relative to the start
+           of the stub */
         dce_conn->auth_state.auth_info->auth_pad_length =
                 (16 - (pkt->u.response.stub_and_verifier.length & 15)) & 15;
-        ndr_err = ndr_push_zero(ndr, dce_conn->auth_state.auth_info->auth_pad_length);
+        ndr_err = ndr_push_zero(ndr,
+                                dce_conn->auth_state.auth_info->auth_pad_length);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 return false;
@@ -470 +446 @@
         /* add the auth verifier */
         ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS,
-                                      dce_conn->auth_state.auth_info);
+                                       dce_conn->auth_state.auth_info);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 return false;
@@ -514 +490 @@
         }
 
-        if (NT_STATUS_IS_OK(status)) {
-                if (creds2.length != sig_size) {
-                        DEBUG(0,("dcesrv_auth_response: creds2.length[%u] != sig_size[%u] pad[%u] stub[%u]\n",
-                                 (unsigned)creds2.length, (uint32_t)sig_size,
-                                 (unsigned)dce_conn->auth_state.auth_info->auth_pad_length,
-                                 (unsigned)pkt->u.response.stub_and_verifier.length));
-                        data_blob_free(&creds2);
-                        status = NT_STATUS_INTERNAL_ERROR;
-                }
-        }
-
-        if (NT_STATUS_IS_OK(status)) {
-                if (!data_blob_append(call, blob, creds2.data, creds2.length)) {
-                        status = NT_STATUS_NO_MEMORY;
-                }
-                data_blob_free(&creds2);
-        }
-
         if (!NT_STATUS_IS_OK(status)) {
                 return false;
         }       
 
+        if (creds2.length != sig_size) {
+                DEBUG(3,("dcesrv_auth_response: creds2.length[%u] != sig_size[%u] pad[%u] stub[%u]\n",
+                         (unsigned)creds2.length, (uint32_t)sig_size,
+                         (unsigned)dce_conn->auth_state.auth_info->auth_pad_length,
+                         (unsigned)pkt->u.response.stub_and_verifier.length));
+                dcerpc_set_frag_length(blob, blob->length + creds2.length);
+                dcerpc_set_auth_length(blob, creds2.length);
+        }
+
+        if (!data_blob_append(call, blob, creds2.data, creds2.length)) {
+                status = NT_STATUS_NO_MEMORY;
+                return false;
+        }
+        data_blob_free(&creds2);
+
         return true;
 }

trunk/server/source4/rpc_server/drsuapi/addentry.c

@@ -23 +23 @@
 #include "includes.h"
 #include "rpc_server/dcerpc_server.h"
-#include "rpc_server/common/common.h"
 #include "dsdb/samdb/samdb.h"
-#include "lib/ldb/include/ldb_errors.h"
+#include "dsdb/common/util.h"
 #include "param/param.h"
-#include "librpc/gen_ndr/ndr_drsblobs.h"
-#include "auth/auth.h"
+#include "libcli/security/security.h"
+#include "libcli/security/session.h"
 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
-#include "libcli/security/security.h"
-#include "librpc/gen_ndr/ndr_drsblobs.h"
 #include "librpc/gen_ndr/ndr_drsuapi.h"
-
 
 /*
@@ -50 +46 @@
                 const char *dn_string = obj->object.identifier->dn;
                 struct ldb_dn *dn = ldb_dn_new(mem_ctx, b_state->sam_ctx, dn_string);
-                struct ldb_result *res;
+                struct ldb_result *res, *res2;
                 struct ldb_dn *ref_dn;
                 struct GUID ntds_guid;
@@ -57 +53 @@
                 const char *ntds_guid_str;
                 const char *dom_string;
+                const char *attrs2[] = { "dNSHostName", "cn", NULL };
+                const char *dNSHostName, *cn;
 
                 DEBUG(6,(__location__ ": Adding SPNs for %s\n", 
@@ -83 +81 @@
                 ntds_guid_str = GUID_string(res, &ntds_guid);
 
-                dom_string = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
+                dom_string = lpcfg_dnsdomain(dce_call->conn->dce_ctx->lp_ctx);
+
+                /* get the dNSHostName and cn */
+                ret = ldb_search(b_state->sam_ctx, mem_ctx, &res2,
+                                 ref_dn, LDB_SCOPE_BASE, attrs2, NULL);
+                if (ret != LDB_SUCCESS) {
+                        DEBUG(0,(__location__ ": Failed to find ref_dn '%s'\n",
+                                 ldb_dn_get_linearized(ref_dn)));
+                        return WERR_DS_DRA_INTERNAL_ERROR;
+                }
+
+                dNSHostName = ldb_msg_find_attr_as_string(res2->msgs[0], "dNSHostName", NULL);
+                cn = ldb_msg_find_attr_as_string(res2->msgs[0], "cn", NULL);
 
                 /*
@@ -101 +111 @@
                 }
 
-                el->num_values = 2;
-                el->values = talloc_array(msg->elements, struct ldb_val, 2);
-                if (el->values == NULL) {
+
+                ldb_msg_add_steal_string(msg, "servicePrincipalName",
+                                         talloc_asprintf(el->values,
+                                                         "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s",
+                                                         ntds_guid_str, dom_string));
+                ldb_msg_add_steal_string(msg, "servicePrincipalName",
+                                         talloc_asprintf(el->values, "ldap/%s._msdcs.%s",
+                                                         ntds_guid_str, dom_string));
+                if (cn) {
+                        ldb_msg_add_steal_string(msg, "servicePrincipalName",
+                                                 talloc_asprintf(el->values, "ldap/%s", cn));
+                }
+                if (dNSHostName) {
+                        ldb_msg_add_steal_string(msg, "servicePrincipalName",
+                                                 talloc_asprintf(el->values, "ldap/%s", dNSHostName));
+                }
+                if (el->num_values < 2) {
                         return WERR_NOMEM;
                 }
-                /* the magic constant is the GUID of the DRSUAPI RPC
-                   interface */
-                el->values[0].data = (uint8_t *)talloc_asprintf(el->values, 
-                                                                "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s", 
-                                                                ntds_guid_str, dom_string);
-                el->values[0].length = strlen((char *)el->values[0].data);
-                el->values[1].data = (uint8_t *)talloc_asprintf(el->values, "ldap/%s._msdcs.%s", 
-                                                                ntds_guid_str, dom_string);
-                el->values[1].length = strlen((char *)el->values[1].data);
-
-                ret = ldb_modify(b_state->sam_ctx, msg);
+
+                ret = dsdb_modify(b_state->sam_ctx, msg, DSDB_MODIFY_PERMISSIVE);
                 if (ret != LDB_SUCCESS) {
                         DEBUG(0,(__location__ ": Failed to add SPNs - %s\n",
@@ -152 +167 @@
         ZERO_STRUCTP(r->out.ctr);
         *r->out.level_out = 3;
-        r->out.ctr->ctr3.level = 1;
-        r->out.ctr->ctr3.error = talloc_zero(mem_ctx, union drsuapi_DsAddEntryError);
+        r->out.ctr->ctr3.err_ver = 1;
+        r->out.ctr->ctr3.err_data = talloc_zero(mem_ctx, union drsuapi_DsAddEntry_ErrData);
 
         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
         b_state = h->data;
 
-        status = drs_security_level_check(dce_call, "DsAddEntry");
+        status = drs_security_level_check(dce_call, "DsAddEntry", SECURITY_DOMAIN_CONTROLLER, NULL);
         if (!W_ERROR_IS_OK(status)) {
                 return status;
@@ -179 +194 @@
                                                     &ids);
                 if (!W_ERROR_IS_OK(status)) {
-                        r->out.ctr->ctr3.error->info1.status = status;
+                        r->out.ctr->ctr3.err_data->v1.status = status;
                         ldb_transaction_cancel(b_state->sam_ctx);
+                        DEBUG(0,(__location__ ": DsAddEntry failed - %s\n", win_errstr(status)));
                         return status;
                 }
@@ -197 +213 @@
         status = drsuapi_add_SPNs(b_state, dce_call, mem_ctx, first_object);
         if (!W_ERROR_IS_OK(status)) {
-                r->out.ctr->ctr3.error->info1.status = status;
+                r->out.ctr->ctr3.err_data->v1.status = status;
                 ldb_transaction_cancel(b_state->sam_ctx);
+                DEBUG(0,(__location__ ": DsAddEntry add SPNs failed - %s\n", win_errstr(status)));
                 return status;
         }
@@ -204 +221 @@
         ret = ldb_transaction_commit(b_state->sam_ctx);
         if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": DsAddEntry commit failed: %s\n",
+                         ldb_errstring(b_state->sam_ctx)));
                 return WERR_DS_DRA_INTERNAL_ERROR;
         }

trunk/server/source4/rpc_server/drsuapi/dcesrv_drsuapi.c

@@ -26 +26 @@
 #include "rpc_server/common/common.h"
 #include "dsdb/samdb/samdb.h"
+#include "libcli/security/security.h"
+#include "libcli/security/session.h"
 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
-#include "libcli/security/security.h"
+#include "auth/auth.h"
+#include "param/param.h"
+#include "lib/messaging/irpc.h"
+
+#define DRSUAPI_UNSUPPORTED(fname) do { \
+        DEBUG(1,(__location__ ": Unsupported DRS call %s\n", #fname)); \
+        if (DEBUGLVL(2)) NDR_PRINT_IN_DEBUG(fname, r); \
+        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); \
+} while (0)
 
 /* 
@@ -48 +58 @@
         uint32_t repl_epoch;
         int ret;
+        struct auth_session_info *auth_info;
+        WERROR werr;
+        bool connected_as_system = false;
 
         r->out.bind_info = NULL;
@@ -55 +68 @@
         W_ERROR_HAVE_NO_MEMORY(b_state);
 
+        /* if this is a DC connecting, give them system level access */
+        werr = drs_security_level_check(dce_call, NULL, SECURITY_DOMAIN_CONTROLLER, NULL);
+        if (W_ERROR_IS_OK(werr)) {
+                DEBUG(3,(__location__ ": doing DsBind with system_session\n"));
+                auth_info = system_session(dce_call->conn->dce_ctx->lp_ctx);
+                connected_as_system = true;
+        } else {
+                auth_info = dce_call->conn->auth_state.session_info;
+        }
+
         /*
          * connect to the samdb
          */
-        b_state->sam_ctx = samdb_connect(b_state, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info); 
+        b_state->sam_ctx = samdb_connect(b_state, dce_call->event_ctx, 
+                                         dce_call->conn->dce_ctx->lp_ctx, auth_info, 0);
         if (!b_state->sam_ctx) {
                 return WERR_FOOBAR;
+        }
+
+        if (connected_as_system) {
+                b_state->sam_ctx_system = b_state->sam_ctx;
+        } else {
+                /* an RODC also needs system samdb access for secret
+                   attribute replication */
+                werr = drs_security_level_check(dce_call, NULL, SECURITY_RO_DOMAIN_CONTROLLER,
+                                                samdb_domain_sid(b_state->sam_ctx));
+                if (W_ERROR_IS_OK(werr)) {
+                        b_state->sam_ctx_system = samdb_connect(b_state, dce_call->event_ctx,
+                                                                dce_call->conn->dce_ctx->lp_ctx,
+                                                                system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
+                        if (!b_state->sam_ctx_system) {
+                                return WERR_FOOBAR;
+                        }
+                }
         }
 
@@ -95 +136 @@
                 return WERR_DS_DRA_INTERNAL_ERROR;
         }
-        repl_epoch = samdb_result_uint(ntds_res->msgs[0], "ms-DS-ReplicationEpoch", 0);
+        repl_epoch = ldb_msg_find_attr_as_uint(ntds_res->msgs[0],
+                                               "ms-DS-ReplicationEpoch", 0);
 
         /*
@@ -147 +189 @@
         b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
         b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
-        if (0 /*domain.behavior_version == 2*/) {
-                /* TODO: find out how this is really triggered! */
-                b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
-        }
+        b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
         b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
         b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
@@ -160 +199 @@
         b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
         b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
-        b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_00100000;
+        b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V5;
         b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
         b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
@@ -173 +212 @@
         b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
 #endif
+        b_state->local_info28.supported_extensions      |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V10;
         b_state->local_info28.site_guid                 = site_guid;
         b_state->local_info28.pid                       = pid;
@@ -230 +270 @@
 {
         WERROR status;
-
-        status = drs_security_level_check(dce_call, "DsReplicaSync");
+        uint32_t timeout;
+
+        status = drs_security_level_check(dce_call, "DsReplicaSync", SECURITY_DOMAIN_CONTROLLER, NULL);
         if (!W_ERROR_IS_OK(status)) {
                 return status;
         }
 
-        dcesrv_irpc_forward_rpc_call(dce_call, mem_ctx, r, NDR_DRSUAPI_DSREPLICASYNC,
+        if (r->in.level != 1) {
+                DEBUG(0,("DsReplicaSync called with unsupported level %d\n", r->in.level));
+                return WERR_DS_DRA_INVALID_PARAMETER;
+        }
+
+        if (r->in.req->req1.options & DRSUAPI_DRS_ASYNC_OP) {
+                timeout = IRPC_CALL_TIMEOUT;
+        } else {
+                /*
+                 * use Infinite time for timeout in case
+                 * the caller made a sync call
+                 */
+                timeout = IRPC_CALL_TIMEOUT_INF;
+        }
+
+        dcesrv_irpc_forward_rpc_call(dce_call, mem_ctx,
+                                     r, NDR_DRSUAPI_DSREPLICASYNC,
                                      &ndr_table_drsuapi,
-                                     "dreplsrv", "DsReplicaSync");
+                                     "dreplsrv", "DsReplicaSync",
+                                     timeout);
 
         return WERR_OK;
@@ -250 +308 @@
                                           struct drsuapi_DsReplicaAdd *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        WERROR status;
+
+        status = drs_security_level_check(dce_call, "DsReplicaAdd", SECURITY_DOMAIN_CONTROLLER, NULL);
+        if (!W_ERROR_IS_OK(status)) {
+                return status;
+        }
+
+        dcesrv_irpc_forward_rpc_call(dce_call, mem_ctx,
+                                     r, NDR_DRSUAPI_DSREPLICAADD,
+                                     &ndr_table_drsuapi,
+                                     "dreplsrv", "DsReplicaAdd",
+                                     IRPC_CALL_TIMEOUT);
+
+        return WERR_OK;
 }
 
@@ -260 +331 @@
                                           struct drsuapi_DsReplicaDel *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        WERROR status;
+
+        status = drs_security_level_check(dce_call, "DsReplicaDel", SECURITY_DOMAIN_CONTROLLER, NULL);
+        if (!W_ERROR_IS_OK(status)) {
+                return status;
+        }
+
+        dcesrv_irpc_forward_rpc_call(dce_call, mem_ctx,
+                                     r, NDR_DRSUAPI_DSREPLICADEL,
+                                     &ndr_table_drsuapi,
+                                     "dreplsrv", "DsReplicaDel",
+                                     IRPC_CALL_TIMEOUT);
+
+        return WERR_OK;
 }
 
@@ -270 +354 @@
                                           struct drsuapi_DsReplicaMod *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        WERROR status;
+
+        status = drs_security_level_check(dce_call, "DsReplicaMod", SECURITY_DOMAIN_CONTROLLER, NULL);
+        if (!W_ERROR_IS_OK(status)) {
+                return status;
+        }
+
+        dcesrv_irpc_forward_rpc_call(dce_call, mem_ctx,
+                                     r, NDR_DRSUAPI_DSREPLICAMOD,
+                                     &ndr_table_drsuapi,
+                                     "dreplsrv", "DsReplicaMod",
+                                     IRPC_CALL_TIMEOUT);
+
+        return WERR_OK;
 }
 
@@ -280 +377 @@
                        struct DRSUAPI_VERIFY_NAMES *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        DRSUAPI_UNSUPPORTED(DRSUAPI_VERIFY_NAMES);
 }
 
@@ -290 +387 @@
                        struct drsuapi_DsGetMemberships *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        DRSUAPI_UNSUPPORTED(drsuapi_DsGetMemberships);
 }
 
@@ -300 +397 @@
                        struct DRSUAPI_INTER_DOMAIN_MOVE *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        DRSUAPI_UNSUPPORTED(DRSUAPI_INTER_DOMAIN_MOVE);
 }
 
@@ -310 +407 @@
                        struct drsuapi_DsGetNT4ChangeLog *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
+        DRSUAPI_UNSUPPORTED(drsuapi_DsGetNT4ChangeLog);
+}
 
 /* 
@@ -320 +416 @@
                             struct drsuapi_DsCrackNames *r)
 {
-        WERROR status;
         struct drsuapi_bind_state *b_state;
         struct dcesrv_handle *h;
@@ -334 +429 @@
         switch (r->in.level) {
                 case 1: {
-                        struct drsuapi_DsNameCtr1 *ctr1;
-                        struct drsuapi_DsNameInfo1 *names;
-                        int count;
-                        int i;
-
-                        ctr1 = talloc(mem_ctx, struct drsuapi_DsNameCtr1);
-                        W_ERROR_HAVE_NO_MEMORY(ctr1);
-
-                        count = r->in.req->req1.count;
-                        names = talloc_array(mem_ctx, struct drsuapi_DsNameInfo1, count);
-                        W_ERROR_HAVE_NO_MEMORY(names);
-
-                        for (i=0; i < count; i++) {
-                                status = DsCrackNameOneName(b_state->sam_ctx, mem_ctx,
-                                                            r->in.req->req1.format_flags,
-                                                            r->in.req->req1.format_offered,
-                                                            r->in.req->req1.format_desired,
-                                                            r->in.req->req1.names[i].str,
-                                                            &names[i]);
-                                if (!W_ERROR_IS_OK(status)) {
-                                        return status;
-                                }
-                        }
-
-                        ctr1->count = count;
-                        ctr1->array = names;
-                        r->out.ctr->ctr1 = ctr1;
-
-                        return WERR_OK;
-                }
-        }
-        
-        return WERR_UNKNOWN_LEVEL;
-}
-
-/* 
-  drsuapi_DsWriteAccountSpn 
-*/
-static WERROR dcesrv_drsuapi_DsWriteAccountSpn(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct drsuapi_DsWriteAccountSpn *r)
-{
-        struct drsuapi_bind_state *b_state;
-        struct dcesrv_handle *h;
-
-        *r->out.level_out = r->in.level;
-
-        DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
-        b_state = h->data;
-
-        r->out.res = talloc(mem_ctx, union drsuapi_DsWriteAccountSpnResult);
-        W_ERROR_HAVE_NO_MEMORY(r->out.res);
-
-        switch (r->in.level) {
-                case 1: {
-                        struct drsuapi_DsWriteAccountSpnRequest1 *req;
-                        struct ldb_message *msg;
-                        int count, i, ret;
-                        req = &r->in.req->req1;
-                        count = req->count;
-
-                        msg = ldb_msg_new(mem_ctx);
-                        if (msg == NULL) {
-                                return WERR_NOMEM;
-                        }
-
-                        msg->dn = ldb_dn_new(msg, b_state->sam_ctx, req->object_dn);
-                        if ( ! ldb_dn_validate(msg->dn)) {
-                                r->out.res->res1.status = WERR_OK;
+                        switch(r->in.req->req1.format_offered){
+                        case DRSUAPI_DS_NAME_FORMAT_UPN_AND_ALTSECID:
+                        case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT_NAME_SANS_DOMAIN_EX:
+                        case DRSUAPI_DS_NAME_FORMAT_LIST_GLOBAL_CATALOG_SERVERS:
+                        case DRSUAPI_DS_NAME_FORMAT_UPN_FOR_LOGON:
+                        case DRSUAPI_DS_NAME_FORMAT_LIST_SERVERS_WITH_DCS_IN_SITE:
+                        case DRSUAPI_DS_NAME_FORMAT_STRING_SID_NAME:
+                        case DRSUAPI_DS_NAME_FORMAT_ALT_SECURITY_IDENTITIES_NAME:
+                        case DRSUAPI_DS_NAME_FORMAT_LIST_NCS:
+                        case DRSUAPI_DS_NAME_FORMAT_LIST_DOMAINS:
+                        case DRSUAPI_DS_NAME_FORMAT_MAP_SCHEMA_GUID:
+                        case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT_NAME_SANS_DOMAIN:
+                        case DRSUAPI_DS_NAME_FORMAT_LIST_INFO_FOR_SERVER:
+                        case DRSUAPI_DS_NAME_FORMAT_LIST_SERVERS_FOR_DOMAIN_IN_SITE:
+                        case DRSUAPI_DS_NAME_FORMAT_LIST_DOMAINS_IN_SITE:
+                        case DRSUAPI_DS_NAME_FORMAT_LIST_SERVERS_IN_SITE:
+                        case DRSUAPI_DS_NAME_FORMAT_LIST_SITES:
+                                DEBUG(0, ("DsCrackNames: Unsupported operation requested: %X",
+                                          r->in.req->req1.format_offered));
                                 return WERR_OK;
-                        }
-                        
-                        /* construct mods */
-                        for (i = 0; i < count; i++) {
-                                samdb_msg_add_string(b_state->sam_ctx, 
-                                                     msg, msg, "servicePrincipalName",
-                                                     req->spn_names[i].str);
-                        }
-                        for (i=0;i<msg->num_elements;i++) {
-                                switch (req->operation) {
-                                case DRSUAPI_DS_SPN_OPERATION_ADD:
-                                        msg->elements[i].flags = LDB_FLAG_MOD_ADD;
-                                        break;
-                                case DRSUAPI_DS_SPN_OPERATION_REPLACE:
-                                        msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
-                                        break;
-                                case DRSUAPI_DS_SPN_OPERATION_DELETE:
-                                        msg->elements[i].flags = LDB_FLAG_MOD_DELETE;
-                                        break;
-                                }
-                        }
-   
-                        /* Apply to database */
-
-                        ret = ldb_modify(b_state->sam_ctx, msg);
-                        if (ret != 0) {
-                                DEBUG(0,("Failed to modify SPNs on %s: %s\n",
-                                         ldb_dn_get_linearized(msg->dn), 
-                                         ldb_errstring(b_state->sam_ctx)));
-                                r->out.res->res1.status = WERR_ACCESS_DENIED;
-                        } else {
-                                r->out.res->res1.status = WERR_OK;
-                        }
-
-                        return WERR_OK;
-                }
-        }
-        
+                        case DRSUAPI_DS_NAME_FORMAT_LIST_ROLES:
+                                return dcesrv_drsuapi_ListRoles(b_state->sam_ctx, mem_ctx,
+                                                                &r->in.req->req1, &r->out.ctr->ctr1);
+                        default:/* format_offered is in the enum drsuapi_DsNameFormat*/
+                                return dcesrv_drsuapi_CrackNamesByNameFormat(b_state->sam_ctx, mem_ctx,
+                                                                             &r->in.req->req1, &r->out.ctr->ctr1);
+                        }
+                }
+        }
         return WERR_UNKNOWN_LEVEL;
 }
@@ -458 +475 @@
         WERROR status;
 
-        ZERO_STRUCT(r->out.res);
         *r->out.level_out = 1;
 
-        status = drs_security_level_check(dce_call, "DsRemoveDSServer");
+        status = drs_security_level_check(dce_call, "DsRemoveDSServer", SECURITY_DOMAIN_CONTROLLER, NULL);
         if (!W_ERROR_IS_OK(status)) {
                 return status;
@@ -508 +524 @@
                        struct DRSUAPI_REMOVE_DS_DOMAIN *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        DRSUAPI_UNSUPPORTED(DRSUAPI_REMOVE_DS_DOMAIN);
 }
 
 /* Obtain the site name from a server DN */
-static const char *result_site_name(struct ldb_dn *site_dn)
+static const char *result_site_name(struct ldb_dn *server_dn)
 {
         /* Format is cn=<NETBIOS name>,cn=Servers,cn=<site>,cn=sites.... */
-        const struct ldb_val *val = ldb_dn_get_component_val(site_dn, 2);
-        const char *name = ldb_dn_get_component_name(site_dn, 2);
+        const struct ldb_val *val = ldb_dn_get_component_val(server_dn, 2);
+        const char *name = ldb_dn_get_component_name(server_dn, 2);
 
         if (!name || (ldb_attr_cmp(name, "cn") != 0)) {
@@ -556 +572 @@
         struct drsuapi_DsGetDCInfoCtr2 *ctr2;
 
-        int ret, i;
+        int ret;
+        unsigned int i;
 
         *r->out.level_out = r->in.req->req1.level;
@@ -686 +703 @@
                         if (ret == LDB_SUCCESS && res_ntds->count == 1) {
                                 ctr2->array[i].is_gc
-                                        = (ldb_msg_find_attr_as_int(res_ntds->msgs[0], "options", 0) == 1);
+                                        = (ldb_msg_find_attr_as_uint(res_ntds->msgs[0], "options", 0) & DS_NTDSDSA_OPT_IS_GC);
                                 ctr2->array[i].ntds_guid 
                                         = samdb_result_guid(res_ntds->msgs[0], "objectGUID");
@@ -784 +801 @@
                                   struct drsuapi_DsExecuteKCC *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        WERROR status;
+        status = drs_security_level_check(dce_call, "DsExecuteKCC", SECURITY_DOMAIN_CONTROLLER, NULL);
+
+        if (!W_ERROR_IS_OK(status)) {
+                return status;
+        }
+
+        dcesrv_irpc_forward_rpc_call(dce_call, mem_ctx, r, NDR_DRSUAPI_DSEXECUTEKCC,
+                                     &ndr_table_drsuapi, "kccsrv", "DsExecuteKCC",
+                                     IRPC_CALL_TIMEOUT);
+        return WERR_OK;
 }
 
@@ -794 +821 @@
                        struct drsuapi_DsReplicaGetInfo *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        enum security_user_level level;
+
+        if (!lpcfg_parm_bool(dce_call->conn->dce_ctx->lp_ctx, NULL,
+                         "drs", "disable_sec_check", false)) {
+                level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
+                if (level < SECURITY_DOMAIN_CONTROLLER) {
+                        DEBUG(1,(__location__ ": Administrator access required for DsReplicaGetInfo\n"));
+                        security_token_debug(0, 2, dce_call->conn->auth_state.session_info->security_token);
+                        return WERR_DS_DRA_ACCESS_DENIED;
+                }
+        }
+
+        dcesrv_irpc_forward_rpc_call(dce_call, mem_ctx, r, NDR_DRSUAPI_DSREPLICAGETINFO,
+                                     &ndr_table_drsuapi, "kccsrv", "DsReplicaGetInfo",
+                                     IRPC_CALL_TIMEOUT);
+
+        return WERR_OK;
 }
 
@@ -804 +847 @@
                        struct DRSUAPI_ADD_SID_HISTORY *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        DRSUAPI_UNSUPPORTED(DRSUAPI_ADD_SID_HISTORY);
 }
 
@@ -813 +856 @@
                        struct drsuapi_DsGetMemberships2 *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        DRSUAPI_UNSUPPORTED(drsuapi_DsGetMemberships2);
 }
 
@@ -822 +865 @@
                        struct DRSUAPI_REPLICA_VERIFY_OBJECTS *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        DRSUAPI_UNSUPPORTED(DRSUAPI_REPLICA_VERIFY_OBJECTS);
 }
 
@@ -832 +875 @@
                        struct DRSUAPI_GET_OBJECT_EXISTENCE *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        DRSUAPI_UNSUPPORTED(DRSUAPI_GET_OBJECT_EXISTENCE);
 }
 
@@ -842 +885 @@
                        struct drsuapi_QuerySitesByCost *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        DRSUAPI_UNSUPPORTED(drsuapi_QuerySitesByCost);
 }
 

trunk/server/source4/rpc_server/drsuapi/dcesrv_drsuapi.h

@@ -32 +32 @@
 struct drsuapi_bind_state {
         struct ldb_context *sam_ctx;
+        struct ldb_context *sam_ctx_system;
         struct GUID remote_bind_guid;
         struct drsuapi_DsBindInfo28 remote_info28;
@@ -40 +41 @@
 
 /* prototypes of internal functions */
+WERROR drsuapi_UpdateRefs(struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
+                          struct drsuapi_DsReplicaUpdateRefsRequest1 *req);
 WERROR dcesrv_drsuapi_DsReplicaUpdateRefs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                                           struct drsuapi_DsReplicaUpdateRefs *r);
@@ -46 +49 @@
 WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                                  struct drsuapi_DsAddEntry *r);
+WERROR dcesrv_drsuapi_DsWriteAccountSpn(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                                        struct drsuapi_DsWriteAccountSpn *r);
 
 char *drs_ObjectIdentifier_to_string(TALLOC_CTX *mem_ctx,
@@ -56 +61 @@
                                     enum ldb_scope scope,
                                     const char * const *attrs,
-                                    const char *sort_attrib,
                                     const char *filter);
 
 WERROR drs_security_level_check(struct dcesrv_call_state *dce_call,
-                                const char* call);
+                                const char* call, enum security_user_level minimum_level,
+                                const struct dom_sid *domain_sid);
 
 void drsuapi_process_secret_attribute(struct drsuapi_DsReplicaAttribute *attr,
                                       struct drsuapi_DsReplicaMetaData *meta_data);
+
+WERROR drs_security_access_check(struct ldb_context *sam_ctx,
+                                 TALLOC_CTX *mem_ctx,
+                                 struct security_token *token,
+                                 struct drsuapi_DsReplicaObjectIdentifier *nc,
+                                 const char *ext_right);
+
+WERROR drs_security_access_check_nc_root(struct ldb_context *sam_ctx,
+                                         TALLOC_CTX *mem_ctx,
+                                         struct security_token *token,
+                                         struct drsuapi_DsReplicaObjectIdentifier *nc,
+                                         const char *ext_right);

trunk/server/source4/rpc_server/drsuapi/drsutil.c

@@ -23 +23 @@
 #include "rpc_server/dcerpc_server.h"
 #include "dsdb/samdb/samdb.h"
-#include "libcli/security/dom_sid.h"
-#include "rpc_server/drsuapi/dcesrv_drsuapi.h"
 #include "libcli/security/security.h"
+#include "libcli/security/session.h"
 #include "param/param.h"
-
-/*
-  format a drsuapi_DsReplicaObjectIdentifier naming context as a string
- */
-char *drs_ObjectIdentifier_to_string(TALLOC_CTX *mem_ctx,
-                                     struct drsuapi_DsReplicaObjectIdentifier *nc)
-{
-        char *guid, *sid, *ret;
-        guid = GUID_string(mem_ctx, &nc->guid);
-        sid  = dom_sid_string(mem_ctx, &nc->sid);
-        ret = talloc_asprintf(mem_ctx, "<GUID=%s>;<SID=%s>;%s",
-                              guid, sid, nc->dn);
-        talloc_free(guid);
-        talloc_free(sid);
-        return ret;
-}
+#include "auth/session.h"
 
 int drsuapi_search_with_extended_dn(struct ldb_context *ldb,
@@ -50 +34 @@
                                     enum ldb_scope scope,
                                     const char * const *attrs,
-                                    const char *sort_attrib,
                                     const char *filter)
 {
@@ -84 +67 @@
         }
 
-        ret = ldb_request_add_control(req, LDB_CONTROL_SHOW_DELETED_OID, true, NULL);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-
-        if (sort_attrib) {
-                struct ldb_server_sort_control **sort_control;
-                sort_control = talloc_array(req, struct ldb_server_sort_control *, 2);
-                if (sort_control == NULL) {
-                        talloc_free(tmp_ctx);
-                        return LDB_ERR_OPERATIONS_ERROR;
-                }
-                sort_control[0] = talloc(req, struct ldb_server_sort_control);
-                sort_control[0]->attributeName = sort_attrib;
-                sort_control[0]->orderingRule = NULL;
-                sort_control[0]->reverse = 1;
-                sort_control[1] = NULL;
-
-                ret = ldb_request_add_control(req, LDB_CONTROL_SERVER_SORT_OID, true, sort_control);
-                if (ret != LDB_SUCCESS) {
-                        return ret;
-                }
-        }
-
+        ret = ldb_request_add_control(req, LDB_CONTROL_SHOW_RECYCLED_OID, true, NULL);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        ret = ldb_request_add_control(req, LDB_CONTROL_REVEAL_INTERNALS, false, NULL);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
 
         ret = ldb_request(ldb, req);
@@ -119 +87 @@
 }
 
-WERROR drs_security_level_check(struct dcesrv_call_state *dce_call, const char* call)
-{
-        if (lp_parm_bool(dce_call->conn->dce_ctx->lp_ctx, NULL, 
+WERROR drs_security_level_check(struct dcesrv_call_state *dce_call,
+                                const char* call,
+                                enum security_user_level minimum_level,
+                                const struct dom_sid *domain_sid)
+{
+        enum security_user_level level;
+
+        if (lpcfg_parm_bool(dce_call->conn->dce_ctx->lp_ctx, NULL,
                          "drs", "disable_sec_check", false)) {
                 return WERR_OK;
         }
 
-        if (security_session_user_level(dce_call->conn->auth_state.session_info) <
-                SECURITY_DOMAIN_CONTROLLER) {
-                DEBUG(0,("DsReplicaGetInfo refused for security token\n"));
+        level = security_session_user_level(dce_call->conn->auth_state.session_info, domain_sid);
+        if (level < minimum_level) {
+                if (call) {
+                        DEBUG(0,("%s refused for security token (level=%u)\n",
+                                 call, (unsigned)level));
+                        security_token_debug(0, 2, dce_call->conn->auth_state.session_info->security_token);
+                }
                 return WERR_DS_DRA_ACCESS_DENIED;
         }
@@ -143 +120 @@
 
         switch (attr->attid) {
-        case DRSUAPI_ATTRIBUTE_dBCSPwd:
-        case DRSUAPI_ATTRIBUTE_unicodePwd:
-        case DRSUAPI_ATTRIBUTE_ntPwdHistory:
-        case DRSUAPI_ATTRIBUTE_lmPwdHistory:
-        case DRSUAPI_ATTRIBUTE_supplementalCredentials:
-        case DRSUAPI_ATTRIBUTE_priorValue:
-        case DRSUAPI_ATTRIBUTE_currentValue:
-        case DRSUAPI_ATTRIBUTE_trustAuthOutgoing:
-        case DRSUAPI_ATTRIBUTE_trustAuthIncoming:
-        case DRSUAPI_ATTRIBUTE_initialAuthOutgoing:
-        case DRSUAPI_ATTRIBUTE_initialAuthIncoming:
+        case DRSUAPI_ATTID_dBCSPwd:
+        case DRSUAPI_ATTID_unicodePwd:
+        case DRSUAPI_ATTID_ntPwdHistory:
+        case DRSUAPI_ATTID_lmPwdHistory:
+        case DRSUAPI_ATTID_supplementalCredentials:
+        case DRSUAPI_ATTID_priorValue:
+        case DRSUAPI_ATTID_currentValue:
+        case DRSUAPI_ATTID_trustAuthOutgoing:
+        case DRSUAPI_ATTID_trustAuthIncoming:
+        case DRSUAPI_ATTID_initialAuthOutgoing:
+        case DRSUAPI_ATTID_initialAuthIncoming:
                 /*set value to null*/
                 attr->value_ctr.num_values = 0;
@@ -163 +140 @@
                 return;
         }
-        return;
-}
+}
+
+
+/*
+  check security on a DN, with logging of errors
+ */
+static WERROR drs_security_access_check_log(struct ldb_context *sam_ctx,
+                                            TALLOC_CTX *mem_ctx,
+                                            struct security_token *token,
+                                            struct ldb_dn *dn,
+                                            const char *ext_right)
+{
+        int ret;
+        if (!dn) {
+                DEBUG(3,("drs_security_access_check: Null dn provided, access is denied for %s\n",
+                              ext_right));
+                return WERR_DS_DRA_ACCESS_DENIED;
+        }
+        ret = dsdb_check_access_on_dn(sam_ctx,
+                                      mem_ctx,
+                                      dn,
+                                      token,
+                                      SEC_ADS_CONTROL_ACCESS,
+                                      ext_right);
+        if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
+                DEBUG(3,("%s refused for security token on %s\n",
+                         ext_right, ldb_dn_get_linearized(dn)));
+                security_token_debug(2, 0, token);
+                return WERR_DS_DRA_ACCESS_DENIED;
+        } else if (ret != LDB_SUCCESS) {
+                DEBUG(1,("Failed to perform access check on %s\n", ldb_dn_get_linearized(dn)));
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+        return WERR_OK;
+}
+
+
+/*
+  check security on a object identifier
+ */
+WERROR drs_security_access_check(struct ldb_context *sam_ctx,
+                                 TALLOC_CTX *mem_ctx,
+                                 struct security_token *token,
+                                 struct drsuapi_DsReplicaObjectIdentifier *nc,
+                                 const char *ext_right)
+{
+        struct ldb_dn *dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, nc);
+        WERROR werr;
+        werr = drs_security_access_check_log(sam_ctx, mem_ctx, token, dn, ext_right);
+        talloc_free(dn);
+        return werr;
+}
+
+/*
+  check security on the NC root of a object identifier
+ */
+WERROR drs_security_access_check_nc_root(struct ldb_context *sam_ctx,
+                                         TALLOC_CTX *mem_ctx,
+                                         struct security_token *token,
+                                         struct drsuapi_DsReplicaObjectIdentifier *nc,
+                                         const char *ext_right)
+{
+        struct ldb_dn *dn, *nc_root;
+        WERROR werr;
+        int ret;
+
+        dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, nc);
+        W_ERROR_HAVE_NO_MEMORY(dn);
+        ret = dsdb_find_nc_root(sam_ctx, dn, dn, &nc_root);
+        if (ret != LDB_SUCCESS) {
+                return WERR_DS_CANT_FIND_EXPECTED_NC;
+        }
+        werr = drs_security_access_check_log(sam_ctx, mem_ctx, token, nc_root, ext_right);
+        talloc_free(dn);
+        return werr;
+}

trunk/server/source4/rpc_server/drsuapi/getncchanges.c

@@ -2 +2 @@
    Unix SMB/CIFS implementation.
 
-   implement the DRSUpdateRefs call
+   implement the DSGetNCChanges call
 
    Copyright (C) Anatoliy Atanasov 2009
@@ -22 +22 @@
 
 #include "includes.h"
-#include "librpc/gen_ndr/ndr_drsuapi.h"
 #include "rpc_server/dcerpc_server.h"
 #include "dsdb/samdb/samdb.h"
 #include "param/param.h"
 #include "librpc/gen_ndr/ndr_drsblobs.h"
-#include "auth/auth.h"
+#include "librpc/gen_ndr/ndr_drsuapi.h"
+#include "librpc/gen_ndr/ndr_security.h"
+#include "libcli/security/security.h"
+#include "libcli/security/session.h"
 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
 #include "rpc_server/dcerpc_server_proto.h"
 #include "../libcli/drsuapi/drsuapi.h"
-#include "libcli/security/security.h"
+#include "lib/util/binsearch.h"
+#include "lib/util/tsort.h"
+#include "auth/session.h"
+#include "dsdb/common/util.h"
+
+/*
+  build a DsReplicaObjectIdentifier from a ldb msg
+ */
+static struct drsuapi_DsReplicaObjectIdentifier *get_object_identifier(TALLOC_CTX *mem_ctx,
+                                                                       struct ldb_message *msg)
+{
+        struct drsuapi_DsReplicaObjectIdentifier *identifier;
+        struct dom_sid *sid;
+
+        identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
+        if (identifier == NULL) {
+                return NULL;
+        }
+
+        identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
+        identifier->guid = samdb_result_guid(msg, "objectGUID");
+
+        sid = samdb_result_dom_sid(identifier, msg, "objectSid");
+        if (sid) {
+                identifier->sid = *sid;
+        } else {
+                ZERO_STRUCT(identifier->sid);
+        }
+        return identifier;
+}
+
+static int udv_compare(const struct GUID *guid1, struct GUID guid2)
+{
+        return GUID_compare(guid1, &guid2);
+}
+
+/*
+  see if we can filter an attribute using the uptodateness_vector
+ */
+static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv,
+                       const struct GUID *originating_invocation_id,
+                       uint64_t originating_usn)
+{
+        const struct drsuapi_DsReplicaCursor *c;
+        if (udv == NULL) return false;
+        BINARY_ARRAY_SEARCH(udv->cursors, udv->count, source_dsa_invocation_id, 
+                            originating_invocation_id, udv_compare, c);
+        if (c && originating_usn <= c->highest_usn) {
+                return true;
+        }
+        return false;
+        
+}
+
+static int attid_cmp(enum drsuapi_DsAttributeId a1, enum drsuapi_DsAttributeId a2)
+{
+        if (a1 == a2) return 0;
+        return ((uint32_t)a1) > ((uint32_t)a2) ? 1 : -1;
+}
+
+/*
+  check if an attribute is in a partial_attribute_set
+ */
+static bool check_partial_attribute_set(const struct dsdb_attribute *sa,
+                                        struct drsuapi_DsPartialAttributeSet *pas)
+{
+        enum drsuapi_DsAttributeId *result;
+        BINARY_ARRAY_SEARCH_V(pas->attids, pas->num_attids, (enum drsuapi_DsAttributeId)sa->attributeID_id,
+                              attid_cmp, result);
+        return result != NULL;
+}
+
 
 /* 
@@ -40 +113 @@
                                           struct ldb_context *sam_ctx,
                                           struct ldb_dn *ncRoot_dn,
+                                          bool   is_schema_nc,
                                           struct dsdb_schema *schema,
                                           DATA_BLOB *session_key,
                                           uint64_t highest_usn,
-                                          uint32_t replica_flags)
+                                          uint32_t replica_flags,
+                                          struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
+                                          struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
+                                          enum drsuapi_DsExtendedOperation extended_op)
 {
         const struct ldb_val *md_value;
-        int i, n;
-        struct ldb_dn *obj_dn;
+        uint32_t i, n;
         struct replPropertyMetaDataBlob md;
-        struct dom_sid *sid;
         uint32_t rid = 0;
         enum ndr_err_code ndr_err;
@@ -55 +130 @@
         const char *rdn;
         const struct dsdb_attribute *rdn_sa;
-
-        if (ldb_dn_compare(ncRoot_dn, msg->dn) == 0) {
+        unsigned int instanceType;
+        struct dsdb_syntax_ctx syntax_ctx;
+
+        /* make dsdb sytanx context for conversions */
+        dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
+        syntax_ctx.is_schema_nc = is_schema_nc;
+
+        instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
+        if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
                 obj->is_nc_prefix = true;
                 obj->parent_object_guid = NULL;
         } else {
-                struct ldb_dn *parent_dn;
-                uint32_t instance_type;
-
-                instance_type = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
-                if (instance_type & INSTANCE_TYPE_IS_NC_HEAD) {
-                        struct ldb_result *res;
-                        int ret;
-                        char *dnstr = ldb_dn_get_linearized(msg->dn);
-                        msg->dn = ldb_dn_new(msg, sam_ctx, dnstr);
-                        /* we need to re-search the msg, to avoid the
-                         * broken dual message problems with our
-                         * partitions implementation */
-                        DEBUG(6,(__location__ ": Re-fetching subref %s\n", 
-                                 ldb_dn_get_linearized(msg->dn)));
-                        ret = drsuapi_search_with_extended_dn(sam_ctx, msg, &res,
-                                                              msg->dn, LDB_SCOPE_BASE, NULL,
-                                                              NULL, NULL);
-                        if (ret != LDB_SUCCESS || res->count < 1) {
-                                DEBUG(0,(__location__ ": Failed to reload subref head %s in %s\n",
-                                         ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(ncRoot_dn)));
-                                return WERR_DS_DRA_INTERNAL_ERROR;
-                        }
-                        msg = res->msgs[0];
-                }
-
-                parent_dn = ldb_dn_copy(msg, msg->dn);
                 obj->is_nc_prefix = false;
                 obj->parent_object_guid = talloc(obj, struct GUID);
-                if (parent_dn == NULL) {
+                if (obj->parent_object_guid == NULL) {
                         return WERR_DS_DRA_INTERNAL_ERROR;
                 }
-                if (ldb_dn_remove_child_components(parent_dn, 1) != true) {
-                        DEBUG(0,(__location__ ": Unable to remove DN component\n"));
+                *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
+                if (GUID_all_zero(obj->parent_object_guid)) {
+                        DEBUG(0,(__location__ ": missing parentGUID for %s\n",
+                                 ldb_dn_get_linearized(msg->dn)));
                         return WERR_DS_DRA_INTERNAL_ERROR;
                 }
-                if (dsdb_find_guid_by_dn(sam_ctx, parent_dn, obj->parent_object_guid) != LDB_SUCCESS) {
-                        DEBUG(0,(__location__ ": Unable to find parent DN %s %s\n", 
-                                 ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(parent_dn)));
-                }
-                talloc_free(parent_dn);
         }
         obj->next_object = NULL;
@@ -109 +162 @@
         }
 
-        ndr_err = ndr_pull_struct_blob(md_value, obj,
-                                       lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")), &md,
+        if (instanceType & INSTANCE_TYPE_UNINSTANT) {
+                /* don't send uninstantiated objects */
+                return WERR_OK;
+        }
+
+        ndr_err = ndr_pull_struct_blob(md_value, obj, &md,
                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -135 +192 @@
         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
+
+        obj->object.identifier = get_object_identifier(obj, msg);
+        if (obj->object.identifier == NULL) {
+                return WERR_NOMEM;
+        }
+        dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
         
         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
         for (n=i=0; i<md.ctr.ctr1.count; i++) {
+                const struct dsdb_attribute *sa;
+                bool force_attribute = false;
+
                 /* if the attribute has not changed, and it is not the
                    instanceType then don't include it */
                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
-                    md.ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) continue;
+                    extended_op != DRSUAPI_EXOP_REPL_SECRET &&
+                    md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) continue;
+
                 /* don't include the rDN */
                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
+
+                sa = dsdb_attribute_by_attributeID_id(schema, md.ctr.ctr1.array[i].attid);
+                if (!sa) {
+                        DEBUG(0,(__location__ ": Failed to find attribute in schema for attrid %u mentioned in replPropertyMetaData of %s\n", 
+                                 (unsigned int)md.ctr.ctr1.array[i].attid, 
+                                 ldb_dn_get_linearized(msg->dn)));
+                        return WERR_DS_DRA_INTERNAL_ERROR;              
+                }
+
+                if (sa->linkID) {
+                        struct ldb_message_element *el;
+                        el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
+                        if (el && el->num_values && dsdb_dn_is_upgraded_link_val(&el->values[0])) {
+                                /* don't send upgraded links inline */
+                                continue;
+                        }
+                }
+
+                if (extended_op == DRSUAPI_EXOP_REPL_SECRET &&
+                    !dsdb_attr_in_rodc_fas(sa)) {
+                        force_attribute = true;
+                        DEBUG(4,("Forcing attribute %s in %s\n",
+                                 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
+                }
+
+                /* filter by uptodateness_vector */
+                if (md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType &&
+                    !force_attribute &&
+                    udv_filter(uptodateness_vector,
+                               &md.ctr.ctr1.array[i].originating_invocation_id, 
+                               md.ctr.ctr1.array[i].originating_usn)) {
+                        continue;
+                }
+
+                /* filter by partial_attribute_set */
+                if (partial_attribute_set && !check_partial_attribute_set(sa, partial_attribute_set)) {
+                        continue;
+                }
+
                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
@@ -152 +259 @@
         }
 
-        /*
-          note that if n==0 we still need to send the change, as it
-          could be a rename, which changes the uSNChanged, but not any
-          of the replicated attributes
-         */
+        /* ignore it if its an empty change. Note that renames always
+         * change the 'name' attribute, so they won't be ignored by
+         * this */
+        if (n == 0 ||
+            (n == 1 && attids[0] == DRSUAPI_ATTID_instanceType)) {
+                talloc_free(obj->meta_data_ctr);
+                obj->meta_data_ctr = NULL;
+                return WERR_OK;
+        }
 
         obj->meta_data_ctr->count = n;
-
-        obj->object.identifier = talloc(obj, struct drsuapi_DsReplicaObjectIdentifier);
-        obj_dn = ldb_msg_find_attr_as_dn(sam_ctx, obj, msg, "distinguishedName");
-        obj->object.identifier->dn = ldb_dn_get_linearized(obj_dn);
-        obj->object.identifier->guid = samdb_result_guid(msg, "objectGUID");
-        sid = samdb_result_dom_sid(obj, msg, "objectSid");
-        if (sid) {
-                dom_sid_split_rid(NULL, sid, NULL, &rid);
-                obj->object.identifier->sid = *sid;
-        } else {
-                ZERO_STRUCT(obj->object.identifier->sid);
-        }
 
         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
@@ -194 +293 @@
                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
                 if (el == NULL) {
-                        DEBUG(0,("No element '%s' for attributeID %u in message\n", 
+                        /* this happens for attributes that have been removed */
+                        DEBUG(5,("No element '%s' for attributeID %u in message\n",
                                  sa->lDAPDisplayName, attids[i]));
                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
-                        obj->object.attribute_ctr.attributes[i].attid = attids[i];
+                        obj->object.attribute_ctr.attributes[i].attid =
+                                        dsdb_attribute_get_attid(sa, syntax_ctx.is_schema_nc);
                 } else {
-                        werr = dsdb_attribute_ldb_to_drsuapi(sam_ctx, schema, el, obj,
-                                                             &obj->object.attribute_ctr.attributes[i]);
+                        werr = sa->syntax->ldb_to_drsuapi(&syntax_ctx, sa, el, obj,
+                                                          &obj->object.attribute_ctr.attributes[i]);
                         if (!W_ERROR_IS_OK(werr)) {
                                 DEBUG(0,("Unable to convert %s to DRS object - %s\n", 
@@ -206 +307 @@
                                 return werr;
                         }
-                        /* if DRSUAPI_DS_REPLICA_NEIGHBOUR_SPECIAL_SECRET_PROCESSING is set
+                        /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
                          * check if attribute is secret and send a null value
-                         * TODO: check if we can make this in the database layer
                          */
-                        if ((replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_SPECIAL_SECRET_PROCESSING)
-                            == DRSUAPI_DS_REPLICA_NEIGHBOUR_SPECIAL_SECRET_PROCESSING) {
+                        if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
                                                                  &obj->meta_data_ctr->meta_data[i]);
@@ -230 +329 @@
 }
 
+
 /*
-  load replUpToDateVector from a DN
+  add one linked attribute from an object to the list of linked
+  attributes in a getncchanges request
  */
-static WERROR load_udv(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
-                       struct ldb_dn *dn, struct replUpToDateVectorBlob *ouv)
-{
-        const char *attrs[] = { "replUpToDateVector", NULL };
-        struct ldb_result *res = NULL;
+static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
+                                    struct ldb_context *sam_ctx,
+                                    const struct dsdb_schema *schema,
+                                    const struct dsdb_attribute *sa,
+                                    struct ldb_message *msg,
+                                    struct dsdb_dn *dsdb_dn,
+                                    struct drsuapi_DsReplicaLinkedAttribute **la_list,
+                                    uint32_t *la_count)
+{
+        struct drsuapi_DsReplicaLinkedAttribute *la;
+        bool active;
+        NTSTATUS status;
+        WERROR werr;
+
+        (*la_list) = talloc_realloc(mem_ctx, *la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
+        W_ERROR_HAVE_NO_MEMORY(*la_list);
+
+        la = &(*la_list)[*la_count];
+
+        la->identifier = get_object_identifier(*la_list, msg);
+        W_ERROR_HAVE_NO_MEMORY(la->identifier);
+
+        active = (dsdb_dn_rmd_flags(dsdb_dn->dn) & DSDB_RMD_FLAG_DELETED) == 0;
+
+        la->attid = sa->attributeID_id;
+        la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
+
+        status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+        status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+        status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+        status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+        status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+
+        werr = dsdb_dn_la_to_blob(sam_ctx, sa, schema, *la_list, dsdb_dn, &la->value.blob);
+        W_ERROR_NOT_OK_RETURN(werr);
+
+        (*la_count)++;
+        return WERR_OK;
+}
+
+
+/*
+  add linked attributes from an object to the list of linked
+  attributes in a getncchanges request
+ */
+static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
+                                       TALLOC_CTX *mem_ctx,
+                                       struct ldb_dn *ncRoot_dn,
+                                       struct dsdb_schema *schema,
+                                       uint64_t highest_usn,
+                                       uint32_t replica_flags,
+                                       struct ldb_message *msg,
+                                       struct drsuapi_DsReplicaLinkedAttribute **la_list,
+                                       uint32_t *la_count,
+                                       struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
+{
+        unsigned int i;
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
-        struct ldb_message_element *el;
-        enum ndr_err_code ndr_err;
-
-        ZERO_STRUCTP(ouv);
-
-        if (ldb_search(sam_ctx, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL) != LDB_SUCCESS ||
-            res->count < 1) {
-                DEBUG(0,("load_udv: failed to read partition object\n"));
-                talloc_free(tmp_ctx);
-                return WERR_DS_DRA_INTERNAL_ERROR;
-        }
-
-        el = ldb_msg_find_element(res->msgs[0], "replUpToDateVector");
-        if (el == NULL || el->num_values < 1) {
-                talloc_free(tmp_ctx);
-                ouv->version = 2;
-                return WERR_OK;
-        }
-
-        ndr_err = ndr_pull_struct_blob(&el->values[0], 
-                                       mem_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
-                                       ouv, 
-                                       (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
+        uint64_t uSNChanged = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
+
+        for (i=0; i<msg->num_elements; i++) {
+                struct ldb_message_element *el = &msg->elements[i];
+                const struct dsdb_attribute *sa;
+                unsigned int j;
+
+                sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
+
+                if (!sa || sa->linkID == 0 || (sa->linkID & 1)) {
+                        /* we only want forward links */
+                        continue;
+                }
+
+                if (el->num_values && !dsdb_dn_is_upgraded_link_val(&el->values[0])) {
+                        /* its an old style link, it will have been
+                         * sent in the main replication data */
+                        continue;
+                }
+
+                for (j=0; j<el->num_values; j++) {
+                        struct dsdb_dn *dsdb_dn;
+                        uint64_t local_usn;
+                        NTSTATUS status;
+                        WERROR werr;
+
+                        dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
+                        if (dsdb_dn == NULL) {
+                                DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
+                                         el->name, ldb_dn_get_linearized(msg->dn)));
+                                talloc_free(tmp_ctx);
+                                return WERR_DS_DRA_INTERNAL_ERROR;
+                        }
+
+                        status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
+                        if (!NT_STATUS_IS_OK(status)) {
+                                /* this can happen for attributes
+                                   given to us with old style meta
+                                   data */
+                                continue;
+                        }
+
+                        if (local_usn > uSNChanged) {
+                                DEBUG(1,(__location__ ": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
+                                         el->name, ldb_dn_get_linearized(msg->dn)));
+                                talloc_free(tmp_ctx);
+                                return WERR_DS_DRA_INTERNAL_ERROR;
+                        }
+
+                        if (local_usn < highest_usn) {
+                                continue;
+                        }
+
+                        werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema, sa, msg,
+                                                     dsdb_dn, la_list, la_count);
+                        if (!W_ERROR_IS_OK(werr)) {
+                                talloc_free(tmp_ctx);
+                                return werr;
+                        }
+                }
+        }
+
         talloc_free(tmp_ctx);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                DEBUG(0,(__location__ ": Failed to parse replUpToDateVector for %s\n",
-                         ldb_dn_get_linearized(dn)));
-                return WERR_DS_DRA_INTERNAL_ERROR;
-        }
-        
         return WERR_OK;
-        
 }
 
@@ -280 +480 @@
                                  struct drsuapi_DsReplicaCursor2CtrEx *udv)
 {
+        int ret;
+
+        udv->version = 2;
+        udv->reserved1 = 0;
+        udv->reserved2 = 0;
+
+        ret = dsdb_load_udv_v2(sam_ctx, ncRoot_dn, udv, &udv->cursors, &udv->count);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed to load UDV for %s - %s\n",
+                         ldb_dn_get_linearized(ncRoot_dn), ldb_errstring(sam_ctx)));
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+        
+        return WERR_OK;
+}
+
+
+/* comparison function for linked attributes - see CompareLinks() in
+ * MS-DRSR section 4.1.10.5.17 */
+static int linked_attribute_compare(const struct drsuapi_DsReplicaLinkedAttribute *la1,
+                                    const struct drsuapi_DsReplicaLinkedAttribute *la2,
+                                    struct ldb_context *sam_ctx)
+{
+        int c;
         WERROR werr;
-        struct drsuapi_DsReplicaCursor2 *tmp_cursor;
-        uint64_t highest_commited_usn;
-        NTTIME now;
-        time_t t = time(NULL);
+        TALLOC_CTX *tmp_ctx;
+        const struct dsdb_schema *schema;
+        const struct dsdb_attribute *schema_attrib;
+        struct dsdb_dn *dn1, *dn2;
+        struct GUID guid1, guid2;
+        NTSTATUS status;
+
+        c = GUID_compare(&la1->identifier->guid,
+                         &la2->identifier->guid);
+        if (c != 0) return c;
+
+        if (la1->attid != la2->attid) {
+                return la1->attid < la2->attid? -1:1;
+        }
+
+        if ((la1->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) !=
+            (la2->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)) {
+                return (la1->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)? 1:-1;
+        }
+
+        /* we need to get the target GUIDs to compare */
+        tmp_ctx = talloc_new(sam_ctx);
+
+        schema = dsdb_get_schema(sam_ctx, tmp_ctx);
+        schema_attrib = dsdb_attribute_by_attributeID_id(schema, la1->attid);
+
+        werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, tmp_ctx, la1->value.blob, &dn1);
+        if (!W_ERROR_IS_OK(werr)) {
+                DEBUG(0,(__location__ ": Bad la1 blob in sort\n"));
+                talloc_free(tmp_ctx);
+                return 0;
+        }
+
+        werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, tmp_ctx, la2->value.blob, &dn2);
+        if (!W_ERROR_IS_OK(werr)) {
+                DEBUG(0,(__location__ ": Bad la2 blob in sort\n"));
+                talloc_free(tmp_ctx);
+                return 0;
+        }
+
+        status = dsdb_get_extended_dn_guid(dn1->dn, &guid1, "GUID");
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,(__location__ ": Bad la1 guid in sort\n"));
+                talloc_free(tmp_ctx);
+                return 0;
+        }
+        status = dsdb_get_extended_dn_guid(dn2->dn, &guid2, "GUID");
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,(__location__ ": Bad la2 guid in sort\n"));
+                talloc_free(tmp_ctx);
+                return 0;
+        }
+
+        talloc_free(tmp_ctx);
+
+        return GUID_compare(&guid1, &guid2);
+}
+
+
+/*
+  sort the objects we send by tree order
+ */
+static int site_res_cmp_parent_order(struct ldb_message **m1, struct ldb_message **m2)
+{
+        return ldb_dn_compare((*m2)->dn, (*m1)->dn);
+}
+
+/*
+  sort the objects we send first by uSNChanged
+ */
+static int site_res_cmp_usn_order(struct ldb_message **m1, struct ldb_message **m2)
+{
+        unsigned usnchanged1, usnchanged2;
+        unsigned cn1, cn2;
+        cn1 = ldb_dn_get_comp_num((*m1)->dn);
+        cn2 = ldb_dn_get_comp_num((*m2)->dn);
+        if (cn1 != cn2) {
+                return cn1 > cn2 ? 1 : -1;
+        }
+        usnchanged1 = ldb_msg_find_attr_as_uint(*m1, "uSNChanged", 0);
+        usnchanged2 = ldb_msg_find_attr_as_uint(*m2, "uSNChanged", 0);
+        if (usnchanged1 == usnchanged2) {
+                return 0;
+        }
+        return usnchanged1 > usnchanged2 ? 1 : -1;
+}
+
+
+/*
+  handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
+ */
+static WERROR getncchanges_rid_alloc(struct drsuapi_bind_state *b_state,
+                                     TALLOC_CTX *mem_ctx,
+                                     struct drsuapi_DsGetNCChangesRequest10 *req10,
+                                     struct drsuapi_DsGetNCChangesCtr6 *ctr6)
+{
+        struct ldb_dn *rid_manager_dn, *fsmo_role_dn, *req_dn;
         int ret;
-        struct replUpToDateVectorBlob ouv;
-
-        werr = load_udv(sam_ctx, udv, ncRoot_dn, &ouv);
+        struct ldb_context *ldb = b_state->sam_ctx;
+        struct ldb_result *ext_res;
+        struct ldb_dn *base_dn;
+        struct dsdb_fsmo_extended_op *exop;
+
+        /*
+          steps:
+            - verify that the DN being asked for is the RID Manager DN
+            - verify that we are the RID Manager
+         */
+
+        /* work out who is the RID Manager */
+        ret = samdb_rid_manager_dn(ldb, mem_ctx, &rid_manager_dn);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
+        if (!ldb_dn_validate(req_dn) ||
+            ldb_dn_compare(req_dn, rid_manager_dn) != 0) {
+                /* that isn't the RID Manager DN */
+                DEBUG(0,(__location__ ": RID Alloc request for wrong DN %s\n",
+                         drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
+                ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
+                return WERR_OK;
+        }
+
+        /* find the DN of the RID Manager */
+        ret = samdb_reference_dn(ldb, mem_ctx, rid_manager_dn, "fSMORoleOwner", &fsmo_role_dn);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed to find fSMORoleOwner in RID Manager object - %s\n",
+                         ldb_errstring(ldb)));
+                ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), fsmo_role_dn) != 0) {
+                /* we're not the RID Manager - go away */
+                DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
+                ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
+                return WERR_OK;
+        }
+
+        exop = talloc(mem_ctx, struct dsdb_fsmo_extended_op);
+        W_ERROR_HAVE_NO_MEMORY(exop);
+
+        exop->fsmo_info = req10->fsmo_info;
+        exop->destination_dsa_guid = req10->destination_dsa_guid;
+
+        ret = ldb_transaction_start(ldb);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed transaction start - %s\n",
+                         ldb_errstring(ldb)));
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        /*
+         * FIXME (kim): this is a temp hack to return just few object,
+         * but not the whole domain NC.
+         * We should remove this hack and implement a 'scope'
+         * building function to return just the set of object
+         * documented for DRSUAPI_EXOP_FSMO_RID_ALLOC extended_op
+         */
+        ldb_sequence_number(ldb, LDB_SEQ_HIGHEST_SEQ, &req10->highwatermark.highest_usn);
+
+        ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID_POOL, exop, &ext_res);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed extended allocation RID pool operation - %s\n",
+                         ldb_errstring(ldb)));
+                ldb_transaction_cancel(ldb);
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        ret = ldb_transaction_commit(ldb);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
+                         ldb_errstring(ldb)));
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        talloc_free(ext_res);
+
+        base_dn = ldb_get_default_basedn(ldb);
+
+        DEBUG(2,("Allocated RID pool for server %s\n",
+                 GUID_string(mem_ctx, &req10->destination_dsa_guid)));
+
+        ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
+
+        return WERR_OK;
+}
+
+/*
+  return an array of SIDs from a ldb_message given an attribute name
+  assumes the SIDs are in extended DN format
+ */
+static WERROR samdb_result_sid_array_dn(struct ldb_context *sam_ctx,
+                                        struct ldb_message *msg,
+                                        TALLOC_CTX *mem_ctx,
+                                        const char *attr,
+                                        const struct dom_sid ***sids)
+{
+        struct ldb_message_element *el;
+        unsigned int i;
+
+        el = ldb_msg_find_element(msg, attr);
+        if (!el) {
+                *sids = NULL;
+                return WERR_OK;
+        }
+
+        (*sids) = talloc_array(mem_ctx, const struct dom_sid *, el->num_values + 1);
+        W_ERROR_HAVE_NO_MEMORY(*sids);
+
+        for (i=0; i<el->num_values; i++) {
+                struct ldb_dn *dn = ldb_dn_from_ldb_val(mem_ctx, sam_ctx, &el->values[i]);
+                NTSTATUS status;
+                struct dom_sid *sid;
+
+                sid = talloc(*sids, struct dom_sid);
+                W_ERROR_HAVE_NO_MEMORY(sid);
+                status = dsdb_get_extended_dn_sid(dn, sid, "SID");
+                if (!NT_STATUS_IS_OK(status)) {
+                        return WERR_INTERNAL_DB_CORRUPTION;
+                }
+                (*sids)[i] = sid;
+        }
+        (*sids)[i] = NULL;
+
+        return WERR_OK;
+}
+
+
+/*
+  return an array of SIDs from a ldb_message given an attribute name
+  assumes the SIDs are in NDR form
+ */
+static WERROR samdb_result_sid_array_ndr(struct ldb_context *sam_ctx,
+                                         struct ldb_message *msg,
+                                         TALLOC_CTX *mem_ctx,
+                                         const char *attr,
+                                         const struct dom_sid ***sids)
+{
+        struct ldb_message_element *el;
+        unsigned int i;
+
+        el = ldb_msg_find_element(msg, attr);
+        if (!el) {
+                *sids = NULL;
+                return WERR_OK;
+        }
+
+        (*sids) = talloc_array(mem_ctx, const struct dom_sid *, el->num_values + 1);
+        W_ERROR_HAVE_NO_MEMORY(*sids);
+
+        for (i=0; i<el->num_values; i++) {
+                enum ndr_err_code ndr_err;
+                struct dom_sid *sid;
+
+                sid = talloc(*sids, struct dom_sid);
+                W_ERROR_HAVE_NO_MEMORY(sid);
+
+                ndr_err = ndr_pull_struct_blob(&el->values[i], sid, sid,
+                                               (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
+                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                        return WERR_INTERNAL_DB_CORRUPTION;
+                }
+                (*sids)[i] = sid;
+        }
+        (*sids)[i] = NULL;
+
+        return WERR_OK;
+}
+
+/*
+  see if any SIDs in list1 are in list2
+ */
+static bool sid_list_match(const struct dom_sid **list1, const struct dom_sid **list2)
+{
+        unsigned int i, j;
+        /* do we ever have enough SIDs here to worry about O(n^2) ? */
+        for (i=0; list1[i]; i++) {
+                for (j=0; list2[j]; j++) {
+                        if (dom_sid_equal(list1[i], list2[j])) {
+                                return true;
+                        }
+                }
+        }
+        return false;
+}
+
+/*
+  handle a DRSUAPI_EXOP_REPL_SECRET call
+ */
+static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
+                                       TALLOC_CTX *mem_ctx,
+                                       struct drsuapi_DsGetNCChangesRequest10 *req10,
+                                       struct dom_sid *user_sid,
+                                       struct drsuapi_DsGetNCChangesCtr6 *ctr6)
+{
+        struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
+        struct ldb_dn *obj_dn, *rodc_dn, *krbtgt_link_dn;
+        int ret;
+        const char *rodc_attrs[] = { "msDS-KrbTgtLink", "msDS-NeverRevealGroup", "msDS-RevealOnDemandGroup", NULL };
+        const char *obj_attrs[] = { "tokenGroups", "objectSid", "UserAccountControl", "msDS-KrbTgtLinkBL", NULL };
+        struct ldb_result *rodc_res, *obj_res;
+        const struct dom_sid **never_reveal_sids, **reveal_sids, **token_sids;
+        WERROR werr;
+
+        DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_SECRET extended op on %s\n",
+                 drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
+
+        /*
+         * we need to work out if we will allow this RODC to
+         * replicate the secrets for this object
+         *
+         * see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
+         * of this function
+         */
+
+        if (b_state->sam_ctx_system == NULL) {
+                /* this operation needs system level access */
+                ctr6->extended_ret = DRSUAPI_EXOP_ERR_ACCESS_DENIED;
+                return WERR_DS_DRA_SOURCE_DISABLED;
+        }
+
+        obj_dn = drs_ObjectIdentifier_to_dn(mem_ctx, b_state->sam_ctx_system, ncRoot);
+        if (!ldb_dn_validate(obj_dn)) goto failed;
+
+        rodc_dn = ldb_dn_new_fmt(mem_ctx, b_state->sam_ctx_system, "<SID=%s>",
+                                 dom_sid_string(mem_ctx, user_sid));
+        if (!ldb_dn_validate(rodc_dn)) goto failed;
+
+        /* do the two searches we need */
+        ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &rodc_res, rodc_dn, rodc_attrs,
+                             DSDB_SEARCH_SHOW_EXTENDED_DN);
+        if (ret != LDB_SUCCESS || rodc_res->count != 1) goto failed;
+
+        ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &obj_res, obj_dn, obj_attrs, 0);
+        if (ret != LDB_SUCCESS || obj_res->count != 1) goto failed;
+
+        /* if the object SID is equal to the user_sid, allow */
+        if (dom_sid_equal(user_sid,
+                          samdb_result_dom_sid(mem_ctx, obj_res->msgs[0], "objectSid"))) {
+                goto allowed;
+        }
+
+        /* an RODC is allowed to get its own krbtgt account secrets */
+        krbtgt_link_dn = samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
+                                         rodc_res->msgs[0], "msDS-KrbTgtLink", NULL);
+        if (krbtgt_link_dn != NULL &&
+            ldb_dn_compare(obj_dn, krbtgt_link_dn) == 0) {
+                goto allowed;
+        }
+
+        /* but it isn't allowed to get anyone elses krbtgt secrets */
+        if (samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
+                            obj_res->msgs[0], "msDS-KrbTgtLinkBL", NULL)) {
+                goto denied;
+        }
+
+        if (ldb_msg_find_attr_as_uint(obj_res->msgs[0],
+                                      "userAccountControl", 0) &
+            UF_INTERDOMAIN_TRUST_ACCOUNT) {
+                goto denied;
+        }
+
+        werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
+                                         mem_ctx, "msDS-NeverRevealGroup", &never_reveal_sids);
         if (!W_ERROR_IS_OK(werr)) {
-                return werr;
-        }
-        
-        ret = ldb_sequence_number(sam_ctx, LDB_SEQ_HIGHEST_SEQ, &highest_commited_usn);
+                goto denied;
+        }
+
+        werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
+                                         mem_ctx, "msDS-RevealOnDemandGroup", &reveal_sids);
+        if (!W_ERROR_IS_OK(werr)) {
+                goto denied;
+        }
+
+        werr = samdb_result_sid_array_ndr(b_state->sam_ctx_system, obj_res->msgs[0],
+                                         mem_ctx, "tokenGroups", &token_sids);
+        if (!W_ERROR_IS_OK(werr) || token_sids==NULL) {
+                goto denied;
+        }
+
+        if (never_reveal_sids &&
+            sid_list_match(token_sids, never_reveal_sids)) {
+                goto denied;
+        }
+
+        if (reveal_sids &&
+            sid_list_match(token_sids, reveal_sids)) {
+                goto allowed;
+        }
+
+        /* default deny */
+denied:
+        DEBUG(2,(__location__ ": Denied RODC secret replication for %s by RODC %s\n",
+                 ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
+        ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
+        return WERR_DS_DRA_ACCESS_DENIED;
+
+allowed:
+        DEBUG(2,(__location__ ": Allowed RODC secret replication for %s by RODC %s\n",
+                 ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
+        ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
+        req10->highwatermark.highest_usn = 0;
+        return WERR_OK;
+
+failed:
+        DEBUG(2,(__location__ ": Failed RODC secret replication for %s by RODC %s\n",
+                 ldb_dn_get_linearized(obj_dn), dom_sid_string(mem_ctx, user_sid)));
+        ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
+        return WERR_DS_DRA_BAD_DN;
+}
+
+
+/*
+  handle a DRSUAPI_EXOP_REPL_OBJ call
+ */
+static WERROR getncchanges_repl_obj(struct drsuapi_bind_state *b_state,
+                                    TALLOC_CTX *mem_ctx,
+                                    struct drsuapi_DsGetNCChangesRequest10 *req10,
+                                    struct dom_sid *user_sid,
+                                    struct drsuapi_DsGetNCChangesCtr6 *ctr6)
+{
+        struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
+
+        DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_OBJ extended op on %s\n",
+                 drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
+
+        ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
+        req10->highwatermark.highest_usn = 0;
+        return WERR_OK;
+}
+
+
+/*
+  handle DRSUAPI_EXOP_FSMO_REQ_ROLE,
+  DRSUAPI_EXOP_FSMO_RID_REQ_ROLE,
+  and DRSUAPI_EXOP_FSMO_REQ_PDC calls
+ */
+static WERROR getncchanges_change_master(struct drsuapi_bind_state *b_state,
+                                         TALLOC_CTX *mem_ctx,
+                                         struct drsuapi_DsGetNCChangesRequest10 *req10,
+                                         struct drsuapi_DsGetNCChangesCtr6 *ctr6)
+{
+        struct ldb_dn *fsmo_role_dn, *req_dn, *ntds_dn;
+        int ret;
+        unsigned int i;
+        struct ldb_context *ldb = b_state->sam_ctx;
+        struct ldb_message *msg;
+
+        /*
+          steps:
+            - verify that the client dn exists
+            - verify that we are the current master
+         */
+
+        req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
+        if (!ldb_dn_validate(req_dn)) {
+                /* that is not a valid dn */
+                DEBUG(0,(__location__ ": FSMO role transfer request for invalid DN %s\n",
+                         drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
+                ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
+                return WERR_OK;
+        }
+
+        /* retrieve the current role owner */
+        ret = samdb_reference_dn(ldb, mem_ctx, req_dn, "fSMORoleOwner", &fsmo_role_dn);
         if (ret != LDB_SUCCESS) {
-                return WERR_DS_DRA_INTERNAL_ERROR;
-        }
-
-        tmp_cursor = talloc(udv, struct drsuapi_DsReplicaCursor2);
-        tmp_cursor->source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
-        tmp_cursor->highest_usn = highest_commited_usn;
-        unix_to_nt_time(&now, t);
-        tmp_cursor->last_sync_success = now;
-
-        udv->count = ouv.ctr.ctr2.count + 1;
-        udv->cursors = talloc_steal(udv, ouv.ctr.ctr2.cursors);
-        udv->cursors = talloc_realloc(udv, udv->cursors, struct drsuapi_DsReplicaCursor2, udv->count);
-        if (!udv->cursors) {
-                return WERR_DS_DRA_INTERNAL_ERROR;
-        }
-        udv->cursors[udv->count - 1] = *tmp_cursor;
-        
-        qsort(udv->cursors, udv->count,
-              sizeof(struct drsuapi_DsReplicaCursor2),
-              (comparison_fn_t)drsuapi_DsReplicaCursor2_compare);
+                DEBUG(0,(__location__ ": Failed to find fSMORoleOwner in context - %s\n",
+                         ldb_errstring(ldb)));
+                ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), fsmo_role_dn) != 0) {
+                /* we're not the current owner - go away */
+                DEBUG(0,(__location__ ": FSMO transfer request when not owner\n"));
+                ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
+                return WERR_OK;
+        }
+
+        /* change the current master */
+        msg = ldb_msg_new(ldb);
+        W_ERROR_HAVE_NO_MEMORY(msg);
+        msg->dn = drs_ObjectIdentifier_to_dn(msg, ldb, req10->naming_context);
+        W_ERROR_HAVE_NO_MEMORY(msg->dn);
+
+        ret = dsdb_find_dn_by_guid(ldb, msg, &req10->destination_dsa_guid, &ntds_dn);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
+                          GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
+                talloc_free(msg);
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        ret = ldb_msg_add_string(msg, "fSMORoleOwner", ldb_dn_get_linearized(ntds_dn));
+        if (ret != 0) {
+                talloc_free(msg);
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        for (i=0;i<msg->num_elements;i++) {
+                msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
+        }
+
+        ret = ldb_transaction_start(ldb);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed transaction start - %s\n",
+                         ldb_errstring(ldb)));
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        ret = ldb_modify(ldb, msg);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed to change current owner - %s\n",
+                         ldb_errstring(ldb)));
+                ldb_transaction_cancel(ldb);
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        ret = ldb_transaction_commit(ldb);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
+                         ldb_errstring(ldb)));
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+
+        ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
 
