Changeset 988 for vendor/current/source3/utils

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source3/utils

Files:

• dbwrap_tool.c (modified) (20 diffs)
• dbwrap_torture.c (modified) (16 diffs)
• eventlogadm.c (modified) (12 diffs)
• interact.c (added)
• interact.h (added)
• log2pcaphex.c (modified) (10 diffs)
• net.c (modified) (20 diffs)
• net.h (modified) (5 diffs)
• net_ads.c (modified) (39 diffs)
• net_ads_gpo.c (modified) (16 diffs)
• net_afs.c (modified) (2 diffs)
• net_cache.c (modified) (1 diff)
• net_conf.c (modified) (11 diffs)
• net_conf_util.c (added)
• net_conf_util.h (added)
• net_dns.c (modified) (2 diffs)
• net_dom.c (modified) (6 diffs)
• net_file.c (modified) (1 diff)
• net_g_lock.c (modified) (6 diffs)
• net_group.c (modified) (1 diff)
• net_groupmap.c (modified) (39 diffs)
• net_help.c (modified) (1 diff)
• net_idmap.c (modified) (32 diffs)
• net_idmap_check.c (modified) (27 diffs)
• net_join.c (modified) (1 diff)
• net_lookup.c (modified) (10 diffs)
• net_notify.c (added)
• net_printing.c (modified) (1 diff)
• net_proto.h (modified) (7 diffs)
• net_rap.c (modified) (15 diffs)
• net_registry.c (modified) (26 diffs)
• net_registry_check.c (added)
• net_registry_check.h (added)
• net_registry_util.c (modified) (3 diffs)
• net_rpc.c (modified) (147 diffs)
• net_rpc_audit.c (modified) (5 diffs)
• net_rpc_conf.c (added)
• net_rpc_join.c (deleted)
• net_rpc_printer.c (modified) (56 diffs)
• net_rpc_registry.c (modified) (37 diffs)
• net_rpc_rights.c (modified) (11 diffs)
• net_rpc_samsync.c (modified) (11 diffs)
• net_rpc_service.c (modified) (20 diffs)
• net_rpc_sh_acct.c (modified) (1 diff)
• net_rpc_shell.c (modified) (4 diffs)
• net_rpc_trust.c (modified) (13 diffs)
• net_sam.c (modified) (52 diffs)
• net_serverid.c (modified) (6 diffs)
• net_share.c (modified) (1 diff)
• net_status.c (modified) (11 diffs)
• net_time.c (modified) (8 diffs)
• net_user.c (modified) (1 diff)
• net_usershare.c (modified) (22 diffs)
• net_util.c (modified) (18 diffs)
• netlookup.c (modified) (4 diffs)
• nmblookup.c (modified) (14 diffs)
• ntlm_auth.c (modified) (42 diffs)
• ntlm_auth_diagnostics.c (modified) (11 diffs)
• ntlm_auth_proto.h (modified) (1 diff)
• passwd_util.c (modified) (2 diffs)
• pdbedit.c (modified) (22 diffs)
• profiles.c (modified) (5 diffs)
• regedit.c (added)
• regedit.h (added)
• regedit_dialog.c (added)
• regedit_dialog.h (added)
• regedit_hexedit.c (added)
• regedit_hexedit.h (added)
• regedit_list.c (added)
• regedit_list.h (added)
• regedit_samba3.c (added)
• regedit_treeview.c (added)
• regedit_treeview.h (added)
• regedit_valuelist.c (added)
• regedit_valuelist.h (added)
• regedit_wrap.c (added)
• sharesec.c (modified) (21 diffs)
• smbcacls.c (modified) (30 diffs)
• smbcontrol.c (modified) (70 diffs)
• smbcquotas.c (modified) (12 diffs)
• smbfilter.c (modified) (8 diffs)
• smbget.c (modified) (26 diffs)
• smbpasswd.c (modified) (15 diffs)
• smbta-util.c (deleted)
• smbtree.c (modified) (9 diffs)
• smbw_sample.c (deleted)
• split_tokens.c (modified) (2 diffs)
• status.c (modified) (26 diffs)
• status_profile.c (modified) (10 diffs)
• status_profile.h (added)
• status_profile_dummy.c (added)
• testparm.c (modified) (22 diffs)

vendor/current/source3/utils/dbwrap_tool.c

@@ -5 +5 @@
 
    Copyright (C) 2009 Michael Adam <obnox@samba.org>
+   Copyright (C) 2011 Bjoern Baumbach <bb@sernet.de>
 
    This program is free software; you can redistribute it and/or modify
@@ -22 +23 @@
 #include "includes.h"
 #include "system/filesys.h"
-#include "dbwrap.h"
+#include "popt_common.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
+#include "dbwrap/dbwrap_watch.h"
 #include "messages.h"
-
-typedef enum { OP_FETCH, OP_STORE, OP_DELETE, OP_ERASE, OP_LISTKEYS } dbwrap_op;
-
-typedef enum { TYPE_INT32, TYPE_UINT32 } dbwrap_type;
+#include "util_tdb.h"
+
+enum dbwrap_op { OP_FETCH, OP_STORE, OP_DELETE, OP_ERASE, OP_LISTKEYS,
+                 OP_LISTWATCHERS, OP_EXISTS };
+
+enum dbwrap_type { TYPE_INT32, TYPE_UINT32, TYPE_STRING, TYPE_HEX, TYPE_NONE };
 
 static int dbwrap_tool_fetch_int32(struct db_context *db,
                                    const char *keyname,
-                                   void *data)
+                                   const char *data)
 {
         int32_t value;
-
-        value = dbwrap_fetch_int32(db, keyname);
+        NTSTATUS status;
+
+        status = dbwrap_fetch_int32_bystring(db, keyname, &value);
+        if (!NT_STATUS_IS_OK(status)) {
+                d_printf("Error fetching int32 from key '%s': %s\n",
+                         keyname, nt_errstr(status));
+                return -1;
+        }
         d_printf("%d\n", value);
 
@@ -43 +55 @@
 static int dbwrap_tool_fetch_uint32(struct db_context *db,
                                     const char *keyname,
-                                    void *data)
+                                    const char *data)
 {
         uint32_t value;
-        bool ret;
-
-        ret = dbwrap_fetch_uint32(db, keyname, &value);
-        if (ret) {
+        NTSTATUS ret;
+
+        ret = dbwrap_fetch_uint32_bystring(db, keyname, &value);
+        if (NT_STATUS_IS_OK(ret)) {
                 d_printf("%u\n", value);
                 return 0;
         } else {
-                d_fprintf(stderr, "ERROR: could not fetch uint32 key '%s'\n",
-                          keyname);
-                return -1;
-        }
+                d_fprintf(stderr, "ERROR: could not fetch uint32 key '%s': "
+                          "%s\n", nt_errstr(ret), keyname);
+                return -1;
+        }
+}
+
+static int dbwrap_tool_fetch_string(struct db_context *db,
+                                    const char *keyname,
+                                    const char *data)
+{
+        TDB_DATA tdbdata;
+        NTSTATUS status;
+        TALLOC_CTX *tmp_ctx = talloc_stackframe();
+        int ret;
+
+        status = dbwrap_fetch_bystring(db, tmp_ctx, keyname, &tdbdata);
+        if (NT_STATUS_IS_OK(status)) {
+                d_printf("%-*.*s\n", (int)tdbdata.dsize, (int)tdbdata.dsize,
+                         tdbdata.dptr);
+                ret = 0;
+        } else {
+                d_fprintf(stderr, "ERROR: could not fetch string key '%s': "
+                          "%s\n", nt_errstr(status), keyname);
+                ret = -1;
+        }
+
+        talloc_free(tmp_ctx);
+        return ret;
+}
+
+static int dbwrap_tool_fetch_hex(struct db_context *db,
+                                 const char *keyname,
+                                 const char *data)
+{
+        TDB_DATA tdbdata;
+        DATA_BLOB datablob;
+        NTSTATUS status;
+        TALLOC_CTX *tmp_ctx = talloc_stackframe();
+        char *hex_string;
+        int ret;
+
+        status = dbwrap_fetch_bystring(db, tmp_ctx, keyname, &tdbdata);
+        if (NT_STATUS_IS_OK(status)) {
+                datablob.data = tdbdata.dptr;
+                datablob.length = tdbdata.dsize;
+
+                hex_string = data_blob_hex_string_upper(tmp_ctx, &datablob);
+                if (hex_string == NULL) {
+                        d_fprintf(stderr, "ERROR: could not get hex string "
+                                  "from data blob\n");
+                        ret = -1;
+                } else {
+                        d_printf("%s\n", hex_string);
+                        ret =  0;
+                }
+        } else {
+                d_fprintf(stderr, "ERROR: could not fetch hex key '%s': "
+                          "%s\n", nt_errstr(status), keyname);
+                ret = -1;
+        }
+
+        talloc_free(tmp_ctx);
+        return ret;
 }
 
 static int dbwrap_tool_store_int32(struct db_context *db,
                                    const char *keyname,
-                                   void *data)
-{
-        NTSTATUS status;
-        int32_t value = *((int32_t *)data);
-
-        status = dbwrap_trans_store_int32(db, keyname, value);
-
+                                   const char *data)
+{
+        NTSTATUS status;
+        int32_t value = (int32_t)strtol(data, NULL, 10);
+
+        if (dbwrap_is_persistent(db)) {
+                status = dbwrap_trans_store_int32_bystring(db, keyname, value);
+        } else {
+                status = dbwrap_store_int32_bystring(db, keyname, value);
+        }
         if (!NT_STATUS_IS_OK(status)) {
                 d_fprintf(stderr, "ERROR: could not store int32 key '%s': %s\n",
@@ -79 +153 @@
 static int dbwrap_tool_store_uint32(struct db_context *db,
                                     const char *keyname,
-                                    void *data)
-{
-        NTSTATUS status;
-        uint32_t value = *((uint32_t *)data);
-
-        status = dbwrap_trans_store_uint32(db, keyname, value);
-
+                                    const char *data)
+{
+        NTSTATUS status;
+        uint32_t value = (uint32_t)strtol(data, NULL, 10);
+
+        if (dbwrap_is_persistent(db)) {
+                status = dbwrap_trans_store_uint32_bystring(db, keyname, value);
+        } else {
+                status = dbwrap_store_uint32_bystring(db, keyname, value);
+        }
         if (!NT_STATUS_IS_OK(status)) {
                 d_fprintf(stderr,
@@ -96 +173 @@
 }
 
+static int dbwrap_tool_store_string(struct db_context *db,
+                                    const char *keyname,
+                                    const char *data)
+{
+        NTSTATUS status;
+        TDB_DATA tdbdata;
+
+        tdbdata = string_term_tdb_data(data);
+
+        if (dbwrap_is_persistent(db)) {
+                status = dbwrap_trans_store_bystring(db, keyname,
+                                                     tdbdata,
+                                                     TDB_REPLACE);
+        } else {
+                status = dbwrap_store_bystring(db, keyname,
+                                              tdbdata,
+                                              TDB_REPLACE);
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                d_fprintf(stderr,
+                          "ERROR: could not store string key '%s': %s\n",
+                          keyname, nt_errstr(status));
+                return -1;
+        }
+
+        return 0;
+}
+
+static int dbwrap_tool_store_hex(struct db_context *db,
+                                    const char *keyname,
+                                    const char *data)
+{
+        NTSTATUS status;
+        DATA_BLOB datablob;
+        TDB_DATA tdbdata;
+        TALLOC_CTX *tmp_ctx = talloc_stackframe();
+
+        datablob = strhex_to_data_blob(tmp_ctx, data);
+        if(strlen(data) > 0 && datablob.length == 0) {
+                d_fprintf(stderr,
+                          "ERROR: could not convert hex string to data blob\n"
+                          "       Not a valid hex string?\n");
+                talloc_free(tmp_ctx);
+                return -1;
+        }
+
+        tdbdata.dptr = (unsigned char *)datablob.data;
+        tdbdata.dsize = datablob.length;
+
+        if (dbwrap_is_persistent(db)) {
+                status = dbwrap_trans_store_bystring(db, keyname,
+                                                     tdbdata,
+                                                     TDB_REPLACE);
+        } else {
+                status = dbwrap_store_bystring(db, keyname,
+                                               tdbdata,
+                                               TDB_REPLACE);
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                d_fprintf(stderr,
+                          "ERROR: could not store string key '%s': %s\n",
+                          keyname, nt_errstr(status));
+                talloc_free(tmp_ctx);
+                return -1;
+        }
+
+        talloc_free(tmp_ctx);
+        return 0;
+}
+
 static int dbwrap_tool_delete(struct db_context *db,
                               const char *keyname,
-                              void *data)
-{
-        NTSTATUS status;
-
-        status = dbwrap_trans_delete_bystring(db, keyname);
+                              const char *data)
+{
+        NTSTATUS status;
+
+        if (dbwrap_is_persistent(db)) {
+                status = dbwrap_trans_delete_bystring(db, keyname);
+        } else {
+                status = dbwrap_delete_bystring(db, keyname);
+        }
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -113 +264 @@
 }
 
+static int dbwrap_tool_exists(struct db_context *db,
+                              const char *keyname,
+                              const char *data)
+{
+        bool result;
+
+        result = dbwrap_exists(db, string_term_tdb_data(keyname));
+
+        if (result) {
+                d_fprintf(stdout, "Key %s exists\n", keyname);
+        } else {
+                d_fprintf(stdout, "Key %s does not exist\n", keyname);
+        }
+
+        return (result)?0:1;
+}
+
+
 static int delete_fn(struct db_record *rec, void *priv)
 {
-        rec->delete_rec(rec);
+        dbwrap_record_delete(rec);
         return 0;
 }
@@ -125 +294 @@
 static int dbwrap_tool_erase(struct db_context *db,
                              const char *keyname,
-                             void *data)
-{
-        int ret;
-
-        ret = db->traverse(db, delete_fn, NULL);
-
-        if (ret < 0) {
+                             const char *data)
+{
+        NTSTATUS status;
+
+        status = dbwrap_traverse(db, delete_fn, NULL, NULL);
+
+        if (!NT_STATUS_IS_OK(status)) {
                 d_fprintf(stderr, "ERROR erasing the database\n");
                 return -1;
@@ -141 +310 @@
 static int listkey_fn(struct db_record *rec, void *private_data)
 {
-        int length = rec->key.dsize;
-        unsigned char *p = (unsigned char *)rec->key.dptr;
+        int length = dbwrap_record_get_key(rec).dsize;
+        unsigned char *p = (unsigned char *)dbwrap_record_get_key(rec).dptr;
 
         while (length--) {
@@ -160 +329 @@
 static int dbwrap_tool_listkeys(struct db_context *db,
                                 const char *keyname,
-                                void *data)
-{
-        int ret;
-
-        ret = db->traverse_read(db, listkey_fn, NULL);
-
-        if (ret < 0) {
+                                const char *data)
+{
+        NTSTATUS status;
+
+        status = dbwrap_traverse_read(db, listkey_fn, NULL, NULL);
+
+        if (!NT_STATUS_IS_OK(status)) {
                 d_fprintf(stderr, "ERROR listing db keys\n");
                 return -1;
@@ -174 +343 @@
 }
 
+static int dbwrap_tool_listwatchers_cb(const uint8_t *db_id, size_t db_id_len,
+                                       const TDB_DATA key,
+                                       const struct server_id *watchers,
+                                       size_t num_watchers,
+                                       void *private_data)
+{
+        uint32_t i;
+        dump_data_file(db_id, db_id_len, false, stdout);
+        dump_data_file(key.dptr, key.dsize, false, stdout);
+
+        for (i=0; i<num_watchers; i++) {
+                struct server_id_buf idbuf;
+                printf("%s\n", server_id_str_buf(watchers[i], &idbuf));
+        }
+        printf("\n");
+        return 0;
+}
+
+
+static int dbwrap_tool_listwatchers(struct db_context *db,
+                                    const char *keyname,
+                                    const char *data)
+{
+        dbwrap_watchers_traverse_read(dbwrap_tool_listwatchers_cb, NULL);
+        return 0;
+}
+
 struct dbwrap_op_dispatch_table {
-        dbwrap_op op;
-        dbwrap_type type;
+        enum dbwrap_op op;
+        enum dbwrap_type type;
         int (*cmd)(struct db_context *db,
                    const char *keyname,
-                   void *data);
+                   const char *data);
 };
 
@@ -185 +381 @@
         { OP_FETCH,  TYPE_INT32,  dbwrap_tool_fetch_int32 },
         { OP_FETCH,  TYPE_UINT32, dbwrap_tool_fetch_uint32 },
+        { OP_FETCH,  TYPE_STRING, dbwrap_tool_fetch_string },
+        { OP_FETCH,  TYPE_HEX,    dbwrap_tool_fetch_hex },
         { OP_STORE,  TYPE_INT32,  dbwrap_tool_store_int32 },
         { OP_STORE,  TYPE_UINT32, dbwrap_tool_store_uint32 },
+        { OP_STORE,  TYPE_STRING, dbwrap_tool_store_string },
+        { OP_STORE,  TYPE_HEX,    dbwrap_tool_store_hex },
         { OP_DELETE, TYPE_INT32,  dbwrap_tool_delete },
         { OP_ERASE,  TYPE_INT32,  dbwrap_tool_erase },
         { OP_LISTKEYS, TYPE_INT32, dbwrap_tool_listkeys },
+        { OP_LISTWATCHERS, TYPE_NONE, dbwrap_tool_listwatchers },
+        { OP_EXISTS, TYPE_STRING, dbwrap_tool_exists },
         { 0, 0, NULL },
 };
@@ -203 +405 @@
         const char *dbname;
         const char *opname;
-        dbwrap_op op;
+        enum dbwrap_op op;
         const char *keyname = "";
         const char *keytype = "int32";
-        dbwrap_type type;
+        enum dbwrap_type type;
         const char *valuestr = "0";
-        int32_t value = 0;
+        int persistent = 0;
+        int non_persistent = 0;
+        int tdb_flags = TDB_DEFAULT;
 
         TALLOC_CTX *mem_ctx = talloc_stackframe();
@@ -214 +418 @@
         int ret = 1;
 
-        load_case_tables();
+        struct poptOption popt_options[] = {
+                POPT_AUTOHELP
+                POPT_COMMON_SAMBA
+                { "non-persistent", 0, POPT_ARG_NONE, &non_persistent, 0,
+                  "treat the database as non-persistent "
+                  "(CAVEAT: This mode might wipe your database!)",
+                  NULL },
+                { "persistent", 0, POPT_ARG_NONE, &persistent, 0,
+                  "treat the database as persistent",
+                  NULL },
+                POPT_TABLEEND
+        };
+        int opt;
+        const char **extra_argv;
+        int extra_argc = 0;
+        poptContext pc;
+
+        smb_init_locale();
         lp_set_cmdline("log level", "0");
         setup_logging(argv[0], DEBUG_STDERR);
-        lp_load(get_dyn_CONFIGFILE(), true, false, false, true);
-
-        if ((argc < 3) || (argc > 6)) {
+
+        pc = poptGetContext(argv[0], argc, argv, popt_options, POPT_CONTEXT_KEEP_FIRST);
+
+        while ((opt = poptGetNextOpt(pc)) != -1) {
+                switch (opt) {
+                default:
+                        fprintf(stderr, "Invalid option %s: %s\n",
+                                poptBadOption(pc, 0), poptStrerror(opt));
+                        goto done;
+                }
+        }
+
+        /* setup the remaining options for the main program to use */
+        extra_argv = poptGetArgs(pc);
+        if (extra_argv) {
+                extra_argv++;
+                while (extra_argv[extra_argc]) extra_argc++;
+        }
+
+        lp_load_global(get_dyn_CONFIGFILE());
+
+        if ((extra_argc < 2) || (extra_argc > 5)) {
                 d_fprintf(stderr,
-                          "USAGE: %s <database> <op> [<key> [<type> [<value>]]]\n"
-                          "       ops: fetch, store, delete, erase, listkeys\n"
-                          "       types: int32, uint32\n",
+                          "USAGE: %s [options] <database> <op> [<key> [<type> "
+                          "[<value>]]]\n"
+                          "       ops: fetch, store, delete, exists, "
+                          "erase, listkeys, listwatchers\n"
+                          "       types: int32, uint32, string, hex\n",
                          argv[0]);
                 goto done;
         }
 
-        dbname = argv[1];
-        opname = argv[2];
+        if ((persistent == 0 && non_persistent == 0) ||
+            (persistent == 1 && non_persistent == 1))
+        {
+                d_fprintf(stderr, "ERROR: you must specify exactly one "
+                          "of --persistent and --non-persistent\n");
+                goto done;
+        } else if (non_persistent == 1) {
+                tdb_flags |= TDB_CLEAR_IF_FIRST;
+        }
+
+        dbname = extra_argv[0];
+        opname = extra_argv[1];
 
         if (strcmp(opname, "store") == 0) {
-                if (argc != 6) {
+                if (extra_argc != 5) {
                         d_fprintf(stderr, "ERROR: operation 'store' requires "
                                   "value argument\n");
                         goto done;
                 }
-                valuestr = argv[5];
-                keytype = argv[4];
-                keyname = argv[3];
+                valuestr = extra_argv[4];
+                keytype = extra_argv[3];
+                keyname = extra_argv[2];
                 op = OP_STORE;
         } else if (strcmp(opname, "fetch") == 0) {
-                if (argc != 5) {
+                if (extra_argc != 4) {
                         d_fprintf(stderr, "ERROR: operation 'fetch' requires "
                                   "type but not value argument\n");
@@ -248 +500 @@
                 }
                 op = OP_FETCH;
-                keytype = argv[4];
-                keyname = argv[3];
+                keytype = extra_argv[3];
+                keyname = extra_argv[2];
         } else if (strcmp(opname, "delete") == 0) {
-                if (argc != 4) {
+                if (extra_argc != 3) {
                         d_fprintf(stderr, "ERROR: operation 'delete' does "
                                   "not allow type nor value argument\n");
                         goto done;
                 }
-                keyname = argv[3];
+                keyname = extra_argv[2];
                 op = OP_DELETE;
         } else if (strcmp(opname, "erase") == 0) {
-                if (argc != 3) {
+                if (extra_argc != 2) {
                         d_fprintf(stderr, "ERROR: operation 'erase' does "
                                   "not take a key argument\n");
@@ -266 +518 @@
                 op = OP_ERASE;
         } else if (strcmp(opname, "listkeys") == 0) {
-                if (argc != 3) {
+                if (extra_argc != 2) {
                         d_fprintf(stderr, "ERROR: operation 'listkeys' does "
                                   "not take a key argument\n");
@@ -272 +524 @@
                 }
                 op = OP_LISTKEYS;
+        } else if (strcmp(opname, "listwatchers") == 0) {
+                if (extra_argc != 2) {
+                        d_fprintf(stderr, "ERROR: operation 'listwatchers' "
+                                  "does not take an argument\n");
+                        goto done;
+                }
+                op = OP_LISTWATCHERS;
+                keytype = "none";
+        } else if (strcmp(opname, "exists") == 0) {
+                if (extra_argc != 3) {
+                        d_fprintf(stderr, "ERROR: operation 'exists' does "
+                                  "not allow type nor value argument\n");
+                        goto done;
+                }
+                keyname = extra_argv[2];
+                op = OP_EXISTS;
+                keytype = "string";
         } else {
                 d_fprintf(stderr,
                           "ERROR: invalid op '%s' specified\n"
-                          "       supported ops: fetch, store, delete\n",
+                          "       supported ops: fetch, store, delete, exists, "
+                          "erase, listkeys, listwatchers\n",
                           opname);
                 goto done;
@@ -282 +552 @@
         if (strcmp(keytype, "int32") == 0) {
                 type = TYPE_INT32;
-                value = (int32_t)strtol(valuestr, NULL, 10);
         } else if (strcmp(keytype, "uint32") == 0) {
                 type = TYPE_UINT32;
-                value = (int32_t)strtoul(valuestr, NULL, 10);
+        } else if (strcmp(keytype, "string") == 0) {
+                type = TYPE_STRING;
+        } else if (strcmp(keytype, "hex") == 0) {
+                type = TYPE_HEX;
+        } else if (strcmp(keytype, "none") == 0) {
+                type = TYPE_NONE;
         } else {
                 d_fprintf(stderr, "ERROR: invalid type '%s' specified.\n"
-                                  "       supported types: int32, uint32\n",
+                                  "       supported types: int32, uint32, "
+                                  "string, hex, none\n",
                                   keytype);
                 goto done;
         }
 
-        evt_ctx = tevent_context_init(mem_ctx);
+        evt_ctx = samba_tevent_context_init(mem_ctx);
         if (evt_ctx == NULL) {
                 d_fprintf(stderr, "ERROR: could not init event context\n");
@@ -299 +574 @@
         }
 
-        msg_ctx = messaging_init(mem_ctx, procid_self(), evt_ctx);
+        msg_ctx = messaging_init(mem_ctx, evt_ctx);
         if (msg_ctx == NULL) {
                 d_fprintf(stderr, "ERROR: could not init messaging context\n");
@@ -305 +580 @@
         }
 
-        db = db_open(mem_ctx, dbname, 0, TDB_DEFAULT, O_RDWR | O_CREAT, 0644);
-        if (db == NULL) {
-                d_fprintf(stderr, "ERROR: could not open dbname\n");
-                goto done;
+        switch (op) {
+        case OP_FETCH:
+        case OP_STORE:
+        case OP_DELETE:
+        case OP_ERASE:
+        case OP_LISTKEYS:
+        case OP_EXISTS:
+                db = db_open(mem_ctx, dbname, 0, tdb_flags, O_RDWR | O_CREAT,
+                             0644, DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
+                if (db == NULL) {
+                        d_fprintf(stderr, "ERROR: could not open dbname\n");
+                        goto done;
+                }
+                break;
+        default:
+                db = NULL;
+                break;
         }
 
@@ -315 +603 @@
                     (type == dispatch_table[count].type))
                 {
-                        ret = dispatch_table[count].cmd(db, keyname, &value);
+                        ret = dispatch_table[count].cmd(db, keyname, valuestr);
                         break;
                 }

vendor/current/source3/utils/dbwrap_torture.c

@@ -23 +23 @@
 #include "system/filesys.h"
 #include "popt_common.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
 #include "messages.h"
+#include "lib/util/util_tdb.h"
 
 #if 0
@@ -42 +44 @@
 static int verbose = 0;
 static int no_trans = 0;
-static char *db_name = (char *)discard_const(DEFAULT_DB_NAME);
+static const char *db_name = DEFAULT_DB_NAME;
 
 
@@ -56 +58 @@
         uint32_t *old_counters;
 
-        printf("[%4u] Counters: ", getpid());
+        printf("[%4u] Counters: ", (unsigned int)getpid());
         old_counters = (uint32_t *)old_data.dptr;
         for (i=0; i < old_data.dsize/sizeof(uint32_t); i++) {
@@ -88 +90 @@
                 if (counters[i] < old_counters[i]) {
                         printf("[%4u] ERROR: counters has decreased for node %u  From %u to %u\n",
-                               getpid(), i, old_counters[i], counters[i]);
+                               (unsigned int)getpid(), i, old_counters[i], counters[i]);
                         success = false;
                         return false;
@@ -129 +131 @@
         struct timeval start;
 