         return WERR_OK;
@@ -321 +1041 @@
 /* state of a partially completed getncchanges call */
 struct drsuapi_getncchanges_state {
-        struct ldb_result *site_res;
-        uint32_t num_sent;
-        struct ldb_context *sam_ctx;
+        struct GUID *guids;
+        uint32_t num_records;
+        uint32_t num_processed;
         struct ldb_dn *ncRoot_dn;
-        uint32_t min_usn;
+        bool is_schema_nc;
+        uint64_t min_usn;
+        uint64_t highest_usn;
+        struct ldb_dn *last_dn;
+        struct drsuapi_DsReplicaLinkedAttribute *la_list;
+        uint32_t la_count;
+        bool la_sorted;
+        uint32_t la_idx;
+        struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector;
 };
+
+/*
+  see if this getncchanges request includes a request to reveal secret information
+ */
+static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state *b_state,
+                                                       struct drsuapi_DsGetNCChangesRequest10 *req10,
+                                                       bool *is_secret_request)
+{
+        enum drsuapi_DsExtendedOperation exop;
+        uint32_t i;
+        struct dsdb_schema *schema;
+
+        *is_secret_request = true;
+
+        exop = req10->extended_op;
+
+        switch (exop) {
+        case DRSUAPI_EXOP_FSMO_REQ_ROLE:
+        case DRSUAPI_EXOP_FSMO_RID_ALLOC:
+        case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
+        case DRSUAPI_EXOP_FSMO_REQ_PDC:
+        case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
+                /* FSMO exops can reveal secrets */
+                *is_secret_request = true;
+                return WERR_OK;
+        case DRSUAPI_EXOP_REPL_SECRET:
+        case DRSUAPI_EXOP_REPL_OBJ:
+        case DRSUAPI_EXOP_NONE:
+                break;
+        }
+
+        if (req10->replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
+                *is_secret_request = false;
+                return WERR_OK;
+        }
+
+        if (exop == DRSUAPI_EXOP_REPL_SECRET ||
+            req10->partial_attribute_set == NULL) {
+                /* they want secrets */
+                *is_secret_request = true;
+                return WERR_OK;
+        }
+
+        schema = dsdb_get_schema(b_state->sam_ctx, NULL);
+
+        /* check the attributes they asked for */
+        for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
+                const struct dsdb_attribute *sa;
+                sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set->attids[i]);
+                if (sa == NULL) {
+                        return WERR_DS_DRA_SCHEMA_MISMATCH;
+                }
+                if (!dsdb_attr_in_rodc_fas(sa)) {
+                        *is_secret_request = true;
+                        return WERR_OK;
+                }
+        }
+
+        /* check the attributes they asked for */
+        for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
+                const struct dsdb_attribute *sa;
+                sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set_ex->attids[i]);
+                if (sa == NULL) {
+                        return WERR_DS_DRA_SCHEMA_MISMATCH;
+                }
+                if (!dsdb_attr_in_rodc_fas(sa)) {
+                        *is_secret_request = true;
+                        return WERR_OK;
+                }
+        }
+
+        *is_secret_request = false;
+        return WERR_OK;
+}
+
+
+/*
+  map from req8 to req10
+ */
+static struct drsuapi_DsGetNCChangesRequest10 *
+getncchanges_map_req8(TALLOC_CTX *mem_ctx,
+                      struct drsuapi_DsGetNCChangesRequest8 *req8)
+{
+        struct drsuapi_DsGetNCChangesRequest10 *req10 = talloc_zero(mem_ctx,
+                                                                    struct drsuapi_DsGetNCChangesRequest10);
+        if (req10 == NULL) {
+                return NULL;
+        }
+
+        req10->destination_dsa_guid = req8->destination_dsa_guid;
+        req10->source_dsa_invocation_id = req8->source_dsa_invocation_id;
+        req10->naming_context = req8->naming_context;
+        req10->highwatermark = req8->highwatermark;
+        req10->uptodateness_vector = req8->uptodateness_vector;
+        req10->replica_flags = req8->replica_flags;
+        req10->max_object_count = req8->max_object_count;
+        req10->max_ndr_size = req8->max_ndr_size;
+        req10->extended_op = req8->extended_op;
+        req10->fsmo_info = req8->fsmo_info;
+        req10->partial_attribute_set = req8->partial_attribute_set;
+        req10->partial_attribute_set_ex = req8->partial_attribute_set_ex;
+        req10->mapping_ctr = req8->mapping_ctr;
+
+        return req10;
+}
+
 
 /* 
   drsuapi_DsGetNCChanges
+
+  see MS-DRSR 4.1.10.5.2 for basic logic of this function
 */
 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -336 +1172 @@
         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
         int ret;
-        int i;
+        uint32_t i;
         struct dsdb_schema *schema;
         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
@@ -342 +1178 @@
         NTSTATUS status;
         DATA_BLOB session_key;
-        const char *attrs[] = { "*", "distinguishedName", NULL };
+        const char *attrs[] = { "uSNChanged",
+                                "objectGUID" ,
+                                NULL };
         WERROR werr;
         struct dcesrv_handle *h;
         struct drsuapi_bind_state *b_state;     
         struct drsuapi_getncchanges_state *getnc_state;
+        struct drsuapi_DsGetNCChangesRequest10 *req10;
+        uint32_t options;
+        uint32_t max_objects;
+        uint32_t max_links;
+        uint32_t link_count = 0;
+        uint32_t link_total = 0;
+        uint32_t link_given = 0;
+        struct ldb_dn *search_dn = NULL;
+        bool am_rodc, null_scope=false;
+        enum security_user_level security_level;
+        struct ldb_context *sam_ctx;
+        struct dom_sid *user_sid;
+        bool is_secret_request;
 
         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
         b_state = h->data;
+
+        sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
 
         *r->out.level_out = 6;
@@ -361 +1214 @@
         r->out.ctr->ctr6.uptodateness_vector = NULL;
 
-        /* Check request revision. */
-        if (r->in.level != 8) {
+        /* a RODC doesn't allow for any replication */
+        ret = samdb_rodc(sam_ctx, &am_rodc);
+        if (ret == LDB_SUCCESS && am_rodc) {
+                DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
+                return WERR_DS_DRA_SOURCE_DISABLED;
+        }
+
+        /* Check request revision. 
+         */
+        switch (r->in.level) {
+        case 8:
+                req10 = getncchanges_map_req8(mem_ctx, &r->in.req->req8);
+                if (req10 == NULL) {
+                        return WERR_NOMEM;
+                }
+                break;
+        case 10:
+                req10 = &r->in.req->req10;
+                break;
+        default:
+                DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
+                         r->in.level));
                 return WERR_REVISION_MISMATCH;
         }
 
+
         /* Perform access checks. */
-        if (r->in.req->req8.naming_context == NULL) {
+        /* TODO: we need to support a sync on a specific non-root
+         * DN. We'll need to find the real partition root here */
+        ncRoot = req10->naming_context;
+        if (ncRoot == NULL) {
+                DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
                 return WERR_DS_DRA_INVALID_PARAMETER;
         }
 
-        ncRoot = r->in.req->req8.naming_context;
-        if (ncRoot == NULL) {
-                return WERR_DS_DRA_BAD_NC;
-        }
-
-        if ((r->in.req->req8.replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET)
-            == DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET) {
-                /* Ignore the _in_ uptpdateness vector*/
-                r->in.req->req8.uptodateness_vector = NULL;
-        } 
-
-        werr = drs_security_level_check(dce_call, "DsGetNCChanges");
+        if (samdb_ntds_options(sam_ctx, &options) != LDB_SUCCESS) {
+                return WERR_DS_DRA_INTERNAL_ERROR;
+        }
+        
+        if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
+            !(req10->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
+                return WERR_DS_DRA_SOURCE_DISABLED;
+        }
+
+        user_sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
+
+        werr = drs_security_access_check_nc_root(b_state->sam_ctx,
+                                                 mem_ctx,
+                                                 dce_call->conn->auth_state.session_info->security_token,
+                                                 req10->naming_context,
+                                                 GUID_DRS_GET_CHANGES);
         if (!W_ERROR_IS_OK(werr)) {
                 return werr;
         }
 
+        werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10, &is_secret_request);
+        if (!W_ERROR_IS_OK(werr)) {
+                return werr;
+        }
+        if (is_secret_request && req10->extended_op != DRSUAPI_EXOP_REPL_SECRET) {
+                werr = drs_security_access_check_nc_root(b_state->sam_ctx,
+                                                         mem_ctx,
+                                                         dce_call->conn->auth_state.session_info->security_token,
+                                                         req10->naming_context,
+                                                         GUID_DRS_GET_ALL_CHANGES);
+                if (!W_ERROR_IS_OK(werr)) {
+                        return werr;
+                }
+        }
+
+        /* for non-administrator replications, check that they have
+           given the correct source_dsa_invocation_id */
+        security_level = security_session_user_level(dce_call->conn->auth_state.session_info,
+                                                     samdb_domain_sid(sam_ctx));
+        if (security_level == SECURITY_RO_DOMAIN_CONTROLLER) {
+                if (req10->replica_flags & DRSUAPI_DRS_WRIT_REP) {
+                        /* we rely on this flag being unset for RODC requests */
+                        req10->replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
+                }
+        }
+
+        if (req10->replica_flags & DRSUAPI_DRS_FULL_SYNC_PACKET) {
+                /* Ignore the _in_ uptpdateness vector*/
+                req10->uptodateness_vector = NULL;
+        } 
+
         getnc_state = b_state->getncchanges_state;
+
+        /* see if a previous replication has been abandoned */
+        if (getnc_state) {
+                struct ldb_dn *new_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
+                if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
+                        DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
+                                 ldb_dn_get_linearized(new_dn),
+                                 ldb_dn_get_linearized(getnc_state->ncRoot_dn),
+                                 ldb_dn_get_linearized(getnc_state->last_dn)));
+                        talloc_free(getnc_state);
+                        getnc_state = NULL;
+                }
+        }
+
         if (getnc_state == NULL) {
                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
@@ -394 +1321 @@
                 }
                 b_state->getncchanges_state = getnc_state;
-
+                getnc_state->ncRoot_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
+
+                /* find out if we are to replicate Schema NC */
+                ret = ldb_dn_compare(getnc_state->ncRoot_dn,
+                                     ldb_get_schema_basedn(b_state->sam_ctx));
+                getnc_state->is_schema_nc = (0 == ret);
 
                 /*
-                 * connect to the samdb. TODO: We need to check that the caller
-                 * has the rights to do this. This exposes all attributes,
-                 * including all passwords.
+                 * This is the first replication cycle and it is
+                 * a good place to handle extended operations
+                 *
+                 * FIXME: we don't fully support extended operations yet
                  */
-                getnc_state->sam_ctx = samdb_connect(getnc_state, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, 
-                                                     system_session(getnc_state, dce_call->conn->dce_ctx->lp_ctx));
-                if (!getnc_state->sam_ctx) {
-                        return WERR_FOOBAR;
-                }
+                switch (req10->extended_op) {
+                case DRSUAPI_EXOP_NONE:
+                        break;
+                case DRSUAPI_EXOP_FSMO_RID_ALLOC:
+                        werr = getncchanges_rid_alloc(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
+                        W_ERROR_NOT_OK_RETURN(werr);
+                        search_dn = ldb_get_default_basedn(sam_ctx);
+                        break;
+                case DRSUAPI_EXOP_REPL_SECRET:
+                        werr = getncchanges_repl_secret(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
+                        r->out.result = werr;
+                        W_ERROR_NOT_OK_RETURN(werr);
+                        break;
+                case DRSUAPI_EXOP_FSMO_REQ_ROLE:
+                        werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
+                        W_ERROR_NOT_OK_RETURN(werr);
+                        break;
+                case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
+                        werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
+                        W_ERROR_NOT_OK_RETURN(werr);
+                        break;
+                case DRSUAPI_EXOP_FSMO_REQ_PDC:
+                        werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
+                        W_ERROR_NOT_OK_RETURN(werr);
+                        break;
+                case DRSUAPI_EXOP_REPL_OBJ:
+                        werr = getncchanges_repl_obj(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
+                        r->out.result = werr;
+                        W_ERROR_NOT_OK_RETURN(werr);
+                        break;
+
+                case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
+
+                        DEBUG(0,(__location__ ": Request for DsGetNCChanges unsupported extended op 0x%x\n",
+                                 (unsigned)req10->extended_op));
+                        return WERR_DS_DRA_NOT_SUPPORTED;
+                }
+        }
+
+        if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
+            ldb_dn_is_null(getnc_state->ncRoot_dn)) {
+                DEBUG(0,(__location__ ": Bad DN '%s'\n",
+                         drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
+                return WERR_DS_DRA_INVALID_PARAMETER;
         }
 
@@ -415 +1387 @@
         }
 
-        if (getnc_state->site_res == NULL) {
+        /* 
+           TODO: MS-DRSR section 4.1.10.1.1
+           Work out if this is the start of a new cycle */
+
+        if (getnc_state->guids == NULL) {
                 char* search_filter;
                 enum ldb_scope scope = LDB_SCOPE_SUBTREE;
-
-                getnc_state->min_usn = r->in.req->req8.highwatermark.highest_usn;
+                const char *extra_filter;
+                struct ldb_result *search_res;
+
+                if (req10->extended_op == DRSUAPI_EXOP_REPL_OBJ ||
+                    req10->extended_op == DRSUAPI_EXOP_REPL_SECRET) {
+                        scope = LDB_SCOPE_BASE;
+                }
+
+                extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
+
+                getnc_state->min_usn = req10->highwatermark.highest_usn;
 
                 /* Construct response. */
@@ -425 +1410 @@
                                                 "(uSNChanged>=%llu)",
                                                 (unsigned long long)(getnc_state->min_usn+1));
-                
-                if (r->in.req->req8.replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY) {
+        
+                if (extra_filter) {
+                        search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
+                }
+
+                if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
                         search_filter = talloc_asprintf(mem_ctx,
                                                         "(&%s(isCriticalSystemObject=TRUE))",
@@ -432 +1421 @@
                 }
                 
-                getnc_state->ncRoot_dn = ldb_dn_new(getnc_state, getnc_state->sam_ctx, ncRoot->dn);
-                if (r->in.req->req8.replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_ASYNC_REP) {
+                if (req10->replica_flags & DRSUAPI_DRS_ASYNC_REP) {
                         scope = LDB_SCOPE_BASE;
                 }
                 
-                DEBUG(6,(__location__ ": getncchanges on %s using filter %s\n",
+                if (!search_dn) {
+                        search_dn = getnc_state->ncRoot_dn;
+                }
+
+                DEBUG(2,(__location__ ": getncchanges on %s using filter %s\n",
                          ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
-                ret = drsuapi_search_with_extended_dn(getnc_state->sam_ctx, getnc_state, &getnc_state->site_res,
-                                                      getnc_state->ncRoot_dn, scope, attrs,
-                                                      "distinguishedName",
+                ret = drsuapi_search_with_extended_dn(sam_ctx, getnc_state, &search_res,
+                                                      search_dn, scope, attrs,
                                                       search_filter);
                 if (ret != LDB_SUCCESS) {
                         return WERR_DS_DRA_INTERNAL_ERROR;
                 }
+
+                if (req10->replica_flags & DRSUAPI_DRS_GET_ANC) {
+                        TYPESAFE_QSORT(search_res->msgs,
+                                       search_res->count,
+                                       site_res_cmp_parent_order);
+                } else {
+                        TYPESAFE_QSORT(search_res->msgs,
+                                       search_res->count,
+                                       site_res_cmp_usn_order);
+                }
+
+                /* extract out the GUIDs list */
+                getnc_state->num_records = search_res->count;
+                getnc_state->guids = talloc_array(getnc_state, struct GUID, getnc_state->num_records);
+                W_ERROR_HAVE_NO_MEMORY(getnc_state->guids);
+
+                for (i=0; i<getnc_state->num_records; i++) {
+                        getnc_state->guids[i] = samdb_result_guid(search_res->msgs[i], "objectGUID");
+                        if (GUID_all_zero(&getnc_state->guids[i])) {
+                                DEBUG(2,("getncchanges: bad objectGUID from %s\n", ldb_dn_get_linearized(search_res->msgs[i]->dn)));
+                                return WERR_DS_DRA_INTERNAL_ERROR;
+                        }
+                }
+
+
+                talloc_free(search_res);
+
+                getnc_state->uptodateness_vector = talloc_steal(getnc_state, req10->uptodateness_vector);
+                if (getnc_state->uptodateness_vector) {
+                        /* make sure its sorted */
+                        TYPESAFE_QSORT(getnc_state->uptodateness_vector->cursors,
+                                       getnc_state->uptodateness_vector->count,
+                                       drsuapi_DsReplicaCursor_compare);
+                }
         }
 
         /* Prefix mapping */
-        schema = dsdb_get_schema(getnc_state->sam_ctx);
+        schema = dsdb_get_schema(sam_ctx, mem_ctx);
         if (!schema) {
                 DEBUG(0,("No schema in sam_ctx\n"));
@@ -458 +1483 @@
         *r->out.ctr->ctr6.naming_context = *ncRoot;
 
-        if (dsdb_find_guid_by_dn(getnc_state->sam_ctx, getnc_state->ncRoot_dn, 
+        if (dsdb_find_guid_by_dn(sam_ctx, getnc_state->ncRoot_dn,
                                  &r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
                 DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
@@ -466 +1491 @@
 
         /* find the SID if there is one */
-        dsdb_find_sid_by_dn(getnc_state->sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
+        dsdb_find_sid_by_dn(sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
 
         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
         r->out.ctr->ctr6.mapping_ctr = *ctr;
 
-        r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(getnc_state->sam_ctx));
-        r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(getnc_state->sam_ctx));
-
-        r->out.ctr->ctr6.old_highwatermark = r->in.req->req8.highwatermark;
-        r->out.ctr->ctr6.new_highwatermark = r->in.req->req8.highwatermark;
+        r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
+        r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
+
+        r->out.ctr->ctr6.old_highwatermark = req10->highwatermark;
+        r->out.ctr->ctr6.new_highwatermark = req10->highwatermark;
 
         r->out.ctr->ctr6.first_object = NULL;
         currentObject = &r->out.ctr->ctr6.first_object;
 
-        for(i=getnc_state->num_sent; 
-            i<getnc_state->site_res->count && 
-                    (r->out.ctr->ctr6.object_count < r->in.req->req8.max_object_count);
+        /* use this to force single objects at a time, which is useful
+         * for working out what object is giving problems
+         */
+        max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max object sync", 1000);
+        if (req10->max_object_count < max_objects) {
+                max_objects = req10->max_object_count;
+        }
+        /*
+         * TODO: work out how the maximum should be calculated
+         */
+        max_links = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max link sync", 1500);
+
+        for (i=getnc_state->num_processed;
+             i<getnc_state->num_records &&
+                     !null_scope &&
+                     (r->out.ctr->ctr6.object_count < max_objects);
             i++) {
                 int uSN;
                 struct drsuapi_DsReplicaObjectListItemEx *obj;
+                struct ldb_message *msg;
+                static const char * const msg_attrs[] = {
+                                            "*",
+                                            "nTSecurityDescriptor",
+                                            "parentGUID",
+                                            "replPropertyMetaData",
+                                            DSDB_SECRET_ATTRIBUTES,
+                                            NULL };
+                struct ldb_result *msg_res;
+                struct ldb_dn *msg_dn;
+
                 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
-
-                uSN = ldb_msg_find_attr_as_int(getnc_state->site_res->msgs[i], "uSNChanged", -1);
+                W_ERROR_HAVE_NO_MEMORY(obj);
+
+                msg_dn = ldb_dn_new_fmt(obj, sam_ctx, "<GUID=%s>", GUID_string(obj, &getnc_state->guids[i]));
+                W_ERROR_HAVE_NO_MEMORY(msg_dn);
+
+
+                /* by re-searching here we avoid having a lot of full
+                 * records in memory between calls to getncchanges
+                 */
+                ret = drsuapi_search_with_extended_dn(sam_ctx, obj, &msg_res,
+                                                      msg_dn,
+                                                      LDB_SCOPE_BASE, msg_attrs, NULL);
+                if (ret != LDB_SUCCESS) {
+                        if (ret != LDB_ERR_NO_SUCH_OBJECT) {
+                                DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
+                                         ldb_dn_get_extended_linearized(obj, msg_dn, 1), ldb_errstring(sam_ctx)));
+                        }
+                        talloc_free(obj);
+                        continue;
+                }
+
+                msg = msg_res->msgs[0];
+
+                werr = get_nc_changes_build_object(obj, msg,
+                                                   sam_ctx, getnc_state->ncRoot_dn,
+                                                   getnc_state->is_schema_nc,
+                                                   schema, &session_key, getnc_state->min_usn,
+                                                   req10->replica_flags,
+                                                   req10->partial_attribute_set,
+                                                   getnc_state->uptodateness_vector,
+                                                   req10->extended_op);
+                if (!W_ERROR_IS_OK(werr)) {
+                        return werr;
+                }
+
+                werr = get_nc_changes_add_links(sam_ctx, getnc_state,
+                                                getnc_state->ncRoot_dn,
+                                                schema, getnc_state->min_usn,
+                                                req10->replica_flags,
+                                                msg,
+                                                &getnc_state->la_list,
+                                                &getnc_state->la_count,
+                                                getnc_state->uptodateness_vector);
+                if (!W_ERROR_IS_OK(werr)) {
+                        return werr;
+                }
+
+                uSN = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
                 if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
                         r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
                 }
-
-                werr = get_nc_changes_build_object(obj, getnc_state->site_res->msgs[i], 
-                                                   getnc_state->sam_ctx, getnc_state->ncRoot_dn, 
-                                                   schema, &session_key, getnc_state->min_usn,
-                                                   r->in.req->req8.replica_flags);
-                if (!W_ERROR_IS_OK(werr)) {
-                        return werr;
+                if (uSN > getnc_state->highest_usn) {
+                        getnc_state->highest_usn = uSN;
                 }
 
                 if (obj->meta_data_ctr == NULL) {
-                        DEBUG(0,(__location__ ": getncchanges skipping send of object %s\n",
-                                 ldb_dn_get_linearized(getnc_state->site_res->msgs[i]->dn)));
+                        DEBUG(8,(__location__ ": getncchanges skipping send of object %s\n",
+                                 ldb_dn_get_linearized(msg->dn)));
                         /* no attributes to send */
                         talloc_free(obj);
@@ -513 +1603 @@
                 *currentObject = obj;
                 currentObject = &obj->next_object;
-        }
-
-        getnc_state->num_sent += r->out.ctr->ctr6.object_count;
-
-        r->out.ctr->ctr6.nc_object_count = getnc_state->site_res->count;
-
-        if (i < getnc_state->site_res->count) {
+
+                talloc_free(getnc_state->last_dn);
+                getnc_state->last_dn = ldb_dn_copy(getnc_state, msg->dn);
+
+                DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
+
+                talloc_free(msg_res);
+                talloc_free(msg_dn);
+        }
+
+        getnc_state->num_processed = i;
+
+        r->out.ctr->ctr6.nc_object_count = getnc_state->num_records;
+
+        /* the client can us to call UpdateRefs on its behalf to
+           re-establish monitoring of the NC */
+        if ((req10->replica_flags & (DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_REF_GCSPN)) &&
+            !GUID_all_zero(&req10->destination_dsa_guid)) {
+                struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
+                DEBUG(3,("UpdateRefs on getncchanges for %s\n",
+                         GUID_string(mem_ctx, &req10->destination_dsa_guid)));
+                ureq.naming_context = ncRoot;
+                ureq.dest_dsa_dns_name = talloc_asprintf(mem_ctx, "%s._msdcs.%s",
+                                                         GUID_string(mem_ctx, &req10->destination_dsa_guid),
+                                                         lpcfg_dnsdomain(dce_call->conn->dce_ctx->lp_ctx));
+                if (!ureq.dest_dsa_dns_name) {
+                        return WERR_NOMEM;
+                }
+                ureq.dest_dsa_guid = req10->destination_dsa_guid;
+                ureq.options = DRSUAPI_DRS_ADD_REF |
+                        DRSUAPI_DRS_ASYNC_OP |
+                        DRSUAPI_DRS_GETCHG_CHECK;
+
+                /* we also need to pass through the
+                   DRSUAPI_DRS_REF_GCSPN bit so that repsTo gets flagged
+                   to send notifies using the GC SPN */
+                ureq.options |= (req10->replica_flags & DRSUAPI_DRS_REF_GCSPN);
+
+                werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
+                if (!W_ERROR_IS_OK(werr)) {
+                        DEBUG(0,(__location__ ": Failed UpdateRefs in DsGetNCChanges - %s\n",
+                                 win_errstr(werr)));
+                }
+        }
+
+        /*
+         * TODO:
+         * This is just a guess, how to calculate the
+         * number of linked attributes to send, we need to
+         * find out how to do this right.
+         */
+        if (r->out.ctr->ctr6.object_count >= max_links) {
+                max_links = 0;
+        } else {
+                max_links -= r->out.ctr->ctr6.object_count;
+        }
+
+        link_total = getnc_state->la_count;
+
+        if (i < getnc_state->num_records) {
                 r->out.ctr->ctr6.more_data = true;
         } else {
+                /* sort the whole array the first time */
+                if (!getnc_state->la_sorted) {
+                        LDB_TYPESAFE_QSORT(getnc_state->la_list, getnc_state->la_count,
+                                           sam_ctx, linked_attribute_compare);
+                        getnc_state->la_sorted = true;
+                }
+
+                link_count = getnc_state->la_count - getnc_state->la_idx;
+                link_count = MIN(max_links, link_count);
+
+                r->out.ctr->ctr6.linked_attributes_count = link_count;
+                r->out.ctr->ctr6.linked_attributes = getnc_state->la_list + getnc_state->la_idx;
+
+                getnc_state->la_idx += link_count;
+                link_given = getnc_state->la_idx;
+
+                if (getnc_state->la_idx < getnc_state->la_count) {
+                        r->out.ctr->ctr6.more_data = true;
+                }
+        }
+
+        if (!r->out.ctr->ctr6.more_data) {
+                talloc_steal(mem_ctx, getnc_state->la_list);
+
                 r->out.ctr->ctr6.uptodateness_vector = talloc(mem_ctx, struct drsuapi_DsReplicaCursor2CtrEx);
-                r->out.ctr->ctr6.uptodateness_vector->version = 2;
-                r->out.ctr->ctr6.uptodateness_vector->reserved1 = 0;
-                r->out.ctr->ctr6.uptodateness_vector->reserved2 = 0;
-
                 r->out.ctr->ctr6.new_highwatermark.highest_usn = r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn;
 
-                werr = get_nc_changes_udv(getnc_state->sam_ctx, getnc_state->ncRoot_dn, 
+                werr = get_nc_changes_udv(sam_ctx, getnc_state->ncRoot_dn,
                                           r->out.ctr->ctr6.uptodateness_vector);
                 if (!W_ERROR_IS_OK(werr)) {
@@ -539 +1702 @@
         }
 
-        DEBUG(3,("DsGetNCChanges with uSNChanged >= %llu on %s gave %u objects\n", 
-                 (unsigned long long)(r->in.req->req8.highwatermark.highest_usn+1),
-                 ncRoot->dn, r->out.ctr->ctr6.object_count));
+        if (req10->extended_op != DRSUAPI_EXOP_NONE) {
+                r->out.ctr->ctr6.uptodateness_vector = NULL;
+                r->out.ctr->ctr6.nc_object_count = 0;
+                ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
+                r->out.ctr->ctr6.extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
+        }
+
+        DEBUG(r->out.ctr->ctr6.more_data?4:2,
+              ("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
+               (unsigned long long)(req10->highwatermark.highest_usn+1),
+               req10->replica_flags, drs_ObjectIdentifier_to_string(mem_ctx, ncRoot),
+               r->out.ctr->ctr6.object_count,
+               i, r->out.ctr->ctr6.more_data?getnc_state->num_records:i,
+               r->out.ctr->ctr6.linked_attributes_count,
+               link_given, link_total,
+               dom_sid_string(mem_ctx, user_sid)));
+
+#if 0
+        if (!r->out.ctr->ctr6.more_data && req10->extended_op != DRSUAPI_EXOP_NONE) {
+                NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges, NDR_BOTH, r);
+        }
+#endif
 
         return WERR_OK;

trunk/server/source4/rpc_server/drsuapi/updaterefs.c

@@ -23 +23 @@
 #include "rpc_server/dcerpc_server.h"
 #include "dsdb/samdb/samdb.h"
-#include "auth/auth.h"
+#include "libcli/security/security.h"
+#include "libcli/security/session.h"
 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
-#include "libcli/security/security.h"
+#include "auth/session.h"
+#include "librpc/gen_ndr/ndr_drsuapi.h"
 
 struct repsTo {
@@ -36 +38 @@
  */
 static WERROR uref_add_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
-                            struct ldb_dn *dn, struct repsFromTo1 *dest)
+                            struct ldb_dn *dn, struct repsFromTo1 *dest, 
+                            uint32_t options)
 {
         struct repsTo reps;
         WERROR werr;
+        unsigned int i;
 
         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
         if (!W_ERROR_IS_OK(werr)) {
                 return werr;
+        }
+
+        for (i=0; i<reps.count; i++) {
+                if (GUID_compare(&dest->source_dsa_obj_guid, 
+                                 &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
+                        if (options & DRSUAPI_DRS_GETCHG_CHECK) {
+                                return WERR_OK;
+                        } else {
+                                return WERR_DS_DRA_REF_ALREADY_EXISTS;
+                        }
+                }
         }
 
@@ -53 +68 @@
         reps.r[reps.count].version = 1;
         reps.r[reps.count].ctr.ctr1 = *dest;
+        /* add the GCSPN flag if the client asked for it */
+        reps.r[reps.count].ctr.ctr1.replica_flags |= (options & DRSUAPI_DRS_REF_GCSPN);
         reps.count++;
 
@@ -67 +84 @@
  */
 static WERROR uref_del_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
-                            struct ldb_dn *dn, struct GUID *dest_guid)
+                            struct ldb_dn *dn, struct GUID *dest_guid, 
+                            uint32_t options)
 {
         struct repsTo reps;
         WERROR werr;
-        int i;
+        unsigned int i;
+        bool found = false;
 
         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
@@ -84 +103 @@
                         }
                         reps.count--;
+                        found = true;
                 }
         }
@@ -92 +112 @@
         }
 
+        if (!found &&
+            !(options & DRSUAPI_DRS_GETCHG_CHECK) &&
+            !(options & DRSUAPI_DRS_ADD_REF)) {
+                return WERR_DS_DRA_REF_NOT_FOUND;
+        }
+
         return WERR_OK; 
+}
+
+/* 
+  drsuapi_DsReplicaUpdateRefs - a non RPC version callable from getncchanges
+*/
+WERROR drsuapi_UpdateRefs(struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
+                          struct drsuapi_DsReplicaUpdateRefsRequest1 *req)
+{
+        WERROR werr;
+        struct ldb_dn *dn;
+        struct ldb_context *sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
+
+        DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
+                 req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
+                 req->options,
+                 drs_ObjectIdentifier_to_string(mem_ctx, req->naming_context)));
+
+        dn = ldb_dn_new(mem_ctx, sam_ctx, req->naming_context->dn);
+        if (dn == NULL) {
+                return WERR_DS_INVALID_DN_SYNTAX;
+        }
+
+        if (ldb_transaction_start(sam_ctx) != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed to start transaction on samdb: %s\n",
+                         ldb_errstring(sam_ctx)));
+                return WERR_DS_DRA_INTERNAL_ERROR;              
+        }
+
+        if (req->options & DRSUAPI_DRS_DEL_REF) {
+                werr = uref_del_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid, req->options);
+                if (!W_ERROR_IS_OK(werr)) {
+                        DEBUG(0,("Failed to delete repsTo for %s: %s\n",
+                                 GUID_string(mem_ctx, &req->dest_dsa_guid),
+                                 win_errstr(werr)));
+                        goto failed;
+                }
+        }
+
+        if (req->options & DRSUAPI_DRS_ADD_REF) {
+                struct repsFromTo1 dest;
+                struct repsFromTo1OtherInfo oi;
+                
+                ZERO_STRUCT(dest);
+                ZERO_STRUCT(oi);
+
+                oi.dns_name = req->dest_dsa_dns_name;
+                dest.other_info          = &oi;
+                dest.source_dsa_obj_guid = req->dest_dsa_guid;
+                dest.replica_flags       = req->options;
+
+                werr = uref_add_dest(sam_ctx, mem_ctx, dn, &dest, req->options);
+                if (!W_ERROR_IS_OK(werr)) {
+                        DEBUG(0,("Failed to add repsTo for %s: %s\n",
+                                 GUID_string(mem_ctx, &dest.source_dsa_obj_guid),
+                                 win_errstr(werr)));
+                        goto failed;
+                }
+        }
+
+        if (ldb_transaction_commit(sam_ctx) != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed to commit transaction on samdb: %s\n",
+                         ldb_errstring(sam_ctx)));
+                return WERR_DS_DRA_INTERNAL_ERROR;              
+        }
+
+        return WERR_OK;
+
+failed:
+        ldb_transaction_cancel(sam_ctx);
+        return werr;
 }
 
@@ -101 +197 @@
                                           struct drsuapi_DsReplicaUpdateRefs *r)
 {
+        struct dcesrv_handle *h;
+        struct drsuapi_bind_state *b_state;
         struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
-        struct ldb_context *sam_ctx;
-        WERROR werr;
-        struct ldb_dn *dn;
-
-        werr = drs_security_level_check(dce_call, "DsReplicaUpdateRefs");
-        if (!W_ERROR_IS_OK(werr)) {
-                return werr;
-        }
+        WERROR werr;
+        int ret;
+        enum security_user_level security_level;
+
+        DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
+        b_state = h->data;
 
         if (r->in.level != 1) {
@@ -115 +211 @@
                 return WERR_DS_DRA_INVALID_PARAMETER;
         }
-
         req = &r->in.req.req1;
-        DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
-                 req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
-                 req->options,
-                 drs_ObjectIdentifier_to_string(mem_ctx, req->naming_context)));
-
-        /* TODO: We need to authenticate this operation pretty carefully */
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, 
-                                system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
-        if (!sam_ctx) {
-                return WERR_DS_DRA_INTERNAL_ERROR;              
-        }
-
-        dn = ldb_dn_new(mem_ctx, sam_ctx, req->naming_context->dn);
-        if (dn == NULL) {
-                talloc_free(sam_ctx);           
-                return WERR_DS_INVALID_DN_SYNTAX;
-        }
-
-        if (ldb_transaction_start(sam_ctx) != LDB_SUCCESS) {
-                DEBUG(0,(__location__ ": Failed to start transaction on samdb\n"));
-                talloc_free(sam_ctx);
-                return WERR_DS_DRA_INTERNAL_ERROR;              
-        }
-
-        if (req->options & DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE) {
-                werr = uref_del_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid);
-                if (!W_ERROR_IS_OK(werr)) {
-                        DEBUG(0,("Failed to delete repsTo for %s\n",
-                                 GUID_string(dce_call, &req->dest_dsa_guid)));
-                        goto failed;
-                }
-        }
-
-        if (req->options & DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE) {
-                struct repsFromTo1 dest;
-                struct repsFromTo1OtherInfo oi;
-                
-                ZERO_STRUCT(dest);
-                ZERO_STRUCT(oi);
-
-                oi.dns_name = req->dest_dsa_dns_name;
-                dest.other_info          = &oi;
-                dest.source_dsa_obj_guid = req->dest_dsa_guid;
-                dest.replica_flags       = req->options;
-
-                werr = uref_add_dest(sam_ctx, mem_ctx, dn, &dest);
-                if (!W_ERROR_IS_OK(werr)) {
-                        DEBUG(0,("Failed to delete repsTo for %s\n",
-                                 GUID_string(dce_call, &dest.source_dsa_obj_guid)));
-                        goto failed;
-                }
-        }
-
-        if (ldb_transaction_commit(sam_ctx) != LDB_SUCCESS) {
-                DEBUG(0,(__location__ ": Failed to commit transaction on samdb\n"));
-                return WERR_DS_DRA_INTERNAL_ERROR;              
-        }
-
-        talloc_free(sam_ctx);
-        return WERR_OK;
-
-failed:
-        ldb_transaction_cancel(sam_ctx);
-        talloc_free(sam_ctx);
+        werr = drs_security_access_check(b_state->sam_ctx,
+                                         mem_ctx,
+                                         dce_call->conn->auth_state.session_info->security_token,
+                                         req->naming_context,
+                                         GUID_DRS_MANAGE_TOPOLOGY);
+
+        if (!W_ERROR_IS_OK(werr)) {
+                return werr;
+        }
+
+        security_level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
+        if (security_level < SECURITY_ADMINISTRATOR) {
+                /* check that they are using an DSA objectGUID that they own */
+                ret = dsdb_validate_dsa_guid(b_state->sam_ctx,
+                                             &req->dest_dsa_guid,
+                                             &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]);
+                if (ret != LDB_SUCCESS) {
+                        DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
+                                 dom_sid_string(mem_ctx,
+                                                &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
+                                 GUID_string(mem_ctx, &req->dest_dsa_guid)));
+                        return WERR_DS_DRA_ACCESS_DENIED;
+                }
+        }
+
+        werr = drsuapi_UpdateRefs(b_state, mem_ctx, req);
+
+#if 0
+        NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsReplicaUpdateRefs, NDR_BOTH, r);
+#endif
+
         return werr;
 }

trunk/server/source4/rpc_server/echo/rpc_echo.c

@@ -40 +40 @@
         }
 
-        r->out.out_data = talloc_memdup(mem_ctx, r->in.in_data, r->in.len);
+        r->out.out_data = (uint8_t *)talloc_memdup(mem_ctx, r->in.in_data, r->in.len);
         if (!r->out.out_data) {
                 return NT_STATUS_NO_MEMORY;
@@ -55 +55 @@
 static NTSTATUS dcesrv_echo_SourceData(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, struct echo_SourceData *r)
 {
-        int i;
+        unsigned int i;
 
         r->out.data = talloc_array(mem_ctx, uint8_t, r->in.len);

trunk/server/source4/rpc_server/epmapper/rpc_epmapper.c

@@ -66 +66 @@
                         description->object = iface->iface.syntax_id;
 
-                        status = dcerpc_binding_build_tower(mem_ctx, description, &(*eps)[total].ep);
+                        status = dcerpc_binding_build_tower(*eps, description, &(*eps)[total].ep);
                         if (NT_STATUS_IS_ERR(status)) {
                                 DEBUG(1, ("Unable to build tower for %s\n", iface->iface.name));
@@ -104 +104 @@
         } *eps;
         uint32_t num_ents;
-        int i;
+        unsigned int i;
 
         DCESRV_PULL_HANDLE_FAULT(h, r->in.entry_handle, HTYPE_LOOKUP);
@@ -169 +169 @@
 {
         uint32_t count;
-        int i;
+        unsigned int i;
         struct dcesrv_ep_iface *eps;
         struct epm_floor *floors;

trunk/server/source4/rpc_server/handles.c

@@ -23 +23 @@
 #include "../lib/util/dlinklist.h"
 #include "rpc_server/dcerpc_server.h"
-#include "libcli/security/dom_sid.h"
+#include "libcli/security/security.h"
 #include "auth/session.h"
 
@@ -45 +45 @@
         struct dom_sid *sid;
 
-        sid = context->conn->auth_state.session_info->security_token->user_sid;
+        sid = &context->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
 
         h = talloc(context->assoc_group, struct dcesrv_handle);
@@ -81 +81 @@
         struct dom_sid *sid;
 
-        sid = context->conn->auth_state.session_info->security_token->user_sid;
+        sid = &context->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
 
         if (policy_handle_empty(p)) {

trunk/server/source4/rpc_server/lsa/dcesrv_lsa.c

@@ -29 +29 @@
 #include "librpc/gen_ndr/ndr_lsa.h"
 #include "../lib/crypto/crypto.h"
+#include "lib/util/tsort.h"
+#include "dsdb/common/util.h"
+#include "libcli/security/session.h"
+#include "kdc/kdc-policy.h"
 
 /*
@@ -81 +85 @@
 
         status = dom_sid_split_rid(tmp_ctx, sid, &domain_sid, &rid);
-        NT_STATUS_NOT_OK_RETURN(status);
+        NT_STATUS_NOT_OK_RETURN_AND_FREE(status, tmp_ctx);
 
         domain_admins_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_ADMINS);
@@ -180 +184 @@
 
                 /* Ensure user is permitted to delete this... */
-                switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+                switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
                 {
                 case SECURITY_SYSTEM:
@@ -186 +190 @@
                         break;
                 default:
-                        /* Users and annonymous are not allowed delete things */
+                        /* Users and anonymous are not allowed to delete things */
                         return NT_STATUS_ACCESS_DENIED;
                 }
@@ -192 +196 @@
                 ret = ldb_delete(secret_state->sam_ldb, 
                                  secret_state->secret_dn);
-                talloc_free(h);
-                if (ret != 0) {
+                if (ret != LDB_SUCCESS) {
                         return NT_STATUS_INVALID_HANDLE;
                 }
@@ -200 +203 @@
 
                 return NT_STATUS_OK;
+
         } else if (h->wire_handle.handle_type == LSA_HANDLE_TRUSTED_DOMAIN) {
                 struct lsa_trusted_domain_state *trusted_domain_state = 
                         talloc_get_type(h->data, struct lsa_trusted_domain_state);
                 ret = ldb_transaction_start(trusted_domain_state->policy->sam_ldb);
-                if (ret != 0) {
+                if (ret != LDB_SUCCESS) {
                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
                 }
@@ -210 +214 @@
                 ret = ldb_delete(trusted_domain_state->policy->sam_ldb, 
                                  trusted_domain_state->trusted_domain_dn);
-                if (ret != 0) {
+                if (ret != LDB_SUCCESS) {
                         ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
                         return NT_STATUS_INVALID_HANDLE;
@@ -218 +222 @@
                         ret = ldb_delete(trusted_domain_state->policy->sam_ldb, 
                                          trusted_domain_state->trusted_domain_user_dn);
-                        if (ret != 0) {
+                        if (ret != LDB_SUCCESS) {
                                 ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
                                 return NT_STATUS_INVALID_HANDLE;
@@ -225 +229 @@
 
                 ret = ldb_transaction_commit(trusted_domain_state->policy->sam_ldb);
-                if (ret != 0) {
+                if (ret != LDB_SUCCESS) {
                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
                 }
-                talloc_free(h);
+
                 ZERO_STRUCTP(r->out.handle);
 
                 return NT_STATUS_OK;
+
         } else if (h->wire_handle.handle_type == LSA_HANDLE_ACCOUNT) {
                 struct lsa_RightSet *rights;
@@ -272 +277 @@
 
                 ZERO_STRUCTP(r->out.handle);
+
+                return NT_STATUS_OK;
         } 
         
@@ -286 +293 @@
         struct dcesrv_handle *h;
         struct lsa_policy_state *state;
-        int i;
+        uint32_t i;
+        enum sec_privilege priv;
         const char *privname;
 
@@ -294 +302 @@
 
         i = *r->in.resume_handle;
-        if (i == 0) i = 1;
-
-        while ((privname = sec_privilege_name(i)) &&
+
+        while (((priv = sec_privilege_from_index(i)) != SEC_PRIV_INVALID) &&
                r->out.privs->count < r->in.max_count) {
                 struct lsa_PrivEntry *e;
-
+                privname = sec_privilege_name(priv);
                 r->out.privs->privs = talloc_realloc(r->out.privs,
                                                        r->out.privs->privs, 
@@ -308 +315 @@
                 }
                 e = &r->out.privs->privs[r->out.privs->count];
-                e->luid.low = i;
+                e->luid.low = priv;
                 e->luid.high = 0;
                 e->name.string = privname;
@@ -334 +341 @@
         DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);
 
-        sid = dce_call->conn->auth_state.session_info->security_token->user_sid;
+        sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
 
         if (h->wire_handle.handle_type == LSA_HANDLE_POLICY) {
@@ -386 +393 @@
         union dssetup_DsRoleInfo *info;
 
-        info = talloc(mem_ctx, union dssetup_DsRoleInfo);
+        info = talloc_zero(mem_ctx, union dssetup_DsRoleInfo);
         W_ERROR_HAVE_NO_MEMORY(info);
 
@@ -407 +414 @@
                 ZERO_STRUCT(domain_guid);
 
-                switch (lp_server_role(dce_call->conn->dce_ctx->lp_ctx)) {
+                switch (lpcfg_server_role(dce_call->conn->dce_ctx->lp_ctx)) {
                 case ROLE_STANDALONE:
                         role            = DS_ROLE_STANDALONE_SERVER;
@@ -423 +430 @@
                 }
 
-                switch (lp_server_role(dce_call->conn->dce_ctx->lp_ctx)) {
+                switch (lpcfg_server_role(dce_call->conn->dce_ctx->lp_ctx)) {
                 case ROLE_STANDALONE:
-                        domain          = talloc_strdup(mem_ctx, lp_workgroup(dce_call->conn->dce_ctx->lp_ctx));
+                        domain          = talloc_strdup(mem_ctx, lpcfg_workgroup(dce_call->conn->dce_ctx->lp_ctx));
                         W_ERROR_HAVE_NO_MEMORY(domain);
                         break;
                 case ROLE_DOMAIN_MEMBER:
-                        domain          = talloc_strdup(mem_ctx, lp_workgroup(dce_call->conn->dce_ctx->lp_ctx));
+                        domain          = talloc_strdup(mem_ctx, lpcfg_workgroup(dce_call->conn->dce_ctx->lp_ctx));
                         W_ERROR_HAVE_NO_MEMORY(domain);
                         /* TODO: what is with dns_domain and forest and guid? */
@@ -477 +484 @@
                 return WERR_INVALID_PARAM;
         }
-
-        return WERR_INVALID_PARAM;
 }
 
@@ -551 +556 @@
                 return dcesrv_lsa_info_AccountDomain(state, mem_ctx, &info->l_account_domain);
 
-
         case LSA_POLICY_INFO_ROLE:
                 info->role.role = LSA_ROLE_PRIMARY;
@@ -683 +687 @@
         struct dcesrv_handle *h;
         struct lsa_policy_state *state;
-        int ret, i;
+        int ret;
         struct ldb_message **res;
         const char * const attrs[] = { "objectSid", NULL};
-        uint32_t count;
+        uint32_t count, i;
 
         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
@@ -695 +699 @@
            one privilege set 
         */
-        ret = gendb_search(state->sam_ldb, mem_ctx, NULL, &res, attrs, 
+        ret = gendb_search(state->pdb, mem_ctx, NULL, &res, attrs, 
                            "(&(objectSid=*)(privilege=*))");
         if (ret < 0) {
-                return NT_STATUS_NO_SUCH_USER;
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
@@ -734 +738 @@
 }
 
+/* This decrypts and returns Trusted Domain Auth Information Internal data */
+static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call,
+                                       TALLOC_CTX *mem_ctx, DATA_BLOB *auth_blob,
+                                       struct trustDomainPasswords *auth_struct)
+{
+        DATA_BLOB session_key = data_blob(NULL, 0);
+        enum ndr_err_code ndr_err;
+        NTSTATUS nt_status;
+
+        nt_status = dcesrv_fetch_session_key(dce_call->conn, &session_key);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        arcfour_crypt_blob(auth_blob->data, auth_blob->length, &session_key);
+        ndr_err = ndr_pull_struct_blob(auth_blob, mem_ctx,
+                                       auth_struct,
+                                       (ndr_pull_flags_fn_t)ndr_pull_trustDomainPasswords);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS get_trustauth_inout_blob(struct dcesrv_call_state *dce_call,
+                                         TALLOC_CTX *mem_ctx,
+                                         struct trustAuthInOutBlob *iopw,
+                                         DATA_BLOB *trustauth_blob)
+{
+        enum ndr_err_code ndr_err;
+
+        ndr_err = ndr_push_struct_blob(trustauth_blob, mem_ctx,
+                                       iopw,
+                                       (ndr_push_flags_fn_t)ndr_push_trustAuthInOutBlob);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS add_trust_user(TALLOC_CTX *mem_ctx,
+                               struct ldb_context *sam_ldb,
+                               struct ldb_dn *base_dn,
+                               const char *netbios_name,
+                               struct trustAuthInOutBlob *in,
+                               struct ldb_dn **user_dn)
+{
+        struct ldb_message *msg;
+        struct ldb_dn *dn;
+        uint32_t i;
+        int ret;
+
+        dn = ldb_dn_copy(mem_ctx, base_dn);
+        if (!dn) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        if (!ldb_dn_add_child_fmt(dn, "cn=%s$,cn=users", netbios_name)) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        msg = ldb_msg_new(mem_ctx);
+        if (!msg) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        msg->dn = dn;
+
+        ret = ldb_msg_add_string(msg, "objectClass", "user");
+        if (ret != LDB_SUCCESS) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ret = ldb_msg_add_fmt(msg, "samAccountName", "%s$", netbios_name);
+        if (ret != LDB_SUCCESS) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ret = samdb_msg_add_uint(sam_ldb, msg, msg, "userAccountControl",
+                                 UF_INTERDOMAIN_TRUST_ACCOUNT);
+        if (ret != LDB_SUCCESS) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        for (i = 0; i < in->count; i++) {
+                const char *attribute;
+                struct ldb_val v;
+                switch (in->current.array[i].AuthType) {
+                case TRUST_AUTH_TYPE_NT4OWF:
+                        attribute = "unicodePwd";
+                        v.data = (uint8_t *)&in->current.array[i].AuthInfo.nt4owf.password;
+                        v.length = 16;
+                        break;
+                case TRUST_AUTH_TYPE_CLEAR:
+                        attribute = "clearTextPassword";
+                        v.data = in->current.array[i].AuthInfo.clear.password;
+                        v.length = in->current.array[i].AuthInfo.clear.size;
+                        break;
+                default:
+                        continue;
+                }
+
+                ret = ldb_msg_add_value(msg, attribute, &v, NULL);
+                if (ret != LDB_SUCCESS) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+
+        /* create the trusted_domain user account */
+        ret = ldb_add(sam_ldb, msg);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,("Failed to create user record %s: %s\n",
+                         ldb_dn_get_linearized(msg->dn),
+                         ldb_errstring(sam_ldb)));
+
+                switch (ret) {
+                case LDB_ERR_ENTRY_ALREADY_EXISTS:
+                        return NT_STATUS_DOMAIN_EXISTS;
+                case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
+                        return NT_STATUS_ACCESS_DENIED;
+                default:
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+        }
+
+        if (user_dn) {
+                *user_dn = dn;
+        }
+        return NT_STATUS_OK;
+}
 
 /*
@@ -747 +881 @@
         struct lsa_trusted_domain_state *trusted_domain_state;
         struct dcesrv_handle *handle;
-        struct ldb_message **msgs, *msg, *msg_user;
+        struct ldb_message **msgs, *msg;
         const char *attrs[] = {
                 NULL
@@ -754 +888 @@
         const char *dns_name;
         const char *name;
-        DATA_BLOB session_key = data_blob(NULL, 0);
         DATA_BLOB trustAuthIncoming, trustAuthOutgoing, auth_blob;
         struct trustDomainPasswords auth_struct;
         int ret;
         NTSTATUS nt_status;
-        enum ndr_err_code ndr_err;
-        
+        struct ldb_context *sam_ldb;
+
         DCESRV_PULL_HANDLE(policy_handle, r->in.policy_handle, LSA_HANDLE_POLICY);
         ZERO_STRUCTP(r->out.trustdom_handle);
-        
+
         policy_state = policy_handle->data;
-
-        nt_status = dcesrv_fetch_session_key(dce_call->conn, &session_key);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                return nt_status;
-        }
+        sam_ldb = policy_state->sam_ldb;
 
         netbios_name = r->in.info->netbios_name.string;
@@ -775 +904 @@
                 return NT_STATUS_INVALID_PARAMETER;
         }
-        
+
         dns_name = r->in.info->domain_name.string;
-        
+
         trusted_domain_state = talloc_zero(mem_ctx, struct lsa_trusted_domain_state);
         if (!trusted_domain_state) {
@@ -785 +914 @@
 
         if (strcasecmp(netbios_name, "BUILTIN") == 0
-            || (dns_name && strcasecmp(dns_name, "BUILTIN") == 0) 
+            || (dns_name && strcasecmp(dns_name, "BUILTIN") == 0)
             || (dom_sid_in_domain(policy_state->builtin_sid, r->in.info->sid))) {
-                return NT_STATUS_INVALID_PARAMETER;;
+                return NT_STATUS_INVALID_PARAMETER;
         }
 
         if (strcasecmp(netbios_name, policy_state->domain_name) == 0
             || strcasecmp(netbios_name, policy_state->domain_dns) == 0
-            || (dns_name && strcasecmp(dns_name, policy_state->domain_dns) == 0) 
+            || (dns_name && strcasecmp(dns_name, policy_state->domain_dns) == 0)
             || (dns_name && strcasecmp(dns_name, policy_state->domain_name) == 0)
             || (dom_sid_equal(policy_state->domain_sid, r->in.info->sid))) {
@@ -804 +933 @@
                 auth_struct.incoming.count = 0;
         } else {
-                auth_blob = data_blob_const(r->in.auth_info->auth_blob.data, r->in.auth_info->auth_blob.size);
-                arcfour_crypt_blob(auth_blob.data, auth_blob.length, &session_key);
-                ndr_err = ndr_pull_struct_blob(&auth_blob, mem_ctx, 
-                                               lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx),
-                                               &auth_struct,
-                                               (ndr_pull_flags_fn_t)ndr_pull_trustDomainPasswords);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        return NT_STATUS_INVALID_PARAMETER;
-                }                               
+                auth_blob = data_blob_const(r->in.auth_info->auth_blob.data,
+                                            r->in.auth_info->auth_blob.size);
+                nt_status = get_trustdom_auth_blob(dce_call, mem_ctx,
+                                                   &auth_blob, &auth_struct);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
 
                 if (op == NDR_LSA_CREATETRUSTEDDOMAINEX) {
@@ -822 +949 @@
 
         if (auth_struct.incoming.count) {
-                int i;
-                struct trustAuthInOutBlob incoming;
-                
-                incoming.count = auth_struct.incoming.count;
-                incoming.current = talloc(mem_ctx, struct AuthenticationInformationArray);
-                if (!incoming.current) {
-                        return NT_STATUS_NO_MEMORY;
-                }
-                
-                incoming.current->array = *auth_struct.incoming.current;
-                if (!incoming.current->array) {
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                incoming.previous = talloc(mem_ctx, struct AuthenticationInformationArray);
-                if (!incoming.previous) {
-                        return NT_STATUS_NO_MEMORY;
-                }
-                incoming.previous->array = talloc_array(mem_ctx, struct AuthenticationInformation, incoming.count);
-                if (!incoming.previous->array) {
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                for (i = 0; i < incoming.count; i++) {
-                        incoming.previous->array[i].LastUpdateTime = 0;
-                        incoming.previous->array[i].AuthType = 0;
-                }
-                ndr_err = ndr_push_struct_blob(&trustAuthIncoming, mem_ctx, 
-                                               lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx),
-                                               &incoming,
-                                               (ndr_push_flags_fn_t)ndr_push_trustAuthInOutBlob);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        return NT_STATUS_INVALID_PARAMETER;
+                nt_status = get_trustauth_inout_blob(dce_call, mem_ctx,
+                                                     &auth_struct.incoming,
+                                                     &trustAuthIncoming);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
                 }
         } else {
                 trustAuthIncoming = data_blob(NULL, 0);
         }
-        
+
         if (auth_struct.outgoing.count) {
-                int i;
-                struct trustAuthInOutBlob outgoing;
-                
-                outgoing.count = auth_struct.outgoing.count;
-                outgoing.current = talloc(mem_ctx, struct AuthenticationInformationArray);
-                if (!outgoing.current) {
-                        return NT_STATUS_NO_MEMORY;
-                }
-                
-                outgoing.current->array = *auth_struct.outgoing.current;
-                if (!outgoing.current->array) {
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                outgoing.previous = talloc(mem_ctx, struct AuthenticationInformationArray);
-                if (!outgoing.previous) {
-                        return NT_STATUS_NO_MEMORY;
-                }
-                outgoing.previous->array = talloc_array(mem_ctx, struct AuthenticationInformation, outgoing.count);
-                if (!outgoing.previous->array) {
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                for (i = 0; i < outgoing.count; i++) {
-                        outgoing.previous->array[i].LastUpdateTime = 0;
-                        outgoing.previous->array[i].AuthType = 0;
-                }
-                ndr_err = ndr_push_struct_blob(&trustAuthOutgoing, mem_ctx, 
-                                               lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx),
-                                               &outgoing,
-                                               (ndr_push_flags_fn_t)ndr_push_trustAuthInOutBlob);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        return NT_STATUS_INVALID_PARAMETER;
+                nt_status = get_trustauth_inout_blob(dce_call, mem_ctx,
+                                                     &auth_struct.outgoing,
+                                                     &trustAuthOutgoing);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
                 }
         } else {
@@ -899 +970 @@
         }
 
-        ret = ldb_transaction_start(policy_state->sam_ldb);
+        ret = ldb_transaction_start(sam_ldb);
         if (ret != LDB_SUCCESS) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -908 +979 @@
                 char *netbios_encoded = ldb_binary_encode_string(mem_ctx, netbios_name);
                 /* search for the trusted_domain record */
-                ret = gendb_search(policy_state->sam_ldb,
+                ret = gendb_search(sam_ldb,
                                    mem_ctx, policy_state->system_dn, &msgs, attrs,
-                                   "(&(|(flatname=%s)(cn=%s)(trustPartner=%s)(flatname=%s)(cn=%s)(trustPartner=%s))(objectclass=trustedDomain))", 
+                                   "(&(|(flatname=%s)(cn=%s)(trustPartner=%s)(flatname=%s)(cn=%s)(trustPartner=%s))(objectclass=trustedDomain))",
                                    dns_encoded, dns_encoded, dns_encoded, netbios_encoded, netbios_encoded, netbios_encoded);
                 if (ret > 0) {
-                        ldb_transaction_cancel(policy_state->sam_ldb);
+                        ldb_transaction_cancel(sam_ldb);
                         return NT_STATUS_OBJECT_NAME_COLLISION;
                 }
@@ -919 +990 @@
                 char *netbios_encoded = ldb_binary_encode_string(mem_ctx, netbios_name);
                 /* search for the trusted_domain record */
-                ret = gendb_search(policy_state->sam_ldb,
+                ret = gendb_search(sam_ldb,
                                    mem_ctx, policy_state->system_dn, &msgs, attrs,
-                                   "(&(|(flatname=%s)(cn=%s)(trustPartner=%s))(objectclass=trustedDomain))", 
+                                   "(&(|(flatname=%s)(cn=%s)(trustPartner=%s))(objectclass=trustedDomain))",
                                    netbios_encoded, netbios_encoded, netbios_encoded);
                 if (ret > 0) {
-                        ldb_transaction_cancel(policy_state->sam_ldb);
+                        ldb_transaction_cancel(sam_ldb);
                         return NT_STATUS_OBJECT_NAME_COLLISION;
                 }
         }
-        
+
         if (ret < 0 ) {
-                ldb_transaction_cancel(policy_state->sam_ldb);
+                ldb_transaction_cancel(sam_ldb);
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
-        
+
         name = dns_name ? dns_name : netbios_name;
 
@@ -943 +1014 @@
         msg->dn = ldb_dn_copy(mem_ctx, policy_state->system_dn);
         if ( ! ldb_dn_add_child_fmt(msg->dn, "cn=%s", name)) {
-                        ldb_transaction_cancel(policy_state->sam_ldb);
-                return NT_STATUS_NO_MEMORY;
-        }
-        
-        samdb_msg_add_string(trusted_domain_state->policy->sam_ldb, mem_ctx, msg, "flatname", netbios_name);
+                        ldb_transaction_cancel(sam_ldb);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ldb_msg_add_string(msg, "flatname", netbios_name);
 
         if (r->in.info->sid) {
-                const char *sid_string = dom_sid_string(mem_ctx, r->in.info->sid);
-                if (!sid_string) {
-                        ldb_transaction_cancel(policy_state->sam_ldb);
-                        return NT_STATUS_NO_MEMORY;
-                }
-                        
-                samdb_msg_add_string(trusted_domain_state->policy->sam_ldb, mem_ctx, msg, "securityIdentifier", sid_string);
-        }
-
-        samdb_msg_add_string(trusted_domain_state->policy->sam_ldb, mem_ctx, msg, "objectClass", "trustedDomain");
-
-        samdb_msg_add_int(trusted_domain_state->policy->sam_ldb, mem_ctx, msg, "trustType", r->in.info->trust_type);
-
-        samdb_msg_add_int(trusted_domain_state->policy->sam_ldb, mem_ctx, msg, "trustAttributes", r->in.info->trust_attributes);
-
-        samdb_msg_add_int(trusted_domain_state->policy->sam_ldb, mem_ctx, msg, "trustDirection", r->in.info->trust_direction);
-        
+                ret = samdb_msg_add_dom_sid(sam_ldb, mem_ctx, msg, "securityIdentifier", r->in.info->sid);
+                if (ret != LDB_SUCCESS) {
+                        ldb_transaction_cancel(sam_ldb);
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+        }
+
+        ldb_msg_add_string(msg, "objectClass", "trustedDomain");
+
+        samdb_msg_add_int(sam_ldb, mem_ctx, msg, "trustType", r->in.info->trust_type);
+
+        samdb_msg_add_int(sam_ldb, mem_ctx, msg, "trustAttributes", r->in.info->trust_attributes);
+
+        samdb_msg_add_int(sam_ldb, mem_ctx, msg, "trustDirection", r->in.info->trust_direction);
+
         if (dns_name) {
-                samdb_msg_add_string(trusted_domain_state->policy->sam_ldb, mem_ctx, msg, "trustPartner", dns_name);
+                ldb_msg_add_string(msg, "trustPartner", dns_name);
         }
 
@@ -974 +1043 @@
                 ret = ldb_msg_add_value(msg, "trustAuthIncoming", &trustAuthIncoming, NULL);
                 if (ret != LDB_SUCCESS) {
-                        ldb_transaction_cancel(policy_state->sam_ldb);
+                        ldb_transaction_cancel(sam_ldb);
                         return NT_STATUS_NO_MEMORY;
                 }
@@ -981 +1050 @@
                 ret = ldb_msg_add_value(msg, "trustAuthOutgoing", &trustAuthOutgoing, NULL);
                 if (ret != LDB_SUCCESS) {
-                        ldb_transaction_cancel(policy_state->sam_ldb);
+                        ldb_transaction_cancel(sam_ldb);
                         return NT_STATUS_NO_MEMORY;
                 }
@@ -989 +1058 @@
 
         /* create the trusted_domain */
-        ret = ldb_add(trusted_domain_state->policy->sam_ldb, msg);
+        ret = ldb_add(sam_ldb, msg);
         switch (ret) {
         case  LDB_SUCCESS:
                 break;
         case  LDB_ERR_ENTRY_ALREADY_EXISTS:
-                ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
+                ldb_transaction_cancel(sam_ldb);
                 DEBUG(0,("Failed to create trusted domain record %s: %s\n",
                          ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(trusted_domain_state->policy->sam_ldb)));
+                         ldb_errstring(sam_ldb)));
                 return NT_STATUS_DOMAIN_EXISTS;
         case  LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
-                ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
+                ldb_transaction_cancel(sam_ldb);
                 DEBUG(0,("Failed to create trusted domain record %s: %s\n",
                          ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(trusted_domain_state->policy->sam_ldb)));
+                         ldb_errstring(sam_ldb)));
                 return NT_STATUS_ACCESS_DENIED;
         default:
-                ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
+                ldb_transaction_cancel(sam_ldb);
                 DEBUG(0,("Failed to create user record %s: %s\n",
                          ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(trusted_domain_state->policy->sam_ldb)));
+                         ldb_errstring(sam_ldb)));
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
         if (r->in.info->trust_direction & LSA_TRUST_DIRECTION_INBOUND) {
-                msg_user = ldb_msg_new(mem_ctx);
-                if (msg_user == NULL) {
-                        ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
-                        return NT_STATUS_NO_MEMORY;
-                }
-
+                struct ldb_dn *user_dn;
                 /* Inbound trusts must also create a cn=users object to match */
-
-                trusted_domain_state->trusted_domain_user_dn = msg_user->dn
-                        = ldb_dn_copy(trusted_domain_state, policy_state->domain_dn);
-                if ( ! ldb_dn_add_child_fmt(msg_user->dn, "cn=users")) {
-                        ldb_transaction_cancel(policy_state->sam_ldb);
-                        return NT_STATUS_NO_MEMORY;
-                }
-        
-                if ( ! ldb_dn_add_child_fmt(msg_user->dn, "cn=%s", netbios_name)) {
-                        ldb_transaction_cancel(policy_state->sam_ldb);
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                ldb_msg_add_string(msg_user, "objectClass", "user");
-
-                ldb_msg_add_steal_string(msg_user, "samAccountName", 
-                                         talloc_asprintf(mem_ctx, "%s$", netbios_name));
-
-                if (samdb_msg_add_uint(trusted_domain_state->policy->sam_ldb, mem_ctx, msg_user, 
-                                       "userAccountControl", 
-                                       UF_INTERDOMAIN_TRUST_ACCOUNT) != 0) { 
-                        ldb_transaction_cancel(policy_state->sam_ldb);
-                        return NT_STATUS_NO_MEMORY; 
-                }
-
-                if (auth_struct.incoming.count) {
-                        int i;
-                        for (i=0; i < auth_struct.incoming.count; i++ ) {
-                                if (auth_struct.incoming.current[i]->AuthType == TRUST_AUTH_TYPE_NT4OWF) {
-                                        samdb_msg_add_hash(trusted_domain_state->policy->sam_ldb, 
-                                                           mem_ctx, msg_user, "unicodePwd", 
-                                                           &auth_struct.incoming.current[i]->AuthInfo.nt4owf.password);
-                                } else if (auth_struct.incoming.current[i]->AuthType == TRUST_AUTH_TYPE_CLEAR) {
-                                        DATA_BLOB new_password = data_blob_const(auth_struct.incoming.current[i]->AuthInfo.clear.password,
-                                                                                 auth_struct.incoming.current[i]->AuthInfo.clear.size);
-                                        ret = ldb_msg_add_value(msg_user, "clearTextPassword", &new_password, NULL);
-                                        if (ret != LDB_SUCCESS) {
-                                                ldb_transaction_cancel(policy_state->sam_ldb);
-                                                return NT_STATUS_NO_MEMORY;
-                                        }
-                                } 
-                        }
-                }
-
-                /* create the cn=users trusted_domain account */
-                ret = ldb_add(trusted_domain_state->policy->sam_ldb, msg_user);
-                switch (ret) {
-                case  LDB_SUCCESS:
-                        break;
-                case  LDB_ERR_ENTRY_ALREADY_EXISTS:
-                        ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
-                        DEBUG(0,("Failed to create trusted domain record %s: %s\n",
-                                 ldb_dn_get_linearized(msg_user->dn),
-                                 ldb_errstring(trusted_domain_state->policy->sam_ldb)));
-                        return NT_STATUS_DOMAIN_EXISTS;
-                case  LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
-                        ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
-                        DEBUG(0,("Failed to create trusted domain record %s: %s\n",
-                                 ldb_dn_get_linearized(msg_user->dn),
-                                 ldb_errstring(trusted_domain_state->policy->sam_ldb)));
-                        return NT_STATUS_ACCESS_DENIED;
-                default:
-                        ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
-                        DEBUG(0,("Failed to create user record %s: %s\n",
-                                 ldb_dn_get_linearized(msg_user->dn),
-                                 ldb_errstring(trusted_domain_state->policy->sam_ldb)));
-                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
-                }
-        }
-
-        ret = ldb_transaction_commit(policy_state->sam_ldb);
+                nt_status = add_trust_user(mem_ctx, sam_ldb,
+                                           policy_state->domain_dn,
+                                           netbios_name,
+                                           &auth_struct.incoming,
+                                           &user_dn);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        ldb_transaction_cancel(sam_ldb);
+                        return nt_status;
+                }
+
+                /* save the trust user dn */
+                trusted_domain_state->trusted_domain_user_dn
+                        = talloc_steal(trusted_domain_state, user_dn);
+        }
+
+        ret = ldb_transaction_commit(sam_ldb);
         if (ret != LDB_SUCCESS) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -1100 +1109 @@
                 return NT_STATUS_NO_MEMORY;
         }
-        
+
         handle->data = talloc_steal(handle, trusted_domain_state);
-        
+
         trusted_domain_state->access_mask = r->in.access_mask;
         trusted_domain_state->policy = talloc_reference(trusted_domain_state, policy_state);
-        
+
         *r->out.trustdom_handle = handle->wire_handle;
-        
+
         return NT_STATUS_OK;
 }
@@ -1224 +1233 @@
                 ret = gendb_search(trusted_domain_state->policy->sam_ldb,
                                    mem_ctx, policy_state->domain_dn, &msgs, attrs,
-                                   "(&(samaccountname=%s$)(objectclass=user)(userAccountControl:1.2.840.113556.1.4.803:=%d))", 
+                                   "(&(samaccountname=%s$)(objectclass=user)(userAccountControl:1.2.840.113556.1.4.803:=%u))",
                                    flatname, UF_INTERDOMAIN_TRUST_ACCOUNT);
                 if (ret == 1) {
@@ -1254 +1263 @@
 {
         struct dcesrv_handle *policy_handle;
-        
+
         struct lsa_policy_state *policy_state;
         struct lsa_trusted_domain_state *trusted_domain_state;
@@ -1262 +1271 @@
                 NULL
         };
-
+        char *td_name;
         int ret;
 
@@ -1272 +1281 @@
                 return NT_STATUS_INVALID_PARAMETER;
         }
-        
+
         trusted_domain_state = talloc_zero(mem_ctx, struct lsa_trusted_domain_state);
         if (!trusted_domain_state) {
@@ -1280 +1289 @@
 
         /* search for the trusted_domain record */
+        td_name = ldb_binary_encode_string(mem_ctx, r->in.name.string);
         ret = gendb_search(trusted_domain_state->policy->sam_ldb,
                            mem_ctx, policy_state->system_dn, &msgs, attrs,
-                           "(&(flatname=%s)(objectclass=trustedDomain))", 
-                           ldb_binary_encode_string(mem_ctx, r->in.name.string));
+                           "(&(|(flatname=%s)(cn=%s)(trustPartner=%s))"
+                             "(objectclass=trustedDomain))",
+                           td_name, td_name, td_name);
         if (ret == 0) {
                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
         }
-        
+
         if (ret != 1) {
                 DEBUG(0,("Found %d records matching DN %s\n", ret,
@@ -1294 +1305 @@
         }
 
+        /* TODO: perform access checks */
+
         trusted_domain_state->trusted_domain_dn = talloc_reference(trusted_domain_state, msgs[0]->dn);
-        
+
         handle = dcesrv_handle_new(dce_call->context, LSA_HANDLE_TRUSTED_DOMAIN);
         if (!handle) {
                 return NT_STATUS_NO_MEMORY;
         }
-        
+
         handle->data = talloc_steal(handle, trusted_domain_state);
-        
+
         trusted_domain_state->access_mask = r->in.access_mask;
         trusted_domain_state->policy = talloc_reference(trusted_domain_state, policy_state);
-        
+
         *r->out.trustdom_handle = handle->wire_handle;
-        
+
         return NT_STATUS_OK;
 }
@@ -1324 +1337 @@
 
 
-/* 
+/* parameters 4 to 6 are optional if the dn is a dn of a TDO object,
+ * otherwise at least one must be provided */
+static NTSTATUS get_tdo(struct ldb_context *sam, TALLOC_CTX *mem_ctx,
+                        struct ldb_dn *basedn, const char *dns_domain,
+                        const char *netbios, struct dom_sid2 *sid,
+                        struct ldb_message ***msgs)
+{
+        const char *attrs[] = { "flatname", "trustPartner",
+                                "securityIdentifier", "trustDirection",
+                                "trustType", "trustAttributes",
+                                "trustPosixOffset",
+                                "msDs-supportedEncryptionTypes", NULL };
+        char *dns = NULL;
+        char *nbn = NULL;
+        char *sidstr = NULL;
+        char *filter;
+        int ret;
+
+
+        if (dns_domain || netbios || sid) {
+                filter = talloc_strdup(mem_ctx,
+                                   "(&(objectclass=trustedDomain)(|");
+        } else {
+                filter = talloc_strdup(mem_ctx,
+                                       "(objectclass=trustedDomain)");
+        }
+        if (!filter) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (dns_domain) {
+                dns = ldb_binary_encode_string(mem_ctx, dns_domain);
+                if (!dns) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                filter = talloc_asprintf_append(filter,
+                                                "(trustPartner=%s)", dns);
+                if (!filter) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+        if (netbios) {
+                nbn = ldb_binary_encode_string(mem_ctx, netbios);
+                if (!nbn) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                filter = talloc_asprintf_append(filter,
+                                                "(flatname=%s)", nbn);
+                if (!filter) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+        if (sid) {
+                sidstr = dom_sid_string(mem_ctx, sid);
+                if (!sidstr) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+                filter = talloc_asprintf_append(filter,
+                                                "(securityIdentifier=%s)",
+                                                sidstr);
+                if (!filter) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+        if (dns_domain || netbios || sid) {
+                filter = talloc_asprintf_append(filter, "))");
+                if (!filter) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+
+        ret = gendb_search(sam, mem_ctx, basedn, msgs, attrs, "%s", filter);
+        if (ret == 0) {
+                return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+        }
+
+        if (ret != 1) {
+                return NT_STATUS_OBJECT_NAME_COLLISION;
+        }
+
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS update_uint32_t_value(TALLOC_CTX *mem_ctx,
+                                      struct ldb_context *sam_ldb,
+                                      struct ldb_message *orig,
+                                      struct ldb_message *dest,
+                                      const char *attribute,
+                                      uint32_t value,
+                                      uint32_t *orig_value)
+{
+        const struct ldb_val *orig_val;
+        uint32_t orig_uint = 0;
+        int flags = 0;
+        int ret;
+
+        orig_val = ldb_msg_find_ldb_val(orig, attribute);
+        if (!orig_val || !orig_val->data) {
+                /* add new attribute */
+                flags = LDB_FLAG_MOD_ADD;
+
+        } else {
+                errno = 0;
+                orig_uint = strtoul((const char *)orig_val->data, NULL, 0);
+                if (errno != 0 || orig_uint != value) {
+                        /* replace also if can't get value */
+                        flags = LDB_FLAG_MOD_REPLACE;
+                }
+        }
+
+        if (flags == 0) {
+                /* stored value is identical, nothing to change */
+                goto done;
+        }
+
+        ret = ldb_msg_add_empty(dest, attribute, flags, NULL);
+        if (ret != LDB_SUCCESS) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ret = samdb_msg_add_uint(sam_ldb, dest, dest, attribute, value);
+        if (ret != LDB_SUCCESS) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+done:
+        if (orig_value) {
+                *orig_value = orig_uint;
+        }
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS update_trust_user(TALLOC_CTX *mem_ctx,
+                                  struct ldb_context *sam_ldb,
+                                  struct ldb_dn *base_dn,
+                                  bool delete_user,
+                                  const char *netbios_name,
+                                  struct trustAuthInOutBlob *in)
+{
+        const char *attrs[] = { "userAccountControl", NULL };
+        struct ldb_message **msgs;
+        struct ldb_message *msg;
+        uint32_t uac;
+        uint32_t i;
+        int ret;
+
+        ret = gendb_search(sam_ldb, mem_ctx,
+                           base_dn, &msgs, attrs,
+                           "samAccountName=%s$", netbios_name);
+        if (ret > 1) {
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+
+        if (ret == 0) {
+                if (delete_user) {
+                        return NT_STATUS_OK;
+                }
+
+                /* ok no existing user, add it from scratch */
+                return add_trust_user(mem_ctx, sam_ldb, base_dn,
+                                      netbios_name, in, NULL);
+        }
+
+        /* check user is what we are looking for */
+        uac = ldb_msg_find_attr_as_uint(msgs[0],
+                                        "userAccountControl", 0);
+        if (!(uac & UF_INTERDOMAIN_TRUST_ACCOUNT)) {
+                return NT_STATUS_OBJECT_NAME_COLLISION;
+        }
+
+        if (delete_user) {
+                ret = ldb_delete(sam_ldb, msgs[0]->dn);
+                switch (ret) {
+                case LDB_SUCCESS:
+                        return NT_STATUS_OK;
+                case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
+                        return NT_STATUS_ACCESS_DENIED;
+                default:
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+        }
+
+        /* entry exists, just modify secret if any */
+        if (in->count == 0) {
+                return NT_STATUS_OK;
+        }
+
+        msg = ldb_msg_new(mem_ctx);
+        if (!msg) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        msg->dn = msgs[0]->dn;
+
+        for (i = 0; i < in->count; i++) {
+                const char *attribute;
+                struct ldb_val v;
+                switch (in->current.array[i].AuthType) {
+                case TRUST_AUTH_TYPE_NT4OWF:
+                        attribute = "unicodePwd";
+                        v.data = (uint8_t *)&in->current.array[i].AuthInfo.nt4owf.password;
+                        v.length = 16;
+                        break;
+                case TRUST_AUTH_TYPE_CLEAR:
+                        attribute = "clearTextPassword";
+                        v.data = in->current.array[i].AuthInfo.clear.password;
+                        v.length = in->current.array[i].AuthInfo.clear.size;
+                        break;
+                default:
+                        continue;
+                }
+
+                ret = ldb_msg_add_empty(msg, attribute,
+                                        LDB_FLAG_MOD_REPLACE, NULL);
+                if (ret != LDB_SUCCESS) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+
+                ret = ldb_msg_add_value(msg, attribute, &v, NULL);
+                if (ret != LDB_SUCCESS) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+
+        /* create the trusted_domain user account */
+        ret = ldb_modify(sam_ldb, msg);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,("Failed to create user record %s: %s\n",
+                         ldb_dn_get_linearized(msg->dn),
+                         ldb_errstring(sam_ldb)));
+
+                switch (ret) {
+                case LDB_ERR_ENTRY_ALREADY_EXISTS:
+                        return NT_STATUS_DOMAIN_EXISTS;
+                case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
+                        return NT_STATUS_ACCESS_DENIED;
+                default:
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+        }
+
+        return NT_STATUS_OK;
+}
+
+
+static NTSTATUS setInfoTrustedDomain_base(struct dcesrv_call_state *dce_call,
+                                          struct dcesrv_handle *p_handle,
+                                          TALLOC_CTX *mem_ctx,
+                                          struct ldb_message *dom_msg,
+                                          enum lsa_TrustDomInfoEnum level,
+                                          union lsa_TrustedDomainInfo *info)
+{
+        struct lsa_policy_state *p_state = p_handle->data;
+        uint32_t *posix_offset = NULL;
+        struct lsa_TrustDomainInfoInfoEx *info_ex = NULL;
+        struct lsa_TrustDomainInfoAuthInfo *auth_info = NULL;
+        struct lsa_TrustDomainInfoAuthInfoInternal *auth_info_int = NULL;
+        uint32_t *enc_types = NULL;
+        DATA_BLOB trustAuthIncoming, trustAuthOutgoing, auth_blob;
+        struct trustDomainPasswords auth_struct;
+        NTSTATUS nt_status;
+        struct ldb_message **msgs;
+        struct ldb_message *msg;
+        bool add_outgoing = false;
+        bool add_incoming = false;
+        bool del_outgoing = false;
+        bool del_incoming = false;
+        bool in_transaction = false;
+        int ret;
+        bool am_rodc;
+
+        switch (level) {
+        case LSA_TRUSTED_DOMAIN_INFO_POSIX_OFFSET:
+                posix_offset = &info->posix_offset.posix_offset;
+                break;
+        case LSA_TRUSTED_DOMAIN_INFO_INFO_EX:
+                info_ex = &info->info_ex;
+                break;
+        case LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO:
+                auth_info = &info->auth_info;
+                break;
+        case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO:
+                posix_offset = &info->full_info.posix_offset.posix_offset;
+                info_ex = &info->full_info.info_ex;
+                auth_info = &info->full_info.auth_info;
+                break;
+        case LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO_INTERNAL:
+                auth_info_int = &info->auth_info_internal;
+                break;
+        case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_INTERNAL:
+                posix_offset = &info->full_info_internal.posix_offset.posix_offset;
+                info_ex = &info->full_info_internal.info_ex;
+                auth_info_int = &info->full_info_internal.auth_info;
+                break;
+        case LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES:
+                enc_types = &info->enc_types.enc_types;
+                break;
+        default:
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        if (auth_info) {
+                /* FIXME: not handled yet */
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        /* decode auth_info_int if set */
+        if (auth_info_int) {
+
+                /* now decrypt blob */
+                auth_blob = data_blob_const(auth_info_int->auth_blob.data,
+                                            auth_info_int->auth_blob.size);
+
+                nt_status = get_trustdom_auth_blob(dce_call, mem_ctx,
+                                                   &auth_blob, &auth_struct);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+        }
+
+        if (info_ex) {
+                /* verify data matches */
+                if (info_ex->trust_attributes &
+                    LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
+                        /* TODO: check what behavior level we have */
+                       if (strcasecmp_m(p_state->domain_dns,
+                                        p_state->forest_dns) != 0) {
+                                return NT_STATUS_INVALID_DOMAIN_STATE;
+                        }
+                }
+
+                ret = samdb_rodc(p_state->sam_ldb, &am_rodc);
+                if (ret == LDB_SUCCESS && am_rodc) {
+                        return NT_STATUS_NO_SUCH_DOMAIN;
+                }
+
+                /* verify only one object matches the dns/netbios/sid
+                 * triplet and that this is the one we already have */
+                nt_status = get_tdo(p_state->sam_ldb, mem_ctx,
+                                    p_state->system_dn,
+                                    info_ex->domain_name.string,
+                                    info_ex->netbios_name.string,
+                                    info_ex->sid, &msgs);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+                if (ldb_dn_compare(dom_msg->dn, msgs[0]->dn) != 0) {
+                        return NT_STATUS_OBJECT_NAME_COLLISION;
+                }
+                talloc_free(msgs);
+        }
+
+        /* TODO: should we fetch previous values from the existing entry
+         * and append them ? */
+        if (auth_struct.incoming.count) {
+                nt_status = get_trustauth_inout_blob(dce_call, mem_ctx,
+                                                     &auth_struct.incoming,
+                                                     &trustAuthIncoming);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+        } else {
+                trustAuthIncoming = data_blob(NULL, 0);
+        }
+
+        if (auth_struct.outgoing.count) {
+                nt_status = get_trustauth_inout_blob(dce_call, mem_ctx,
+                                                     &auth_struct.outgoing,
+                                                     &trustAuthOutgoing);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+        } else {
+                trustAuthOutgoing = data_blob(NULL, 0);
+        }
+
+        msg = ldb_msg_new(mem_ctx);
+        if (msg == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        msg->dn = dom_msg->dn;
+
+        if (posix_offset) {
+                nt_status = update_uint32_t_value(mem_ctx, p_state->sam_ldb,
+                                                  dom_msg, msg,
+                                                  "trustPosixOffset",
+                                                  *posix_offset, NULL);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+        }
+
+        if (info_ex) {
+                uint32_t origattrs;
+                uint32_t origdir;
+                uint32_t tmp;
+                int origtype;
+
+                nt_status = update_uint32_t_value(mem_ctx, p_state->sam_ldb,
+                                                  dom_msg, msg,
+                                                  "trustDirection",
+                                                  info_ex->trust_direction,
+                                                  &origdir);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+
+                tmp = info_ex->trust_direction ^ origdir;
+                if (tmp & LSA_TRUST_DIRECTION_INBOUND) {
+                        if (origdir & LSA_TRUST_DIRECTION_INBOUND) {
+                                del_incoming = true;
+                        } else {
+                                add_incoming = true;
+                        }
+                }
+                if (tmp & LSA_TRUST_DIRECTION_OUTBOUND) {
+                        if (origdir & LSA_TRUST_DIRECTION_OUTBOUND) {
+                                del_outgoing = true;
+                        } else {
+                                add_outgoing = true;
+                        }
+                }
+
+                origtype = ldb_msg_find_attr_as_int(dom_msg, "trustType", -1);
+                if (origtype == -1 || origtype != info_ex->trust_type) {
+                        DEBUG(1, ("Attempted to change trust type! "
+                                  "Operation not handled\n"));
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                nt_status = update_uint32_t_value(mem_ctx, p_state->sam_ldb,
+                                                  dom_msg, msg,
+                                                  "trustAttributes",
+                                                  info_ex->trust_attributes,
+                                                  &origattrs);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+                /* TODO: check forestFunctionality from ldb opaque */
+                /* TODO: check what is set makes sense */
+                /* for now refuse changes */
+                if (origattrs == -1 ||
+                    origattrs != info_ex->trust_attributes) {
+                        DEBUG(1, ("Attempted to change trust attributes! "
+                                  "Operation not handled\n"));
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+        }
+
+        if (enc_types) {
+                nt_status = update_uint32_t_value(mem_ctx, p_state->sam_ldb,
+                                                  dom_msg, msg,
+                                                  "msDS-SupportedEncryptionTypes",
+                                                  *enc_types, NULL);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+        }
+
+        if (add_incoming && trustAuthIncoming.data) {
+                ret = ldb_msg_add_empty(msg, "trustAuthIncoming",
+                                        LDB_FLAG_MOD_REPLACE, NULL);
+                if (ret != LDB_SUCCESS) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                ret = ldb_msg_add_value(msg, "trustAuthIncoming",
+                                        &trustAuthIncoming, NULL);
+                if (ret != LDB_SUCCESS) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+        if (add_outgoing && trustAuthOutgoing.data) {
+                ret = ldb_msg_add_empty(msg, "trustAuthIncoming",
+                                        LDB_FLAG_MOD_REPLACE, NULL);
+                if (ret != LDB_SUCCESS) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                ret = ldb_msg_add_value(msg, "trustAuthOutgoing",
+                                        &trustAuthOutgoing, NULL);
+                if (ret != LDB_SUCCESS) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+        }
+
+        /* start transaction */
+        ret = ldb_transaction_start(p_state->sam_ldb);
+        if (ret != LDB_SUCCESS) {
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+        in_transaction = true;
+
+        ret = ldb_modify(p_state->sam_ldb, msg);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(1,("Failed to modify trusted domain record %s: %s\n",
+                         ldb_dn_get_linearized(msg->dn),
+                         ldb_errstring(p_state->sam_ldb)));
+                if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
+                        nt_status = NT_STATUS_ACCESS_DENIED;
+                } else {
+                        nt_status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+                goto done;
+        }
+
+        if (add_incoming || del_incoming) {
+                const char *netbios_name;
+
+                netbios_name = ldb_msg_find_attr_as_string(dom_msg,
+                                                           "flatname", NULL);
+                if (!netbios_name) {
+                        nt_status = NT_STATUS_INVALID_DOMAIN_STATE;
+                        goto done;
+                }
+
+                nt_status = update_trust_user(mem_ctx,
+                                              p_state->sam_ldb,
+                                              p_state->domain_dn,
+                                              del_incoming,
+                                              netbios_name,
+                                              &auth_struct.incoming);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        goto done;
+                }
+        }
+
+        /* ok, all fine, commit transaction and return */
+        ret = ldb_transaction_commit(p_state->sam_ldb);
+        if (ret != LDB_SUCCESS) {
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+        in_transaction = false;
+
+        nt_status = NT_STATUS_OK;
+
+done:
+        if (in_transaction) {
+                ldb_transaction_cancel(p_state->sam_ldb);
+        }
+        return nt_status;
+}
+
+/*
   lsa_SetInfomrationTrustedDomain
 */
-static NTSTATUS dcesrv_lsa_SetInformationTrustedDomain(struct dcesrv_call_state *dce_call, 
-                                                TALLOC_CTX *mem_ctx,
-                                                struct lsa_SetInformationTrustedDomain *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+static NTSTATUS dcesrv_lsa_SetInformationTrustedDomain(
+                                struct dcesrv_call_state *dce_call,
+                                TALLOC_CTX *mem_ctx,
+                                struct lsa_SetInformationTrustedDomain *r)
+{
+        struct dcesrv_handle *h;
+        struct lsa_trusted_domain_state *td_state;
+        struct ldb_message **msgs;
+        NTSTATUS nt_status;
+
+        DCESRV_PULL_HANDLE(h, r->in.trustdom_handle,
+                           LSA_HANDLE_TRUSTED_DOMAIN);
+
+        td_state = talloc_get_type(h->data, struct lsa_trusted_domain_state);
+
+        /* get the trusted domain object */
+        nt_status = get_tdo(td_state->policy->sam_ldb, mem_ctx,
+                            td_state->trusted_domain_dn,
+                            NULL, NULL, NULL, &msgs);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                if (NT_STATUS_EQUAL(nt_status,
+                                    NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+                        return nt_status;
+                }
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+
+        return setInfoTrustedDomain_base(dce_call, h, mem_ctx,
+                                         msgs[0], r->in.level, r->in.info);
 }
 
@@ -1433 +2010 @@
         case LSA_TRUSTED_DOMAIN_INFO_NAME:
                 info->name.netbios_name.string
-                        = samdb_result_string(msg, "flatname", NULL);                                      
+                        = ldb_msg_find_attr_as_string(msg, "flatname", NULL);
                 break;
         case LSA_TRUSTED_DOMAIN_INFO_POSIX_OFFSET:
                 info->posix_offset.posix_offset
-                        = samdb_result_uint(msg, "posixOffset", 0);                                        
+                        = ldb_msg_find_attr_as_uint(msg, "posixOffset", 0);
                 break;
 #if 0  /* Win2k3 doesn't implement this */
@@ -1453 +2030 @@
                 ZERO_STRUCT(info->full_info);
                 return fill_trust_domain_ex(mem_ctx, msg, &info->full_info.info_ex);
-
         case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_2_INTERNAL:
                 ZERO_STRUCT(info->full_info2_internal);
                 info->full_info2_internal.posix_offset.posix_offset
-                        = samdb_result_uint(msg, "posixOffset", 0);                                        
+                        = ldb_msg_find_attr_as_uint(msg, "posixOffset", 0);
                 return fill_trust_domain_ex(mem_ctx, msg, &info->full_info2_internal.info.info_ex);
                 
         case LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES:
                 info->enc_types.enc_types
-                        = samdb_result_uint(msg, "msDs-supportedEncryptionTypes", KERB_ENCTYPE_RC4_HMAC_MD5);
+                        = ldb_msg_find_attr_as_uint(msg, "msDs-supportedEncryptionTypes", KERB_ENCTYPE_RC4_HMAC_MD5);
                 break;
 
@@ -1527 +2103 @@
                                                struct lsa_SetTrustedDomainInfoByName *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        struct dcesrv_handle *policy_handle;
+        struct lsa_policy_state *policy_state;
+        struct ldb_message **msgs;
+        NTSTATUS nt_status;
+
+        DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
+        policy_state = policy_handle->data;
+
+        /* get the trusted domain object */
+        nt_status = get_tdo(policy_state->sam_ldb, mem_ctx,
+                            policy_state->domain_dn,
+                            r->in.trusted_domain->string,
+                            r->in.trusted_domain->string,
+                            NULL, &msgs);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                if (NT_STATUS_EQUAL(nt_status,
+                                    NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+                        return nt_status;
+                }
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+
+        return setInfoTrustedDomain_base(dce_call, policy_handle, mem_ctx,
+                                         msgs[0], r->in.level, r->in.info);
 }
 
@@ -1623 +2222 @@
         count = gendb_search(policy_state->sam_ldb, mem_ctx, policy_state->system_dn, &domains, attrs, 
                              "objectclass=trustedDomain");
-        if (count == -1) {
+        if (count < 0) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
@@ -1634 +2233 @@
         for (i=0;i<count;i++) {
                 entries[i].sid = samdb_result_dom_sid(mem_ctx, domains[i], "securityIdentifier");
-                entries[i].name.string = samdb_result_string(domains[i], "flatname", NULL);
+                entries[i].name.string = ldb_msg_find_attr_as_string(domains[i], "flatname", NULL);
         }
 
         /* sort the results by name */
-        qsort(entries, count, sizeof(*entries), 
-              (comparison_fn_t)compare_DomainInfo);
+        TYPESAFE_QSORT(entries, count, compare_DomainInfo);
 
         if (*r->in.resume_handle >= count) {
@@ -1717 +2315 @@
         count = gendb_search(policy_state->sam_ldb, mem_ctx, policy_state->system_dn, &domains, attrs, 
                              "objectclass=trustedDomain");
-        if (count == -1) {
+        if (count < 0) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
@@ -1734 +2332 @@
 
         /* sort the results by name */
-        qsort(entries, count, sizeof(*entries), 
-              (comparison_fn_t)compare_TrustDomainInfoInfoEx);
+        TYPESAFE_QSORT(entries, count, compare_TrustDomainInfoInfoEx);
 
         if (*r->in.resume_handle >= count) {
@@ -1814 +2411 @@
         struct dcesrv_handle *h;
         struct lsa_account_state *astate;
-        int ret, i;
+        int ret;
+        unsigned int i, j;
         struct ldb_message **res;
         const char * const attrs[] = { "privilege", NULL};
@@ -1840 +2438 @@
         }
 
-        ret = gendb_search(astate->policy->sam_ldb, mem_ctx, NULL, &res, attrs, 
+        ret = gendb_search(astate->policy->pdb, mem_ctx, NULL, &res, attrs, 
                            "objectSid=%s", sidstr);
+        if (ret < 0) {
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
         if (ret != 1) {
                 return NT_STATUS_OK;
@@ -1857 +2458 @@
         }
 
+        j = 0;
         for (i=0;i<el->num_values;i++) {
                 int id = sec_privilege_id((const char *)el->values[i].data);
-                if (id == -1) {
-                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
-                }
-                privs->set[i].attribute = 0;
-                privs->set[i].luid.low = id;
-                privs->set[i].luid.high = 0;
-        }
-
-        privs->count = el->num_values;
+                if (id == SEC_PRIV_INVALID) {
+                        /* Perhaps an account right, not a privilege */
+                        continue;
+                }
+                privs->set[j].attribute = 0;
+                privs->set[j].luid.low = id;
+                privs->set[j].luid.high = 0;
+                j++;
+        }
+
+        privs->count = j;
 
         return NT_STATUS_OK;
@@ -1881 +2485 @@
         struct dcesrv_handle *h;
         struct lsa_policy_state *state;
-        int ret, i;
+        int ret;
+        unsigned int i;
         struct ldb_message **res;
         const char * const attrs[] = { "privilege", NULL};
@@ -1896 +2501 @@
         }
 
-        ret = gendb_search(state->sam_ldb, mem_ctx, NULL, &res, attrs, 
+        ret = gendb_search(state->pdb, mem_ctx, NULL, &res, attrs, 
                            "(&(objectSid=%s)(privilege=*))", sidstr);
         if (ret == 0) {
                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
         }
-        if (ret > 1) {
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-        if (ret == -1) {
+        if (ret != 1) {
                 DEBUG(3, ("searching for account rights for SID: %s failed: %s", 
                           dom_sid_string(mem_ctx, r->in.sid),
-                          ldb_errstring(state->sam_ldb)));
+                          ldb_errstring(state->pdb)));
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
@@ -1942 +2544 @@
                                            const struct lsa_RightSet *rights)
 {
-        const char *sidstr;
+        const char *sidstr, *sidndrstr;
         struct ldb_message *msg;
         struct ldb_message_element *el;
-        int i, ret;
+        int ret;
+        uint32_t i;
         struct lsa_EnumAccountRights r2;
-
-        sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
-        if (sidstr == NULL) {
-                return NT_STATUS_NO_MEMORY;
+        char *dnstr;
+
+        if (security_session_user_level(dce_call->conn->auth_state.session_info, NULL) <
+            SECURITY_ADMINISTRATOR) {
+                DEBUG(0,("lsa_AddRemoveAccount refused for supplied security token\n"));
+                return NT_STATUS_ACCESS_DENIED;
         }
 
@@ -1958 +2563 @@
         }
 
-        msg->dn = samdb_search_dn(state->sam_ldb, mem_ctx, 
-                                  NULL, "objectSid=%s", sidstr);
-        if (msg->dn == NULL) {
-                NTSTATUS status;
-                if (ldb_flag == LDB_FLAG_MOD_DELETE) {
-                        return NT_STATUS_OBJECT_NAME_NOT_FOUND;
-                }
-                status = samdb_create_foreign_security_principal(state->sam_ldb, mem_ctx, 
-                                                                 sid, &msg->dn);
-                if (!NT_STATUS_IS_OK(status)) {
-                        return status;
-                }
-                return NT_STATUS_NO_SUCH_USER;
-        }
-
-        if (ldb_msg_add_empty(msg, "privilege", ldb_flag, NULL)) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (ldb_flag == LDB_FLAG_MOD_ADD) {
+        sidndrstr = ldap_encode_ndr_dom_sid(msg, sid);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sidndrstr, msg);
+
+        sidstr = dom_sid_string(msg, sid);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sidstr, msg);
+
+        dnstr = talloc_asprintf(msg, "sid=%s", sidstr);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(dnstr, msg);
+
+        msg->dn = ldb_dn_new(msg, state->pdb, dnstr);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg->dn, msg);
+
+        if (LDB_FLAG_MOD_TYPE(ldb_flag) == LDB_FLAG_MOD_ADD) {
                 NTSTATUS status;
 
@@ -1991 +2589 @@
 
         for (i=0;i<rights->count;i++) {
-                if (sec_privilege_id(rights->names[i].string) == -1) {
+                if (sec_privilege_id(rights->names[i].string) == SEC_PRIV_INVALID) {
+                        if (sec_right_bit(rights->names[i].string) == 0) {
+                                talloc_free(msg);
+                                return NT_STATUS_NO_SUCH_PRIVILEGE;
+                        }
+
+                        talloc_free(msg);
                         return NT_STATUS_NO_SUCH_PRIVILEGE;
                 }
 
-                if (ldb_flag == LDB_FLAG_MOD_ADD) {
-                        int j;
+                if (LDB_FLAG_MOD_TYPE(ldb_flag) == LDB_FLAG_MOD_ADD) {
+                        uint32_t j;
                         for (j=0;j<r2.out.rights->count;j++) {
                                 if (strcasecmp_m(r2.out.rights->names[j].string, 
@@ -2008 +2612 @@
                 ret = ldb_msg_add_string(msg, "privilege", rights->names[i].string);
                 if (ret != LDB_SUCCESS) {
+                        talloc_free(msg);
                         return NT_STATUS_NO_MEMORY;
                 }
@@ -2014 +2619 @@
         el = ldb_msg_find_element(msg, "privilege");
         if (!el) {
+                talloc_free(msg);
                 return NT_STATUS_OK;
         }
 
-        ret = ldb_modify(state->sam_ldb, msg);
-        if (ret != 0) {
-                if (ldb_flag == LDB_FLAG_MOD_DELETE && ret == LDB_ERR_NO_SUCH_ATTRIBUTE) {
-                        return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+        el->flags = ldb_flag;
+
+        ret = ldb_modify(state->pdb, msg);
+        if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+                if (samdb_msg_add_dom_sid(state->pdb, msg, msg, "objectSid", sid) != LDB_SUCCESS) {
+                        talloc_free(msg);
+                        return NT_STATUS_NO_MEMORY;
+                }
+                ldb_msg_add_string(msg, "comment", "added via LSA");
+                ret = ldb_add(state->pdb, msg);         
+        }
+        if (ret != LDB_SUCCESS) {
+                if (LDB_FLAG_MOD_TYPE(ldb_flag) == LDB_FLAG_MOD_DELETE && ret == LDB_ERR_NO_SUCH_ATTRIBUTE) {
+                        talloc_free(msg);
+                        return NT_STATUS_OK;
                 }
                 DEBUG(3, ("Could not %s attributes from %s: %s", 
-                          ldb_flag == LDB_FLAG_MOD_DELETE ? "delete" : "add",
-                          ldb_dn_get_linearized(msg->dn), ldb_errstring(state->sam_ldb)));
+                          LDB_FLAG_MOD_TYPE(ldb_flag) == LDB_FLAG_MOD_DELETE ? "delete" : "add",
+                          ldb_dn_get_linearized(msg->dn), ldb_errstring(state->pdb)));
+                talloc_free(msg);
                 return NT_STATUS_UNEXPECTED_IO_ERROR;
         }
 
+        talloc_free(msg);
         return NT_STATUS_OK;
 }
@@ -2040 +2659 @@
         struct dcesrv_handle *h;
         struct lsa_account_state *astate;
-        int i;
+        uint32_t i;
 
         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_ACCOUNT);
@@ -2077 +2696 @@
         struct dcesrv_handle *h;
         struct lsa_account_state *astate;
-        int i;
+        uint32_t i;
 
         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_ACCOUNT);
@@ -2156 +2775 @@
                        struct lsa_GetSystemAccessAccount *r)
 {
-        int i;
-        NTSTATUS status;
-        struct lsa_EnumPrivsAccount enumPrivs;
-        struct lsa_PrivilegeSet *privs;
-
-        privs = talloc(mem_ctx, struct lsa_PrivilegeSet);
-        if (!privs) {
-                return NT_STATUS_NO_MEMORY;
-        }
-        privs->count = 0;
-        privs->unknown = 0;
-        privs->set = NULL;
-
-        enumPrivs.in.handle = r->in.handle;
-        enumPrivs.out.privs = &privs;
-
-        status = dcesrv_lsa_EnumPrivsAccount(dce_call, mem_ctx, &enumPrivs);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }       
+        struct dcesrv_handle *h;
+        struct lsa_account_state *astate;
+        int ret;
+        unsigned int i;
+        struct ldb_message **res;
+        const char * const attrs[] = { "privilege", NULL};
+        struct ldb_message_element *el;
+        const char *sidstr;
 
         *(r->out.access_mask) = 0x00000000;
 
-        for (i = 0; i < privs->count; i++) {
-                int priv = privs->set[i].luid.low;
-
-                switch (priv) {
-                case SEC_PRIV_INTERACTIVE_LOGON:
-                        *(r->out.access_mask) |= LSA_POLICY_MODE_INTERACTIVE;
-                        break;
-                case SEC_PRIV_NETWORK_LOGON:
-                        *(r->out.access_mask) |= LSA_POLICY_MODE_NETWORK;
-                        break;
-                case SEC_PRIV_REMOTE_INTERACTIVE_LOGON:
-                        *(r->out.access_mask) |= LSA_POLICY_MODE_REMOTE_INTERACTIVE;
-                        break;
-                }
+        DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_ACCOUNT);
+
+        astate = h->data;
+
+        sidstr = ldap_encode_ndr_dom_sid(mem_ctx, astate->account_sid);
+        if (sidstr == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ret = gendb_search(astate->policy->pdb, mem_ctx, NULL, &res, attrs, 
+                           "objectSid=%s", sidstr);
+        if (ret < 0) {
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+        if (ret != 1) {
+                return NT_STATUS_OK;
+        }
+
+        el = ldb_msg_find_element(res[0], "privilege");
+        if (el == NULL || el->num_values == 0) {
+                return NT_STATUS_OK;
+        }
+
+        for (i=0;i<el->num_values;i++) {
+                uint32_t right_bit = sec_right_bit((const char *)el->values[i].data);
+                if (right_bit == 0) {
+                        /* Perhaps an privilege, not a right */
+                        continue;
+                }
+                *(r->out.access_mask) |= right_bit;
         }
 
@@ -2231 +2854 @@
         ZERO_STRUCTP(r->out.sec_handle);
         
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
         {
         case SECURITY_SYSTEM:
@@ -2248 +2871 @@
         
         secret_state = talloc(mem_ctx, struct lsa_secret_state);
-        if (!secret_state) {
-                return NT_STATUS_NO_MEMORY;
-        }
+        NT_STATUS_HAVE_NO_MEMORY(secret_state);
         secret_state->policy = policy_state;
 
@@ -2260 +2881 @@
         if (strncmp("G$", r->in.name.string, 2) == 0) {
                 const char *name2;
+
+                secret_state->global = true;
+
                 name = &r->in.name.string[2];
-                        /* We need to connect to the database as system, as this is one of the rare RPC calls that must read the secrets (and this is denied otherwise) */
-                secret_state->sam_ldb = talloc_reference(secret_state, 
-                                                         samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(secret_state, dce_call->conn->dce_ctx->lp_ctx))); 
-                secret_state->global = true;
-
-                if (strlen(name) < 1) {
+                if (strlen(name) == 0) {
                         return NT_STATUS_INVALID_PARAMETER;
                 }
 
-                name2 = talloc_asprintf(mem_ctx, "%s Secret", ldb_binary_encode_string(mem_ctx, name));
+                name2 = talloc_asprintf(mem_ctx, "%s Secret",
+                                        ldb_binary_encode_string(mem_ctx, name));
+                NT_STATUS_HAVE_NO_MEMORY(name2);
+
+                /* We need to connect to the database as system, as this is one
+                 * of the rare RPC calls that must read the secrets (and this
+                 * is denied otherwise) */
+                secret_state->sam_ldb = talloc_reference(secret_state,
+                                                         samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(dce_call->conn->dce_ctx->lp_ctx), 0));
+                NT_STATUS_HAVE_NO_MEMORY(secret_state->sam_ldb);
+
                 /* search for the secret record */
                 ret = gendb_search(secret_state->sam_ldb,
@@ -2280 +2909 @@
                 }
                 
-                if (ret == -1) {
+                if (ret < 0) {
                         DEBUG(0,("Failure searching for CN=%s: %s\n", 
                                  name2, ldb_errstring(secret_state->sam_ldb)));
@@ -2287 +2916 @@
 
                 msg->dn = ldb_dn_copy(mem_ctx, policy_state->system_dn);
-                if (!name2 || ! ldb_dn_add_child_fmt(msg->dn, "cn=%s", name2)) {
+                NT_STATUS_HAVE_NO_MEMORY(msg->dn);
+                if (!ldb_dn_add_child_fmt(msg->dn, "cn=%s", name2)) {
                         return NT_STATUS_NO_MEMORY;
                 }
-                
-                samdb_msg_add_string(secret_state->sam_ldb, mem_ctx, msg, "cn", name2);
-        
+
+                ret = ldb_msg_add_string(msg, "cn", name2);
+                if (ret != LDB_SUCCESS) return NT_STATUS_NO_MEMORY;
         } else {
                 secret_state->global = false;
 
                 name = r->in.name.string;
-                if (strlen(name) < 1) {
+                if (strlen(name) == 0) {
                         return NT_STATUS_INVALID_PARAMETER;
                 }
 
                 secret_state->sam_ldb = talloc_reference(secret_state, 
-                                                         secrets_db_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx));
+                                                         secrets_db_connect(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+                NT_STATUS_HAVE_NO_MEMORY(secret_state->sam_ldb);
+
                 /* search for the secret record */
                 ret = gendb_search(secret_state->sam_ldb, mem_ctx,
@@ -2313 +2945 @@
                 }
                 
-                if (ret == -1) {
+                if (ret < 0) {
                         DEBUG(0,("Failure searching for CN=%s: %s\n", 
                                  name, ldb_errstring(secret_state->sam_ldb)));
@@ -2319 +2951 @@
                 }
 
-                msg->dn = ldb_dn_new_fmt(mem_ctx, secret_state->sam_ldb, "cn=%s,cn=LSA Secrets", name);
-                samdb_msg_add_string(secret_state->sam_ldb, mem_ctx, msg, "cn", name);
+                msg->dn = ldb_dn_new_fmt(mem_ctx, secret_state->sam_ldb,
+                                         "cn=%s,cn=LSA Secrets", name);
+                NT_STATUS_HAVE_NO_MEMORY(msg->dn);
+                ret = ldb_msg_add_string(msg, "cn", name);
+                if (ret != LDB_SUCCESS) return NT_STATUS_NO_MEMORY;
         } 
 
-        samdb_msg_add_string(secret_state->sam_ldb, mem_ctx, msg, "objectClass", "secret");
+        ret = ldb_msg_add_string(msg, "objectClass", "secret");
+        if (ret != LDB_SUCCESS) return NT_STATUS_NO_MEMORY;
         
         secret_state->secret_dn = talloc_reference(secret_state, msg->dn);
+        NT_STATUS_HAVE_NO_MEMORY(secret_state->secret_dn);
 
         /* create the secret */
         ret = ldb_add(secret_state->sam_ldb, msg);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 DEBUG(0,("Failed to create secret record %s: %s\n",
                          ldb_dn_get_linearized(msg->dn), 
@@ -2336 +2973 @@
         }
 
+        handle = dcesrv_handle_new(dce_call->context, LSA_HANDLE_SECRET);
+        NT_STATUS_HAVE_NO_MEMORY(handle);
+
+        handle->data = talloc_steal(handle, secret_state);
+        
+        secret_state->access_mask = r->in.access_mask;
+        secret_state->policy = talloc_reference(secret_state, policy_state);
+        NT_STATUS_HAVE_NO_MEMORY(secret_state->policy);
+        
+        *r->out.sec_handle = handle->wire_handle;
+        
+        return NT_STATUS_OK;
+}
+
+
+/* 
+  lsa_OpenSecret 
+*/
+static NTSTATUS dcesrv_lsa_OpenSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                               struct lsa_OpenSecret *r)
+{
+        struct dcesrv_handle *policy_handle;
+        
+        struct lsa_policy_state *policy_state;
+        struct lsa_secret_state *secret_state;
+        struct dcesrv_handle *handle;
+        struct ldb_message **msgs;
+        const char *attrs[] = {
+                NULL
+        };
+
+        const char *name;
+
+        int ret;
+
+        DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
+        ZERO_STRUCTP(r->out.sec_handle);
+        policy_state = policy_handle->data;
+
+        if (!r->in.name.string) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
+        {
+        case SECURITY_SYSTEM:
+        case SECURITY_ADMINISTRATOR:
+                break;
+        default:
+                /* Users and annonymous are not allowed to access secrets */
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        secret_state = talloc(mem_ctx, struct lsa_secret_state);
+        if (!secret_state) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        secret_state->policy = policy_state;
+
+        if (strncmp("G$", r->in.name.string, 2) == 0) {
+                name = &r->in.name.string[2];
+                /* We need to connect to the database as system, as this is one of the rare RPC calls that must read the secrets (and this is denied otherwise) */
+                secret_state->sam_ldb = talloc_reference(secret_state, 
+                                                         samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(dce_call->conn->dce_ctx->lp_ctx), 0));
+                secret_state->global = true;
+
+                if (strlen(name) < 1) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                /* search for the secret record */
+                ret = gendb_search(secret_state->sam_ldb,
+                                   mem_ctx, policy_state->system_dn, &msgs, attrs,
+                                   "(&(cn=%s Secret)(objectclass=secret))", 
+                                   ldb_binary_encode_string(mem_ctx, name));
+                if (ret == 0) {
+                        return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+                }
+                
+                if (ret != 1) {
+                        DEBUG(0,("Found %d records matching DN %s\n", ret,
+                                 ldb_dn_get_linearized(policy_state->system_dn)));
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+        
+        } else {
+                secret_state->global = false;
+                secret_state->sam_ldb = talloc_reference(secret_state, 
+                                                         secrets_db_connect(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+
+                name = r->in.name.string;
+                if (strlen(name) < 1) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                /* search for the secret record */
+                ret = gendb_search(secret_state->sam_ldb, mem_ctx,
+                                   ldb_dn_new(mem_ctx, secret_state->sam_ldb, "cn=LSA Secrets"),
+                                   &msgs, attrs,
+                                   "(&(cn=%s)(objectclass=secret))", 
+                                   ldb_binary_encode_string(mem_ctx, name));
+                if (ret == 0) {
+                        return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+                }
+                
+                if (ret != 1) {
+                        DEBUG(0,("Found %d records matching CN=%s\n", 
+                                 ret, ldb_binary_encode_string(mem_ctx, name)));
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+        } 
+
+        secret_state->secret_dn = talloc_reference(secret_state, msgs[0]->dn);
+        
         handle = dcesrv_handle_new(dce_call->context, LSA_HANDLE_SECRET);
         if (!handle) {
@@ -2353 +3104 @@
 
 /* 
-  lsa_OpenSecret 
-*/
-static NTSTATUS dcesrv_lsa_OpenSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                               struct lsa_OpenSecret *r)
-{
-        struct dcesrv_handle *policy_handle;
-        
-        struct lsa_policy_state *policy_state;
-        struct lsa_secret_state *secret_state;
-        struct dcesrv_handle *handle;
-        struct ldb_message **msgs;
-        const char *attrs[] = {
-                NULL
-        };
-
-        const char *name;
-
-        int ret;
-
-        DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
-        ZERO_STRUCTP(r->out.sec_handle);
-        policy_state = policy_handle->data;
-
-        if (!r->in.name.string) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-        
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
-        {
-        case SECURITY_SYSTEM:
-        case SECURITY_ADMINISTRATOR:
-                break;
-        default:
-                /* Users and annonymous are not allowed to access secrets */
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        secret_state = talloc(mem_ctx, struct lsa_secret_state);
-        if (!secret_state) {
-                return NT_STATUS_NO_MEMORY;
-        }
-        secret_state->policy = policy_state;
-
-        if (strncmp("G$", r->in.name.string, 2) == 0) {
-                name = &r->in.name.string[2];
-                /* We need to connect to the database as system, as this is one of the rare RPC calls that must read the secrets (and this is denied otherwise) */
-                secret_state->sam_ldb = talloc_reference(secret_state, 
-                                                         samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(secret_state, dce_call->conn->dce_ctx->lp_ctx))); 
-                secret_state->global = true;
-
-                if (strlen(name) < 1) {
-                        return NT_STATUS_INVALID_PARAMETER;
-                }
-
-                /* search for the secret record */
-                ret = gendb_search(secret_state->sam_ldb,
-                                   mem_ctx, policy_state->system_dn, &msgs, attrs,
-                                   "(&(cn=%s Secret)(objectclass=secret))", 
-                                   ldb_binary_encode_string(mem_ctx, name));
-                if (ret == 0) {
-                        return NT_STATUS_OBJECT_NAME_NOT_FOUND;
-                }
-                
-                if (ret != 1) {
-                        DEBUG(0,("Found %d records matching DN %s\n", ret,
-                                 ldb_dn_get_linearized(policy_state->system_dn)));
-                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
-                }
-        
-        } else {
-                secret_state->global = false;
-                secret_state->sam_ldb = talloc_reference(secret_state, 
-                                 secrets_db_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx));
-
-                name = r->in.name.string;
-                if (strlen(name) < 1) {
-                        return NT_STATUS_INVALID_PARAMETER;
-                }
-
-                /* search for the secret record */
-                ret = gendb_search(secret_state->sam_ldb, mem_ctx,
-                                   ldb_dn_new(mem_ctx, secret_state->sam_ldb, "cn=LSA Secrets"),
-                                   &msgs, attrs,
-                                   "(&(cn=%s)(objectclass=secret))", 
-                                   ldb_binary_encode_string(mem_ctx, name));
-                if (ret == 0) {
-                        return NT_STATUS_OBJECT_NAME_NOT_FOUND;
-                }
-                
-                if (ret != 1) {
-                        DEBUG(0,("Found %d records matching CN=%s\n", 
-                                 ret, ldb_binary_encode_string(mem_ctx, name)));
-                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
-                }
-        } 
-
-        secret_state->secret_dn = talloc_reference(secret_state, msgs[0]->dn);
-        
-        handle = dcesrv_handle_new(dce_call->context, LSA_HANDLE_SECRET);
-        if (!handle) {
-                return NT_STATUS_NO_MEMORY;
-        }
-        
-        handle->data = talloc_steal(handle, secret_state);
-        
-        secret_state->access_mask = r->in.access_mask;
-        secret_state->policy = talloc_reference(secret_state, policy_state);
-        
-        *r->out.sec_handle = handle->wire_handle;
-        
-        return NT_STATUS_OK;
-}
-
-
-/* 
   lsa_SetSecret 
 */
@@ -2518 +3154 @@
                 
                 /* set value */
-                if (samdb_msg_add_value(secret_state->sam_ldb, 
-                                        mem_ctx, msg, "priorValue", &val) != 0) {
+                if (ldb_msg_add_value(msg, "priorValue", &val, NULL) != LDB_SUCCESS) {
                         return NT_STATUS_NO_MEMORY; 
                 }
@@ -2525 +3160 @@
                 /* set old value mtime */
                 if (samdb_msg_add_uint64(secret_state->sam_ldb, 
-                                         mem_ctx, msg, "priorSetTime", nt_now) != 0) { 
+                                         mem_ctx, msg, "priorSetTime", nt_now) != LDB_SUCCESS) {
                         return NT_STATUS_NO_MEMORY; 
                 }
@@ -2559 +3194 @@
                 if (old_val) {
                         /* set old value */
-                        if (samdb_msg_add_value(secret_state->sam_ldb, 
-                                                mem_ctx, msg, "priorValue", 
-                                                old_val) != 0) {
+                        if (ldb_msg_add_value(msg, "priorValue",
+                                              old_val, NULL) != LDB_SUCCESS) {
                                 return NT_STATUS_NO_MEMORY; 
                         }
                 } else {
                         if (samdb_msg_add_delete(secret_state->sam_ldb, 
-                                                 mem_ctx, msg, "priorValue")) {
+                                                 mem_ctx, msg, "priorValue") != LDB_SUCCESS) {
                                 return NT_STATUS_NO_MEMORY;
                         }
@@ -2575 +3209 @@
                 if (ldb_msg_find_ldb_val(res[0], "lastSetTime")) {
                         if (samdb_msg_add_uint64(secret_state->sam_ldb, 
-                                                 mem_ctx, msg, "priorSetTime", last_set_time) != 0) { 
+                                                 mem_ctx, msg, "priorSetTime", last_set_time) != LDB_SUCCESS) {
                                 return NT_STATUS_NO_MEMORY; 
                         }
                 } else {
                         if (samdb_msg_add_uint64(secret_state->sam_ldb, 
-                                                 mem_ctx, msg, "priorSetTime", nt_now) != 0) { 
+                                                 mem_ctx, msg, "priorSetTime", nt_now) != LDB_SUCCESS) {
                                 return NT_STATUS_NO_MEMORY; 
                         }
@@ -2600 +3234 @@
                 
                 /* set value */
-                if (samdb_msg_add_value(secret_state->sam_ldb, 
-                                        mem_ctx, msg, "currentValue", &val) != 0) {
+                if (ldb_msg_add_value(msg, "currentValue", &val, NULL) != LDB_SUCCESS) {
                         return NT_STATUS_NO_MEMORY; 
                 }
@@ -2607 +3240 @@
                 /* set new value mtime */
                 if (samdb_msg_add_uint64(secret_state->sam_ldb, 
-                                         mem_ctx, msg, "lastSetTime", nt_now) != 0) { 
+                                         mem_ctx, msg, "lastSetTime", nt_now) != LDB_SUCCESS) {
                         return NT_STATUS_NO_MEMORY; 
                 }
@@ -2614 +3247 @@
                 /* NULL out the NEW value */
                 if (samdb_msg_add_uint64(secret_state->sam_ldb, 
-                                         mem_ctx, msg, "lastSetTime", nt_now) != 0) { 
+                                         mem_ctx, msg, "lastSetTime", nt_now) != LDB_SUCCESS) {
                         return NT_STATUS_NO_MEMORY; 
                 }
                 if (samdb_msg_add_delete(secret_state->sam_ldb, 
-                                         mem_ctx, msg, "currentValue")) {
+                                         mem_ctx, msg, "currentValue") != LDB_SUCCESS) {
                         return NT_STATUS_NO_MEMORY;
                 }
@@ -2624 +3257 @@
 
         /* modify the samdb record */
-        ret = samdb_replace(secret_state->sam_ldb, mem_ctx, msg);
-        if (ret != 0) {
+        ret = dsdb_replace(secret_state->sam_ldb, msg, 0);
+        if (ret != LDB_SUCCESS) {
                 /* we really need samdb.c to return NTSTATUS */
                 return NT_STATUS_UNSUCCESSFUL;
@@ -2660 +3293 @@
 
         /* Ensure user is permitted to read this... */
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
         {
         case SECURITY_SYSTEM:
@@ -2776 +3409 @@
 
         id = sec_privilege_id(r->in.name->string);
-        if (id == -1) {
+        if (id == SEC_PRIV_INVALID) {
                 return NT_STATUS_NO_SUCH_PRIVILEGE;
         }
@@ -2835 +3468 @@
         struct lsa_policy_state *state;
         struct lsa_StringLarge *disp_name = NULL;
-        int id;
+        enum sec_privilege id;
 
         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
@@ -2842 +3475 @@
 
         id = sec_privilege_id(r->in.name->string);
-        if (id == -1) {
+        if (id == SEC_PRIV_INVALID) {
                 return NT_STATUS_NO_SUCH_PRIVILEGE;
         }
@@ -2886 +3519 @@
 
         privname = r->in.name->string;
-        if (sec_privilege_id(privname) == -1) {
+        if (sec_privilege_id(privname) == SEC_PRIV_INVALID && sec_right_bit(privname) == 0) {
                 return NT_STATUS_NO_SUCH_PRIVILEGE;
         }
 
-        ret = gendb_search(state->sam_ldb, mem_ctx, NULL, &res, attrs, 
+        ret = gendb_search(state->pdb, mem_ctx, NULL, &res, attrs, 
                            "privilege=%s", privname);
-        if (ret == -1) {
+        if (ret < 0) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
@@ -3004 +3637 @@
         }
 
-        account_name = talloc_reference(mem_ctx, dce_call->conn->auth_state.session_info->server_info->account_name);
-        authority_name = talloc_reference(mem_ctx, dce_call->conn->auth_state.session_info->server_info->domain_name);
+        account_name = talloc_reference(mem_ctx, dce_call->conn->auth_state.session_info->info->account_name);
+        authority_name = talloc_reference(mem_ctx, dce_call->conn->auth_state.session_info->info->domain_name);
 
         _account_name = talloc(mem_ctx, struct lsa_String);
@@ -3045 +3678 @@
         union lsa_DomainInformationPolicy *info;
 
-        info = talloc(r->out.info, union lsa_DomainInformationPolicy);
+        info = talloc_zero(r->out.info, union lsa_DomainInformationPolicy);
         if (!info) {
                 return NT_STATUS_NO_MEMORY;
@@ -3068 +3701 @@
                         return NT_STATUS_INTERNAL_ERROR;
                 }
-                k->enforce_restrictions = 0; /* FIXME, details missing from MS-LSAD 2.2.53 */
-                k->service_tkt_lifetime = 0; /* Need to find somewhere to store this, and query in KDC too */
-                k->user_tkt_lifetime = 0;    /* Need to find somewhere to store this, and query in KDC too */
-                k->user_tkt_renewaltime = 0; /* Need to find somewhere to store this, and query in KDC too */
-                k->clock_skew = krb5_get_max_time_skew(smb_krb5_context->krb5_context);
+                kdc_get_policy(dce_call->conn->dce_ctx->lp_ctx,
+                               smb_krb5_context,
+                               k);
                 talloc_free(smb_krb5_context);
                 *r->out.info = info;
@@ -3233 +3864 @@
 }
 