-        key.dptr = (unsigned char *)discard_const("testkey");
-        key.dsize = strlen((const char *)key.dptr)+1;
+        key = string_term_tdb_data("testkey");
 
         start = timeval_current();
@@ -136 +137 @@
                 struct db_record *rec;
                 TDB_DATA data;
+                TDB_DATA value;
                 int ret;
                 NTSTATUS status;
@@ -141 +143 @@
                 if (!no_trans) {
                         if (verbose) DEBUG(1, ("starting transaction\n"));
-                        ret = db->transaction_start(db);
+                        ret = dbwrap_transaction_start(db);
                         if (ret != 0) {
                                 DEBUG(0, ("Failed to start transaction on node "
@@ -152 +154 @@
 
                 if (verbose) DEBUG(1, ("calling fetch_lock\n"));
-                rec = db->fetch_locked(db, tmp_ctx, key);
+                rec = dbwrap_fetch_locked(db, tmp_ctx, key);
                 if (rec == NULL) {
                         DEBUG(0, ("Failed to fetch record\n"));
@@ -159 +161 @@
                 if (verbose) DEBUG(1, ("fetched record ok\n"));
                 do_sleep(torture_delay);
-
-                data.dsize = MAX(rec->value.dsize, sizeof(uint32_t) * (pnn+1));
+                value = dbwrap_record_get_value(rec);
+
+                data.dsize = MAX(value.dsize, sizeof(uint32_t) * (pnn+1));
                 data.dptr = (unsigned char *)talloc_zero_size(tmp_ctx,
                                                               data.dsize);
@@ -167 +170 @@
                         goto fail;
                 }
-                memcpy(data.dptr, rec->value.dptr,rec->value.dsize);
+                memcpy(data.dptr, value.dptr, value.dsize);
 
                 counters = (uint32_t *)data.dptr;
@@ -175 +178 @@
 
                 if (verbose) DEBUG(1, ("storing data\n"));
-                status = rec->store(rec, data, TDB_REPLACE);
+                status = dbwrap_record_store(rec, data, TDB_REPLACE);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(0, ("Failed to store record\n"));
                         if (!no_trans) {
-                                ret = db->transaction_cancel(db);
+                                ret = dbwrap_transaction_cancel(db);
                                 if (ret != 0) {
                                         DEBUG(0, ("Error cancelling transaction.\n"));
@@ -192 +195 @@
                 if (!no_trans) {
                         if (verbose) DEBUG(1, ("calling transaction_commit\n"));
-                        ret = db->transaction_commit(db);
+                        ret = dbwrap_transaction_commit(db);
                         if (ret != 0) {
                                 DEBUG(0, ("Failed to commit transaction\n"));
@@ -259 +262 @@
         }
 
-        load_case_tables();
+        smb_init_locale();
 
         setup_logging(argv[0], DEBUG_STDERR);
@@ -282 +285 @@
         }
 
-        lp_load(get_dyn_CONFIGFILE(), true, false, false, true);
-
-        ev_ctx = tevent_context_init(mem_ctx);
+        lp_load_global(get_dyn_CONFIGFILE());
+
+        ev_ctx = samba_tevent_context_init(mem_ctx);
         if (ev_ctx == NULL) {
                 d_fprintf(stderr, "ERROR: could not init event context\n");
@@ -290 +293 @@
         }
 
-        msg_ctx = messaging_init(mem_ctx, procid_self(), ev_ctx);
+        msg_ctx = messaging_init(mem_ctx, ev_ctx);
         if (msg_ctx == NULL) {
                 d_fprintf(stderr, "ERROR: could not init messaging context\n");
@@ -306 +309 @@
         }
 
-        db = db_open(mem_ctx, db_name, 0, tdb_flags,  O_RDWR | O_CREAT, 0644);
+        db = db_open(mem_ctx, db_name, 0, tdb_flags,  O_RDWR | O_CREAT, 0644,
+                     DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
 
         if (db == NULL) {

vendor/current/source3/utils/eventlogadm.c

@@ -26 +26 @@
 #include "lib/eventlog/eventlog.h"
 #include "registry.h"
+#include "registry/reg_api.h"
+#include "registry/reg_init_basic.h"
+#include "registry/reg_util_token.h"
 #include "registry/reg_backend_db.h"
-#include "registry/reg_objects.h"
 #include "../libcli/registry/util_reg.h"
 
@@ -79 +81 @@
         const char **wrklist, **wp;
         char *evtlogpath = NULL;
-        struct regsubkey_ctr *subkeys;
-        struct regval_ctr *values;
-        struct regval_blob *rval;
         int ii = 0;
         bool already_in;
         int i;
         int numsources = 0;
-        TALLOC_CTX *ctx = talloc_tos();
+        TALLOC_CTX *ctx = talloc_stackframe();
         WERROR werr;
-        DATA_BLOB blob;
+        struct registry_key *key_hive, *key_eventlog, *key_source;
+        struct security_token *token = NULL;
+        const char *hive_name, *relpath;
+        enum winreg_CreateAction action;
+        struct registry_value *value;
+        static const uint32_t ACCESS = REG_KEY_READ | REG_KEY_WRITE;
+        bool ret = false;
 
         if (!elogs) {
-                return False;
+                d_printf("No Eventlogs configured\n");
+                goto done;
         }
 
@@ -102 +108 @@
                 d_printf("Eventlog [%s] not found in list of valid event logs\n",
                          eventlog);
-                return false;   /* invalid named passed in */
+                goto done;
         }
 
@@ -110 +116 @@
         /* todo add to Sources */
 
-        werr = regval_ctr_init(ctx, &values);
-        if(!W_ERROR_IS_OK(werr)) {
-                d_printf("talloc() failure!\n");
-                return false;
-        }
-
         evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog);
         if (!evtlogpath) {
-                TALLOC_FREE(values);
-                return false;
-        }
-
-        regdb_fetch_values( evtlogpath, values );
-
-
-        if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) {
-                d_printf("No Sources value for [%s]!\n", eventlog);
-                return False;
+                d_printf("Out of memory\n");
+                goto done;
+        }
+
+        relpath = evtlogpath + sizeof(KEY_EVENTLOG);
+        hive_name = talloc_strndup(ctx, evtlogpath, relpath - evtlogpath);
+        if (!hive_name) {
+                d_printf("Out of memory\n");
+                goto done;
+        }
+        relpath++;
+
+        werr = ntstatus_to_werror(registry_create_admin_token(ctx, &token));
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Failed to create admin token: %s\n", win_errstr(werr));
+                goto done;
+        }
+
+        werr = reg_openhive(ctx, hive_name, ACCESS, token, &key_hive);
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Failed to open hive [%s]: %s\n", hive_name, win_errstr(werr));
+                goto done;
+        }
+
+        werr = reg_openkey(ctx, key_hive, relpath, ACCESS, &key_eventlog);
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Failed to open key [%s]: %s\n", evtlogpath, win_errstr(werr));
+                goto done;
+        }
+
+        werr = reg_queryvalue(ctx, key_eventlog, "Sources", &value);
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Failed to get value \"Sources\" for [%s]: %s\n", evtlogpath, win_errstr(werr));
+                goto done;
         }
         /* perhaps this adding a new string to a multi_sz should be a fn? */
         /* check to see if it's there already */
 
-        if ( regval_type(rval) != REG_MULTI_SZ ) {
-                d_printf("Wrong type for Sources, should be REG_MULTI_SZ\n");
-                return False;
+        if ( value->type != REG_MULTI_SZ ) {
+                d_printf("Wrong type for \"Sources\", should be REG_MULTI_SZ\n");
+                goto done;
         }
         /* convert to a 'regulah' chars to do some comparisons */
 
-        already_in = False;
+        already_in = false;
         wrklist = NULL;
-        dump_data(1, regval_data_p(rval), regval_size(rval));
-
-        blob = data_blob_const(regval_data_p(rval), regval_size(rval));
-        if (!pull_reg_multi_sz(talloc_tos(), &blob, &wrklist)) {
-                return false;
+        dump_data(1, value->data.data, value->data.length);
+
+        if (!pull_reg_multi_sz(ctx, &value->data, &wrklist)) {
+                d_printf("Failed to pull REG_MULTI_SZ from \"Sources\"\n");
+                goto done;
         }
 
@@ -159 +183 @@
                                 d_printf("Source name [%s] already in list for [%s] \n",
                                          sourcename, eventlog);
-                                already_in = True;
+                                already_in = true;
                                 break;
                         }
@@ -168 +192 @@
         }
 
-        wp = wrklist;
-
         if ( !already_in ) {
                 /* make a new list with an additional entry; copy values, add another */
-                wp = TALLOC_ARRAY(ctx, const char *, numsources + 2 );
-
+                wp = talloc_realloc(ctx, wrklist, const char *, numsources + 2 );
                 if ( !wp ) {
-                        d_printf("talloc() failed \n");
-                        return False;
-                }
-                memcpy( wp, wrklist, sizeof( char * ) * numsources );
-                *( wp + numsources ) = ( char * ) sourcename;
-                *( wp + numsources + 1 ) = NULL;
-                if (!push_reg_multi_sz(ctx, &blob, wp)) {
-                        return false;
-                }
-                dump_data( 1, blob.data, blob.length);
-                regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
-                                     blob.data, blob.length);
-                regdb_store_values( evtlogpath, values );
-                data_blob_free(&blob);
+                        d_printf("Out of memory\n");
+                        goto done;
+                }
+
+                wp[numsources] = sourcename;
+                wp[numsources+1] = NULL;
+                if (!push_reg_multi_sz(ctx, &value->data, wp)) {
+                        d_printf("Failed to push Sources\n");
+                        goto done;
+                }
+                dump_data( 1, value->data.data, value->data.length);
+                werr = reg_setvalue(key_eventlog,  "Sources", value);
+                if (!W_ERROR_IS_OK(werr)) {
+                        d_printf("Failed to set value Sources:  %s\n", win_errstr(werr));
+                        goto done;
+                }
         } else {
                 d_printf("Source name [%s] found in existing list of sources\n",
                          sourcename);
         }
-        TALLOC_FREE(values);
-        TALLOC_FREE(wrklist);   /*  */
-
-        werr = regsubkey_ctr_init(ctx, &subkeys);
-        if (!W_ERROR_IS_OK(werr)) {
-                d_printf("talloc() failure!\n");
-                return False;
-        }
-        TALLOC_FREE(evtlogpath);
-        evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog );
-        if (!evtlogpath) {
-                TALLOC_FREE(subkeys);
-                return false;
-        }
-
-        regdb_fetch_keys( evtlogpath, subkeys );
-
-        if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) {
+
+        werr = reg_createkey(ctx, key_eventlog, sourcename, ACCESS, &key_source, &action);
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Failed to create subkey \"%s\" of \"%s\": %s\n", sourcename, evtlogpath, win_errstr(werr));
+                goto done;
+        }
+
+        if (action == REG_CREATED_NEW_KEY) {
                 d_printf(" Source name [%s] for eventlog [%s] didn't exist, adding \n",
                          sourcename, eventlog);
-                regsubkey_ctr_addkey( subkeys, sourcename );
-                if ( !regdb_store_keys( evtlogpath, subkeys ) )
-                        return False;
-        }
-        TALLOC_FREE(subkeys);
+        }
 
         /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
 
-        /* now allocate room for the source's subkeys */
-
-        werr = regsubkey_ctr_init(ctx, &subkeys);
-        if (!W_ERROR_IS_OK(werr)) {
-                d_printf("talloc() failure!\n");
-                return False;
-        }
-        TALLOC_FREE(evtlogpath);
-        evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s",
-                  KEY_EVENTLOG, eventlog, sourcename);
-        if (!evtlogpath) {
-                TALLOC_FREE(subkeys);
-                return false;
-        }
-
-        regdb_fetch_keys( evtlogpath, subkeys );
-
         /* now add the values to the KEY_EVENTLOG/Application form key */
-        werr = regval_ctr_init(ctx, &values);
-        if (!W_ERROR_IS_OK(werr)) {
-                d_printf("talloc() failure!\n");
-                return False;
-        }
         d_printf("Storing EventMessageFile [%s] to eventlog path of [%s]\n",
                  messagefile, evtlogpath);
 
-        regdb_fetch_values( evtlogpath, values );
-
-        regval_ctr_addvalue_sz(values, "EventMessageFile", messagefile);
-        regdb_store_values( evtlogpath, values );
-
-        TALLOC_FREE(values);
-
-        return True;
+        if (!push_reg_sz(ctx, &value->data, messagefile)) {
+                d_printf("Failed to push \"EventMessageFile\"\n");
+                goto done;
+        }
+        value->type = REG_SZ;
+
+        werr = reg_setvalue(key_source, "EventMessageFile", value);
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Failed to set value \"EventMessageFile\":  %s\n", win_errstr(werr));
+                return false;
+        }
+        ret = true;
+done:
+        talloc_free(ctx);
+        return ret;
 }
 
 static int DoAddSourceCommand( int argc, char **argv, bool debugflag, char *exename )
 {
+        WERROR werr;
 
         if ( argc < 3 ) {
@@ -265 +260 @@
                 return -1;
         }
+
         /* must open the registry before we access it */
-        if (!W_ERROR_IS_OK(regdb_init())) {
-                printf( "Can't open the registry.\n" );
-                return -1;
-        }
-
-        if ( !eventlog_add_source( argv[0], argv[1], argv[2] ) )
+        werr = registry_init_common();
+        if (!W_ERROR_IS_OK(werr)) {
+                printf("Can't open the registry: %s.\n", win_errstr(werr));
+                return -1;
+        }
+        werr = regdb_transaction_start();
+        if (!W_ERROR_IS_OK(werr)) {
+                printf("Can't start transaction on registry: %s.\n", win_errstr(werr));
+                return -1;
+        }
+
+        if ( !eventlog_add_source( argv[0], argv[1], argv[2] ) ) {
+                regdb_transaction_cancel();
                 return -2;
+        }
+        werr = regdb_transaction_commit();
+        if (!W_ERROR_IS_OK(werr)) {
+                printf("Failed to commit transaction on registry: %s.\n", win_errstr(werr));
+                return -1;
+        }
         return 0;
 }
@@ -366 +375 @@
         ELOG_TDB *etdb;
         TALLOC_CTX *mem_ctx = talloc_tos();
-        const char *tdb_filename;
         uint32_t count = 1;
 
@@ -372 +380 @@
                 return -1;
         }
-
-        tdb_filename = argv[0];
 
         if (argc > 1) {
@@ -422 +428 @@
         fstring opname;
 
-        load_case_tables();
+        smb_init_locale();
 
         opt_debug = 0;          /* todo set this from getopts */
@@ -468 +474 @@
 
         if ( configfile == NULL ) {
-                lp_load(get_dyn_CONFIGFILE(), True, False, False, True);
-        } else if (!lp_load(configfile, True, False, False, True)) {
+                lp_load_global(get_dyn_CONFIGFILE());
+        } else if (!lp_load_global(configfile)) {
                 printf("Unable to parse configfile '%s'\n",configfile);
                 exit( 1 );
@@ -476 +482 @@
         /*  note that the separate command types should call usage if they need to... */
         while ( 1 ) {
-                if ( !StrCaseCmp( opname, "addsource" ) ) {
+                if ( !strcasecmp_m( opname, "addsource" ) ) {
                         rc = DoAddSourceCommand( argc, argv, opt_debug,
                                                  exename );
                         break;
                 }
-                if ( !StrCaseCmp( opname, "write" ) ) {
+                if ( !strcasecmp_m( opname, "write" ) ) {
                         rc = DoWriteCommand( argc, argv, opt_debug, exename );
                         break;
                 }
-                if ( !StrCaseCmp( opname, "dump" ) ) {
+                if ( !strcasecmp_m( opname, "dump" ) ) {
                         rc = DoDumpCommand( argc, argv, opt_debug, exename );
                         break;

vendor/current/source3/utils/log2pcaphex.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
    Utility to extract pcap files from samba (log level 10) log files
@@ -75 +75 @@
 /* tcpdump file format */
 struct tcpdump_file_header {
-        uint32 magic;
-        uint16 major;
-        uint16 minor;
-        int32 zone;
-        uint32 sigfigs;
-        uint32 snaplen;
-        uint32 linktype;
+        uint32_t magic;
+        uint16_t major;
+        uint16_t minor;
+        int32_t zone;
+        uint32_t sigfigs;
+        uint32_t snaplen;
+        uint32_t linktype;
 };
 
 struct tcpdump_packet {
         struct timeval ts;
-        uint32 caplen;
-        uint32 len;
+        uint32_t caplen;
+        uint32_t len;
 };
 
 typedef struct {
-    uint8  ver_hdrlen;
-    uint8  dscp;
-    uint16 packet_length;
-    uint16 identification;
-    uint8  flags;
-    uint8  fragment;
-    uint8  ttl;
-    uint8  protocol;
-    uint16 hdr_checksum;
-    uint32 src_addr;
-    uint32 dest_addr;
+    uint8_t  ver_hdrlen;
+    uint8_t  dscp;
+    uint16_t packet_length;
+    uint16_t identification;
+    uint8_t  flags;
+    uint8_t  fragment;
+    uint8_t  ttl;
+    uint8_t  protocol;
+    uint16_t hdr_checksum;
+    uint32_t src_addr;
+    uint32_t dest_addr;
 } hdr_ip_t;
 
@@ -107 +107 @@
 
 typedef struct {
-    uint16 source_port;
-    uint16 dest_port;
-    uint32 seq_num;
-    uint32 ack_num;
-    uint8  hdr_length;
-    uint8  flags;
-    uint16 window;
-    uint16 checksum;
-    uint16 urg;
+    uint16_t source_port;
+    uint16_t dest_port;
+    uint32_t seq_num;
+    uint32_t ack_num;
+    uint8_t  hdr_length;
+    uint8_t  flags;
+    uint16_t window;
+    uint16_t checksum;
+    uint16_t urg;
 } hdr_tcp_t;
 
@@ -155 +155 @@
                         fprintf(out, "%02x ", data[i]);
                 }
-        
                 cur = i;
                 fprintf(out, "\n");
@@ -163 +162 @@
 static void print_netbios_packet(FILE *out, unsigned char *data, long length,
                                  long actual_length)
-{       
+{
         unsigned char *newdata; long offset = 0;
         long newlen;
-        
+
         newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP);
         newdata = (unsigned char *)malloc(newlen);
@@ -177 +176 @@
         memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP);
         memcpy(newdata+offset,data,length);
-        
+
         print_pcap_packet(out, newdata, newlen, actual_length+offset);
         free(newdata);
@@ -297 +296 @@
 }
 
-int main (int argc, char **argv)
+int main(int argc, const char **argv)
 {
         const char *infile, *outfile;
@@ -313 +312 @@
                 POPT_TABLEEND
         };
-        
-        pc = poptGetContext(NULL, argc, (const char **) argv, long_options,
+
+        pc = poptGetContext(NULL, argc, argv, long_options,
                             POPT_CONTEXT_KEEP_FIRST);
         poptSetOtherOptionHelp(pc, "[<infile> [<outfile>]]");
-        
-        
+
+
         while((opt = poptGetNextOpt(pc)) != -1) {
                 switch (opt) {
@@ -335 +334 @@
                 }
         } else in = stdin;
-        
+
         outfile = poptGetArg(pc);
 
         if(outfile) {
                 out = fopen(outfile, "w+");
-                if(!out) { 
-                        perror("fopen"); 
+                if(!out) {
+                        perror("fopen");
                         fprintf(stderr, "Can't find %s, using stdout...\n", outfile);
                         return 1;
@@ -360 +359 @@
                         } else if(in_packet && strstr(buffer, "dump_data")) {
                                 data_bytes_read = read_log_data(in, curpacket+data_offset, data_length);
-                        }  else { 
-                                if(in_packet){ 
-                                        if(hexformat) print_hex_packet(out, curpacket, curpacket_len); 
+                        }  else {
+                                if(in_packet){
+                                        if(hexformat) print_hex_packet(out, curpacket, curpacket_len);
                                         else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset);
-                                        free(curpacket); 
+                                        free(curpacket);
                                 }
                                 in_packet = 0;
                         }
-                } 
+                }
         }
 

vendor/current/source3/utils/net.c

@@ -106 +106 @@
 
                 trust_pw = get_pass(_("Enter machine password: "), c->opt_stdin);
+                if (trust_pw == NULL) {
+                            d_fprintf(stderr,
+                                      _("Error in reading machine password\n"));
+                            return 1;
+                }
 
                 if (!secrets_store_machine_password(trust_pw, lp_workgroup(), sec_channel_type)) {
@@ -244 +249 @@
         }
         else {
-                name = global_myname();
+                name = lp_netbios_name();
         }
 
         if(!initialize_password_db(false, NULL)) {
-                DEBUG(0, ("WARNING: Could not open passdb - local sid may not reflect passdb\n"
-                          "backend knowledge (such as the sid stored in LDAP)\n"));
+                d_fprintf(stderr, _("WARNING: Could not open passdb\n"));
+                return 1;
         }
 
@@ -287 +292 @@
         }
 
-        if (!secrets_store_domain_sid(global_myname(), &sid)) {
+        if (!secrets_store_domain_sid(lp_netbios_name(), &sid)) {
                 DEBUG(0,("Can't store domain SID as a pdc/bdc.\n"));
                 return 1;
@@ -328 +333 @@
 
         if(!initialize_password_db(false, NULL)) {
-                DEBUG(0, ("WARNING: Could not open passdb - domain SID may "
-                          "not reflect passdb\n"
-                          "backend knowledge (such as the SID stored in "
-                          "LDAP)\n"));
+                d_fprintf(stderr, _("WARNING: Could not open passdb\n"));
+                return 1;
         }
 
@@ -347 +350 @@
         get_global_sam_sid();
 
-        if (!secrets_fetch_domain_sid(global_myname(), &domain_sid)) {
-                d_fprintf(stderr, _("Could not fetch local SID\n"));
-                return 1;
-        }
-        sid_to_fstring(sid_str, &domain_sid);
-        d_printf(_("SID for local machine %s is: %s\n"),
-                 global_myname(), sid_str);
-
+        if (!IS_DC) {
+                if (!secrets_fetch_domain_sid(lp_netbios_name(), &domain_sid)) {
+                        d_fprintf(stderr, _("Could not fetch local SID\n"));
+                        return 1;
+                }
+                sid_to_fstring(sid_str, &domain_sid);
+                d_printf(_("SID for local machine %s is: %s\n"),
+                         lp_netbios_name(), sid_str);
+        }
         if (!secrets_fetch_domain_sid(c->opt_workgroup, &domain_sid)) {
                 d_fprintf(stderr, _("Could not fetch domain SID\n"));
@@ -367 +371 @@
 
 static bool search_maxrid(struct pdb_search *search, const char *type,
-                          uint32 *max_rid)
+                          uint32_t *max_rid)
 {
         struct samr_displayentry *entries;
-        uint32 i, num_entries;
+        uint32_t i, num_entries;
 
         if (search == NULL) {
@@ -384 +388 @@
 }
 
-static uint32 get_maxrid(void)
-{
-        uint32 max_rid = 0;
+static uint32_t get_maxrid(void)
+{
+        uint32_t max_rid = 0;
 
         if (!search_maxrid(pdb_search_users(talloc_tos(), 0), "users", &max_rid))
@@ -404 +408 @@
 static int net_maxrid(struct net_context *c, int argc, const char **argv)
 {
-        uint32 rid;
+        uint32_t rid;
 
         if (argc != 0) {
@@ -740 +744 @@
         },
 
+        {       "notify",
+                net_notify,
+                NET_TRANSPORT_LOCAL,
+                N_("notifyd client code"),
+                N_("  Use 'net help notify' to get more information about "
+                   "'net notify' commands.")
+        },
+
 #ifdef WITH_FAKE_KASERVER
         {       "afs",
@@ -764 +776 @@
   main program
 ****************************************************************************/
- int main(int argc, const char **argv)
+ int main(int argc, char **argv)
 {
         int opt,i;
@@ -771 +783 @@
         int argc_new = 0;
         const char ** argv_new;
+        const char **argv_const = discard_const_p(const char *, argv);
         poptContext pc;
         TALLOC_CTX *frame = talloc_stackframe();
@@ -783 +796 @@
                 {"myname",      'n', POPT_ARG_STRING, &c->opt_requester_name},
                 {"server",      'S', POPT_ARG_STRING, &c->opt_host},
-                {"encrypt",     'e', POPT_ARG_NONE,   NULL, 'e', N_("Encrypt SMB transport (UNIX extended servers only)") },
+                {"encrypt",     'e', POPT_ARG_NONE,   NULL, 'e', N_("Encrypt SMB transport") },
                 {"container",   'c', POPT_ARG_STRING, &c->opt_container},
                 {"comment",     'C', POPT_ARG_STRING, &c->opt_comment},
@@ -821 +834 @@
                 {"auto", 'a', POPT_ARG_NONE,   &c->opt_auto},
                 {"repair", 0, POPT_ARG_NONE,   &c->opt_repair},
+                /* Options for 'net registry check'*/
+                {"reg-version", 0, POPT_ARG_INT, &c->opt_reg_version},
+                {"output", 'o', POPT_ARG_STRING, &c->opt_output},
+                {"wipe", 0, POPT_ARG_NONE, &c->opt_wipe},
+                /* Options for 'net registry import' */
+                {"precheck", 0, POPT_ARG_STRING, &c->opt_precheck},
+                /* Options for 'net ads join' */
+                {"no-dns-updates", 0, POPT_ARG_NONE, &c->opt_no_dns_updates},
                 POPT_COMMON_SAMBA
                 { 0, 0, 0, 0}
@@ -829 +850 @@
         setup_logging(argv[0], DEBUG_STDERR);
 
-        load_case_tables();
+        smb_init_locale();
 
         setlocale(LC_ALL, "");
@@ -843 +864 @@
         c->private_data = net_func;
 
-        pc = poptGetContext(NULL, argc, (const char **) argv, long_options,
+        pc = poptGetContext(NULL, argc, argv_const, long_options,
                             POPT_CONTEXT_KEEP_FIRST);
 
@@ -864 +885 @@
                 case 'U':
                         c->opt_user_specified = true;
-                        c->opt_user_name = SMB_STRDUP(c->opt_user_name);
+                        c->opt_user_name = talloc_strdup(c, c->opt_user_name);
                         p = strchr(c->opt_user_name,'%');
                         if (p) {
@@ -874 +895 @@
                         d_fprintf(stderr, _("\nInvalid option %s: %s\n"),
                                  poptBadOption(pc, 0), poptStrerror(opt));
-                        net_help(c, argc, argv);
+                        net_help(c, argc, argv_const);
                         exit(1);
                 }
         }
 
-        lp_load(get_dyn_CONFIGFILE(), true, false, false, true);
+        if (!lp_load_initial_only(get_dyn_CONFIGFILE())) {
+                d_fprintf(stderr, "Can't load %s - run testparm to debug it\n",
+                          get_dyn_CONFIGFILE());
+                exit(1);
+        }
+
+        /*
+         * Failing to init the msg_ctx isn't a fatal error. Only root-level
+         * things (joining/leaving domains etc.) will be denied.
+         */
+        c->msg_ctx = messaging_init(c, samba_tevent_context_init(c));
+
+        if (!lp_load_global(get_dyn_CONFIGFILE())) {
+                d_fprintf(stderr, "Can't load %s - run testparm to debug it\n",
+                          get_dyn_CONFIGFILE());
+                exit(1);
+        }
+
+#if defined(HAVE_BIND_TEXTDOMAIN_CODESET)
+        /* Bind our gettext results to 'unix charset'
+           
+           This ensures that the translations and any embedded strings are in the
+           same charset.  It won't be the one from the user's locale (we no
+           longer auto-detect that), but it will be self-consistent.
+        */
+        bind_textdomain_codeset(MODULE_NAME, lp_unix_charset());
+#endif
 
         argv_new = (const char **)poptGetArgs(pc);
@@ -896 +943 @@
 
         if (c->opt_requester_name) {
-                set_global_myname(c->opt_requester_name);
+                lp_set_cmdline("netbios name", c->opt_requester_name);
         }
 
@@ -904 +951 @@
 
         if (!c->opt_workgroup) {
-                c->opt_workgroup = smb_xstrdup(lp_workgroup());
+                c->opt_workgroup = talloc_strdup(c, lp_workgroup());
         }
 
         if (!c->opt_target_workgroup) {
-                c->opt_target_workgroup = smb_xstrdup(lp_workgroup());
+                c->opt_target_workgroup = talloc_strdup(c, lp_workgroup());
         }
 
@@ -931 +978 @@
         }
 
-        /* Failing to init the msg_ctx isn't a fatal error. Only
-           root-level things (joining/leaving domains etc.) will be denied. */
-
-        c->msg_ctx = messaging_init(c, procid_self(),
-                                    event_context_init(c));
+        popt_burn_cmdline_password(argc, argv);
 
         rc = net_run_function(c, argc_new-1, argv_new+1, "net", net_func);

vendor/current/source3/utils/net.h

@@ -81 +81 @@
         int opt_auto;
         int opt_repair;
+        int opt_reg_version;
+        const char *opt_output;
+        int opt_wipe;
+        const char *opt_precheck;
+        int opt_no_dns_updates;
 
         int opt_have_ip;
@@ -87 +92 @@
         struct libnetapi_ctx *netapi_ctx;
         struct messaging_context *msg_ctx;
+        struct netlogon_creds_cli_context *netlogon_creds;
 
         bool display_usage;
@@ -129 +135 @@
         struct cli_state *cli_share_dst;
         char *cwd;
-        uint16 attribute;
+        uint16_t attribute;
         struct net_context *c;
 }copy_clistate;
@@ -150 +156 @@
                                   TALLOC_CTX *mem_ctx,
                                   struct rpc_sh_ctx *ctx);
-        const struct ndr_syntax_id *interface;
+        const struct ndr_interface_table *table;
         NTSTATUS (*fn)(struct net_context *c, TALLOC_CTX *mem_ctx,
                        struct rpc_sh_ctx *ctx,
@@ -179 +185 @@
 #define NET_FLAGS_SEAL                          0x00000080      /* seal RPC connection */
 #define NET_FLAGS_TCP                           0x00000100      /* use ncacn_ip_tcp */
+#define NET_FLAGS_EXPECT_FALLBACK               0x00000200      /* the caller will fallback */
 
 /* net share operation modes */

vendor/current/source3/utils/net_ads.c

@@ -29 +29 @@
 #include "ads.h"
 #include "libads/cldap.h"
-#include "libads/dns.h"
+#include "../lib/addns/dnsquery.h"
 #include "../libds/common/flags.h"
 #include "librpc/gen_ndr/libnet_join.h"
@@ -38 +38 @@
 #include "../libcli/security/security.h"
 #include "libsmb/libsmb.h"
+#include "lib/param/loadparm.h"
 #include "utils/net_dns.h"
 
@@ -63 +64 @@
 
         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
-        if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
+
+        if ( !ads_cldap_netlogon_5(talloc_tos(), &ads->ldap.ss, ads->server.realm, &reply ) ) {
                 d_fprintf(stderr, _("CLDAP query failed!\n"));
                 return -1;
@@ -98 +100 @@
                    "\tIs a non-domain NC serviced by LDAP server: %s\n"
                    "\tIs NT6 DC that has some secrets:            %s\n"
-                   "\tIs NT6 DC that has all secrets:             %s\n"),
+                   "\tIs NT6 DC that has all secrets:             %s\n"
+                   "\tRuns Active Directory Web Services:         %s\n"
+                   "\tRuns on Windows 2012 or later:              %s\n"),
                    (reply.server_type & NBT_SERVER_PDC) ? _("yes") : _("no"),
                    (reply.server_type & NBT_SERVER_GC) ? _("yes") : _("no"),
@@ -110 +114 @@
                    (reply.server_type & NBT_SERVER_NDNC) ? _("yes") : _("no"),
                    (reply.server_type & NBT_SERVER_SELECT_SECRET_DOMAIN_6) ? _("yes") : _("no"),
-                   (reply.server_type & NBT_SERVER_FULL_SECRET_DOMAIN_6) ? _("yes") : _("no"));
+                   (reply.server_type & NBT_SERVER_FULL_SECRET_DOMAIN_6) ? _("yes") : _("no"),
+                   (reply.server_type & NBT_SERVER_ADS_WEB_SERVICE) ? _("yes") : _("no"),
+                   (reply.server_type & NBT_SERVER_DS_8) ? _("yes") : _("no"));
 
 
@@ -157 +163 @@
 
         if (!ads->config.realm) {
-                ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
+                ads->config.realm = discard_const_p(char, c->opt_target_workgroup);
                 ads->ldap.port = 389;
         }
@@ -172 +178 @@
         ADS_STRUCT *ads;
         char addr[INET6_ADDRSTRLEN];
+        time_t pass_time;
 
         if (c->display_usage) {
@@ -201 +208 @@
         }
 
+        pass_time = secrets_fetch_pass_last_set_time(ads->server.workgroup);
+
         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
 
@@ -214 +223 @@
         d_printf(_("Server time offset: %d\n"), ads->auth.time_offset );
 
+        d_printf(_("Last machine account password change: %s\n"),
+                 http_timestring(talloc_tos(), pass_time));
+
         ads_destroy(&ads);
         return 0;
@@ -225 +237 @@
 
 static ADS_STATUS ads_startup_int(struct net_context *c, bool only_own_domain,
-                                  uint32 auth_flags, ADS_STRUCT **ads_ret)
+                                  uint32_t auth_flags, ADS_STRUCT **ads_ret)
 {
         ADS_STRUCT *ads = NULL;
@@ -287 +299 @@
                 SAFE_FREE(ads->auth.realm);
                 ads->auth.realm = smb_xstrdup(cp);
-                strupper_m(ads->auth.realm);
+                if (!strupper_m(ads->auth.realm)) {
+                        ads_destroy(&ads);
+                        return ADS_ERROR(LDAP_NO_MEMORY);
+                }
        }
 
@@ -386 +401 @@
 {
         ADS_STRUCT *ads;
-        char addr[INET6_ADDRSTRLEN];
         struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
 
@@ -404 +418 @@
 
         if (!ads->config.realm) {
-                ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
+                ads->config.realm = discard_const_p(char, c->opt_target_workgroup);
                 ads->ldap.port = 389;
         }
 
-        print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
-        if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
+        if ( !ads_cldap_netlogon_5(talloc_tos(), &ads->ldap.ss, ads->server.realm, &reply ) ) {
                 d_fprintf(stderr, _("CLDAP query failed!\n"));
                 ads_destroy(&ads);
@@ -444 +457 @@
         if (!values) /* must be new field, indicate string field */
                 return true;
-        if (StrCaseCmp(field, "sAMAccountName") == 0) {
+        if (strcasecmp_m(field, "sAMAccountName") == 0) {
                 disp_fields[0] = SMB_STRDUP((char *) values[0]);
         }
-        if (StrCaseCmp(field, "description") == 0)
+        if (strcasecmp_m(field, "description") == 0)
                 disp_fields[1] = SMB_STRDUP((char *) values[0]);
         return true;
@@ -918 +931 @@
         }
 
-        rc = ads_find_machine_acct(ads, &res, global_myname());
+        rc = ads_find_machine_acct(ads, &res, lp_netbios_name());
         if (!ADS_ERR_OK(rc)) {
                 d_fprintf(stderr, _("ads_find_machine_acct: %s\n"), ads_errstr(rc));
@@ -926 +939 @@
 
         if (ads_count_replies(ads, res) == 0) {
-                d_fprintf(stderr, _("No machine account for '%s' found\n"), global_myname());
+                d_fprintf(stderr, _("No machine account for '%s' found\n"), lp_netbios_name());
                 ads_destroy(&ads);
                 return -1;
@@ -1021 +1034 @@
         }
 
-        /* Based on what we requseted, we shouldn't get here, but if
+        /* Based on what we requested, we shouldn't get here, but if
            we did, it means the secrets were removed, and therefore
            we have left the domain */
@@ -1103 +1116 @@
         }
 
-        if (strlen(global_myname()) > 15) {
+        if (strlen(lp_netbios_name()) > 15) {
                 d_printf(_("Our netbios name can be at most 15 chars long, "
-                           "\"%s\" is %u chars long\n"), global_myname(),
-                         (unsigned int)strlen(global_myname()));
+                           "\"%s\" is %u chars long\n"), lp_netbios_name(),
+                         (unsigned int)strlen(lp_netbios_name()));
                 return WERR_INVALID_COMPUTERNAME;
         }
@@ -1148 +1161 @@
         dnsdomain++;
 
-        status = ads_dns_lookup_ns( ctx, dnsdomain, &nameservers, &ns_count );
+        status = ads_dns_lookup_ns(ctx,
+                                   dnsdomain,
+                                   &nameservers,
+                                   &ns_count);
         if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
                 /* Child domains often do not have NS records.  Look
@@ -1186 +1202 @@
                 /* try again for NS servers */
 
-                status = ads_dns_lookup_ns( ctx, root_domain, &nameservers, &ns_count );
+                status = ads_dns_lookup_ns(ctx,
+                                           root_domain,
+                                           &nameservers,
+                                           &ns_count);
 
                 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
@@ -1258 +1277 @@
                 fstrcpy(machine_name, hostname);
         } else {
-                name_to_fqdn( machine_name, global_myname() );
-        }
-        strlower_m( machine_name );
+                name_to_fqdn( machine_name, lp_netbios_name() );
+        }
+        if (!strlower_m( machine_name )) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         if (num_addrs == 0 || iplist == NULL) {
@@ -1298 +1319 @@
 static int net_ads_join_usage(struct net_context *c, int argc, const char **argv)
 {
-        d_printf(_("net ads join [options]\n"
+        d_printf(_("net ads join [--no-dns-updates] [options]\n"
                    "Valid options:\n"));
-        d_printf(_("   createupn[=UPN]    Set the userPrincipalName attribute during the join.\n"
-                   "                      The deault UPN is in the form host/netbiosname@REALM.\n"));
-        d_printf(_("   createcomputer=OU  Precreate the computer account in a specific OU.\n"
-                   "                      The OU string read from top to bottom without RDNs and delimited by a '/'.\n"
-                   "                      E.g. \"createcomputer=Computers/Servers/Unix\"\n"
-                   "                      NB: A backslash '\\' is used as escape at multiple levels and may\n"
-                   "                          need to be doubled or even quadrupled.  It is not used as a separator.\n"));
-        d_printf(_("   osName=string      Set the operatingSystem attribute during the join.\n"));
-        d_printf(_("   osVer=string       Set the operatingSystemVersion attribute during the join.\n"
-                   "                      NB: osName and osVer must be specified together for either to take effect.\n"
-                   "                          Also, the operatingSystemService attribute is also set when along with\n"
-                   "                          the two other attributes.\n"));
-
+        d_printf(_("   createupn[=UPN]       Set the userPrincipalName attribute during the join.\n"
+                   "                         The default UPN is in the form host/netbiosname@REALM.\n"));
+        d_printf(_("   createcomputer=OU     Precreate the computer account in a specific OU.\n"
+                   "                         The OU string read from top to bottom without RDNs\n"
+                   "                         and delimited by a '/'.\n"
+                   "                         E.g. \"createcomputer=Computers/Servers/Unix\"\n"
+                   "                         NB: A backslash '\\' is used as escape at multiple\n"
+                   "                             levels and may need to be doubled or even\n"
+                   "                             quadrupled. It is not used as a separator.\n"));
+        d_printf(_("   machinepass=PASS      Set the machine password to a specific value during\n"
+                   "                         the join. The default password is random.\n"));
+        d_printf(_("   osName=string         Set the operatingSystem attribute during the join.\n"));
+        d_printf(_("   osVer=string          Set the operatingSystemVersion attribute during join.\n"
+                   "                         NB: osName and osVer must be specified together for\n"
+                   "                             either to take effect. The operatingSystemService\n"
+                   "                             attribute is then also set along with the two\n"
+                   "                             other attributes.\n"));
+        d_printf(_("   osServicePack=string  Set the operatingSystemServicePack attribute\n"
+                   "                         during the join.\n"
+                   "                         NB: If not specified then by default the samba\n"
+                   "                             version string is used instead.\n"));
         return -1;
 }
 
-/*******************************************************************
- ********************************************************************/
-
-int net_ads_join(struct net_context *c, int argc, const char **argv)
-{
-        TALLOC_CTX *ctx = NULL;
-        struct libnet_JoinCtx *r = NULL;
-        const char *domain = lp_realm();
-        WERROR werr = WERR_SETUP_NOT_JOINED;
-        bool createupn = false;
-        const char *machineupn = NULL;
-        const char *create_in_ou = NULL;
-        int i;
-        const char *os_name = NULL;
-        const char *os_version = NULL;
-        bool modify_config = lp_config_backend_is_registry();
-
-        if (c->display_usage)
-                return net_ads_join_usage(c, argc, argv);
-
-        if (!modify_config) {
-
-                werr = check_ads_config();
-                if (!W_ERROR_IS_OK(werr)) {
-                        d_fprintf(stderr, _("Invalid configuration.  Exiting....\n"));
-                        goto fail;
-                }
-        }
-
-        if (!(ctx = talloc_init("net_ads_join"))) {
-                d_fprintf(stderr, _("Could not initialise talloc context.\n"));
-                werr = WERR_NOMEM;
-                goto fail;
-        }
-
-        if (!c->opt_kerberos) {
-                use_in_memory_ccache();
-        }
-
-        werr = libnet_init_JoinCtx(ctx, &r);
-        if (!W_ERROR_IS_OK(werr)) {
-                goto fail;
-        }
-
-        /* process additional command line args */
-
-        for ( i=0; i<argc; i++ ) {
-                if ( !StrnCaseCmp(argv[i], "createupn", strlen("createupn")) ) {
-                        createupn = true;
-                        machineupn = get_string_param(argv[i]);
-                }
-                else if ( !StrnCaseCmp(argv[i], "createcomputer", strlen("createcomputer")) ) {
-                        if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
-                                d_fprintf(stderr, _("Please supply a valid OU path.\n"));
-                                werr = WERR_INVALID_PARAM;
-                                goto fail;
-                        }
-                }
-                else if ( !StrnCaseCmp(argv[i], "osName", strlen("osName")) ) {
-                        if ( (os_name = get_string_param(argv[i])) == NULL ) {
-                                d_fprintf(stderr, _("Please supply a operating system name.\n"));
-                                werr = WERR_INVALID_PARAM;
-                                goto fail;
-                        }
-                }
-                else if ( !StrnCaseCmp(argv[i], "osVer", strlen("osVer")) ) {
-                        if ( (os_version = get_string_param(argv[i])) == NULL ) {
-                                d_fprintf(stderr, _("Please supply a valid operating system version.\n"));
-                                werr = WERR_INVALID_PARAM;
-                                goto fail;
-                        }
-                }
-                else {
-                        domain = argv[i];
-                }
-        }
-
-        if (!*domain) {
-                d_fprintf(stderr, _("Please supply a valid domain name\n"));
-                werr = WERR_INVALID_PARAM;
-                goto fail;
-        }
-
-        if (!c->msg_ctx) {
-                d_fprintf(stderr, _("Could not initialise message context. "
-                        "Try running as root\n"));
-                werr = WERR_ACCESS_DENIED;
-                goto fail;
-        }
-
-        /* Do the domain join here */
-
-        r->in.domain_name       = domain;
-        r->in.create_upn        = createupn;
-        r->in.upn               = machineupn;
-        r->in.account_ou        = create_in_ou;
-        r->in.os_name           = os_name;
-        r->in.os_version        = os_version;
-        r->in.dc_name           = c->opt_host;
-        r->in.admin_account     = c->opt_user_name;
-        r->in.admin_password    = net_prompt_pass(c, c->opt_user_name);
-        r->in.debug             = true;
-        r->in.use_kerberos      = c->opt_kerberos;
-        r->in.modify_config     = modify_config;
-        r->in.join_flags        = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
-                                  WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
-                                  WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
-        r->in.msg_ctx           = c->msg_ctx;
-
-        werr = libnet_Join(ctx, r);
-        if (W_ERROR_EQUAL(werr, WERR_DCNOTFOUND) &&
-            strequal(domain, lp_realm())) {
-                r->in.domain_name = lp_workgroup();
-                werr = libnet_Join(ctx, r);
-        }
-        if (!W_ERROR_IS_OK(werr)) {
-                goto fail;
-        }
-
-        /* Check the short name of the domain */
-
-        if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
-                d_printf(_("The workgroup in %s does not match the short\n"
-                           "domain name obtained from the server.\n"
-                           "Using the name [%s] from the server.\n"
-                           "You should set \"workgroup = %s\" in %s.\n"),
-                         get_dyn_CONFIGFILE(), r->out.netbios_domain_name,
-                         r->out.netbios_domain_name, get_dyn_CONFIGFILE());
-        }
-
-        d_printf(_("Using short domain name -- %s\n"), r->out.netbios_domain_name);
-
-        if (r->out.dns_domain_name) {
-                d_printf(_("Joined '%s' to dns domain '%s'\n"), r->in.machine_name,
-                        r->out.dns_domain_name);
-        } else {
-                d_printf(_("Joined '%s' to domain '%s'\n"), r->in.machine_name,
-                        r->out.netbios_domain_name);
-        }
-
+
+static void _net_ads_join_dns_updates(struct net_context *c, TALLOC_CTX *ctx, struct libnet_JoinCtx *r)
+{
 #if defined(WITH_DNS_UPDATES)
+        ADS_STRUCT *ads_dns = NULL;
+        int ret;
+        NTSTATUS status;
+
         /*
          * In a clustered environment, don't do dynamic dns updates:
@@ -1469 +1365 @@
          */
         if (lp_clustering()) {
-                d_fprintf(stderr, _("Not doing automatic DNS update in a"
+                d_fprintf(stderr, _("Not doing automatic DNS update in a "
                                     "clustered setup.\n"));
-                goto done;
-        }
-
-        if (r->out.domain_is_ad) {
-                /* We enter this block with user creds */
-                ADS_STRUCT *ads_dns = NULL;
-
-                if ( (ads_dns = ads_init( lp_realm(), NULL, NULL )) != NULL ) {
-                        /* kinit with the machine password */
-
-                        use_in_memory_ccache();
-                        if (asprintf( &ads_dns->auth.user_name, "%s$", global_myname()) == -1) {
+                return;
+        }
+
+        if (!r->out.domain_is_ad) {
+                return;
+        }
+
+        /*
+         * We enter this block with user creds.
+         * kinit with the machine password to do dns update.
+         */
+
+        ads_dns = ads_init(lp_realm(), NULL, r->in.dc_name);
+
+        if (ads_dns == NULL) {
+                d_fprintf(stderr, _("DNS update failed: out of memory!\n"));
+                goto done;
+        }
+
+        use_in_memory_ccache();
+
+        ret = asprintf(&ads_dns->auth.user_name, "%s$", lp_netbios_name());
+        if (ret == -1) {
+                d_fprintf(stderr, _("DNS update failed: out of memory\n"));
+                goto done;
+        }
+
+        ads_dns->auth.password = secrets_fetch_machine_password(
+                r->out.netbios_domain_name, NULL, NULL);
+        if (ads_dns->auth.password == NULL) {
+                d_fprintf(stderr, _("DNS update failed: out of memory\n"));
+                goto done;
+        }
+
+        ads_dns->auth.realm = SMB_STRDUP(r->out.dns_domain_name);
+        if (ads_dns->auth.realm == NULL) {
+                d_fprintf(stderr, _("DNS update failed: out of memory\n"));
+                goto done;
+        }
+
+        if (!strupper_m(ads_dns->auth.realm)) {
+                d_fprintf(stderr, _("strupper_m %s failed\n"), ads_dns->auth.realm);
+                goto done;
+        }
+
+        ret = ads_kinit_password(ads_dns);
+        if (ret != 0) {
+                d_fprintf(stderr,
+                          _("DNS update failed: kinit failed: %s\n"),
+                          error_message(ret));
+                goto done;
+        }
+
+        status = net_update_dns(c, ctx, ads_dns, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
+                d_fprintf( stderr, _("DNS update failed: %s\n"),
+                          nt_errstr(status));
+        }
+
+done:
+        ads_destroy(&ads_dns);
+#endif
+
+        return;
+}
+
+
+int net_ads_join(struct net_context *c, int argc, const char **argv)
+{
+        TALLOC_CTX *ctx = NULL;
+        struct libnet_JoinCtx *r = NULL;
+        const char *domain = lp_realm();
+        WERROR werr = WERR_SETUP_NOT_JOINED;
+        bool createupn = false;
+        const char *machineupn = NULL;
+        const char *machine_password = NULL;
+        const char *create_in_ou = NULL;
+        int i;
+        const char *os_name = NULL;
+        const char *os_version = NULL;
+        const char *os_servicepack = NULL;
+        bool modify_config = lp_config_backend_is_registry();
+        enum libnetjoin_JoinDomNameType domain_name_type = JoinDomNameTypeDNS;
+
+        if (c->display_usage)
+                return net_ads_join_usage(c, argc, argv);
+
+        if (!modify_config) {
+
+                werr = check_ads_config();
+                if (!W_ERROR_IS_OK(werr)) {
+                        d_fprintf(stderr, _("Invalid configuration.  Exiting....\n"));
+                        goto fail;
+                }
+        }
+
+        if (!(ctx = talloc_init("net_ads_join"))) {
+                d_fprintf(stderr, _("Could not initialise talloc context.\n"));
+                werr = WERR_NOMEM;
+                goto fail;
+        }
+
+        if (!c->opt_kerberos) {
+                use_in_memory_ccache();
+        }
+
+        werr = libnet_init_JoinCtx(ctx, &r);
+        if (!W_ERROR_IS_OK(werr)) {
+                goto fail;
+        }
+
+        /* process additional command line args */
+
+        for ( i=0; i<argc; i++ ) {
+                if ( !strncasecmp_m(argv[i], "createupn", strlen("createupn")) ) {
+                        createupn = true;
+                        machineupn = get_string_param(argv[i]);
+                }
+                else if ( !strncasecmp_m(argv[i], "createcomputer", strlen("createcomputer")) ) {
+                        if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
+                                d_fprintf(stderr, _("Please supply a valid OU path.\n"));
+                                werr = WERR_INVALID_PARAM;
                                 goto fail;
                         }
-                        ads_dns->auth.password = secrets_fetch_machine_password(
-                                r->out.netbios_domain_name, NULL, NULL );
-                        ads_dns->auth.realm = SMB_STRDUP( r->out.dns_domain_name );
-                        strupper_m(ads_dns->auth.realm );
-                        ads_kinit_password( ads_dns );
-                }
-
-                if ( !ads_dns || !NT_STATUS_IS_OK(net_update_dns(c, ctx, ads_dns, NULL)) ) {
-                        d_fprintf( stderr, _("DNS update failed!\n") );
-                }
-
-                /* exit from this block using machine creds */
-                ads_destroy(&ads_dns);
-        }
-
-done:
-#endif
+                }
+                else if ( !strncasecmp_m(argv[i], "osName", strlen("osName")) ) {
+                        if ( (os_name = get_string_param(argv[i])) == NULL ) {
+                                d_fprintf(stderr, _("Please supply a operating system name.\n"));
+                                werr = WERR_INVALID_PARAM;
+                                goto fail;
+                        }
+                }
+                else if ( !strncasecmp_m(argv[i], "osVer", strlen("osVer")) ) {
+                        if ( (os_version = get_string_param(argv[i])) == NULL ) {
+                                d_fprintf(stderr, _("Please supply a valid operating system version.\n"));
+                                werr = WERR_INVALID_PARAM;
+                                goto fail;
+                        }
+                }
+                else if ( !strncasecmp_m(argv[i], "osServicePack", strlen("osServicePack")) ) {
+                        if ( (os_servicepack = get_string_param(argv[i])) == NULL ) {
+                                d_fprintf(stderr, _("Please supply a valid servicepack identifier.\n"));
+                                werr = WERR_INVALID_PARAM;
+                                goto fail;
+                        }
+                }
+                else if ( !strncasecmp_m(argv[i], "machinepass", strlen("machinepass")) ) {
+                        if ( (machine_password = get_string_param(argv[i])) == NULL ) {
+                                d_fprintf(stderr, _("Please supply a valid password to set as trust account password.\n"));
+                                werr = WERR_INVALID_PARAM;
+                                goto fail;
+                        }
+                }
+                else {
+                        domain = argv[i];
+                        if (strchr(domain, '.') == NULL) {
+                                domain_name_type = JoinDomNameTypeUnknown;
+                        } else {
+                                domain_name_type = JoinDomNameTypeDNS;
+                        }
+                }
+        }
+
+        if (!*domain) {
+                d_fprintf(stderr, _("Please supply a valid domain name\n"));
+                werr = WERR_INVALID_PARAM;
+                goto fail;
+        }
+
+        if (!c->msg_ctx) {
+                d_fprintf(stderr, _("Could not initialise message context. "
+                        "Try running as root\n"));
+                werr = WERR_ACCESS_DENIED;
+                goto fail;
+        }
+
+        /* Do the domain join here */
+
+        r->in.domain_name       = domain;
+        r->in.domain_name_type  = domain_name_type;
+        r->in.create_upn        = createupn;
+        r->in.upn               = machineupn;
+        r->in.account_ou        = create_in_ou;
+        r->in.os_name           = os_name;
+        r->in.os_version        = os_version;
+        r->in.os_servicepack    = os_servicepack;
+        r->in.dc_name           = c->opt_host;
+        r->in.admin_account     = c->opt_user_name;
+        r->in.admin_password    = net_prompt_pass(c, c->opt_user_name);
+        r->in.machine_password  = machine_password;
+        r->in.debug             = true;
+        r->in.use_kerberos      = c->opt_kerberos;
+        r->in.modify_config     = modify_config;
+        r->in.join_flags        = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
+                                  WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
+                                  WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
+        r->in.msg_ctx           = c->msg_ctx;
+
+        werr = libnet_Join(ctx, r);
+        if (W_ERROR_EQUAL(werr, WERR_DCNOTFOUND) &&
+            strequal(domain, lp_realm())) {
+                r->in.domain_name = lp_workgroup();
+                r->in.domain_name_type = JoinDomNameTypeNBT;
+                werr = libnet_Join(ctx, r);
+        }
+        if (!W_ERROR_IS_OK(werr)) {
+                goto fail;
+        }
+
+        /* Check the short name of the domain */
+
+        if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
+                d_printf(_("The workgroup in %s does not match the short\n"
+                           "domain name obtained from the server.\n"
+                           "Using the name [%s] from the server.\n"
+                           "You should set \"workgroup = %s\" in %s.\n"),
+                         get_dyn_CONFIGFILE(), r->out.netbios_domain_name,
+                         r->out.netbios_domain_name, get_dyn_CONFIGFILE());
+        }
+
+        d_printf(_("Using short domain name -- %s\n"), r->out.netbios_domain_name);
+
+        if (r->out.dns_domain_name) {
+                d_printf(_("Joined '%s' to dns domain '%s'\n"), r->in.machine_name,
+                        r->out.dns_domain_name);
+        } else {
+                d_printf(_("Joined '%s' to domain '%s'\n"), r->in.machine_name,
+                        r->out.netbios_domain_name);
+        }
+
+        /*
+         * We try doing the dns update (if it was compiled in
+         * and if it was not disabled on the command line).
+         * If the dns update fails, we still consider the join
+         * operation as succeeded if we came this far.
+         */
+        if (!c->opt_no_dns_updates) {
+                _net_ads_join_dns_updates(c, ctx, r);
+        }
 
         TALLOC_FREE(r);
@@ -1766 +1870 @@
                 servername =  argv[1];
         } else {
-                servername = global_myname();
+                servername = lp_netbios_name();
         }
 
@@ -1807 +1911 @@
         char *srv_cn_escaped = NULL, *printername_escaped = NULL;
         LDAPMessage *res = NULL;
+        bool ok;
 
         if (argc < 1 || c->display_usage) {
@@ -1829 +1934 @@
                 servername = argv[1];
         } else {
-                servername = global_myname();
+                servername = lp_netbios_name();
         }
 