-
-/* 
-  lsa_LSARSETFORESTTRUSTINFORMATION 
-*/
-static NTSTATUS dcesrv_lsa_LSARSETFORESTTRUSTINFORMATION(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
+#define DNS_CMP_MATCH 0
+#define DNS_CMP_FIRST_IS_CHILD 1
+#define DNS_CMP_SECOND_IS_CHILD 2
+#define DNS_CMP_NO_MATCH 3
+
+/* this function assumes names are well formed DNS names.
+ * it doesn't validate them */
+static int dns_cmp(const char *s1, size_t l1,
+                   const char *s2, size_t l2)
+{
+        const char *p1, *p2;
+        size_t t1, t2;
+        int cret;
+
+        if (l1 == l2) {
+                if (strcasecmp_m(s1, s2) == 0) {
+                        return DNS_CMP_MATCH;
+                }
+                return DNS_CMP_NO_MATCH;
+        }
+
+        if (l1 > l2) {
+                p1 = s1;
+                p2 = s2;
+                t1 = l1;
+                t2 = l2;
+                cret = DNS_CMP_FIRST_IS_CHILD;
+        } else {
+                p1 = s2;
+                p2 = s1;
+                t1 = l2;
+                t2 = l1;
+                cret = DNS_CMP_SECOND_IS_CHILD;
+        }
+
+        if (p1[t1 - t2 - 1] != '.') {
+                return DNS_CMP_NO_MATCH;
+        }
+
+        if (strcasecmp_m(&p1[t1 - t2], p2) == 0) {
+                return cret;
+        }
+
+        return DNS_CMP_NO_MATCH;
+}
+
+/* decode all TDOs forest trust info blobs */
+static NTSTATUS get_ft_info(TALLOC_CTX *mem_ctx,
+                            struct ldb_message *msg,
+                            struct ForestTrustInfo *info)
+{
+        const struct ldb_val *ft_blob;
+        enum ndr_err_code ndr_err;
+
+        ft_blob = ldb_msg_find_ldb_val(msg, "msDS-TrustForestTrustInfo");
+        if (!ft_blob || !ft_blob->data) {
+                return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+        }
+        /* ldb_val is equivalent to DATA_BLOB */
+        ndr_err = ndr_pull_struct_blob_all(ft_blob, mem_ctx, info,
+                                           (ndr_pull_flags_fn_t)ndr_pull_ForestTrustInfo);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                return NT_STATUS_INVALID_DOMAIN_STATE;
+        }
+
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS own_ft_info(struct lsa_policy_state *ps,
+                            struct ForestTrustInfo *fti)
+{
+        struct ForestTrustDataDomainInfo *info;
+        struct ForestTrustInfoRecord *rec;
+
+        fti->version = 1;
+        fti->count = 2;
+        fti->records = talloc_array(fti,
+                                    struct ForestTrustInfoRecordArmor, 2);
+        if (!fti->records) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /* TLN info */
+        rec = &fti->records[0].record;
+
+        rec->flags = 0;
+        rec->timestamp = 0;
+        rec->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME;
+
+        rec->data.name.string = talloc_strdup(fti, ps->forest_dns);
+        if (!rec->data.name.string) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        rec->data.name.size = strlen(rec->data.name.string);
+
+        /* DOMAIN info */
+        rec = &fti->records[1].record;
+
+        rec->flags = 0;
+        rec->timestamp = 0;
+        rec->type = LSA_FOREST_TRUST_DOMAIN_INFO;
+
+        info = &rec->data.info;
+
+        info->sid = *ps->domain_sid;
+        info->dns_name.string = talloc_strdup(fti, ps->domain_dns);
+        if (!info->dns_name.string) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        info->dns_name.size = strlen(info->dns_name.string);
+        info->netbios_name.string = talloc_strdup(fti, ps->domain_name);
+        if (!info->netbios_name.string) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        info->netbios_name.size = strlen(info->netbios_name.string);
+
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS make_ft_info(TALLOC_CTX *mem_ctx,
+                             struct lsa_ForestTrustInformation *lfti,
+                             struct ForestTrustInfo *fti)
+{
+        struct lsa_ForestTrustRecord *lrec;
+        struct ForestTrustInfoRecord *rec;
+        struct lsa_StringLarge *tln;
+        struct lsa_ForestTrustDomainInfo *info;
+        uint32_t i;
+
+        fti->version = 1;
+        fti->count = lfti->count;
+        fti->records = talloc_array(mem_ctx,
+                                    struct ForestTrustInfoRecordArmor,
+                                    fti->count);
+        if (!fti->records) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        for (i = 0; i < fti->count; i++) {
+                lrec = lfti->entries[i];
+                rec = &fti->records[i].record;
+
+                rec->flags = lrec->flags;
+                rec->timestamp = lrec->time;
+                rec->type = lrec->type;
+
+                switch (lrec->type) {
+                case LSA_FOREST_TRUST_TOP_LEVEL_NAME:
+                case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
+                        tln = &lrec->forest_trust_data.top_level_name;
+                        rec->data.name.string =
+                                talloc_strdup(mem_ctx, tln->string);
+                        if (!rec->data.name.string) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                        rec->data.name.size = strlen(rec->data.name.string);
+                        break;
+                case LSA_FOREST_TRUST_DOMAIN_INFO:
+                        info = &lrec->forest_trust_data.domain_info;
+                        rec->data.info.sid = *info->domain_sid;
+                        rec->data.info.dns_name.string =
+                                talloc_strdup(mem_ctx,
+                                            info->dns_domain_name.string);
+                        if (!rec->data.info.dns_name.string) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                        rec->data.info.dns_name.size =
+                                strlen(rec->data.info.dns_name.string);
+                        rec->data.info.netbios_name.string =
+                                talloc_strdup(mem_ctx,
+                                            info->netbios_domain_name.string);
+                        if (!rec->data.info.netbios_name.string) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                        rec->data.info.netbios_name.size =
+                                strlen(rec->data.info.netbios_name.string);
+                        break;
+                default:
+                        return NT_STATUS_INVALID_DOMAIN_STATE;
+                }
+        }
+
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS add_collision(struct lsa_ForestTrustCollisionInfo *c_info,
+                              uint32_t idx, uint32_t collision_type,
+                              uint32_t conflict_type, const char *tdo_name);
+
+static NTSTATUS check_ft_info(TALLOC_CTX *mem_ctx,
+                              const char *tdo_name,
+                              struct ForestTrustInfo *tdo_fti,
+                              struct ForestTrustInfo *new_fti,
+                              struct lsa_ForestTrustCollisionInfo *c_info)
+{
+        struct ForestTrustInfoRecord *nrec;
+        struct ForestTrustInfoRecord *trec;
+        const char *dns_name;
+        const char *nb_name;
+        struct dom_sid *sid;
+        const char *tname;
+        size_t dns_len;
+        size_t nb_len;
+        size_t tlen;
+        NTSTATUS nt_status;
+        uint32_t new_fti_idx;
+        uint32_t i;
+        /* use always TDO type, until we understand when Xref can be used */
+        uint32_t collision_type = LSA_FOREST_TRUST_COLLISION_TDO;
+        bool tln_conflict;
+        bool sid_conflict;
+        bool nb_conflict;
+        bool exclusion;
+        bool ex_rule;
+        int ret;
+
+        for (new_fti_idx = 0; new_fti_idx < new_fti->count; new_fti_idx++) {
+
+                nrec = &new_fti->records[new_fti_idx].record;
+                dns_name = NULL;
+                tln_conflict = false;
+                sid_conflict = false;
+                nb_conflict = false;
+                exclusion = false;
+
+                switch (nrec->type) {
+                case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
+                        /* exclusions do not conflict by definition */
+                        break;
+
+                case FOREST_TRUST_TOP_LEVEL_NAME:
+                        dns_name = nrec->data.name.string;
+                        dns_len = nrec->data.name.size;
+                        break;
+
+                case LSA_FOREST_TRUST_DOMAIN_INFO:
+                        dns_name = nrec->data.info.dns_name.string;
+                        dns_len = nrec->data.info.dns_name.size;
+                        nb_name = nrec->data.info.netbios_name.string;
+                        nb_len = nrec->data.info.netbios_name.size;
+                        sid = &nrec->data.info.sid;
+                        break;
+                }
+
+                if (!dns_name) continue;
+
+                /* check if this is already taken and not excluded */
+                for (i = 0; i < tdo_fti->count; i++) {
+                        trec = &tdo_fti->records[i].record;
+
+                        switch (trec->type) {
+                        case FOREST_TRUST_TOP_LEVEL_NAME:
+                                ex_rule = false;
+                                tname = trec->data.name.string;
+                                tlen = trec->data.name.size;
+                                break;
+                        case FOREST_TRUST_TOP_LEVEL_NAME_EX:
+                                ex_rule = true;
+                                tname = trec->data.name.string;
+                                tlen = trec->data.name.size;
+                                break;
+                        case FOREST_TRUST_DOMAIN_INFO:
+                                ex_rule = false;
+                                tname = trec->data.info.dns_name.string;
+                                tlen = trec->data.info.dns_name.size;
+                        }
+                        ret = dns_cmp(dns_name, dns_len, tname, tlen);
+                        switch (ret) {
+                        case DNS_CMP_MATCH:
+                                /* if it matches exclusion,
+                                 * it doesn't conflict */
+                                if (ex_rule) {
+                                        exclusion = true;
+                                        break;
+                                }
+                                /* fall through */
+                        case DNS_CMP_FIRST_IS_CHILD:
+                        case DNS_CMP_SECOND_IS_CHILD:
+                                tln_conflict = true;
+                                /* fall through */
+                        default:
+                                break;
+                        }
+
+                        /* explicit exclusion, no dns name conflict here */
+                        if (exclusion) {
+                                tln_conflict = false;
+                        }
+
+                        if (trec->type != FOREST_TRUST_DOMAIN_INFO) {
+                                continue;
+                        }
+
+                        /* also test for domain info */
+                        if (!(trec->flags & LSA_SID_DISABLED_ADMIN) &&
+                            dom_sid_compare(&trec->data.info.sid, sid) == 0) {
+                                sid_conflict = true;
+                        }
+                        if (!(trec->flags & LSA_NB_DISABLED_ADMIN) &&
+                            strcasecmp_m(trec->data.info.netbios_name.string,
+                                         nb_name) == 0) {
+                                nb_conflict = true;
+                        }
+                }
+
+                if (tln_conflict) {
+                        nt_status = add_collision(c_info, new_fti_idx,
+                                                  collision_type,
+                                                  LSA_TLN_DISABLED_CONFLICT,
+                                                  tdo_name);
+                }
+                if (sid_conflict) {
+                        nt_status = add_collision(c_info, new_fti_idx,
+                                                  collision_type,
+                                                  LSA_SID_DISABLED_CONFLICT,
+                                                  tdo_name);
+                }
+                if (nb_conflict) {
+                        nt_status = add_collision(c_info, new_fti_idx,
+                                                  collision_type,
+                                                  LSA_NB_DISABLED_CONFLICT,
+                                                  tdo_name);
+                }
+        }
+
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS add_collision(struct lsa_ForestTrustCollisionInfo *c_info,
+                              uint32_t idx, uint32_t collision_type,
+                              uint32_t conflict_type, const char *tdo_name)
+{
+        struct lsa_ForestTrustCollisionRecord **es;
+        uint32_t i = c_info->count;
+
+        es = talloc_realloc(c_info, c_info->entries,
+                            struct lsa_ForestTrustCollisionRecord *, i + 1);
+        if (!es) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        c_info->entries = es;
+        c_info->count = i + 1;
+
+        es[i] = talloc(es, struct lsa_ForestTrustCollisionRecord);
+        if (!es[i]) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        es[i]->index = idx;
+        es[i]->type = collision_type;
+        es[i]->flags.flags = conflict_type;
+        es[i]->name.string = talloc_strdup(es[i], tdo_name);
+        if (!es[i]->name.string) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        es[i]->name.size = strlen(es[i]->name.string);
+
+        return NT_STATUS_OK;
+}
+
+/*
+  lsa_lsaRSetForestTrustInformation
+*/
+static NTSTATUS dcesrv_lsa_lsaRSetForestTrustInformation(struct dcesrv_call_state *dce_call,
+                                                         TALLOC_CTX *mem_ctx,
+                                                         struct lsa_lsaRSetForestTrustInformation *r)
+{
+        struct dcesrv_handle *h;
+        struct lsa_policy_state *p_state;
+        const char *trust_attrs[] = { "trustPartner", "trustAttributes",
+                                      "msDS-TrustForestTrustInfo", NULL };
+        struct ldb_message **dom_res = NULL;
+        struct ldb_dn *tdo_dn;
+        struct ldb_message *msg;
+        int num_res, i;
+        const char *td_name;
+        uint32_t trust_attributes;
+        struct lsa_ForestTrustCollisionInfo *c_info;
+        struct ForestTrustInfo *nfti;
+        struct ForestTrustInfo *fti;
+        DATA_BLOB ft_blob;
+        enum ndr_err_code ndr_err;
+        NTSTATUS nt_status;
+        bool am_rodc;
+        int ret;
+
+        DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
+
+        p_state = h->data;
+
+        if (strcmp(p_state->domain_dns, p_state->forest_dns)) {
+                return NT_STATUS_INVALID_DOMAIN_STATE;
+        }
+
+        /* abort if we are not a PDC */
+        if (!samdb_is_pdc(p_state->sam_ldb)) {
+                return NT_STATUS_INVALID_DOMAIN_ROLE;
+        }
+
+        ret = samdb_rodc(p_state->sam_ldb, &am_rodc);
+        if (ret == LDB_SUCCESS && am_rodc) {
+                return NT_STATUS_NO_SUCH_DOMAIN;
+        }
+
+        /* check caller has TRUSTED_SET_AUTH */
+
+        /* fetch all trusted domain objects */
+        num_res = gendb_search(p_state->sam_ldb, mem_ctx,
+                               p_state->system_dn,
+                               &dom_res, trust_attrs,
+                               "(objectclass=trustedDomain)");
+        if (num_res == 0) {
+                return NT_STATUS_NO_SUCH_DOMAIN;
+        }
+
+        for (i = 0; i < num_res; i++) {
+                td_name = ldb_msg_find_attr_as_string(dom_res[i],
+                                                      "trustPartner", NULL);
+                if (!td_name) {
+                        return NT_STATUS_INVALID_DOMAIN_STATE;
+                }
+                if (strcasecmp_m(td_name,
+                                 r->in.trusted_domain_name->string) == 0) {
+                        break;
+                }
+        }
+        if (i >= num_res) {
+                return NT_STATUS_NO_SUCH_DOMAIN;
+        }
+
+        tdo_dn = dom_res[i]->dn;
+
+        trust_attributes = ldb_msg_find_attr_as_uint(dom_res[i],
+                                                     "trustAttributes", 0);
+        if (!(trust_attributes & NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        if (r->in.highest_record_type >= LSA_FOREST_TRUST_RECORD_TYPE_LAST) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        nfti = talloc(mem_ctx, struct ForestTrustInfo);
+        if (!nfti) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        nt_status = make_ft_info(nfti, r->in.forest_trust_info, nfti);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        c_info = talloc_zero(r->out.collision_info,
+                             struct lsa_ForestTrustCollisionInfo);
+        if (!c_info) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /* first check own info, then other domains */
+        fti = talloc(mem_ctx, struct ForestTrustInfo);
+        if (!fti) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        nt_status = own_ft_info(p_state, fti);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        nt_status = check_ft_info(c_info, p_state->domain_dns,
+                                  fti, nfti, c_info);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        for (i = 0; i < num_res; i++) {
+                fti = talloc(mem_ctx, struct ForestTrustInfo);
+                if (!fti) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+
+                nt_status = get_ft_info(mem_ctx, dom_res[i], fti);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        if (NT_STATUS_EQUAL(nt_status,
+                            NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+                                continue;
+                        }
+                        return nt_status;
+                }
+
+                td_name = ldb_msg_find_attr_as_string(dom_res[i],
+                                                      "trustPartner", NULL);
+                if (!td_name) {
+                        return NT_STATUS_INVALID_DOMAIN_STATE;
+                }
+
+                nt_status = check_ft_info(c_info, td_name, fti, nfti, c_info);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+        }
+
+        *r->out.collision_info = c_info;
+
+        if (r->in.check_only != 0) {
+                return NT_STATUS_OK;
+        }
+
+        /* not just a check, write info back */
+
+        ndr_err = ndr_push_struct_blob(&ft_blob, mem_ctx, nfti,
+                                       (ndr_push_flags_fn_t)ndr_push_ForestTrustInfo);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        msg = ldb_msg_new(mem_ctx);
+        if (msg == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        msg->dn = ldb_dn_copy(mem_ctx, tdo_dn);
+        if (!msg->dn) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ret = ldb_msg_add_empty(msg, "msDS-TrustForestTrustInfo",
+                                LDB_FLAG_MOD_REPLACE, NULL);
+        if (ret != LDB_SUCCESS) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        ret = ldb_msg_add_value(msg, "msDS-TrustForestTrustInfo",
+                                &ft_blob, NULL);
+        if (ret != LDB_SUCCESS) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ret = ldb_modify(p_state->sam_ldb, msg);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0, ("Failed to store Forest Trust Info: %s\n",
+                          ldb_errstring(p_state->sam_ldb)));
+
+                switch (ret) {
+                case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
+                        return NT_STATUS_ACCESS_DENIED;
+                default:
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+        }
+
+        return NT_STATUS_OK;
+}
 
 /* 

trunk/server/source4/rpc_server/lsa/lsa.h

@@ -27 +27 @@
 #include "dsdb/samdb/samdb.h"
 #include "libcli/ldap/ldap_ndr.h"
-#include "lib/ldb/include/ldb_errors.h"
+#include <ldb_errors.h>
 #include "libcli/security/security.h"
 #include "libcli/auth/libcli_auth.h"
@@ -41 +41 @@
         struct dcesrv_handle *handle;
         struct ldb_context *sam_ldb;
+        struct ldb_context *pdb;
         uint32_t access_mask;
         struct ldb_dn *domain_dn;

trunk/server/source4/rpc_server/lsa/lsa_init.c

@@ -44 +44 @@
 
         /* make sure the sam database is accessible */
-        state->sam_ldb = samdb_connect(state, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info); 
+        state->sam_ldb = samdb_connect(state, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info, 0);
         if (state->sam_ldb == NULL) {
+                return NT_STATUS_INVALID_SYSTEM_SERVICE;
+        }
+
+        /* and the privilege database */
+        state->pdb = privilege_connect(state, dce_call->conn->dce_ctx->lp_ctx);
+        if (state->pdb == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
         }
@@ -58 +64 @@
         /* work out the forest root_dn - useful for so many calls its worth
            fetching here */
-        state->forest_dn = samdb_root_dn(state->sam_ldb);
+        state->forest_dn = ldb_get_root_basedn(state->sam_ldb);
         if (!state->forest_dn) {
                 return NT_STATUS_NO_MEMORY;             
@@ -83 +89 @@
         talloc_free(dom_res);
 
-        state->domain_name = lp_sam_name(dce_call->conn->dce_ctx->lp_ctx);
+        state->domain_name = lpcfg_sam_name(dce_call->conn->dce_ctx->lp_ctx);
 
         state->domain_dns = ldb_dn_canonical_string(state, state->domain_dn);

trunk/server/source4/rpc_server/lsa/lsa_lookup.c

@@ -22 +22 @@
 
 #include "rpc_server/lsa/lsa.h"
+#include "libds/common/flag_mapping.h"
 
 static const struct {
@@ -27 +28 @@
         const char *name;
         const char *sid;
-        int rtype;
+        enum lsa_SidType rtype;
 } well_known[] = {
         {
@@ -194 +195 @@
 static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
                                         const char *name, const char **authority_name, 
-                                        struct dom_sid **sid, uint32_t *rtype) 
-{
-        int i;
+                                        struct dom_sid **sid, enum lsa_SidType *rtype)
+{
+        unsigned int i;
         for (i=0; well_known[i].sid; i++) {
                 if (domain) {
@@ -220 +221 @@
 static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx, 
                                        const char *sid_str, const char **authority_name, 
-                                       const char **name, uint32_t *rtype) 
-{
-        int i;
+                                       const char **name, enum lsa_SidType *rtype) 
+{
+        unsigned int i;
         for (i=0; well_known[i].sid; i++) {
                 if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
@@ -240 +241 @@
                                        struct loadparm_context *lp_ctx,
                                        struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
-                                const char *name, const char **authority_name, 
-                                struct dom_sid **sid, enum lsa_SidType *rtype)
-{
-        int ret, atype, i;
+                                       const char *name, const char **authority_name, 
+                                       struct dom_sid **sid, enum lsa_SidType *rtype,
+                                       uint32_t *rid)
+{
+        int ret, i;
+        uint32_t atype;
         struct ldb_message **res;
         const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
@@ -275 +278 @@
                 status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
                 if (NT_STATUS_IS_OK(status)) {
+                        dom_sid_split_rid(NULL, *sid, NULL, rid);
+                        return NT_STATUS_OK;
+                }
+
+                if (username == NULL) {
+                        *authority_name = NAME_BUILTIN;
+                        *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
+                        *rtype = SID_NAME_DOMAIN;
+                        *rid = 0xFFFFFFFF;
                         return NT_STATUS_OK;
                 }
@@ -282 +294 @@
                         *sid =  dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
                         *rtype = SID_NAME_DOMAIN;
+                        dom_sid_split_rid(NULL, *sid, NULL, rid);
                         return NT_STATUS_OK;
                 }
@@ -288 +301 @@
                         *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
                         *rtype = SID_NAME_DOMAIN;
+                        *rid = 0xFFFFFFFF;
                         return NT_STATUS_OK;
                 }
@@ -294 +308 @@
                         *sid =  state->domain_sid;
                         *rtype = SID_NAME_DOMAIN;
+                        *rid = 0xFFFFFFFF;
                         return NT_STATUS_OK;
                 }
@@ -300 +315 @@
                         *sid =  state->domain_sid;
                         *rtype = SID_NAME_DOMAIN;
+                        *rid = 0xFFFFFFFF;
                         return NT_STATUS_OK;
                 }
@@ -308 +324 @@
                         return NT_STATUS_NO_MEMORY;
                 }
-                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
+                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
                 if (NT_STATUS_IS_OK(status)) {
                         return status;
@@ -318 +334 @@
                         return NT_STATUS_NO_MEMORY;
                 }
-                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
+                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
                 if (NT_STATUS_IS_OK(status)) {
                         return status;
@@ -328 +344 @@
                         return NT_STATUS_NO_MEMORY;
                 }
-                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
+                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
                 if (NT_STATUS_IS_OK(status)) {
                         return status;
@@ -339 +355 @@
                         *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
                         *rtype = SID_NAME_DOMAIN;
+                        dom_sid_split_rid(NULL, *sid, NULL, rid);
                         return NT_STATUS_OK;
                 }
 
                 /* Look up table of well known names */
-                return lookup_well_known_names(mem_ctx, domain, username, authority_name, 
-                                               sid, rtype);
+                status = lookup_well_known_names(mem_ctx, domain, username, authority_name, 
+                                                 sid, rtype);
+                if (NT_STATUS_IS_OK(status)) {
+                        dom_sid_split_rid(NULL, *sid, NULL, rid);
+                }
+                return status;
         } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
                 *authority_name = NAME_BUILTIN;
@@ -360 +381 @@
 
         ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
-        if (ret == 1) {
-                domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
-                if (domain_sid == NULL) {
-                        return NT_STATUS_INVALID_SID;
-                }
-        } else {
+        if (ret != 1) {
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+        domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
+        if (domain_sid == NULL) {
                 return NT_STATUS_INVALID_SID;
         }
@@ -372 +392 @@
                 *sid = domain_sid;
                 *rtype = SID_NAME_DOMAIN;
+                *rid = 0xFFFFFFFF;
                 return NT_STATUS_OK;
         }
@@ -378 +399 @@
                            "(&(sAMAccountName=%s)(objectSid=*))", 
                            ldb_binary_encode_string(mem_ctx, username));
-        if (ret == -1) {
-                return NT_STATUS_INVALID_SID;
+        if (ret < 0) {
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
@@ -393 +414 @@
                 }
 
-                atype = samdb_result_uint(res[i], "sAMAccountType", 0);
+                atype = ldb_msg_find_attr_as_uint(res[i], "sAMAccountType", 0);
                         
                 *rtype = ds_atype_map(atype);
@@ -400 +421 @@
                 }
 
+                dom_sid_split_rid(NULL, *sid, NULL, rid);
                 return NT_STATUS_OK;
         }
@@ -420 +442 @@
 {
         struct dom_sid *authority_sid;
-        int i;
+        uint32_t i;
 
         if (rtype != SID_NAME_DOMAIN) {
@@ -490 +512 @@
         }
 
+        /* need to re-add a check for an allocated sid */
+
         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
                            "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
-        if (ret == 1) {
-                *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
+        if ((ret < 0) || (ret > 1)) {
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+        if (ret == 0) {
+                return NT_STATUS_NOT_FOUND;
+        }
+
+        *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
+        if (!*name) {
+                *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
                 if (!*name) {
-                        *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
-                        if (!*name) {
-                                *name = talloc_strdup(mem_ctx, sid_str);
-                                NT_STATUS_HAVE_NO_MEMORY(*name);
-                        }
-                }
-
-                atype = samdb_result_uint(res[0], "sAMAccountType", 0);
-
-                *rtype = ds_atype_map(atype);
-
-                return NT_STATUS_OK;
-        }
-
-        /* need to re-add a check for an allocated sid */
-
-        return NT_STATUS_NOT_FOUND;
+                        *name = talloc_strdup(mem_ctx, sid_str);
+                        NT_STATUS_HAVE_NO_MEMORY(*name);
+                }
+        }
+
+        atype = ldb_msg_find_attr_as_uint(res[0], "sAMAccountType", 0);
+        *rtype = ds_atype_map(atype);
+
+        return NT_STATUS_OK;
 }
 
@@ -524 +548 @@
         struct lsa_policy_state *state;
         struct lsa_RefDomainList *domains = NULL;
-        int i;
+        uint32_t i;
         NTSTATUS status = NT_STATUS_OK;
 
@@ -683 +707 @@
         struct lsa_LookupSids2 r2;
         NTSTATUS status;
-        int i;
+        uint32_t i;
 
         ZERO_STRUCT(r2);
@@ -737 +761 @@
         struct lsa_policy_state *policy_state;
         struct dcesrv_handle *policy_handle;
-        int i;
+        uint32_t i;
         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
         struct lsa_RefDomainList *domains;
@@ -775 +799 @@
                 const char *authority_name;
                 struct dom_sid *sid;
-                uint32_t sid_index;
+                uint32_t sid_index, rid;
                 enum lsa_SidType rtype;
                 NTSTATUS status2;
@@ -786 +810 @@
                 r->out.sids->sids[i].flags       = 0;
 
-                status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name, &authority_name, &sid, &rtype);
+                status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name,
+                                                 &authority_name, &sid, &rtype, &rid);
                 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
                         continue;
@@ -878 +903 @@
         struct lsa_policy_state *state;
         struct dcesrv_handle *h;
-        int i;
+        uint32_t i;
         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
         struct lsa_RefDomainList *domains;
@@ -916 +941 @@
                 const char *authority_name;
                 struct dom_sid *sid;
-                uint32_t rtype, sid_index;
+                uint32_t sid_index, rid=0;
+                enum lsa_SidType rtype;
                 NTSTATUS status2;
 
@@ -929 +955 @@
                 r->out.sids->sids[i].unknown     = 0;
 
-                status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name, 
-                                                 &authority_name, &sid, &rtype);
+                status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name,
+                                                 &authority_name, &sid, &rtype, &rid);
                 if (!NT_STATUS_IS_OK(status2)) {
                         continue;
@@ -942 +968 @@
 
                 r->out.sids->sids[i].sid_type    = rtype;
-                r->out.sids->sids[i].rid         = sid->sub_auths[sid->num_auths-1];
+                r->out.sids->sids[i].rid         = rid;
                 r->out.sids->sids[i].sid_index   = sid_index;
                 r->out.sids->sids[i].unknown     = 0;
@@ -967 +993 @@
         struct lsa_LookupNames2 r2;
         NTSTATUS status;
-        int i;
+        uint32_t i;
 
         ZERO_STRUCT(r2);

trunk/server/source4/rpc_server/netlogon/dcerpc_netlogon.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -6 +6 @@
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2008
    Copyright (C) Stefan Metzmacher <metze@samba.org>  2005
-   Copyright (C) Matthias Dieter Wallnöfer            2009
-   
+   Copyright (C) Matthias Dieter Wallnöfer            2009-2010
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -29 +29 @@
 #include "../lib/util/util_ldb.h"
 #include "../libcli/auth/schannel.h"
-#include "auth/gensec/schannel_state.h"
 #include "libcli/security/security.h"
 #include "param/param.h"
 #include "lib/messaging/irpc.h"
+#include "librpc/gen_ndr/ndr_irpc_c.h"
+#include "../libcli/ldap/ldap_ndr.h"
+#include "cldap_server/cldap_server.h"
+#include "lib/tsocket/tsocket.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
 #include "librpc/gen_ndr/ndr_irpc.h"
 
@@ -40 +44 @@
 };
 
-
 static NTSTATUS dcesrv_netr_ServerReqChallenge(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                                         struct netr_ServerReqChallenge *r)
@@ -55 +58 @@
                 dce_call->context->private_data = NULL;
         }
-        
+
         pipe_state = talloc(dce_call->context, struct netlogon_server_pipe_state);
         NT_STATUS_HAVE_NO_MEMORY(pipe_state);
@@ -61 +64 @@
         pipe_state->client_challenge = *r->in.credentials;
 
-        generate_random_buffer(pipe_state->server_challenge.data, 
+        generate_random_buffer(pipe_state->server_challenge.data,
                                sizeof(pipe_state->server_challenge.data));
 
@@ -77 +80 @@
                 talloc_get_type(dce_call->context->private_data, struct netlogon_server_pipe_state);
         struct netlogon_creds_CredentialState *creds;
-        struct ldb_context *schannel_ldb;
         struct ldb_context *sam_ctx;
         struct samr_Password *mach_pwd;
@@ -84 +86 @@
         struct ldb_message **msgs;
         NTSTATUS nt_status;
-        const char *attrs[] = {"unicodePwd", "userAccountControl", 
+        const char *attrs[] = {"unicodePwd", "userAccountControl",
                                "objectSid", NULL};
 
@@ -124 +126 @@
                                   NETLOGON_NEG_AUTHENTICATED_RPC;
 
-        if (!pipe_state) {
-                DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, 
-                                system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+        switch (r->in.secure_channel_type) {
+        case SEC_CHAN_WKSTA:
+        case SEC_CHAN_DNS_DOMAIN:
+        case SEC_CHAN_DOMAIN:
+        case SEC_CHAN_BDC:
+        case SEC_CHAN_RODC:
+                break;
+        default:
+                DEBUG(1, ("Client asked for an invalid secure channel type: %d\n",
+                          r->in.secure_channel_type));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx,
+                                system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
@@ -150 +160 @@
                 num_records = gendb_search(sam_ctx, mem_ctx, NULL, &msgs,
                                            trust_dom_attrs,
-                                           "(&(trustPartner=%s)(objectclass=trustedDomain))", 
+                                           "(&(trustPartner=%s)(objectclass=trustedDomain))",
                                            encoded_account);
-                
+
                 if (num_records == 0) {
-                        DEBUG(3,("Couldn't find trust [%s] in samdb.\n", 
+                        DEBUG(3,("Couldn't find trust [%s] in samdb.\n",
                                  encoded_account));
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-                
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
+                }
+
                 if (num_records > 1) {
                         DEBUG(0,("Found %d records matching user [%s]\n", num_records, r->in.account_name));
                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
                 }
-                
+
                 flatname = ldb_msg_find_attr_as_string(msgs[0], "flatname", NULL);
                 if (!flatname) {
                         /* No flatname for this trust - we can't proceed */
-                        return NT_STATUS_ACCESS_DENIED;
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
                 }
                 account_name = talloc_asprintf(mem_ctx, "%s$", flatname);
@@ -174 +184 @@
                         return NT_STATUS_NO_MEMORY;
                 }
-                
+
         } else {
                 account_name = r->in.account_name;
         }
-        
+
         /* pull the user attributes */
         num_records = gendb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
-                                   "(&(sAMAccountName=%s)(objectclass=user))", 
+                                   "(&(sAMAccountName=%s)(objectclass=user))",
                                    ldb_binary_encode_string(mem_ctx, account_name));
 
         if (num_records == 0) {
-                DEBUG(3,("Couldn't find user [%s] in samdb.\n", 
+                DEBUG(3,("Couldn't find user [%s] in samdb.\n",
                          r->in.account_name));
-                return NT_STATUS_ACCESS_DENIED;
+                return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
         }
 
@@ -195 +205 @@
         }
 
-        
         user_account_control = ldb_msg_find_attr_as_uint(msgs[0], "userAccountControl", 0);
 
         if (user_account_control & UF_ACCOUNTDISABLE) {
                 DEBUG(1, ("Account [%s] is disabled\n", r->in.account_name));
-                return NT_STATUS_ACCESS_DENIED;
+                return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
         }
 
@@ -206 +215 @@
                 if (!(user_account_control & UF_WORKSTATION_TRUST_ACCOUNT)) {
                         DEBUG(1, ("Client asked for a workstation secure channel, but is not a workstation (member server) acb flags: 0x%x\n", user_account_control));
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        } else if (r->in.secure_channel_type == SEC_CHAN_DOMAIN || 
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
+                }
+        } else if (r->in.secure_channel_type == SEC_CHAN_DOMAIN ||
                    r->in.secure_channel_type == SEC_CHAN_DNS_DOMAIN) {
                 if (!(user_account_control & UF_INTERDOMAIN_TRUST_ACCOUNT)) {
                         DEBUG(1, ("Client asked for a trusted domain secure channel, but is not a trusted domain: acb flags: 0x%x\n", user_account_control));
-                        
-                        return NT_STATUS_ACCESS_DENIED;
+
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
                 }
         } else if (r->in.secure_channel_type == SEC_CHAN_BDC) {
                 if (!(user_account_control & UF_SERVER_TRUST_ACCOUNT)) {
                         DEBUG(1, ("Client asked for a server secure channel, but is not a server (domain controller): acb flags: 0x%x\n", user_account_control));
-                        return NT_STATUS_ACCESS_DENIED;
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
+                }
+        } else if (r->in.secure_channel_type == SEC_CHAN_RODC) {
+                if (!(user_account_control & UF_PARTIAL_SECRETS_ACCOUNT)) {
+                        DEBUG(1, ("Client asked for a RODC secure channel, but is not a RODC: acb flags: 0x%x\n", user_account_control));
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
                 }
         } else {
-                DEBUG(1, ("Client asked for an invalid secure channel type: %d\n", 
-                          r->in.secure_channel_type));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        *r->out.rid = samdb_result_rid_from_sid(mem_ctx, msgs[0], 
+                /* we should never reach this */
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        *r->out.rid = samdb_result_rid_from_sid(mem_ctx, msgs[0],
                                                 "objectSid", 0);
 
@@ -234 +247 @@
         }
 
-        creds = netlogon_creds_server_init(mem_ctx,     
+        if (!pipe_state) {
+                DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        creds = netlogon_creds_server_init(mem_ctx,
                                            r->in.account_name,
                                            r->in.computer_name,
                                            r->in.secure_channel_type,
-                                           &pipe_state->client_challenge, 
-                                           &pipe_state->server_challenge, 
+                                           &pipe_state->client_challenge,
+                                           &pipe_state->server_challenge,
                                            mach_pwd,
                                            r->in.credentials,
                                            r->out.return_credentials,
                                            *r->in.negotiate_flags);
-        
+
         if (!creds) {
                 return NT_STATUS_ACCESS_DENIED;
@@ -251 +269 @@
         creds->sid = samdb_result_dom_sid(creds, msgs[0], "objectSid");
 
-        schannel_ldb = schannel_db_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx);
-        if (!schannel_ldb) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        nt_status = schannel_store_session_key_ldb(schannel_ldb, mem_ctx, creds);
-        talloc_free(schannel_ldb);
+        nt_status = schannel_save_creds_state(mem_ctx,
+                                              lpcfg_private_dir(dce_call->conn->dce_ctx->lp_ctx),
+                                              creds);
 
         return nt_status;
 }
-                                                 
+
 static NTSTATUS dcesrv_netr_ServerAuthenticate(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                                         struct netr_ServerAuthenticate *r)
@@ -267 +281 @@
         struct netr_ServerAuthenticate3 a;
         uint32_t rid;
-        /* TODO: 
+        /* TODO:
          * negotiate_flags is used as an [in] parameter
          * so it need to be initialised.
@@ -305 +319 @@
         r3.out.negotiate_flags = r->out.negotiate_flags;
         r3.out.rid = &rid;
-        
+
         return dcesrv_netr_ServerAuthenticate3(dce_call, mem_ctx, &r3);
 }
 
 /*
-  Validate an incoming authenticator against the credentials for the remote machine.
-
-  The credentials are (re)read and from the schannel database, and
-  written back after the caclulations are performed.
-
-  The creds_out parameter (if not NULL) returns the credentials, if
-  the caller needs some of that information.
-
-*/
+ * NOTE: The following functions are nearly identical to the ones available in
+ * source3/rpc_server/srv_nelog_nt.c
+ * The reason we keep 2 copies is that they use different structures to
+ * represent the auth_info and the decrpc pipes.
+ */
+
+/*
+ * If schannel is required for this call test that it actually is available.
+ */
+static NTSTATUS schannel_check_required(struct dcerpc_auth *auth_info,
+                                        const char *computer_name,
+                                        bool integrity, bool privacy)
+{
+
+        if (auth_info && auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
+                if (!privacy && !integrity) {
+                        return NT_STATUS_OK;
+                }
+
+                if ((!privacy && integrity) &&
+                    auth_info->auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
+                        return NT_STATUS_OK;
+                }
+
+                if ((privacy || integrity) &&
+                    auth_info->auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
+                        return NT_STATUS_OK;
+                }
+        }
+
+        /* test didn't pass */
+        DEBUG(0, ("schannel_check_required: [%s] is not using schannel\n",
+                  computer_name));
+
+        return NT_STATUS_ACCESS_DENIED;
+}
+
 static NTSTATUS dcesrv_netr_creds_server_step_check(struct dcesrv_call_state *dce_call,
-                                                    TALLOC_CTX *mem_ctx, 
+                                                    TALLOC_CTX *mem_ctx,
                                                     const char *computer_name,
                                                     struct netr_Authenticator *received_authenticator,
                                                     struct netr_Authenticator *return_authenticator,
-                                                    struct netlogon_creds_CredentialState **creds_out) 
+                                                    struct netlogon_creds_CredentialState **creds_out)
 {
         NTSTATUS nt_status;
-        struct ldb_context *ldb;
-        bool schannel_global_required = false; /* Should be lp_schannel_server() == true */
-        bool schannel_in_use = dce_call->conn->auth_state.auth_info
-                && dce_call->conn->auth_state.auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL
-                && (dce_call->conn->auth_state.auth_info->auth_level == DCERPC_AUTH_LEVEL_INTEGRITY 
-                    || dce_call->conn->auth_state.auth_info->auth_level == DCERPC_AUTH_LEVEL_PRIVACY);
-
-        ldb = schannel_db_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx);
-        if (!ldb) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-        nt_status = schannel_creds_server_step_check_ldb(ldb, mem_ctx,
-                                                         computer_name,
-                                                         schannel_global_required,
-                                                         schannel_in_use,
-                                                         received_authenticator,
-                                                         return_authenticator, creds_out);
-        talloc_free(ldb);
+        struct dcerpc_auth *auth_info = dce_call->conn->auth_state.auth_info;
+        bool schannel_global_required = false; /* Should be lpcfg_schannel_server() == true */
+
+        if (schannel_global_required) {
+                nt_status = schannel_check_required(auth_info,
+                                                    computer_name,
+                                                    true, false);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+        }
+
+        nt_status = schannel_check_creds_state(mem_ctx,
+                                               lpcfg_private_dir(dce_call->conn->dce_ctx->lp_ctx),
+                                               computer_name,
+                                               received_authenticator,
+                                               return_authenticator,
+                                               creds_out);
         return nt_status;
 }
 
-/* 
+/*
   Change the machine account password for the currently connected
   client.  Supplies only the NT#.
@@ -358 +400 @@
         struct netlogon_creds_CredentialState *creds;
         struct ldb_context *sam_ctx;
+        const char * const attrs[] = { "unicodePwd", NULL };
+        struct ldb_message **res;
+        struct samr_Password *oldNtHash;
         NTSTATUS nt_status;
+        int ret;
 
         nt_status = dcesrv_netr_creds_server_step_check(dce_call,
-                                                        mem_ctx, 
-                                                        r->in.computer_name, 
+                                                        mem_ctx,
+                                                        r->in.computer_name,
                                                         r->in.credential, r->out.return_authenticator,
                                                         &creds);
         NT_STATUS_NOT_OK_RETURN(nt_status);
 
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
@@ -374 +420 @@
         netlogon_creds_des_decrypt(creds, r->in.new_password);
 
+        /* fetch the old password hashes (the NT hash has to exist) */
+
+        ret = gendb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
+                           "(&(objectClass=user)(objectSid=%s))",
+                           ldap_encode_ndr_dom_sid(mem_ctx, creds->sid));
+        if (ret != 1) {
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
+        nt_status = samdb_result_passwords(mem_ctx,
+                                           dce_call->conn->dce_ctx->lp_ctx,
+                                           res[0], NULL, &oldNtHash);
+        if (!NT_STATUS_IS_OK(nt_status) || !oldNtHash) {
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
         /* Using the sid for the account as the key, set the password */
-        nt_status = samdb_set_password_sid(sam_ctx, mem_ctx, 
+        nt_status = samdb_set_password_sid(sam_ctx, mem_ctx,
                                            creds->sid,
                                            NULL, /* Don't have plaintext */
                                            NULL, r->in.new_password,
-                                           true, /* Password change */
+                                           NULL, oldNtHash, /* Password change */
                                            NULL, NULL);
         return nt_status;
 }
 
-/* 
+/*
   Change the machine account password for the currently connected
   client.  Supplies new plaintext.
@@ -393 +455 @@
         struct netlogon_creds_CredentialState *creds;
         struct ldb_context *sam_ctx;
+        const char * const attrs[] = { "dBCSPwd", "unicodePwd", NULL };
+        struct ldb_message **res;
+        struct samr_Password *oldLmHash, *oldNtHash;
         NTSTATUS nt_status;
         DATA_BLOB new_password;
+        int ret;
 
         struct samr_CryptPassword password_buf;
 
         nt_status = dcesrv_netr_creds_server_step_check(dce_call,
-                                                        mem_ctx, 
-                                                        r->in.computer_name, 
+                                                        mem_ctx,
+                                                        r->in.computer_name,
                                                         r->in.credential, r->out.return_authenticator,
                                                         &creds);
         NT_STATUS_NOT_OK_RETURN(nt_status);
 
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
@@ -418 +484 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-                
+
+        /* fetch the old password hashes (at least one of both has to exist) */
+
+        ret = gendb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
+                           "(&(objectClass=user)(objectSid=%s))",
+                           ldap_encode_ndr_dom_sid(mem_ctx, creds->sid));
+        if (ret != 1) {
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
+        nt_status = samdb_result_passwords(mem_ctx,
+                                           dce_call->conn->dce_ctx->lp_ctx,
+                                           res[0], &oldLmHash, &oldNtHash);
+        if (!NT_STATUS_IS_OK(nt_status) || (!oldLmHash && !oldNtHash)) {
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
         /* Using the sid for the account as the key, set the password */
         nt_status = samdb_set_password_sid(sam_ctx, mem_ctx,
@@ -424 +506 @@
                                            &new_password, /* we have plaintext */
                                            NULL, NULL,
-                                           true, /* Password change */
+                                           oldLmHash, oldNtHash, /* Password change */
                                            NULL, NULL);
         return nt_status;
@@ -430 +512 @@
 
 
-/* 
-  netr_LogonUasLogon 
+/*
+  netr_LogonUasLogon
 */
 static WERROR dcesrv_netr_LogonUasLogon(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -440 +522 @@
 
 
-/* 
-  netr_LogonUasLogoff 
+/*
+  netr_LogonUasLogoff
 */
 static WERROR dcesrv_netr_LogonUasLogoff(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -450 +532 @@
 
 
-/* 
+static NTSTATUS dcesrv_netr_LogonSamLogon_check(const struct netr_LogonSamLogonEx *r)
+{
+        switch (r->in.logon_level) {
+        case NetlogonInteractiveInformation:
+        case NetlogonServiceInformation:
+        case NetlogonInteractiveTransitiveInformation:
+        case NetlogonServiceTransitiveInformation:
+                if (r->in.logon->password == NULL) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                switch (r->in.validation_level) {
+                case NetlogonValidationSamInfo:  /* 2 */
+                case NetlogonValidationSamInfo2: /* 3 */
+                case NetlogonValidationSamInfo4: /* 6 */
+                        break;
+                default:
+                        return NT_STATUS_INVALID_INFO_CLASS;
+                }
+
+                break;
+        case NetlogonNetworkInformation:
+        case NetlogonNetworkTransitiveInformation:
+                if (r->in.logon->network == NULL) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                switch (r->in.validation_level) {
+                case NetlogonValidationSamInfo:  /* 2 */
+                case NetlogonValidationSamInfo2: /* 3 */
+                case NetlogonValidationSamInfo4: /* 6 */
+                        break;
+                default:
+                        return NT_STATUS_INVALID_INFO_CLASS;
+                }
+
+                break;
+
+        case NetlogonGenericInformation:
+                if (r->in.logon->generic == NULL) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                switch (r->in.validation_level) {
+                /* TODO: case NetlogonValidationGenericInfo: 4 */
+                case NetlogonValidationGenericInfo2: /* 5 */
+                        break;
+                default:
+                        return NT_STATUS_INVALID_INFO_CLASS;
+                }
+
+                break;
+        default:
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        return NT_STATUS_OK;
+}
+
+/*
   netr_LogonSamLogon_base
 
@@ -462 +603 @@
         struct auth_context *auth_context;
         struct auth_usersupplied_info *user_info;
-        struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
         NTSTATUS nt_status;
         static const char zeros[16];
@@ -469 +610 @@
         struct netr_SamInfo3 *sam3;
         struct netr_SamInfo6 *sam6;
-        
-        user_info = talloc(mem_ctx, struct auth_usersupplied_info);
+
+        *r->out.authoritative = 1;
+
+        user_info = talloc_zero(mem_ctx, struct auth_usersupplied_info);
         NT_STATUS_HAVE_NO_MEMORY(user_info);
-
-        user_info->flags = 0;
-        user_info->mapped_state = false;
-        user_info->remote_host = NULL;
 
         switch (r->in.logon_level) {
@@ -483 +622 @@
         case NetlogonServiceTransitiveInformation:
                 if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
-                        netlogon_creds_arcfour_crypt(creds, 
+                        netlogon_creds_arcfour_crypt(creds,
                                             r->in.logon->password->lmpassword.hash,
                                             sizeof(r->in.logon->password->lmpassword.hash));
-                        netlogon_creds_arcfour_crypt(creds, 
+                        netlogon_creds_arcfour_crypt(creds,
                                             r->in.logon->password->ntpassword.hash,
                                             sizeof(r->in.logon->password->ntpassword.hash));
@@ -495 +634 @@
 
                 /* TODO: we need to deny anonymous access here */
-                nt_status = auth_context_create(mem_ctx, 
+                nt_status = auth_context_create(mem_ctx,
                                                 dce_call->event_ctx, dce_call->msg_ctx,
                                                 dce_call->conn->dce_ctx->lp_ctx,
@@ -505 +644 @@
                 user_info->client.domain_name = r->in.logon->password->identity_info.domain_name.string;
                 user_info->workstation_name = r->in.logon->password->identity_info.workstation.string;
-                
+
                 user_info->flags |= USER_INFO_INTERACTIVE_LOGON;
                 user_info->password_state = AUTH_PASSWORD_HASH;
@@ -522 +661 @@
 
                 /* TODO: we need to deny anonymous access here */
-                nt_status = auth_context_create(mem_ctx, 
+                nt_status = auth_context_create(mem_ctx,
                                                 dce_call->event_ctx, dce_call->msg_ctx,
                                                 dce_call->conn->dce_ctx->lp_ctx,
@@ -535 +674 @@
                 user_info->client.domain_name = r->in.logon->network->identity_info.domain_name.string;
                 user_info->workstation_name = r->in.logon->network->identity_info.workstation.string;
-                
+
                 user_info->password_state = AUTH_PASSWORD_RESPONSE;
                 user_info->password.response.lanman = data_blob_talloc(mem_ctx, r->in.logon->network->lm.data, r->in.logon->network->lm.length);
                 user_info->password.response.nt = data_blob_talloc(mem_ctx, r->in.logon->network->nt.data, r->in.logon->network->nt.length);
-        
+
                 break;
 
-                
+
         case NetlogonGenericInformation:
         {
                 if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
-                        netlogon_creds_arcfour_crypt(creds, 
+                        netlogon_creds_arcfour_crypt(creds,
                                             r->in.logon->generic->data, r->in.logon->generic->length);
                 } else {
@@ -555 +694 @@
                 if (strcmp(r->in.logon->generic->package_name.string, "Kerberos") == 0) {
                         NTSTATUS status;
-                        struct server_id *kdc;
+                        struct dcerpc_binding_handle *irpc_handle;
                         struct kdc_check_generic_kerberos check;
                         struct netr_GenericInfo2 *generic = talloc_zero(mem_ctx, struct netr_GenericInfo2);
                         NT_STATUS_HAVE_NO_MEMORY(generic);
                         *r->out.authoritative = 1;
-                        
+
                         /* TODO: Describe and deal with these flags */
                         *r->out.flags = 0;
 
                         r->out.validation->generic = generic;
-        
-                        kdc = irpc_servers_byname(dce_call->msg_ctx, mem_ctx, "kdc_server");
-                        if ((kdc == NULL) || (kdc[0].id == 0)) {
+
+                        irpc_handle = irpc_binding_handle_by_name(mem_ctx,
+                                                                  dce_call->msg_ctx,
+                                                                  "kdc_server",
+                                                                  &ndr_table_irpc);
+                        if (irpc_handle == NULL) {
                                 return NT_STATUS_NO_LOGON_SERVERS;
                         }
-                        
-                        check.in.generic_request = 
+
+                        check.in.generic_request =
                                 data_blob_const(r->in.logon->generic->data,
                                                 r->in.logon->generic->length);
-                        
-                        status = irpc_call(dce_call->msg_ctx, kdc[0],
-                                           &ndr_table_irpc, NDR_KDC_CHECK_GENERIC_KERBEROS,
-                                           &check, mem_ctx);
+
+                        status = dcerpc_kdc_check_generic_kerberos_r(irpc_handle,
+                                                                     mem_ctx,
+                                                                     &check);
                         if (!NT_STATUS_IS_OK(status)) {
                                 return status;
@@ -592 +734 @@
                 return NT_STATUS_INVALID_PARAMETER;
         }
-        
-        nt_status = auth_check_password(auth_context, mem_ctx, user_info, &server_info);
+
+        nt_status = auth_check_password(auth_context, mem_ctx, user_info, &user_info_dc);
+        /* TODO: set *r->out.authoritative = 0 on specific errors */
         NT_STATUS_NOT_OK_RETURN(nt_status);
 
-        nt_status = auth_convert_server_info_sambaseinfo(mem_ctx, server_info, &sam);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
+        switch (r->in.validation_level) {
+        case 2:
+                nt_status = auth_convert_user_info_dc_sambaseinfo(mem_ctx, user_info_dc, &sam);
+                NT_STATUS_NOT_OK_RETURN(nt_status);
+
+                sam2 = talloc_zero(mem_ctx, struct netr_SamInfo2);
+                NT_STATUS_HAVE_NO_MEMORY(sam2);
+                sam2->base = *sam;
+
+                /* And put into the talloc tree */
+                talloc_steal(sam2, sam);
+                r->out.validation->sam2 = sam2;
+
+                sam = &sam2->base;
+                break;
+
+        case 3:
+                nt_status = auth_convert_user_info_dc_saminfo3(mem_ctx,
+                                                              user_info_dc,
+                                                              &sam3);
+                NT_STATUS_NOT_OK_RETURN(nt_status);
+
+                r->out.validation->sam3 = sam3;
+
+                sam = &sam3->base;
+                break;
+
+        case 6:
+                nt_status = auth_convert_user_info_dc_saminfo3(mem_ctx,
+                                                           user_info_dc,
+                                                           &sam3);
+                NT_STATUS_NOT_OK_RETURN(nt_status);
+
+                sam6 = talloc_zero(mem_ctx, struct netr_SamInfo6);
+                NT_STATUS_HAVE_NO_MEMORY(sam6);
+                sam6->base = sam3->base;
+                sam = &sam6->base;
+                sam6->sidcount = sam3->sidcount;
+                sam6->sids = sam3->sids;
+
+                sam6->dns_domainname.string = lpcfg_dnsdomain(dce_call->conn->dce_ctx->lp_ctx);
+                sam6->principle.string = talloc_asprintf(mem_ctx, "%s@%s",
+                                                         sam->account_name.string, sam6->dns_domainname.string);
+                NT_STATUS_HAVE_NO_MEMORY(sam6->principle.string);
+                /* And put into the talloc tree */
+                talloc_steal(sam6, sam3);
+
+                r->out.validation->sam6 = sam6;
+                break;
+
+        default:
+                return NT_STATUS_INVALID_INFO_CLASS;
+        }
 
         /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
@@ -605 +799 @@
                 /* This key is sent unencrypted without the ARCFOUR flag set */
                 if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
-                        netlogon_creds_arcfour_crypt(creds, 
-                                            sam->key.key, 
+                        netlogon_creds_arcfour_crypt(creds,
+                                            sam->key.key,
                                             sizeof(sam->key.key));
                 }
@@ -616 +810 @@
             memcmp(sam->LMSessKey.key, zeros, sizeof(sam->LMSessKey.key)) != 0) {
                 if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
-                        netlogon_creds_arcfour_crypt(creds, 
-                                            sam->LMSessKey.key, 
+                        netlogon_creds_arcfour_crypt(creds,
+                                            sam->LMSessKey.key,
                                             sizeof(sam->LMSessKey.key));
                 } else {
-                        netlogon_creds_des_encrypt_LMKey(creds, 
+                        netlogon_creds_des_encrypt_LMKey(creds,
                                                 &sam->LMSessKey);
                 }
         }
-
-        switch (r->in.validation_level) {
-        case 2:
-                sam2 = talloc_zero(mem_ctx, struct netr_SamInfo2);
-                NT_STATUS_HAVE_NO_MEMORY(sam2);
-                sam2->base = *sam;
-                r->out.validation->sam2 = sam2;
-                break;
-
-        case 3:
-                sam3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
-                NT_STATUS_HAVE_NO_MEMORY(sam3);
-                sam3->base = *sam;
-                r->out.validation->sam3 = sam3;
-                break;
-
-        case 6:
-                sam6 = talloc_zero(mem_ctx, struct netr_SamInfo6);
-                NT_STATUS_HAVE_NO_MEMORY(sam6);
-                sam6->base = *sam;
-                sam6->forest.string = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
-                sam6->principle.string = talloc_asprintf(mem_ctx, "%s@%s", 
-                                                         sam->account_name.string, sam6->forest.string);
-                NT_STATUS_HAVE_NO_MEMORY(sam6->principle.string);
-                r->out.validation->sam6 = sam6;
-                break;
-
-        default:
-                break;
-        }
-
-        *r->out.authoritative = 1;
 
         /* TODO: Describe and deal with these flags */
@@ -664 +826 @@
 
 static NTSTATUS dcesrv_netr_LogonSamLogonEx(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                                     struct netr_LogonSamLogonEx *r) 
+                                     struct netr_LogonSamLogonEx *r)
 {
         NTSTATUS nt_status;
         struct netlogon_creds_CredentialState *creds;
-        struct ldb_context *ldb = schannel_db_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx);
-        if (!ldb) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-        
-        nt_status = schannel_fetch_session_key_ldb(ldb, mem_ctx, r->in.computer_name, &creds);
+
+        *r->out.authoritative = 1;
+
+        nt_status = dcesrv_netr_LogonSamLogon_check(r);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        nt_status = schannel_get_creds_state(mem_ctx,
+                                             lpcfg_private_dir(dce_call->conn->dce_ctx->lp_ctx),
+                                             r->in.computer_name, &creds);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
@@ -685 +852 @@
 }
 
-/* 
+/*
   netr_LogonSamLogonWithFlags
 
@@ -697 +864 @@
 
         struct netr_Authenticator *return_authenticator;
-
-        return_authenticator = talloc(mem_ctx, struct netr_Authenticator);
-        NT_STATUS_HAVE_NO_MEMORY(return_authenticator);
-
-        nt_status = dcesrv_netr_creds_server_step_check(dce_call,
-                                                        mem_ctx, 
-                                                        r->in.computer_name, 
-                                                        r->in.credential, return_authenticator,
-                                                        &creds);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
 
         ZERO_STRUCT(r2);
@@ -720 +877 @@
         r2.out.flags            = r->out.flags;
 
+        *r->out.authoritative = 1;
+
+        nt_status = dcesrv_netr_LogonSamLogon_check(&r2);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        return_authenticator = talloc(mem_ctx, struct netr_Authenticator);
+        NT_STATUS_HAVE_NO_MEMORY(return_authenticator);
+
+        nt_status = dcesrv_netr_creds_server_step_check(dce_call,
+                                                        mem_ctx,
+                                                        r->in.computer_name,
+                                                        r->in.credential, return_authenticator,
+                                                        &creds);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+
         nt_status = dcesrv_netr_LogonSamLogon_base(dce_call, mem_ctx, &r2, creds);
 
@@ -727 +901 @@
 }
 
-/* 
+/*
   netr_LogonSamLogon
 */
@@ -759 +933 @@
 
 
-/* 
-  netr_LogonSamLogoff 
+/*
+  netr_LogonSamLogoff
 */
 static NTSTATUS dcesrv_netr_LogonSamLogoff(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -770 +944 @@
 
 
-/* 
-  netr_DatabaseDeltas 
+/*
+  netr_DatabaseDeltas
 */
 static NTSTATUS dcesrv_netr_DatabaseDeltas(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -780 +954 @@
 
 
-/* 
-  netr_DatabaseSync2 
+/*
+  netr_DatabaseSync2
 */
 static NTSTATUS dcesrv_netr_DatabaseSync2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -791 +965 @@
 
 
-/* 
-  netr_DatabaseSync 
+/*
+  netr_DatabaseSync
 */
 static NTSTATUS dcesrv_netr_DatabaseSync(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -818 +992 @@
 
 
-/* 
-  netr_AccountDeltas 
+/*
+  netr_AccountDeltas
 */
 static NTSTATUS dcesrv_netr_AccountDeltas(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -829 +1003 @@
 
 
-/* 
-  netr_AccountSync 
+/*
+  netr_AccountSync
 */
 static NTSTATUS dcesrv_netr_AccountSync(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -840 +1014 @@
 
 
-/* 
-  netr_GetDcName 
+/*
+  netr_GetDcName
 */
 static WERROR dcesrv_netr_GetDcName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -853 +1027 @@
         const char *dcname;
 
+        /*
+         * [MS-NRPC] 3.5.5.3.4 NetrGetDCName says
+         * that the domainname needs to be a valid netbios domain
+         * name, if it is not NULL.
+         */
+        if (r->in.domainname) {
+                const char *dot = strchr(r->in.domainname, '.');
+                size_t len = strlen(r->in.domainname);
+
+                if (dot || len > 15) {
+                        return WERR_DCNOTFOUND;
+                }
+
+                /*
+                 * TODO: Should we also varify that only valid
+                 *       netbios name characters are used?
+                 */
+        }
+
         sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
                                 dce_call->conn->dce_ctx->lp_ctx,
-                                dce_call->conn->auth_state.session_info);
+                                dce_call->conn->auth_state.session_info, 0);
         if (sam_ctx == NULL) {
                 return WERR_DS_UNAVAILABLE;
@@ -876 +1069 @@
          */
         dcname = talloc_asprintf(mem_ctx, "\\\\%s",
-                                 lp_netbios_name(dce_call->conn->dce_ctx->lp_ctx));
+                                 lpcfg_netbios_name(dce_call->conn->dce_ctx->lp_ctx));
         W_ERROR_HAVE_NO_MEMORY(dcname);
 
@@ -884 +1077 @@
 
 
-/* 
-  netr_LogonControl2Ex 
+/*
+  netr_LogonControl2Ex
 */
 static WERROR dcesrv_netr_LogonControl2Ex(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -894 +1087 @@
 
 
-/* 
-  netr_LogonControl 
+/*
+  netr_LogonControl
 */
 static WERROR dcesrv_netr_LogonControl(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -923 +1116 @@
 
 
-/* 
-  netr_LogonControl2 
+/*
+  netr_LogonControl2
 */
 static WERROR dcesrv_netr_LogonControl2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -945 +1138 @@
 }
 
-
-/* 
-  netr_GetAnyDCName 
+static WERROR fill_trusted_domains_array(TALLOC_CTX *mem_ctx,
+                                         struct ldb_context *sam_ctx,
+                                         struct netr_DomainTrustList *trusts,
+                                         uint32_t trust_flags);
+
+/*
+  netr_GetAnyDCName
 */
 static WERROR dcesrv_netr_GetAnyDCName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                        struct netr_GetAnyDCName *r)
 {
-        struct netr_GetDcName r2;
+        struct netr_DomainTrustList *trusts;
+        struct ldb_context *sam_ctx;
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        uint32_t i;
         WERROR werr;
 
-        ZERO_STRUCT(r2);
-
-        r2.in.logon_server      = r->in.logon_server;
-        r2.in.domainname        = r->in.domainname;
-        r2.out.dcname           = r->out.dcname;
-
-        werr = dcesrv_netr_GetDcName(dce_call, mem_ctx, &r2);
-
-        return werr;
-}
-
-
-/* 
-  netr_DatabaseRedo 
+        *r->out.dcname = NULL;
+
+        if ((r->in.domainname == NULL) || (r->in.domainname[0] == '\0')) {
+                /* if the domainname parameter wasn't set assume our domain */
+                r->in.domainname = lpcfg_workgroup(lp_ctx);
+        }
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return WERR_DS_UNAVAILABLE;
+        }
+
+        if (strcasecmp(r->in.domainname, lpcfg_workgroup(lp_ctx)) == 0) {
+                /* well we asked for a DC of our own domain */
+                if (samdb_is_pdc(sam_ctx)) {
+                        /* we are the PDC of the specified domain */
+                        return WERR_NO_SUCH_DOMAIN;
+                }
+
+                *r->out.dcname = talloc_asprintf(mem_ctx, "\\%s",
+                                                lpcfg_netbios_name(lp_ctx));
+                W_ERROR_HAVE_NO_MEMORY(*r->out.dcname);
+
+                return WERR_OK;
+        }
+
+        /* Okay, now we have to consider the trusted domains */
+
+        trusts = talloc_zero(mem_ctx, struct netr_DomainTrustList);
+        W_ERROR_HAVE_NO_MEMORY(trusts);
+
+        trusts->count = 0;
+
+        werr = fill_trusted_domains_array(mem_ctx, sam_ctx, trusts,
+                                          NETR_TRUST_FLAG_INBOUND
+                                          | NETR_TRUST_FLAG_OUTBOUND);
+        W_ERROR_NOT_OK_RETURN(werr);
+
+        for (i = 0; i < trusts->count; i++) {
+                if (strcasecmp(r->in.domainname, trusts->array[i].netbios_name) == 0) {
+                        /* FIXME: Here we need to find a DC for the specified
+                         * trusted domain. */
+
+                        /* return WERR_OK; */
+                        return WERR_NO_SUCH_DOMAIN;
+                }
+        }
+
+        return WERR_NO_SUCH_DOMAIN;
+}
+
+
+/*
+  netr_DatabaseRedo
 */
 static NTSTATUS dcesrv_netr_DatabaseRedo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -977 +1218 @@
 
 
-/* 
-  netr_NetrEnumerateTurstedDomains
-*/
-static WERROR dcesrv_netr_NetrEnumerateTrustedDomains(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+/*
+  netr_NetrEnumerateTrustedDomains
+*/
+static NTSTATUS dcesrv_netr_NetrEnumerateTrustedDomains(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                        struct netr_NetrEnumerateTrustedDomains *r)
 {
@@ -987 +1228 @@
 
 
-/* 
+/*
   netr_LogonGetCapabilities
 */
@@ -998 +1239 @@
 
 
-/* 
-  netr_NETRLOGONSETSERVICEBITS 
+/*
+  netr_NETRLOGONSETSERVICEBITS
 */
 static WERROR dcesrv_netr_NETRLOGONSETSERVICEBITS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1018 +1259 @@
 
 
-/* 
-  netr_NETRLOGONCOMPUTESERVERDIGEST 
+/*
+  netr_NETRLOGONCOMPUTESERVERDIGEST
 */
 static WERROR dcesrv_netr_NETRLOGONCOMPUTESERVERDIGEST(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1028 +1269 @@
 
 
-/* 
-  netr_NETRLOGONCOMPUTECLIENTDIGEST 
+/*
+  netr_NETRLOGONCOMPUTECLIENTDIGEST
 */
 static WERROR dcesrv_netr_NETRLOGONCOMPUTECLIENTDIGEST(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1039 +1280 @@
 
 
-/* 
+/*
   netr_DsRGetSiteName
 */
@@ -1045 +1286 @@
                                   struct netr_DsRGetSiteName *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        struct ldb_context *sam_ctx;
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return WERR_DS_UNAVAILABLE;
+        }
+
+        *r->out.site = samdb_server_site_name(sam_ctx, mem_ctx);
+        W_ERROR_HAVE_NO_MEMORY(*r->out.site);
+
+        return WERR_OK;
 }
 
@@ -1065 +1318 @@
                 info->trust_extension.info = talloc_zero(mem_ctx, struct netr_trust_extension);
                 info->trust_extension.length = 16;
-                info->trust_extension.info->flags = 
+                info->trust_extension.info->flags =
                         NETR_TRUST_FLAG_TREEROOT |
-                        NETR_TRUST_FLAG_IN_FOREST | 
+                        NETR_TRUST_FLAG_IN_FOREST |
                         NETR_TRUST_FLAG_PRIMARY |
                         NETR_TRUST_FLAG_NATIVE;
@@ -1081 +1334 @@
                 info->dns_forestname.string = NULL;
         } else {
-                char *p;
-                /* TODO: we need a common function for pulling the forest */
-                info->dns_forestname.string = ldb_dn_canonical_string(info, ldb_get_root_basedn(sam_ctx));
-                if (!info->dns_forestname.string) {
-                        return NT_STATUS_NO_SUCH_DOMAIN;                
-                }
-                p = strchr(info->dns_forestname.string, '/');
-                if (p) {
-                        *p = '\0';
-                }
+                info->dns_forestname.string = samdb_forest_name(sam_ctx, mem_ctx);
+                NT_STATUS_HAVE_NO_MEMORY(info->dns_forestname.string);
                 info->dns_forestname.string = talloc_asprintf(mem_ctx, "%s.", info->dns_forestname.string);
-                                        
+                NT_STATUS_HAVE_NO_MEMORY(info->dns_forestname.string);
         }
 
         if (is_local) {
-                info->domainname.string = lp_sam_name(lp_ctx);
-                info->dns_domainname.string = lp_realm(lp_ctx);
+                info->domainname.string = lpcfg_workgroup(lp_ctx);
+                info->dns_domainname.string = lpcfg_dnsdomain(lp_ctx);
                 info->domain_guid = samdb_result_guid(res, "objectGUID");
                 info->domain_sid = samdb_result_dom_sid(mem_ctx, res, "objectSid");
         } else {
-                info->domainname.string = samdb_result_string(res, "flatName", NULL);
-                info->dns_domainname.string = samdb_result_string(res, "trustPartner", NULL);
+                info->domainname.string = ldb_msg_find_attr_as_string(res, "flatName", NULL);
+                info->dns_domainname.string = ldb_msg_find_attr_as_string(res, "trustPartner", NULL);
                 info->domain_guid = samdb_result_guid(res, "objectGUID");
                 info->domain_sid = samdb_result_dom_sid(mem_ctx, res, "securityIdentifier");
@@ -1113 +1358 @@
 }
 
-/* 
+/*
   netr_LogonGetDomainInfo
   this is called as part of the ADS domain logon procedure.
@@ -1126 +1371 @@
         const char * const attrs[] = { "objectSid", "objectGUID", "flatName",
                 "securityIdentifier", "trustPartner", NULL };
-        const char *temp_str;
-        const char *old_dns_hostname;
+        const char * const attrs2[] = { "sAMAccountName", "dNSHostName",
+                "msDS-SupportedEncryptionTypes", NULL };
+        const char *sam_account_name, *old_dns_hostname, *prefix1, *prefix2;
         struct ldb_context *sam_ctx;
-        struct ldb_message **res1, **res2, *new_msg;
+        struct ldb_message **res1, **res2, **res3, *new_msg;
         struct ldb_dn *workstation_dn;
         struct netr_DomainInformation *domain_info;
         struct netr_LsaPolicyInformation *lsa_policy_info;
-        struct netr_OsVersionInfoEx *os_version;
         uint32_t default_supported_enc_types = 0xFFFFFFFF;
-        int ret1, ret2, i;
+        bool update_dns_hostname = true;
+        int ret, ret3, i;
         NTSTATUS status;
 
         status = dcesrv_netr_creds_server_step_check(dce_call,
-                                                     mem_ctx, 
-                                                     r->in.computer_name, 
-                                                     r->in.credential, 
+                                                     mem_ctx,
+                                                     r->in.computer_name,
+                                                     r->in.credential,
                                                      r->out.return_authenticator,
                                                      &creds);
@@ -1150 +1396 @@
 
         sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
-                dce_call->conn->dce_ctx->lp_ctx,
-                system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+                                dce_call->conn->dce_ctx->lp_ctx,
+                                system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
@@ -1159 +1405 @@
         case 1: /* Domain information */
 
-                /* TODO: check NTSTATUS results - and fail also on SAMDB
-                 * errors (needs some testing against Windows Server 2008) */
+                if (r->in.query->workstation_info == NULL) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                /* Prepares the workstation DN */
+                workstation_dn = ldb_dn_new_fmt(mem_ctx, sam_ctx, "<SID=%s>",
+                                                dom_sid_string(mem_ctx, creds->sid));
+                NT_STATUS_HAVE_NO_MEMORY(workstation_dn);
+
+                /* Lookup for attributes in workstation object */
+                ret = gendb_search_dn(sam_ctx, mem_ctx, workstation_dn, &res1,
+                                      attrs2);
+                if (ret != 1) {
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+
+                /* Gets the sam account name which is checked against the DNS
+                 * hostname parameter. */
+                sam_account_name = ldb_msg_find_attr_as_string(res1[0],
+                                                               "sAMAccountName",
+                                                               NULL);
+                if (sam_account_name == NULL) {
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
 
                 /*
-                 * Check that the computer name parameter matches as prefix with
-                 * the DNS hostname in the workstation info structure.
+                 * Checks that the sam account name without a possible "$"
+                 * matches as prefix with the DNS hostname in the workstation
+                 * info structure.
                  */
-                temp_str = strndup(r->in.query->workstation_info->dns_hostname,
-                        strcspn(r->in.query->workstation_info->dns_hostname,
-                        "."));
-                if (strcasecmp(r->in.computer_name, temp_str) != 0)
-                        return NT_STATUS_INVALID_PARAMETER;
-
-                workstation_dn = ldb_dn_new_fmt(mem_ctx, sam_ctx, "<SID=%s>",
-                        dom_sid_string(mem_ctx, creds->sid));
-                NT_STATUS_HAVE_NO_MEMORY(workstation_dn);
+                prefix1 = talloc_strndup(mem_ctx, sam_account_name,
+                                         strcspn(sam_account_name, "$"));
+                NT_STATUS_HAVE_NO_MEMORY(prefix1);
+                if (r->in.query->workstation_info->dns_hostname != NULL) {
+                        prefix2 = talloc_strndup(mem_ctx,
+                                                 r->in.query->workstation_info->dns_hostname,
+                                                 strcspn(r->in.query->workstation_info->dns_hostname, "."));
+                        NT_STATUS_HAVE_NO_MEMORY(prefix2);
+
+                        if (strcasecmp(prefix1, prefix2) != 0) {
+                                update_dns_hostname = false;
+                        }
+                } else {
+                        update_dns_hostname = false;
+                }
 
                 /* Gets the old DNS hostname */
-                old_dns_hostname = samdb_search_string(sam_ctx, mem_ctx,
-                                                        workstation_dn,
-                                                        "dNSHostName",
-                                                        NULL);
-
-                /* Gets host informations and put them in our directory */
+                old_dns_hostname = ldb_msg_find_attr_as_string(res1[0],
+                                                               "dNSHostName",
+                                                               NULL);
+
+                /*
+                 * Updates the DNS hostname when the client wishes that the
+                 * server should handle this for him
+                 * ("NETR_WS_FLAG_HANDLES_SPN_UPDATE" not set). And this is
+                 * obviously only checked when we do already have a
+                 * "dNSHostName".
+                 * See MS-NRPC section 3.5.4.3.9
+                 */
+                if ((old_dns_hostname != NULL) &&
+                    (r->in.query->workstation_info->workstation_flags
+                    & NETR_WS_FLAG_HANDLES_SPN_UPDATE) != 0) {
+                        update_dns_hostname = false;
+                }
+
+                /* Gets host information and put them into our directory */
+
                 new_msg = ldb_msg_new(mem_ctx);
                 NT_STATUS_HAVE_NO_MEMORY(new_msg);
@@ -1188 +1477 @@
                 new_msg->dn = workstation_dn;
 
-                /* Deletes old OS version values */
-                samdb_msg_add_delete(sam_ctx, mem_ctx, new_msg,
-                        "operatingSystemServicePack");
-                samdb_msg_add_delete(sam_ctx, mem_ctx, new_msg,
-                        "operatingSystemVersion");
-
-                if (samdb_replace(sam_ctx, mem_ctx, new_msg) != LDB_SUCCESS) {
-                        DEBUG(3,("Impossible to update samdb: %s\n",
-                                ldb_errstring(sam_ctx)));
-                }
-
-                talloc_free(new_msg);
-
-                new_msg = ldb_msg_new(mem_ctx);
-                NT_STATUS_HAVE_NO_MEMORY(new_msg);
-
-                new_msg->dn = workstation_dn;
-
                 /* Sets the OS name */
-                samdb_msg_set_string(sam_ctx, mem_ctx, new_msg,
-                        "operatingSystem",
-                        r->in.query->workstation_info->os_name.string);
-
-                if (r->in.query->workstation_info->dns_hostname) {
-                        /* TODO: should this always be done? */
-                        samdb_msg_add_string(sam_ctx, mem_ctx, new_msg,
-                                             "dNSHostname",
-                                             r->in.query->workstation_info->dns_hostname);
+
+                if (r->in.query->workstation_info->os_name.string == NULL) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                ret = ldb_msg_add_string(new_msg, "operatingSystem",
+                                         r->in.query->workstation_info->os_name.string);
+                if (ret != LDB_SUCCESS) {
+                        return NT_STATUS_NO_MEMORY;
                 }
 
                 /*
-                 * Sets informations from "os_version". On a empty structure
+                 * Sets information from "os_version". On an empty structure
                  * the values are cleared.
                  */
                 if (r->in.query->workstation_info->os_version.os != NULL) {
+                        struct netr_OsVersionInfoEx *os_version;
+                        const char *os_version_str;
+
                         os_version = &r->in.query->workstation_info->os_version.os->os;
 
-                        samdb_msg_set_string(sam_ctx, mem_ctx, new_msg,
-                                             "operatingSystemServicePack",
-                                             os_version->CSDVersion);
-
-                        samdb_msg_set_string(sam_ctx, mem_ctx, new_msg,
-                                "operatingSystemVersion",
-                                talloc_asprintf(mem_ctx, "%d.%d (%d)",
-                                        os_version->MajorVersion,
-                                        os_version->MinorVersion,
-                                        os_version->BuildNumber
-                                )
-                        );
+                        if (os_version->CSDVersion == NULL) {
+                                return NT_STATUS_INVALID_PARAMETER;
+                        }
+
+                        os_version_str = talloc_asprintf(new_msg, "%u.%u (%u)",
+                                                         os_version->MajorVersion,
+                                                         os_version->MinorVersion,
+                                                         os_version->BuildNumber);
+                        NT_STATUS_HAVE_NO_MEMORY(os_version_str);
+
+                        ret = ldb_msg_add_string(new_msg,
+                                                 "operatingSystemServicePack",
+                                                 os_version->CSDVersion);
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+
+                        ret = ldb_msg_add_string(new_msg,
+                                                 "operatingSystemVersion",
+                                                 os_version_str);
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                } else {
+                        ret = samdb_msg_add_delete(sam_ctx, mem_ctx, new_msg,
+                                                   "operatingSystemServicePack");
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+
+                        ret = samdb_msg_add_delete(sam_ctx, mem_ctx, new_msg,
+                                                   "operatingSystemVersion");
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
                 }
 
                 /*
-                 * Updates the "dNSHostname" and the "servicePrincipalName"s
-                 * since the client wishes that the server should handle this
-                 * for him ("NETR_WS_FLAG_HANDLES_SPN_UPDATE" not set).
-                 * See MS-NRPC section 3.5.4.3.9
+                 * If the boolean "update_dns_hostname" remained true, then we
+                 * are fine to start the update.
                  */
-                if ((r->in.query->workstation_info->workstation_flags
-                        & NETR_WS_FLAG_HANDLES_SPN_UPDATE) == 0) {
-
-                        samdb_msg_add_string(sam_ctx, mem_ctx, new_msg,
-                                "servicePrincipalName",
-                                talloc_asprintf(mem_ctx, "HOST/%s",
-                                r->in.computer_name)
-                        );
-                        samdb_msg_add_string(sam_ctx, mem_ctx, new_msg,
-                                "servicePrincipalName",
-                                talloc_asprintf(mem_ctx, "HOST/%s",
-                                r->in.query->workstation_info->dns_hostname)
-                        );
-                }
-
-                if (samdb_replace(sam_ctx, mem_ctx, new_msg) != LDB_SUCCESS) {
+                if (update_dns_hostname) {
+                        ret = ldb_msg_add_string(new_msg,
+                                                 "dNSHostname",
+                                                 r->in.query->workstation_info->dns_hostname);
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+
+                        /* This manual "servicePrincipalName" generation is
+                         * still needed! Since the update in the samldb LDB
+                         * module does only work if the entries already exist
+                         * which isn't always the case. */
+                        ret = ldb_msg_add_string(new_msg,
+                                                 "servicePrincipalName",
+                                                 talloc_asprintf(new_msg, "HOST/%s",
+                                                 r->in.computer_name));
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+
+                        ret = ldb_msg_add_string(new_msg,
+                                                 "servicePrincipalName",
+                                                 talloc_asprintf(new_msg, "HOST/%s",
+                                                 r->in.query->workstation_info->dns_hostname));
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                }
+
+                if (dsdb_replace(sam_ctx, new_msg, 0) != LDB_SUCCESS) {
                         DEBUG(3,("Impossible to update samdb: %s\n",
                                 ldb_errstring(sam_ctx)));
@@ -1274 +1583 @@
                    put the primary domain into the lists of returned trusts as
                    well. */
-                ret1 = gendb_search_dn(sam_ctx, mem_ctx, samdb_base_dn(sam_ctx),
-                        &res1, attrs);
-                if (ret1 != 1) {
+                ret = gendb_search_dn(sam_ctx, mem_ctx, ldb_get_default_basedn(sam_ctx),
+                        &res2, attrs);
+                if (ret != 1) {
                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
                 }
 
-                ret2 = gendb_search(sam_ctx, mem_ctx, NULL, &res2, attrs,
+                ret3 = gendb_search(sam_ctx, mem_ctx, NULL, &res3, attrs,
                         "(objectClass=trustedDomain)");
-                if (ret2 == -1) {
+                if (ret3 == -1) {
                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
                 }
@@ -1295 +1604 @@
                 status = fill_one_domain_info(mem_ctx,
                         dce_call->conn->dce_ctx->lp_ctx,
-                        sam_ctx, res1[0], &domain_info->primary_domain,
+                        sam_ctx, res2[0], &domain_info->primary_domain,
                         true, false);
                 NT_STATUS_NOT_OK_RETURN(status);
 
-                domain_info->trusted_domain_count = ret2 + 1;
+                domain_info->trusted_domain_count = ret3 + 1;
                 domain_info->trusted_domains = talloc_array(mem_ctx,
                         struct netr_OneDomainInfo,
@@ -1305 +1614 @@
                 NT_STATUS_HAVE_NO_MEMORY(domain_info->trusted_domains);
 
-                for (i=0;i<ret2;i++) {
+                for (i=0;i<ret3;i++) {
                         status = fill_one_domain_info(mem_ctx,
                                 dce_call->conn->dce_ctx->lp_ctx,
-                                sam_ctx, res2[i],
+                                sam_ctx, res3[i],
                                 &domain_info->trusted_domains[i],
                                 false, true);
@@ -1315 +1624 @@
 
                 status = fill_one_domain_info(mem_ctx,
-                        dce_call->conn->dce_ctx->lp_ctx, sam_ctx, res1[0],
+                        dce_call->conn->dce_ctx->lp_ctx, sam_ctx, res2[0],
                         &domain_info->trusted_domains[i], true, true);
                 NT_STATUS_NOT_OK_RETURN(status);
 
                 /* Sets the supported encryption types */
-                domain_info->supported_enc_types = samdb_search_uint(
-                        sam_ctx, mem_ctx,
-                        default_supported_enc_types, workstation_dn,
-                        "msDS-SupportedEncryptionTypes", NULL);
-
-                /* Other host domain informations */
+                domain_info->supported_enc_types = ldb_msg_find_attr_as_uint(res1[0],
+                        "msDS-SupportedEncryptionTypes",
+                        default_supported_enc_types);
+
+                /* Other host domain information */
 
                 lsa_policy_info = talloc(mem_ctx,
@@ -1334 +1642 @@
                 domain_info->lsa_policy = *lsa_policy_info;
 
-                domain_info->dns_hostname.string = old_dns_hostname;
+                /* The DNS hostname is only returned back when there is a chance
+                 * for a change. */
+                if ((r->in.query->workstation_info->workstation_flags
+                    & NETR_WS_FLAG_HANDLES_SPN_UPDATE) != 0) {
+                        domain_info->dns_hostname.string = old_dns_hostname;
+                } else {
+                        domain_info->dns_hostname.string = NULL;
+                }
+
                 domain_info->workstation_flags =
                         r->in.query->workstation_info->workstation_flags;
@@ -1357 +1673 @@
 
 
-
 /*
   netr_ServerPasswordGet
@@ -1368 +1683 @@
 
 
-/* 
-  netr_NETRLOGONSENDTOSAM 
+/*
+  netr_NETRLOGONSENDTOSAM
 */
 static WERROR dcesrv_netr_NETRLOGONSENDTOSAM(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1378 +1693 @@
 
 
-/* 
-  netr_DsRAddressToSitenamesW 
-*/
-static WERROR dcesrv_netr_DsRAddressToSitenamesW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct netr_DsRAddressToSitenamesW *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/* 
+/*
   netr_DsRGetDCNameEx2
 */
-static WERROR dcesrv_netr_DsRGetDCNameEx2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                                   struct netr_DsRGetDCNameEx2 *r)
-{
-        const char * const attrs[] = { "objectGUID", NULL };
+static WERROR dcesrv_netr_DsRGetDCNameEx2(struct dcesrv_call_state *dce_call,
+                                          TALLOC_CTX *mem_ctx,
+                                          struct netr_DsRGetDCNameEx2 *r)
+{
         struct ldb_context *sam_ctx;
-        struct ldb_message **res;
-        struct ldb_dn *domain_dn;
-        int ret;
         struct netr_DsRGetDCNameInfo *info;
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        const struct tsocket_address *remote_address;
+        char *addr = NULL;
+        const char *server_site_name;
+        char *guid_str;
+        struct netlogon_samlogon_response response;
+        NTSTATUS status;
+        const char *dc_name = NULL;
+        const char *domain_name = NULL;
 
         ZERO_STRUCTP(r->out.info);
 
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info);
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
         if (sam_ctx == NULL) {
                 return WERR_DS_UNAVAILABLE;
         }
 
-        /* Win7-beta will send the domain name in the form the user typed, so we have to cope
-           with both the short and long form here */
-        if (r->in.domain_name != NULL && !lp_is_my_domain_or_realm(dce_call->conn->dce_ctx->lp_ctx, 
-                                                                r->in.domain_name)) {
+        remote_address = dcesrv_connection_get_remote_address(dce_call->conn);
+        if (tsocket_address_is_inet(remote_address, "ip")) {
+                addr = tsocket_address_inet_addr_string(remote_address, mem_ctx);
+                W_ERROR_HAVE_NO_MEMORY(addr);
+        }
+
+        /* "server_unc" is ignored by w2k3 */
+
+        if (r->in.flags & ~(DSGETDC_VALID_FLAGS)) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        if (r->in.flags & DS_GC_SERVER_REQUIRED &&
+            r->in.flags & DS_PDC_REQUIRED &&
+            r->in.flags & DS_KDC_REQUIRED) {
+                return WERR_INVALID_FLAGS;
+        }
+        if (r->in.flags & DS_IS_FLAT_NAME &&
+            r->in.flags & DS_IS_DNS_NAME) {
+                return WERR_INVALID_FLAGS;
+        }
+        if (r->in.flags & DS_RETURN_DNS_NAME &&
+            r->in.flags & DS_RETURN_FLAT_NAME) {
+                return WERR_INVALID_FLAGS;
+        }
+        if (r->in.flags & DS_DIRECTORY_SERVICE_REQUIRED &&
+            r->in.flags & DS_DIRECTORY_SERVICE_6_REQUIRED) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        if (r->in.flags & DS_GOOD_TIMESERV_PREFERRED &&
+            r->in.flags &
+            (DS_DIRECTORY_SERVICE_REQUIRED |
+             DS_DIRECTORY_SERVICE_PREFERRED |
+             DS_GC_SERVER_REQUIRED |
+             DS_PDC_REQUIRED |
+             DS_KDC_REQUIRED)) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        if (r->in.flags & DS_TRY_NEXTCLOSEST_SITE &&
+            r->in.site_name) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        /* Proof server site parameter "site_name" if it was specified */
+        server_site_name = samdb_server_site_name(sam_ctx, mem_ctx);
+        W_ERROR_HAVE_NO_MEMORY(server_site_name);
+        if ((r->in.site_name != NULL) && (strcasecmp(r->in.site_name,
+                                                     server_site_name) != 0)) {
                 return WERR_NO_SUCH_DOMAIN;
         }
 
-        domain_dn = ldb_get_default_basedn(sam_ctx);
-        if (domain_dn == NULL) {
-                return WERR_DS_UNAVAILABLE;
-        }
-
-        ret = gendb_search_dn(sam_ctx, mem_ctx,
-                              domain_dn, &res, attrs);
-        if (ret != 1) {
+        guid_str = r->in.domain_guid != NULL ?
+                 GUID_string(mem_ctx, r->in.domain_guid) : NULL;
+
+        status = fill_netlogon_samlogon_response(sam_ctx, mem_ctx,
+                                                 r->in.domain_name,
+                                                 r->in.domain_name,
+                                                 NULL, guid_str,
+                                                 r->in.client_account,
+                                                 r->in.mask, addr,
+                                                 NETLOGON_NT_VERSION_5EX_WITH_IP,
+                                                 lp_ctx, &response, true);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+
+        if (r->in.flags & DS_RETURN_DNS_NAME) {
+                dc_name = response.data.nt5_ex.pdc_dns_name;
+                domain_name = response.data.nt5_ex.dns_domain;
+        } else if (r->in.flags & DS_RETURN_FLAT_NAME) {
+                dc_name = response.data.nt5_ex.pdc_name;
+                domain_name = response.data.nt5_ex.domain_name;
+        } else {
+
+                /*
+                 * TODO: autodetect what we need to return
+                 * based on the given arguments
+                 */
+                dc_name = response.data.nt5_ex.pdc_name;
+                domain_name = response.data.nt5_ex.domain_name;
+        }
+
+        if (!dc_name || !dc_name[0]) {
+                return WERR_NO_SUCH_DOMAIN;
+        }
+
+        if (!domain_name || !domain_name[0]) {
+                return WERR_NO_SUCH_DOMAIN;
         }
 
         info = talloc(mem_ctx, struct netr_DsRGetDCNameInfo);
         W_ERROR_HAVE_NO_MEMORY(info);
-
-        /* TODO: - return real IP address
-         *       - check all r->in.* parameters (server_unc is ignored by w2k3!)
-         */
-        info->dc_unc                    = talloc_asprintf(mem_ctx, "\\\\%s.%s",
-                                                          lp_netbios_name(dce_call->conn->dce_ctx->lp_ctx), 
-                                                          lp_realm(dce_call->conn->dce_ctx->lp_ctx));
+        info->dc_unc           = talloc_asprintf(mem_ctx, "\\\\%s", dc_name);
         W_ERROR_HAVE_NO_MEMORY(info->dc_unc);
-        info->dc_address                = talloc_strdup(mem_ctx, "\\\\0.0.0.0");
+        info->dc_address = talloc_asprintf(mem_ctx, "\\\\%s",
+                                           response.data.nt5_ex.sockaddr.pdc_ip);
         W_ERROR_HAVE_NO_MEMORY(info->dc_address);
-        info->dc_address_type           = DS_ADDRESS_TYPE_INET;
-        info->domain_guid               = samdb_result_guid(res[0], "objectGUID");
-        info->domain_name               = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
-        info->forest_name               = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
-        info->dc_flags                  = DS_DNS_FOREST |
-                                          DS_DNS_DOMAIN |
-                                          DS_DNS_CONTROLLER |
-                                          DS_SERVER_WRITABLE |
-                                          DS_SERVER_CLOSEST |
-                                          DS_SERVER_TIMESERV |
-                                          DS_SERVER_KDC |
-                                          DS_SERVER_DS |
-                                          DS_SERVER_LDAP |
-                                          DS_SERVER_GC |
-                                          DS_SERVER_PDC;
-        info->dc_site_name      = talloc_strdup(mem_ctx, "Default-First-Site-Name");
-        W_ERROR_HAVE_NO_MEMORY(info->dc_site_name);
-        info->client_site_name  = talloc_strdup(mem_ctx, "Default-First-Site-Name");
-        W_ERROR_HAVE_NO_MEMORY(info->client_site_name);
+        info->dc_address_type  = DS_ADDRESS_TYPE_INET; /* TODO: make this dynamic? for ipv6 */
+        info->domain_guid      = response.data.nt5_ex.domain_uuid;
+        info->domain_name      = domain_name;
+        info->forest_name      = response.data.nt5_ex.forest;
+        info->dc_flags         = response.data.nt5_ex.server_type;
+        info->dc_site_name     = response.data.nt5_ex.server_site;
+        info->client_site_name = response.data.nt5_ex.client_site;
 
         *r->out.info = info;
@@ -1462 +1832 @@
 }
 
-/* 
+/*
   netr_DsRGetDCNameEx
 */
@@ -1487 +1857 @@
 }
 
-/* 
+/*
   netr_DsRGetDCName
 */
@@ -1503 +1873 @@
         r2.in.domain_name = r->in.domain_name;
         r2.in.domain_guid = r->in.domain_guid;
-        
-        r2.in.site_name = NULL; /* should fill in from site GUID */
+
+        r2.in.site_name = NULL; /* this is correct, we should ignore site GUID */
         r2.in.flags = r->in.flags;
         r2.out.info = r->out.info;
@@ -1512 +1882 @@
         return werr;
 }
-/* 
-  netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN 
+/*
+  netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN
 */
 static WERROR dcesrv_netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1532 +1902 @@
 
 
-/* 
-  netr_DsRAddressToSitenamesExW 
+/*
+  netr_DsRAddressToSitenamesExW
 */
 static WERROR dcesrv_netr_DsRAddressToSitenamesExW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                                                    struct netr_DsRAddressToSitenamesExW *r)
 {
+        struct ldb_context *sam_ctx;
         struct netr_DsRAddressToSitenamesExWCtr *ctr;
-        int i;
-
-        /* we should map the provided IPs to site names, once we have
-         * sites support
-         */
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        sa_family_t sin_family;
+        struct sockaddr_in *addr;
+#ifdef HAVE_IPV6
+        struct sockaddr_in6 *addr6;
+        char addr_str[INET6_ADDRSTRLEN];
+#else
+        char addr_str[INET_ADDRSTRLEN];
+#endif
+        char *subnet_name;
+        const char *res;
+        uint32_t i;
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return WERR_DS_UNAVAILABLE;
+        }
+
         ctr = talloc(mem_ctx, struct netr_DsRAddressToSitenamesExWCtr);
         W_ERROR_HAVE_NO_MEMORY(ctr);
@@ -1556 +1941 @@
 
         for (i=0; i<ctr->count; i++) {
-                ctr->sitename[i].string   = "Default-First-Site-Name";
+                ctr->sitename[i].string = NULL;
                 ctr->subnetname[i].string = NULL;
+
+                if (r->in.addresses[i].size < sizeof(sa_family_t)) {
+                        continue;
+                }
+                /* The first two byte of the buffer are reserved for the
+                 * "sin_family" but for now only the first one is used. */
+                sin_family = r->in.addresses[i].buffer[0];
+
+                switch (sin_family) {
+                case AF_INET:
+                        if (r->in.addresses[i].size < sizeof(struct sockaddr_in)) {
+                                continue;
+                        }
+                        addr = (struct sockaddr_in *) r->in.addresses[i].buffer;
+                        res = inet_ntop(AF_INET, &addr->sin_addr,
+                                        addr_str, sizeof(addr_str));
+                        break;
+#ifdef HAVE_IPV6
+                case AF_INET6:
+                        if (r->in.addresses[i].size < sizeof(struct sockaddr_in6)) {
+                                continue;
+                        }
+                        addr6 = (struct sockaddr_in6 *) r->in.addresses[i].buffer;
+                        res = inet_ntop(AF_INET6, &addr6->sin6_addr,
+                                        addr_str, sizeof(addr_str));
+                        break;
+#endif
+                default:
+                        continue;
+                }
+
+                if (res == NULL) {
+                        continue;
+                }
+
+                ctr->sitename[i].string   = samdb_client_site_name(sam_ctx,
+                                                                   mem_ctx,
+                                                                   addr_str,
+                                                                   &subnet_name);
+                W_ERROR_HAVE_NO_MEMORY(ctr->sitename[i].string);
+                ctr->subnetname[i].string = subnet_name;
         }
 
@@ -1564 +1990 @@
 
 
-/* 
+/*
+  netr_DsRAddressToSitenamesW
+*/
+static WERROR dcesrv_netr_DsRAddressToSitenamesW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                       struct netr_DsRAddressToSitenamesW *r)
+{
+        struct netr_DsRAddressToSitenamesExW r2;
+        struct netr_DsRAddressToSitenamesWCtr *ctr;
+        uint32_t i;
+        WERROR werr;
+
+        ZERO_STRUCT(r2);
+
+        r2.in.server_name = r->in.server_name;
+        r2.in.count = r->in.count;
+        r2.in.addresses = r->in.addresses;
+
+        r2.out.ctr = talloc(mem_ctx, struct netr_DsRAddressToSitenamesExWCtr *);
+        W_ERROR_HAVE_NO_MEMORY(r2.out.ctr);
+
+        ctr = talloc(mem_ctx, struct netr_DsRAddressToSitenamesWCtr);
+        W_ERROR_HAVE_NO_MEMORY(ctr);
+
+        *r->out.ctr = ctr;
+
+        ctr->count = r->in.count;
+        ctr->sitename = talloc_array(ctr, struct lsa_String, ctr->count);
+        W_ERROR_HAVE_NO_MEMORY(ctr->sitename);
+
+        werr = dcesrv_netr_DsRAddressToSitenamesExW(dce_call, mem_ctx, &r2);
+
+        for (i=0; i<ctr->count; i++) {
+                ctr->sitename[i].string   = (*r2.out.ctr)->sitename[i].string;
+        }
+
+        return werr;
+}
+
+
+/*
   netr_DsrGetDcSiteCoverageW
 */
@@ -1570 +2035 @@
                        struct netr_DsrGetDcSiteCoverageW *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/* 
-  netr_DsrEnumerateDomainTrusts 
-*/
-static WERROR dcesrv_netr_DsrEnumerateDomainTrusts(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                                              struct netr_DsrEnumerateDomainTrusts *r)
+        struct ldb_context *sam_ctx;
+        struct DcSitesCtr *ctr;
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return WERR_DS_UNAVAILABLE;
+        }
+
+        ctr = talloc(mem_ctx, struct DcSitesCtr);
+        W_ERROR_HAVE_NO_MEMORY(ctr);
+
+        *r->out.ctr = ctr;
+
+        /* For now only return our default site */
+        ctr->num_sites = 1;
+        ctr->sites = talloc_array(ctr, struct lsa_String, ctr->num_sites);
+        W_ERROR_HAVE_NO_MEMORY(ctr->sites);
+        ctr->sites[0].string = samdb_server_site_name(sam_ctx, mem_ctx);
+        W_ERROR_HAVE_NO_MEMORY(ctr->sites[0].string);
+
+        return WERR_OK;
+}
+
+
+#define GET_CHECK_STR(dest, mem, msg, attr) \
+do {\
+        const char *s; \
+        s = ldb_msg_find_attr_as_string(msg, attr, NULL); \
+        if (!s) { \
+                DEBUG(0, ("DB Error, TustedDomain entry (%s) " \
+                          "without flatname\n", \
+                          ldb_dn_get_linearized(msg->dn))); \
+                continue; \
+        } \
+        dest = talloc_strdup(mem, s); \
+        W_ERROR_HAVE_NO_MEMORY(dest); \
+} while(0)
+
+
+static WERROR fill_trusted_domains_array(TALLOC_CTX *mem_ctx,
+                                         struct ldb_context *sam_ctx,
+                                         struct netr_DomainTrustList *trusts,
+                                         uint32_t trust_flags)
+{
+        struct ldb_dn *system_dn;
+        struct ldb_message **dom_res = NULL;
+        const char *trust_attrs[] = { "flatname", "trustPartner",
+                                      "securityIdentifier", "trustDirection",
+                                      "trustType", "trustAttributes", NULL };
+        uint32_t n;
+        int i;
+        int ret;
+
+        if (!(trust_flags & (NETR_TRUST_FLAG_INBOUND |
+                             NETR_TRUST_FLAG_OUTBOUND))) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        system_dn = samdb_search_dn(sam_ctx, mem_ctx,
+                                    ldb_get_default_basedn(sam_ctx),
+                                    "(&(objectClass=container)(cn=System))");
+        if (!system_dn) {
+                return WERR_GENERAL_FAILURE;
+        }
+
+        ret = gendb_search(sam_ctx, mem_ctx, system_dn,
+                           &dom_res, trust_attrs,
+                           "(objectclass=trustedDomain)");
+
+        for (i = 0; i < ret; i++) {
+                unsigned int trust_dir;
+                uint32_t flags = 0;
+
+                trust_dir = ldb_msg_find_attr_as_uint(dom_res[i],
+                                                      "trustDirection", 0);
+
+                if (trust_dir & LSA_TRUST_DIRECTION_INBOUND) {
+                        flags |= NETR_TRUST_FLAG_INBOUND;
+                }
+                if (trust_dir & LSA_TRUST_DIRECTION_OUTBOUND) {
+                        flags |= NETR_TRUST_FLAG_OUTBOUND;
+                }
+
+                if (!(flags & trust_flags)) {
+                        /* this trust direction was not requested */
+                        continue;
+                }
+
+                n = trusts->count;
+                trusts->array = talloc_realloc(trusts, trusts->array,
+                                               struct netr_DomainTrust,
+                                               n + 1);
+                W_ERROR_HAVE_NO_MEMORY(trusts->array);
+
+                GET_CHECK_STR(trusts->array[n].netbios_name, trusts,
+                              dom_res[i], "flatname");
+                GET_CHECK_STR(trusts->array[n].dns_name, trusts,
+                              dom_res[i], "trustPartner");
+
+                trusts->array[n].trust_flags = flags;
+                if ((trust_flags & NETR_TRUST_FLAG_IN_FOREST) &&
+                    !(flags & NETR_TRUST_FLAG_TREEROOT)) {
+                        /* TODO: find if we have parent in the list */
+                        trusts->array[n].parent_index = 0;
+                }
+
+                trusts->array[n].trust_type =
+                                ldb_msg_find_attr_as_uint(dom_res[i],
+                                                  "trustType", 0);
+                trusts->array[n].trust_attributes =
+                                ldb_msg_find_attr_as_uint(dom_res[i],
+                                                  "trustAttributes", 0);
+
+                if ((trusts->array[n].trust_type == NETR_TRUST_TYPE_MIT) ||
+                    (trusts->array[n].trust_type == NETR_TRUST_TYPE_DCE)) {
+                        struct dom_sid zero_sid;
+                        ZERO_STRUCT(zero_sid);
+                        trusts->array[n].sid =
+                                dom_sid_dup(trusts, &zero_sid);
+                } else {
+                        trusts->array[n].sid =
+                                samdb_result_dom_sid(trusts, dom_res[i],
+                                                     "securityIdentifier");
+                }
+                trusts->array[n].guid = GUID_zero();
+
+                trusts->count = n + 1;
+        }
+
+        talloc_free(dom_res);
+        return WERR_OK;
+}
+
+/*
+  netr_DsrEnumerateDomainTrusts
+*/
+static WERROR dcesrv_netr_DsrEnumerateDomainTrusts(struct dcesrv_call_state *dce_call,
+                                                   TALLOC_CTX *mem_ctx,
+                                                   struct netr_DsrEnumerateDomainTrusts *r)
 {
         struct netr_DomainTrustList *trusts;
@@ -1585 +2182 @@
         struct ldb_message **dom_res;
         const char * const dom_attrs[] = { "objectSid", "objectGUID", NULL };
-
-        ZERO_STRUCT(r->out);
-
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info);
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        const char *dnsdomain = lpcfg_dnsdomain(lp_ctx);
+        const char *p;
+        WERROR werr;
+
+        if (r->in.trust_flags & 0xFFFFFE00) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        /* TODO: turn to hard check once we are sure this is 100% correct */
+        if (!r->in.server_name) {
+                DEBUG(3, ("Invalid domain! Expected name in domain [%s]. "
+                          "But received NULL!\n", dnsdomain));
+        } else {
+                p = strchr(r->in.server_name, '.');
+                if (!p) {
+                        DEBUG(3, ("Invalid domain! Expected name in domain "
+                                  "[%s]. But received [%s]!\n",
+                                  dnsdomain, r->in.server_name));
+                        p = r->in.server_name;
+                } else {
+                        p++;
+                }
+                if (strcasecmp(p, dnsdomain)) {
+                        DEBUG(3, ("Invalid domain! Expected name in domain "
+                                  "[%s]. But received [%s]!\n",
+                                  dnsdomain, r->in.server_name));
+                }
+        }
+
+        trusts = talloc_zero(mem_ctx, struct netr_DomainTrustList);
+        W_ERROR_HAVE_NO_MEMORY(trusts);
+
+        trusts->count = 0;
+        r->out.trusts = trusts;
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
         if (sam_ctx == NULL) {
                 return WERR_GENERAL_FAILURE;
         }
 
-        ret = gendb_search_dn(sam_ctx, mem_ctx, NULL,
-                              &dom_res, dom_attrs);
-        if (ret == -1) {
-                return WERR_GENERAL_FAILURE;            
-        }
+        if ((r->in.trust_flags & NETR_TRUST_FLAG_INBOUND) ||
+            (r->in.trust_flags & NETR_TRUST_FLAG_OUTBOUND)) {
+
+                werr = fill_trusted_domains_array(mem_ctx, sam_ctx,
+                                                  trusts, r->in.trust_flags);
+                W_ERROR_NOT_OK_RETURN(werr);
+        }
+
+        /* NOTE: we currently are always the root of the forest */
+        if (r->in.trust_flags & NETR_TRUST_FLAG_IN_FOREST) {
+                uint32_t n = trusts->count;
+
+                ret = gendb_search_dn(sam_ctx, mem_ctx, NULL,
+                                      &dom_res, dom_attrs);
+                if (ret != 1) {
+                        return WERR_GENERAL_FAILURE;
+                }
+
+                trusts->count = n + 1;
+                trusts->array = talloc_realloc(trusts, trusts->array,
+                                               struct netr_DomainTrust,
+                                               trusts->count);
+                W_ERROR_HAVE_NO_MEMORY(trusts->array);
+
+                trusts->array[n].netbios_name = lpcfg_workgroup(lp_ctx);
+                trusts->array[n].dns_name = lpcfg_dnsdomain(lp_ctx);
+                trusts->array[n].trust_flags =
+                        NETR_TRUST_FLAG_NATIVE |
+                        NETR_TRUST_FLAG_TREEROOT |
+                        NETR_TRUST_FLAG_IN_FOREST |
+                        NETR_TRUST_FLAG_PRIMARY;
+                /* we are always the root domain for now */
+                trusts->array[n].parent_index = 0;
+                trusts->array[n].trust_type = NETR_TRUST_TYPE_UPLEVEL;
+                trusts->array[n].trust_attributes = 0;
+                trusts->array[n].sid = samdb_result_dom_sid(mem_ctx,
+                                                            dom_res[0],
+                                                            "objectSid");
+                trusts->array[n].guid = samdb_result_guid(dom_res[0],
+                                                          "objectGUID");
+                talloc_free(dom_res);
+        }
+
+        return WERR_OK;
+}
+
+
+/*
+  netr_DsrDeregisterDNSHostRecords
+*/
+static WERROR dcesrv_netr_DsrDeregisterDNSHostRecords(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                       struct netr_DsrDeregisterDNSHostRecords *r)
+{
+        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+}
+
+
+/*
+  netr_ServerTrustPasswordsGet
+*/
+static NTSTATUS dcesrv_netr_ServerTrustPasswordsGet(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                       struct netr_ServerTrustPasswordsGet *r)
+{
+        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+}
+
+
+static WERROR fill_forest_trust_array(TALLOC_CTX *mem_ctx,
+                                      struct ldb_context *sam_ctx,
+                                      struct loadparm_context *lp_ctx,
+                                      struct lsa_ForestTrustInformation *info)
+{
+        struct lsa_ForestTrustDomainInfo *domain_info;
+        struct lsa_ForestTrustRecord *e;
+        struct ldb_message **dom_res;
+        const char * const dom_attrs[] = { "objectSid", NULL };
+        int ret;
+
+        /* we need to provide 2 entries:
+         * 1. the Root Forest name
+         * 2. the Domain Information
+         */
+
+        info->count = 2;
+        info->entries = talloc_array(info, struct lsa_ForestTrustRecord *, 2);
+        W_ERROR_HAVE_NO_MEMORY(info->entries);
+
+        /* Forest root info */
+        e = talloc(info, struct lsa_ForestTrustRecord);
+        W_ERROR_HAVE_NO_MEMORY(e);
+
+        e->flags = 0;
+        e->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME;
+        e->time = 0; /* so far always 0 in trces. */
+        e->forest_trust_data.top_level_name.string = samdb_forest_name(sam_ctx,
+                                                                       mem_ctx);
+        W_ERROR_HAVE_NO_MEMORY(e->forest_trust_data.top_level_name.string);
+
+        info->entries[0] = e;
+
+        /* Domain info */
+        e = talloc(info, struct lsa_ForestTrustRecord);
+        W_ERROR_HAVE_NO_MEMORY(e);
+
+        /* get our own domain info */
+        ret = gendb_search_dn(sam_ctx, mem_ctx, NULL, &dom_res, dom_attrs);
         if (ret != 1) {
                 return WERR_GENERAL_FAILURE;
         }
 
-        trusts = talloc(mem_ctx, struct netr_DomainTrustList);
-        W_ERROR_HAVE_NO_MEMORY(trusts);
-
-        trusts->array = talloc_array(trusts, struct netr_DomainTrust, ret);
-        W_ERROR_HAVE_NO_MEMORY(trusts->array);
-
-        trusts->count = 1; /* ?? */
-
-        r->out.trusts = trusts;
-
-        /* TODO: add filtering by trust_flags, and correct trust_type
-           and attributes */
-        trusts->array[0].netbios_name = lp_sam_name(dce_call->conn->dce_ctx->lp_ctx);
-        trusts->array[0].dns_name     = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
-        trusts->array[0].trust_flags =
-                NETR_TRUST_FLAG_TREEROOT | 
-                NETR_TRUST_FLAG_IN_FOREST | 
-                NETR_TRUST_FLAG_PRIMARY;
-        trusts->array[0].parent_index = 0;
-        trusts->array[0].trust_type = 2;
-        trusts->array[0].trust_attributes = 0;
-        trusts->array[0].sid  = samdb_result_dom_sid(mem_ctx, dom_res[0], "objectSid");
-        trusts->array[0].guid = samdb_result_guid(dom_res[0], "objectGUID");
+        /* TODO: check if disabled and set flags accordingly */
+        e->flags = 0;
+        e->type = LSA_FOREST_TRUST_DOMAIN_INFO;
+        e->time = 0; /* so far always 0 in traces. */
+
+        domain_info = &e->forest_trust_data.domain_info;
+        domain_info->domain_sid = samdb_result_dom_sid(info, dom_res[0],
+                                                       "objectSid");
+        domain_info->dns_domain_name.string = lpcfg_dnsdomain(lp_ctx);
+        domain_info->netbios_domain_name.string = lpcfg_workgroup(lp_ctx);
+
+        info->entries[1] = e;
+
+        talloc_free(dom_res);
 
         return WERR_OK;
 }
 
-
-/*
-  netr_DsrDeregisterDNSHostRecords
-*/
-static WERROR dcesrv_netr_DsrDeregisterDNSHostRecords(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct netr_DsrDeregisterDNSHostRecords *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/*
-  netr_ServerTrustPasswordsGet
-*/
-static NTSTATUS dcesrv_netr_ServerTrustPasswordsGet(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct netr_ServerTrustPasswordsGet *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/* 
-  netr_DsRGetForestTrustInformation 
-*/
-static WERROR dcesrv_netr_DsRGetForestTrustInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct netr_DsRGetForestTrustInformation *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+/*
+  netr_DsRGetForestTrustInformation
+*/
+static WERROR dcesrv_netr_DsRGetForestTrustInformation(struct dcesrv_call_state *dce_call,
+                                                       TALLOC_CTX *mem_ctx,
+                                                       struct netr_DsRGetForestTrustInformation *r)
+{
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        struct lsa_ForestTrustInformation *info, **info_ptr;
+        struct ldb_context *sam_ctx;
+        WERROR werr;
+
+        if (r->in.flags & 0xFFFFFFFE) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return WERR_GENERAL_FAILURE;
+        }
+
+        if (r->in.flags & DS_GFTI_UPDATE_TDO) {
+                if (!samdb_is_pdc(sam_ctx)) {
+                        return WERR_NERR_NOTPRIMARY;
+                }
+
+                if (r->in.trusted_domain_name == NULL) {
+                        return WERR_INVALID_FLAGS;
+                }
+
+                /* TODO: establish an schannel connection with
+                 * r->in.trusted_domain_name and perform a
+                 * netr_GetForestTrustInformation call against it */
+
+                /* for now return not implementd */
+                return WERR_CALL_NOT_IMPLEMENTED;
+        }
+
+        /* TODO: check r->in.server_name is our name */
+
+        info_ptr = talloc(mem_ctx, struct lsa_ForestTrustInformation *);
+        W_ERROR_HAVE_NO_MEMORY(info_ptr);
+
+        info = talloc_zero(info_ptr, struct lsa_ForestTrustInformation);
+        W_ERROR_HAVE_NO_MEMORY(info);
+
+        werr = fill_forest_trust_array(mem_ctx, sam_ctx, lp_ctx, info);
+        W_ERROR_NOT_OK_RETURN(werr);
+
+        *info_ptr = info;
+        r->out.forest_trust_info = info_ptr;
+
+        return WERR_OK;
 }
 
@@ -1663 +2412 @@
   netr_GetForestTrustInformation
 */
-static WERROR dcesrv_netr_GetForestTrustInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct netr_GetForestTrustInformation *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+static NTSTATUS dcesrv_netr_GetForestTrustInformation(struct dcesrv_call_state *dce_call,
+                                                      TALLOC_CTX *mem_ctx,
+                                                      struct netr_GetForestTrustInformation *r)
+{
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        struct netlogon_creds_CredentialState *creds;
+        struct lsa_ForestTrustInformation *info, **info_ptr;
+        struct ldb_context *sam_ctx;
+        NTSTATUS status;
+        WERROR werr;
+
+        status = dcesrv_netr_creds_server_step_check(dce_call,
+                                                     mem_ctx,
+                                                     r->in.computer_name,
+                                                     r->in.credential,
+                                                     r->out.return_authenticator,
+                                                     &creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        if ((creds->secure_channel_type != SEC_CHAN_DNS_DOMAIN) &&
+            (creds->secure_channel_type != SEC_CHAN_DOMAIN)) {
+                return NT_STATUS_NOT_IMPLEMENTED;
+        }
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        /* TODO: check r->in.server_name is our name */
+
+        info_ptr = talloc(mem_ctx, struct lsa_ForestTrustInformation *);
+        if (!info_ptr) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        info = talloc_zero(info_ptr, struct lsa_ForestTrustInformation);
+        if (!info) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        werr = fill_forest_trust_array(mem_ctx, sam_ctx, lp_ctx, info);
+        if (!W_ERROR_IS_OK(werr)) {
+                return werror_to_ntstatus(werr);
+        }
+
+        *info_ptr = info;
+        r->out.forest_trust_info = info_ptr;
+
+        return NT_STATUS_OK;
 }
 
@@ -1679 +2476 @@
 }
 
+/*
+  netr_Unused47
+*/
+static NTSTATUS dcesrv_netr_Unused47(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                                     struct netr_Unused47 *r)
+{
+        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+}
+
+
+struct netr_dnsupdate_RODC_state {
+        struct dcesrv_call_state *dce_call;
+        struct netr_DsrUpdateReadOnlyServerDnsRecords *r;
+        struct dnsupdate_RODC *r2;
+};
+
+/*
+  called when the forwarded RODC dns update request is finished
+ */
+static void netr_dnsupdate_RODC_callback(struct tevent_req *subreq)
+{
+        struct netr_dnsupdate_RODC_state *st =
+                tevent_req_callback_data(subreq,
+                                         struct netr_dnsupdate_RODC_state);
+        NTSTATUS status;
+
+        status = dcerpc_dnsupdate_RODC_r_recv(subreq, st->dce_call);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,(__location__ ": IRPC callback failed %s\n", nt_errstr(status)));
+                st->dce_call->fault_code = DCERPC_FAULT_CANT_PERFORM;
+        }
+
+        st->r->out.dns_names = talloc_steal(st->dce_call, st->r2->out.dns_names);
+
+        status = dcesrv_reply(st->dce_call);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,(__location__ ": dcesrv_reply() failed - %s\n", nt_errstr(status)));
+        }
+}
+
+/*
+  netr_DsrUpdateReadOnlyServerDnsRecords
+*/
+static NTSTATUS dcesrv_netr_DsrUpdateReadOnlyServerDnsRecords(struct dcesrv_call_state *dce_call,
+                                                              TALLOC_CTX *mem_ctx,
+                                                              struct netr_DsrUpdateReadOnlyServerDnsRecords *r)
+{
+        struct netlogon_creds_CredentialState *creds;
+        NTSTATUS nt_status;
+        struct dcerpc_binding_handle *binding_handle;
+        struct netr_dnsupdate_RODC_state *st;
+        struct tevent_req *subreq;
+
+        nt_status = dcesrv_netr_creds_server_step_check(dce_call,
+                                                        mem_ctx,
+                                                        r->in.computer_name,
+                                                        r->in.credential,
+                                                        r->out.return_authenticator,
+                                                        &creds);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+
+        if (creds->secure_channel_type != SEC_CHAN_RODC) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        st = talloc_zero(mem_ctx, struct netr_dnsupdate_RODC_state);
+        NT_STATUS_HAVE_NO_MEMORY(st);
+
+        st->dce_call = dce_call;
+        st->r = r;
+        st->r2 = talloc_zero(st, struct dnsupdate_RODC);
+        NT_STATUS_HAVE_NO_MEMORY(st->r2);
+
+        st->r2->in.dom_sid = creds->sid;
+        st->r2->in.site_name = r->in.site_name;
+        st->r2->in.dns_ttl = r->in.dns_ttl;
+        st->r2->in.dns_names = r->in.dns_names;
+        st->r2->out.dns_names = r->out.dns_names;
+
+        binding_handle = irpc_binding_handle_by_name(st, dce_call->msg_ctx,
+                                                     "dnsupdate", &ndr_table_irpc);
+        if (binding_handle == NULL) {
+                DEBUG(0,("Failed to get binding_handle for dnsupdate task\n"));
+                dce_call->fault_code = DCERPC_FAULT_CANT_PERFORM;
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+
+        /* forward the call */
+        subreq = dcerpc_dnsupdate_RODC_r_send(st, dce_call->event_ctx,
+                                              binding_handle, st->r2);
+        NT_STATUS_HAVE_NO_MEMORY(subreq);
+
+        dce_call->state_flags |= DCESRV_CALL_STATE_FLAG_ASYNC;
+
+        /* setup the callback */
+        tevent_req_set_callback(subreq, netr_dnsupdate_RODC_callback, st);
+
+        return NT_STATUS_OK;
+}
+
 
 /* include the generated boilerplate */

trunk/server/source4/rpc_server/remote/dcesrv_remote.c

@@ -4 +4 @@
 
    Copyright (C) Stefan (metze) Metzmacher 2004
-   
+   Copyright (C) Julien Kerihuel 2008-2009
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2010
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -20 +22 @@
 
 #include "includes.h"
+#include <tevent.h>
 #include "rpc_server/dcerpc_server.h"
 #include "auth/auth.h"
@@ -36 +39 @@
 }
 
-static NTSTATUS remote_op_bind(struct dcesrv_call_state *dce_call, const struct dcesrv_interface *iface)
+static NTSTATUS remote_op_bind(struct dcesrv_call_state *dce_call, const struct dcesrv_interface *iface, uint32_t if_version)
 {
         NTSTATUS status;
         const struct ndr_interface_table *table;
         struct dcesrv_remote_private *priv;
-        const char *binding = lp_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "dcerpc_remote", "binding");
+        const char *binding = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "dcerpc_remote", "binding");
         const char *user, *pass, *domain;
         struct cli_credentials *credentials;
+        bool must_free_credentials = true;
         bool machine_account;
-
-        machine_account = lp_parm_bool(dce_call->conn->dce_ctx->lp_ctx, NULL, "dcerpc_remote", "use_machine_account", false);
+        struct dcerpc_binding           *b;
+        struct composite_context        *pipe_conn_req;
+
+        machine_account = lpcfg_parm_bool(dce_call->conn->dce_ctx->lp_ctx, NULL, "dcerpc_remote", "use_machine_account", false);
 
         priv = talloc(dce_call->conn, struct dcesrv_remote_private);
@@ -61 +67 @@
         }
 
-        user = lp_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "dcerpc_remote", "user");
-        pass = lp_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "dcerpc_remote", "password");
-        domain = lp_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "dceprc_remote", "domain");
+        user = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "dcerpc_remote", "user");
+        pass = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "dcerpc_remote", "password");
+        domain = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "dceprc_remote", "domain");
 
         table = ndr_table_by_uuid(&iface->syntax_id.uuid); /* FIXME: What about if_version ? */
@@ -97 +103 @@
                 DEBUG(5, ("dcerpc_remote: RPC Proxy: Using delegated credentials\n"));
                 credentials = dce_call->conn->auth_state.session_info->credentials;
+                must_free_credentials = false;
         } else {
                 DEBUG(1,("dcerpc_remote: RPC Proxy: You must supply binding, user and password or have delegated credentials\n"));
@@ -102 +109 @@
         }
 
-        status = dcerpc_pipe_connect(priv,
-                                     &(priv->c_pipe), binding, table,
-                                     credentials, dce_call->event_ctx,
-                                     dce_call->conn->dce_ctx->lp_ctx);
-
-        talloc_free(credentials);
+        /* parse binding string to the structure */
+        status = dcerpc_parse_binding(dce_call->context, binding, &b);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("Failed to parse dcerpc binding '%s'\n", binding));
+                return status;
+        }
+        
+        DEBUG(3, ("Using binding %s\n", dcerpc_binding_string(dce_call->context, b)));
+        
+        /* If we already have a remote association group ID, then use that */
+        if (dce_call->context->assoc_group->proxied_id != 0) {
+                b->assoc_group_id = dce_call->context->assoc_group->proxied_id;
+        }
+
+        b->object.if_version = if_version;
+
+        pipe_conn_req = dcerpc_pipe_connect_b_send(dce_call->context, b, table,
+                                                   credentials, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx);
+        status = dcerpc_pipe_connect_b_recv(pipe_conn_req, dce_call->context, &(priv->c_pipe));
+        
+        if (must_free_credentials) {
+                talloc_free(credentials);
+        }
+
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
 
+        if (dce_call->context->assoc_group->proxied_id == 0) {
+                dce_call->context->assoc_group->proxied_id = priv->c_pipe->assoc_group_id;
+        }
+
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
         return NT_STATUS_OK;    
-}
-
-static void remote_op_unbind(struct dcesrv_connection_context *context, const struct dcesrv_interface *iface)
-{
-        struct dcesrv_remote_private *priv = (struct dcesrv_remote_private *)context->private_data;
-
-        talloc_free(priv->c_pipe);
-
-        return; 
 }
 
@@ -155 +179 @@
 }
 
+static void remote_op_dispatch_done(struct tevent_req *subreq);
+
 static NTSTATUS remote_op_dispatch(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, void *r)
 {
-        struct dcesrv_remote_private *priv = dce_call->context->private_data;
+        struct dcesrv_remote_private *priv = talloc_get_type_abort(dce_call->context->private_data,
+                                                                   struct dcesrv_remote_private);
         uint16_t opnum = dce_call->pkt.u.request.opnum;
         const struct ndr_interface_table *table = dce_call->context->iface->private_data;
         const struct ndr_interface_call *call;
         const char *name;
+        struct tevent_req *subreq;
 
         name = table->calls[opnum].name;
@@ -173 +201 @@
 
         /* we didn't use the return code of this function as we only check the last_fault_code */
-        dcerpc_ndr_request(priv->c_pipe, NULL, table, opnum, mem_ctx,r);
+        subreq = dcerpc_binding_handle_call_send(dce_call, dce_call->event_ctx,
+                                                 priv->c_pipe->binding_handle,
+                                                 NULL, table,
+                                                 opnum, mem_ctx, r);
+        if (subreq == NULL) {
+                DEBUG(0,("dcesrv_remote: call[%s] dcerpc_binding_handle_call_send() failed!\n", name));
+                return NT_STATUS_NO_MEMORY;
+        }
+        tevent_req_set_callback(subreq, remote_op_dispatch_done, dce_call);
+
+        dce_call->state_flags |= DCESRV_CALL_STATE_FLAG_ASYNC;
+        return NT_STATUS_OK;
+}
+
+static void remote_op_dispatch_done(struct tevent_req *subreq)
+{
+        struct dcesrv_call_state *dce_call = tevent_req_callback_data(subreq,
+                                             struct dcesrv_call_state);
+        struct dcesrv_remote_private *priv = talloc_get_type_abort(dce_call->context->private_data,
+                                                                   struct dcesrv_remote_private);
+        uint16_t opnum = dce_call->pkt.u.request.opnum;
+        const struct ndr_interface_table *table = dce_call->context->iface->private_data;
+        const struct ndr_interface_call *call;
+        const char *name;
+        NTSTATUS status;
+
+        name = table->calls[opnum].name;
+        call = &table->calls[opnum];
+
+        /* we didn't use the return code of this function as we only check the last_fault_code */
+        status = dcerpc_binding_handle_call_recv(subreq);
+        TALLOC_FREE(subreq);
 
         dce_call->fault_code = priv->c_pipe->last_fault_code;
         if (dce_call->fault_code != 0) {
-                DEBUG(0,("dcesrv_remote: call[%s] failed with: %s!\n",name, dcerpc_errstr(mem_ctx, dce_call->fault_code)));
-                return NT_STATUS_NET_WRITE_FAULT;
-        }
-
-        if ((dce_call->fault_code == 0) && 
+                DEBUG(0,("dcesrv_remote: call[%s] failed with: %s!\n",
+                        name, dcerpc_errstr(dce_call, dce_call->fault_code)));
+                goto reply;
+        }
+
+        if (NT_STATUS_IS_OK(status) &&
             (priv->c_pipe->conn->flags & DCERPC_DEBUG_PRINT_OUT)) {
-                ndr_print_function_debug(call->ndr_print, name, NDR_OUT, r);            
-        }
-
-        return NT_STATUS_OK;
+                ndr_print_function_debug(call->ndr_print, name, NDR_OUT, dce_call->r);
+        }
+
+reply:
+        status = dcesrv_reply(dce_call);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("dcesrv_remote: call[%s]: dcesrv_reply() failed - %s\n",
+                        name, nt_errstr(status)));
+        }
 }
 
@@ -207 +272 @@
 static NTSTATUS remote_register_one_iface(struct dcesrv_context *dce_ctx, const struct dcesrv_interface *iface)
 {
-        int i;
+        unsigned int i;
         const struct ndr_interface_table *table = iface->private_data;
 
@@ -226 +291 @@
 static NTSTATUS remote_op_init_server(struct dcesrv_context *dce_ctx, const struct dcesrv_endpoint_server *ep_server)
 {
-        int i;
-        const char **ifaces = (const char **)str_list_make(dce_ctx, lp_parm_string(dce_ctx->lp_ctx, NULL, "dcerpc_remote", "interfaces"),NULL);
+        unsigned int i;
+        const char **ifaces = (const char **)str_list_make(dce_ctx, lpcfg_parm_string(dce_ctx->lp_ctx, NULL, "dcerpc_remote", "interfaces"),NULL);
 
         if (!ifaces) {
@@ -262 +327 @@
         
         iface->bind = remote_op_bind;
-        iface->unbind = remote_op_unbind;
+        iface->unbind = NULL;
 
         iface->ndr_pull = remote_op_ndr_pull;

trunk/server/source4/rpc_server/samr/dcesrv_samr.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -8 +8 @@
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
    Copyright (C) Matthias Dieter Wallnöfer 2009
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -29 +29 @@
 #include "rpc_server/samr/dcesrv_samr.h"
 #include "system/time.h"
-#include "lib/ldb/include/ldb.h"
-#include "lib/ldb/include/ldb_errors.h"
+#include <ldb.h>
+#include <ldb_errors.h>
 #include "../libds/common/flags.h"
 #include "dsdb/samdb/samdb.h"
+#include "dsdb/common/util.h"
 #include "libcli/ldap/ldap_ndr.h"
 #include "libcli/security/security.h"
@@ -38 +39 @@
 #include "../lib/util/util_ldb.h"
 #include "param/param.h"
+#include "lib/util/tsort.h"
+#include "libds/common/flag_mapping.h"
 
 /* these query macros make samr_Query[User|Group|Alias]Info a bit easier to read */
 
 #define QUERY_STRING(msg, field, attr) \
-        info->field.string = samdb_result_string(msg, attr, "");
+        info->field.string = ldb_msg_find_attr_as_string(msg, attr, "");
 #define QUERY_UINT(msg, field, attr) \
-        info->field = samdb_result_uint(msg, attr, 0);
+        info->field = ldb_msg_find_attr_as_uint(msg, attr, 0);
 #define QUERY_RID(msg, field, attr) \
         info->field = samdb_result_rid_from_sid(mem_ctx, msg, attr, 0);
 #define QUERY_UINT64(msg, field, attr) \
-        info->field = samdb_result_uint64(msg, attr, 0);
+        info->field = ldb_msg_find_attr_as_uint64(msg, attr, 0);
 #define QUERY_APASSC(msg, field, attr) \
         info->field = samdb_result_allow_password_change(sam_ctx, mem_ctx, \
@@ -69 +72 @@
         if (r->in.info->field.string == NULL) return NT_STATUS_INVALID_PARAMETER; \
         if (r->in.info->field.string[0] == '\0') {                      \
-                if (ldb_msg_add_empty(msg, attr, LDB_FLAG_MOD_DELETE, NULL)) { \
+                if (ldb_msg_add_empty(msg, attr, LDB_FLAG_MOD_DELETE, NULL) != LDB_SUCCESS) { \
                         return NT_STATUS_NO_MEMORY;                     \
                 }                                                       \
         }                                                               \
-        if (ldb_msg_add_string(msg, attr, r->in.info->field.string) != 0) { \
+        if (ldb_msg_add_string(msg, attr, r->in.info->field.string) != LDB_SUCCESS) { \
                 return NT_STATUS_NO_MEMORY;                             \
         }                                                               \
@@ -82 +85 @@
 #define SET_UINT(msg, field, attr) do {                                 \
         struct ldb_message_element *set_el;                             \
-        if (samdb_msg_add_uint(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != 0) { \
+        if (samdb_msg_add_uint(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != LDB_SUCCESS) { \
                 return NT_STATUS_NO_MEMORY;                             \
         }                                                               \
         set_el = ldb_msg_find_element(msg, attr);                       \
         set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
-} while (0)                                                             
-                                                                        
+} while (0)
+
 #define SET_INT64(msg, field, attr) do {                                \
         struct ldb_message_element *set_el;                             \
-        if (samdb_msg_add_int64(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != 0) { \
+        if (samdb_msg_add_int64(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != LDB_SUCCESS) { \
                 return NT_STATUS_NO_MEMORY;                             \
         }                                                               \
         set_el = ldb_msg_find_element(msg, attr);                       \
         set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
-} while (0)                                                             
-                                                                        
+} while (0)
+
 #define SET_UINT64(msg, field, attr) do {                               \
         struct ldb_message_element *set_el;                             \
-        if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != 0) { \
+        if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != LDB_SUCCESS) { \
                 return NT_STATUS_NO_MEMORY;                             \
         }                                                               \
         set_el = ldb_msg_find_element(msg, attr);                       \
         set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
-} while (0)                                                             
+} while (0)
 
 #define CHECK_FOR_MULTIPLES(value, flag, poss_flags)    \
@@ -113 +116 @@
                 }                                                       \
         } while (0)                                                     \
-        
-/* Set account flags, discarding flags that cannot be set with SAMR */                                                          
+
+/* Set account flags, discarding flags that cannot be set with SAMR */
 #define SET_AFLAGS(msg, field, attr) do {                               \
         struct ldb_message_element *set_el;                             \
@@ -129 +132 @@
         set_el = ldb_msg_find_element(msg, attr);                       \
         set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
-} while (0)                                                             
-                                                                        
+} while (0)
+
 #define SET_LHOURS(msg, field, attr) do {                               \
         struct ldb_message_element *set_el;                             \
-        if (samdb_msg_add_logon_hours(sam_ctx, mem_ctx, msg, attr, &r->in.info->field) != 0) { \
+        if (samdb_msg_add_logon_hours(sam_ctx, mem_ctx, msg, attr, &r->in.info->field) != LDB_SUCCESS) { \
                 return NT_STATUS_NO_MEMORY;                             \
         }                                                               \
@@ -143 +146 @@
         struct ldb_message_element *set_el;                             \
         if (r->in.info->field.length != 0) {                            \
-                if (samdb_msg_add_parameters(sam_ctx, mem_ctx, msg, attr, &r->in.info->field) != 0) { \
+                if (samdb_msg_add_parameters(sam_ctx, mem_ctx, msg, attr, &r->in.info->field) != LDB_SUCCESS) { \
                         return NT_STATUS_NO_MEMORY;                     \
                 }                                                       \
@@ -153 +156 @@
 
 
-/* 
-  samr_Connect 
+/*
+  samr_Connect
 
   create a connection to the SAM database
@@ -166 +169 @@
         ZERO_STRUCTP(r->out.connect_handle);
 
-        c_state = talloc(dce_call->conn, struct samr_connect_state);
+        c_state = talloc(mem_ctx, struct samr_connect_state);
         if (!c_state) {
                 return NT_STATUS_NO_MEMORY;
@@ -172 +175 @@
 
         /* make sure the sam database is accessible */
-        c_state->sam_ctx = samdb_connect(c_state, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info); 
+        c_state->sam_ctx = samdb_connect(c_state, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info, 0);
         if (c_state->sam_ctx == NULL) {
                 talloc_free(c_state);
@@ -194 +197 @@
 
 
-/* 
-  samr_Close 
+/*
+  samr_Close
 */
 static NTSTATUS dcesrv_samr_Close(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -214 +217 @@
 
 
-/* 
-  samr_SetSecurity 
+/*
+  samr_SetSecurity
 */
 static NTSTATUS dcesrv_samr_SetSecurity(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -224 +227 @@
 
 
-/* 
-  samr_QuerySecurity 
+/*
+  samr_QuerySecurity
 */
 static NTSTATUS dcesrv_samr_QuerySecurity(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -250 +253 @@
 
 
-/* 
-  samr_Shutdown 
+/*
+  samr_Shutdown
 
   we refuse this operation completely. If a admin wants to shutdown samr
@@ -263 +266 @@
 
 
-/* 
-  samr_LookupDomain 
+/*
+  samr_LookupDomain
 
   this maps from a domain name to a SID
@@ -292 +295 @@
                                    mem_ctx, NULL, &dom_msgs, dom_attrs,
                                    "(objectClass=builtinDomain)");
-        } else if (strcasecmp_m(r->in.domain_name->string, lp_sam_name(dce_call->conn->dce_ctx->lp_ctx)) == 0) {
+        } else if (strcasecmp_m(r->in.domain_name->string, lpcfg_sam_name(dce_call->conn->dce_ctx->lp_ctx)) == 0) {
                 ret = gendb_search_dn(c_state->sam_ctx,
-                                      mem_ctx, ldb_get_default_basedn(c_state->sam_ctx), 
+                                      mem_ctx, ldb_get_default_basedn(c_state->sam_ctx),
                                       &dom_msgs, dom_attrs);
         } else {
@@ -302 +305 @@
                 return NT_STATUS_NO_SUCH_DOMAIN;
         }
-        
+
         sid = samdb_result_dom_sid(mem_ctx, dom_msgs[0],
                                    "objectSid");
-                
+
         if (sid == NULL) {
                 return NT_STATUS_NO_SUCH_DOMAIN;
@@ -316 +319 @@
 
 
-/* 
-  samr_EnumDomains 
+/*
+  samr_EnumDomains
 
   list the domains in the SAM
@@ -327 +330 @@
         struct dcesrv_handle *h;
         struct samr_SamArray *array;
-        int i, start_i;
+        uint32_t i, start_i;
 