         /* Get printer data from SPOOLSS */
 
-        resolve_name(servername, &server_ss, 0x20, false);
-
-        nt_status = cli_full_connection(&cli, global_myname(), servername,
+        ok = resolve_name(servername, &server_ss, 0x20, false);
+        if (!ok) {
+                d_fprintf(stderr, _("Could not find server %s\n"),
+                          servername);
+                ads_destroy(&ads);
+                talloc_destroy(mem_ctx);
+                return -1;
+        }
+
+        nt_status = cli_full_connection(&cli, lp_netbios_name(), servername,
                                         &server_ss, 0,
                                         "IPC$", "IPC",
@@ -1842 +1954 @@
                                         c->opt_password ? c->opt_password : "",
                                         CLI_FULL_CONNECTION_USE_KERBEROS,
-                                        Undefined);
+                                        SMB_SIGNING_IPC_DEFAULT);
 
         if (NT_STATUS_IS_ERR(nt_status)) {
@@ -1892 +2004 @@
         SAFE_FREE(printername_escaped);
 
-        nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_spoolss.syntax_id, &pipe_hnd);
+        nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_spoolss, &pipe_hnd);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 d_fprintf(stderr, _("Unable to open a connection to the spoolss pipe on %s\n"),
@@ -1952 +2064 @@
                 servername = argv[1];
         } else {
-                servername = global_myname();
+                servername = lp_netbios_name();
         }
 
@@ -2033 +2145 @@
         const char *auth_principal = c->opt_user_name;
         const char *auth_password = c->opt_password;
-        char *realm = NULL;
-        char *new_password = NULL;
+        const char *realm = NULL;
+        const char *new_password = NULL;
         char *chr, *prompt;
         const char *user;
+        char pwd[256] = {0};
         ADS_STATUS ret;
 
@@ -2093 +2206 @@
 
         if (argv[1]) {
-                new_password = (char *)argv[1];
+                new_password = (const char *)argv[1];
         } else {
+                int rc;
+
                 if (asprintf(&prompt, _("Enter new password for %s:"), user) == -1) {
                         return -1;
                 }
-                new_password = getpass(prompt);
+                rc = samba_getpass(prompt, pwd, sizeof(pwd), false, true);
+                if (rc < 0) {
+                        return -1;
+                }
+                new_password = pwd;
                 free(prompt);
         }
@@ -2104 +2223 @@
         ret = kerberos_set_password(ads->auth.kdc_server, auth_principal,
                                 auth_password, user, new_password, ads->auth.time_offset);
+        memset(pwd, '\0', sizeof(pwd));
         if (!ADS_ERR_OK(ret)) {
                 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
@@ -2145 +2265 @@
         }
 
-        fstrcpy(my_name, global_myname());
-        strlower_m(my_name);
+        fstrcpy(my_name, lp_netbios_name());
+        if (!strlower_m(my_name)) {
+                ads_destroy(&ads);
+                return -1;
+        }
+
         if (asprintf(&host_principal, "%s$@%s", my_name, ads->config.realm) == -1) {
                 ads_destroy(&ads);
@@ -2520 +2644 @@
 }
 
-static int net_ads_kerberos_pac(struct net_context *c, int argc, const char **argv)
-{
-        struct PAC_LOGON_INFO *info = NULL;
-        TALLOC_CTX *mem_ctx = NULL;
+static int net_ads_kerberos_pac_common(struct net_context *c, int argc, const char **argv,
+                                       struct PAC_DATA_CTR **pac_data_ctr)
+{
         NTSTATUS status;
         int ret = -1;
         const char *impersonate_princ_s = NULL;
-
-        if (c->display_usage) {
-                d_printf(  "%s\n"
-                           "net ads kerberos pac\n"
-                           "    %s\n",
-                         _("Usage:"),
-                         _("Dump the Kerberos PAC"));
-                return 0;
-        }
-
-        mem_ctx = talloc_init("net_ads_kerberos_pac");
-        if (!mem_ctx) {
-                goto out;
-        }
-
-        if (argc > 0) {
-                impersonate_princ_s = argv[0];
+        const char *local_service = NULL;
+        int i;
+
+        for (i=0; i<argc; i++) {
+                if (strnequal(argv[i], "impersonate", strlen("impersonate"))) {
+                        impersonate_princ_s = get_string_param(argv[i]);
+                        if (impersonate_princ_s == NULL) {
+                                return -1;
+                        }
+                }
+                if (strnequal(argv[i], "local_service", strlen("local_service"))) {
+                        local_service = get_string_param(argv[i]);
+                        if (local_service == NULL) {
+                                return -1;
+                        }
+                }
+        }
+
+        if (local_service == NULL) {
+                local_service = talloc_asprintf(c, "%s$@%s",
+                                                lp_netbios_name(), lp_realm());
+                if (local_service == NULL) {
+                        goto out;
+                }
         }
 
         c->opt_password = net_prompt_pass(c, c->opt_user_name);
 
-        status = kerberos_return_pac(mem_ctx,
+        status = kerberos_return_pac(c,
                                      c->opt_user_name,
                                      c->opt_password,
@@ -2559 +2689 @@
                                      2592000, /* one month */
                                      impersonate_princ_s,
-                                     &info);
+                                     local_service,
+                                     pac_data_ctr);
         if (!NT_STATUS_IS_OK(status)) {
                 d_printf(_("failed to query kerberos PAC: %s\n"),
@@ -2566 +2697 @@
         }
 
-        if (info) {
-                const char *s;
-                s = NDR_PRINT_STRUCT_STRING(mem_ctx, PAC_LOGON_INFO, info);
-                d_printf(_("The Pac: %s\n"), s);
-        }
-
         ret = 0;
  out:
-        TALLOC_FREE(mem_ctx);
         return ret;
+}
+
+static int net_ads_kerberos_pac_dump(struct net_context *c, int argc, const char **argv)
+{
+        struct PAC_DATA_CTR *pac_data_ctr = NULL;
+        int i;
+        int ret = -1;
+        enum PAC_TYPE type = 0;
+
+        if (c->display_usage) {
+                d_printf(  "%s\n"
+                           "net ads kerberos pac dump [impersonate=string] [local_service=string] [pac_buffer_type=int]\n"
+                           "    %s\n",
+                         _("Usage:"),
+                         _("Dump the Kerberos PAC"));
+                return -1;
+        }
+
+        for (i=0; i<argc; i++) {
+                if (strnequal(argv[i], "pac_buffer_type", strlen("pac_buffer_type"))) {
+                        type = get_int_param(argv[i]);
+                }
+        }
+
+        ret = net_ads_kerberos_pac_common(c, argc, argv, &pac_data_ctr);
+        if (ret) {
+                return ret;
+        }
+
+        if (type == 0) {
+
+                char *s = NULL;
+
+                s = NDR_PRINT_STRUCT_STRING(c, PAC_DATA,
+                        pac_data_ctr->pac_data);
+                if (s != NULL) {
+                        d_printf(_("The Pac: %s\n"), s);
+                        talloc_free(s);
+                }
+
+                return 0;
+        }
+
+        for (i=0; i < pac_data_ctr->pac_data->num_buffers; i++) {
+
+                char *s = NULL;
+
+                if (pac_data_ctr->pac_data->buffers[i].type != type) {
+                        continue;
+                }
+
+                s = NDR_PRINT_UNION_STRING(c, PAC_INFO, type,
+                                pac_data_ctr->pac_data->buffers[i].info);
+                if (s != NULL) {
+                        d_printf(_("The Pac: %s\n"), s);
+                        talloc_free(s);
+                }
+                break;
+        }
+
+        return 0;
+}
+
+static int net_ads_kerberos_pac_save(struct net_context *c, int argc, const char **argv)
+{
+        struct PAC_DATA_CTR *pac_data_ctr = NULL;
+        char *filename = NULL;
+        int ret = -1;
+        int i;
+
+        if (c->display_usage) {
+                d_printf(  "%s\n"
+                           "net ads kerberos pac save [impersonate=string] [local_service=string] [filename=string]\n"
+                           "    %s\n",
+                         _("Usage:"),
+                         _("Save the Kerberos PAC"));
+                return -1;
+        }
+
+        for (i=0; i<argc; i++) {
+                if (strnequal(argv[i], "filename", strlen("filename"))) {
+                        filename = get_string_param(argv[i]);
+                        if (filename == NULL) {
+                                return -1;
+                        }
+                }
+        }
+
+        ret = net_ads_kerberos_pac_common(c, argc, argv, &pac_data_ctr);
+        if (ret) {
+                return ret;
+        }
+
+        if (filename == NULL) {
+                d_printf(_("please define \"filename=<filename>\" to save the PAC\n"));
+                return -1;
+        }
+
+        /* save the raw format */
+        if (!file_save(filename, pac_data_ctr->pac_blob.data, pac_data_ctr->pac_blob.length)) {
+                d_printf(_("failed to save PAC in %s\n"), filename);
+                return -1;
+        }
+
+        return 0;
+}
+
+static int net_ads_kerberos_pac(struct net_context *c, int argc, const char **argv)
+{
+        struct functable func[] = {
+                {
+                        "dump",
+                        net_ads_kerberos_pac_dump,
+                        NET_TRANSPORT_ADS,
+                        N_("Dump Kerberos PAC"),
+                        N_("net ads kerberos pac dump\n"
+                           "    Dump a Kerberos PAC to stdout")
+                },
+                {
+                        "save",
+                        net_ads_kerberos_pac_save,
+                        NET_TRANSPORT_ADS,
+                        N_("Save Kerberos PAC"),
+                        N_("net ads kerberos pac save\n"
+                           "    Save a Kerberos PAC in a file")
+                },
+
+                {NULL, NULL, 0, NULL, NULL}
+        };
+
+        return net_run_function(c, argc, argv, "net ads kerberos pac", func);
 }
 
@@ -2652 +2907 @@
 }
 
+static int net_ads_enctype_lookup_account(struct net_context *c,
+                                          ADS_STRUCT *ads,
+                                          const char *account,
+                                          LDAPMessage **res,
+                                          const char **enctype_str)
+{
+        const char *filter;
+        const char *attrs[] = {
+                "msDS-SupportedEncryptionTypes",
+                NULL
+        };
+        int count;
+        int ret = -1;
+        ADS_STATUS status;
+
+        filter = talloc_asprintf(c, "(&(objectclass=user)(sAMAccountName=%s))",
+                                 account);
+        if (filter == NULL) {
+                goto done;
+        }
+
+        status = ads_search(ads, res, filter, attrs);
+        if (!ADS_ERR_OK(status)) {
+                d_printf(_("no account found with filter: %s\n"), filter);
+                goto done;
+        }
+
+        count = ads_count_replies(ads, *res);
+        switch (count) {
+        case 1:
+                break;
+        case 0:
+                d_printf(_("no account found with filter: %s\n"), filter);
+                goto done;
+        default:
+                d_printf(_("multiple accounts found with filter: %s\n"), filter);
+                goto done;
+        }
+
+        if (enctype_str) {
+                *enctype_str = ads_pull_string(ads, c, *res,
+                                               "msDS-SupportedEncryptionTypes");
+                if (*enctype_str == NULL) {
+                        d_printf(_("no msDS-SupportedEncryptionTypes attribute found\n"));
+                        goto done;
+                }
+        }
+
+        ret = 0;
+ done:
+        return ret;
+}
+
+static void net_ads_enctype_dump_enctypes(const char *username,
+                                          const char *enctype_str)
+{
+        int enctypes = atoi(enctype_str);
+
+        d_printf(_("'%s' uses \"msDS-SupportedEncryptionTypes\": %d (0x%08x)\n"),
+                username, enctypes, enctypes);
+
+        printf("[%s] 0x%08x DES-CBC-CRC\n",
+                enctypes & ENC_CRC32 ? "X" : " ",
+                ENC_CRC32);
+        printf("[%s] 0x%08x DES-CBC-MD5\n",
+                enctypes & ENC_RSA_MD5 ? "X" : " ",
+                ENC_RSA_MD5);
+        printf("[%s] 0x%08x RC4-HMAC\n",
+                enctypes & ENC_RC4_HMAC_MD5 ? "X" : " ",
+                ENC_RC4_HMAC_MD5);
+        printf("[%s] 0x%08x AES128-CTS-HMAC-SHA1-96\n",
+                enctypes & ENC_HMAC_SHA1_96_AES128 ? "X" : " ",
+                ENC_HMAC_SHA1_96_AES128);
+        printf("[%s] 0x%08x AES256-CTS-HMAC-SHA1-96\n",
+                enctypes & ENC_HMAC_SHA1_96_AES256 ? "X" : " ",
+                ENC_HMAC_SHA1_96_AES256);
+}
+
+static int net_ads_enctypes_list(struct net_context *c, int argc, const char **argv)
+{
+        int ret = -1;
+        ADS_STATUS status;
+        ADS_STRUCT *ads = NULL;
+        LDAPMessage *res = NULL;
+        const char *str = NULL;
+
+        if (c->display_usage || (argc < 1)) {
+                d_printf(  "%s\n"
+                           "net ads enctypes list\n"
+                           "    %s\n",
+                         _("Usage:"),
+                         _("List supported enctypes"));
+                return 0;
+        }
+
+        status = ads_startup(c, false, &ads);
+        if (!ADS_ERR_OK(status)) {
+                printf("startup failed\n");
+                return ret;
+        }
+
+        ret = net_ads_enctype_lookup_account(c, ads, argv[0], &res, &str);
+        if (ret) {
+                goto done;
+        }
+
+        net_ads_enctype_dump_enctypes(argv[0], str);
+
+        ret = 0;
+ done:
+        ads_msgfree(ads, res);
+        ads_destroy(&ads);
+
+        return ret;
+}
+
+static int net_ads_enctypes_set(struct net_context *c, int argc, const char **argv)
+{
+        int ret = -1;
+        ADS_STATUS status;
+        ADS_STRUCT *ads;
+        LDAPMessage *res = NULL;
+        const char *etype_list_str;
+        const char *dn;
+        ADS_MODLIST mods;
+        uint32_t etype_list;
+        const char *str;
+
+        if (c->display_usage || argc < 1) {
+                d_printf(  "%s\n"
+                           "net ads enctypes set <sAMAccountName> [enctypes]\n"
+                           "    %s\n",
+                         _("Usage:"),
+                         _("Set supported enctypes"));
+                return 0;
+        }
+
+        status = ads_startup(c, false, &ads);
+        if (!ADS_ERR_OK(status)) {
+                printf("startup failed\n");
+                return ret;
+        }
+
+        ret = net_ads_enctype_lookup_account(c, ads, argv[0], &res, NULL);
+        if (ret) {
+                goto done;
+        }
+
+        dn = ads_get_dn(ads, c, res);
+        if (dn == NULL) {
+                goto done;
+        }
+
+        etype_list = ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5;
+#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
+        etype_list |= ENC_HMAC_SHA1_96_AES128;
+#endif
+#ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
+        etype_list |= ENC_HMAC_SHA1_96_AES256;
+#endif
+
+        if (argv[1] != NULL) {
+                sscanf(argv[1], "%i", &etype_list);
+        }
+
+        etype_list_str = talloc_asprintf(c, "%d", etype_list);
+        if (!etype_list_str) {
+                goto done;
+        }
+
+        mods = ads_init_mods(c);
+        if (!mods) {
+                goto done;
+        }
+
+        status = ads_mod_str(c, &mods, "msDS-SupportedEncryptionTypes",
+                             etype_list_str);
+        if (!ADS_ERR_OK(status)) {
+                goto done;
+        }
+
+        status = ads_gen_mod(ads, dn, mods);
+        if (!ADS_ERR_OK(status)) {
+                d_printf(_("failed to add msDS-SupportedEncryptionTypes: %s\n"),
+                        ads_errstr(status));
+                goto done;
+        }
+
+        ads_msgfree(ads, res);
+
+        ret = net_ads_enctype_lookup_account(c, ads, argv[0], &res, &str);
+        if (ret) {
+                goto done;
+        }
+
+        net_ads_enctype_dump_enctypes(argv[0], str);
+
+        ret = 0;
+ done:
+        ads_msgfree(ads, res);
+        ads_destroy(&ads);
+
+        return ret;
+}
+
+static int net_ads_enctypes_delete(struct net_context *c, int argc, const char **argv)
+{
+        int ret = -1;
+        ADS_STATUS status;
+        ADS_STRUCT *ads;
+        LDAPMessage *res = NULL;
+        const char *dn;
+        ADS_MODLIST mods;
+
+        if (c->display_usage || argc < 1) {
+                d_printf(  "%s\n"
+                           "net ads enctypes delete <sAMAccountName>\n"
+                           "    %s\n",
+                         _("Usage:"),
+                         _("Delete supported enctypes"));
+                return 0;
+        }
+
+        status = ads_startup(c, false, &ads);
+        if (!ADS_ERR_OK(status)) {
+                printf("startup failed\n");
+                return ret;
+        }
+
+        ret = net_ads_enctype_lookup_account(c, ads, argv[0], &res, NULL);
+        if (ret) {
+                goto done;
+        }
+
+        dn = ads_get_dn(ads, c, res);
+        if (dn == NULL) {
+                goto done;
+        }
+
+        mods = ads_init_mods(c);
+        if (!mods) {
+                goto done;
+        }
+
+        status = ads_mod_str(c, &mods, "msDS-SupportedEncryptionTypes", NULL);
+        if (!ADS_ERR_OK(status)) {
+                goto done;
+        }
+
+        status = ads_gen_mod(ads, dn, mods);
+        if (!ADS_ERR_OK(status)) {
+                d_printf(_("failed to remove msDS-SupportedEncryptionTypes: %s\n"),
+                        ads_errstr(status));
+                goto done;
+        }
+
+        ret = 0;
+
+ done:
+        ads_msgfree(ads, res);
+        ads_destroy(&ads);
+        return ret;
+}
+
+static int net_ads_enctypes(struct net_context *c, int argc, const char **argv)
+{
+        struct functable func[] = {
+                {
+                        "list",
+                        net_ads_enctypes_list,
+                        NET_TRANSPORT_ADS,
+                        N_("List the supported encryption types"),
+                        N_("net ads enctypes list\n"
+                           "    List the supported encryption types")
+                },
+                {
+                        "set",
+                        net_ads_enctypes_set,
+                        NET_TRANSPORT_ADS,
+                        N_("Set the supported encryption types"),
+                        N_("net ads enctypes set\n"
+                           "    Set the supported encryption types")
+                },
+                {
+                        "delete",
+                        net_ads_enctypes_delete,
+                        NET_TRANSPORT_ADS,
+                        N_("Delete the supported encryption types"),
+                        N_("net ads enctypes delete\n"
+                           "    Delete the supported encryption types")
+                },
+
+                {NULL, NULL, 0, NULL, NULL}
+        };
+
+        return net_run_function(c, argc, argv, "net ads enctypes", func);
+}
+
+
 int net_ads(struct net_context *c, int argc, const char **argv)
 {
@@ -2807 +3361 @@
                            "    Manage kerberos keytab")
                 },
+                {
+                        "enctypes",
+                        net_ads_enctypes,
+                        NET_TRANSPORT_ADS,
+                        N_("List/modify supported encryption types"),
+                        N_("net ads enctypes\n"
+                           "    List/modify enctypes")
+                },
                 {NULL, NULL, 0, NULL, NULL}
         };
@@ -2872 +3434 @@
 }
 
-#endif  /* WITH_ADS */
+#endif  /* HAVE_ADS */

vendor/current/source3/utils/net_ads_gpo.c

@@ -35 +35 @@
         struct GROUP_POLICY_OBJECT *gpo_list = NULL;
         struct GROUP_POLICY_OBJECT *read_list = NULL;
-        uint32 uac = 0;
-        uint32 flags = 0;
+        uint32_t uac = 0;
+        uint32_t flags = 0;
         struct GROUP_POLICY_OBJECT *gpo;
         NTSTATUS result;
         struct security_token *token = NULL;
+        char *gpo_cache_path;
 
         if (argc < 1 || c->display_usage) {
@@ -79 +80 @@
         d_printf(_("* fetching token "));
         if (uac & UF_WORKSTATION_TRUST_ACCOUNT) {
-                status = gp_get_machine_token(ads, mem_ctx, NULL, dn, &token);
+                status = gp_get_machine_token(ads, mem_ctx, dn, &token);
         } else {
                 status = ads_get_sid_token(ads, mem_ctx, dn, &token);
@@ -100 +101 @@
 
         d_printf(_("* Refreshing Group Policy Data "));
-        if (!NT_STATUS_IS_OK(result = check_refresh_gpo_list(ads, mem_ctx,
-                                                             cache_path(GPO_CACHE_DIR),
-                                                             NULL,
-                                                             flags,
-                                                             gpo_list))) {
+        gpo_cache_path = cache_path(GPO_CACHE_DIR);
+        if (gpo_cache_path == NULL) {
+                d_printf(_("failed: %s\n"), nt_errstr(NT_STATUS_NO_MEMORY));
+                goto out;
+        }
+        result = check_refresh_gpo_list(ads, mem_ctx,
+                                        gpo_cache_path,
+                                        flags,
+                                        gpo_list);
+        TALLOC_FREE(gpo_cache_path);
+        if (!NT_STATUS_IS_OK(result)) {
                 d_printf(_("failed: %s\n"), nt_errstr(result));
                 goto out;
@@ -129 +136 @@
                 for (gpo = gpo_list; gpo; gpo = gpo->next) {
 
-                        dump_gpo(ads, mem_ctx, gpo, 0);
+                        dump_gpo(gpo, 0);
 #if 0
                 char *server, *share, *nt_path, *unix_path;
@@ -174 +181 @@
                 for (gpo = read_list; gpo; gpo = gpo->next) {
 
-                        dump_gpo(ads, mem_ctx, gpo, 0);
+                        dump_gpo(gpo, 0);
 
 #if 0
@@ -280 +287 @@
                 }
 
-                dump_gpo(ads, mem_ctx, &gpo, 0);
+                dump_gpo(&gpo, 0);
         }
 
@@ -299 +306 @@
         TALLOC_CTX *mem_ctx;
         const char *dn = NULL;
-        uint32 uac = 0;
-        uint32 flags = 0;
+        uint32_t uac = 0;
+        uint32_t flags = 0;
         struct GROUP_POLICY_OBJECT *gpo_list;
         struct security_token *token = NULL;
@@ -338 +345 @@
 
         if (uac & UF_WORKSTATION_TRUST_ACCOUNT) {
-                status = gp_get_machine_token(ads, mem_ctx, NULL, dn, &token);
+                status = gp_get_machine_token(ads, mem_ctx, dn, &token);
         } else {
                 status = ads_get_sid_token(ads, mem_ctx, dn, &token);
@@ -352 +359 @@
         }
 
-        dump_gpo_list(ads, mem_ctx, gpo_list, 0);
+        dump_gpo_list(gpo_list, 0);
 
 out:
@@ -370 +377 @@
         const char *dn = NULL;
         struct GROUP_POLICY_OBJECT *gpo_list;
-        uint32 uac = 0;
-        uint32 flags = 0;
+        uint32_t uac = 0;
+        uint32_t flags = 0;
         struct security_token *token = NULL;
         const char *filter = NULL;
@@ -421 +428 @@
 
         if (uac & UF_WORKSTATION_TRUST_ACCOUNT) {
-                status = gp_get_machine_token(ads, mem_ctx, NULL, dn, &token);
+                status = gp_get_machine_token(ads, mem_ctx, dn, &token);
         } else {
                 status = ads_get_sid_token(ads, mem_ctx, dn, &token);
@@ -435 +442 @@
         }
 
-        status = gpo_process_gpo_list(ads, mem_ctx, token, gpo_list,
-                                      filter, flags);
+        status = ADS_ERROR_NT(gpo_process_gpo_list(mem_ctx, token, NULL, gpo_list,
+                                                   filter, flags));
         if (!ADS_ERR_OK(status)) {
                 d_printf("failed to process gpo list: %s\n",
@@ -482 +489 @@
         }
 
-        dump_gplink(ads, mem_ctx, &gp_link);
+        dump_gplink(&gp_link);
 
 out:
@@ -495 +502 @@
         ADS_STRUCT *ads;
         ADS_STATUS status;
-        uint32 gpo_opt = 0;
+        uint32_t gpo_opt = 0;
         TALLOC_CTX *mem_ctx;
 
@@ -590 +597 @@
                          _("Usage:"),
                          _("net ads gpo getgpo <gpo>"),
-                         _("  List speciefied GPO\n"
+                         _("  List specified GPO\n"
                            "    gpo\t\tGPO to list\n"));
                 return -1;
@@ -617 +624 @@
         }
 
-        dump_gpo(ads, mem_ctx, &gpo, 1);
+        dump_gpo(&gpo, 1);
 
 out:

vendor/current/source3/utils/net_afs.c

@@ -20 +20 @@
 #include "includes.h"
 #include "utils/net.h"
+#include "utils/net_afs.h"
 #include "secrets.h"
 #include "system/filesys.h"
+#include "lib/afs/afs_funcs.h"
+#include "lib/afs/afs_settoken.h"
+
+#ifdef WITH_FAKE_KASERVER
 
 int net_afs_usage(struct net_context *c, int argc, const char **argv)
@@ -118 +123 @@
 }
 
+#endif /* WITH_FAKE_KASERVER */

vendor/current/source3/utils/net_cache.c

@@ -243 +243 @@
         }
 
-        if (gencache_get_data_blob(keystr, &value, &timeout, NULL)) {
+        if (gencache_get_data_blob(keystr, NULL, &value, &timeout, NULL)) {
                 print_cache_entry(keystr, value, timeout, NULL);
                 data_blob_free(&value);

vendor/current/source3/utils/net_conf.c

@@ -31 +31 @@
 #include "system/filesys.h"
 #include "utils/net.h"
+#include "utils/net_conf_util.h"
 #include "lib/smbconf/smbconf.h"
 #include "lib/smbconf/smbconf_init.h"
 #include "lib/smbconf/smbconf_reg.h"
+#include "lib/param/loadparm.h"
 
 /**********************************************************************
@@ -91 +93 @@
                  _("Usage:"),
                  _(" net conf addshare <sharename> <path> "
-                   "[writeable={y|N} [guest_ok={y|N} [<comment>]]\n"
+                   "[writeable={y|N} [guest_ok={y|N} [<comment>]]]\n"
                    "\t<sharename>      the new share name.\n"
                    "\t<path>           the path on the filesystem to export.\n"
@@ -179 +181 @@
                                      struct smbconf_service *service)
 {
-        uint32_t idx;
         sbcErr err = SBC_ERR_OK;
-        uint32_t num_includes = 0;
-        char **includes = NULL;
-        TALLOC_CTX *mem_ctx = talloc_stackframe();
 
         if (c->opt_testmode) {
+                uint32_t idx;
                 const char *indent = "";
                 if (service->name != NULL) {
@@ -206 +205 @@
                 }
         }
-        err = smbconf_create_share(conf_ctx, service->name);
-        if (!SBC_ERROR_IS_OK(err)) {
-                goto done;
-        }
-
-        for (idx = 0; idx < service->num_params; idx ++) {
-                if (strequal(service->param_names[idx], "include")) {
-                        includes = TALLOC_REALLOC_ARRAY(mem_ctx,
-                                                        includes,
-                                                        char *,
-                                                        num_includes+1);
-                        if (includes == NULL) {
-                                err = SBC_ERR_NOMEM;
-                                goto done;
-                        }
-                        includes[num_includes] = talloc_strdup(includes,
-                                                service->param_values[idx]);
-                        if (includes[num_includes] == NULL) {
-                                err = SBC_ERR_NOMEM;
-                                goto done;
-                        }
-                        num_includes++;
-                } else {
-                        err = smbconf_set_parameter(conf_ctx,
-                                                     service->name,
-                                                     service->param_names[idx],
-                                                     service->param_values[idx]);
-                        if (!SBC_ERROR_IS_OK(err)) {
-                                d_fprintf(stderr,
-                                          _("Error in section [%s], parameter \"%s\": %s\n"),
-                                          service->name, service->param_names[idx],
-                                          sbcErrorString(err));
-                                goto done;
-                        }
-                }
-        }
-
-        err = smbconf_set_includes(conf_ctx, service->name, num_includes,
-                                   (const char **)includes);
-        if (!SBC_ERROR_IS_OK(err)) {
-                goto done;
-        }
-
-        err = SBC_ERR_OK;
-done:
-        TALLOC_FREE(mem_ctx);
+
+        err = smbconf_create_set_share(conf_ctx, service);
+
+done:
         return err;
 }
@@ -383 +340 @@
                 err = import_process_service(c, conf_ctx, service);
                 if (!SBC_ERROR_IS_OK(err)) {
+                        d_printf(_("error importing service %s: %s\n"),
+                                 servicename, sbcErrorString(err));
                         goto cancel;
                 }
@@ -420 +379 @@
                                                      services[sidx]);
                         if (!SBC_ERROR_IS_OK(err)) {
+                                d_printf(_("error importing service %s: %s\n"),
+                                         services[sidx]->name,
+                                         sbcErrorString(err));
                                 goto cancel;
                         }
@@ -833 +795 @@
         value_str = argv[2];
 