         *r->out.resume_handle = 0;
@@ -350 +353 @@
                 return NT_STATUS_NO_MEMORY;
         }
-                
+
         array->count = 0;
         array->entries = NULL;
@@ -362 +365 @@
                 array->entries[i].idx = start_i + i;
                 if (i == 0) {
-                        array->entries[i].name.string = lp_sam_name(dce_call->conn->dce_ctx->lp_ctx);
+                        array->entries[i].name.string = lpcfg_sam_name(dce_call->conn->dce_ctx->lp_ctx);
                 } else {
                         array->entries[i].name.string = "BUILTIN";
@@ -376 +379 @@
 
 
-/* 
-  samr_OpenDomain 
+/*
+  samr_OpenDomain
 */
 static NTSTATUS dcesrv_samr_OpenDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -399 +402 @@
         }
 
-        d_state = talloc(c_state, struct samr_domain_state);
+        d_state = talloc(mem_ctx, struct samr_domain_state);
         if (!d_state) {
                 return NT_STATUS_NO_MEMORY;
@@ -411 +414 @@
         } else {
                 d_state->builtin = false;
-                d_state->domain_name = lp_sam_name(dce_call->conn->dce_ctx->lp_ctx);
+                d_state->domain_name = lpcfg_sam_name(dce_call->conn->dce_ctx->lp_ctx);
         }
 
         ret = gendb_search(c_state->sam_ctx,
                            mem_ctx, ldb_get_default_basedn(c_state->sam_ctx), &dom_msgs, dom_attrs,
-                           "(objectSid=%s)", 
+                           "(objectSid=%s)",
                            ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid));
-        
+
         if (ret == 0) {
                 talloc_free(d_state);
@@ -432 +435 @@
 
         d_state->domain_dn = talloc_steal(d_state, dom_msgs[0]->dn);
-        d_state->role = lp_server_role(dce_call->conn->dce_ctx->lp_ctx);
+        d_state->role = lpcfg_server_role(dce_call->conn->dce_ctx->lp_ctx);
         d_state->connect_state = talloc_reference(d_state, c_state);
         d_state->sam_ctx = c_state->sam_ctx;
@@ -444 +447 @@
                 return NT_STATUS_NO_MEMORY;
         }
-        
+
         h_domain->data = talloc_steal(h_domain, d_state);
 
@@ -456 +459 @@
 */
 static NTSTATUS dcesrv_samr_info_DomInfo1(struct samr_domain_state *state,
-                                   TALLOC_CTX *mem_ctx,
-                                    struct ldb_message **dom_msgs,
-                                   struct samr_DomInfo1 *info)
+                                          TALLOC_CTX *mem_ctx,
+                                          struct ldb_message **dom_msgs,
+                                          struct samr_DomInfo1 *info)
 {
         info->min_password_length =
-                samdb_result_uint(dom_msgs[0], "minPwdLength", 0);
+                ldb_msg_find_attr_as_uint(dom_msgs[0], "minPwdLength", 0);
         info->password_history_length =
-                samdb_result_uint(dom_msgs[0], "pwdHistoryLength", 0);
-        info->password_properties = 
-                samdb_result_uint(dom_msgs[0], "pwdProperties", 0);
-        info->max_password_age = 
-                samdb_result_int64(dom_msgs[0], "maxPwdAge", 0);
-        info->min_password_age = 
-                samdb_result_int64(dom_msgs[0], "minPwdAge", 0);
+                ldb_msg_find_attr_as_uint(dom_msgs[0], "pwdHistoryLength", 0);
+        info->password_properties =
+                ldb_msg_find_attr_as_uint(dom_msgs[0], "pwdProperties", 0);
+        info->max_password_age =
+                ldb_msg_find_attr_as_int64(dom_msgs[0], "maxPwdAge", 0);
+        info->min_password_age =
+                ldb_msg_find_attr_as_int64(dom_msgs[0], "minPwdAge", 0);
 
         return NT_STATUS_OK;
@@ -477 +480 @@
   return DomInfo2
 */
-static NTSTATUS dcesrv_samr_info_DomGeneralInformation(struct samr_domain_state *state, 
+static NTSTATUS dcesrv_samr_info_DomGeneralInformation(struct samr_domain_state *state,
                                                        TALLOC_CTX *mem_ctx,
                                                        struct ldb_message **dom_msgs,
                                                        struct samr_DomGeneralInformation *info)
 {
-        /* This pulls the NetBIOS name from the 
-           cn=NTDS Settings,cn=<NETBIOS name of PDC>,....
-           string */
-        info->primary.string = samdb_result_fsmo_name(state->sam_ctx, mem_ctx, dom_msgs[0], "fSMORoleOwner");
-
-        if (!info->primary.string) {
-                info->primary.string = lp_netbios_name(state->lp_ctx);
-        }
-
-        info->force_logoff_time = ldb_msg_find_attr_as_uint64(dom_msgs[0], "forceLogoff", 
+        /* MS-SAMR 2.2.4.1 - ReplicaSourceNodeName: "domainReplica" attribute */
+        info->primary.string = ldb_msg_find_attr_as_string(dom_msgs[0],
+                                                           "domainReplica",
+                                                           "");
+
+        info->force_logoff_time = ldb_msg_find_attr_as_uint64(dom_msgs[0], "forceLogoff",
                                                             0x8000000000000000LL);
 
-        info->oem_information.string = samdb_result_string(dom_msgs[0], "oEMInformation", NULL);
+        info->oem_information.string = ldb_msg_find_attr_as_string(dom_msgs[0],
+                                                                   "oEMInformation",
+                                                                   "");
         info->domain_name.string  = state->domain_name;
 
-        info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount", 
+        info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount",
                                                  0);
         switch (state->role) {
         case ROLE_DOMAIN_CONTROLLER:
-                /* This pulls the NetBIOS name from the 
+                /* This pulls the NetBIOS name from the
                    cn=NTDS Settings,cn=<NETBIOS name of PDC>,....
                    string */
@@ -518 +519 @@
         }
 
-        /* No users in BUILTIN, and the LOCAL group types are only in builtin, and the global group type is never in BUILTIN */
-        info->num_users = samdb_search_count(state->sam_ctx, mem_ctx, state->domain_dn, 
+        info->num_users = samdb_search_count(state->sam_ctx, mem_ctx,
+                                             state->domain_dn,
                                              "(objectClass=user)");
-        info->num_groups = samdb_search_count(state->sam_ctx, mem_ctx, state->domain_dn,
-                                              "(&(objectClass=group)(sAMAccountType=%u))",
-                                              ATYPE_GLOBAL_GROUP);
-        info->num_aliases = samdb_search_count(state->sam_ctx, mem_ctx, state->domain_dn,
-                                               "(&(objectClass=group)(sAMAccountType=%u))",
-                                               ATYPE_LOCAL_GROUP);
+        info->num_groups = samdb_search_count(state->sam_ctx, mem_ctx,
+                                              state->domain_dn,
+                                              "(&(objectClass=group)(|(groupType=%d)(groupType=%d)))",
+                                              GTYPE_SECURITY_UNIVERSAL_GROUP,
+                                              GTYPE_SECURITY_GLOBAL_GROUP);
+        info->num_aliases = samdb_search_count(state->sam_ctx, mem_ctx,
+                                               state->domain_dn,
+                                               "(&(objectClass=group)(|(groupType=%d)(groupType=%d)))",
+                                               GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
+                                               GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
 
         return NT_STATUS_OK;
@@ -535 +540 @@
 */
 static NTSTATUS dcesrv_samr_info_DomInfo3(struct samr_domain_state *state,
-                                   TALLOC_CTX *mem_ctx,
-                                    struct ldb_message **dom_msgs,
-                                   struct samr_DomInfo3 *info)
-{
-        info->force_logoff_time = ldb_msg_find_attr_as_uint64(dom_msgs[0], "forceLogoff", 
+                                          TALLOC_CTX *mem_ctx,
+                                          struct ldb_message **dom_msgs,
+                                          struct samr_DomInfo3 *info)
+{
+        info->force_logoff_time = ldb_msg_find_attr_as_uint64(dom_msgs[0], "forceLogoff",
                                                       0x8000000000000000LL);
 
@@ -553 +558 @@
                                    struct samr_DomOEMInformation *info)
 {
-        info->oem_information.string = samdb_result_string(dom_msgs[0], "oEMInformation", NULL);
+        info->oem_information.string = ldb_msg_find_attr_as_string(dom_msgs[0],
+                                                                   "oEMInformation",
+                                                                   "");
 
         return NT_STATUS_OK;
@@ -562 +569 @@
 */
 static NTSTATUS dcesrv_samr_info_DomInfo5(struct samr_domain_state *state,
-                                   TALLOC_CTX *mem_ctx,
-                                    struct ldb_message **dom_msgs,
-                                   struct samr_DomInfo5 *info)
+                                          TALLOC_CTX *mem_ctx,
+                                          struct ldb_message **dom_msgs,
+                                          struct samr_DomInfo5 *info)
 {
         info->domain_name.string  = state->domain_name;
@@ -575 +582 @@
 */
 static NTSTATUS dcesrv_samr_info_DomInfo6(struct samr_domain_state *state,
-                                   TALLOC_CTX *mem_ctx,
-                                   struct ldb_message **dom_msgs,
-                                   struct samr_DomInfo6 *info)
-{
-        /* This pulls the NetBIOS name from the 
-           cn=NTDS Settings,cn=<NETBIOS name of PDC>,....
-           string */
-        info->primary.string = samdb_result_fsmo_name(state->sam_ctx, mem_ctx, 
-                                                      dom_msgs[0], "fSMORoleOwner");
-
-        if (!info->primary.string) {
-                info->primary.string = lp_netbios_name(state->lp_ctx);
-        }
+                                          TALLOC_CTX *mem_ctx,
+                                          struct ldb_message **dom_msgs,
+                                          struct samr_DomInfo6 *info)
+{
+        /* MS-SAMR 2.2.4.1 - ReplicaSourceNodeName: "domainReplica" attribute */
+        info->primary.string = ldb_msg_find_attr_as_string(dom_msgs[0],
+                                                           "domainReplica",
+                                                           "");
 
         return NT_STATUS_OK;
@@ -596 +598 @@
 */
 static NTSTATUS dcesrv_samr_info_DomInfo7(struct samr_domain_state *state,
-                                   TALLOC_CTX *mem_ctx,
-                                    struct ldb_message **dom_msgs,
-                                   struct samr_DomInfo7 *info)
+                                          TALLOC_CTX *mem_ctx,
+                                          struct ldb_message **dom_msgs,
+                                          struct samr_DomInfo7 *info)
 {
 
         switch (state->role) {
         case ROLE_DOMAIN_CONTROLLER:
-                /* This pulls the NetBIOS name from the 
+                /* This pulls the NetBIOS name from the
                    cn=NTDS Settings,cn=<NETBIOS name of PDC>,....
                    string */
@@ -627 +629 @@
 */
 static NTSTATUS dcesrv_samr_info_DomInfo8(struct samr_domain_state *state,
-                                   TALLOC_CTX *mem_ctx,
-                                    struct ldb_message **dom_msgs,
-                                   struct samr_DomInfo8 *info)
-{
-        info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount", 
+                                          TALLOC_CTX *mem_ctx,
+                                          struct ldb_message **dom_msgs,
+                                          struct samr_DomInfo8 *info)
+{
+        info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount",
                                                time(NULL));
 
@@ -644 +646 @@
 */
 static NTSTATUS dcesrv_samr_info_DomInfo9(struct samr_domain_state *state,
-                                   TALLOC_CTX *mem_ctx,
-                                    struct ldb_message **dom_msgs,
-                                   struct samr_DomInfo9 *info)
+                                          TALLOC_CTX *mem_ctx,
+                                          struct ldb_message **dom_msgs,
+                                          struct samr_DomInfo9 *info)
 {
         info->domain_server_state = DOMAIN_SERVER_ENABLED;
@@ -657 +659 @@
 */
 static NTSTATUS dcesrv_samr_info_DomGeneralInformation2(struct samr_domain_state *state,
-                                    TALLOC_CTX *mem_ctx,
-                                    struct ldb_message **dom_msgs,
-                                    struct samr_DomGeneralInformation2 *info)
+                                                        TALLOC_CTX *mem_ctx,
+                                                        struct ldb_message **dom_msgs,
+                                                        struct samr_DomGeneralInformation2 *info)
 {
         NTSTATUS status;
@@ -666 +668 @@
                 return status;
         }
-        
-        info->lockout_duration = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutDuration", 
+
+        info->lockout_duration = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutDuration",
                                                     -18000000000LL);
         info->lockout_window = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockOutObservationWindow",
@@ -680 +682 @@
 */
 static NTSTATUS dcesrv_samr_info_DomInfo12(struct samr_domain_state *state,
-                                   TALLOC_CTX *mem_ctx,
-                                    struct ldb_message **dom_msgs,
-                                   struct samr_DomInfo12 *info)
-{
-        info->lockout_duration = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutDuration", 
+                                           TALLOC_CTX *mem_ctx,
+                                           struct ldb_message **dom_msgs,
+                                           struct samr_DomInfo12 *info)
+{
+        info->lockout_duration = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutDuration",
                                                     -18000000000LL);
         info->lockout_window = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockOutObservationWindow",
@@ -697 +699 @@
 */
 static NTSTATUS dcesrv_samr_info_DomInfo13(struct samr_domain_state *state,
-                                    TALLOC_CTX *mem_ctx,
-                                    struct ldb_message **dom_msgs,
-                                    struct samr_DomInfo13 *info)
-{
-        info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount", 
+                                           TALLOC_CTX *mem_ctx,
+                                           struct ldb_message **dom_msgs,
+                                           struct samr_DomInfo13 *info)
+{
+        info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount",
                                                time(NULL));
 
@@ -712 +714 @@
 }
 
-/* 
-  samr_QueryDomainInfo 
-*/
-static NTSTATUS dcesrv_samr_QueryDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                                     struct samr_QueryDomainInfo *r)
+/*
+  samr_QueryDomainInfo
+*/
+static NTSTATUS dcesrv_samr_QueryDomainInfo(struct dcesrv_call_state *dce_call,
+                                            TALLOC_CTX *mem_ctx,
+                                            struct samr_QueryDomainInfo *r)
 {
         struct dcesrv_handle *h;
@@ -724 +727 @@
         struct ldb_message **dom_msgs;
         const char * const *attrs = NULL;
-        
+
         *r->out.info = NULL;
 
@@ -731 +734 @@
         d_state = h->data;
 
-        info = talloc(mem_ctx, union samr_DomainInfo);
-        if (!info) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
         switch (r->in.level) {
-        case 1: 
+        case 1:
         {
                 static const char * const attrs2[] = { "minPwdLength",
@@ -751 +749 @@
         {
                 static const char * const attrs2[] = {"forceLogoff",
-                                                      "oEMInformation", 
-                                                      "modifiedCount", 
-                                                      "fSMORoleOwner",
+                                                      "oEMInformation",
+                                                      "modifiedCount",
+                                                      "domainReplica",
                                                       NULL};
                 attrs = attrs2;
@@ -760 +758 @@
         case 3:
         {
-                static const char * const attrs2[] = {"forceLogoff", 
+                static const char * const attrs2[] = {"forceLogoff",
                                                       NULL};
                 attrs = attrs2;
@@ -767 +765 @@
         case 4:
         {
-                static const char * const attrs2[] = {"oEMInformation", 
+                static const char * const attrs2[] = {"oEMInformation",
                                                       NULL};
                 attrs = attrs2;
@@ -779 +777 @@
         case 6:
         {
-                static const char * const attrs2[] = {"fSMORoleOwner", 
-                                                      NULL};
+                static const char * const attrs2[] = { "domainReplica",
+                                                       NULL };
                 attrs = attrs2;
                 break;
@@ -791 +789 @@
         case 8:
         {
-                static const char * const attrs2[] = { "modifiedCount", 
-                                                       "creationTime", 
+                static const char * const attrs2[] = { "modifiedCount",
+                                                       "creationTime",
                                                        NULL };
                 attrs = attrs2;
@@ -798 +796 @@
         }
         case 9:
+        {
                 attrs = NULL;
-                break;          
+                break;
+        }
         case 11:
         {
                 static const char * const attrs2[] = { "oEMInformation",
                                                        "forceLogoff",
-                                                       "modifiedCount", 
-                                                       "lockoutDuration", 
-                                                       "lockOutObservationWindow", 
-                                                       "lockoutThreshold", 
+                                                       "modifiedCount",
+                                                       "lockoutDuration",
+                                                       "lockOutObservationWindow",
+                                                       "lockoutThreshold",
                                                        NULL};
                 attrs = attrs2;
@@ -814 +814 @@
         case 12:
         {
-                static const char * const attrs2[] = { "lockoutDuration", 
-                                                       "lockOutObservationWindow", 
-                                                       "lockoutThreshold", 
+                static const char * const attrs2[] = { "lockoutDuration",
+                                                       "lockOutObservationWindow",
+                                                       "lockoutThreshold",
                                                        NULL};
                 attrs = attrs2;
@@ -823 +823 @@
         case 13:
         {
-                static const char * const attrs2[] = { "modifiedCount", 
-                                                       "creationTime", 
+                static const char * const attrs2[] = { "modifiedCount",
+                                                       "creationTime",
                                                        NULL };
                 attrs = attrs2;
                 break;
+        }
+        default:
+        {
+                return NT_STATUS_INVALID_INFO_CLASS;
         }
         }
@@ -836 +840 @@
                 ret = gendb_search_dn(d_state->sam_ctx, mem_ctx,
                                       d_state->domain_dn, &dom_msgs, attrs);
+                if (ret == 0) {
+                        return NT_STATUS_NO_SUCH_DOMAIN;
+                }
                 if (ret != 1) {
                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -841 +848 @@
         }
 
+        /* allocate the info structure */
+        info = talloc_zero(mem_ctx, union samr_DomainInfo);
+        if (info == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
         *r->out.info = info;
-
-        ZERO_STRUCTP(info);
 
         switch (r->in.level) {
         case 1:
-                return dcesrv_samr_info_DomInfo1(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomInfo1(d_state, mem_ctx, dom_msgs,
                                                  &info->info1);
         case 2:
-                return dcesrv_samr_info_DomGeneralInformation(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomGeneralInformation(d_state, mem_ctx, dom_msgs,
                                                               &info->general);
         case 3:
-                return dcesrv_samr_info_DomInfo3(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomInfo3(d_state, mem_ctx, dom_msgs,
                                                  &info->info3);
         case 4:
-                return dcesrv_samr_info_DomOEMInformation(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomOEMInformation(d_state, mem_ctx, dom_msgs,
                                                           &info->oem);
         case 5:
-                return dcesrv_samr_info_DomInfo5(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomInfo5(d_state, mem_ctx, dom_msgs,
                                                  &info->info5);
         case 6:
-                return dcesrv_samr_info_DomInfo6(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomInfo6(d_state, mem_ctx, dom_msgs,
                                                  &info->info6);
         case 7:
-                return dcesrv_samr_info_DomInfo7(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomInfo7(d_state, mem_ctx, dom_msgs,
                                                  &info->info7);
         case 8:
-                return dcesrv_samr_info_DomInfo8(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomInfo8(d_state, mem_ctx, dom_msgs,
                                                  &info->info8);
         case 9:
-                return dcesrv_samr_info_DomInfo9(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomInfo9(d_state, mem_ctx, dom_msgs,
                                                  &info->info9);
         case 11:
-                return dcesrv_samr_info_DomGeneralInformation2(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomGeneralInformation2(d_state, mem_ctx, dom_msgs,
                                                                &info->general2);
         case 12:
-                return dcesrv_samr_info_DomInfo12(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomInfo12(d_state, mem_ctx, dom_msgs,
                                                   &info->info12);
         case 13:
-                return dcesrv_samr_info_DomInfo13(d_state, mem_ctx, dom_msgs, 
+                return dcesrv_samr_info_DomInfo13(d_state, mem_ctx, dom_msgs,
                                                   &info->info13);
-        }
-
-        return NT_STATUS_INVALID_INFO_CLASS;
-}
-
-
-/* 
-  samr_SetDomainInfo 
+        default:
+                return NT_STATUS_INVALID_INFO_CLASS;
+        }
+}
+
+
+/*
+  samr_SetDomainInfo
 */
 static NTSTATUS dcesrv_samr_SetDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -937 +948 @@
 
         case 12:
-                
+                /*
+                 * It is not possible to set lockout_duration < lockout_window.
+                 * (The test is the other way around since the negative numbers
+                 *  are stored...)
+                 *
+                 * TODO:
+                 *   This check should be moved to the backend, i.e. to some
+                 *   ldb module under dsdb/samdb/ldb_modules/ .
+                 *
+                 * This constraint is documented here for the samr rpc service:
+                 * MS-SAMR 3.1.1.6 Attribute Constraints for Originating Updates
+                 * http://msdn.microsoft.com/en-us/library/cc245667%28PROT.10%29.aspx
+                 *
+                 * And here for the ldap backend:
+                 * MS-ADTS 3.1.1.5.3.2 Constraints
+                 * http://msdn.microsoft.com/en-us/library/cc223462(PROT.10).aspx
+                 */
+                if (r->in.info->info12.lockout_duration >
+                    r->in.info->info12.lockout_window)
+                {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
                 SET_INT64  (msg, info12.lockout_duration,      "lockoutDuration");
                 SET_INT64  (msg, info12.lockout_window,        "lockOutObservationWindow");
@@ -950 +982 @@
         /* modify the samdb record */
         ret = ldb_modify(sam_ctx, msg);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 DEBUG(1,("Failed to modify record %s: %s\n",
                          ldb_dn_get_linearized(d_state->domain_dn),
@@ -962 +994 @@
 }
 
-/* 
-  samr_CreateDomainGroup 
+/*
+  samr_CreateDomainGroup
 */
 static NTSTATUS dcesrv_samr_CreateDomainGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                                        struct samr_CreateDomainGroup *r)
 {
+        NTSTATUS status;
         struct samr_domain_state *d_state;
         struct samr_account_state *a_state;
         struct dcesrv_handle *h;
-        const char *name;
-        struct ldb_message *msg;
-        struct dom_sid *sid;
         const char *groupname;
+        struct dom_sid *group_sid;
+        struct ldb_dn *group_dn;
         struct dcesrv_handle *g_handle;
-        int ret;
 
         ZERO_STRUCTP(r->out.group_handle);
@@ -996 +1027 @@
         }
 
-        /* check if the group already exists */
-        name = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL, 
-                                   "sAMAccountName",
-                                   "(&(sAMAccountName=%s)(objectclass=group))",
-                                   ldb_binary_encode_string(mem_ctx, groupname));
-        if (name != NULL) {
-                return NT_STATUS_GROUP_EXISTS;
-        }
-
-        msg = ldb_msg_new(mem_ctx);
-        if (msg == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* add core elements to the ldb_message for the user */
-        msg->dn = ldb_dn_copy(mem_ctx, d_state->domain_dn);
-        ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=Users", groupname);
-        if (!msg->dn) {
-                return NT_STATUS_NO_MEMORY;
-        }
-        samdb_msg_add_string(d_state->sam_ctx, mem_ctx, msg, "sAMAccountName", groupname);
-        samdb_msg_add_string(d_state->sam_ctx, mem_ctx, msg, "objectClass", "group");
-                             
-        /* create the group */
-        ret = ldb_add(d_state->sam_ctx, msg);
-        switch (ret) {
-        case  LDB_SUCCESS:
-                break;
-        case  LDB_ERR_ENTRY_ALREADY_EXISTS:
-                DEBUG(0,("Failed to create group record %s: %s\n",
-                         ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(d_state->sam_ctx)));
-                return NT_STATUS_GROUP_EXISTS;
-        case  LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
-                DEBUG(0,("Failed to create group record %s: %s\n",
-                         ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(d_state->sam_ctx)));
-                return NT_STATUS_ACCESS_DENIED;
-        default:
-                DEBUG(0,("Failed to create group record %s: %s\n",
-                         ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(d_state->sam_ctx)));
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
-        a_state = talloc(d_state, struct samr_account_state);
+        status = dsdb_add_domain_group(d_state->sam_ctx, mem_ctx, groupname, &group_sid, &group_dn);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        a_state = talloc(mem_ctx, struct samr_account_state);
         if (!a_state) {
                 return NT_STATUS_NO_MEMORY;
@@ -1048 +1039 @@
         a_state->access_mask = r->in.access_mask;
         a_state->domain_state = talloc_reference(a_state, d_state);
-        a_state->account_dn = talloc_steal(a_state, msg->dn);
-
-        /* retrieve the sid for the group just created */
-        sid = samdb_search_dom_sid(d_state->sam_ctx, a_state,
-                                   msg->dn, "objectSid", NULL);
-        if (sid == NULL) {
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        a_state->account_name = talloc_strdup(a_state, groupname);
-        if (!a_state->account_name) {
-                return NT_STATUS_NO_MEMORY;
-        }
+        a_state->account_dn = talloc_steal(a_state, group_dn);
+
+        a_state->account_name = talloc_steal(a_state, groupname);
 
         /* create the policy handle */
@@ -1071 +1052 @@
 
         *r->out.group_handle = g_handle->wire_handle;
-        *r->out.rid = sid->sub_auths[sid->num_auths-1];
+        *r->out.rid = group_sid->sub_auths[group_sid->num_auths-1];
 
         return NT_STATUS_OK;
@@ -1085 +1066 @@
 }
 
-/* 
-  samr_EnumDomainGroups 
+/*
+  samr_EnumDomainGroups
 */
 static NTSTATUS dcesrv_samr_EnumDomainGroups(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1094 +1075 @@
         struct samr_domain_state *d_state;
         struct ldb_message **res;
-        int ldb_cnt, count, i, first;
+        int i, ldb_cnt;
+        uint32_t first, count;
         struct samr_SamEntry *entries;
-        const char * const attrs[3] = { "objectSid", "sAMAccountName", NULL };
+        const char * const attrs[] = { "objectSid", "sAMAccountName", NULL };
         struct samr_SamArray *sam;
 
@@ -1112 +1094 @@
                                       d_state->domain_dn, &res, attrs,
                                       d_state->domain_sid,
-                                      "(&(grouptype=%d)(objectclass=group))",
+                                      "(&(|(groupType=%d)(groupType=%d))(objectClass=group))",
+                                      GTYPE_SECURITY_UNIVERSAL_GROUP,
                                       GTYPE_SECURITY_GLOBAL_GROUP);
-        if (ldb_cnt == -1) {
+        if (ldb_cnt < 0) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
@@ -1131 +1114 @@
                 group_sid = samdb_result_dom_sid(mem_ctx, res[i],
                                                  "objectSid");
-                if (group_sid == NULL)
-                        continue;
+                if (group_sid == NULL) {
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
 
                 entries[count].idx =
                         group_sid->sub_auths[group_sid->num_auths-1];
                 entries[count].name.string =
-                        samdb_result_string(res[i], "sAMAccountName", "");
+                        ldb_msg_find_attr_as_string(res[i], "sAMAccountName", "");
                 count += 1;
         }
 
         /* sort the results by rid */
-        qsort(entries, count, sizeof(struct samr_SamEntry), 
-              (comparison_fn_t)compare_SamEntry);
+        TYPESAFE_QSORT(entries, count, compare_SamEntry);
 
         /* find the first entry to return */
@@ -1150 +1133 @@
              first++) ;
 
-        /* return the rest, limit by max_size. Note that we 
+        /* return the rest, limit by max_size. Note that we
            use the w2k3 element size value of 54 */
         *r->out.num_entries = count - first;
@@ -1166 +1149 @@
         *r->out.sam = sam;
 
+        if (first == count) {
+                return NT_STATUS_OK;
+        }
+
         if (*r->out.num_entries < count - first) {
                 *r->out.resume_handle = entries[first+*r->out.num_entries-1].idx;
@@ -1175 +1162 @@
 
 
-/* 
-  samr_CreateUser2 
+/*
+  samr_CreateUser2
 
   This call uses transactions to ensure we don't get a new conflicting
@@ -1185 +1172 @@
                                  struct samr_CreateUser2 *r)
 {
+        NTSTATUS status;
         struct samr_domain_state *d_state;
         struct samr_account_state *a_state;
         struct dcesrv_handle *h;
-        const char *name;
-        struct ldb_message *msg;
+        struct ldb_dn *dn;
         struct dom_sid *sid;
+        struct dcesrv_handle *u_handle;
         const char *account_name;
-        struct dcesrv_handle *u_handle;
-        int ret;
-        const char *container, *obj_class=NULL;
-        char *cn_name;
-        int cn_name_len;
-
-        const char *attrs[] = {
-                "objectSid", 
-                "userAccountControl",
-                NULL
-        };
-
-        uint32_t user_account_control;
-
-        struct ldb_message **msgs;
 
         ZERO_STRUCTP(r->out.user_handle);
@@ -1229 +1202 @@
         }
 
-        /*
-         * Start a transaction, so we can query and do a subsequent atomic
-         * modify
-         */
-
-        ret = ldb_transaction_start(d_state->sam_ctx);
-        if (ret != 0) {
-                DEBUG(0,("Failed to start a transaction for user creation: %s\n",
-                         ldb_errstring(d_state->sam_ctx)));
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
-        /* check if the user already exists */
-        name = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL, 
-                                   "sAMAccountName", 
-                                   "(&(sAMAccountName=%s)(objectclass=user))", 
-                                   ldb_binary_encode_string(mem_ctx, account_name));
-        if (name != NULL) {
-                ldb_transaction_cancel(d_state->sam_ctx);
-                return NT_STATUS_USER_EXISTS;
-        }
-
-        msg = ldb_msg_new(mem_ctx);
-        if (msg == NULL) {
-                ldb_transaction_cancel(d_state->sam_ctx);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        cn_name   = talloc_strdup(mem_ctx, account_name);
-        if (!cn_name) {
-                ldb_transaction_cancel(d_state->sam_ctx);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        cn_name_len = strlen(cn_name);
-
-        /* This must be one of these values *only* */
-        if (r->in.acct_flags == ACB_NORMAL) {
-                container = "CN=Users";
-                obj_class = "user";
-
-        } else if (r->in.acct_flags == ACB_WSTRUST) {
-                if (cn_name[cn_name_len - 1] != '$') {
-                        ldb_transaction_cancel(d_state->sam_ctx);
-                        return NT_STATUS_FOOBAR;
-                }
-                cn_name[cn_name_len - 1] = '\0';
-                container = "CN=Computers";
-                obj_class = "computer";
-                samdb_msg_add_int(d_state->sam_ctx, mem_ctx, msg,
-                        "primaryGroupID", DOMAIN_RID_DOMAIN_MEMBERS);
-
-        } else if (r->in.acct_flags == ACB_SVRTRUST) {
-                if (cn_name[cn_name_len - 1] != '$') {
-                        ldb_transaction_cancel(d_state->sam_ctx);
-                        return NT_STATUS_FOOBAR;                
-                }
-                cn_name[cn_name_len - 1] = '\0';
-                container = "OU=Domain Controllers";
-                obj_class = "computer";
-                samdb_msg_add_int(d_state->sam_ctx, mem_ctx, msg,
-                        "primaryGroupID", DOMAIN_RID_DCS);
-        } else {
-                ldb_transaction_cancel(d_state->sam_ctx);
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* add core elements to the ldb_message for the user */
-        msg->dn = ldb_dn_copy(mem_ctx, d_state->domain_dn);
-        if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s,%s", cn_name, container)) {
-                ldb_transaction_cancel(d_state->sam_ctx);
-                return NT_STATUS_FOOBAR;
-        }
-
-        samdb_msg_add_string(d_state->sam_ctx, mem_ctx, msg, "sAMAccountName",
-                account_name);
-        samdb_msg_add_string(d_state->sam_ctx, mem_ctx, msg, "objectClass",
-                obj_class);
-
-        /* create the user */
-        ret = ldb_add(d_state->sam_ctx, msg);
-        switch (ret) {
-        case LDB_SUCCESS:
-                break;
-        case LDB_ERR_ENTRY_ALREADY_EXISTS:
-                ldb_transaction_cancel(d_state->sam_ctx);
-                DEBUG(0,("Failed to create user record %s: %s\n",
-                         ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(d_state->sam_ctx)));
-                return NT_STATUS_USER_EXISTS;
-        case LDB_ERR_UNWILLING_TO_PERFORM:
-        case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
-                ldb_transaction_cancel(d_state->sam_ctx);
-                DEBUG(0,("Failed to create user record %s: %s\n",
-                         ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(d_state->sam_ctx)));
-                return NT_STATUS_ACCESS_DENIED;
-        default:
-                ldb_transaction_cancel(d_state->sam_ctx);
-                DEBUG(0,("Failed to create user record %s: %s\n",
-                         ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(d_state->sam_ctx)));
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
-        a_state = talloc(d_state, struct samr_account_state);
+        status = dsdb_add_user(d_state->sam_ctx, mem_ctx, account_name, r->in.acct_flags, &sid, &dn);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+        a_state = talloc(mem_ctx, struct samr_account_state);
         if (!a_state) {
                 ldb_transaction_cancel(d_state->sam_ctx);
@@ -1342 +1214 @@
         a_state->access_mask = r->in.access_mask;
         a_state->domain_state = talloc_reference(a_state, d_state);
-        a_state->account_dn = talloc_steal(a_state, msg->dn);
-
-        /* retrieve the sid and account control bits for the user just created */
-        ret = gendb_search_dn(d_state->sam_ctx, a_state,
-                              msg->dn, &msgs, attrs);
-
-        if (ret != 1) {
-                ldb_transaction_cancel(d_state->sam_ctx);
-                DEBUG(0,("Apparently we failed to create an account record, as %s now doesn't exist\n",
-                         ldb_dn_get_linearized(msg->dn)));
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-        sid = samdb_result_dom_sid(mem_ctx, msgs[0], "objectSid");
-        if (sid == NULL) {
-                ldb_transaction_cancel(d_state->sam_ctx);
-                DEBUG(0,("Apparently we failed to get the objectSid of the just created account record %s\n",
-                         ldb_dn_get_linearized(msg->dn)));
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
-        /* Change the account control to be the correct account type.
-         * The default is for a workstation account */
-        user_account_control = samdb_result_uint(msgs[0], "userAccountControl", 0);
-        user_account_control = (user_account_control & 
-                                ~(UF_NORMAL_ACCOUNT |
-                                  UF_INTERDOMAIN_TRUST_ACCOUNT | 
-                                  UF_WORKSTATION_TRUST_ACCOUNT | 
-                                  UF_SERVER_TRUST_ACCOUNT));
-        user_account_control |= ds_acb2uf(r->in.acct_flags);
-
-        talloc_free(msg);
-        msg = ldb_msg_new(mem_ctx);
-        if (msg == NULL) {
-                ldb_transaction_cancel(d_state->sam_ctx);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        msg->dn = ldb_dn_copy(msg, a_state->account_dn);
-
-        if (samdb_msg_add_uint(a_state->sam_ctx, mem_ctx, msg, 
-                               "userAccountControl", 
-                               user_account_control) != 0) { 
-                ldb_transaction_cancel(d_state->sam_ctx);
-                return NT_STATUS_NO_MEMORY; 
-        }
-
-        /* modify the samdb record */
-        ret = samdb_replace(a_state->sam_ctx, mem_ctx, msg);
-        if (ret != 0) {
-                DEBUG(0,("Failed to modify account record %s to set userAccountControl: %s\n",
-                         ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(d_state->sam_ctx)));
-                ldb_transaction_cancel(d_state->sam_ctx);
-
-                /* we really need samdb.c to return NTSTATUS */
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        ret = ldb_transaction_commit(d_state->sam_ctx);
-        if (ret != 0) {
-                DEBUG(0,("Failed to commit transaction to add and modify account record %s: %s\n",
-                         ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(d_state->sam_ctx)));
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
+        a_state->account_dn = talloc_steal(a_state, dn);
 
         a_state->account_name = talloc_steal(a_state, account_name);
@@ -1430 +1238 @@
 
 
-/* 
-  samr_CreateUser 
+/*
+  samr_CreateUser
 */
 static NTSTATUS dcesrv_samr_CreateUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1452 +1260 @@
 }
 
-/* 
-  samr_EnumDomainUsers 
+/*
+  samr_EnumDomainUsers
 */
 static NTSTATUS dcesrv_samr_EnumDomainUsers(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1460 +1268 @@
         struct dcesrv_handle *h;
         struct samr_domain_state *d_state;
-        struct ldb_result *res;
-        int ret, num_filtered_entries, i, first;
+        struct ldb_message **res;
+        int i, ldb_cnt;
+        uint32_t first, count;
         struct samr_SamEntry *entries;
         const char * const attrs[] = { "objectSid", "sAMAccountName",
@@ -1474 +1283 @@
 
         d_state = h->data;
-        
-        /* don't have to worry about users in the builtin domain, as there are none */
-        ret = ldb_search(d_state->sam_ctx, mem_ctx, &res, d_state->domain_dn, LDB_SCOPE_SUBTREE, attrs, "objectClass=user");
-
-        if (ret != LDB_SUCCESS) {
-                DEBUG(3, ("Failed to search for Domain Users in %s: %s\n", 
-                          ldb_dn_get_linearized(d_state->domain_dn), ldb_errstring(d_state->sam_ctx)));
+
+        /* search for all domain users in this domain. This could possibly be
+           cached and resumed on resume_key */
+        ldb_cnt = samdb_search_domain(d_state->sam_ctx, mem_ctx,
+                                      d_state->domain_dn,
+                                      &res, attrs,
+                                      d_state->domain_sid,
+                                      "(objectClass=user)");
+        if (ldb_cnt < 0) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
         /* convert to SamEntry format */
-        entries = talloc_array(mem_ctx, struct samr_SamEntry, res->count);
+        entries = talloc_array(mem_ctx, struct samr_SamEntry, ldb_cnt);
         if (!entries) {
                 return NT_STATUS_NO_MEMORY;
         }
-        num_filtered_entries = 0;
-        for (i=0;i<res->count;i++) {
+
+        count = 0;
+
+        for (i=0;i<ldb_cnt;i++) {
                 /* Check if a mask has been requested */
                 if (r->in.acct_flags
-                    && ((samdb_result_acct_flags(d_state->sam_ctx, mem_ctx, res->msgs[i], 
-                                                 d_state->domain_dn) & r->in.acct_flags) == 0)) {
+                    && ((samdb_result_acct_flags(d_state->sam_ctx, mem_ctx,
+                                                 res[i], d_state->domain_dn) & r->in.acct_flags) == 0)) {
                         continue;
                 }
-                entries[num_filtered_entries].idx = samdb_result_rid_from_sid(mem_ctx, res->msgs[i], "objectSid", 0);
-                entries[num_filtered_entries].name.string = samdb_result_string(res->msgs[i], "sAMAccountName", "");
-                num_filtered_entries++;
+                entries[count].idx = samdb_result_rid_from_sid(mem_ctx, res[i],
+                                                               "objectSid", 0);
+                entries[count].name.string = ldb_msg_find_attr_as_string(res[i],
+                                                                 "sAMAccountName", "");
+                count += 1;
         }
 
         /* sort the results by rid */
-        qsort(entries, num_filtered_entries, sizeof(struct samr_SamEntry), 
-              (comparison_fn_t)compare_SamEntry);
+        TYPESAFE_QSORT(entries, count, compare_SamEntry);
 
         /* find the first entry to return */
         for (first=0;
-             first<num_filtered_entries && entries[first].idx <= *r->in.resume_handle;
+             first<count && entries[first].idx <= *r->in.resume_handle;
              first++) ;
 
-        /* return the rest, limit by max_size. Note that we 
+        /* return the rest, limit by max_size. Note that we
            use the w2k3 element size value of 54 */
-        *r->out.num_entries = num_filtered_entries - first;
+        *r->out.num_entries = count - first;
         *r->out.num_entries = MIN(*r->out.num_entries,
                                  1+(r->in.max_size/SAMR_ENUM_USERS_MULTIPLIER));
@@ -1527 +1341 @@
         *r->out.sam = sam;
 
-        if (first == num_filtered_entries) {
+        if (first == count) {
                 return NT_STATUS_OK;
         }
 
-        if (*r->out.num_entries < num_filtered_entries - first) {
+        if (*r->out.num_entries < count - first) {
                 *r->out.resume_handle = entries[first+*r->out.num_entries-1].idx;
                 return STATUS_MORE_ENTRIES;
@@ -1540 +1354 @@
 
 
-/* 
-  samr_CreateDomAlias 
+/*
+  samr_CreateDomAlias
 */
 static NTSTATUS dcesrv_samr_CreateDomAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1549 +1363 @@
         struct samr_account_state *a_state;
         struct dcesrv_handle *h;
-        const char *alias_name, *name;
-        struct ldb_message *msg;
+        const char *alias_name;
         struct dom_sid *sid;
         struct dcesrv_handle *a_handle;
-        int ret;
+        struct ldb_dn *dn;
+        NTSTATUS status;
 
         ZERO_STRUCTP(r->out.alias_handle);
@@ -1573 +1387 @@
         }
 
-        /* Check if alias already exists */
-        name = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL,
-                                   "sAMAccountName",
-                                   "(sAMAccountName=%s)(objectclass=group))",
-                                   ldb_binary_encode_string(mem_ctx, alias_name));
-
-        if (name != NULL) {
-                return NT_STATUS_ALIAS_EXISTS;
-        }
-
-        msg = ldb_msg_new(mem_ctx);
-        if (msg == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* add core elements to the ldb_message for the alias */
-        msg->dn = ldb_dn_copy(mem_ctx, d_state->domain_dn);
-        ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=Users", alias_name);
-        if (!msg->dn) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        samdb_msg_add_string(d_state->sam_ctx, mem_ctx, msg, "sAMAccountName", alias_name);
-        samdb_msg_add_string(d_state->sam_ctx, mem_ctx, msg, "objectClass", "group");
-        samdb_msg_add_int(d_state->sam_ctx, mem_ctx, msg, "groupType", GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
-
-        /* create the alias */
-        ret = ldb_add(d_state->sam_ctx, msg);
-        switch (ret) {
-        case LDB_SUCCESS:
-                break;
-        case LDB_ERR_ENTRY_ALREADY_EXISTS:
-                return NT_STATUS_ALIAS_EXISTS;
-        case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
-                return NT_STATUS_ACCESS_DENIED;
-        default:
-                DEBUG(0,("Failed to create alias record %s: %s\n",
-                         ldb_dn_get_linearized(msg->dn),
-                         ldb_errstring(d_state->sam_ctx)));
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
-        a_state = talloc(d_state, struct samr_account_state);
+        status = dsdb_add_domain_alias(d_state->sam_ctx, mem_ctx, alias_name, &sid, &dn);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        a_state = talloc(mem_ctx, struct samr_account_state);
         if (!a_state) {
                 return NT_STATUS_NO_MEMORY;
@@ -1623 +1400 @@
         a_state->access_mask = r->in.access_mask;
         a_state->domain_state = talloc_reference(a_state, d_state);
-        a_state->account_dn = talloc_steal(a_state, msg->dn);
-
-        /* retrieve the sid for the alias just created */
-        sid = samdb_search_dom_sid(d_state->sam_ctx, a_state,
-                                   msg->dn, "objectSid", NULL);
-
-        a_state->account_name = talloc_strdup(a_state, alias_name);
-        if (!a_state->account_name) {
-                return NT_STATUS_NO_MEMORY;
-        }
+        a_state->account_dn = talloc_steal(a_state, dn);
+
+        a_state->account_name = talloc_steal(a_state, alias_name);
 
         /* create the policy handle */
@@ -1649 +1419 @@
 
 
-/* 
-  samr_EnumDomainAliases 
+/*
+  samr_EnumDomainAliases
 */
 static NTSTATUS dcesrv_samr_EnumDomainAliases(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1658 +1428 @@
         struct samr_domain_state *d_state;
         struct ldb_message **res;
-        int ldb_cnt, count, i, first;
+        int i, ldb_cnt;
+        uint32_t first, count;
         struct samr_SamEntry *entries;
-        const char * const attrs[3] = { "objectSid", "sAMAccountName", NULL };
+        const char * const attrs[] = { "objectSid", "sAMAccountName", NULL };
         struct samr_SamArray *sam;
 
@@ -1671 +1442 @@
         d_state = h->data;
 
-        /* search for all domain groups in this domain. This could possibly be
+        /* search for all domain aliases in this domain. This could possibly be
            cached and resumed based on resume_key */
-        ldb_cnt = samdb_search_domain(d_state->sam_ctx, mem_ctx,
-                                      d_state->domain_dn,
-                                      &res, attrs, 
+        ldb_cnt = samdb_search_domain(d_state->sam_ctx, mem_ctx, NULL,
+                                      &res, attrs,
                                       d_state->domain_sid,
                                       "(&(|(grouptype=%d)(grouptype=%d)))"
@@ -1681 +1451 @@
                                       GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
                                       GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
-        if (ldb_cnt == -1) {
+        if (ldb_cnt < 0) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-        if (ldb_cnt == 0) {
-                return NT_STATUS_OK;
         }
 
@@ -1702 +1469 @@
                                                  "objectSid");
 
-                if (alias_sid == NULL)
-                        continue;
+                if (alias_sid == NULL) {
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
 
                 entries[count].idx =
                         alias_sid->sub_auths[alias_sid->num_auths-1];
                 entries[count].name.string =
-                        samdb_result_string(res[i], "sAMAccountName", "");
+                        ldb_msg_find_attr_as_string(res[i], "sAMAccountName", "");
                 count += 1;
         }
 
         /* sort the results by rid */
-        qsort(entries, count, sizeof(struct samr_SamEntry), 
-              (comparison_fn_t)compare_SamEntry);
+        TYPESAFE_QSORT(entries, count, compare_SamEntry);
 
         /* find the first entry to return */
@@ -1721 +1488 @@
              first++) ;
 
+        /* return the rest, limit by max_size. Note that we
+           use the w2k3 element size value of 54 */
+        *r->out.num_entries = count - first;
+        *r->out.num_entries = MIN(*r->out.num_entries,
+                                  1+(r->in.max_size/SAMR_ENUM_USERS_MULTIPLIER));
+
+        sam = talloc(mem_ctx, struct samr_SamArray);
+        if (!sam) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        sam->entries = entries+first;
+        sam->count = *r->out.num_entries;
+
+        *r->out.sam = sam;
+
         if (first == count) {
                 return NT_STATUS_OK;
         }
-
-        *r->out.num_entries = count - first;
-        *r->out.num_entries = MIN(*r->out.num_entries, 1000);
-
-        sam = talloc(mem_ctx, struct samr_SamArray);
-        if (!sam) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        sam->entries = entries+first;
-        sam->count = *r->out.num_entries;
-
-        *r->out.sam = sam;
 
         if (*r->out.num_entries < count - first) {
@@ -1748 +1518 @@
 
 
-/* 
-  samr_GetAliasMembership 
+/*
+  samr_GetAliasMembership
 */
 static NTSTATUS dcesrv_samr_GetAliasMembership(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1756 +1526 @@
         struct dcesrv_handle *h;
         struct samr_domain_state *d_state;
+        const char *filter;
+        const char * const attrs[] = { "objectSid", NULL };
         struct ldb_message **res;
-        int i, count = 0;
+        uint32_t i;
+        int count = 0;
 
         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
@@ -1763 +1536 @@
         d_state = h->data;
 
-        if (r->in.sids->num_sids > 0) {
-                const char *filter;
-                const char * const attrs[2] = { "objectSid", NULL };
-
-                filter = talloc_asprintf(mem_ctx,
-                                         "(&(|(grouptype=%d)(grouptype=%d))"
-                                         "(objectclass=group)(|",
-                                         GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
-                                         GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
-                if (filter == NULL)
+        filter = talloc_asprintf(mem_ctx,
+                                 "(&(|(grouptype=%d)(grouptype=%d))"
+                                 "(objectclass=group)(|",
+                                 GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
+                                 GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
+        if (filter == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        for (i=0; i<r->in.sids->num_sids; i++) {
+                const char *memberdn;
+
+                memberdn = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL,
+                                               "distinguishedName",
+                                               "(objectSid=%s)",
+                                               ldap_encode_ndr_dom_sid(mem_ctx,
+                                                                       r->in.sids->sids[i].sid));
+                if (memberdn == NULL) {
+                        continue;
+                }
+
+                filter = talloc_asprintf(mem_ctx, "%s(member=%s)", filter,
+                                         memberdn);
+                if (filter == NULL) {
                         return NT_STATUS_NO_MEMORY;
-
-                for (i=0; i<r->in.sids->num_sids; i++) {
-                        const char *memberdn;
-
-                        memberdn = 
-                                samdb_search_string(d_state->sam_ctx,
-                                                    mem_ctx, NULL,
-                                                    "distinguishedName",
-                                                    "(objectSid=%s)",
-                                                    ldap_encode_ndr_dom_sid(mem_ctx, 
-                                                                            r->in.sids->sids[i].sid));
-
-                        if (memberdn == NULL)
-                                continue;
-
-                        filter = talloc_asprintf(mem_ctx, "%s(member=%s)",
-                                                 filter, memberdn);
-                        if (filter == NULL)
-                                return NT_STATUS_NO_MEMORY;
                 }
-
-                count = samdb_search_domain(d_state->sam_ctx, mem_ctx,
-                                            d_state->domain_dn, &res, attrs,
-                                            d_state->domain_sid, "%s))", filter);
-                if (count < 0)
+        }
+
+        /* Find out if we had at least one valid member SID passed - otherwise
+         * just skip the search. */
+        if (strstr(filter, "member") != NULL) {
+                count = samdb_search_domain(d_state->sam_ctx, mem_ctx, NULL,
+                                            &res, attrs, d_state->domain_sid,
+                                            "%s))", filter);
+                if (count < 0) {
                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
         }
 
@@ -1811 +1584 @@
 
                 alias_sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
-
                 if (alias_sid == NULL) {
-                        DEBUG(0, ("Could not find objectSid\n"));
-                        continue;
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
                 }
 
@@ -1826 +1597 @@
 
 
-/* 
-  samr_LookupNames 
+/*
+  samr_LookupNames
 */
 static NTSTATUS dcesrv_samr_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1834 +1605 @@
         struct dcesrv_handle *h;
         struct samr_domain_state *d_state;
-        int i, num_mapped;
+        uint32_t i, num_mapped;
         NTSTATUS status = NT_STATUS_OK;
         const char * const attrs[] = { "sAMAccountType", "objectSid", NULL };
@@ -1868 +1639 @@
                 r->out.types->ids[i] = SID_NAME_UNKNOWN;
 
-                count = gendb_search(d_state->sam_ctx, mem_ctx, d_state->domain_dn, &res, attrs, 
-                                     "sAMAccountName=%s", 
+                count = gendb_search(d_state->sam_ctx, mem_ctx, d_state->domain_dn, &res, attrs,
+                                     "sAMAccountName=%s",
                                      ldb_binary_encode_string(mem_ctx, r->in.names[i].string));
                 if (count != 1) {
@@ -1881 +1652 @@
                         continue;
                 }
-                
-                atype = samdb_result_uint(res[0], "sAMAccountType", 0);
+
+                atype = ldb_msg_find_attr_as_uint(res[0], "sAMAccountType", 0);
                 if (atype == 0) {
                         status = STATUS_SOME_UNMAPPED;
@@ -1889 +1660 @@
 
                 rtype = ds_atype_map(atype);
-                
+
                 if (rtype == SID_NAME_UNKNOWN) {
                         status = STATUS_SOME_UNMAPPED;
@@ -1899 +1670 @@
                 num_mapped++;
         }
-        
+
         if (num_mapped == 0) {
                 return NT_STATUS_NONE_MAPPED;
@@ -1907 +1678 @@
 
 
-/* 
-  samr_LookupRids 
+/*
+  samr_LookupRids
 */
 static NTSTATUS dcesrv_samr_LookupRids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                        struct samr_LookupRids *r)
 {
+        NTSTATUS status;
         struct dcesrv_handle *h;
         struct samr_domain_state *d_state;
-        int i, total;
-        NTSTATUS status = NT_STATUS_OK;
-        struct lsa_String *names;
-        uint32_t *ids;
+        const char **names;
+        struct lsa_String *lsa_names;
+        enum lsa_SidType *ids;
 
         ZERO_STRUCTP(r->out.names);
@@ -1930 +1701 @@
                 return NT_STATUS_OK;
 
-        names = talloc_array(mem_ctx, struct lsa_String, r->in.num_rids);
-        ids = talloc_array(mem_ctx, uint32_t, r->in.num_rids);
-
-        if ((names == NULL) || (ids == NULL))
-                return NT_STATUS_NO_MEMORY;
-
-        total = 0;
-
-        for (i=0; i<r->in.num_rids; i++) {
-                struct ldb_message **res;
-                int count;
-                const char * const attrs[] = {  "sAMAccountType",
-                                                "sAMAccountName", NULL };
-                uint32_t atype;
-                struct dom_sid *sid;
-
-                ids[i] = SID_NAME_UNKNOWN;
-
-                sid = dom_sid_add_rid(mem_ctx, d_state->domain_sid,
-                        r->in.rids[i]);
-                if (sid == NULL) {
-                        names[i].string = NULL;
-                        status = STATUS_SOME_UNMAPPED;
-                        continue;
+        lsa_names = talloc_zero_array(mem_ctx, struct lsa_String, r->in.num_rids);
+        names = talloc_zero_array(mem_ctx, const char *, r->in.num_rids);
+        ids = talloc_zero_array(mem_ctx, enum lsa_SidType, r->in.num_rids);
+
+        if ((lsa_names == NULL) || (names == NULL) || (ids == NULL))
+                return NT_STATUS_NO_MEMORY;
+
+        r->out.names->names = lsa_names;
+        r->out.names->count = r->in.num_rids;
+
+        r->out.types->ids = (uint32_t *) ids;
+        r->out.types->count = r->in.num_rids;
+
+        status = dsdb_lookup_rids(d_state->sam_ctx, mem_ctx, d_state->domain_sid,
+                                  r->in.num_rids, r->in.rids, names, ids);
+        if (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) || NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
+                uint32_t i;
+                for (i = 0; i < r->in.num_rids; i++) {
+                        lsa_names[i].string = names[i];
                 }
-                
-                count = gendb_search(d_state->sam_ctx, mem_ctx,
-                                     d_state->domain_dn, &res, attrs,
-                                     "(objectSid=%s)", 
-                                     ldap_encode_ndr_dom_sid(mem_ctx, sid));
-                if (count != 1) {
-                        names[i].string = NULL;
-                        status = STATUS_SOME_UNMAPPED;
-                        continue;
-                }
-
-                names[i].string = samdb_result_string(res[0], "sAMAccountName",
-                                                      NULL);
-
-                atype = samdb_result_uint(res[0], "sAMAccountType", 0);
-                if (atype == 0) {
-                        status = STATUS_SOME_UNMAPPED;
-                        continue;
-                }
-
-                ids[i] = ds_atype_map(atype);
-                
-                if (ids[i] == SID_NAME_UNKNOWN) {
-                        status = STATUS_SOME_UNMAPPED;
-                        continue;
-                }
-        }
-
-        r->out.names->names = names;
-        r->out.names->count = r->in.num_rids;
-
-        r->out.types->ids = ids;
-        r->out.types->count = r->in.num_rids;
-
+        }
         return status;
 }
 
 
-/* 
-  samr_OpenGroup 
+/*
+  samr_OpenGroup
 */
 static NTSTATUS dcesrv_samr_OpenGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2024 +1757 @@
         ret = gendb_search(d_state->sam_ctx,
                            mem_ctx, d_state->domain_dn, &msgs, attrs,
-                           "(&(objectSid=%s)(objectclass=group)"
-                           "(grouptype=%d))",
+                           "(&(objectSid=%s)(objectClass=group)"
+                           "(|(groupType=%d)(groupType=%d)))",
                            ldap_encode_ndr_dom_sid(mem_ctx, sid),
+                           GTYPE_SECURITY_UNIVERSAL_GROUP,
                            GTYPE_SECURITY_GLOBAL_GROUP);
         if (ret == 0) {
@@ -2032 +1766 @@
         }
         if (ret != 1) {
-                DEBUG(0,("Found %d records matching sid %s\n", 
+                DEBUG(0,("Found %d records matching sid %s\n",
                          ret, dom_sid_string(mem_ctx, sid)));
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
-        groupname = samdb_result_string(msgs[0], "sAMAccountName", NULL);
+        groupname = ldb_msg_find_attr_as_string(msgs[0], "sAMAccountName", NULL);
         if (groupname == NULL) {
-                DEBUG(0,("sAMAccountName field missing for sid %s\n", 
+                DEBUG(0,("sAMAccountName field missing for sid %s\n",
                          dom_sid_string(mem_ctx, sid)));
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
-        a_state = talloc(d_state, struct samr_account_state);
+        a_state = talloc(mem_ctx, struct samr_account_state);
         if (!a_state) {
                 return NT_STATUS_NO_MEMORY;
@@ -2071 +1805 @@
 }
 
-/* 
-  samr_QueryGroupInfo 
+/*
+  samr_QueryGroupInfo
 */
 static NTSTATUS dcesrv_samr_QueryGroupInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2079 +1813 @@
         struct dcesrv_handle *h;
         struct samr_account_state *a_state;
-        struct ldb_message *msg;
-        struct ldb_result *res;
+        struct ldb_message *msg, **res;
         const char * const attrs[4] = { "sAMAccountName", "description",
                                         "numMembers", NULL };
@@ -2091 +1824 @@
 
         a_state = h->data;
-        
-        ret = ldb_search(a_state->sam_ctx, mem_ctx, &res, a_state->account_dn,
-                LDB_SCOPE_SUBTREE, attrs, "objectClass=*");
-        
-        if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+
+        /* pull all the group attributes */
+        ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
+                              a_state->account_dn, &res, attrs);
+        if (ret == 0) {
                 return NT_STATUS_NO_SUCH_GROUP;
-        } else if (ret != LDB_SUCCESS) {
-                DEBUG(2, ("Error reading group info: %s\n", ldb_errstring(a_state->sam_ctx)));
+        }
+        if (ret != 1) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
-
-        if (res->count != 1) {
-                DEBUG(2, ("Error finding group info, got %d entries\n", res->count));
-                
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-        msg = res->msgs[0];
+        msg = res[0];
 
         /* allocate the info structure */
@@ -2149 +1876 @@
 
 
-/* 
-  samr_SetGroupInfo 
+/*
+  samr_SetGroupInfo
 */
 static NTSTATUS dcesrv_samr_SetGroupInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2169 +1896 @@
         if (msg == NULL) {
                 return NT_STATUS_NO_MEMORY;
-        }       
+        }
 
         msg->dn = ldb_dn_copy(mem_ctx, g_state->account_dn);
@@ -2194 +1921 @@
         /* modify the samdb record */
         ret = ldb_modify(g_state->sam_ctx, msg);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 /* we really need samdb.c to return NTSTATUS */
                 return NT_STATUS_UNSUCCESSFUL;
@@ -2203 +1930 @@
 
 
-/* 
-  samr_AddGroupMember 
+/*
+  samr_AddGroupMember
 */
 static NTSTATUS dcesrv_samr_AddGroupMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2225 +1952 @@
 
         membersid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid);
-        if (membersid == NULL)
-                return NT_STATUS_NO_MEMORY;
-
-        /* In native mode, AD can also nest domain groups. Not sure yet
-         * whether this is also available via RPC. */
+        if (membersid == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /* according to MS-SAMR 3.1.5.8.2 all type of accounts are accepted */
         ret = ldb_search(d_state->sam_ctx, mem_ctx, &res,
-                                 d_state->domain_dn, LDB_SCOPE_SUBTREE, attrs,
-                                 "(&(objectSid=%s)(objectclass=user))",
-                                 ldap_encode_ndr_dom_sid(mem_ctx, membersid));
-
-        if (ret != 0) {
+                         d_state->domain_dn, LDB_SCOPE_SUBTREE, attrs,
+                         "(objectSid=%s)",
+                         ldap_encode_ndr_dom_sid(mem_ctx, membersid));
+
+        if (ret != LDB_SUCCESS) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
@@ -2242 +1969 @@
                 return NT_STATUS_NO_SUCH_USER;
         }
-                
+
         if (res->count > 1) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -2259 +1986 @@
         mod->dn = talloc_reference(mem_ctx, a_state->account_dn);
 
-        if (samdb_msg_add_addval(d_state->sam_ctx, mem_ctx, mod, "member",
-                                 memberdn) != 0)
+        ret = samdb_msg_add_addval(d_state->sam_ctx, mem_ctx, mod, "member",
+                                                                memberdn);
+        if (ret != LDB_SUCCESS) {
                 return NT_STATUS_UNSUCCESSFUL;
+        }
 
         ret = ldb_modify(a_state->sam_ctx, mod);
@@ -2267 +1996 @@
         case LDB_SUCCESS:
                 return NT_STATUS_OK;
-        case LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS:
+        case LDB_ERR_ENTRY_ALREADY_EXISTS:
                 return NT_STATUS_MEMBER_IN_GROUP;
         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
@@ -2274 +2003 @@
                 return NT_STATUS_UNSUCCESSFUL;
         }
-
-}
-
-
-/* 
-  samr_DeleteDomainGroup 
+}
+
+
+/*
+  samr_DeleteDomainGroup
 */
 static NTSTATUS dcesrv_samr_DeleteDomainGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2295 +2023 @@
 
         ret = ldb_delete(a_state->sam_ctx, a_state->account_dn);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 return NT_STATUS_UNSUCCESSFUL;
         }
 
+        talloc_free(h);
         ZERO_STRUCTP(r->out.group_handle);
 
@@ -2305 +2034 @@
 
 
-/* 
-  samr_DeleteGroupMember 
+/*
+  samr_DeleteGroupMember
 */
 static NTSTATUS dcesrv_samr_DeleteGroupMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2327 +2056 @@
 
         membersid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid);
-        if (membersid == NULL)
-                return NT_STATUS_NO_MEMORY;
-
-        /* In native mode, AD can also nest domain groups. Not sure yet
-         * whether this is also available via RPC. */
+        if (membersid == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /* according to MS-SAMR 3.1.5.8.2 all type of accounts are accepted */
         ret = ldb_search(d_state->sam_ctx, mem_ctx, &res,
-                                 d_state->domain_dn, LDB_SCOPE_SUBTREE, attrs,
-                                 "(&(objectSid=%s)(objectclass=user))",
-                                 ldap_encode_ndr_dom_sid(mem_ctx, membersid));
-
-        if (ret != 0) {
+                         d_state->domain_dn, LDB_SCOPE_SUBTREE, attrs,
+                         "(objectSid=%s)",
+                         ldap_encode_ndr_dom_sid(mem_ctx, membersid));
+
+        if (ret != LDB_SUCCESS) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
@@ -2344 +2073 @@
                 return NT_STATUS_NO_SUCH_USER;
         }
-                
+
         if (res->count > 1) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -2361 +2090 @@
         mod->dn = talloc_reference(mem_ctx, a_state->account_dn);
 
-        if (samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod, "member",
-                                 memberdn) != 0) {
+        ret = samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod, "member",
+                                                                memberdn);
+        if (ret != LDB_SUCCESS) {
                 return NT_STATUS_NO_MEMORY;
         }
@@ -2370 +2100 @@
         case LDB_SUCCESS:
                 return NT_STATUS_OK;
-        case LDB_ERR_NO_SUCH_ATTRIBUTE:
+        case LDB_ERR_UNWILLING_TO_PERFORM:
                 return NT_STATUS_MEMBER_NOT_IN_GROUP;
         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
@@ -2380 +2110 @@
 
 
-/* 
-  samr_QueryGroupMember 
+/*
+  samr_QueryGroupMember
 */
 static NTSTATUS dcesrv_samr_QueryGroupMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2388 +2118 @@
         struct dcesrv_handle *h;
         struct samr_account_state *a_state;
-        struct ldb_message **res;
-        struct ldb_message_element *el;
-        struct samr_RidTypeArray *array;
-        const char * const attrs[2] = { "member", NULL };
-        int ret;
+        struct samr_domain_state *d_state;
+        struct samr_RidAttrArray *array;
+        unsigned int i, num_members;
+        struct dom_sid *members;
+        NTSTATUS status;
 
         DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP);
 
         a_state = h->data;
-
-        /* pull the member attribute */
-        ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
-                              a_state->account_dn, &res, attrs);
-
-        if (ret != 1) {
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
-        array = talloc(mem_ctx, struct samr_RidTypeArray);
-
-        if (array == NULL)
-                return NT_STATUS_NO_MEMORY;
-
-        ZERO_STRUCTP(array);
-
-        el = ldb_msg_find_element(res[0], "member");
-
-        if (el != NULL) {
-                int i;
-
-                array->count = el->num_values;
-
-                array->rids = talloc_array(mem_ctx, uint32_t,
-                                             el->num_values);
-                if (array->rids == NULL)
-                        return NT_STATUS_NO_MEMORY;
-
-                array->types = talloc_array(mem_ctx, uint32_t,
-                                            el->num_values);
-                if (array->types == NULL)
-                        return NT_STATUS_NO_MEMORY;
-
-                for (i=0; i<el->num_values; i++) {
-                        struct ldb_message **res2;
-                        const char * const attrs2[2] = { "objectSid", NULL };
-                        ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
-                                           ldb_dn_from_ldb_val(mem_ctx, a_state->sam_ctx, &el->values[i]),
-                                           &res2, attrs2);
-                        if (ret != 1)
-                                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-
-                        array->rids[i] =
-                                samdb_result_rid_from_sid(mem_ctx, res2[0],
-                                                          "objectSid", 0);
-
-                        if (array->rids[i] == 0)
-                                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-
-                        array->types[i] = 7; /* RID type of some kind, not sure what the value means. */
+        d_state = a_state->domain_state;
+
+        status = dsdb_enum_group_mem(d_state->sam_ctx, mem_ctx,
+                                     a_state->account_dn, &members,
+                                     &num_members);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        array = talloc_zero(mem_ctx, struct samr_RidAttrArray);
+        if (array == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (num_members == 0) {
+                *r->out.rids = array;
+
+                return NT_STATUS_OK;
+        }
+
+        array->rids = talloc_array(array, uint32_t, num_members);
+        if (array->rids == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        array->attributes = talloc_array(array, uint32_t, num_members);
+        if (array->attributes == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        array->count = 0;
+        for (i=0; i<num_members; i++) {
+                if (!dom_sid_in_domain(d_state->domain_sid, &members[i])) {
+                        continue;
                 }
+
+                status = dom_sid_split_rid(NULL, &members[i], NULL,
+                                           &array->rids[array->count]);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                array->attributes[array->count] = SE_GROUP_MANDATORY |
+                                                  SE_GROUP_ENABLED_BY_DEFAULT |
+                                                  SE_GROUP_ENABLED;
+                array->count++;
         }
 
@@ -2456 +2181 @@
 
 
-/* 
-  samr_SetMemberAttributesOfGroup 
+/*
+  samr_SetMemberAttributesOfGroup
 */
 static NTSTATUS dcesrv_samr_SetMemberAttributesOfGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2466 +2191 @@
 