+        if (!net_conf_param_valid(service,param, value_str)) {
+                goto done;
+        }
+
         err = smbconf_transaction_start(conf_ctx);
         if (!SBC_ERROR_IS_OK(err)) {
@@ -1131 +1097 @@
         err = smbconf_init(mem_ctx, &conf_ctx, "registry:");
         if (!SBC_ERROR_IS_OK(err)) {
+                talloc_free(mem_ctx);
                 return -1;
         }
@@ -1138 +1105 @@
         smbconf_shutdown(conf_ctx);
 
+        talloc_free(mem_ctx);
         return ret;
 }
@@ -1167 +1135 @@
         if (argc != 0) {
                 for (i=0; table[i].funcname; i++) {
-                        if (StrCaseCmp(argv[0], table[i].funcname) == 0)
+                        if (strcasecmp_m(argv[0], table[i].funcname) == 0)
                                 return net_conf_wrap_function(c, table[i].fn,
                                                               argc-1,
@@ -1300 +1268 @@
                         NET_TRANSPORT_LOCAL,
                         N_("Delete includes from a share definition."),
-                        N_("net conf setincludes\n"
+                        N_("net conf delincludes\n"
                            "    Delete includes from a share definition.")
                 },

vendor/current/source3/utils/net_dns.c

@@ -193 +193 @@
 
                 /* Don't register loopback addresses */
-                if (is_loopback_addr((struct sockaddr *)nic_sa_storage)) {
+                if (is_loopback_addr((const struct sockaddr *)nic_sa_storage)) {
+                        continue;
+                }
+
+                /* Don't register link-local addresses */
+                if (is_linklocal_addr(nic_sa_storage)) {
                         continue;
                 }
@@ -206 +211 @@
 DNS_ERROR do_gethostbyname(const char *server, const char *host)
 {
-        struct dns_connection *conn;
+        struct dns_connection *conn = NULL;
         struct dns_request *req, *resp;
         DNS_ERROR err;

vendor/current/source3/utils/net_dom.c

@@ -112 +112 @@
 
                 ret = run_rpc_command(c, cli,
-                                      &ndr_table_initshutdown.syntax_id,
+                                      &ndr_table_initshutdown,
                                       0, rpc_init_shutdown_internals,
                                       argc, argv);
@@ -119 +119 @@
                 }
 
-                ret = run_rpc_command(c, cli, &ndr_table_winreg.syntax_id, 0,
+                ret = run_rpc_command(c, cli, &ndr_table_winreg, 0,
                                       rpc_reg_shutdown_internals,
                                       argc, argv);
@@ -218 +218 @@
                 c->opt_timeout = 30;
 
-                ret = run_rpc_command(c, cli, &ndr_table_initshutdown.syntax_id, 0,
+                ret = run_rpc_command(c, cli, &ndr_table_initshutdown, 0,
                                       rpc_init_shutdown_internals,
                                       argc, argv);
@@ -225 +225 @@
                 }
 
-                ret = run_rpc_command(c, cli, &ndr_table_winreg.syntax_id, 0,
+                ret = run_rpc_command(c, cli, &ndr_table_winreg, 0,
                                       rpc_reg_shutdown_internals,
                                       argc, argv);
@@ -315 +315 @@
 
                 ret = run_rpc_command(c, cli,
-                                      &ndr_table_initshutdown.syntax_id,
+                                      &ndr_table_initshutdown,
                                       0, rpc_init_shutdown_internals,
                                       argc, argv);
@@ -322 +322 @@
                 }
 
-                ret = run_rpc_command(c, cli, &ndr_table_winreg.syntax_id, 0,
+                ret = run_rpc_command(c, cli, &ndr_table_winreg, 0,
                                       rpc_reg_shutdown_internals,
                                       argc, argv);

vendor/current/source3/utils/net_file.c

@@ -45 +45 @@
                 return net_file_usage(c, argc, argv);
 
-        if (StrCaseCmp(argv[0], "HELP") == 0) {
+        if (strcasecmp_m(argv[0], "HELP") == 0) {
                 net_file_usage(c, argc, argv);
                 return 0;

vendor/current/source3/utils/net_g_lock.c

@@ -32 +32 @@
         struct g_lock_ctx *g_ctx = NULL;
 
-        ev = tevent_context_init(mem_ctx);
+        ev = samba_tevent_context_init(mem_ctx);
         if (ev == NULL) {
                 d_fprintf(stderr, "ERROR: could not init event context\n");
                 goto fail;
         }
-        msg = messaging_init(mem_ctx, procid_self(), ev);
+        msg = messaging_init(mem_ctx, ev);
         if (msg == NULL) {
                 d_fprintf(stderr, "ERROR: could not init messaging context\n");
@@ -92 +92 @@
         status = g_lock_do(name, G_LOCK_WRITE,
                            timeval_set(timeout / 1000, timeout % 1000),
-                           procid_self(), net_g_lock_do_fn, &state);
+                           net_g_lock_do_fn, &state);
         if (!NT_STATUS_IS_OK(status)) {
                 d_fprintf(stderr, "ERROR: g_lock_do failed: %s\n",
@@ -112 +112 @@
                               void *private_data)
 {
-        char *pidstr;
-
-        pidstr = procid_str(talloc_tos(), &pid);
-        d_printf("%s: %s (%s)\n", pidstr,
-                 (lock_type & 1) ? "WRITE" : "READ",
-                 (lock_type & G_LOCK_PENDING) ? "pending" : "holder");
-        TALLOC_FREE(pidstr);
+        struct server_id_buf idbuf;
+        d_printf("%s: %s\n", server_id_str_buf(pid, &idbuf),
+                 (lock_type & 1) ? "WRITE" : "READ");
         return 0;
 }
@@ -127 +123 @@
         struct messaging_context *msg = NULL;
         struct g_lock_ctx *g_ctx = NULL;
-        NTSTATUS status;
         int ret = -1;
 
@@ -139 +134 @@
         }
 
-        status = g_lock_dump(g_ctx, argv[0], net_g_lock_dump_fn, NULL);
+        (void)g_lock_dump(g_ctx, argv[0], net_g_lock_dump_fn, NULL);
 
         ret = 0;
@@ -176 +171 @@
         TALLOC_FREE(msg);
         TALLOC_FREE(ev);
-        return ret;
+        return ret < 0 ? -1 : ret;
 }
 

vendor/current/source3/utils/net_group.c

@@ -56 +56 @@
                 return net_group_usage(c, argc, argv);
 
-        if (StrCaseCmp(argv[0], "HELP") == 0) {
+        if (strcasecmp_m(argv[0], "HELP") == 0) {
                 net_group_usage(c, argc, argv);
                 return 0;

vendor/current/source3/utils/net_groupmap.c

@@ -34 +34 @@
 static bool get_sid_from_input(struct dom_sid *sid, char *input)
 {
-        GROUP_MAP map;
-
-        if (StrnCaseCmp( input, "S-", 2)) {
+        GROUP_MAP *map;
+
+        map = talloc_zero(NULL, GROUP_MAP);
+        if (!map) {
+                return false;
+        }
+
+        if (strncasecmp_m( input, "S-", 2)) {
                 /* Perhaps its the NT group name? */
-                if (!pdb_getgrnam(&map, input)) {
+                if (!pdb_getgrnam(map, input)) {
                         printf(_("NT Group %s doesn't exist in mapping DB\n"),
                                input);
+                        TALLOC_FREE(map);
                         return false;
                 } else {
-                        *sid = map.sid;
+                        *sid = map->sid;
                 }
         } else {
@@ -49 +55 @@
                         printf(_("converting sid %s from a string failed!\n"),
                                input);
+                        TALLOC_FREE(map);
                         return false;
                 }
         }
+        TALLOC_FREE(map);
         return true;
 }
@@ -59 +67 @@
 **********************************************************/
 
-static void print_map_entry ( GROUP_MAP map, bool long_list )
+static void print_map_entry (const GROUP_MAP *map, bool long_list)
 {
         if (!long_list)
-                d_printf("%s (%s) -> %s\n", map.nt_name,
-                         sid_string_tos(&map.sid), gidtoname(map.gid));
+                d_printf("%s (%s) -> %s\n", map->nt_name,
+                         sid_string_tos(&map->sid), gidtoname(map->gid));
         else {
-                d_printf("%s\n", map.nt_name);
-                d_printf(_("\tSID       : %s\n"), sid_string_tos(&map.sid));
-                d_printf(_("\tUnix gid  : %u\n"), (unsigned int)map.gid);
-                d_printf(_("\tUnix group: %s\n"), gidtoname(map.gid));
+                d_printf("%s\n", map->nt_name);
+                d_printf(_("\tSID       : %s\n"), sid_string_tos(&map->sid));
+                d_printf(_("\tUnix gid  : %u\n"), (unsigned int)map->gid);
+                d_printf(_("\tUnix group: %s\n"), gidtoname(map->gid));
                 d_printf(_("\tGroup type: %s\n"),
-                         sid_type_lookup(map.sid_name_use));
-                d_printf(_("\tComment   : %s\n"), map.comment);
+                         sid_type_lookup(map->sid_name_use));
+                d_printf(_("\tComment   : %s\n"), map->comment);
         }
 
@@ -101 +109 @@
         /* get the options */
         for ( i=0; i<argc; i++ ) {
-                if ( !StrCaseCmp(argv[i], "verbose")) {
+                if ( !strcasecmp_m(argv[i], "verbose")) {
                         long_list = true;
                 }
-                else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
+                else if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
                         if ( !ntgroup[0] ) {
@@ -111 +119 @@
                         }
                 }
-                else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
+                else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
                         fstrcpy( sid_string, get_string_param( argv[i] ) );
                         if ( !sid_string[0] ) {
@@ -128 +136 @@
         if ( ntgroup[0] || sid_string[0] ) {
                 struct dom_sid sid;
-                GROUP_MAP map;
+                GROUP_MAP *map;
 
                 if ( sid_string[0] )
-                        fstrcpy( ntgroup, sid_string);
+                        strlcpy(ntgroup, sid_string, sizeof(ntgroup));
 
                 if (!get_sid_from_input(&sid, ntgroup)) {
@@ -137 +145 @@
                 }
 
+                map = talloc_zero(NULL, GROUP_MAP);
+                if (!map) {
+                        return -1;
+                }
+
                 /* Get the current mapping from the database */
-                if(!pdb_getgrsid(&map, sid)) {
+                if(!pdb_getgrsid(map, sid)) {
                         d_fprintf(stderr,
                                   _("Failure to local group SID in the "
                                     "database\n"));
-                        return -1;
-                }
-
-                print_map_entry( map, long_list );
+                        TALLOC_FREE(map);
+                        return -1;
+                }
+
+                print_map_entry(map, long_list );
+                TALLOC_FREE(map);
         }
         else {
-                GROUP_MAP *map=NULL;
+                GROUP_MAP **maps = NULL;
+                bool ok = false;
                 /* enumerate all group mappings */
-                if (!pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN, &map, &entries, ENUM_ALL_MAPPED))
-                        return -1;
+                ok = pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN,
+                                            &maps, &entries,
+                                            ENUM_ALL_MAPPED);
+                if (!ok) {
+                        return -1;
+                }
 
                 for (i=0; i<entries; i++) {
-                        print_map_entry( map[i], long_list );
-                }
-
-                SAFE_FREE(map);
+                        print_map_entry(maps[i], long_list);
+                }
+
+                TALLOC_FREE(maps);
         }
 
@@ -176 +196 @@
         fstring ntcomment = "";
         enum lsa_SidType sid_type = SID_NAME_DOM_GRP;
-        uint32 rid = 0;
+        uint32_t rid = 0;
         gid_t gid;
         int i;
-        GROUP_MAP map;
+        GROUP_MAP *map;
 
         const char *name_type;
@@ -189 +209 @@
                                         "[comment=<string>]");
 
-        ZERO_STRUCT(map);
-
-        /* Default is domain group. */
-        map.sid_name_use = SID_NAME_DOM_GRP;
         name_type = "domain group";
 
@@ -202 +218 @@
         /* get the options */
         for ( i=0; i<argc; i++ ) {
-                if ( !StrnCaseCmp(argv[i], "rid", strlen("rid")) ) {
+                if ( !strncasecmp_m(argv[i], "rid", strlen("rid")) ) {
                         rid = get_int_param(argv[i]);
                         if ( rid < DOMAIN_RID_ADMINS ) {
                                 d_fprintf(stderr,
                                           _("RID must be greater than %d\n"),
-                                          (uint32)DOMAIN_RID_ADMINS-1);
-                                return -1;
-                        }
-                }
-                else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) {
+                                          (uint32_t)DOMAIN_RID_ADMINS-1);
+                                return -1;
+                        }
+                }
+                else if ( !strncasecmp_m(argv[i], "unixgroup", strlen("unixgroup")) ) {
                         fstrcpy( unixgrp, get_string_param( argv[i] ) );
                         if ( !unixgrp[0] ) {
@@ -218 +234 @@
                         }
                 }
-                else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
+                else if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
                         if ( !ntgroup[0] ) {
@@ -225 +241 @@
                         }
                 }
-                else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
+                else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
                         fstrcpy( string_sid, get_string_param( argv[i] ) );
                         if ( !string_sid[0] ) {
@@ -232 +248 @@
                         }
                 }
-                else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
+                else if ( !strncasecmp_m(argv[i], "comment", strlen("comment")) ) {
                         fstrcpy( ntcomment, get_string_param( argv[i] ) );
                         if ( !ntcomment[0] ) {
@@ -240 +256 @@
                         }
                 }
-                else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) )  {
+                else if ( !strncasecmp_m(argv[i], "type", strlen("type")) )  {
                         fstrcpy( type, get_string_param( argv[i] ) );
                         switch ( type[0] ) {
@@ -281 +297 @@
         }
 
-        {
-                if (pdb_getgrgid(&map, gid)) {
-                        d_printf(_("Unix group %s already mapped to SID %s\n"),
-                                 unixgrp, sid_string_tos(&map.sid));
-                        return -1;
-                }
-        }
+        map = talloc_zero(NULL, GROUP_MAP);
+        if (!map) {
+                return -1;
+        }
+        /* Default is domain group. */
+        map->sid_name_use = SID_NAME_DOM_GRP;
+        if (pdb_getgrgid(map, gid)) {
+                d_printf(_("Unix group %s already mapped to SID %s\n"),
+                         unixgrp, sid_string_tos(&map->sid));
+                TALLOC_FREE(map);
+                return -1;
+        }
+        TALLOC_FREE(map);
 
         if ( (rid == 0) && (string_sid[0] == '\0') ) {
@@ -325 +347 @@
 
         if (!ntgroup[0] )
-                fstrcpy( ntgroup, unixgrp );
+                strlcpy(ntgroup, unixgrp, sizeof(ntgroup));
 
         if (!NT_STATUS_IS_OK(add_initial_entry(gid, string_sid, sid_type, ntgroup, ntcomment))) {
@@ -340 +362 @@
 {
         struct dom_sid sid;
-        GROUP_MAP map;
+        GROUP_MAP *map = NULL;
         fstring ntcomment = "";
         fstring type = "";
@@ -362 +384 @@
         /* get the options */
         for ( i=0; i<argc; i++ ) {
-                if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
+                if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
                         if ( !ntgroup[0] ) {
@@ -369 +391 @@
                         }
                 }
-                else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
+                else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
                         fstrcpy( sid_string, get_string_param( argv[i] ) );
                         if ( !sid_string[0] ) {
@@ -376 +398 @@
                         }
                 }
-                else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
+                else if ( !strncasecmp_m(argv[i], "comment", strlen("comment")) ) {
                         fstrcpy( ntcomment, get_string_param( argv[i] ) );
                         if ( !ntcomment[0] ) {
@@ -384 +406 @@
                         }
                 }
-                else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) {
+                else if ( !strncasecmp_m(argv[i], "unixgroup", strlen("unixgroup")) ) {
                         fstrcpy( unixgrp, get_string_param( argv[i] ) );
                         if ( !unixgrp[0] ) {
@@ -392 +414 @@
                         }
                 }
-                else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) )  {
+                else if ( !strncasecmp_m(argv[i], "type", strlen("type")) )  {
                         fstrcpy( type, get_string_param( argv[i] ) );
                         switch ( type[0] ) {
@@ -431 +453 @@
         }
 
+        map = talloc_zero(NULL, GROUP_MAP);
+        if (!map) {
+                return -1;
+        }
+
         /* Get the current mapping from the database */
-        if(!pdb_getgrsid(&map, sid)) {
+        if(!pdb_getgrsid(map, sid)) {
                 d_fprintf(stderr,
                          _("Failed to find local group SID in the database\n"));
+                TALLOC_FREE(map);
                 return -1;
         }
@@ -444 +472 @@
         if (sid_type == SID_NAME_UNKNOWN) {
                 d_fprintf(stderr, _("Can't map to an unknown group type.\n"));
+                TALLOC_FREE(map);
                 return -1;
         }
 
-        if (map.sid_name_use == SID_NAME_WKN_GRP) {
+        if (map->sid_name_use == SID_NAME_WKN_GRP) {
                 d_fprintf(stderr,
                           _("You can only change between domain and local "
                             "groups.\n"));
-                return -1;
-        }
-
-        map.sid_name_use=sid_type;
+                TALLOC_FREE(map);
+                return -1;
+        }
+
+        map->sid_name_use = sid_type;
 
         /* Change comment if new one */
-        if ( ntcomment[0] )
-                fstrcpy( map.comment, ntcomment );
-
-        if ( ntgroup[0] )
-                fstrcpy( map.nt_name, ntgroup );
+        if (ntcomment[0]) {
+                map->comment = talloc_strdup(map, ntcomment);
+                if (!map->comment) {
+                        d_fprintf(stderr, _("Out of memory!\n"));
+                        return -1;
+                }
+        }
+
+        if (ntgroup[0]) {
+                map->nt_name = talloc_strdup(map, ntgroup);
+                if (!map->nt_name) {
+                        d_fprintf(stderr, _("Out of memory!\n"));
+                        return -1;
+                }
+        }
 
         if ( unixgrp[0] ) {
@@ -469 +509 @@
                                             "Make sure the group exists.\n"),
                                 unixgrp);
-                        return -1;
-                }
-
-                map.gid = gid;
-        }
-
-        if ( !NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map)) ) {
+                        TALLOC_FREE(map);
+                        return -1;
+                }
+
+                map->gid = gid;
+        }
+
+        if (!NT_STATUS_IS_OK(pdb_update_group_mapping_entry(map))) {
                 d_fprintf(stderr, _("Could not update group database\n"));
-                return -1;
-        }
-
-        d_printf(_("Updated mapping entry for %s\n"), map.nt_name);
-
+                TALLOC_FREE(map);
+                return -1;
+        }
+
+        d_printf(_("Updated mapping entry for %s\n"), map->nt_name);
+
+        TALLOC_FREE(map);
         return 0;
 }
@@ -501 +544 @@
         /* get the options */
         for ( i=0; i<argc; i++ ) {
-                if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
+                if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
                         if ( !ntgroup[0] ) {
@@ -508 +551 @@
                         }
                 }
-                else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
+                else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
                         fstrcpy( sid_string, get_string_param( argv[i] ) );
                         if ( !sid_string[0] ) {
@@ -529 +572 @@
 
         if ( sid_string[0] )
-                fstrcpy( ntgroup, sid_string );
+                strlcpy(ntgroup, sid_string, sizeof(ntgroup));
 
         if ( !get_sid_from_input(&sid, ntgroup) ) {
@@ -544 +587 @@
         }
 
-        d_printf(_("Sucessfully removed %s from the mapping db\n"), ntgroup);
+        d_printf(_("Successfully removed %s from the mapping db\n"), ntgroup);
 
         return 0;
@@ -553 +596 @@
         const char *ntgroup = NULL;
         struct group *grp = NULL;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         bool have_map = false;
 
@@ -581 +624 @@
         }
 
-        have_map = pdb_getgrnam(&map, ntgroup);
+        map = talloc_zero(NULL, GROUP_MAP);
+        if (!map) {
+                d_printf(_("Out of memory!\n"));
+                return -1;
+        }
+
+        have_map = pdb_getgrnam(map, ntgroup);
 
         if (!have_map) {
@@ -587 +636 @@
                 have_map = ( (strncmp(ntgroup, "S-", 2) == 0) &&
                              string_to_sid(&sid, ntgroup) &&
-                             pdb_getgrsid(&map, sid) );
+                             pdb_getgrsid(map, sid) );
         }
 
@@ -598 +647 @@
                                   _("Could not find group mapping for %s\n"),
                                   ntgroup);
-                        return -1;
-                }
-
-                map.gid = grp->gr_gid;
+                        TALLOC_FREE(map);
+                        return -1;
+                }
+
+                map->gid = grp->gr_gid;
 
                 if (c->opt_rid == 0) {
                         if ( pdb_capabilities() & PDB_CAP_STORE_RIDS ) {
-                                if ( !pdb_new_rid((uint32*)&c->opt_rid) ) {
+                                if ( !pdb_new_rid((uint32_t *)&c->opt_rid) ) {
                                         d_fprintf( stderr,
                                             _("Could not allocate new RID\n"));
+                                        TALLOC_FREE(map);
                                         return -1;
                                 }
                         } else {
-                                c->opt_rid = algorithmic_pdb_gid_to_group_rid(map.gid);
-                        }
-                }
-
-                sid_compose(&map.sid, get_global_sam_sid(), c->opt_rid);
-
-                map.sid_name_use = SID_NAME_DOM_GRP;
-                fstrcpy(map.nt_name, ntgroup);
-                fstrcpy(map.comment, "");
-
-                if (!NT_STATUS_IS_OK(pdb_add_group_mapping_entry(&map))) {
+                                c->opt_rid = algorithmic_pdb_gid_to_group_rid(map->gid);
+                        }
+                }
+
+                sid_compose(&map->sid, get_global_sam_sid(), c->opt_rid);
+
+                map->sid_name_use = SID_NAME_DOM_GRP;
+                map->nt_name = talloc_strdup(map, ntgroup);
+                map->comment = talloc_strdup(map, "");
+                if (!map->nt_name || !map->comment) {
+                        d_printf(_("Out of memory!\n"));
+                        TALLOC_FREE(map);
+                        return -1;
+                }
+
+                if (!NT_STATUS_IS_OK(pdb_add_group_mapping_entry(map))) {
                         d_fprintf(stderr,
                                   _("Could not add mapping entry for %s\n"),
                                   ntgroup);
+                        TALLOC_FREE(map);
                         return -1;
                 }
@@ -632 +689 @@
 
         if ( c->opt_localgroup || c->opt_domaingroup ) {
-                if (map.sid_name_use == SID_NAME_WKN_GRP) {
+                if (map->sid_name_use == SID_NAME_WKN_GRP) {
                         d_fprintf(stderr,
                                   _("Can't change type of the BUILTIN "
                                     "group %s\n"),
-                                  map.nt_name);
+                                  map->nt_name);
+                        TALLOC_FREE(map);
                         return -1;
                 }
@@ -642 +700 @@
 
         if (c->opt_localgroup)
-                map.sid_name_use = SID_NAME_ALIAS;
+                map->sid_name_use = SID_NAME_ALIAS;
 
         if (c->opt_domaingroup)
-                map.sid_name_use = SID_NAME_DOM_GRP;
+                map->sid_name_use = SID_NAME_DOM_GRP;
 
         /* The case (opt_domaingroup && opt_localgroup) was tested for above */
 
         if ((c->opt_comment != NULL) && (strlen(c->opt_comment) > 0)) {
-                fstrcpy(map.comment, c->opt_comment);
+                map->comment = talloc_strdup(map, c->opt_comment);
+                if (!map->comment) {
+                        d_printf(_("Out of memory!\n"));
+                        TALLOC_FREE(map);
+                        return -1;
+                }
         }
 
         if ((c->opt_newntname != NULL) && (strlen(c->opt_newntname) > 0)) {
-                fstrcpy(map.nt_name, c->opt_newntname);
+                map->nt_name = talloc_strdup(map, c->opt_newntname);
+                if (!map->nt_name) {
+                        d_printf(_("Out of memory!\n"));
+                        TALLOC_FREE(map);
+                        return -1;
+                }
         }
 
         if (grp != NULL)
-                map.gid = grp->gr_gid;
-
-        if (!NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map))) {
+                map->gid = grp->gr_gid;
+
+        if (!NT_STATUS_IS_OK(pdb_update_group_mapping_entry(map))) {
                 d_fprintf(stderr, _("Could not update group mapping for %s\n"),
                           ntgroup);
-                return -1;
-        }
-
+                TALLOC_FREE(map);
+                return -1;
+        }
+
+        TALLOC_FREE(map);
         return 0;
 }
@@ -671 +741 @@
 static int net_groupmap_cleanup(struct net_context *c, int argc, const char **argv)
 {
-        GROUP_MAP *map = NULL;
+        GROUP_MAP **maps = NULL;
         size_t i, entries;
 
@@ -683 +753 @@
         }
 
-        if (!pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN, &map, &entries,
+        if (!pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN, &maps, &entries,
                                     ENUM_ALL_MAPPED)) {
                 d_fprintf(stderr, _("Could not list group mappings\n"));
@@ -691 +761 @@
         for (i=0; i<entries; i++) {
 
-                if (map[i].gid == -1)
-                        printf(_("Group %s is not mapped\n"), map[i].nt_name);
-
-                if (!sid_check_is_in_our_domain(&map[i].sid)) {
+                if (maps[i]->gid == -1)
+                        printf(_("Group %s is not mapped\n"),
+                                maps[i]->nt_name);
+
+                if (!sid_check_is_in_our_sam(&maps[i]->sid)) {
                         printf(_("Deleting mapping for NT Group %s, sid %s\n"),
-                               map[i].nt_name,
-                               sid_string_tos(&map[i].sid));
-                        pdb_delete_group_mapping_entry(map[i].sid);
-                }
-        }
-
-        SAFE_FREE(map);
-
+                                maps[i]->nt_name,
+                                sid_string_tos(&maps[i]->sid));
+                        pdb_delete_group_mapping_entry(maps[i]->sid);
+                }
+        }
+
+        TALLOC_FREE(maps);
         return 0;
 }
@@ -791 +861 @@
                                     const struct dom_sid *member)
 {
-        uint32 *alias_rids;
+        uint32_t *alias_rids;
         size_t i, num_alias_rids;
 

vendor/current/source3/utils/net_help.c

@@ -61 +61 @@
         }
 
-        if (StrCaseCmp(argv[0], "help") == 0) {
+        if (strcasecmp_m(argv[0], "help") == 0) {
                 return net_help_usage(c, argc, argv);
         }

vendor/current/source3/utils/net_idmap.c

@@ -23 +23 @@
 #include "secrets.h"
 #include "idmap.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
 #include "../libcli/security/security.h"
 #include "net_idmap_check.h"
 #include "util_tdb.h"
+#include "idmap_autorid_tdb.h"
 
 #define ALLOC_CHECK(mem) do { \
@@ -35 +37 @@
         } } while(0)
 
+enum idmap_dump_backend {
+        TDB,
+        AUTORID
+};
+
+struct net_idmap_ctx {
+        enum idmap_dump_backend backend;
+};
+
+static int net_idmap_dump_one_autorid_entry(struct db_record *rec,
+                                            void *unused)
+{
+        TDB_DATA key;
+        TDB_DATA value;
+
+        key = dbwrap_record_get_key(rec);
+        value = dbwrap_record_get_value(rec);
+
+        if (strncmp((char *)key.dptr, "CONFIG", 6) == 0) {
+                char *config = talloc_array(talloc_tos(), char, value.dsize+1);
+                memcpy(config, value.dptr, value.dsize);
+                config[value.dsize] = '\0';
+                printf("CONFIG: %s\n", config);
+                talloc_free(config);
+                return 0;
+        }
+
+        if (strncmp((char *)key.dptr, "NEXT RANGE", 10) == 0) {
+                printf("RANGE HWM: %"PRIu32"\n", IVAL(value.dptr, 0));
+                return 0;
+        }
+
+        if (strncmp((char *)key.dptr, "NEXT ALLOC UID", 14) == 0) {
+                printf("UID HWM: %"PRIu32"\n", IVAL(value.dptr, 0));
+                return 0;
+        }
+
+        if (strncmp((char *)key.dptr, "NEXT ALLOC GID", 14) == 0) {
+                printf("GID HWM: %"PRIu32"\n", IVAL(value.dptr, 0));
+                return 0;
+        }
+
+        if (strncmp((char *)key.dptr, "UID", 3) == 0 ||
+            strncmp((char *)key.dptr, "GID", 3) == 0)
+        {
+                /* mapped entry from allocation pool */
+                printf("%s %s\n", value.dptr, key.dptr);
+                return 0;
+        }
+
+        if ((strncmp((char *)key.dptr, "S-1-5-", 6) == 0 ||
+             strncmp((char *)key.dptr, "ALLOC", 5) == 0) &&
+            value.dsize == sizeof(uint32_t))
+        {
+                /* this is a domain range assignment */
+                uint32_t range = IVAL(value.dptr, 0);
+                printf("RANGE %"PRIu32": %s\n", range, key.dptr);
+                return 0;
+        }
+
+        return 0;
+}
+
 /***********************************************************
  Helper function for net_idmap_dump. Dump one entry.
  **********************************************************/
-static int net_idmap_dump_one_entry(struct db_record *rec,
-                                    void *unused)
-{
-        if (strcmp((char *)rec->key.dptr, "USER HWM") == 0) {
-                printf(_("USER HWM %d\n"), IVAL(rec->value.dptr,0));
+static int net_idmap_dump_one_tdb_entry(struct db_record *rec,
+                                        void *unused)
+{
+        TDB_DATA key;
+        TDB_DATA value;
+
+        key = dbwrap_record_get_key(rec);
+        value = dbwrap_record_get_value(rec);
+
+        if (strcmp((char *)key.dptr, "USER HWM") == 0) {
+                printf(_("USER HWM %d\n"), IVAL(value.dptr,0));
                 return 0;
         }
 
-        if (strcmp((char *)rec->key.dptr, "GROUP HWM") == 0) {
-                printf(_("GROUP HWM %d\n"), IVAL(rec->value.dptr,0));
+        if (strcmp((char *)key.dptr, "GROUP HWM") == 0) {
+                printf(_("GROUP HWM %d\n"), IVAL(value.dptr,0));
                 return 0;
         }
 
-        if (strncmp((char *)rec->key.dptr, "S-", 2) != 0)
+        if (strncmp((char *)key.dptr, "S-", 2) != 0) {
                 return 0;
-
-        printf("%s %s\n", rec->value.dptr, rec->key.dptr);
+        }
+
+        printf("%s %s\n", value.dptr, key.dptr);
         return 0;
 }
 
-static const char* net_idmap_dbfile(struct net_context *c)
-{
-        const char* dbfile = NULL;
+/* returns db path for idmap backend alloced on talloc_tos */
+static char *net_idmap_dbfile(struct net_context *c,
+                              struct net_idmap_ctx *ctx)
+{
+        char *dbfile = NULL;
+        const char *backend = NULL;
+
+        backend = lp_idmap_default_backend();
+        if (!backend) {
+                d_printf(_("Internal error: 'idmap config * : backend' is not set!\n"));
+                return NULL;
+        }
 
         if (c->opt_db != NULL) {
@@ -67 +148 @@
                         d_fprintf(stderr, _("Out of memory!\n"));
                 }
-        } else if (strequal(lp_idmap_backend(), "tdb")) {
+        } else if (strequal(backend, "tdb")) {
                 dbfile = state_path("winbindd_idmap.tdb");
                 if (dbfile == NULL) {
                         d_fprintf(stderr, _("Out of memory!\n"));
                 }
-        } else if (strequal(lp_idmap_backend(), "tdb2")) {
-                dbfile = lp_parm_talloc_string(-1, "tdb", "idmap2.tdb", NULL);
-                if (dbfile == NULL) {
-                        dbfile = talloc_asprintf(talloc_tos(), "%s/idmap2.tdb",
-                                                 lp_private_dir());
-                }
+                ctx->backend = TDB;
+        } else if (strequal(backend, "tdb2")) {
+                dbfile = talloc_asprintf(talloc_tos(), "%s/idmap2.tdb",
+                                         lp_private_dir());
                 if (dbfile == NULL) {
                         d_fprintf(stderr, _("Out of memory!\n"));
                 }
+                ctx->backend = TDB;
+        } else if (strequal(backend, "autorid")) {
+                dbfile = state_path("autorid.tdb");
+                if (dbfile == NULL) {
+                        d_fprintf(stderr, _("Out of memory!\n"));
+                }
+                ctx->backend = AUTORID;
         } else {
-                char* backend = talloc_strdup(talloc_tos(), lp_idmap_backend());
-                char* args = strchr(backend, ':');
+                char *_backend = talloc_strdup(talloc_tos(), backend);
+                char* args = strchr(_backend, ':');
                 if (args != NULL) {
                         *args = '\0';
@@ -89 +175 @@
 
                 d_printf(_("Sorry, 'idmap backend = %s' is currently not supported\n"),
-                         backend);
-
-                talloc_free(backend);
+                           _backend);
+
+                talloc_free(_backend);
         }
 
         return dbfile;
 }
+
+static bool net_idmap_opendb_autorid(TALLOC_CTX *mem_ctx,
+                                     struct net_context *c,
+                                     bool readonly,
+                                     struct db_context **db)
+{
+        bool ret = false;
+        char *dbfile = NULL;
+        struct net_idmap_ctx ctx = { .backend = AUTORID };
+
+        if (c == NULL) {
+                goto done;
+        }
+
+        dbfile = net_idmap_dbfile(c, &ctx);
+        if (dbfile == NULL) {
+                goto done;
+        }
+
+        if (ctx.backend != AUTORID) {
+                d_fprintf(stderr, _("Unsupported backend\n"));
+                goto done;
+        }
+
+        if (readonly) {
+                *db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDONLY, 0,
+                             DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
+                if (*db == NULL) {
+                        d_fprintf(stderr,
+                                  _("Could not open autorid db (%s): %s\n"),
+                                 dbfile, strerror(errno));
+                        goto done;
+                }
+        } else {
+                NTSTATUS status;
+                status = idmap_autorid_db_init(dbfile, mem_ctx, db);
+                if (!NT_STATUS_IS_OK(status)) {
+                        d_fprintf(stderr,
+                                _("Error calling idmap_autorid_db_init: %s\n"),
+                                nt_errstr(status));
+                        goto done;
+                }
+        }
+
+        ret = true;
+
+done:
+        talloc_free(dbfile);
+        return ret;
+}
+
 
 /***********************************************************
@@ -105 +242 @@
         TALLOC_CTX *mem_ctx;
         const char* dbfile;
+        NTSTATUS status;
         int ret = -1;
+        struct net_idmap_ctx ctx = { .backend = TDB };
 
         if ( argc > 1  || c->display_usage) {
@@ -118 +257 @@
         mem_ctx = talloc_stackframe();
 
-        dbfile = (argc > 0) ? argv[0] : net_idmap_dbfile(c);
+        dbfile = (argc > 0) ? argv[0] : net_idmap_dbfile(c, &ctx);
         if (dbfile == NULL) {
                 goto done;
@@ -124 +263 @@
         d_fprintf(stderr, _("dumping id mapping from %s\n"), dbfile);
 
-        db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDONLY, 0);
+        db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDONLY, 0,
+                     DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
         if (db == NULL) {
                 d_fprintf(stderr, _("Could not open idmap db (%s): %s\n"),
@@ -131 +271 @@
         }
 
-        db->traverse_read(db, net_idmap_dump_one_entry, NULL);
+        if (ctx.backend == AUTORID) {
+                status = dbwrap_traverse_read(db,
+                                              net_idmap_dump_one_autorid_entry,
+                                              NULL, NULL);
+        } else {
+                status = dbwrap_traverse_read(db,
+                                              net_idmap_dump_one_tdb_entry,
+                                              NULL, NULL);
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                d_fprintf(stderr, _("error traversing the database\n"));
+                ret = -1;
+                goto done;
+        }
+
         ret = 0;
 
@@ -192 +346 @@
         const char *dbfile = NULL;
         int ret = 0;
+        struct net_idmap_ctx ctx = { .backend = TDB };
 
         if (c->display_usage) {
@@ -206 +361 @@
         mem_ctx = talloc_stackframe();
 
-        dbfile = net_idmap_dbfile(c);
+        dbfile = net_idmap_dbfile(c, &ctx);
 
         if (dbfile == NULL) {
+                ret = -1;
+                goto done;
+        }
+
+        if (ctx.backend != TDB) {
+                d_fprintf(stderr, _("Sorry, restoring of non-TDB databases is "
+                                    "currently not supported\n"));
                 ret = -1;
                 goto done;
@@ -227 +389 @@
         }
 
-        db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0644);
+        db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0644,
+                     DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
         if (db == NULL) {
                 d_fprintf(stderr, _("Could not open idmap db (%s): %s\n"),
@@ -235 +398 @@
         }
 
-        if (db->transaction_start(db) != 0) {
+        if (dbwrap_transaction_start(db) != 0) {
                 d_fprintf(stderr, _("Failed to start transaction.\n"));
                 ret = -1;
@@ -245 +408 @@
                 int len;
                 unsigned long idval;
+                NTSTATUS status;
 
                 if (fgets(line, 127, input) == NULL)
@@ -269 +433 @@
                         }
                 } else if (sscanf(line, "USER HWM %lu", &idval) == 1) {
-                        ret = dbwrap_store_int32(db, "USER HWM", idval);
-                        if (ret != 0) {
-                                d_fprintf(stderr, _("Could not store USER HWM.\n"));
+                        status = dbwrap_store_int32_bystring(
+                                db, "USER HWM", idval);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                d_fprintf(stderr,
+                                          _("Could not store USER HWM: %s\n"),
+                                          nt_errstr(status));
                                 break;
                         }
                 } else if (sscanf(line, "GROUP HWM %lu", &idval) == 1) {
-                        ret = dbwrap_store_int32(db, "GROUP HWM", idval);
-                        if (ret != 0) {
+                        status = dbwrap_store_int32_bystring(
+                                db, "GROUP HWM", idval);
+                        if (!NT_STATUS_IS_OK(status)) {
                                 d_fprintf(stderr,
-                                          _("Could not store GROUP HWM.\n"));
+                                          _("Could not store GROUP HWM: %s\n"),
+                                          nt_errstr(status));
                                 break;
                         }
@@ -289 +458 @@
 
         if (ret == 0) {
-                if(db->transaction_commit(db) != 0) {
+                if(dbwrap_transaction_commit(db) != 0) {
                         d_fprintf(stderr, _("Failed to commit transaction.\n"));
                         ret = -1;
                 }
         } else {
-                if (db->transaction_cancel(db) != 0) {
+                if (dbwrap_transaction_cancel(db) != 0) {
                         d_fprintf(stderr, _("Failed to cancel transaction.\n"));
                 }
@@ -311 +480 @@
 NTSTATUS dbwrap_delete_mapping(struct db_context *db, TDB_DATA key1, bool force)
 {
-        TALLOC_CTX* mem_ctx = talloc_tos();
-        struct db_record *rec1=NULL, *rec2=NULL;
-        TDB_DATA key2;
+        TALLOC_CTX *mem_ctx = talloc_stackframe();
         bool is_valid_mapping;
         NTSTATUS status = NT_STATUS_OK;
-
-        rec1 = db->fetch_locked(db, mem_ctx, key1);
-        if (rec1 == NULL) {
+        TDB_DATA val1, val2;
+
+        ZERO_STRUCT(val1);
+        ZERO_STRUCT(val2);
+
+        status = dbwrap_fetch(db, mem_ctx, key1, &val1);
+        if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(1, ("failed to fetch: %.*s\n", (int)key1.dsize, key1.dptr));
-                status = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-        key2 = rec1->value;
-        if (key2.dptr == NULL) {
-                DEBUG(1, ("could not find %.*s\n", (int)key1.dsize, key1.dptr));
-                status = NT_STATUS_NOT_FOUND;
+                goto done;
+        }
+
+        if (val1.dptr == NULL) {
+                DEBUG(1, ("invalid mapping: %.*s -> empty value\n",
+                          (int)key1.dsize, key1.dptr));
+                status = NT_STATUS_FILE_INVALID;
                 goto done;
         }
 
         DEBUG(2, ("mapping: %.*s -> %.*s\n",
-                  (int)key1.dsize, key1.dptr, (int)key2.dsize, key2.dptr));
-
-        rec2 = db->fetch_locked(db, mem_ctx, key2);
-        if (rec2 == NULL) {
-                DEBUG(1, ("failed to fetch: %.*s\n", (int)key2.dsize, key2.dptr));
-                status = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        is_valid_mapping = tdb_data_equal(key1, rec2->value);
+                  (int)key1.dsize, key1.dptr, (int)val1.dsize, val1.dptr));
+
+        status = dbwrap_fetch(db, mem_ctx, val1, &val2);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("failed to fetch: %.*s\n", (int)val1.dsize, val1.dptr));
+                goto done;
+        }
+
+        is_valid_mapping = tdb_data_equal(key1, val2);
 
         if (!is_valid_mapping) {
                 DEBUG(1, ("invalid mapping: %.*s -> %.*s -> %.*s\n",
-                          (int)key1.dsize, key1.dptr, (int)key2.dsize, key2.dptr,
-                          (int)rec2->value.dsize, rec2->value.dptr ));
+                          (int)key1.dsize, key1.dptr,
+                          (int)val1.dsize, val1.dptr,
+                          (int)val2.dsize, val2.dptr));
                 if ( !force ) {
                         status = NT_STATUS_FILE_INVALID;
@@ -352 +523 @@
         }
 
-        status = rec1->delete_rec(rec1);
+        status = dbwrap_delete(db, key1);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(1, ("failed to delete: %.*s\n", (int)key1.dsize, key1.dptr));
@@ -358 +529 @@
         }
 
-        if (is_valid_mapping) {
-                status = rec2->delete_rec(rec2);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(1, ("failed to delete: %.*s\n", (int)key2.dsize, key2.dptr));
-                }
-        }
+        if (!is_valid_mapping) {
+                goto done;
+        }
+
+        status = dbwrap_delete(db, val1);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("failed to delete: %.*s\n", (int)val1.dsize, val1.dptr));
+        }
+
 done:
-        TALLOC_FREE(rec1);
-        TALLOC_FREE(rec2);
+        talloc_free(mem_ctx);
         return status;
 }
@@ -397 +570 @@
 }
 
-static int net_idmap_delete(struct net_context *c, int argc, const char **argv)
+static int net_idmap_delete_mapping(struct net_context *c, int argc,
+                                    const char **argv)
 {
         int ret = -1;
@@ -405 +579 @@
         NTSTATUS status;
         const char* dbfile;
+        struct net_idmap_ctx ctx = { .backend = TDB };
 
         if ( !delete_args_ok(argc,argv) || c->display_usage) {
                 d_printf("%s\n%s",
                          _("Usage:"),
-                         _("net idmap delete [-f] [--db=<TDB>] <ID>\n"
+                         _("net idmap delete mapping [-f] [--db=<TDB>] <ID>\n"
                            "  Delete mapping of ID from TDB.\n"
                            "    -f\tforce\n"
@@ -419 +594 @@
         mem_ctx = talloc_stackframe();
 
-        dbfile = net_idmap_dbfile(c);
+        dbfile = net_idmap_dbfile(c, &ctx);
         if (dbfile == NULL) {
                 goto done;
@@ -425 +600 @@
         d_fprintf(stderr, _("deleting id mapping from %s\n"), dbfile);
 
-        db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDWR, 0);
+        db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDWR, 0,
+                     DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
         if (db == NULL) {
                 d_fprintf(stderr, _("Could not open idmap db (%s): %s\n"),
@@ -449 +625 @@
 }
 
-static int net_idmap_set(struct net_context *c, int argc, const char **argv)
+static bool parse_uint32(const char *str, uint32_t *result)
+{
+        unsigned long val;
+        char *endptr;
+
+        val = strtoul(str, &endptr, 10);
+
+        if (str == endptr) {
+                return false;
+        }
+        if (*endptr != '\0') {
+                return false;
+        }
+        if ((val == ULONG_MAX) && (errno == ERANGE)) {
+                return false;
+        }
+        if ((val & UINT32_MAX) != val) {
+                /* overflow */
+                return false;
+        }
+        *result = val;          /* Potential crop */
+        return true;
+}
+
+static void net_idmap_autorid_delete_range_usage(void)
+{
+        d_printf("%s\n%s",
+                 _("Usage:"),
+                 _("net idmap delete range [-f] [--db=<TDB>] <RANGE>|(<SID>[ <INDEX>])\n"
+                   "  Delete a domain range mapping from the database.\n"
+                   "    -f\tforce\n"
+                   "    TDB\tidmap database\n"
+                   "    RANGE\tthe range number to delete\n"
+                   "    SID\t\tSID of the domain\n"
+                   "    INDEX\trange index number do delete for the domain\n"));
+}
+
+static int net_idmap_autorid_delete_range(struct net_context *c, int argc,
+                                          const char **argv)
+{
+        int ret = -1;
+        struct db_context *db = NULL;
+        NTSTATUS status;
+        uint32_t rangenum;
+        uint32_t range_index;
+        const char *domsid;
+        TALLOC_CTX *mem_ctx = NULL;
+        bool ok;
+        bool force = (c->opt_force != 0);
+
+        if (c->display_usage) {
+                net_idmap_autorid_delete_range_usage();
+                return 0;
+        }
+
+        if (argc < 1 || argc > 2) {
+                net_idmap_autorid_delete_range_usage();
+                return -1;
+        }
+
+        mem_ctx = talloc_stackframe();
+        if (!net_idmap_opendb_autorid(mem_ctx, c, false, &db)) {
+                goto done;
+        }
+
+        ok = parse_uint32(argv[0], &rangenum);
+        if (ok) {
+                d_printf("%s: %"PRIu32"\n", _("Deleting range number"),
+                         rangenum);
+
+                status = idmap_autorid_delete_range_by_num(db, rangenum,
+                                                           force);
+                if (!NT_STATUS_IS_OK(status)) {
+                        d_fprintf(stderr, "%s: %s\n",
+                                  _("Failed to delete domain range mapping"),
+                                  nt_errstr(status));
+                } else {
+                        ret = 0;
+                }
+
+                goto done;
+        }
+
+        domsid = argv[0];
+        range_index = 0;
+
+        if (argc == 2) {
+                ok = parse_uint32(argv[1], &range_index);
+                if (!ok) {
+                        d_printf("%s: %s\n",
+                                 _("Invalid index specification"), argv[1]);
+                        net_idmap_autorid_delete_range_usage();
+                        goto done;
+                }
+        }
+
+        status = idmap_autorid_delete_range_by_sid(db, domsid, range_index,
+                                                   force);
+        if (!NT_STATUS_IS_OK(status)) {
+                d_fprintf(stderr, "%s: %s\n",
+                          _("Failed to delete domain range mapping"),
+                          nt_errstr(status));
+                goto done;
+        }
+
+        ret = 0;
+
+done:
+        talloc_free(mem_ctx);
+        return ret;
+}
+
+static void net_idmap_autorid_delete_ranges_usage(void)
+{
+        d_printf("%s\n%s",
+                 _("Usage:"),
+                 _("net idmap delete ranges [-f] [--db=<TDB>] <SID>\n"
+                   "  Delete all domain range mappings for a given domain.\n"
+                   "    -f\tforce\n"
+                   "    TDB\tidmap database\n"
+                   "    SID\t\tSID of the domain\n"));
+}
+
+static int net_idmap_autorid_delete_ranges(struct net_context *c, int argc,
+                                           const char **argv)
+{
+        int ret = -1;
+        struct db_context *db = NULL;
+        NTSTATUS status;
+        const char *domsid;
+        TALLOC_CTX *mem_ctx = NULL;
+        bool force = (c->opt_force != 0);
+        int count = 0;
+
+        if (c->display_usage) {
+                net_idmap_autorid_delete_ranges_usage();
+                return 0;
+        }
+
+        if (argc != 1) {
+                net_idmap_autorid_delete_ranges_usage();
+                return -1;
+        }
+
+        domsid = argv[0];
+
+        mem_ctx = talloc_stackframe();
+        if (!net_idmap_opendb_autorid(mem_ctx, c, false, &db)) {
+                goto done;
+        }
+
+        status = idmap_autorid_delete_domain_ranges(db, domsid, force, &count);
+        if (!NT_STATUS_IS_OK(status)) {
+                d_fprintf(stderr, "%s %s: %s\n",
+                          _("Failed to delete domain range mappings for "
+                            "domain"),
+                          domsid,
+                          nt_errstr(status));
+                goto done;
+        }
+
+        d_printf(_("deleted %d domain mappings\n"), count);
+
+        ret = 0;
+
+done:
+        talloc_free(mem_ctx);
+        return ret;
+}
+
+static int net_idmap_delete(struct net_context *c, int argc, const char **argv)
+{
+        struct functable func[] = {
+                {
+                        "mapping",
+                        net_idmap_delete_mapping,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Delete ID mapping"),
+                        N_("net idmap delete mapping <ID>\n"
+                           "  Delete ID mapping")
+                },
+                {
+                        "range",
+                        net_idmap_autorid_delete_range,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Delete a domain range mapping"),
+                        N_("net idmap delete range <RANGE>|(<SID>[ <INDEX>])\n"
+                           "  Delete a domain range mapping")
+                },
+                {
+                        "ranges",
+                        net_idmap_autorid_delete_ranges,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Delete all domain range mappings for a given "
+                           "domain"),
+                        N_("net idmap delete ranges <SID>\n"
+                           "  Delete a domain range mapping")
+                },
+                {NULL, NULL, 0, NULL, NULL}
+        };
+
+        return net_run_function(c, argc, argv, "net idmap delete", func);
+}
+
+
+static int net_idmap_set_mapping(struct net_context *c,
+                                 int argc, const char **argv)
 {
         d_printf("%s\n", _("Not implemented yet"));
         return -1;
 }
+
+static void net_idmap_autorid_set_range_usage(void)
+{
+        d_printf("%s\n%s",
+                 _("Usage:"),
+                 _("net idmap set range"
+                   " <range> <SID> [<index>] [--db=<inputfile>]\n"
+                   "  Store a domain-range mapping for a given domain.\n"
+                   "    range\tRange number to be set for the domain\n"
+                   "    SID\t\tSID of the domain\n"
+                   "    index\trange-index number to be set for the domain\n"
+                   "    inputfile\tTDB file to add mapping to.\n"));
+}
+
+static int net_idmap_autorid_set_range(struct net_context *c,
+                                       int argc, const char **argv)
+{
+        int ret = -1;
+        TALLOC_CTX *mem_ctx;
+        struct db_context *db = NULL;
+        const char *domsid;
+        uint32_t rangenum;
+        uint32_t range_index = 0;
+        NTSTATUS status;
+        bool ok;
+
+        if (c->display_usage) {
+                net_idmap_autorid_set_range_usage();
+                return 0;
+        }
+
+        if (argc < 2  || argc > 3) {
+                net_idmap_autorid_set_range_usage();
+                return -1;
+        }
+
+        ok = parse_uint32(argv[0], &rangenum);
+        if (!ok) {
+                d_printf("%s: %s\n", _("Invalid range specification"),
+                         argv[0]);
+                net_idmap_autorid_set_range_usage();
+                return -1;
+        }
+
+        domsid = argv[1];
+
+        if (argc == 3) {
+                ok = parse_uint32(argv[2], &range_index);
+                if (!ok) {
+                        d_printf("%s: %s\n",
+                                 _("Invalid index specification"), argv[2]);
+                        net_idmap_autorid_set_range_usage();
+                        return -1;
+                }
+        }
+
+        mem_ctx = talloc_stackframe();
+        if (!net_idmap_opendb_autorid(mem_ctx, c, false, &db)) {
+                goto done;
+        }
+
+        status = idmap_autorid_setrange(db, domsid, range_index, rangenum);
+        if (!NT_STATUS_IS_OK(status)) {
+                d_fprintf(stderr, "%s: %s\n",
+                          _("Failed to save domain mapping"),
+                          nt_errstr(status));
+                goto done;
+        }
+
+        ret = 0;
+
+done:
+        TALLOC_FREE(mem_ctx);
+        return ret;
+}
+
 static bool idmap_store_secret(const char *backend,
                                const char *domain,
@@ -467 +925 @@
         if (r < 0) return false;
 
-        strupper_m(tmp); /* make sure the key is case insensitive */
+        /* make sure the key is case insensitive */
+        if (!strupper_m(tmp)) {
+                free(tmp);
+                return false;
+        }
         ret = secrets_store_generic(tmp, identity, secret);
 
@@ -488 +950 @@
                 d_printf("%s\n%s",
                          _("Usage:\n"),
-                         _("net idmap secret <DOMAIN> <secret>\n"
+                         _("net idmap set secret <DOMAIN> <secret>\n"
                            "  Set the secret for the specified domain\n"
                            "    DOMAIN\tDomain to set secret for.\n"
@@ -509 +971 @@
         ALLOC_CHECK(backend);
 
-        if ( ( ! backend) || ( ! strequal(backend, "ldap"))) {
+        if ((!backend) || (!strequal(backend, "ldap") &&
+                           !strequal(backend, "rfc2307"))) {
                 d_fprintf(stderr,
-                          _("The only currently supported backend is LDAP\n"));
+                          _("The only currently supported backend are LDAP "
+                            "and rfc2307\n"));
                 talloc_free(ctx);
                 return -1;
@@ -537 +1001 @@
 }
 