 
-/* 
-  samr_OpenAlias 
+/*
+  samr_OpenAlias
 */
 static NTSTATUS dcesrv_samr_OpenAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2494 +2219 @@
 
         /* search for the group record */
-        ret = gendb_search(d_state->sam_ctx,
-                           mem_ctx, d_state->domain_dn, &msgs, attrs,
+        ret = gendb_search(d_state->sam_ctx, mem_ctx, NULL, &msgs, attrs,
                            "(&(objectSid=%s)(objectclass=group)"
                            "(|(grouptype=%d)(grouptype=%d)))",
@@ -2505 +2229 @@
         }
         if (ret != 1) {
-                DEBUG(0,("Found %d records matching sid %s\n", 
+                DEBUG(0,("Found %d records matching sid %s\n",
                          ret, dom_sid_string(mem_ctx, sid)));
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
-        alias_name = samdb_result_string(msgs[0], "sAMAccountName", NULL);
+        alias_name = ldb_msg_find_attr_as_string(msgs[0], "sAMAccountName", NULL);
         if (alias_name == NULL) {
-                DEBUG(0,("sAMAccountName field missing for sid %s\n", 
+                DEBUG(0,("sAMAccountName field missing for sid %s\n",
                          dom_sid_string(mem_ctx, sid)));
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
-        a_state = talloc(d_state, struct samr_account_state);
+        a_state = talloc(mem_ctx, struct samr_account_state);
         if (!a_state) {
                 return NT_STATUS_NO_MEMORY;
@@ -2545 +2269 @@
 
 
-/* 
-  samr_QueryAliasInfo 
+/*
+  samr_QueryAliasInfo
 */
 static NTSTATUS dcesrv_samr_QueryAliasInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2567 +2291 @@
         /* pull all the alias attributes */
         ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
-                              a_state->account_dn ,&res, attrs);
+                              a_state->account_dn, &res, attrs);
+        if (ret == 0) {
+                return NT_STATUS_NO_SUCH_ALIAS;
+        }
         if (ret != 1) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -2602 +2329 @@
 
 
-/* 
-  samr_SetAliasInfo 
+/*
+  samr_SetAliasInfo
 */
 static NTSTATUS dcesrv_samr_SetAliasInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2644 +2371 @@
         /* modify the samdb record */
         ret = ldb_modify(a_state->sam_ctx, msg);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 /* we really need samdb.c to return NTSTATUS */
                 return NT_STATUS_UNSUCCESSFUL;
@@ -2653 +2380 @@
 
 
-/* 
-  samr_DeleteDomAlias 
+/*
+  samr_DeleteDomAlias
 */
 static NTSTATUS dcesrv_samr_DeleteDomAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2670 +2397 @@
 
         ret = ldb_delete(a_state->sam_ctx, a_state->account_dn);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 return NT_STATUS_UNSUCCESSFUL;
         }
 
+        talloc_free(h);
         ZERO_STRUCTP(r->out.alias_handle);
 
@@ -2680 +2408 @@
 
 
-/* 
-  samr_AddAliasMember 
+/*
+  samr_AddAliasMember
 */
 static NTSTATUS dcesrv_samr_AddAliasMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2702 +2430 @@
 
         ret = gendb_search(d_state->sam_ctx, mem_ctx, NULL,
-                           &msgs, attrs, "(objectsid=%s)", 
+                           &msgs, attrs, "(objectsid=%s)",
                            ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid));
 
         if (ret == 1) {
                 memberdn = msgs[0]->dn;
-        } else  if (ret > 1) {
-                DEBUG(0,("Found %d records matching sid %s\n", 
-                         ret, dom_sid_string(mem_ctx, r->in.sid)));
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
         } else if (ret == 0) {
                 status = samdb_create_foreign_security_principal(
@@ -2718 +2442 @@
                 }
         } else {
-                DEBUG(0, ("samdb_search returned %d: %s\n", ret, ldb_errstring(d_state->sam_ctx)));
+                DEBUG(0,("Found %d records matching sid %s\n",
+                         ret, dom_sid_string(mem_ctx, r->in.sid)));
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
@@ -2733 +2459 @@
         mod->dn = talloc_reference(mem_ctx, a_state->account_dn);
 
-        if (samdb_msg_add_addval(d_state->sam_ctx, mem_ctx, mod, "member",
-                                 ldb_dn_alloc_linearized(mem_ctx, memberdn)) != 0)
+        ret = samdb_msg_add_addval(d_state->sam_ctx, mem_ctx, mod, "member",
+                                 ldb_dn_alloc_linearized(mem_ctx, memberdn));
+        if (ret != LDB_SUCCESS) {
                 return NT_STATUS_UNSUCCESSFUL;
-
-        if (ldb_modify(a_state->sam_ctx, mod) != 0)
+        }
+
+        ret = ldb_modify(a_state->sam_ctx, mod);
+        switch (ret) {
+        case LDB_SUCCESS:
+                return NT_STATUS_OK;
+        case LDB_ERR_ENTRY_ALREADY_EXISTS:
+                return NT_STATUS_MEMBER_IN_GROUP;
+        case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
+                return NT_STATUS_ACCESS_DENIED;
+        default:
                 return NT_STATUS_UNSUCCESSFUL;
-
-        return NT_STATUS_OK;
-}
-
-
-/* 
-  samr_DeleteAliasMember 
+        }
+}
+
+
+/*
+  samr_DeleteAliasMember
 */
 static NTSTATUS dcesrv_samr_DeleteAliasMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2755 +2490 @@
         struct ldb_message *mod;
         const char *memberdn;
+        int ret;
 
         DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS);
@@ -2762 +2498 @@
 
         memberdn = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL,
-                                       "distinguishedName", "(objectSid=%s)", 
+                                       "distinguishedName", "(objectSid=%s)",
                                        ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid));
-
-        if (memberdn == NULL)
+        if (memberdn == NULL) {
                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+        }
 
         mod = ldb_msg_new(mem_ctx);
@@ -2775 +2511 @@
         mod->dn = talloc_reference(mem_ctx, a_state->account_dn);
 
-        if (samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod, "member",
-                                 memberdn) != 0)
+        ret = samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod, "member",
+                                                                 memberdn);
+        if (ret != LDB_SUCCESS) {
                 return NT_STATUS_UNSUCCESSFUL;
-
-        if (ldb_modify(a_state->sam_ctx, mod) != 0)
+        }
+
+        ret = ldb_modify(a_state->sam_ctx, mod);
+        switch (ret) {
+        case LDB_SUCCESS:
+                return NT_STATUS_OK;
+        case LDB_ERR_UNWILLING_TO_PERFORM:
+                return NT_STATUS_MEMBER_NOT_IN_GROUP;
+        case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
+                return NT_STATUS_ACCESS_DENIED;
+        default:
                 return NT_STATUS_UNSUCCESSFUL;
-
-        return NT_STATUS_OK;
-}
-
-
-/* 
-  samr_GetMembersInAlias 
+        }
+}
+
+
+/*
+  samr_GetMembersInAlias
 */
 static NTSTATUS dcesrv_samr_GetMembersInAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2795 +2540 @@
         struct samr_account_state *a_state;
         struct samr_domain_state *d_state;
-        struct ldb_message **msgs;
-        struct lsa_SidPtr *sids;
-        struct ldb_message_element *el;
-        const char * const attrs[2] = { "member", NULL};
-        int ret;
+        struct lsa_SidPtr *array;
+        unsigned int i, num_members;
+        struct dom_sid *members;
+        NTSTATUS status;
 
         DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS);
@@ -2806 +2550 @@
         d_state = a_state->domain_state;
 
-        ret = gendb_search_dn(d_state->sam_ctx, mem_ctx,
-                              a_state->account_dn, &msgs, attrs);
-
-        if (ret == -1) {
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        } else if (ret == 0) {
-                return NT_STATUS_OBJECT_NAME_NOT_FOUND;
-        } else if (ret != 1) {
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
-        r->out.sids->num_sids = 0;
-        r->out.sids->sids = NULL;
-
-        el = ldb_msg_find_element(msgs[0], "member");
-
-        if (el != NULL) {
-                int i;
-
-                sids = talloc_array(mem_ctx, struct lsa_SidPtr,
-                                      el->num_values);
-
-                if (sids == NULL)
-                        return NT_STATUS_NO_MEMORY;
-
-                for (i=0; i<el->num_values; i++) {
-                        struct ldb_message **msgs2;
-                        const char * const attrs2[2] = { "objectSid", NULL };
-                        ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
-                                              ldb_dn_from_ldb_val(mem_ctx, a_state->sam_ctx, &el->values[i]),
-                                              &msgs2, attrs2);
-                        if (ret != 1)
-                                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-
-                        sids[i].sid = samdb_result_dom_sid(mem_ctx, msgs2[0],
-                                                           "objectSid");
-
-                        if (sids[i].sid == NULL)
-                                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-                }
-                r->out.sids->num_sids = el->num_values;
-                r->out.sids->sids = sids;
-        }
-
-        return NT_STATUS_OK;
-}
-
-/* 
-  samr_OpenUser 
+        status = dsdb_enum_group_mem(d_state->sam_ctx, mem_ctx,
+                                     a_state->account_dn, &members,
+                                     &num_members);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        if (num_members == 0) {
+                r->out.sids->sids = NULL;
+
+                return NT_STATUS_OK;
+        }
+
+        array = talloc_array(mem_ctx, struct lsa_SidPtr, num_members);
+        if (array == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        for (i=0; i<num_members; i++) {
+                array[i].sid = &members[i];
+        }
+
+        r->out.sids->num_sids = num_members;
+        r->out.sids->sids = array;
+
+        return NT_STATUS_OK;
+}
+
+/*
+  samr_OpenUser
 */
 static NTSTATUS dcesrv_samr_OpenUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2884 +2609 @@
         ret = gendb_search(d_state->sam_ctx,
                            mem_ctx, d_state->domain_dn, &msgs, attrs,
-                           "(&(objectSid=%s)(objectclass=user))", 
+                           "(&(objectSid=%s)(objectclass=user))",
                            ldap_encode_ndr_dom_sid(mem_ctx, sid));
         if (ret == 0) {
@@ -2890 +2615 @@
         }
         if (ret != 1) {
-                DEBUG(0,("Found %d records matching sid %s\n", ret, 
+                DEBUG(0,("Found %d records matching sid %s\n", ret,
                          dom_sid_string(mem_ctx, sid)));
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
-        account_name = samdb_result_string(msgs[0], "sAMAccountName", NULL);
+        account_name = ldb_msg_find_attr_as_string(msgs[0], "sAMAccountName", NULL);
         if (account_name == NULL) {
-                DEBUG(0,("sAMAccountName field missing for sid %s\n", 
+                DEBUG(0,("sAMAccountName field missing for sid %s\n",
                          dom_sid_string(mem_ctx, sid)));
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -2931 +2656 @@
 
 
-/* 
-  samr_DeleteUser 
+/*
+  samr_DeleteUser
 */
 static NTSTATUS dcesrv_samr_DeleteUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -2948 +2673 @@
 
         ret = ldb_delete(a_state->sam_ctx, a_state->account_dn);
-        if (ret != 0) {
-                DEBUG(1, ("Failed to delete user: %s: %s\n", 
-                          ldb_dn_get_linearized(a_state->account_dn), 
+        if (ret != LDB_SUCCESS) {
+                DEBUG(1, ("Failed to delete user: %s: %s\n",
+                          ldb_dn_get_linearized(a_state->account_dn),
                           ldb_errstring(a_state->sam_ctx)));
                 return NT_STATUS_UNSUCCESSFUL;
         }
 
+        talloc_free(h);
         ZERO_STRUCTP(r->out.user_handle);
 
@@ -2961 +2687 @@
 
 
-/* 
-  samr_QueryUserInfo 
+/*
+  samr_QueryUserInfo
 */
 static NTSTATUS dcesrv_samr_QueryUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -3036 +2762 @@
         case 5:
         {
-                static const char * const attrs2[] = {"sAMAccountName", 
+                static const char * const attrs2[] = {"sAMAccountName",
                                                       "displayName",
                                                       "objectSid",
@@ -3042 +2768 @@
                                                       "homeDirectory",
                                                       "homeDrive",
-                                                      "scriptPath", 
+                                                      "scriptPath",
                                                       "profilePath",
                                                       "description",
@@ -3137 +2863 @@
                 attrs = attrs2;
                 break;
+        }
+        case 18:
+        {
+                return NT_STATUS_NOT_SUPPORTED;
         }
         case 20:
@@ -3173 +2903 @@
                 break;
         }
+        case 23:
+        case 24:
+        case 25:
+        case 26:
+        {
+                return NT_STATUS_NOT_SUPPORTED;
+        }
+        default:
+        {
+                return NT_STATUS_INVALID_INFO_CLASS;
+        }
         }
 
         /* pull all the user attributes */
         ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
-                              a_state->account_dn ,&res, attrs);
+                              a_state->account_dn, &res, attrs);
+        if (ret == 0) {
+                return NT_STATUS_NO_SUCH_USER;
+        }
         if (ret != 1) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -3321 +3065 @@
                 QUERY_UINT  (msg, info21.primary_gid,          "primaryGroupID");
                 QUERY_AFLAGS(msg, info21.acct_flags,           "userAccountControl");
-                info->info21.fields_present = 0x00FFFFFF;
+                info->info21.fields_present = 0x08FFFFFF;
                 QUERY_LHOURS(msg, info21.logon_hours,          "logonHours");
                 QUERY_UINT  (msg, info21.bad_password_count,   "badPwdCount");
                 QUERY_UINT  (msg, info21.logon_count,          "logonCount");
+                if ((info->info21.acct_flags & ACB_PW_EXPIRED) != 0) {
+                        info->info21.password_expired = PASS_MUST_CHANGE_AT_NEXT_LOGON;
+                } else {
+                        info->info21.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
+                }
                 QUERY_UINT  (msg, info21.country_code,         "countryCode");
                 QUERY_UINT  (msg, info21.code_page,            "codePage");
                 break;
-                
+
 
         default:
@@ -3341 +3090 @@
 
 
-/* 
-  samr_SetUserInfo 
+/*
+  samr_SetUserInfo
 */
 static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -3426 +3175 @@
                 break;
 
+        case 18:
+                status = samr_set_password_buffers(dce_call,
+                                                   a_state->sam_ctx,
+                                                   a_state->account_dn,
+                                                   a_state->domain_state->domain_dn,
+                                                   mem_ctx,
+                                                   r->in.info->info18.lm_pwd_active ? r->in.info->info18.lm_pwd.hash : NULL,
+                                                   r->in.info->info18.nt_pwd_active ? r->in.info->info18.nt_pwd.hash : NULL);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                if (r->in.info->info18.password_expired > 0) {
+                        struct ldb_message_element *set_el;
+                        if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, "pwdLastSet", 0) != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                        set_el = ldb_msg_find_element(msg, "pwdLastSet");
+                        set_el->flags = LDB_FLAG_MOD_REPLACE;
+                }
+                break;
+
         case 20:
                 SET_PARAMETERS(msg, info20.parameters,      "userParameters");
@@ -3431 +3202 @@
 
         case 21:
+                if (r->in.info->info21.fields_present == 0)
+                        return NT_STATUS_INVALID_PARAMETER;
+
 #define IFSET(bit) if (bit & r->in.info->info21.fields_present)
+                IFSET(SAMR_FIELD_LAST_LOGON)
+                        SET_UINT64(msg, info21.last_logon,     "lastLogon");
+                IFSET(SAMR_FIELD_LAST_LOGOFF)
+                        SET_UINT64(msg, info21.last_logoff,    "lastLogoff");
                 IFSET(SAMR_FIELD_ACCT_EXPIRY)
                         SET_UINT64(msg, info21.acct_expiry,    "accountExpires");
-                IFSET(SAMR_FIELD_ACCOUNT_NAME)         
+                IFSET(SAMR_FIELD_ACCOUNT_NAME)
                         SET_STRING(msg, info21.account_name,   "samAccountName");
-                IFSET(SAMR_FIELD_FULL_NAME) 
+                IFSET(SAMR_FIELD_FULL_NAME)
                         SET_STRING(msg, info21.full_name,      "displayName");
                 IFSET(SAMR_FIELD_HOME_DIRECTORY)
@@ -3452 +3230 @@
                 IFSET(SAMR_FIELD_COMMENT)
                         SET_STRING(msg, info21.comment,        "comment");
-                IFSET(SAMR_FIELD_PARAMETERS)   
+                IFSET(SAMR_FIELD_PARAMETERS)
                         SET_PARAMETERS(msg, info21.parameters, "userParameters");
                 IFSET(SAMR_FIELD_PRIMARY_GID)
@@ -3460 +3238 @@
                 IFSET(SAMR_FIELD_LOGON_HOURS)
                         SET_LHOURS(msg, info21.logon_hours,    "logonHours");
+                IFSET(SAMR_FIELD_BAD_PWD_COUNT)
+                        SET_UINT  (msg, info21.bad_password_count, "badPwdCount");
+                IFSET(SAMR_FIELD_NUM_LOGONS)
+                        SET_UINT  (msg, info21.logon_count,    "logonCount");
                 IFSET(SAMR_FIELD_COUNTRY_CODE)
                         SET_UINT  (msg, info21.country_code,   "countryCode");
                 IFSET(SAMR_FIELD_CODE_PAGE)
                         SET_UINT  (msg, info21.code_page,      "codePage");
+
+                /* password change fields */
+                IFSET(SAMR_FIELD_LAST_PWD_CHANGE)
+                        return NT_STATUS_ACCESS_DENIED;
+
+                IFSET((SAMR_FIELD_LM_PASSWORD_PRESENT
+                                        | SAMR_FIELD_NT_PASSWORD_PRESENT)) {
+                        uint8_t *lm_pwd_hash = NULL, *nt_pwd_hash = NULL;
+
+                        if (r->in.info->info21.lm_password_set) {
+                                if ((r->in.info->info21.lm_owf_password.length != 16)
+                                 || (r->in.info->info21.lm_owf_password.size != 16)) {
+                                        return NT_STATUS_INVALID_PARAMETER;
+                                }
+
+                                lm_pwd_hash = (uint8_t *) r->in.info->info21.lm_owf_password.array;
+                        }
+                        if (r->in.info->info21.nt_password_set) {
+                                if ((r->in.info->info21.nt_owf_password.length != 16)
+                                 || (r->in.info->info21.nt_owf_password.size != 16)) {
+                                        return NT_STATUS_INVALID_PARAMETER;
+                                }
+
+                                nt_pwd_hash = (uint8_t *) r->in.info->info21.nt_owf_password.array;
+                        }
+                        status = samr_set_password_buffers(dce_call,
+                                                           a_state->sam_ctx,
+                                                           a_state->account_dn,
+                                                           a_state->domain_state->domain_dn,
+                                                           mem_ctx,
+                                                           lm_pwd_hash,
+                                                           nt_pwd_hash);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
+                }
+
+
+                IFSET(SAMR_FIELD_EXPIRED_FLAG) {
+                        NTTIME t = 0;
+                        struct ldb_message_element *set_el;
+                        if (r->in.info->info21.password_expired
+                                        == PASS_DONT_CHANGE_AT_NEXT_LOGON) {
+                                unix_to_nt_time(&t, time(NULL));
+                        }
+                        if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg,
+                                                 "pwdLastSet", t) != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                        set_el = ldb_msg_find_element(msg, "pwdLastSet");
+                        set_el->flags = LDB_FLAG_MOD_REPLACE;
+                }
 #undef IFSET
                 break;
 
         case 23:
+                if (r->in.info->info23.info.fields_present == 0)
+                        return NT_STATUS_INVALID_PARAMETER;
+
 #define IFSET(bit) if (bit & r->in.info->info23.info.fields_present)
+                IFSET(SAMR_FIELD_LAST_LOGON)
+                        SET_UINT64(msg, info23.info.last_logon,     "lastLogon");
+                IFSET(SAMR_FIELD_LAST_LOGOFF)
+                        SET_UINT64(msg, info23.info.last_logoff,    "lastLogoff");
                 IFSET(SAMR_FIELD_ACCT_EXPIRY)
                         SET_UINT64(msg, info23.info.acct_expiry,    "accountExpires");
-                IFSET(SAMR_FIELD_ACCOUNT_NAME)         
+                IFSET(SAMR_FIELD_ACCOUNT_NAME)
                         SET_STRING(msg, info23.info.account_name,   "samAccountName");
                 IFSET(SAMR_FIELD_FULL_NAME)
@@ -3497 +3338 @@
                 IFSET(SAMR_FIELD_LOGON_HOURS)
                         SET_LHOURS(msg, info23.info.logon_hours,    "logonHours");
+                IFSET(SAMR_FIELD_BAD_PWD_COUNT)
+                        SET_UINT  (msg, info23.info.bad_password_count, "badPwdCount");
+                IFSET(SAMR_FIELD_NUM_LOGONS)
+                        SET_UINT  (msg, info23.info.logon_count,    "logonCount");
+
                 IFSET(SAMR_FIELD_COUNTRY_CODE)
                         SET_UINT  (msg, info23.info.country_code,   "countryCode");
                 IFSET(SAMR_FIELD_CODE_PAGE)
                         SET_UINT  (msg, info23.info.code_page,      "codePage");
+
+                /* password change fields */
+                IFSET(SAMR_FIELD_LAST_PWD_CHANGE)
+                        return NT_STATUS_ACCESS_DENIED;
 
                 IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) {
@@ -3507 +3357 @@
                                                    a_state->account_dn,
                                                    a_state->domain_state->domain_dn,
-                                                   mem_ctx, msg, 
+                                                   mem_ctx,
                                                    &r->in.info->info23.password);
                 } else IFSET(SAMR_FIELD_LM_PASSWORD_PRESENT) {
@@ -3514 +3364 @@
                                                    a_state->account_dn,
                                                    a_state->domain_state->domain_dn,
-                                                   mem_ctx, msg, 
+                                                   mem_ctx,
                                                    &r->in.info->info23.password);
+                }
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                IFSET(SAMR_FIELD_EXPIRED_FLAG) {
+                        NTTIME t = 0;
+                        struct ldb_message_element *set_el;
+                        if (r->in.info->info23.info.password_expired
+                                        == PASS_DONT_CHANGE_AT_NEXT_LOGON) {
+                                unix_to_nt_time(&t, time(NULL));
+                        }
+                        if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg,
+                                                 "pwdLastSet", t) != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                        set_el = ldb_msg_find_element(msg, "pwdLastSet");
+                        set_el->flags = LDB_FLAG_MOD_REPLACE;
                 }
 #undef IFSET
@@ -3526 +3394 @@
                                            a_state->account_dn,
                                            a_state->domain_state->domain_dn,
-                                           mem_ctx, msg, 
+                                           mem_ctx,
                                            &r->in.info->info24.password);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                if (r->in.info->info24.password_expired > 0) {
+                        struct ldb_message_element *set_el;
+                        if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, "pwdLastSet", 0) != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                        set_el = ldb_msg_find_element(msg, "pwdLastSet");
+                        set_el->flags = LDB_FLAG_MOD_REPLACE;
+                }
                 break;
 
         case 25:
+                if (r->in.info->info25.info.fields_present == 0)
+                        return NT_STATUS_INVALID_PARAMETER;
+
 #define IFSET(bit) if (bit & r->in.info->info25.info.fields_present)
+                IFSET(SAMR_FIELD_LAST_LOGON)
+                        SET_UINT64(msg, info25.info.last_logon,     "lastLogon");
+                IFSET(SAMR_FIELD_LAST_LOGOFF)
+                        SET_UINT64(msg, info25.info.last_logoff,    "lastLogoff");
                 IFSET(SAMR_FIELD_ACCT_EXPIRY)
                         SET_UINT64(msg, info25.info.acct_expiry,    "accountExpires");
-                IFSET(SAMR_FIELD_ACCOUNT_NAME)         
+                IFSET(SAMR_FIELD_ACCOUNT_NAME)
                         SET_STRING(msg, info25.info.account_name,   "samAccountName");
                 IFSET(SAMR_FIELD_FULL_NAME)
@@ -3560 +3447 @@
                 IFSET(SAMR_FIELD_LOGON_HOURS)
                         SET_LHOURS(msg, info25.info.logon_hours,    "logonHours");
+                IFSET(SAMR_FIELD_BAD_PWD_COUNT)
+                        SET_UINT  (msg, info25.info.bad_password_count, "badPwdCount");
+                IFSET(SAMR_FIELD_NUM_LOGONS)
+                        SET_UINT  (msg, info25.info.logon_count,    "logonCount");
                 IFSET(SAMR_FIELD_COUNTRY_CODE)
                         SET_UINT  (msg, info25.info.country_code,   "countryCode");
                 IFSET(SAMR_FIELD_CODE_PAGE)
                         SET_UINT  (msg, info25.info.code_page,      "codePage");
+
+                /* password change fields */
+                IFSET(SAMR_FIELD_LAST_PWD_CHANGE)
+                        return NT_STATUS_ACCESS_DENIED;
 
                 IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) {
@@ -3570 +3465 @@
                                                       a_state->account_dn,
                                                       a_state->domain_state->domain_dn,
-                                                      mem_ctx, msg, 
+                                                      mem_ctx,
                                                       &r->in.info->info25.password);
                 } else IFSET(SAMR_FIELD_LM_PASSWORD_PRESENT) {
@@ -3577 +3472 @@
                                                       a_state->account_dn,
                                                       a_state->domain_state->domain_dn,
-                                                      mem_ctx, msg, 
+                                                      mem_ctx,
                                                       &r->in.info->info25.password);
+                }
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                IFSET(SAMR_FIELD_EXPIRED_FLAG) {
+                        NTTIME t = 0;
+                        struct ldb_message_element *set_el;
+                        if (r->in.info->info25.info.password_expired
+                                        == PASS_DONT_CHANGE_AT_NEXT_LOGON) {
+                                unix_to_nt_time(&t, time(NULL));
+                        }
+                        if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg,
+                                                 "pwdLastSet", t) != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                        set_el = ldb_msg_find_element(msg, "pwdLastSet");
+                        set_el->flags = LDB_FLAG_MOD_REPLACE;
                 }
 #undef IFSET
@@ -3589 +3502 @@
                                               a_state->account_dn,
                                               a_state->domain_state->domain_dn,
-                                              mem_ctx, msg, 
+                                              mem_ctx,
                                               &r->in.info->info26.password);
-                break;
-                
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                if (r->in.info->info26.password_expired > 0) {
+                        struct ldb_message_element *set_el;
+                        if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, "pwdLastSet", 0) != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                        set_el = ldb_msg_find_element(msg, "pwdLastSet");
+                        set_el->flags = LDB_FLAG_MOD_REPLACE;
+                }
+                break;
 
         default:
@@ -3604 +3528 @@
 
         /* modify the samdb record */
-        ret = ldb_modify(a_state->sam_ctx, msg);
-        if (ret != 0) {
-                DEBUG(1,("Failed to modify record %s: %s\n",
-                         ldb_dn_get_linearized(a_state->account_dn),
-                         ldb_errstring(a_state->sam_ctx)));
-
-                /* we really need samdb.c to return NTSTATUS */
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        return NT_STATUS_OK;
-}
-
-
-/* 
-  samr_GetGroupsForUser 
+        if (msg->num_elements > 0) {
+                ret = ldb_modify(a_state->sam_ctx, msg);
+                if (ret != LDB_SUCCESS) {
+                        DEBUG(1,("Failed to modify record %s: %s\n",
+                                 ldb_dn_get_linearized(a_state->account_dn),
+                                 ldb_errstring(a_state->sam_ctx)));
+
+                        /* we really need samdb.c to return NTSTATUS */
+                        return NT_STATUS_UNSUCCESSFUL;
+                }
+        }
+
+        return NT_STATUS_OK;
+}
+
+
+/*
+  samr_GetGroupsForUser
 */
 static NTSTATUS dcesrv_samr_GetGroupsForUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -3640 +3566 @@
                                     d_state->domain_dn, &res,
                                     attrs, d_state->domain_sid,
-                                    "(&(member=%s)(grouptype=%d)(objectclass=group))",
+                                    "(&(member=%s)(|(grouptype=%d)(grouptype=%d))(objectclass=group))",
                                     ldb_dn_get_linearized(a_state->account_dn),
+                                    GTYPE_SECURITY_UNIVERSAL_GROUP,
                                     GTYPE_SECURITY_GLOBAL_GROUP);
         if (count < 0)
@@ -3672 +3599 @@
                 group_sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
                 if (group_sid == NULL) {
-                        DEBUG(0, ("Couldn't find objectSid attrib\n"));
-                        continue;
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
                 }
 
@@ -3689 +3615 @@
 
 
-/* 
-  samr_QueryDisplayInfo 
+/*
+  samr_QueryDisplayInfo
 */
 static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -3697 +3623 @@
         struct dcesrv_handle *h;
         struct samr_domain_state *d_state;
-        struct ldb_message **res;
-        int ldb_cnt, count, i;
+        struct ldb_result *res;
+        unsigned int i;
+        uint32_t count;
         const char * const attrs[] = { "objectSid", "sAMAccountName",
                 "displayName", "description", "userAccountControl",
@@ -3707 +3634 @@
         struct samr_DispEntryGeneral *entriesGeneral = NULL;
         const char *filter;
+        int ret;
 
         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
@@ -3716 +3644 @@
         case 4:
                 filter = talloc_asprintf(mem_ctx, "(&(objectclass=user)"
-                                         "(sAMAccountType=%u))",
+                                         "(sAMAccountType=%d))",
                                          ATYPE_NORMAL_ACCOUNT);
                 break;
         case 2:
                 filter = talloc_asprintf(mem_ctx, "(&(objectclass=user)"
-                                         "(sAMAccountType=%u))",
+                                         "(sAMAccountType=%d))",
                                          ATYPE_WORKSTATION_TRUST);
                 break;
         case 3:
         case 5:
-                filter = talloc_asprintf(mem_ctx, "(&(grouptype=%d)"
-                                         "(objectclass=group))",
+                filter = talloc_asprintf(mem_ctx,
+                                         "(&(|(groupType=%d)(groupType=%d))"
+                                         "(objectClass=group))",
+                                         GTYPE_SECURITY_UNIVERSAL_GROUP,
                                          GTYPE_SECURITY_GLOBAL_GROUP);
                 break;
@@ -3734 +3664 @@
         }
 
-        /* search for all requested objects in this domain. This could
+        /* search for all requested objects in all domains. This could
            possibly be cached and resumed based on resume_key */
-        ldb_cnt = samdb_search_domain(d_state->sam_ctx, mem_ctx,
-                                      d_state->domain_dn, &res, attrs,
-                                      d_state->domain_sid, "%s", filter);
-        if (ldb_cnt == -1) {
+        ret = dsdb_search(d_state->sam_ctx, mem_ctx, &res, NULL,
+                          LDB_SCOPE_SUBTREE, attrs, 0, "%s", filter);
+        if (ret != LDB_SUCCESS) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
-        if (ldb_cnt == 0 || r->in.max_entries == 0) {
+        if ((res->count == 0) || (r->in.max_entries == 0)) {
                 return NT_STATUS_OK;
         }
@@ -3749 +3678 @@
         case 1:
                 entriesGeneral = talloc_array(mem_ctx,
-                                             struct samr_DispEntryGeneral,
-                                             ldb_cnt);
+                                              struct samr_DispEntryGeneral,
+                                              res->count);
                 break;
         case 2:
                 entriesFull = talloc_array(mem_ctx,
-                                             struct samr_DispEntryFull,
-                                             ldb_cnt);
+                                           struct samr_DispEntryFull,
+                                           res->count);
                 break;
         case 3:
                 entriesFullGroup = talloc_array(mem_ctx,
-                                             struct samr_DispEntryFullGroup,
-                                             ldb_cnt);
+                                                struct samr_DispEntryFullGroup,
+                                                res->count);
                 break;
         case 4:
         case 5:
                 entriesAscii = talloc_array(mem_ctx,
-                                              struct samr_DispEntryAscii,
-                                              ldb_cnt);
+                                            struct samr_DispEntryAscii,
+                                            res->count);
                 break;
         }
@@ -3776 +3705 @@
         count = 0;
 
-        for (i=0; i<ldb_cnt; i++) {
+        for (i = 0; i < res->count; i++) {
                 struct dom_sid *objectsid;
 
-                objectsid = samdb_result_dom_sid(mem_ctx, res[i],
+                objectsid = samdb_result_dom_sid(mem_ctx, res->msgs[i],
                                                  "objectSid");
                 if (objectsid == NULL)
@@ -3787 +3716 @@
                 case 1:
                         entriesGeneral[count].idx = count + 1;
-                        entriesGeneral[count].rid = 
+                        entriesGeneral[count].rid =
                                 objectsid->sub_auths[objectsid->num_auths-1];
                         entriesGeneral[count].acct_flags =
-                                samdb_result_acct_flags(d_state->sam_ctx, mem_ctx,
-                                                        res[i], 
+                                samdb_result_acct_flags(d_state->sam_ctx,
+                                                        mem_ctx,
+                                                        res->msgs[i],
                                                         d_state->domain_dn);
                         entriesGeneral[count].account_name.string =
-                                samdb_result_string(res[i],
-                                                    "sAMAccountName", "");
+                                ldb_msg_find_attr_as_string(res->msgs[i],
+                                                            "sAMAccountName", "");
                         entriesGeneral[count].full_name.string =
-                                samdb_result_string(res[i], "displayName", "");
+                                ldb_msg_find_attr_as_string(res->msgs[i],
+                                                            "displayName", "");
                         entriesGeneral[count].description.string =
-                                samdb_result_string(res[i], "description", "");
+                                ldb_msg_find_attr_as_string(res->msgs[i],
+                                                            "description", "");
                         break;
                 case 2:
@@ -3808 +3740 @@
                         /* No idea why we need to or in ACB_NORMAL here, but this is what Win2k3 seems to do... */
                         entriesFull[count].acct_flags =
-                                samdb_result_acct_flags(d_state->sam_ctx, mem_ctx,
-                                                        res[i], 
+                                samdb_result_acct_flags(d_state->sam_ctx,
+                                                        mem_ctx,
+                                                        res->msgs[i],
                                                         d_state->domain_dn) | ACB_NORMAL;
                         entriesFull[count].account_name.string =
-                                samdb_result_string(res[i], "sAMAccountName",
-                                                    "");
+                                ldb_msg_find_attr_as_string(res->msgs[i],
+                                                            "sAMAccountName", "");
                         entriesFull[count].description.string =
-                                samdb_result_string(res[i], "description", "");
+                                ldb_msg_find_attr_as_string(res->msgs[i],
+                                                            "description", "");
                         break;
                 case 3:
@@ -3825 +3759 @@
                                 = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED;
                         entriesFullGroup[count].account_name.string =
-                                samdb_result_string(res[i], "sAMAccountName",
-                                                    "");
+                                ldb_msg_find_attr_as_string(res->msgs[i],
+                                                            "sAMAccountName", "");
                         entriesFullGroup[count].description.string =
-                                samdb_result_string(res[i], "description", "");
+                                ldb_msg_find_attr_as_string(res->msgs[i],
+                                                            "description", "");
                         break;
                 case 4:
@@ -3834 +3769 @@
                         entriesAscii[count].idx = count + 1;
                         entriesAscii[count].account_name.string =
-                                samdb_result_string(res[i], "sAMAccountName",
-                                                    "");
+                                ldb_msg_find_attr_as_string(res->msgs[i],
+                                                            "sAMAccountName", "");
                         break;
                 }
@@ -3905 +3840 @@
 
 
-/* 
-  samr_GetDisplayEnumerationIndex 
+/*
+  samr_GetDisplayEnumerationIndex
 */
 static NTSTATUS dcesrv_samr_GetDisplayEnumerationIndex(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -3915 +3850 @@
 
 
-/* 
-  samr_TestPrivateFunctionsDomain 
+/*
+  samr_TestPrivateFunctionsDomain
 */
 static NTSTATUS dcesrv_samr_TestPrivateFunctionsDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -3925 +3860 @@
 
 
-/* 
-  samr_TestPrivateFunctionsUser 
+/*
+  samr_TestPrivateFunctionsUser
 */
 static NTSTATUS dcesrv_samr_TestPrivateFunctionsUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -3935 +3870 @@
 
 
-/* 
-  samr_GetUserPwInfo 
+/*
+  samr_GetUserPwInfo
 */
 static NTSTATUS dcesrv_samr_GetUserPwInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -3960 +3895 @@
 
 
-/* 
-  samr_RemoveMemberFromForeignDomain 
-*/
-static NTSTATUS dcesrv_samr_RemoveMemberFromForeignDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct samr_RemoveMemberFromForeignDomain *r)
+/*
+  samr_RemoveMemberFromForeignDomain
+*/
+static NTSTATUS dcesrv_samr_RemoveMemberFromForeignDomain(struct dcesrv_call_state *dce_call,
+                                                          TALLOC_CTX *mem_ctx,
+                                                          struct samr_RemoveMemberFromForeignDomain *r)
 {
         struct dcesrv_handle *h;
@@ -3970 +3906 @@
         const char *memberdn;
         struct ldb_message **res;
-        const char * const attrs[3] = { "distinguishedName", "objectSid", NULL };
+        const char *no_attrs[] = { NULL };
         int i, count;
 
@@ -3978 +3914 @@
 
         memberdn = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL,
-                                       "distinguishedName", "(objectSid=%s)", 
+                                       "distinguishedName", "(objectSid=%s)",
                                        ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid));
         /* Nothing to do */
@@ -3985 +3921 @@
         }
 
-        /* TODO: Does this call only remove alias members, or does it do this
-         * for domain groups as well? */
-
         count = samdb_search_domain(d_state->sam_ctx, mem_ctx,
-                                    d_state->domain_dn, &res, attrs,
+                                    d_state->domain_dn, &res, no_attrs,
                                     d_state->domain_sid,
                                     "(&(member=%s)(objectClass=group)"
@@ -4008 +3941 @@
                 }
 
-                mod->dn = samdb_result_dn(d_state->sam_ctx, mod, res[i], "distinguishedName", NULL);
-                if (mod->dn == NULL) {
-                        talloc_free(mod);
-                        continue;
-                }
+                mod->dn = res[i]->dn;
 
                 if (samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod,
-                                         "member", memberdn) != 0)
+                                         "member", memberdn) != LDB_SUCCESS)
                         return NT_STATUS_NO_MEMORY;
 
-                if (ldb_modify(d_state->sam_ctx, mod) != 0)
+                if (ldb_modify(d_state->sam_ctx, mod) != LDB_SUCCESS)
                         return NT_STATUS_UNSUCCESSFUL;
 
@@ -4028 +3957 @@
 
 
-/* 
-  samr_QueryDomainInfo2 
+/*
+  samr_QueryDomainInfo2
 
   just an alias for samr_QueryDomainInfo
@@ -4045 +3974 @@
 
         status = dcesrv_samr_QueryDomainInfo(dce_call, mem_ctx, &r1);
-        
+
         return status;
 }
 
 
-/* 
-  samr_QueryUserInfo2 
+/*
+  samr_QueryUserInfo2
 
   just an alias for samr_QueryUserInfo
@@ -4064 +3993 @@
         r1.in.level  = r->in.level;
         r1.out.info  = r->out.info;
-        
+
         status = dcesrv_samr_QueryUserInfo(dce_call, mem_ctx, &r1);
 
@@ -4071 +4000 @@
 
 
-/* 
-  samr_QueryDisplayInfo2 
+/*
+  samr_QueryDisplayInfo2
 */
 static NTSTATUS dcesrv_samr_QueryDisplayInfo2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4095 +4024 @@
 
 
-/* 
-  samr_GetDisplayEnumerationIndex2 
+/*
+  samr_GetDisplayEnumerationIndex2
 */
 static NTSTATUS dcesrv_samr_GetDisplayEnumerationIndex2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4105 +4034 @@
 
 
-/* 
-  samr_QueryDisplayInfo3 
+/*
+  samr_QueryDisplayInfo3
 */
 static NTSTATUS dcesrv_samr_QueryDisplayInfo3(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4129 +4058 @@
 
 
-/* 
-  samr_AddMultipleMembersToAlias 
+/*
+  samr_AddMultipleMembersToAlias
 */
 static NTSTATUS dcesrv_samr_AddMultipleMembersToAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4139 +4068 @@
 
 
-/* 
-  samr_RemoveMultipleMembersFromAlias 
+/*
+  samr_RemoveMultipleMembersFromAlias
 */
 static NTSTATUS dcesrv_samr_RemoveMultipleMembersFromAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4149 +4078 @@
 
 
-/* 
-  samr_GetDomPwInfo 
+/*
+  samr_GetDomPwInfo
 
   this fetches the default password properties for a domain
 
-  note that w2k3 completely ignores the domain name in this call, and 
+  note that w2k3 completely ignores the domain name in this call, and
   always returns the information for the servers primary domain
 */
@@ -4167 +4096 @@
         ZERO_STRUCTP(r->out.info);
 
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info); 
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
+                                         dce_call->conn->dce_ctx->lp_ctx,
+                                         dce_call->conn->auth_state.session_info, 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
@@ -4173 +4104 @@
 
         /* The domain name in this call is ignored */
-        ret = gendb_search_dn(sam_ctx, 
+        ret = gendb_search_dn(sam_ctx,
                            mem_ctx, NULL, &msgs, attrs);
         if (ret <= 0) {
+                talloc_free(sam_ctx);
+
                 return NT_STATUS_NO_SUCH_DOMAIN;
         }
         if (ret > 1) {
                 talloc_free(msgs);
+                talloc_free(sam_ctx);
+
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
         }
 
-        r->out.info->min_password_length = samdb_result_uint(msgs[0],
+        r->out.info->min_password_length = ldb_msg_find_attr_as_uint(msgs[0],
                 "minPwdLength", 0);
-        r->out.info->password_properties = samdb_result_uint(msgs[0],
+        r->out.info->password_properties = ldb_msg_find_attr_as_uint(msgs[0],
                 "pwdProperties", 1);
 
         talloc_free(msgs);
-
-        talloc_free(sam_ctx);
-        return NT_STATUS_OK;
-}
-
-
-/* 
-  samr_Connect2 
+        talloc_unlink(mem_ctx, sam_ctx);
+
+        return NT_STATUS_OK;
+}
+
+
+/*
+  samr_Connect2
 */
 static NTSTATUS dcesrv_samr_Connect2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4211 +4146 @@
 
 
-/* 
-  samr_SetUserInfo2 
+/*
+  samr_SetUserInfo2
 
   just an alias for samr_SetUserInfo
@@ -4229 +4164 @@
 
 
-/* 
-  samr_SetBootKeyInformation 
+/*
+  samr_SetBootKeyInformation
 */
 static NTSTATUS dcesrv_samr_SetBootKeyInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4239 +4174 @@
 
 
-/* 
-  samr_GetBootKeyInformation 
+/*
+  samr_GetBootKeyInformation
 */
 static NTSTATUS dcesrv_samr_GetBootKeyInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                        struct samr_GetBootKeyInformation *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/* 
-  samr_Connect3 
+        /* Windows Server 2008 returns this */
+        return NT_STATUS_NOT_SUPPORTED;
+}
+
+
+/*
+  samr_Connect3
 */
 static NTSTATUS dcesrv_samr_Connect3(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4265 +4201 @@
 
 
-/* 
-  samr_Connect4 
+/*
+  samr_Connect4
 */
 static NTSTATUS dcesrv_samr_Connect4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4281 +4217 @@
 
 
-/* 
-  samr_Connect5 
+/*
+  samr_Connect5
 */
 static NTSTATUS dcesrv_samr_Connect5(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4304 +4240 @@
 
 
-/* 
-  samr_RidToSid 
+/*
+  samr_RidToSid
 */
 static NTSTATUS dcesrv_samr_RidToSid(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4327 +4263 @@
 
 
-/* 
-  samr_SetDsrmPassword 
+/*
+  samr_SetDsrmPassword
 */
 static NTSTATUS dcesrv_samr_SetDsrmPassword(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -4337 +4273 @@
 
 
-/* 
-  samr_ValidatePassword 
-*/
-static NTSTATUS dcesrv_samr_ValidatePassword(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                                      struct samr_ValidatePassword *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+/*
+  samr_ValidatePassword
+
+  For now the call checks the password complexity (if active) and the minimum
+  password length on level 2 and 3. Level 1 is ignored for now.
+*/
+static NTSTATUS dcesrv_samr_ValidatePassword(struct dcesrv_call_state *dce_call,
+                                             TALLOC_CTX *mem_ctx,
+                                             struct samr_ValidatePassword *r)
+{
+        struct samr_GetDomPwInfo r2;
+        struct samr_PwInfo pwInfo;
+        DATA_BLOB password;
+        enum samr_ValidationStatus res;
+        NTSTATUS status;
+
+        (*r->out.rep) = talloc_zero(mem_ctx, union samr_ValidatePasswordRep);
+
+        r2.in.domain_name = NULL;
+        r2.out.info = &pwInfo;
+        status = dcesrv_samr_GetDomPwInfo(dce_call, mem_ctx, &r2);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        switch (r->in.level) {
+        case NetValidateAuthentication:
+                /* we don't support this yet */
+                return NT_STATUS_NOT_SUPPORTED;
+        break;
+        case NetValidatePasswordChange:
+                password = data_blob_const(r->in.req->req2.password.string,
+                                           r->in.req->req2.password.length);
+                res = samdb_check_password(&password,
+                                           pwInfo.password_properties,
+                                           pwInfo.min_password_length);
+                (*r->out.rep)->ctr2.status = res;
+        break;
+        case NetValidatePasswordReset:
+                password = data_blob_const(r->in.req->req3.password.string,
+                                           r->in.req->req3.password.length);
+                res = samdb_check_password(&password,
+                                           pwInfo.password_properties,
+                                           pwInfo.min_password_length);
+                (*r->out.rep)->ctr3.status = res;
+        break;
+        default:
+                return NT_STATUS_INVALID_INFO_CLASS;
+        break;
+        }
+
+        return NT_STATUS_OK;
 }
 

trunk/server/source4/rpc_server/samr/dcesrv_samr.h

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -5 +5 @@
 
    Copyright (C) Andrew Tridgell 2004
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.

trunk/server/source4/rpc_server/samr/samr_password.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -6 +6 @@
    Copyright (C) Andrew Tridgell 2004
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -31 +31 @@
 #include "../lib/util/util_ldb.h"
 
-/* 
-  samr_ChangePasswordUser 
-*/
-NTSTATUS dcesrv_samr_ChangePasswordUser(struct dcesrv_call_state *dce_call, 
+/*
+  samr_ChangePasswordUser
+*/
+NTSTATUS dcesrv_samr_ChangePasswordUser(struct dcesrv_call_state *dce_call,
                                         TALLOC_CTX *mem_ctx,
                                         struct samr_ChangePasswordUser *r)
@@ -41 +41 @@
         struct samr_account_state *a_state;
         struct ldb_context *sam_ctx;
-        struct ldb_message **res, *msg;
+        struct ldb_message **res;
         int ret;
         struct samr_Password new_lmPwdHash, new_ntPwdHash, checkHash;
@@ -61 +61 @@
         }
 
-        /* To change a password we need to open as system */
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+        /* Connect to a SAMDB with system privileges for fetching the old pw
+         * hashes. */
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
+                                dce_call->conn->dce_ctx->lp_ctx,
+                                system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
-        }
-
-        ret = ldb_transaction_start(sam_ctx);
-        if (ret) {
-                DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
-                return NT_STATUS_TRANSACTION_ABORTED;
         }
 
@@ -77 +74 @@
                               a_state->account_dn, &res, attrs);
         if (ret != 1) {
-                ldb_transaction_cancel(sam_ctx);
-                return NT_STATUS_WRONG_PASSWORD;
-        }
-        msg = res[0];
-
-        status = samdb_result_passwords(mem_ctx, dce_call->conn->dce_ctx->lp_ctx,
-                                        msg, &lm_pwd, &nt_pwd);
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
+        status = samdb_result_passwords(mem_ctx,
+                                        dce_call->conn->dce_ctx->lp_ctx,
+                                        res[0], &lm_pwd, &nt_pwd);
         if (!NT_STATUS_IS_OK(status) || !nt_pwd) {
-                ldb_transaction_cancel(sam_ctx);
                 return NT_STATUS_WRONG_PASSWORD;
         }
@@ -94 +89 @@
                 D_P16(new_lmPwdHash.hash, r->in.old_lm_crypted->hash, checkHash.hash);
                 if (memcmp(checkHash.hash, lm_pwd, 16) != 0) {
-                        ldb_transaction_cancel(sam_ctx);
                         return NT_STATUS_WRONG_PASSWORD;
                 }
@@ -103 +97 @@
         D_P16(new_ntPwdHash.hash, r->in.old_nt_crypted->hash, checkHash.hash);
         if (memcmp(checkHash.hash, nt_pwd, 16) != 0) {
-                ldb_transaction_cancel(sam_ctx);
-                return NT_STATUS_WRONG_PASSWORD;
-        }
-        
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
         /* The NT Cross is not required by Win2k3 R2, but if present
            check the nt cross hash */
@@ -112 +105 @@
                 D_P16(lm_pwd->hash, r->in.nt_cross->hash, checkHash.hash);
                 if (memcmp(checkHash.hash, new_ntPwdHash.hash, 16) != 0) {
-                        ldb_transaction_cancel(sam_ctx);
                         return NT_STATUS_WRONG_PASSWORD;
                 }
@@ -122 +114 @@
                 D_P16(nt_pwd->hash, r->in.lm_cross->hash, checkHash.hash);
                 if (memcmp(checkHash.hash, new_lmPwdHash.hash, 16) != 0) {
-                        ldb_transaction_cancel(sam_ctx);
                         return NT_STATUS_WRONG_PASSWORD;
                 }
         }
 
-        msg = ldb_msg_new(mem_ctx);
-        if (msg == NULL) {
-                ldb_transaction_cancel(sam_ctx);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        msg->dn = ldb_dn_copy(msg, a_state->account_dn);
-        if (!msg->dn) {
-                ldb_transaction_cancel(sam_ctx);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* setup password modify mods on the user DN specified.  This may fail
-         * due to password policies.  */
+        /* Start a SAM with user privileges for the password change */
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
+                                dce_call->conn->dce_ctx->lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return NT_STATUS_INVALID_SYSTEM_SERVICE;
+        }
+
+        /* Start transaction */
+        ret = ldb_transaction_start(sam_ctx);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
+                return NT_STATUS_TRANSACTION_ABORTED;
+        }
+
+        /* Performs the password modification. We pass the old hashes read out
+         * from the database since they were already checked against the user-
+         * provided ones. */
         status = samdb_set_password(sam_ctx, mem_ctx,
-                                    a_state->account_dn, a_state->domain_state->domain_dn,
-                                    msg, NULL, &new_lmPwdHash, &new_ntPwdHash, 
-                                    true, /* this is a user password change */
+                                    a_state->account_dn,
+                                    a_state->domain_state->domain_dn,
+                                    NULL, &new_lmPwdHash, &new_ntPwdHash,
+                                    lm_pwd, nt_pwd, /* this is a user password change */
                                     NULL,
                                     NULL);
@@ -152 +148 @@
         }
 
-        /* The above call only setup the modifications, this actually
-         * makes the write to the database. */
-        ret = samdb_replace(sam_ctx, mem_ctx, msg);
-        if (ret != 0) {
-                DEBUG(2,("Failed to modify record to change password on %s: %s\n",
-                         ldb_dn_get_linearized(a_state->account_dn),
-                         ldb_errstring(sam_ctx)));
-                ldb_transaction_cancel(sam_ctx);
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
         /* And this confirms it in a transaction commit */
         ret = ldb_transaction_commit(sam_ctx);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 DEBUG(1,("Failed to commit transaction to change password on %s: %s\n",
                          ldb_dn_get_linearized(a_state->account_dn),
@@ -175 +160 @@
 }
 
-/* 
-  samr_OemChangePasswordUser2 
-*/
-NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                                     struct samr_OemChangePasswordUser2 *r)
+/*
+  samr_OemChangePasswordUser2
+*/
+NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call,
+                                            TALLOC_CTX *mem_ctx,
+                                            struct samr_OemChangePasswordUser2 *r)
 {
         NTSTATUS status;
@@ -188 +174 @@
         struct ldb_dn *user_dn;
         int ret;
-        struct ldb_message **res, *mod;
+        struct ldb_message **res;
         const char * const attrs[] = { "objectSid", "dBCSPwd", NULL };
         struct samr_Password *lm_pwd;
@@ -205 +191 @@
 
         /* this call can only work with lanman auth */
-        if (!lp_lanman_auth(dce_call->conn->dce_ctx->lp_ctx)) {
-                return NT_STATUS_NOT_SUPPORTED;
-        }
-
-        /* To change a password we need to open as system */
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+        if (!lpcfg_lanman_auth(dce_call->conn->dce_ctx->lp_ctx)) {
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
+        /* Connect to a SAMDB with system privileges for fetching the old pw
+         * hashes. */
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
+                                dce_call->conn->dce_ctx->lp_ctx,
+                                system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
-        }
-
-        ret = ldb_transaction_start(sam_ctx);
-        if (ret) {
-                DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
-                return NT_STATUS_TRANSACTION_ABORTED;
         }
 
@@ -224 +207 @@
            user SID). We also need the current lm password hash in
            order to decrypt the incoming password */
-        ret = gendb_search(sam_ctx, 
+        ret = gendb_search(sam_ctx,
                            mem_ctx, NULL, &res, attrs,
                            "(&(sAMAccountName=%s)(objectclass=user))",
                            r->in.account->string);
         if (ret != 1) {
-                ldb_transaction_cancel(sam_ctx);
                 /* Don't give the game away:  (don't allow anonymous users to prove the existance of usernames) */
                 return NT_STATUS_WRONG_PASSWORD;
@@ -239 +221 @@
                                         res[0], &lm_pwd, NULL);
         if (!NT_STATUS_IS_OK(status) || !lm_pwd) {
-                ldb_transaction_cancel(sam_ctx);
                 return NT_STATUS_WRONG_PASSWORD;
         }
 
         /* decrypt the password we have been given */
-        lm_pwd_blob = data_blob(lm_pwd->hash, sizeof(lm_pwd->hash)); 
+        lm_pwd_blob = data_blob(lm_pwd->hash, sizeof(lm_pwd->hash));
         arcfour_crypt_blob(pwbuf->data, 516, &lm_pwd_blob);
         data_blob_free(&lm_pwd_blob);
-        
+
         if (!extract_pw_from_buffer(mem_ctx, pwbuf->data, &new_password)) {
-                ldb_transaction_cancel(sam_ctx);
                 DEBUG(3,("samr: failed to decode password buffer\n"));
                 return NT_STATUS_WRONG_PASSWORD;
         }
-                
-        if (!convert_string_talloc_convenience(mem_ctx, lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx), 
-                                  CH_DOS, CH_UNIX, 
-                                  (const char *)new_password.data, 
+
+        if (!convert_string_talloc_convenience(mem_ctx, lpcfg_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx),
+                                  CH_DOS, CH_UNIX,
+                                  (const char *)new_password.data,
                                   new_password.length,
                                   (void **)&new_pass, NULL, false)) {
                 DEBUG(3,("samr: failed to convert incoming password buffer to unix charset\n"));
-                ldb_transaction_cancel(sam_ctx);
-                return NT_STATUS_WRONG_PASSWORD;
-        }
-
-        if (!convert_string_talloc_convenience(mem_ctx, lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx), 
-                                               CH_DOS, CH_UTF16, 
-                                               (const char *)new_password.data, 
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
+        if (!convert_string_talloc_convenience(mem_ctx, lpcfg_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx),
+                                               CH_DOS, CH_UTF16,
+                                               (const char *)new_password.data,
                                                new_password.length,
                                                (void **)&new_unicode_password.data, &unicode_pw_len, false)) {
                 DEBUG(3,("samr: failed to convert incoming password buffer to UTF16 charset\n"));
-                ldb_transaction_cancel(sam_ctx);
                 return NT_STATUS_WRONG_PASSWORD;
         }
@@ -278 +256 @@
         E_old_pw_hash(new_lm_hash, lm_pwd->hash, lm_verifier.hash);
         if (memcmp(lm_verifier.hash, r->in.hash->hash, 16) != 0) {
-                ldb_transaction_cancel(sam_ctx);
-                return NT_STATUS_WRONG_PASSWORD;
-        }
-
-        mod = ldb_msg_new(mem_ctx);
-        if (mod == NULL) {
-                ldb_transaction_cancel(sam_ctx);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        mod->dn = ldb_dn_copy(mod, user_dn);
-        if (!mod->dn) {
-                ldb_transaction_cancel(sam_ctx);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* set the password on the user DN specified.  This may fail
-         * due to password policies */
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
+        /* Connect to a SAMDB with user privileges for the password change */
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
+                                dce_call->conn->dce_ctx->lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return NT_STATUS_INVALID_SYSTEM_SERVICE;
+        }
+
+        /* Start transaction */
+        ret = ldb_transaction_start(sam_ctx);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
+                return NT_STATUS_TRANSACTION_ABORTED;
+        }
+
+        /* Performs the password modification. We pass the old hashes read out
+         * from the database since they were already checked against the user-
+         * provided ones. */
         status = samdb_set_password(sam_ctx, mem_ctx,
-                                    user_dn, NULL, 
-                                    mod, &new_unicode_password, 
+                                    user_dn, NULL,
+                                    &new_unicode_password,
                                     NULL, NULL,
-                                    true, /* this is a user password change */
-                                    NULL, 
+                                    lm_pwd, NULL, /* this is a user password change */
+                                    NULL,
                                     NULL);
         if (!NT_STATUS_IS_OK(status)) {
@@ -308 +289 @@
         }
 
-        /* The above call only setup the modifications, this actually
-         * makes the write to the database. */
-        ret = samdb_replace(sam_ctx, mem_ctx, mod);
-        if (ret != 0) {
-                DEBUG(2,("Failed to modify record to change password on %s: %s\n",
-                         ldb_dn_get_linearized(user_dn),
-                         ldb_errstring(sam_ctx)));
-                ldb_transaction_cancel(sam_ctx);
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
         /* And this confirms it in a transaction commit */
         ret = ldb_transaction_commit(sam_ctx);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 DEBUG(1,("Failed to commit transaction to change password on %s: %s\n",
                          ldb_dn_get_linearized(user_dn),
@@ -332 +302 @@
 
 
-/* 
-  samr_ChangePasswordUser3 
-*/
-NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, 
-                                  TALLOC_CTX *mem_ctx,
-                                  struct samr_ChangePasswordUser3 *r)
-{       
+/*
+  samr_ChangePasswordUser3
+*/
+NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
+                                         TALLOC_CTX *mem_ctx,
+                                         struct samr_ChangePasswordUser3 *r)
+{
         NTSTATUS status;
         DATA_BLOB new_password;
@@ -344 +314 @@
         struct ldb_dn *user_dn;
         int ret;
-        struct ldb_message **res, *mod;
+        struct ldb_message **res;
         const char * const attrs[] = { "unicodePwd", "dBCSPwd", NULL };
         struct samr_Password *nt_pwd, *lm_pwd;
         DATA_BLOB nt_pwd_blob;
         struct samr_DomInfo1 *dominfo = NULL;
-        struct samr_ChangeReject *reject = NULL;
-        enum samr_RejectReason reason = SAMR_REJECT_OTHER;
+        struct userPwdChangeFailureInformation *reject = NULL;
+        enum samPwdChangeReason reason = SAM_PWD_CHANGE_NO_ERROR;
         uint8_t new_nt_hash[16], new_lm_hash[16];
         struct samr_Password nt_verifier, lm_verifier;
@@ -362 +332 @@
         }
 
-        /* To change a password we need to open as system */
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+        /* Connect to a SAMDB with system privileges for fetching the old pw
+         * hashes. */
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
+                                dce_call->conn->dce_ctx->lp_ctx,
+                                system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
-        }
-
-        ret = ldb_transaction_start(sam_ctx);
-        if (ret) {
-                talloc_free(sam_ctx);
-                DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
-                return NT_STATUS_TRANSACTION_ABORTED;
         }
 
@@ -378 +344 @@
            user SID). We also need the current lm and nt password hashes
            in order to decrypt the incoming passwords */
-        ret = gendb_search(sam_ctx, 
+        ret = gendb_search(sam_ctx,
                            mem_ctx, NULL, &res, attrs,
                            "(&(sAMAccountName=%s)(objectclass=user))",
@@ -390 +356 @@
         user_dn = res[0]->dn;
 
-        status = samdb_result_passwords(mem_ctx, dce_call->conn->dce_ctx->lp_ctx, 
+        status = samdb_result_passwords(mem_ctx, dce_call->conn->dce_ctx->lp_ctx,
                                         res[0], &lm_pwd, &nt_pwd);
         if (!NT_STATUS_IS_OK(status) ) {
@@ -407 +373 @@
 
         if (!extract_pw_from_buffer(mem_ctx, r->in.nt_password->data, &new_password)) {
-                ldb_transaction_cancel(sam_ctx);
                 DEBUG(3,("samr: failed to decode password buffer\n"));
-                return NT_STATUS_WRONG_PASSWORD;
-        }
-                
+                status =  NT_STATUS_WRONG_PASSWORD;
+                goto failed;
+        }
+
         if (r->in.nt_verifier == NULL) {
                 status = NT_STATUS_WRONG_PASSWORD;
@@ -431 +397 @@
         if (lm_pwd && r->in.lm_verifier != NULL) {
                 char *new_pass;
-                if (!convert_string_talloc_convenience(mem_ctx, lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx), 
-                                          CH_UTF16, CH_UNIX, 
-                                          (const char *)new_password.data, 
+                if (!convert_string_talloc_convenience(mem_ctx, lpcfg_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx),
+                                          CH_UTF16, CH_UNIX,
+                                          (const char *)new_password.data,
                                           new_password.length,
                                           (void **)&new_pass, NULL, false)) {
@@ -445 +411 @@
         }
 
-        mod = ldb_msg_new(mem_ctx);
-        if (mod == NULL) {
-                status = NT_STATUS_NO_MEMORY;
-                goto failed;
-        }
-
-        mod->dn = ldb_dn_copy(mod, user_dn);
-        if (!mod->dn) {
-                status = NT_STATUS_NO_MEMORY;
-                goto failed;
-        }
-
-        /* set the password on the user DN specified.  This may fail
-         * due to password policies */
+        /* Connect to a SAMDB with user privileges for the password change */
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
+                                dce_call->conn->dce_ctx->lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return NT_STATUS_INVALID_SYSTEM_SERVICE;
+        }
+
+        ret = ldb_transaction_start(sam_ctx);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
+                return NT_STATUS_TRANSACTION_ABORTED;
+        }
+
+        /* Performs the password modification. We pass the old hashes read out
+         * from the database since they were already checked against the user-
+         * provided ones. */
         status = samdb_set_password(sam_ctx, mem_ctx,
-                                    user_dn, NULL, 
-                                    mod, &new_password, 
+                                    user_dn, NULL,
+                                    &new_password,
                                     NULL, NULL,
-                                    true, /* this is a user password change */
-                                    &reason, 
+                                    lm_pwd, nt_pwd, /* this is a user password change */
+                                    &reason,
                                     &dominfo);
+
         if (!NT_STATUS_IS_OK(status)) {
-                goto failed;
-        }
-
-        /* The above call only setup the modifications, this actually
-         * makes the write to the database. */
-        ret = samdb_replace(sam_ctx, mem_ctx, mod);
-        if (ret != 0) {
-                DEBUG(2,("samdb_replace failed to change password for %s: %s\n",
-                         ldb_dn_get_linearized(user_dn),
-                         ldb_errstring(sam_ctx)));
-                status = NT_STATUS_UNSUCCESSFUL;
+                ldb_transaction_cancel(sam_ctx);
                 goto failed;
         }
@@ -483 +443 @@
         /* And this confirms it in a transaction commit */
         ret = ldb_transaction_commit(sam_ctx);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 DEBUG(1,("Failed to commit transaction to change password on %s: %s\n",
                          ldb_dn_get_linearized(user_dn),
@@ -494 +454 @@
 
 failed:
-        ldb_transaction_cancel(sam_ctx);
-        talloc_free(sam_ctx);
-
-        reject = talloc(mem_ctx, struct samr_ChangeReject);
+        reject = talloc_zero(mem_ctx, struct userPwdChangeFailureInformation);
+        if (reject != NULL) {
+                reject->extendedFailureReason = reason;
+
+                *r->out.reject = reject;
+        }
+
         *r->out.dominfo = dominfo;
-        *r->out.reject = reject;
-
-        if (reject == NULL) {
-                return status;
-        }
-        ZERO_STRUCTP(reject);
-
-        reject->reason = reason;
 
         return status;
@@ -512 +467 @@
 
 
-/* 
-  samr_ChangePasswordUser2 
+/*
+  samr_ChangePasswordUser2
 
   easy - just a subset of samr_ChangePasswordUser3
 */
-NTSTATUS dcesrv_samr_ChangePasswordUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                                  struct samr_ChangePasswordUser2 *r)
+NTSTATUS dcesrv_samr_ChangePasswordUser2(struct dcesrv_call_state *dce_call,
+                                         TALLOC_CTX *mem_ctx,
+                                         struct samr_ChangePasswordUser2 *r)
 {
         struct samr_ChangePasswordUser3 r2;
         struct samr_DomInfo1 *dominfo = NULL;
-        struct samr_ChangeReject *reject = NULL;
+        struct userPwdChangeFailureInformation *reject = NULL;
 
         r2.in.server = r->in.server;
@@ -541 +497 @@
 /*
   set password via a samr_CryptPassword buffer
-  this will in the 'msg' with modify operations that will update the user
-  password when applied
 */
 NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call,
-                           void *sam_ctx,
+                           struct ldb_context *sam_ctx,
                            struct ldb_dn *account_dn, struct ldb_dn *domain_dn,
                            TALLOC_CTX *mem_ctx,
-                           struct ldb_message *msg, 
                            struct samr_CryptPassword *pwbuf)
 {
@@ -566 +519 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-                
+
         /* set the password - samdb needs to know both the domain and user DNs,
            so the domain password policy can be used */
         return samdb_set_password(sam_ctx, mem_ctx,
-                                  account_dn, domain_dn, 
-                                  msg, &new_password, 
+                                  account_dn, domain_dn,
+                                  &new_password,
                                   NULL, NULL,
-                                  false, /* This is a password set, not change */
+                                  NULL, NULL, /* This is a password set, not change */
                                   NULL, NULL);
 }
@@ -580 +533 @@
 /*
   set password via a samr_CryptPasswordEx buffer
-  this will in the 'msg' with modify operations that will update the user
-  password when applied
 */
 NTSTATUS samr_set_password_ex(struct dcesrv_call_state *dce_call,
                               struct ldb_context *sam_ctx,
-                              struct ldb_dn *account_dn, struct ldb_dn *domain_dn,
+                              struct ldb_dn *account_dn,
+                              struct ldb_dn *domain_dn,
                               TALLOC_CTX *mem_ctx,
-                              struct ldb_message *msg, 
                               struct samr_CryptPasswordEx *pwbuf)
 {
@@ -610 +561 @@
         MD5Update(&ctx, session_key.data, session_key.length);
         MD5Final(co_session_key.data, &ctx);
-        
+
         arcfour_crypt_blob(pwbuf->data, 516, &co_session_key);
 