+static int net_idmap_autorid_set_config(struct net_context *c,
+                                        int argc, const char **argv)
+{
+        int ret = -1;
+        NTSTATUS status;
+        TALLOC_CTX *mem_ctx;
+        struct db_context *db = NULL;
+
+        if (argc != 1 || c->display_usage) {
+                d_printf("%s\n%s",
+                         _("Usage:"),
+                         _("net idmap set config <config>"
+                           " [--db=<inputfile>]\n"
+                           " Update CONFIG entry in autorid.\n"
+                           "    config\tConfig string to be stored\n"
+                           "    inputfile\tTDB file to update config.\n"));
+                return c->display_usage ? 0 : -1;
+        }
+
+        mem_ctx = talloc_stackframe();
+
+        if (!net_idmap_opendb_autorid(mem_ctx, c, false, &db)) {
+                goto done;
+        }
+
+        status = idmap_autorid_saveconfigstr(db, argv[0]);
+        if (!NT_STATUS_IS_OK(status)) {
+                printf("Error storing the config in the database: %s\n",
+                       nt_errstr(status));
+                goto done;
+        }
+
+        ret = 0;
+
+done:
+        TALLOC_FREE(mem_ctx);
+        return ret;
+}
+
+static int net_idmap_set(struct net_context *c, int argc, const char **argv)
+{
+        struct functable func[] = {
+                {
+                        "mapping",
+                        net_idmap_set_mapping,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Not implemented yet"),
+                        N_("net idmap set mapping\n"
+                           "  Not implemented yet")
+                },
+                {
+                        "range",
+                        net_idmap_autorid_set_range,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Store a domain-range mapping"),
+                        N_("net idmap set range\n"
+                           "  Store a domain-range mapping")
+                },
+                {
+                        "config",
+                        net_idmap_autorid_set_config,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Save the global configuration in the autorid database"),
+                        N_("net idmap set config \n"
+                           "  Save the global configuration in the autorid database ")
+                },
+                {
+                        "secret",
+                        net_idmap_secret,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Set secret for specified domain"),
+                        N_("net idmap set secret <DOMAIN> <secret>\n"
+                           "  Set secret for specified domain")
+                },
+                {NULL, NULL, 0, NULL, NULL}
+        };
+
+        return net_run_function(c, argc, argv, "net idmap set", func);
+}
+
+static void net_idmap_autorid_get_range_usage(void)
+{
+        d_printf("%s\n%s",
+                 _("Usage:"),
+                 _("net idmap get range <SID> [<index>] [--db=<inputfile>]\n"
+                   "  Get the range for a given domain and index.\n"
+                   "    SID\t\tSID of the domain\n"
+                   "    index\trange-index number to be retrieved\n"
+                   "    inputfile\tTDB file to add mapping to.\n"));
+}
+
+
+static int net_idmap_autorid_get_range(struct net_context *c, int argc,
+                                       const char **argv)
+{
+        int ret = -1;
+        TALLOC_CTX *mem_ctx;
+        struct db_context *db = NULL;
+        const char *domsid;
+        uint32_t rangenum;
+        uint32_t range_index = 0;
+        uint32_t low_id;
+        NTSTATUS status;
+        char *keystr;
+        bool ok;
+
+        if (c->display_usage) {
+                net_idmap_autorid_get_range_usage();
+                return 0;
+        }
+
+        if (argc < 1  || argc > 2) {
+                net_idmap_autorid_get_range_usage();
+                return -1;
+        }
+
+        domsid = argv[0];
+
+        if (argc == 2) {
+                ok = parse_uint32(argv[1], &range_index);
+                if (!ok) {
+                        d_printf("%s: %s\n",
+                                 _("Invalid index specification"), argv[1]);
+                        net_idmap_autorid_get_range_usage();
+                        return -1;
+                }
+        }
+
+        mem_ctx = talloc_stackframe();
+        if (!net_idmap_opendb_autorid(mem_ctx, c, true, &db)) {
+                goto done;
+        }
+
+        status = idmap_autorid_getrange(db, domsid, range_index, &rangenum,
+                                        &low_id);
+        if (!NT_STATUS_IS_OK(status)) {
+                d_fprintf(stderr, "%s: %s\n",
+                          _("Failed to load domain range"), nt_errstr(status));
+                goto done;
+        }
+
+        if (range_index == 0) {
+                keystr = talloc_strdup(mem_ctx, domsid);
+        } else {
+                keystr = talloc_asprintf(mem_ctx, "%s#%"PRIu32, domsid,
+                                         range_index);
+        }
+
+        printf("RANGE %"PRIu32": %s (low id: %"PRIu32")\n",
+               rangenum, keystr, low_id);
+
+        ret = 0;
+
+done:
+        TALLOC_FREE(mem_ctx);
+        return ret;
+}
+
+static NTSTATUS net_idmap_autorid_print_range(struct db_context *db,
+                                              const char *domsid,
+                                              uint32_t range_index,
+                                              uint32_t rangenum,
+                                              void *private_data)
+{
+        if (range_index == 0) {
+                printf("RANGE %"PRIu32": %s\n", rangenum, domsid);
+        } else {
+                printf("RANGE %"PRIu32": %s#%"PRIu32"\n", rangenum, domsid,
+                       range_index);
+        }
+
+        return NT_STATUS_OK;
+}
+
+static void net_idmap_autorid_get_ranges_usage(void)
+{
+        d_printf("%s\n%s",
+                 _("Usage:"),
+                 _("net idmap get ranges [<SID>] [--db=<inputfile>]\n"
+                   "  Get all ranges for a given domain.\n"
+                   "    SID\t\tSID of the domain - list all ranges if omitted\n"
+                   "    inputfile\tTDB file to add mapping to.\n"));
+}
+
+static int net_idmap_autorid_get_ranges(struct net_context *c, int argc,
+                                        const char **argv)
+{
+        int ret = -1;
+        TALLOC_CTX *mem_ctx;
+        struct db_context *db = NULL;
+        const char *domsid;
+        NTSTATUS status;
+
+        if (c->display_usage) {
+                net_idmap_autorid_get_ranges_usage();
+                return 0;
+        }
+
+        if (argc == 0) {
+                domsid = NULL;
+        } else if (argc == 1) {
+                domsid = argv[0];
+        } else {
+                net_idmap_autorid_get_ranges_usage();
+                return -1;
+        }
+
+        mem_ctx = talloc_stackframe();
+        if (!net_idmap_opendb_autorid(mem_ctx, c, true, &db)) {
+                goto done;
+        }
+
+        status = idmap_autorid_iterate_domain_ranges_read(db,
+                                                domsid,
+                                                net_idmap_autorid_print_range,
+                                                NULL, /* private_data */
+                                                NULL  /* count */);
+        if (!NT_STATUS_IS_OK(status)) {
+                d_fprintf(stderr, "%s: %s\n",
+                          _("Error getting domain ranges"), nt_errstr(status));
+                goto done;
+        }
+
+        ret = 0;
+
+done:
+        talloc_free(mem_ctx);
+        return ret;
+}
+
+static int net_idmap_autorid_get_config(struct net_context *c, int argc,
+                                        const char **argv)
+{
+        int ret = -1;
+        char *config;
+        TALLOC_CTX *mem_ctx;
+        NTSTATUS status;
+        struct db_context *db = NULL;
+
+        if (argc > 0 || c->display_usage) {
+                d_printf("%s\n%s",
+                         _("Usage:"),
+                         _("net idmap get config"
+                           " [--db=<inputfile>]\n"
+                           " Get CONFIG entry from autorid database\n"
+                           "    inputfile\tTDB file to read config from.\n"));
+                return c->display_usage ? 0 : -1;
+        }
+
+        mem_ctx = talloc_stackframe();
+
+        if (!net_idmap_opendb_autorid(mem_ctx, c, true, &db)) {
+                goto done;
+        }
+
+        status = idmap_autorid_getconfigstr(db, mem_ctx, &config);
+        if (!NT_STATUS_IS_OK(status)) {
+                d_fprintf(stderr, "%s: %s\n",
+                          _("Error: unable to read config entry"),
+                          nt_errstr(status));
+                goto done;
+        }
+
+        printf("CONFIG: %s\n", config);
+        ret = 0;
+
+done:
+        TALLOC_FREE(mem_ctx);
+        return ret;
+}
+
+
+static int net_idmap_get(struct net_context *c, int argc, const char **argv)
+{
+        struct functable func[] = {
+                {
+                        "range",
+                        net_idmap_autorid_get_range,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Get the range for a domain and range-index"),
+                        N_("net idmap get range\n"
+                           "  Get the range for a domain and range-index")
+                },
+                {
+                        "ranges",
+                        net_idmap_autorid_get_ranges,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Get all ranges for a domain"),
+                        N_("net idmap get ranges <SID>\n"
+                           "  Get all ranges for a domain")
+                },
+                {
+                        "config",
+                        net_idmap_autorid_get_config,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Get the global configuration from the autorid database"),
+                        N_("net idmap get config \n"
+                           "  Get the global configuration from the autorid database ")
+                },
+                {NULL, NULL, 0, NULL, NULL}
+        };
+
+        return net_run_function(c, argc, argv, "net idmap get", func);
+}
+
 static int net_idmap_check(struct net_context *c, int argc, const char **argv)
 {
-        const char* dbfile;
+        char *dbfile;
         struct check_options opts;
+        struct net_idmap_ctx ctx = { .backend = TDB };
+        int ret;
 
         if ( argc > 1 || c->display_usage) {
@@ -557 +1328 @@
         }
 
-        dbfile = (argc > 0) ? argv[0] : net_idmap_dbfile(c);
+        if (argc > 0) {
+                dbfile = talloc_strdup(talloc_tos(), argv[0]);
+        } else {
+                dbfile = net_idmap_dbfile(c, &ctx);
+        }
         if (dbfile == NULL) {
                 return -1;
         }
+
+        if (ctx.backend != TDB) {
+                d_fprintf(stderr, _("Sorry, checking of non-TDB databases is "
+                                    "currently not supported\n"));
+                talloc_free(dbfile);
+                return -1;
+        }
+
         d_fprintf(stderr, _("check database: %s\n"), dbfile);
 
@@ -572 +1355 @@
         };
 
-        return net_idmap_check_db(dbfile, &opts);
-}
-
-static int net_idmap_aclmapset(struct net_context *c, int argc, const char **argv)
-{
-        TALLOC_CTX *mem_ctx;
-        int result = -1;
-        struct dom_sid src_sid, dst_sid;
-        char *src, *dst;
-        struct db_context *db;
-        struct db_record *rec;
-        NTSTATUS status;
-
-        if (argc != 3 || c->display_usage) {
-                d_fprintf(stderr, "%s net idmap aclmapset <tdb> "
-                          "<src-sid> <dst-sid>\n", _("Usage:"));
-                return -1;
-        }
-
-        if (!(mem_ctx = talloc_init("net idmap aclmapset"))) {
-                d_fprintf(stderr, _("talloc_init failed\n"));
-                return -1;
-        }
-
-        if (!(db = db_open(mem_ctx, argv[0], 0, TDB_DEFAULT,
-                           O_RDWR|O_CREAT, 0600))) {
-                d_fprintf(stderr, _("db_open failed: %s\n"), strerror(errno));
-                goto fail;
-        }
-
-        if (!string_to_sid(&src_sid, argv[1])) {
-                d_fprintf(stderr, _("%s is not a valid sid\n"), argv[1]);
-                goto fail;
-        }
-
-        if (!string_to_sid(&dst_sid, argv[2])) {
-                d_fprintf(stderr, _("%s is not a valid sid\n"), argv[2]);
-                goto fail;
-        }
-
-        if (!(src = sid_string_talloc(mem_ctx, &src_sid))
-            || !(dst = sid_string_talloc(mem_ctx, &dst_sid))) {
-                d_fprintf(stderr, _("talloc_strdup failed\n"));
-                goto fail;
-        }
-
-        if (!(rec = db->fetch_locked(
-                      db, mem_ctx, string_term_tdb_data(src)))) {
-                d_fprintf(stderr, _("could not fetch db record\n"));
-                goto fail;
-        }
-
-        status = rec->store(rec, string_term_tdb_data(dst), 0);
-        TALLOC_FREE(rec);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                d_fprintf(stderr, _("could not store record: %s\n"),
-                          nt_errstr(status));
-                goto fail;
-        }
-
-        result = 0;
-fail:
-        TALLOC_FREE(mem_ctx);
-        return result;
+        ret = net_idmap_check_db(dbfile, &opts);
+        talloc_free(dbfile);
+        return ret;
 }
 
@@ -649 +1370 @@
                         net_idmap_dump,
                         NET_TRANSPORT_LOCAL,
-                        N_("Dump the current ID mappings"),
+                        N_("Dump the current ID mapping database"),
                         N_("net idmap dump\n"
                            "  Dump the current ID mappings")
@@ -657 +1378 @@
                         net_idmap_restore,
                         NET_TRANSPORT_LOCAL,
-                        N_("Restore entries from stdin"),
+                        N_("Restore entries from a file or stdin"),
                         N_("net idmap restore\n"
                            "  Restore entries from stdin")
                 },
                 {
-                        "setmap",
+                        "get",
+                        net_idmap_get,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Read data from the ID mapping database"),
+                        N_("net idmap get\n"
+                           "  Read data from the ID mapping database")
+                },
+                {
+                        "set",
                         net_idmap_set,
                         NET_TRANSPORT_LOCAL,
-                        N_("Not implemented yet"),
-                        N_("net idmap setmap\n"
-                           "  Not implemented yet")
+                        N_("Write data to the ID mapping database"),
+                        N_("net idmap set\n"
+                           "  Write data to the ID mapping database")
                 },
                 {
@@ -673 +1402 @@
                         net_idmap_delete,
                         NET_TRANSPORT_LOCAL,
-                        N_("Delete ID mapping"),
-                        N_("net idmap delete <ID>\n"
-                           "  Delete ID mapping")
-                },
-                {
-                        "secret",
-                        net_idmap_secret,
-                        NET_TRANSPORT_LOCAL,
-                        N_("Set secret for specified domain"),
-                        N_("net idmap secret <DOMAIN> <secret>\n"
-                           "  Set secret for specified domain")
-                },
-                {
-                        "aclmapset",
-                        net_idmap_aclmapset,
-                        NET_TRANSPORT_LOCAL,
-                        N_("Set acl map"),
-                        N_("net idmap aclmapset\n"
-                           "  Set acl map")
+                        N_("Delete entries from the ID mapping database"),
+                        N_("net idmap delete\n"
+                           "  Delete entries from the ID mapping database")
                 },
                 {

vendor/current/source3/utils/net_idmap_check.c

@@ -27 +27 @@
 #include "includes.h"
 #include "system/filesys.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
+#include "dbwrap/dbwrap_rbt.h"
 #include "net.h"
 #include "../libcli/security/dom_sid.h"
 #include "cbuf.h"
 #include "srprs.h"
-#include <termios.h>
 #include "util_tdb.h"
+#include "interact.h"
 
 static int traverse_commit(struct db_record *diff_rec, void* data);
 static int traverse_check(struct db_record *rec, void* data);
-
-static char* interact_edit(TALLOC_CTX* mem_ctx, const char* str);
-static int interact_prompt(const char* msg, const char* accept, char def);
 
 /* TDB_DATA *******************************************************************/
 static char*    print_data(TALLOC_CTX* mem_ctx, TDB_DATA d);
 static TDB_DATA parse_data(TALLOC_CTX* mem_ctx, const char** ptr);
-static TDB_DATA talloc_copy(TALLOC_CTX* mem_ctx, TDB_DATA data);
-static bool is_empty(TDB_DATA data) {
-        return (data.dsize == 0) || (data.dptr == NULL);
-}
 
 /* record *********************************************************************/
@@ -79 +74 @@
 
 typedef struct check_action {
-        const char* fmt;
+        void (*fmt)(struct check_action *a,
+                    struct record *r,
+                    TDB_DATA *v);
         const char* name;
         const char* prompt;
@@ -103 +100 @@
 };
 
+static void invalid_mapping_fmt(struct check_action *a,
+                                struct record *r,
+                                TDB_DATA *v)
+{
+        d_printf("%1$s: %2$s -> %3$s\n(%4$s <- %3$s)\n",
+                 a->name,
+                 print_data(r, r->key),
+                 print_data(r, r->val),
+                 (v ? print_data(r, *v) : ""));
+}
+
+static void record_exists_fmt(struct check_action *a,
+                              struct record *r,
+                              TDB_DATA *v)
+{
+        d_printf("%1$s: %2$s\n-%4$s\n+%3$s\n",
+                 a->name,
+                 print_data(r, r->key),
+                 print_data(r, r->val),
+                 (v ? print_data(r, *v) : ""));
+}
+
+static void valid_mapping_fmt(struct check_action *a,
+                              struct record *r,
+                              TDB_DATA *v)
+{
+        d_printf("%1$s: %2$s <-> %3$s\n",
+                 a->name,
+                 print_data(r, r->key),
+                 print_data(r, r->val));
+}
+
 static struct check_actions
 check_actions_init(const struct check_options* opts) {
@@ -123 +152 @@
                 },
                 .invalid_mapping = (check_action) {
-                        .fmt = "%1$s: %2$s -> %3$s\n(%4$s <- %3$s)\n",
+                        .fmt = invalid_mapping_fmt,
                         .name = "Invalid mapping",
                         .prompt = "[e]dit/[d]elete/[D]elete all"
@@ -140 +169 @@
                 },
                 .record_exists = (check_action) {
-                        .fmt = "%1$s: %2$s\n-%4$s\n+%3$s\n",
+                        .fmt = record_exists_fmt,
                         .name = "Record exists",
                         .prompt = "[o]verwrite/[O]verwrite all/[e]dit"
@@ -170 +199 @@
                 },
                 .valid_mapping = (check_action) {
-                        .fmt = "%1$s: %2$s <-> %3$s\n",
+                        .fmt = valid_mapping_fmt,
                         .name = "Mapping",
                         .auto_action = 's',
@@ -236 +265 @@
                         }
                 } else {
-                        d_printf(a->fmt, a->name,
-                                 print_data(r, r->key),
-                                 print_data(r, r->val),
-                                 (v ? print_data(r, *v) : ""));
+                        a->fmt(a, r, v);
                 }
         }
@@ -277 +303 @@
 #define DEBUG_DIFF(LEV,MEM,MSG,KEY,OLD,NEW)                     \
         DEBUG(LEV, ("%s: %s\n", MSG, print_data(MEM, KEY)));    \
-        if (!is_empty(OLD)) {                                   \
+        if (!tdb_data_is_empty(OLD)) {                          \
                 DEBUGADD(LEV, ("-%s\n", print_data(MEM, OLD))); \
         }                                                       \
-        if (!is_empty(NEW)) {                                   \
+        if (!tdb_data_is_empty(NEW)) {                          \
                 DEBUGADD(LEV, ("+%s\n", print_data(MEM, NEW))); \
         }
@@ -312 +338 @@
         TDB_DATA_diff diff;
         TALLOC_CTX* mem = talloc_new(ctx->diff);
-        struct db_record* rec = ctx->diff->fetch_locked(ctx->diff, mem, key);
+        TDB_DATA recvalue;
+        struct db_record *rec = dbwrap_fetch_locked(ctx->diff, mem, key);
+
         if (rec == NULL) {
                 return -1;
-        };
-        if (rec->value.dptr == 0) { /* first entry */
-                diff.oval = dbwrap_fetch(ctx->db, ctx->diff, key);
+        }
+
+        recvalue = dbwrap_record_get_value(rec);
+
+        if (recvalue.dptr == 0) { /* first entry */
+                status = dbwrap_fetch(ctx->db, ctx->diff, key, &diff.oval);
+                if (!NT_STATUS_IS_OK(status)) {
+                        diff.oval = tdb_null;
+                }
         } else {
-                diff = unpack_diff(rec->value);
+                diff = unpack_diff(recvalue);
                 talloc_free(diff.nval.dptr);
         }
-        diff.nval = talloc_copy(ctx->diff, value);
+        diff.nval = tdb_data_talloc_copy(ctx->diff, value);
 
         DEBUG_DIFF(2, mem, "TDB DIFF", key, diff.oval, diff.nval);
 
-        status = rec->store(rec, pack_diff(&diff), 0);
+        status = dbwrap_record_store(rec, pack_diff(&diff), 0);
 
         talloc_free(mem);
@@ -346 +380 @@
 {
         TDB_DATA tmp;
-
-        if (ctx->diff->fetch(ctx->diff, mem_ctx, key, &tmp) == -1) {
-                DEBUG(0, ("Out of memory!\n"));
-                return tdb_null;
-        }
-        if (tmp.dptr != NULL) {
+        NTSTATUS status;
+
+        status = dbwrap_fetch(ctx->diff, mem_ctx, key, &tmp);
+
+        if (NT_STATUS_IS_OK(status)) {
                 TDB_DATA_diff diff = unpack_diff(tmp);
-                TDB_DATA ret = talloc_copy(mem_ctx, diff.nval);
+                TDB_DATA ret = tdb_data_talloc_copy(mem_ctx, diff.nval);
                 talloc_free(tmp.dptr);
                 return ret;
         }
 
-        if (ctx->db->fetch(ctx->db, mem_ctx, key, &tmp) == -1) {
-                DEBUG(0, ("Out of memory!\n"));
+        status = dbwrap_fetch(ctx->db, mem_ctx, key, &tmp);
+        if (!NT_STATUS_IS_OK(status)) {
                 return tdb_null;
         }
@@ -388 +421 @@
         static const char* key = "IDMAP_VERSION";
         uint32_t version;
-        bool no_version = !dbwrap_fetch_uint32(ctx->db, key, &version);
+        NTSTATUS status;
         char action = 's';
         struct check_actions* act = &ctx->action;
-        if (no_version) {
+
+        status = dbwrap_fetch_uint32_bystring(ctx->db, key, &version);
+        if (!NT_STATUS_IS_OK(status)) {
                 d_printf("No version number, assume 2\n");
                 action = get_action(&act->no_version, NULL, NULL);
@@ -417 +452 @@
         uint32_t hwm;
         char action = 's';
-        bool found = dbwrap_fetch_uint32(ctx->db, key, &hwm);
+        NTSTATUS status;
         struct check_actions* act = &ctx->action;
-        if (!found) {
+
+        status = dbwrap_fetch_uint32_bystring(ctx->db, key, &hwm);
+        if (!NT_STATUS_IS_OK(status)) {
                 d_printf("No %s should be %d\n", key, target);
                 action = get_action(&act->invalid_hwm, NULL, NULL);
@@ -437 +474 @@
         struct check_actions* act = &ctx->action;
         TALLOC_CTX* mem = talloc_new(ctx->diff);
-        struct record* r = parse_record(mem, rec->key, rec->value);
+        TDB_DATA key;
+        TDB_DATA value;
+        struct record *r;
         char action = 's';
+
+        key = dbwrap_record_get_key(rec);
+        value = dbwrap_record_get_value(rec);
+
+        r = parse_record(mem, key, value);
 
         if (is_invalid(r)) {
@@ -471 +515 @@
                         break;
                 case 'd': /* delete */
-                        del_record(ctx, rec->key);
+                        del_record(ctx, key);
                         break;
                 case 'f': /* add reverse mapping */
-                        add_record(ctx, rec->value, rec->key);
+                        add_record(ctx, value, key);
                         break;
                 case 'e': /* edit */
@@ -483 +527 @@
                                 continue;
                         }
-                        if (!tdb_data_equal(rec->key, r->key)) {
+                        if (!tdb_data_equal(key, r->key)) {
                                 TDB_DATA oval = fetch_record(ctx, mem, r->key);
-                                if (!is_empty(oval) &&
+                                if (!tdb_data_is_empty(oval) &&
                                     !tdb_data_equal(oval, r->val))
                                 {
@@ -497 +541 @@
                         if (is_map(r)) {
                                 TDB_DATA okey = fetch_record(ctx, mem, r->val);
-                                if (!is_empty(okey) &&
+                                if (!tdb_data_is_empty(okey) &&
                                     !tdb_data_equal(okey, r->key))
                                 {
@@ -508 +552 @@
                 case 'o': /* overwrite */
                         adjust_hwm(ctx, r);
-                        if (!tdb_data_equal(rec->key, r->key)) {
-                                del_record(ctx, rec->key);
+                        if (!tdb_data_equal(key, r->key)) {
+                                del_record(ctx, key);
                         }
                         add_record(ctx, r->key, r->val);
@@ -535 +579 @@
 }
 
-TDB_DATA talloc_copy(TALLOC_CTX* mem_ctx, TDB_DATA data) {
-        TDB_DATA ret = {
-                .dptr  = (uint8_t *)talloc_size(mem_ctx, data.dsize+1),
-                .dsize = data.dsize
-        };
-        if (ret.dptr == NULL) {
-                ret.dsize = 0;
-        } else {
-                memcpy(ret.dptr, data.dptr, data.dsize);
-                ret.dptr[ret.dsize] = '\0';
-        }
-        return ret;
-}
-
 static bool is_cstr(TDB_DATA str) {
-        return !is_empty(str) && str.dptr[str.dsize-1] == '\0';
+        return !tdb_data_is_empty(str) && str.dptr[str.dsize-1] == '\0';
 }
 
@@ -590 +620 @@
                 return NULL;
         }
-        ret->key = talloc_copy(ret, key);
-        ret->val = talloc_copy(ret, val);
+        ret->key = tdb_data_talloc_copy(ret, key);
+        ret->val = tdb_data_talloc_copy(ret, val);
         if ((ret->key.dptr == NULL && key.dptr != NULL) ||
             (ret->val.dptr == NULL && val.dptr != NULL))
@@ -647 +677 @@
 /******************************************************************************/
 
-int interact_prompt(const char* msg, const char* acc, char def) {
-        struct termios old_tio, new_tio;
-        int c;
-
-        tcgetattr(STDIN_FILENO, &old_tio);
-        new_tio=old_tio;
-        new_tio.c_lflag &=(~ICANON & ~ECHO);
-        tcsetattr(STDIN_FILENO, TCSANOW, &new_tio);
-
-        do {
-                d_printf("%s? [%c]\n", msg, def);
-                fflush(stdout);
-                c = getchar();
-                if (c == '\n') {
-                        c = def;
-                        break;
-                }
-                else if (strchr(acc, tolower(c)) != NULL) {
-                        break;
-                }
-                d_printf("Invalid input '%c'\n", c);
-        } while(c != EOF);
-        tcsetattr(STDIN_FILENO, TCSANOW, &old_tio);
-        return c;
-}
 
 char* print_data(TALLOC_CTX* mem_ctx, TDB_DATA d)
 {
-        if (!is_empty(d)) {
+        if (!tdb_data_is_empty(d)) {
                 char* ret = NULL;
                 cbuf* ost = cbuf_new(mem_ctx);
@@ -702 +707 @@
 }
 
-static const char* get_editor(void) {
-        static const char* editor = NULL;
-        if (editor == NULL) {
-                editor = getenv("VISUAL");
-                if (editor == NULL) {
-                        editor = getenv("EDITOR");
-                }
-                if (editor == NULL) {
-                        editor = "vi";
-                }
-        }
-        return editor;
-}
-
-char* interact_edit(TALLOC_CTX* mem_ctx, const char* str) {
-        char fname[] = "/tmp/net_idmap_check.XXXXXX";
-        char buf[128];
-        char* ret = NULL;
-        FILE* file;
-
-        int fd = mkstemp(fname);
-        if (fd == -1) {
-                DEBUG(0, ("failed to mkstemp %s: %s\n", fname,
-                          strerror(errno)));
-                return NULL;
-        }
-
-        file  = fdopen(fd, "w");
-        if (!file) {
-                DEBUG(0, ("failed to open %s for writing: %s\n", fname,
-                          strerror(errno)));
-                close(fd);
-                unlink(fname);
-                return NULL;
-        }
-
-        fprintf(file, "%s", str);
-        fclose(file);
-
-        snprintf(buf, sizeof(buf), "%s %s\n", get_editor(), fname);
-        if (system(buf) != 0) {
-                DEBUG(0, ("failed to start editor %s: %s\n", buf,
-                          strerror(errno)));
-                unlink(fname);
-                return NULL;
-        }
-
-        file = fopen(fname, "r");
-        if (!file) {
-                DEBUG(0, ("failed to open %s for reading: %s\n", fname,
-                          strerror(errno)));
-                unlink(fname);
-                return NULL;
-        }
-        while ( fgets(buf, sizeof(buf), file) ) {
-                ret = talloc_strdup_append(ret, buf);
-        }
-        fclose(file);
-        unlink(fname);
-
-        return talloc_steal(mem_ctx, ret);
-}
-
-
 static int traverse_print_diff(struct db_record *rec, void* data) {
         struct check_ctx* ctx = (struct check_ctx*)data;
-        TDB_DATA key = rec->key;
-        TDB_DATA_diff diff = unpack_diff(rec->value);
+        TDB_DATA key;
+        TDB_DATA value;
+        TDB_DATA_diff diff;
         TALLOC_CTX* mem = talloc_new(ctx->diff);
+
+        key = dbwrap_record_get_key(rec);
+        value = dbwrap_record_get_value(rec);
+        diff = unpack_diff(value);
 