@@ -617 +568 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-                
+
         /* set the password - samdb needs to know both the domain and user DNs,
            so the domain password policy can be used */
         return samdb_set_password(sam_ctx, mem_ctx,
-                                  account_dn, domain_dn, 
-                                  msg, &new_password, 
+                                  account_dn, domain_dn,
+                                  &new_password,
                                   NULL, NULL,
-                                  false, /* This is a password set, not change */
+                                  NULL, NULL, /* This is a password set, not change */
                                   NULL, NULL);
 }
 
-
+/*
+  set password via encrypted NT and LM hash buffers
+*/
+NTSTATUS samr_set_password_buffers(struct dcesrv_call_state *dce_call,
+                                   struct ldb_context *sam_ctx,
+                                   struct ldb_dn *account_dn,
+                                   struct ldb_dn *domain_dn,
+                                   TALLOC_CTX *mem_ctx,
+                                   const uint8_t *lm_pwd_hash,
+                                   const uint8_t *nt_pwd_hash)
+{
+        struct samr_Password *d_lm_pwd_hash = NULL, *d_nt_pwd_hash = NULL;
+        DATA_BLOB session_key = data_blob(NULL, 0);
+        DATA_BLOB in, out;
+        NTSTATUS nt_status = NT_STATUS_OK;
+
+        nt_status = dcesrv_fetch_session_key(dce_call->conn, &session_key);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        if (lm_pwd_hash != NULL) {
+                in = data_blob_const(lm_pwd_hash, 16);
+                out = data_blob_talloc_zero(mem_ctx, 16);
+
+                sess_crypt_blob(&out, &in, &session_key, false);
+
+                d_lm_pwd_hash = (struct samr_Password *) out.data;
+        }
+        if (nt_pwd_hash != NULL) {
+                in = data_blob_const(nt_pwd_hash, 16);
+                out = data_blob_talloc_zero(mem_ctx, 16);
+
+                sess_crypt_blob(&out, &in, &session_key, false);
+
+                d_nt_pwd_hash = (struct samr_Password *) out.data;
+        }
+
+        if ((d_lm_pwd_hash != NULL) || (d_nt_pwd_hash != NULL)) {
+                nt_status = samdb_set_password(sam_ctx, mem_ctx, account_dn,
+                                               domain_dn, NULL,
+                                               d_lm_pwd_hash, d_nt_pwd_hash,
+                                               NULL, NULL, /* this is a password set */
+                                               NULL, NULL);
+        }
+
+        return nt_status;
+}

trunk/server/source4/rpc_server/service_rpc.c

@@ -28 +28 @@
 #include "rpc_server/dcerpc_server.h"
 #include "rpc_server/dcerpc_server_proto.h"
-#include "smbd/service.h"
 #include "system/filesys.h"
-#include "lib/socket/socket.h"
 #include "lib/messaging/irpc.h"
 #include "system/network.h"
@@ -42 +40 @@
 #include "smbd/process_model.h"
 
-struct dcesrv_socket_context {
-        const struct dcesrv_endpoint *endpoint;
-        struct dcesrv_context *dcesrv_ctx;
-};
-
-static void dcesrv_terminate_connection(struct dcesrv_connection *dce_conn, const char *reason)
-{
-        struct stream_connection *srv_conn;
-        srv_conn = talloc_get_type(dce_conn->transport.private_data,
-                                   struct stream_connection);
-
-        stream_terminate_connection(srv_conn, reason);
-}
-
-static void dcesrv_sock_reply_done(struct tevent_req *subreq);
-
-struct dcesrv_sock_reply_state {
-        struct dcesrv_connection *dce_conn;
-        struct dcesrv_call_state *call;
-        struct iovec iov;
-};
-
-static void dcesrv_sock_report_output_data(struct dcesrv_connection *dce_conn)
-{
-        struct dcesrv_call_state *call;
-
-        call = dce_conn->call_list;
-        if (!call || !call->replies) {
-                return;
-        }
-
-        while (call->replies) {
-                struct data_blob_list_item *rep = call->replies;
-                struct dcesrv_sock_reply_state *substate;
-                struct tevent_req *subreq;
-
-                substate = talloc(call, struct dcesrv_sock_reply_state);
-                if (!substate) {
-                        dcesrv_terminate_connection(dce_conn, "no memory");
-                        return;
-                }
-
-                substate->dce_conn = dce_conn;
-                substate->call = NULL;
-
-                DLIST_REMOVE(call->replies, rep);
-
-                if (call->replies == NULL) {
-                        substate->call = call;
-                }
-
-                substate->iov.iov_base = rep->blob.data;
-                substate->iov.iov_len = rep->blob.length;
-
-                subreq = tstream_writev_queue_send(substate,
-                                                   dce_conn->event_ctx,
-                                                   dce_conn->stream,
-                                                   dce_conn->send_queue,
-                                                   &substate->iov, 1);
-                if (!subreq) {
-                        dcesrv_terminate_connection(dce_conn, "no memory");
-                        return;
-                }
-                tevent_req_set_callback(subreq, dcesrv_sock_reply_done,
-                                        substate);
-        }
-
-        DLIST_REMOVE(call->conn->call_list, call);
-        call->list = DCESRV_LIST_NONE;
-}
-
-static void dcesrv_sock_reply_done(struct tevent_req *subreq)
-{
-        struct dcesrv_sock_reply_state *substate = tevent_req_callback_data(subreq,
-                                                struct dcesrv_sock_reply_state);
-        int ret;
-        int sys_errno;
-        NTSTATUS status;
-        struct dcesrv_call_state *call = substate->call;
-
-        ret = tstream_writev_queue_recv(subreq, &sys_errno);
-        TALLOC_FREE(subreq);
-        if (ret == -1) {
-                status = map_nt_error_from_unix(sys_errno);
-                dcesrv_terminate_connection(substate->dce_conn, nt_errstr(status));
-                return;
-        }
-
-        talloc_free(substate);
-        if (call) {
-                talloc_free(call);
-        }
-}
-
-static struct socket_address *dcesrv_sock_get_my_addr(struct dcesrv_connection *dcesrv_conn, TALLOC_CTX *mem_ctx)
-{
-        struct stream_connection *srv_conn;
-        srv_conn = talloc_get_type(dcesrv_conn->transport.private_data,
-                                   struct stream_connection);
-
-        return socket_get_my_addr(srv_conn->socket, mem_ctx);
-}
-
-static struct socket_address *dcesrv_sock_get_peer_addr(struct dcesrv_connection *dcesrv_conn, TALLOC_CTX *mem_ctx)
-{
-        struct stream_connection *srv_conn;
-        srv_conn = talloc_get_type(dcesrv_conn->transport.private_data,
-                                   struct stream_connection);
-
-        return socket_get_peer_addr(srv_conn->socket, mem_ctx);
-}
-
-struct dcerpc_read_ncacn_packet_state {
-        struct {
-                struct smb_iconv_convenience *smb_iconv_c;
-        } caller;
-        DATA_BLOB buffer;
-        struct ncacn_packet *pkt;
-};
-
-static int dcerpc_read_ncacn_packet_next_vector(struct tstream_context *stream,
-                                                void *private_data,
-                                                TALLOC_CTX *mem_ctx,
-                                                struct iovec **_vector,
-                                                size_t *_count);
-static void dcerpc_read_ncacn_packet_done(struct tevent_req *subreq);
-
-static struct tevent_req *dcerpc_read_ncacn_packet_send(TALLOC_CTX *mem_ctx,
-                                                 struct tevent_context *ev,
-                                                 struct tstream_context *stream,
-                                                 struct smb_iconv_convenience *ic)
-{
-        struct tevent_req *req;
-        struct dcerpc_read_ncacn_packet_state *state;
-        struct tevent_req *subreq;
-
-        req = tevent_req_create(mem_ctx, &state,
-                                struct dcerpc_read_ncacn_packet_state);
-        if (req == NULL) {
-                return NULL;
-        }
-
-        state->caller.smb_iconv_c = ic;
-        state->buffer = data_blob_const(NULL, 0);
-        state->pkt = talloc(state, struct ncacn_packet);
-        if (tevent_req_nomem(state->pkt, req)) {
-                goto post;
-        }
-
-        subreq = tstream_readv_pdu_send(state, ev,
-                                        stream,
-                                        dcerpc_read_ncacn_packet_next_vector,
-                                        state);
-        if (tevent_req_nomem(subreq, req)) {
-                goto post;
-        }
-        tevent_req_set_callback(subreq, dcerpc_read_ncacn_packet_done, req);
-
-        return req;
- post:
-        tevent_req_post(req, ev);
-        return req;
-}
-
-static int dcerpc_read_ncacn_packet_next_vector(struct tstream_context *stream,
-                                                void *private_data,
-                                                TALLOC_CTX *mem_ctx,
-                                                struct iovec **_vector,
-                                                size_t *_count)
-{
-        struct dcerpc_read_ncacn_packet_state *state =
-                talloc_get_type_abort(private_data,
-                struct dcerpc_read_ncacn_packet_state);
-        struct iovec *vector;
-        off_t ofs = 0;
-
-        if (state->buffer.length == 0) {
-                /* first get enough to read the fragment length */
-                ofs = 0;
-                state->buffer.length = DCERPC_FRAG_LEN_OFFSET + 2;
-                state->buffer.data = talloc_array(state, uint8_t,
-                                                  state->buffer.length);
-                if (!state->buffer.data) {
-                        return -1;
-                }
-        } else if (state->buffer.length == (DCERPC_FRAG_LEN_OFFSET + 2)) {
-                /* now read the fragment length and allocate the full buffer */
-                size_t frag_len = dcerpc_get_frag_length(&state->buffer);
-
-                ofs = state->buffer.length;
-
-                state->buffer.data = talloc_realloc(state,
-                                                    state->buffer.data,
-                                                    uint8_t, frag_len);
-                if (!state->buffer.data) {
-                        return -1;
-                }
-                state->buffer.length = frag_len;
-        } else {
-                /* if we reach this we have a full fragment */
-                *_vector = NULL;
-                *_count = 0;
-                return 0;
-        }
-
-        /* now create the vector that we want to be filled */
-        vector = talloc_array(mem_ctx, struct iovec, 1);
-        if (!vector) {
-                return -1;
-        }
-
-        vector[0].iov_base = state->buffer.data + ofs;
-        vector[0].iov_len = state->buffer.length - ofs;
-
-        *_vector = vector;
-        *_count = 1;
-        return 0;
-}
-
-static void dcerpc_read_ncacn_packet_done(struct tevent_req *subreq)
-{
-        struct tevent_req *req = tevent_req_callback_data(subreq,
-                                 struct tevent_req);
-        struct dcerpc_read_ncacn_packet_state *state = tevent_req_data(req,
-                                        struct dcerpc_read_ncacn_packet_state);
-        int ret;
-        int sys_errno;
-        struct ndr_pull *ndr;
-        enum ndr_err_code ndr_err;
-        NTSTATUS status;
-
-        ret = tstream_readv_pdu_recv(subreq, &sys_errno);
-        TALLOC_FREE(subreq);
-        if (ret == -1) {
-                status = map_nt_error_from_unix(sys_errno);
-                tevent_req_nterror(req, status);
-                return;
-        }
-
-        ndr = ndr_pull_init_blob(&state->buffer,
-                                 state->pkt,
-                                 state->caller.smb_iconv_c);
-        if (tevent_req_nomem(ndr, req)) {
-                return;
-        }
-
-        if (!(CVAL(ndr->data, DCERPC_DREP_OFFSET) & DCERPC_DREP_LE)) {
-                ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
-        }
-
-        if (CVAL(ndr->data, DCERPC_PFC_OFFSET) & DCERPC_PFC_FLAG_OBJECT_UUID) {
-                ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
-        }
-
-        ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, state->pkt);
-        TALLOC_FREE(ndr);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                status = ndr_map_error2ntstatus(ndr_err);
-                tevent_req_nterror(req, status);
-                return;
-        }
-
-        tevent_req_done(req);
-}
-
-static NTSTATUS dcerpc_read_ncacn_packet_recv(struct tevent_req *req,
-                                       TALLOC_CTX *mem_ctx,
-                                       struct ncacn_packet **pkt,
-                                       DATA_BLOB *buffer)
-{
-        struct dcerpc_read_ncacn_packet_state *state = tevent_req_data(req,
-                                        struct dcerpc_read_ncacn_packet_state);
-        NTSTATUS status;
-
-        if (tevent_req_is_nterror(req, &status)) {
-                tevent_req_received(req);
-                return status;
-        }
-
-        *pkt = talloc_move(mem_ctx, &state->pkt);
-        if (buffer) {
-                buffer->data = talloc_move(mem_ctx, &state->buffer.data);
-                buffer->length = state->buffer.length;
-        }
-
-        tevent_req_received(req);
-        return NT_STATUS_OK;
-}
-
-static void dcesrv_read_fragment_done(struct tevent_req *subreq);
-
-static void dcesrv_sock_accept(struct stream_connection *srv_conn)
-{
-        NTSTATUS status;
-        struct dcesrv_socket_context *dcesrv_sock = 
-                talloc_get_type(srv_conn->private_data, struct dcesrv_socket_context);
-        struct dcesrv_connection *dcesrv_conn = NULL;
-        int ret;
-        struct tevent_req *subreq;
-        struct loadparm_context *lp_ctx = dcesrv_sock->dcesrv_ctx->lp_ctx;
-
-        if (!srv_conn->session_info) {
-                status = auth_anonymous_session_info(srv_conn,
-                                                     srv_conn->event.ctx,
-                                                     lp_ctx,
-                                                     &srv_conn->session_info);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(0,("dcesrv_sock_accept: auth_anonymous_session_info failed: %s\n",
-                                nt_errstr(status)));
-                        stream_terminate_connection(srv_conn, nt_errstr(status));
-                        return;
-                }
-        }
-
-        status = dcesrv_endpoint_connect(dcesrv_sock->dcesrv_ctx,
-                                         srv_conn,
-                                         dcesrv_sock->endpoint,
-                                         srv_conn->session_info,
-                                         srv_conn->event.ctx,
-                                         srv_conn->msg_ctx,
-                                         srv_conn->server_id,
-                                         DCESRV_CALL_STATE_FLAG_MAY_ASYNC,
-                                         &dcesrv_conn);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("dcesrv_sock_accept: dcesrv_endpoint_connect failed: %s\n", 
-                        nt_errstr(status)));
-                stream_terminate_connection(srv_conn, nt_errstr(status));
-                return;
-        }
-
-        dcesrv_conn->transport.private_data             = srv_conn;
-        dcesrv_conn->transport.report_output_data       = dcesrv_sock_report_output_data;
-        dcesrv_conn->transport.get_my_addr              = dcesrv_sock_get_my_addr;
-        dcesrv_conn->transport.get_peer_addr            = dcesrv_sock_get_peer_addr;
-
-        TALLOC_FREE(srv_conn->event.fde);
-
-        dcesrv_conn->send_queue = tevent_queue_create(dcesrv_conn, "dcesrv send queue");
-        if (!dcesrv_conn->send_queue) {
-                status = NT_STATUS_NO_MEMORY;
-                DEBUG(0,("dcesrv_sock_accept: tevent_queue_create(%s)\n",
-                        nt_errstr(status)));
-                stream_terminate_connection(srv_conn, nt_errstr(status));
-                return;
-        }
-
-        if (dcesrv_sock->endpoint->ep_description->transport == NCACN_NP) {
-                dcesrv_conn->auth_state.session_key = dcesrv_inherited_session_key;
-                ret = tstream_npa_existing_socket(dcesrv_conn,
-                                                  socket_get_fd(srv_conn->socket),
-                                                  FILE_TYPE_MESSAGE_MODE_PIPE,
-                                                  &dcesrv_conn->stream);
-        } else {
-                ret = tstream_bsd_existing_socket(dcesrv_conn,
-                                                  socket_get_fd(srv_conn->socket),
-                                                  &dcesrv_conn->stream);
-        }
-        if (ret == -1) {
-                status = map_nt_error_from_unix(errno);
-                DEBUG(0,("dcesrv_sock_accept: failed to setup tstream: %s\n",
-                        nt_errstr(status)));
-                stream_terminate_connection(srv_conn, nt_errstr(status));
-                return;
-        }
-
-        srv_conn->private_data = dcesrv_conn;
-
-        irpc_add_name(srv_conn->msg_ctx, "rpc_server");
-
-        subreq = dcerpc_read_ncacn_packet_send(dcesrv_conn,
-                                               dcesrv_conn->event_ctx,
-                                               dcesrv_conn->stream,
-                                               lp_iconv_convenience(lp_ctx));
-        if (!subreq) {
-                status = NT_STATUS_NO_MEMORY;
-                DEBUG(0,("dcesrv_sock_accept: dcerpc_read_fragment_buffer_send(%s)\n",
-                        nt_errstr(status)));
-                stream_terminate_connection(srv_conn, nt_errstr(status));
-                return;
-        }
-        tevent_req_set_callback(subreq, dcesrv_read_fragment_done, dcesrv_conn);
-
-        return;
-}
-
-static void dcesrv_read_fragment_done(struct tevent_req *subreq)
-{
-        struct dcesrv_connection *dce_conn = tevent_req_callback_data(subreq,
-                                             struct dcesrv_connection);
-        struct ncacn_packet *pkt;
-        DATA_BLOB buffer;
-        NTSTATUS status;
-        struct loadparm_context *lp_ctx = dce_conn->dce_ctx->lp_ctx;
-
-        status = dcerpc_read_ncacn_packet_recv(subreq, dce_conn,
-                                               &pkt, &buffer);
-        TALLOC_FREE(subreq);
-        if (!NT_STATUS_IS_OK(status)) {
-                dcesrv_terminate_connection(dce_conn, nt_errstr(status));
-                return;
-        }
-
-        status = dcesrv_process_ncacn_packet(dce_conn, pkt, buffer);
-        if (!NT_STATUS_IS_OK(status)) {
-                dcesrv_terminate_connection(dce_conn, nt_errstr(status));
-                return;
-        }
-
-        subreq = dcerpc_read_ncacn_packet_send(dce_conn,
-                                               dce_conn->event_ctx,
-                                               dce_conn->stream,
-                                               lp_iconv_convenience(lp_ctx));
-        if (!subreq) {
-                status = NT_STATUS_NO_MEMORY;
-                dcesrv_terminate_connection(dce_conn, nt_errstr(status));
-                return;
-        }
-        tevent_req_set_callback(subreq, dcesrv_read_fragment_done, dce_conn);
-}
-
-static void dcesrv_sock_recv(struct stream_connection *conn, uint16_t flags)
-{
-        struct dcesrv_connection *dce_conn = talloc_get_type(conn->private_data,
-                                             struct dcesrv_connection);
-        dcesrv_terminate_connection(dce_conn, "dcesrv_sock_recv triggered");
-}
-
-static void dcesrv_sock_send(struct stream_connection *conn, uint16_t flags)
-{
-        struct dcesrv_connection *dce_conn = talloc_get_type(conn->private_data,
-                                             struct dcesrv_connection);
-        dcesrv_terminate_connection(dce_conn, "dcesrv_sock_send triggered");
-}
-
-
-static const struct stream_server_ops dcesrv_stream_ops = {
-        .name                   = "rpc",
-        .accept_connection      = dcesrv_sock_accept,
-        .recv_handler           = dcesrv_sock_recv,
-        .send_handler           = dcesrv_sock_send,
-};
-
-
-
-static NTSTATUS dcesrv_add_ep_unix(struct dcesrv_context *dce_ctx, 
-                                   struct loadparm_context *lp_ctx,
-                                   struct dcesrv_endpoint *e,
-                            struct tevent_context *event_ctx, const struct model_ops *model_ops)
-{
-        struct dcesrv_socket_context *dcesrv_sock;
-        uint16_t port = 1;
-        NTSTATUS status;
-
-        dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
-        NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
-
-        /* remember the endpoint of this socket */
-        dcesrv_sock->endpoint           = e;
-        dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
-
-        status = stream_setup_socket(event_ctx, lp_ctx,
-                                     model_ops, &dcesrv_stream_ops, 
-                                     "unix", e->ep_description->endpoint, &port, 
-                                     lp_socket_options(lp_ctx), 
-                                     dcesrv_sock);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("service_setup_stream_socket(path=%s) failed - %s\n",
-                         e->ep_description->endpoint, nt_errstr(status)));
-        }
-
-        return status;
-}
-
-static NTSTATUS dcesrv_add_ep_ncalrpc(struct dcesrv_context *dce_ctx, 
-                                      struct loadparm_context *lp_ctx,
-                                      struct dcesrv_endpoint *e,
-                                      struct tevent_context *event_ctx, const struct model_ops *model_ops)
-{
-        struct dcesrv_socket_context *dcesrv_sock;
-        uint16_t port = 1;
-        char *full_path;
-        NTSTATUS status;
-
-        if (!e->ep_description->endpoint) {
-                /* No identifier specified: use DEFAULT. 
-                 * DO NOT hardcode this value anywhere else. Rather, specify 
-                 * no endpoint and let the epmapper worry about it. */
-                e->ep_description->endpoint = talloc_strdup(dce_ctx, "DEFAULT");
-        }
-
-        full_path = talloc_asprintf(dce_ctx, "%s/%s", lp_ncalrpc_dir(lp_ctx), 
-                                    e->ep_description->endpoint);
-
-        dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
-        NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
-
-        /* remember the endpoint of this socket */
-        dcesrv_sock->endpoint           = e;
-        dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
-
-        status = stream_setup_socket(event_ctx, lp_ctx,
-                                     model_ops, &dcesrv_stream_ops, 
-                                     "unix", full_path, &port, 
-                                     lp_socket_options(lp_ctx), 
-                                     dcesrv_sock);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("service_setup_stream_socket(identifier=%s,path=%s) failed - %s\n",
-                         e->ep_description->endpoint, full_path, nt_errstr(status)));
-        }
-        return status;
-}
-
-static NTSTATUS dcesrv_add_ep_np(struct dcesrv_context *dce_ctx,
-                                 struct loadparm_context *lp_ctx,
-                                 struct dcesrv_endpoint *e,
-                                 struct tevent_context *event_ctx, const struct model_ops *model_ops)
-{
-        struct dcesrv_socket_context *dcesrv_sock;
-        NTSTATUS status;
-                        
-        if (e->ep_description->endpoint == NULL) {
-                DEBUG(0, ("Endpoint mandatory for named pipes\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
-        NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
-
-        /* remember the endpoint of this socket */
-        dcesrv_sock->endpoint           = e;
-        dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
-
-        status = stream_setup_named_pipe(event_ctx, lp_ctx,
-                                         model_ops, &dcesrv_stream_ops,
-                                         e->ep_description->endpoint, dcesrv_sock);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("stream_setup_named_pipe(pipe=%s) failed - %s\n",
-                         e->ep_description->endpoint, nt_errstr(status)));
-                return status;
-        }
-
-        return NT_STATUS_OK;
-}
-
-/*
-  add a socket address to the list of events, one event per dcerpc endpoint
-*/
-static NTSTATUS add_socket_rpc_tcp_iface(struct dcesrv_context *dce_ctx, struct dcesrv_endpoint *e,
-                                         struct tevent_context *event_ctx, const struct model_ops *model_ops,
-                                         const char *address)
-{
-        struct dcesrv_socket_context *dcesrv_sock;
-        uint16_t port = 0;
-        NTSTATUS status;
-                        
-        if (e->ep_description->endpoint) {
-                port = atoi(e->ep_description->endpoint);
-        }
-
-        dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
-        NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
-
-        /* remember the endpoint of this socket */
-        dcesrv_sock->endpoint           = e;
-        dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
-
-        status = stream_setup_socket(event_ctx, dce_ctx->lp_ctx,
-                                     model_ops, &dcesrv_stream_ops, 
-                                     "ipv4", address, &port, 
-                                     lp_socket_options(dce_ctx->lp_ctx), 
-                                     dcesrv_sock);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("service_setup_stream_socket(address=%s,port=%u) failed - %s\n", 
-                         address, port, nt_errstr(status)));
-        }
-
-        if (e->ep_description->endpoint == NULL) {
-                e->ep_description->endpoint = talloc_asprintf(dce_ctx, "%d", port);
-        }
-
-        return status;
-}
-
-static NTSTATUS dcesrv_add_ep_tcp(struct dcesrv_context *dce_ctx, 
-                                  struct loadparm_context *lp_ctx,
-                                  struct dcesrv_endpoint *e,
-                                  struct tevent_context *event_ctx, const struct model_ops *model_ops)
-{
-        NTSTATUS status;
-
-        /* Add TCP/IP sockets */
-        if (lp_interfaces(lp_ctx) && lp_bind_interfaces_only(lp_ctx)) {
-                int num_interfaces;
-                int i;
-                struct interface *ifaces;
-
-                load_interfaces(dce_ctx, lp_interfaces(lp_ctx), &ifaces);
-
-                num_interfaces = iface_count(ifaces);
-                for(i = 0; i < num_interfaces; i++) {
-                        const char *address = iface_n_ip(ifaces, i);
-                        status = add_socket_rpc_tcp_iface(dce_ctx, e, event_ctx, model_ops, address);
-                        NT_STATUS_NOT_OK_RETURN(status);
-                }
-        } else {
-                status = add_socket_rpc_tcp_iface(dce_ctx, e, event_ctx, model_ops, 
-                                                  lp_socket_address(lp_ctx));
-                NT_STATUS_NOT_OK_RETURN(status);
-        }
-
-        return NT_STATUS_OK;
-}
-
-NTSTATUS dcesrv_add_ep(struct dcesrv_context *dce_ctx,
-                       struct loadparm_context *lp_ctx,
-                       struct dcesrv_endpoint *e,
-                       struct tevent_context *event_ctx,
-                       const struct model_ops *model_ops)
-{
-        switch (e->ep_description->transport) {
-        case NCACN_UNIX_STREAM:
-                return dcesrv_add_ep_unix(dce_ctx, lp_ctx, e, event_ctx, model_ops);
-
-        case NCALRPC:
-                return dcesrv_add_ep_ncalrpc(dce_ctx, lp_ctx, e, event_ctx, model_ops);
-
-        case NCACN_IP_TCP:
-                return dcesrv_add_ep_tcp(dce_ctx, lp_ctx, e, event_ctx, model_ops);
-
-        case NCACN_NP:
-                return dcesrv_add_ep_np(dce_ctx, lp_ctx, e, event_ctx, model_ops);
-
-        default:
-                return NT_STATUS_NOT_SUPPORTED;
-        }
-}
 
 /*
@@ -695 +57 @@
         /* run the rpc server as a single process to allow for shard
          * handles, and sharing of ldb contexts */
-        model_ops = process_model_startup(task->event_ctx, "single");
+        model_ops = process_model_startup("single");
         if (!model_ops) goto failed;
 
         status = dcesrv_init_context(task->event_ctx,
                                      task->lp_ctx,
-                                     lp_dcerpc_endpoint_servers(task->lp_ctx),
+                                     lpcfg_dcerpc_endpoint_servers(task->lp_ctx),
                                      &dce_ctx);
         if (!NT_STATUS_IS_OK(status)) goto failed;
 
         /* Make sure the directory for NCALRPC exists */
-        if (!directory_exist(lp_ncalrpc_dir(task->lp_ctx))) {
-                mkdir(lp_ncalrpc_dir(task->lp_ctx), 0755);
+        if (!directory_exist(lpcfg_ncalrpc_dir(task->lp_ctx))) {
+                mkdir(lpcfg_ncalrpc_dir(task->lp_ctx), 0755);
         }
 
@@ -721 +83 @@
 NTSTATUS server_service_rpc_init(void)
 {
-
         return register_server_service("rpc", dcesrv_task_init);
 }

trunk/server/source4/rpc_server/spoolss/dcesrv_spoolss.c

@@ -25 +25 @@
 #include "librpc/gen_ndr/ndr_spoolss.h"
 #include "ntptr/ntptr.h"
-#include "lib/socket/socket.h"
+#include "lib/tsocket/tsocket.h"
 #include "librpc/gen_ndr/ndr_spoolss_c.h"
 #include "auth/credentials/credentials.h"
@@ -34 +34 @@
 };
 
-#define SPOOLSS_BUFFER_UNION(fn,ic,info,level) \
-        ((info)?ndr_size_##fn(info, level, ic, 0):0)
-
-#define SPOOLSS_BUFFER_UNION_ARRAY(fn,ic,info,level,count) \
-        ((info)?ndr_size_##fn##_info(dce_call, ic, level, count, info):0)
+#define SPOOLSS_BUFFER_UNION(fn,info,level) \
+        ((info)?ndr_size_##fn(info, level, 0):0)
+
+#define SPOOLSS_BUFFER_UNION_ARRAY(fn,info,level,count) \
+        ((info)?ndr_size_##fn##_info(dce_call, level, count, info):0)
 
 #define SPOOLSS_BUFFER_OK(val_true,val_false) ((r->in.offered >= *r->out.needed)?val_true:val_false)
@@ -149 +149 @@
 {
         bool ret;
-        struct socket_address *myaddr;
+        const struct tsocket_address *local_address;
+        char *myaddr;
         const char **aliases;
-        int i;
+        const char *dnsdomain;
+        unsigned int i;
 
         /* NULL is ok */
@@ -173 +175 @@
 
         /* NETBIOS NAME is ok */
-        ret = strequal(lp_netbios_name(dce_call->conn->dce_ctx->lp_ctx), server_name);
+        ret = strequal(lpcfg_netbios_name(dce_call->conn->dce_ctx->lp_ctx), server_name);
         if (ret) return WERR_OK;
 
-        aliases = lp_netbios_aliases(dce_call->conn->dce_ctx->lp_ctx);
+        aliases = lpcfg_netbios_aliases(dce_call->conn->dce_ctx->lp_ctx);
 
         for (i=0; aliases && aliases[i]; i++) {
@@ -187 +189 @@
          * TODO: we need to check if aliases are also ok
          */
-        if (lp_realm(dce_call->conn->dce_ctx->lp_ctx)) {
+        dnsdomain = lpcfg_dnsdomain(dce_call->conn->dce_ctx->lp_ctx);
+        if (dnsdomain != NULL) {
                 char *str;
 
                 str = talloc_asprintf(mem_ctx, "%s.%s",
-                                                lp_netbios_name(dce_call->conn->dce_ctx->lp_ctx),
-                                                lp_realm(dce_call->conn->dce_ctx->lp_ctx));
+                                                lpcfg_netbios_name(dce_call->conn->dce_ctx->lp_ctx),
+                                                dnsdomain);
                 W_ERROR_HAVE_NO_MEMORY(str);
 
@@ -200 +203 @@
         }
 
-        myaddr = dcesrv_connection_get_my_addr(dce_call->conn, mem_ctx);
+        local_address = dcesrv_connection_get_local_address(dce_call->conn);
+
+        myaddr = tsocket_address_inet_addr_string(local_address, mem_ctx);
         W_ERROR_HAVE_NO_MEMORY(myaddr);
 
-        ret = strequal(myaddr->addr, server_name);
+        ret = strequal(myaddr, server_name);
         talloc_free(myaddr);
         if (ret) return WERR_OK;
@@ -216 +221 @@
 
         status = ntptr_init_context(dce_call->context, dce_call->conn->event_ctx, dce_call->conn->dce_ctx->lp_ctx,
-                                    lp_ntptr_providor(dce_call->conn->dce_ctx->lp_ctx), &ntptr);
+                                    lpcfg_ntptr_providor(dce_call->conn->dce_ctx->lp_ctx), &ntptr);
         NT_STATUS_NOT_OK_RETURN(status);
 
@@ -234 +239 @@
         struct ntptr_context *ntptr = talloc_get_type(dce_call->context->private_data, struct ntptr_context);
         WERROR status;
-        struct smb_iconv_convenience *ic = lp_iconv_convenience(ntptr->lp_ctx);
 
         status = dcesrv_spoolss_check_server_name(dce_call, mem_ctx, r->in.server);
@@ -242 +246 @@
         W_ERROR_NOT_OK_RETURN(status);
 
-        *r->out.needed  = SPOOLSS_BUFFER_UNION_ARRAY(spoolss_EnumPrinters, ic, *r->out.info, r->in.level, *r->out.count);
+        *r->out.needed  = SPOOLSS_BUFFER_UNION_ARRAY(spoolss_EnumPrinters, *r->out.info, r->in.level, *r->out.count);
         *r->out.info    = SPOOLSS_BUFFER_OK(*r->out.info, NULL);
         *r->out.count   = SPOOLSS_BUFFER_OK(*r->out.count, 0);
@@ -370 +374 @@
         struct ntptr_context *ntptr = talloc_get_type(dce_call->context->private_data, struct ntptr_context);
         WERROR status;
-        struct smb_iconv_convenience *ic = lp_iconv_convenience(ntptr->lp_ctx);
 
         status = dcesrv_spoolss_check_server_name(dce_call, mem_ctx, r->in.server);
@@ -378 +381 @@
         W_ERROR_NOT_OK_RETURN(status);
 
-        *r->out.needed  = SPOOLSS_BUFFER_UNION_ARRAY(spoolss_EnumPrinterDrivers, ic, *r->out.info, r->in.level, *r->out.count);
+        *r->out.needed  = SPOOLSS_BUFFER_UNION_ARRAY(spoolss_EnumPrinterDrivers, *r->out.info, r->in.level, *r->out.count);
         *r->out.info    = SPOOLSS_BUFFER_OK(*r->out.info, NULL);
         *r->out.count   = SPOOLSS_BUFFER_OK(*r->out.count, 0);
@@ -403 +406 @@
         struct ntptr_context *ntptr = talloc_get_type(dce_call->context->private_data, struct ntptr_context);
         WERROR status;
-        struct smb_iconv_convenience *ic = lp_iconv_convenience(ntptr->lp_ctx);
 
         status = dcesrv_spoolss_check_server_name(dce_call, mem_ctx, r->in.server);
@@ -411 +413 @@
         W_ERROR_NOT_OK_RETURN(status);
 
-        *r->out.needed  = SPOOLSS_BUFFER_UNION(spoolss_DriverDirectoryInfo, ic, r->out.info, r->in.level);
+        *r->out.needed  = SPOOLSS_BUFFER_UNION(spoolss_DriverDirectoryInfo, r->out.info, r->in.level);
         r->out.info     = SPOOLSS_BUFFER_OK(r->out.info, NULL);
         return SPOOLSS_BUFFER_OK(WERR_OK, WERR_INSUFFICIENT_BUFFER);
@@ -455 +457 @@
         struct ntptr_context *ntptr = talloc_get_type(dce_call->context->private_data, struct ntptr_context);
         WERROR status;
-        struct smb_iconv_convenience *ic = lp_iconv_convenience(ntptr->lp_ctx);
 
         status = dcesrv_spoolss_check_server_name(dce_call, mem_ctx, r->in.server);
@@ -463 +464 @@
         W_ERROR_NOT_OK_RETURN(status);
 
-        *r->out.needed  = SPOOLSS_BUFFER_UNION(spoolss_PrintProcessorDirectoryInfo, ic, r->out.info, r->in.level);
+        *r->out.needed  = SPOOLSS_BUFFER_UNION(spoolss_PrintProcessorDirectoryInfo, r->out.info, r->in.level);
         r->out.info     = SPOOLSS_BUFFER_OK(r->out.info, NULL);
         return SPOOLSS_BUFFER_OK(WERR_OK, WERR_INSUFFICIENT_BUFFER);
@@ -572 +573 @@
         struct dcesrv_handle *h;
         WERROR status;
-        struct smb_iconv_convenience *ic = lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx);
 
         r->out.type = talloc_zero(mem_ctx, enum winreg_Type);
@@ -718 +718 @@
         struct dcesrv_handle *h;
         WERROR status;
-        struct smb_iconv_convenience *ic = lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx);
 
         DCESRV_PULL_HANDLE_WERR(h, r->in.handle, DCESRV_HANDLE_ANY);
@@ -739 +738 @@
         }
 
-        *r->out.needed  = SPOOLSS_BUFFER_UNION(spoolss_FormInfo, ic, r->out.info, r->in.level);
+        *r->out.needed  = SPOOLSS_BUFFER_UNION(spoolss_FormInfo, r->out.info, r->in.level);
         r->out.info     = SPOOLSS_BUFFER_OK(r->out.info, NULL);
         return SPOOLSS_BUFFER_OK(WERR_OK, WERR_INSUFFICIENT_BUFFER);
@@ -786 +785 @@
         struct dcesrv_handle *h;
         WERROR status;
-        struct smb_iconv_convenience *ic = lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx);
 
         DCESRV_PULL_HANDLE_WERR(h, r->in.handle, DCESRV_HANDLE_ANY);
@@ -806 +804 @@
         }
 
-        *r->out.needed  = SPOOLSS_BUFFER_UNION_ARRAY(spoolss_EnumForms, ic, *r->out.info, r->in.level, *r->out.count);
+        *r->out.needed  = SPOOLSS_BUFFER_UNION_ARRAY(spoolss_EnumForms, *r->out.info, r->in.level, *r->out.count);
         *r->out.info    = SPOOLSS_BUFFER_OK(*r->out.info, NULL);
         *r->out.count   = SPOOLSS_BUFFER_OK(*r->out.count, 0);
@@ -821 +819 @@
         struct ntptr_context *ntptr = talloc_get_type(dce_call->context->private_data, struct ntptr_context);
         WERROR status;
-        struct smb_iconv_convenience *ic = lp_iconv_convenience(ntptr->lp_ctx);
 
         status = dcesrv_spoolss_check_server_name(dce_call, mem_ctx, r->in.servername);
@@ -829 +826 @@
         W_ERROR_NOT_OK_RETURN(status);
 
-        *r->out.needed  = SPOOLSS_BUFFER_UNION_ARRAY(spoolss_EnumPorts, ic, *r->out.info, r->in.level, *r->out.count);
+        *r->out.needed  = SPOOLSS_BUFFER_UNION_ARRAY(spoolss_EnumPorts, *r->out.info, r->in.level, *r->out.count);
         *r->out.info    = SPOOLSS_BUFFER_OK(*r->out.info, NULL);
         *r->out.count   = SPOOLSS_BUFFER_OK(*r->out.count, 0);
@@ -844 +841 @@
         struct ntptr_context *ntptr = talloc_get_type(dce_call->context->private_data, struct ntptr_context);
         WERROR status;
-        struct smb_iconv_convenience *ic = lp_iconv_convenience(ntptr->lp_ctx);
 
         status = dcesrv_spoolss_check_server_name(dce_call, mem_ctx, r->in.servername);
@@ -852 +848 @@
         W_ERROR_NOT_OK_RETURN(status);
 
-        *r->out.needed  = SPOOLSS_BUFFER_UNION_ARRAY(spoolss_EnumMonitors, ic, *r->out.info, r->in.level, *r->out.count);
+        *r->out.needed  = SPOOLSS_BUFFER_UNION_ARRAY(spoolss_EnumMonitors, *r->out.info, r->in.level, *r->out.count);
         *r->out.info    = SPOOLSS_BUFFER_OK(*r->out.info, NULL);
         *r->out.count   = SPOOLSS_BUFFER_OK(*r->out.count, 0);
@@ -1196 +1192 @@
 
         ZERO_STRUCT(rop);
-        rop.in.server_name = lp_netbios_name(dce_call->conn->dce_ctx->lp_ctx);
+        rop.in.server_name = lpcfg_netbios_name(dce_call->conn->dce_ctx->lp_ctx);
         W_ERROR_HAVE_NO_MEMORY(rop.in.server_name);
         rop.in.printer_local = 0;
@@ -1204 +1200 @@
         rop.out.handle = &notify_handle;
 
-        status = dcerpc_spoolss_ReplyOpenPrinter(p, mem_ctx, &rop);
+        status = dcerpc_spoolss_ReplyOpenPrinter_r(p->binding_handle, mem_ctx, &rop);
         if (NT_STATUS_IS_ERR(status)) {
                 DEBUG(0, ("unable to open remote printer %s\n",
@@ -1310 +1306 @@
 
 /* 
-  spoolss_47 
-*/
-static WERROR dcesrv_spoolss_47(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct spoolss_47 *r)
+  spoolss_SetPort
+*/
+static WERROR dcesrv_spoolss_SetPort(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                       struct spoolss_SetPort *r)
 {
         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
@@ -1450 +1446 @@
 
 /* 
-  spoolss_55 
-*/
-static WERROR dcesrv_spoolss_55(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct spoolss_55 *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/* 
-  spoolss_56 
-*/
-static WERROR dcesrv_spoolss_56(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct spoolss_56 *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/* 
-  spoolss_57 
-*/
-static WERROR dcesrv_spoolss_57(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct spoolss_57 *r)
+  spoolss_AddPerMachineConnection
+*/
+static WERROR dcesrv_spoolss_AddPerMachineConnection(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                       struct spoolss_AddPerMachineConnection *r)
+{
+        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+}
+
+
+/* 
+  spoolss_DeletePerMachineConnection
+*/
+static WERROR dcesrv_spoolss_DeletePerMachineConnection(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                       struct spoolss_DeletePerMachineConnection *r)
+{
+        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+}
+
+
+/* 
+  spoolss_EnumPerMachineConnections
+*/
+static WERROR dcesrv_spoolss_EnumPerMachineConnections(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                       struct spoolss_EnumPerMachineConnections *r)
 {
         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);

trunk/server/source4/rpc_server/srvsvc/dcesrv_srvsvc.c

@@ -25 +25 @@
 #include "librpc/gen_ndr/ndr_srvsvc.h"
 #include "rpc_server/common/common.h"
+#include "rpc_server/common/share.h"
 #include "auth/auth.h"
 #include "libcli/security/security.h"
@@ -34 +35 @@
         struct security_token *t = dce_call->conn->auth_state.session_info->security_token; \
         if (!security_token_has_builtin_administrators(t) && \
-            !security_token_has_sid_string(t, SID_BUILTIN_SERVER_OPERATORS)) { \
+            !security_token_has_sid(t, &global_sid_Builtin_Server_Operators)) { \
                 return WERR_ACCESS_DENIED; \
         } \
@@ -69 +70 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_OK;
 }
 
@@ -94 +93 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -141 +138 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -166 +161 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -195 +188 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -252 +243 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -289 +278 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -314 +301 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -391 +376 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -432 +415 @@
                 struct share_info *info;
                 struct share_context *sctx;
-                int count = 8;
-                int i;
-
-                nterr = share_get_context_by_name(mem_ctx, lp_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
+                unsigned int count = 8;
+                unsigned int i;
+
+                nterr = share_get_context_by_name(mem_ctx, lpcfg_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
                 if (!NT_STATUS_IS_OK(nterr)) {
                         return ntstatus_to_werror(nterr);
@@ -449 +432 @@
                 info[i].type = SHARE_INFO_STRING;
                 switch (r->in.info->info2->type) {
-                case 0x00:
+                case STYPE_DISKTREE:
                         info[i].value = talloc_strdup(info, "DISK");
                         break;
-                case 0x01:
+                case STYPE_PRINTQ:
                         info[i].value = talloc_strdup(info, "PRINTER");
                         break;
-                case 0x03:
+                case STYPE_IPC:
                         info[i].value = talloc_strdup(info, "IPC");
                         break;
@@ -530 +513 @@
                 struct share_info *info;
                 struct share_context *sctx;
-                int count = 10;
-                int i;
-
-                nterr = share_get_context_by_name(mem_ctx, lp_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
+                unsigned int count = 10;
+                unsigned int i;
+
+                nterr = share_get_context_by_name(mem_ctx, lpcfg_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
                 if (!NT_STATUS_IS_OK(nterr)) {
                         return ntstatus_to_werror(nterr);
@@ -619 +602 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -700 +681 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -721 +700 @@
          */
 
-        nterr = share_get_context_by_name(mem_ctx, lp_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
+        nterr = share_get_context_by_name(mem_ctx, lpcfg_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
         if (!NT_STATUS_IS_OK(nterr)) {
                 return ntstatus_to_werror(nterr);
@@ -734 +713 @@
         case 0:
         {
-                int i;
+                unsigned int i;
                 struct srvsvc_NetShareCtr0 *ctr0;
 
@@ -775 +754 @@
         case 1:
         {
-                int i;
+                unsigned int i;
                 struct srvsvc_NetShareCtr1 *ctr1;
 
@@ -817 +796 @@
         case 2:
         {
-                int i;
+                unsigned int i;
                 struct srvsvc_NetShareCtr2 *ctr2;
 
@@ -861 +840 @@
         case 501:
         {
-                int i;
+                unsigned int i;
                 struct srvsvc_NetShareCtr501 *ctr501;
 
@@ -905 +884 @@
         case 502:
         {
-                int i;
+                unsigned int i;
                 struct srvsvc_NetShareCtr502 *ctr502;
 
@@ -950 +929 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -974 +951 @@
         }
 
-        nterr = share_get_context_by_name(mem_ctx, lp_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
+        nterr = share_get_context_by_name(mem_ctx, lpcfg_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
         if (!NT_STATUS_IS_OK(nterr)) {
                 return ntstatus_to_werror(nterr);
@@ -1088 +1065 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -1103 +1078 @@
                                         struct security_descriptor *sd)
 {
-        int i = 0;
+        unsigned int i = 0;
 
         if (level == 501) {
@@ -1222 +1197 @@
         W_ERROR_HAVE_NO_MEMORY(info);
 
-        ZERO_STRUCT(r->out);
-
         if (strcmp("", r->in.share_name) == 0) {
                 return WERR_INVALID_PARAM;
         }
 
-        nterr = share_get_context_by_name(mem_ctx, lp_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
+        nterr = share_get_context_by_name(mem_ctx, lpcfg_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
         if (!NT_STATUS_IS_OK(nterr)) {
                 return ntstatus_to_werror(nterr);
@@ -1384 +1357 @@
         char *device;
         const char **names;
-        int count, i;
+        int count;
+        int i;
 
         *r->out.type = 0;
@@ -1405 +1379 @@
         all_string_sub(device, "\\", "/", 0);
 
-        nterr = share_get_context_by_name(mem_ctx, lp_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
+        nterr = share_get_context_by_name(mem_ctx, lpcfg_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
         if (!NT_STATUS_IS_OK(nterr)) {
                 return ntstatus_to_werror(nterr);
@@ -1458 +1432 @@
 {
         struct dcesrv_context *dce_ctx = dce_call->conn->dce_ctx;
-        struct dcerpc_server_info *server_info = lp_dcerpc_server_info(mem_ctx, dce_ctx->lp_ctx);
+        struct dcerpc_server_info *server_info = lpcfg_dcerpc_server_info(mem_ctx, dce_ctx->lp_ctx);
 
         ZERO_STRUCTP(r->out.info);
@@ -1491 +1465 @@
                 info101->version_minor  = server_info->version_minor;
                 info101->server_type    = dcesrv_common_get_server_type(mem_ctx, dce_call->event_ctx, dce_ctx);
-                info101->comment        = talloc_strdup(mem_ctx, lp_serverstring(dce_ctx->lp_ctx));
+                info101->comment        = talloc_strdup(mem_ctx, lpcfg_serverstring(dce_ctx->lp_ctx));
                 W_ERROR_HAVE_NO_MEMORY(info101->comment);
 
@@ -1511 +1485 @@
                 info102->version_minor  = server_info->version_minor;
                 info102->server_type    = dcesrv_common_get_server_type(mem_ctx, dce_call->event_ctx, dce_ctx);
-                info102->comment        = talloc_strdup(mem_ctx, lp_serverstring(dce_ctx->lp_ctx));
+                info102->comment        = talloc_strdup(mem_ctx, lpcfg_serverstring(dce_ctx->lp_ctx));
                 W_ERROR_HAVE_NO_MEMORY(info102->comment);
 
@@ -1529 +1503 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -1577 +1549 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -1658 +1628 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -1788 +1756 @@
                 return WERR_INVALID_PARAM;
         }
-
-        return WERR_INVALID_PARAM;
 }
 
@@ -1821 +1787 @@
          */
 
-        nterr = share_get_context_by_name(mem_ctx, lp_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
+        nterr = share_get_context_by_name(mem_ctx, lpcfg_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
         if (!NT_STATUS_IS_OK(nterr)) {
                 return ntstatus_to_werror(nterr);
@@ -1834 +1800 @@
         case 0:
         {
-                int i, y = 0;
-                int count;
+                unsigned int i, y = 0;
+                unsigned int count;
                 struct srvsvc_NetShareCtr0 *ctr0;
 
@@ -1886 +1852 @@
         case 1:
         {
-                int i, y = 0;
-                int count;
+                unsigned int i, y = 0;
+                unsigned int count;
                 struct srvsvc_NetShareCtr1 *ctr1;
 
@@ -1938 +1904 @@
         case 2:
         {
-                int i, y = 0;
-                int count;
+                unsigned int i, y = 0;
+                unsigned int count;
                 struct srvsvc_NetShareCtr2 *ctr2;
 
@@ -1992 +1958 @@
         case 502:
         {
-                int i, y = 0;
-                int count;
+                unsigned int i, y = 0;
+                unsigned int count;
                 struct srvsvc_NetShareCtr502 *ctr502;
 
@@ -2047 +2013 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -2288 +2252 @@
         struct share_context *sctx;
                 
-        nterr = share_get_context_by_name(mem_ctx, lp_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
+        nterr = share_get_context_by_name(mem_ctx, lpcfg_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
         if (!NT_STATUS_IS_OK(nterr)) {
                 return ntstatus_to_werror(nterr);

trunk/server/source4/rpc_server/srvsvc/srvsvc_ntvfs.c

@@ -22 +22 @@
 #include "ntvfs/ntvfs.h"
 #include "rpc_server/dcerpc_server.h"
-#include "librpc/gen_ndr/ndr_srvsvc.h"
-#include "rpc_server/common/common.h"
-#include "rpc_server/srvsvc/proto.h"
-#include "lib/socket/socket.h"
 #include "param/param.h"
-
-struct socket_address *srvsvc_get_my_addr(void *p, TALLOC_CTX *mem_ctx)
-{
-        struct dcesrv_connection *conn = talloc_get_type(p, struct dcesrv_connection);
-        return dcesrv_connection_get_my_addr(conn, mem_ctx);
-}
-
-struct socket_address *srvsvc_get_peer_addr(void *p, TALLOC_CTX *mem_ctx)
-{
-        struct dcesrv_connection *conn = talloc_get_type(p, struct dcesrv_connection);
-        return dcesrv_connection_get_peer_addr(conn, mem_ctx);
-}
 
 struct srvsvc_ntvfs_ctx {
@@ -62 +46 @@
         struct share_config *scfg;
         const char *sharetype;
+        union smb_tcon tcon;
+        const struct tsocket_address *local_address;
+        const struct tsocket_address *remote_address;
 
-        status = share_get_context_by_name(mem_ctx, lp_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
+        status = share_get_context_by_name(mem_ctx, lpcfg_share_backend(dce_call->conn->dce_ctx->lp_ctx), dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, &sctx);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -115 +102 @@
          * NOTE: we only set the addr callbacks as we're not interesseted in oplocks or in getting file handles
          */
-        status = ntvfs_set_addr_callbacks(c->ntvfs, srvsvc_get_my_addr, srvsvc_get_peer_addr, dce_call->conn);
+        local_address = dcesrv_connection_get_local_address(dce_call->conn);
+        remote_address = dcesrv_connection_get_remote_address(dce_call->conn);
+        status = ntvfs_set_addresses(c->ntvfs, local_address, remote_address);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0,("srvsvc_create_ntvfs_context: NTVFS failed to set the addr callbacks!\n"));
@@ -129 +118 @@
 
         /* Invoke NTVFS connection hook */
-        status = ntvfs_connect(ntvfs_req, scfg->name);
+        tcon.tcon.level = RAW_TCON_TCON;
+        ZERO_STRUCT(tcon.tcon.in);
+        tcon.tcon.in.service = scfg->name;
+        status = ntvfs_connect(ntvfs_req, &tcon);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0,("srvsvc_create_ntvfs_context: NTVFS ntvfs_connect() failed!\n"));

trunk/server/source4/rpc_server/unixinfo/dcesrv_unixinfo.c

@@ -50 +50 @@
                                                 dce_call->context->private_data,
                                                 struct wbc_context);
-        struct id_mapping *ids;
+        struct id_map *ids;
         struct composite_context *ctx;
 
         DEBUG(5, ("dcesrv_unixinfo_SidToUid called\n"));
 
-        ids = talloc(mem_ctx, struct  id_mapping);
+        ids = talloc(mem_ctx, struct id_map);
         NT_STATUS_HAVE_NO_MEMORY(ids);
 
         ids->sid = &r->in.sid;
-        ids->status = NT_STATUS_NONE_MAPPED;
-        ids->unixid = NULL;
+        ids->status = ID_UNKNOWN;
+        ZERO_STRUCT(ids->xid);
         ctx = wbc_sids_to_xids_send(wbc_ctx, ids, 1, ids);
         NT_STATUS_HAVE_NO_MEMORY(ctx);
@@ -67 +67 @@
         NT_STATUS_NOT_OK_RETURN(status);
 
-        if (ids->unixid->type == ID_TYPE_BOTH ||
-            ids->unixid->type == ID_TYPE_UID) {
-                *r->out.uid = ids->unixid->id;
+        if (ids->xid.type == ID_TYPE_BOTH ||
+            ids->xid.type == ID_TYPE_UID) {
+                *r->out.uid = ids->xid.id;
                 return NT_STATUS_OK;
         } else {
@@ -83 +83 @@
                                                 dce_call->context->private_data,
                                                 struct wbc_context);
-        struct id_mapping *ids;
+        struct id_map *ids;
         struct composite_context *ctx;
         uint32_t uid;
@@ -96 +96 @@
         }
 
-        ids = talloc(mem_ctx, struct id_mapping);
+        ids = talloc(mem_ctx, struct id_map);
         NT_STATUS_HAVE_NO_MEMORY(ids);
 
         ids->sid = NULL;
-        ids->status = NT_STATUS_NONE_MAPPED;
-        ids->unixid = talloc(ids, struct unixid);
-        NT_STATUS_HAVE_NO_MEMORY(ids->unixid);
-
-        ids->unixid->id = uid;
-        ids->unixid->type = ID_TYPE_UID;
+        ids->status = ID_UNKNOWN;
+
+        ids->xid.id = uid;
+        ids->xid.type = ID_TYPE_UID;
 
         ctx = wbc_xids_to_sids_send(wbc_ctx, ids, 1, ids);
@@ -125 +123 @@
                                                 dce_call->context->private_data,
                                                 struct wbc_context);
-        struct id_mapping *ids;
+        struct id_map *ids;
         struct composite_context *ctx;
 
         DEBUG(5, ("dcesrv_unixinfo_SidToGid called\n"));
 
-        ids = talloc(mem_ctx, struct  id_mapping);
+        ids = talloc(mem_ctx, struct id_map);
         NT_STATUS_HAVE_NO_MEMORY(ids);
 
         ids->sid = &r->in.sid;
-        ids->status = NT_STATUS_NONE_MAPPED;
-        ids->unixid = NULL;
+        ids->status = ID_UNKNOWN;
+        ZERO_STRUCT(ids->xid);
         ctx = wbc_sids_to_xids_send(wbc_ctx, ids, 1, ids);
         NT_STATUS_HAVE_NO_MEMORY(ctx);
@@ -142 +140 @@
         NT_STATUS_NOT_OK_RETURN(status);
 
-        if (ids->unixid->type == ID_TYPE_BOTH ||
-            ids->unixid->type == ID_TYPE_GID) {
-                *r->out.gid = ids->unixid->id;
+        if (ids->xid.type == ID_TYPE_BOTH ||
+            ids->xid.type == ID_TYPE_GID) {
+                *r->out.gid = ids->xid.id;
                 return NT_STATUS_OK;
         } else {
@@ -158 +156 @@
                                                 dce_call->context->private_data,
                                                 struct wbc_context);
-        struct id_mapping *ids;
+        struct id_map *ids;
         struct composite_context *ctx;
         uint32_t gid;
@@ -171 +169 @@
         }
 
-        ids = talloc(mem_ctx, struct id_mapping);
+        ids = talloc(mem_ctx, struct id_map);
         NT_STATUS_HAVE_NO_MEMORY(ids);
 
         ids->sid = NULL;
-        ids->status = NT_STATUS_NONE_MAPPED;
-        ids->unixid = talloc(ids, struct unixid);
-        NT_STATUS_HAVE_NO_MEMORY(ids->unixid);
-
-        ids->unixid->id = gid;
-        ids->unixid->type = ID_TYPE_GID;
+        ids->status = ID_UNKNOWN;
+
+        ids->xid.id = gid;
+        ids->xid.type = ID_TYPE_GID;
 
         ctx = wbc_xids_to_sids_send(wbc_ctx, ids, 1, ids);
@@ -196 +192 @@
                                   struct unixinfo_GetPWUid *r)
 {
-        int i;
+        unsigned int i;
 
         *r->out.count = 0;

trunk/server/source4/rpc_server/winreg/rpc_winreg.c

@@ -26 +26 @@
 #include "librpc/gen_ndr/ndr_winreg.h"
 #include "librpc/gen_ndr/ndr_security.h"
-#include "libcli/security/security.h"
+#include "libcli/security/session.h"
 
 enum handle_types { HTYPE_REGVAL, HTYPE_REGKEY };
@@ -37 +37 @@
 
         err = reg_open_samba(dce_call->context,
-                             &ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info,
+                             &ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx,
+                             dce_call->conn->auth_state.session_info,
                              NULL);
 
@@ -61 +62 @@
 
         h = dcesrv_handle_new(dce_call->context, HTYPE_REGKEY);
+        W_ERROR_HAVE_NO_MEMORY(h);
 
         result = reg_get_predefined_key(ctx, hkey,
@@ -98 +100 @@
         DCESRV_PULL_HANDLE_FAULT(h, r->in.handle, HTYPE_REGKEY);
 
-        talloc_free(h);
+        talloc_unlink(dce_call->context, h);
 
         ZERO_STRUCTP(r->out.handle);
@@ -122 +124 @@
         newh = dcesrv_handle_new(dce_call->context, HTYPE_REGKEY);
 
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
         {
         case SECURITY_SYSTEM:
         case SECURITY_ADMINISTRATOR:
+                /* we support only non volatile keys */
+                if (r->in.options != REG_OPTION_NON_VOLATILE) {
+                        return WERR_NOT_SUPPORTED;
+                }
+
                 /* the security descriptor is optional */
                 if (r->in.secdesc != NULL) {
@@ -135 +142 @@
                                 return WERR_INVALID_PARAM;
                         }
-                        ndr_err = ndr_pull_struct_blob_all(&sdblob, mem_ctx, NULL, &sd,
+                        ndr_err = ndr_pull_struct_blob_all(&sdblob, mem_ctx, &sd,
                                                            (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -144 +151 @@
                 result = reg_key_add_name(newh, key, r->in.name.name, NULL,
                         r->in.secdesc?&sd:NULL, (struct registry_key **)&newh->data);
+
+                r->out.action_taken = talloc(mem_ctx, enum winreg_CreateAction);
+                if (r->out.action_taken == NULL) {
+                        talloc_free(newh);
+                        return WERR_NOMEM;
+                }
+                *r->out.action_taken = REG_ACTION_NONE;
+
                 if (W_ERROR_IS_OK(result)) {
                         r->out.new_handle = &newh->wire_handle;
+                        *r->out.action_taken = REG_CREATED_NEW_KEY;
                 } else {
                         talloc_free(newh);
                 }
-                
+
                 return result;
         default:
@@ -166 +182 @@
         struct dcesrv_handle *h;
         struct registry_key *key;
-
-        DCESRV_PULL_HANDLE_FAULT(h, r->in.handle, HTYPE_REGKEY);
-        key = h->data;
-
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+        WERROR result;
+
+        DCESRV_PULL_HANDLE_FAULT(h, r->in.handle, HTYPE_REGKEY);
+        key = h->data;
+
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
         {
         case SECURITY_SYSTEM:
         case SECURITY_ADMINISTRATOR:
-                return reg_key_del(key, r->in.key.name);
+                result = reg_key_del(mem_ctx, key, r->in.key.name);
+                talloc_unlink(dce_call->context, h);
+
+                return result;
         default:
                 return WERR_ACCESS_DENIED;
@@ -194 +214 @@
         key = h->data;
 
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
         {
         case SECURITY_SYSTEM:
         case SECURITY_ADMINISTRATOR:
-                return reg_del_value(key, r->in.value.name);
+                return reg_del_value(mem_ctx, key, r->in.value.name);
         default:
                 return WERR_ACCESS_DENIED;
@@ -282 +302 @@
         }
 
-        /* check if there is enough room for the name */
-        if (r->in.name->size < 2*strlen_m_term(data_name)) {
-                return WERR_MORE_DATA;
-        }
-
         /* "data_name" is NULL when we query the default attribute */
         if (data_name != NULL) {
@@ -297 +312 @@
         r->out.name->size = r->in.name->size;
 
-        r->out.type = talloc(mem_ctx, uint32_t);
+        r->out.type = talloc(mem_ctx, enum winreg_Type);
         if (!r->out.type) {
                 return WERR_NOMEM;
         }
-        *r->out.type = data_type;
+        *r->out.type = (enum winreg_Type) data_type;
 
         /* check the client has enough room for the value */
@@ -337 +352 @@
         key = h->data;
 
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
         {
         case SECURITY_SYSTEM:
@@ -399 +414 @@
         key = h->data;
 
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
         {
         case SECURITY_SYSTEM:
@@ -422 +437 @@
                 return WERR_ACCESS_DENIED;
         }
-
 }
 
@@ -441 +455 @@
         key = h->data;
 
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
         {
         case SECURITY_SYSTEM:
@@ -451 +465 @@
                         r->out.max_valnamelen, r->out.max_valbufsize);
 
+                if (r->out.max_subkeylen != NULL) {
+                        /* for UTF16 encoding */
+                        *r->out.max_subkeylen *= 2;
+                }
+                if (r->out.max_valnamelen != NULL) {
+                        /* for UTF16 encoding */
+                        *r->out.max_valnamelen *= 2;
+                }
+
                 if (classname != NULL) {
                         r->out.classname->name = classname;
@@ -483 +506 @@
         key = h->data;
 
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
         {
         case SECURITY_SYSTEM:
         case SECURITY_ADMINISTRATOR:
         case SECURITY_USER:
+                if ((r->in.type == NULL) || (r->in.data_length == NULL) ||
+                    (r->in.data_size == NULL)) {
+                        return WERR_INVALID_PARAM;
+                }
+
                 result = reg_key_get_value_by_name(mem_ctx, key, 
                          r->in.value_name->name, &value_type, &value_data);
@@ -496 +524 @@
                         value_data.data = r->in.data;
                         value_data.length = *r->in.data_length;
-                }
-
-                r->out.type = talloc(mem_ctx, uint32_t);
+                } else {
+                        if ((r->in.data != NULL)
+                            && (*r->in.data_size < value_data.length)) {
+                                result = WERR_MORE_DATA;
+                        }
+                }
+
+                r->out.type = talloc(mem_ctx, enum winreg_Type);
                 if (!r->out.type) {
                         return WERR_NOMEM;
                 }
-                *r->out.type = value_type;
+                *r->out.type = (enum winreg_Type) value_type;
                 r->out.data_length = talloc(mem_ctx, uint32_t);
                 if (!r->out.data_length) {
@@ -581 +614 @@
         key = h->data;
 
-        switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+        switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
         {
         case SECURITY_SYSTEM:
@@ -691 +724 @@
 }
 
+/*
+  winreg_DeleteKeyEx
+*/
+static WERROR dcesrv_winreg_DeleteKeyEx(struct dcesrv_call_state *dce_call,
+                                        TALLOC_CTX *mem_ctx,
+                                        struct winreg_DeleteKeyEx *r)
+{
+        return WERR_NOT_SUPPORTED;
+}
 
 /* include the generated boilerplate */

trunk/server/source4/rpc_server/wkssvc/dcesrv_wkssvc.c

@@ -23 +23 @@
 #include "rpc_server/dcerpc_server.h"
 #include "librpc/gen_ndr/ndr_wkssvc.h"
+#include "librpc/gen_ndr/ndr_srvsvc.h"
 #include "rpc_server/common/common.h"
+#include "rpc_server/common/share.h"
 #include "param/param.h"
 
@@ -33 +35 @@
 {
         struct dcesrv_context *dce_ctx = dce_call->conn->dce_ctx;
-        struct dcerpc_server_info *server_info = lp_dcerpc_server_info(mem_ctx, dce_ctx->lp_ctx);
-
-        ZERO_STRUCT(r->out);
-        r->out.info = talloc_zero(mem_ctx, union wkssvc_NetWkstaInfo);
-        W_ERROR_HAVE_NO_MEMORY(r->out.info);
+        struct dcerpc_server_info *server_info = lpcfg_dcerpc_server_info(mem_ctx, dce_ctx->lp_ctx);
 
         /* NOTE: win2k3 ignores r->in.server_name completly so we do --metze */
@@ -52 +50 @@
                 info100->server_name    = dcesrv_common_get_server_name(mem_ctx, dce_ctx, NULL);
                 W_ERROR_HAVE_NO_MEMORY(info100->server_name);
-                info100->domain_name    = talloc_reference(mem_ctx, server_info->domain_name);
-                W_ERROR_HAVE_NO_MEMORY(info100->domain_name);
+                info100->domain_name    = server_info->domain_name;
                 info100->version_major  = server_info->version_major;
                 info100->version_minor  = server_info->version_minor;
@@ -70 +67 @@
                 info101->server_name    = dcesrv_common_get_server_name(mem_ctx, dce_ctx, NULL);
                 W_ERROR_HAVE_NO_MEMORY(info101->server_name);
-                info101->domain_name    = talloc_reference(mem_ctx, server_info->domain_name);
-                W_ERROR_HAVE_NO_MEMORY(info101->domain_name);
+                info101->domain_name    = server_info->domain_name;
                 info101->version_major  = server_info->version_major;
                 info101->version_minor  = server_info->version_minor;
@@ -90 +86 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }
 
@@ -141 +135 @@
                        struct wkssvc_NetWkstaTransportEnum *r)
 {
-        r->out.total_entries = 0;
-        r->out.resume_handle = NULL;
-
         switch (r->in.info->level) {
         case 0:
-                r->out.info = talloc(mem_ctx, struct wkssvc_NetWkstaTransportInfo);
-                W_ERROR_HAVE_NO_MEMORY(r->out.info);
-                r->out.info->level = r->in.info->level;
                 r->out.info->ctr.ctr0 = talloc(mem_ctx, struct wkssvc_NetWkstaTransportCtr0);
                 W_ERROR_HAVE_NO_MEMORY(r->out.info->ctr.ctr0);
@@ -160 +148 @@
                 return WERR_UNKNOWN_LEVEL;
         }
-
-        return WERR_UNKNOWN_LEVEL;
 }