         DEBUG_DIFF(0, mem, "DIFF", key, diff.oval, diff.nval);
@@ -781 +727 @@
 static int traverse_commit(struct db_record *diff_rec, void* data) {
         struct check_ctx* ctx = (struct check_ctx*)data;
-        TDB_DATA_diff diff = unpack_diff(diff_rec->value);
-        TDB_DATA key = diff_rec->key;
+        TDB_DATA key;
+        TDB_DATA diff_value;
+        TDB_DATA_diff diff;
+        TDB_DATA value;
         TALLOC_CTX* mem = talloc_new(ctx->diff);
         int ret = -1;
         NTSTATUS status;
         struct check_actions* act = &ctx->action;
-
-        struct db_record* rec = ctx->db->fetch_locked(ctx->db, mem, key);
+        struct db_record* rec;
+
+        key = dbwrap_record_get_key(diff_rec);
+        diff_value = dbwrap_record_get_value(diff_rec);
+        diff = unpack_diff(diff_value);
+
+        rec = dbwrap_fetch_locked(ctx->db, mem, key);
         if (rec == NULL) {
                 goto done;
-        };
-
-        if (!tdb_data_equal(rec->value, diff.oval)) {
+        }
+
+        value = dbwrap_record_get_value(rec);
+
+        if (!tdb_data_equal(value, diff.oval)) {
                 char action;
 
@@ -799 +754 @@
                          "expected: %s got %s\n", print_data(mem, key),
                          print_data(mem, diff.oval),
-                         print_data(mem, rec->value));
+                         print_data(mem, value));
 
                 action = get_action(&act->invalid_diff, NULL, NULL);
@@ -812 +767 @@
         DEBUG_DIFF(0, mem, "Commit", key, diff.oval, diff.nval);
 
-        if (is_empty(diff.nval)) {
-                status = rec->delete_rec(rec);
+        if (tdb_data_is_empty(diff.nval)) {
+                status = dbwrap_record_delete(rec);
         } else {
-                status = rec->store(rec, diff.nval, 0);
+                status = dbwrap_record_store(rec, diff.nval, 0);
         }
 
@@ -866 +821 @@
         }
 
-        ctx->db = db_open(ctx, name, 0, TDB_DEFAULT, oflags, 0);
+        ctx->db = db_open(ctx, name, 0, TDB_DEFAULT, oflags, 0,
+                          DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
         if (ctx->db == NULL) {
                 d_fprintf(stderr,
@@ -915 +871 @@
 
 static bool check_transaction_start(struct check_ctx* ctx) {
-        return (ctx->db->transaction_start(ctx->db) == 0);
+        return (dbwrap_transaction_start(ctx->db) == 0);
 }
 
 static bool check_transaction_commit(struct check_ctx* ctx) {
-        return (ctx->db->transaction_commit(ctx->db) == 0);
+        return (dbwrap_transaction_commit(ctx->db) == 0);
 }
 
 static bool check_transaction_cancel(struct check_ctx* ctx) {
-        return (ctx->db->transaction_cancel(ctx->db) == 0);
+        return (dbwrap_transaction_cancel(ctx->db) == 0);
 }
 
@@ -970 +926 @@
                 return false;
         }
-        if (ctx->opts.test) { //get_action?
+        if (ctx->opts.test) { /*get_action? */
                 return check_transaction_cancel(ctx);
         } else {

vendor/current/source3/utils/net_join.c

@@ -35 +35 @@
 int net_join(struct net_context *c, int argc, const char **argv)
 {
-        if ((argc > 0) && (StrCaseCmp(argv[0], "HELP") == 0)) {
+        if ((argc > 0) && (strcasecmp_m(argv[0], "HELP") == 0)) {
                 net_join_usage(c, argc, argv);
                 return 0;

vendor/current/source3/utils/net_lookup.c

@@ -20 +20 @@
 #include "utils/net.h"
 #include "libads/sitename_cache.h"
-#include "libads/dns.h"
+#include "../lib/addns/dnsquery.h"
 #include "../librpc/gen_ndr/ndr_netlogon.h"
 #include "smb_krb5.h"
@@ -113 +113 @@
                 domain = c->opt_target_workgroup;
 
-        sitename = sitename_fetch(domain);
-
         if ( (ctx = talloc_init("net_lookup_ldap")) == NULL ) {
                 d_fprintf(stderr,"net_lookup_ldap: talloc_init() %s!\n",
                           _("failed"));
-                SAFE_FREE(sitename);
-                return -1;
-        }
+                return -1;
+        }
+
+        sitename = sitename_fetch(ctx, domain);
 
         DEBUG(9, ("Lookup up ldap for domain %s\n", domain));
 
-        status = ads_dns_query_dcs( ctx, domain, sitename, &dcs, &numdcs );
+        status = ads_dns_query_dcs(ctx,
+                                   domain,
+                                   sitename,
+                                   &dcs,
+                                   &numdcs);
         if ( NT_STATUS_IS_OK(status) && numdcs ) {
                 print_ldap_srvlist(dcs, numdcs);
                 TALLOC_FREE( ctx );
-                SAFE_FREE(sitename);
                 return 0;
         }
@@ -135 +137 @@
         if (!get_pdc_ip(domain, &ss)) {
                 TALLOC_FREE( ctx );
-                SAFE_FREE(sitename);
                 return -1;
         }
@@ -147 +148 @@
         if (ret) {
                 TALLOC_FREE( ctx );
-                SAFE_FREE(sitename);
                 return -1;
         }
@@ -155 +155 @@
         if (!domain) {
                 TALLOC_FREE( ctx );
-                SAFE_FREE(sitename);
                 return -1;
         }
@@ -162 +161 @@
         DEBUG(9, ("Looking up ldap for domain %s\n", domain));
 
-        status = ads_dns_query_dcs( ctx, domain, sitename, &dcs, &numdcs );
+        status = ads_dns_query_dcs(ctx,
+                                   domain,
+                                   sitename,
+                                   &dcs,
+                                   &numdcs);
         if ( NT_STATUS_IS_OK(status) && numdcs ) {
                 print_ldap_srvlist(dcs, numdcs);
                 TALLOC_FREE( ctx );
-                SAFE_FREE(sitename);
                 return 0;
         }
 
         TALLOC_FREE( ctx );
-        SAFE_FREE(sitename);
 
         return -1;
@@ -209 +210 @@
         d_printf("%s\n", pdc_str);
 
-        sitename = sitename_fetch(domain);
+        sitename = sitename_fetch(talloc_tos(), domain);
         if (!NT_STATUS_IS_OK(get_sorted_dc_list(domain, sitename,
                                         &ip_list, &count, sec_ads))) {
                 SAFE_FREE(pdc_str);
-                SAFE_FREE(sitename);
+                TALLOC_FREE(sitename);
                 return 0;
         }
-        SAFE_FREE(sitename);
+        TALLOC_FREE(sitename);
         for (i=0;i<count;i++) {
                 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
@@ -292 +293 @@
 
         if (argc > 0) {
-                realm = argv[0];
+                realm = argv[0];
         } else if (lp_realm() && *lp_realm()) {
                 realm = lp_realm();
@@ -318 +319 @@
                 print_sockaddr(addr, sizeof(addr), &kdcs[i].ss);
 
-                d_printf("%s:%hd\n", addr, kdcs[i].port);
+                d_printf("%s:%u\n", addr, kdcs[i].port);
         }
 
@@ -462 +463 @@
         }
         for (i=0; table[i].funcname; i++) {
-                if (StrCaseCmp(argv[0], table[i].funcname) == 0)
+                if (strcasecmp_m(argv[0], table[i].funcname) == 0)
                         return table[i].fn(c, argc-1, argv+1);
         }

vendor/current/source3/utils/net_printing.c

@@ -440 +440 @@
         return run_rpc_command(c,
                                NULL,
-                               &ndr_table_winreg.syntax_id,
+                               &ndr_table_winreg,
                                0,
                                printing_migrate_internal,

vendor/current/source3/utils/net_proto.h

@@ -140 +140 @@
 int run_rpc_command(struct net_context *c,
                         struct cli_state *cli_arg,
-                        const struct ndr_syntax_id *interface,
+                        const struct ndr_interface_table *table,
                         int conn_flags,
                         rpc_command_fn fn,
@@ -146 +146 @@
                         const char **argv);
 int net_rpc_changetrustpw(struct net_context *c, int argc, const char **argv);
+int net_rpc_testjoin(struct net_context *c, int argc, const char **argv);
 int net_rpc_join(struct net_context *c, int argc, const char **argv);
 NTSTATUS rpc_info_internals(struct net_context *c,
@@ -200 +201 @@
 int net_rpc_audit(struct net_context *c, int argc, const char **argv);
 
-/* The following definitions come from utils/net_rpc_join.c  */
-
-NTSTATUS net_rpc_join_ok(struct net_context *c, const char *domain,
-                         const char *server, struct sockaddr_storage *pss);
-int net_rpc_join_newstyle(struct net_context *c, int argc, const char **argv);
-int net_rpc_testjoin(struct net_context *c, int argc, const char **argv);
-
 /* The following definitions come from utils/net_rpc_printer.c  */
 
@@ -339 +333 @@
 /* The following definitions come from utils/net_rpc_service.c  */
 
-const char *svc_status_string( uint32 state );
+const char *svc_status_string( uint32_t state );
 int net_rpc_service(struct net_context *c, int argc, const char **argv);
 
@@ -401 +395 @@
                              enum lsa_SidType *ret_type);
 NTSTATUS connect_to_service(struct net_context *c,
-                                        struct cli_state **cli_ctx,
-                                        struct sockaddr_storage *server_ss,
-                                        const char *server_name,
-                                        const char *service_name,
-                                        const char *service_type);
+                            struct cli_state **cli_ctx,
+                            const struct sockaddr_storage *server_ss,
+                            const char *server_name,
+                            const char *service_name,
+                            const char *service_type);
 NTSTATUS connect_to_ipc(struct net_context *c,
                         struct cli_state **cli_ctx,
-                        struct sockaddr_storage *server_ss,
+                        const struct sockaddr_storage *server_ss,
                         const char *server_name);
 NTSTATUS connect_to_ipc_anonymous(struct net_context *c,
                                 struct cli_state **cli_ctx,
-                                struct sockaddr_storage *server_ss,
+                                const struct sockaddr_storage *server_ss,
                                 const char *server_name);
-NTSTATUS connect_to_ipc_krb5(struct net_context *c,
-                        struct cli_state **cli_ctx,
-                        struct sockaddr_storage *server_ss,
-                        const char *server_name);
 NTSTATUS connect_dst_pipe(struct net_context *c, struct cli_state **cli_dst,
                           struct rpc_pipe_client **pp_pipe_hnd,
-                          const struct ndr_syntax_id *interface);
+                          const struct ndr_interface_table *table);
 int net_use_krb_machine_account(struct net_context *c);
 int net_use_machine_account(struct net_context *c);
@@ -435 +425 @@
 NTSTATUS net_make_ipc_connection_ex(struct net_context *c ,const char *domain,
                                     const char *server,
-                                    struct sockaddr_storage *pss,
+                                    const struct sockaddr_storage *pss,
                                     unsigned flags, struct cli_state **pcli);
 const char *net_prompt_pass(struct net_context *c, const char *user);
@@ -469 +459 @@
 int net_rpc_trust(struct net_context *c, int argc, const char **argv);
 
+/* The following definitions come from utils/net_rpc_conf.c */
+int net_rpc_conf(struct net_context *c, int argc, const char **argv);
+
+int net_notify(struct net_context *c, int argc, const char **argv);
 #endif /*  _NET_PROTO_H_  */

vendor/current/source3/utils/net_rap.c

@@ -29 +29 @@
 #include "libsmb/libsmb.h"
 #include "libsmb/clirap.h"
+#include "../libcli/smb/smbXcli_base.h"
 
 /* The following messages were for error checking that is not properly
@@ -53 +54 @@
   list info on an open file
 ***************************************************************************/
-static void file_fn(const char * pPath, const char * pUser, uint16 perms,
-                    uint16 locks, uint32 id)
+static void file_fn(const char * pPath, const char * pUser, uint16_t perms,
+                    uint16_t locks, uint32_t id)
 {
         d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
@@ -60 +61 @@
 }
 
-static void one_file_fn(const char *pPath, const char *pUser, uint16 perms,
-                        uint16 locks, uint32 id)
+static void one_file_fn(const char *pPath, const char *pUser, uint16_t perms,
+                        uint16_t locks, uint32_t id)
 {
         d_printf(_("File ID          %d\n"
@@ -196 +197 @@
 }
 
-static void long_share_fn(const char *share_name, uint32 type,
+static void long_share_fn(const char *share_name, uint32_t type,
                           const char *comment, void *state)
 {
@@ -203 +204 @@
 }
 
-static void share_fn(const char *share_name, uint32 type,
+static void share_fn(const char *share_name, uint32_t type,
                      const char *comment, void *state)
 {
@@ -348 +349 @@
 }
 
-static void list_sessions_func(char *wsname, char *username, uint16 conns,
-                        uint16 opens, uint16 users, uint32 sess_time,
-                        uint32 idle_time, uint32 user_flags, char *clitype)
+static void list_sessions_func(char *wsname, char *username, uint16_t conns,
+                        uint16_t opens, uint16_t users, uint32_t sess_time,
+                        uint32_t idle_time, uint32_t user_flags, char *clitype)
 {
         int hrs = idle_time / 3600;
@@ -361 +362 @@
 
 static void display_session_func(const char *wsname, const char *username,
-                                 uint16 conns, uint16 opens, uint16 users,
-                                 uint32 sess_time, uint32 idle_time,
-                                 uint32 user_flags, const char *clitype)
+                                 uint16_t conns, uint16_t opens, uint16_t users,
+                                 uint32_t sess_time, uint32_t idle_time,
+                                 uint32_t user_flags, const char *clitype)
 {
         int ihrs = idle_time / 3600;
@@ -382 +383 @@
 }
 
-static void display_conns_func(uint16 conn_id, uint16 conn_type, uint16 opens,
-                               uint16 users, uint32 conn_time,
+static void display_conns_func(uint16_t conn_id, uint16_t conn_type, uint16_t opens,
+                               uint16_t users, uint32_t conn_time,
                                const char *username, const char *netname)
 {
@@ -496 +497 @@
 list a server name
 ****************************************************************************/
-static void display_server_func(const char *name, uint32 m,
+static void display_server_func(const char *name, uint32_t m,
                                 const char *comment, void * reserved)
 {
@@ -634 +635 @@
 }
 
-static void enum_queue(const char *queuename, uint16 pri, uint16 start,
-                       uint16 until, const char *sep, const char *pproc,
+static void enum_queue(const char *queuename, uint16_t pri, uint16_t start,
+                       uint16_t until, const char *sep, const char *pproc,
                        const char *dest, const char *qparms,
-                       const char *qcomment, uint16 status, uint16 jobcount)
+                       const char *qcomment, uint16_t status, uint16_t jobcount)
 {
         d_printf(_("%-17.17s Queue %5d jobs                      "),
@@ -660 +661 @@
 }
 
-static void enum_jobs(uint16 jobid, const char *ownername,
+static void enum_jobs(uint16_t jobid, const char *ownername,
                       const char *notifyname, const char *datatype,
-                      const char *jparms, uint16 pos, uint16 status,
+                      const char *jparms, uint16_t pos, uint16_t status,
                       const char *jstatus, unsigned int submitted, unsigned int jobsize,
                       const char *comment)
@@ -703 +704 @@
                 return -1;
 
-        d_printf(PRINTQ_ENUM_DISPLAY, cli->desthost); /* list header */
+        d_printf(PRINTQ_ENUM_DISPLAY, smbXcli_conn_remote_name(cli->conn)); /* list header */
         ret = cli_NetPrintQGetInfo(cli, argv[0], enum_queue, enum_jobs);
         cli_shutdown(cli);
@@ -764 +765 @@
                         return -1;
 
-                d_printf(PRINTQ_ENUM_DISPLAY, cli->desthost); /* list header */
+                d_printf(PRINTQ_ENUM_DISPLAY, smbXcli_conn_remote_name(cli->conn)); /* list header */
                 ret = cli_NetPrintQEnum(cli, enum_queue, enum_jobs);
                 cli_shutdown(cli);
@@ -826 +827 @@
                 return -1;
 
-        safe_strcpy((char *)userinfo.user_name, argv[0], sizeof(userinfo.user_name)-1);
+        strlcpy((char *)userinfo.user_name, argv[0], sizeof(userinfo.user_name));
         if (c->opt_flags == 0)
                 c->opt_flags = 0x21;
@@ -971 +972 @@
 
         /* BB check for length 21 or smaller explicitly ? BB */
-        safe_strcpy((char *)grinfo.group_name, argv[0], sizeof(grinfo.group_name)-1);
+        strlcpy((char *)grinfo.group_name, argv[0], sizeof(grinfo.group_name));
         grinfo.reserved1 = '\0';
         grinfo.comment = smb_xstrdup(c->opt_comment ? c->opt_comment : "");

vendor/current/source3/utils/net_registry.c

@@ -31 +31 @@
 #include "registry/reg_import.h"
 #include "registry/reg_format.h"
+#include "registry/reg_api_util.h"
 #include <assert.h>
 #include "../libcli/security/display_sec.h"
@@ -36 +37 @@
 #include "../libcli/registry/util_reg.h"
 #include "passdb/machine_sid.h"
+#include "net_registry_check.h"
 
 /*
@@ -47 +49 @@
  */
 static WERROR open_hive(TALLOC_CTX *ctx, const char *path,
-                        uint32 desired_access,
+                        uint32_t desired_access,
                         struct registry_key **hive,
                         char **subkeyname)
@@ -90 +92 @@
 
 static WERROR open_key(TALLOC_CTX *ctx, const char *path,
-                       uint32 desired_access,
+                       uint32_t desired_access,
                        struct registry_key **key)
 {
@@ -123 +125 @@
 }
 
-static WERROR registry_enumkey(struct registry_key* parent, const char* keyname, bool recursive)
+static WERROR registry_enumkey(struct registry_key *parent, const char *keyname,
+                               bool recursive)
 {
         WERROR werr;
         TALLOC_CTX *ctx = talloc_stackframe();
-        char*  subkey_name;
+        char *subkey_name;
         NTTIME modtime;
         uint32_t count;
-        char* valname = NULL;
+        char *valname = NULL;
         struct registry_value *valvalue = NULL;
-        struct registry_key* key = NULL;
+        struct registry_key *key = NULL;
 
         werr = reg_openkey(ctx, parent, keyname, REG_KEY_READ, &key);
@@ -203 +206 @@
         WERROR werr;
         struct registry_key *key = NULL;
-        char* name = NULL;
+        char *name = NULL;
         TALLOC_CTX *ctx = talloc_stackframe();
         int ret = -1;
@@ -237 +240 @@
         WERROR werr;
         struct registry_key *key = NULL;
-        char* name = NULL;
+        char *name = NULL;
         TALLOC_CTX *ctx = talloc_stackframe();
         int ret = -1;
@@ -272 +275 @@
         WERROR werr;
         enum winreg_CreateAction action;
-        char *subkeyname;
+        char *subkeyname = NULL;
         struct registry_key *hivekey = NULL;
         struct registry_key *subkey = NULL;
@@ -331 +334 @@
 {
         WERROR werr;
-        char *subkeyname;
+        char *subkeyname = NULL;
         struct registry_key *hivekey = NULL;
         TALLOC_CTX *ctx = talloc_stackframe();
@@ -642 +645 @@
 
         status = g_lock_do("registry_increment_lock", G_LOCK_WRITE,
-                           timeval_set(600, 0), procid_self(),
+                           timeval_set(600, 0),
                            net_registry_increment_fn, &state);
         if (!NT_STATUS_IS_OK(status)) {
@@ -909 +912 @@
 
 
-static WERROR import_create_key(struct import_ctx* ctx,
-                                struct registry_key* parent,
-                                const char* name, void** pkey, bool* existing)
-{
-        WERROR werr;
-        void* mem_ctx = talloc_new(ctx->mem_ctx);
-
-        struct registry_key* key = NULL;
+static WERROR import_create_key(struct import_ctx *ctx,
+                                struct registry_key *parent,
+                                const char *name, void **pkey, bool *existing)
+{
+        WERROR werr;
+        TALLOC_CTX *mem_ctx = talloc_new(ctx->mem_ctx);
+
+        struct registry_key *key = NULL;
         enum winreg_CreateAction action;
 
         if (parent == NULL) {
-                char* subkeyname = NULL;
+                char *subkeyname = NULL;
                 werr = open_hive(mem_ctx, name, REG_KEY_WRITE,
                          &parent, &subkeyname);
@@ -959 +962 @@
 }
 
-static WERROR import_close_key(struct import_ctx* ctx,
-                               struct registry_key* key)
+static WERROR import_close_key(struct import_ctx *ctx,
+                               struct registry_key *key)
 {
         return WERR_OK;
 }
 
-static WERROR import_delete_key(struct import_ctx* ctx,
-                                struct registry_key* parent, const char* name)
-{
-        WERROR werr;
-        void* mem_ctx = talloc_new(talloc_tos());
+static WERROR import_delete_key(struct import_ctx *ctx,
+                                struct registry_key *parent, const char *name)
+{
+        WERROR werr;
+        TALLOC_CTX *mem_ctx = talloc_new(talloc_tos());
 
         if (parent == NULL) {
-                char* subkeyname = NULL;
+                char *subkeyname = NULL;
                 werr = open_hive(mem_ctx, name, REG_KEY_WRITE,
                          &parent, &subkeyname);
@@ -985 +988 @@
         werr = reg_deletekey_recursive(parent, name);
         if (!W_ERROR_IS_OK(werr)) {
-                d_fprintf(stderr, "reg_deletekey_recursive %s: %s\n", _("failed"),
-                          win_errstr(werr));
+                d_fprintf(stderr, "reg_deletekey_recursive %s: %s\n",
+                          _("failed"), win_errstr(werr));
                 goto done;
         }
@@ -995 +998 @@
 }
 
-static WERROR import_create_val (struct import_ctx* ctx,
-                                 struct registry_key* parent, const char* name,
-                                 const struct registry_value* value)
+static WERROR import_create_val (struct import_ctx *ctx,
+                                 struct registry_key *parent, const char *name,
+                                 const struct registry_value *value)
 {
         WERROR werr;
@@ -1013 +1016 @@
 }
 
-static WERROR import_delete_val (struct import_ctx* ctx, struct registry_key* parent, const char* name) {
+static WERROR import_delete_val (struct import_ctx *ctx,
+                                 struct registry_key *parent, const char *name)
+{
         WERROR werr;
 
@@ -1029 +1034 @@
 }
 
-
-static int net_registry_import(struct net_context *c, int argc,
-                               const char **argv)
-{
-        struct import_ctx import_ctx;
+struct precheck_ctx {
+        TALLOC_CTX *mem_ctx;
+        bool failed;
+};
+
+static WERROR precheck_create_key(struct precheck_ctx *ctx,
+                                  struct registry_key *parent,
+                                  const char *name, void **pkey, bool *existing)
+{
+        WERROR werr;
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct registry_key *key = NULL;
+
+        if (parent == NULL) {
+                char *subkeyname = NULL;
+                werr = open_hive(frame, name, REG_KEY_READ,
+                                 &parent, &subkeyname);
+                if (!W_ERROR_IS_OK(werr)) {
+                        d_printf("Precheck: open_hive of [%s] failed: %s\n",
+                                 name, win_errstr(werr));
+                        goto done;
+                }
+                name = subkeyname;
+        }
+
+        werr = reg_openkey(frame, parent, name, 0, &key);
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Precheck: openkey [%s] failed: %s\n",
+                         name, win_errstr(werr));
+                goto done;
+        }
+
+        if (existing != NULL) {
+                *existing = true;
+        }
+
+        if (pkey != NULL) {
+                *pkey = talloc_steal(ctx->mem_ctx, key);
+        }
+
+done:
+        talloc_free(frame);
+        ctx->failed = !W_ERROR_IS_OK(werr);
+        return werr;
+}
+
+static WERROR precheck_close_key(struct precheck_ctx *ctx,
+                                 struct registry_key *key)
+{
+        talloc_free(key);
+        return WERR_OK;
+}
+
+static WERROR precheck_delete_key(struct precheck_ctx *ctx,
+                                  struct registry_key *parent, const char *name)
+{
+        WERROR werr;
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct registry_key *key;
+
+        if (parent == NULL) {
+                char *subkeyname = NULL;
+                werr = open_hive(frame, name, REG_KEY_READ,
+                                 &parent, &subkeyname);
+                if (!W_ERROR_IS_OK(werr)) {
+                        d_printf("Precheck: open_hive of [%s] failed: %s\n",
+                                 name, win_errstr(werr));
+                        goto done;
+                }
+                name = subkeyname;
+        }
+
+        werr = reg_openkey(ctx->mem_ctx, parent, name, 0, &key);
+        if (W_ERROR_IS_OK(werr)) {
+                d_printf("Precheck: key [%s\\%s] should not exist\n",
+                         parent->key->name, name);
+                werr = WERR_FILE_EXISTS;
+        } else if (W_ERROR_EQUAL(werr, WERR_BADFILE)) {
+                werr = WERR_OK;
+        } else {
+                d_printf("Precheck: openkey [%s\\%s] failed: %s\n",
+                         parent->key->name, name, win_errstr(werr));
+        }
+
+done:
+        talloc_free(frame);
+        ctx->failed = !W_ERROR_IS_OK(werr);
+        return werr;
+}
+
+static WERROR precheck_create_val(struct precheck_ctx *ctx,
+                                  struct registry_key *parent,
+                                  const char *name,
+                                  const struct registry_value *value)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct registry_value *old;
+        WERROR werr;
+
+        SMB_ASSERT(parent);
+
+        werr = reg_queryvalue(frame, parent, name, &old);
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Precheck: queryvalue \"%s\" of [%s] failed: %s\n",
+                         name, parent->key->name, win_errstr(werr));
+                goto done;
+        }
+        if (registry_value_cmp(value, old) != 0) {
+                d_printf("Precheck: unexpected value \"%s\" of key [%s]\n",
+                         name, parent->key->name);
+                ctx->failed = true;
+        }
+done:
+        talloc_free(frame);
+        return werr;
+}
+
+static WERROR precheck_delete_val(struct precheck_ctx *ctx,
+                                  struct registry_key *parent,
+                                  const char *name)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct registry_value *old;
+        WERROR werr;
+
+        SMB_ASSERT(parent);
+
+        werr = reg_queryvalue(frame, parent, name, &old);
+        if (W_ERROR_IS_OK(werr)) {
+                d_printf("Precheck: value \"%s\" of key [%s] should not exist\n",
+                         name, parent->key->name);
+                werr = WERR_FILE_EXISTS;
+        } else if (W_ERROR_EQUAL(werr, WERR_BADFILE)) {
+                werr = WERR_OK;
+        } else {
+                printf("Precheck: queryvalue \"%s\" of key [%s] failed: %s\n",
+                       name, parent->key->name, win_errstr(werr));
+        }
+
+        talloc_free(frame);
+        ctx->failed = !W_ERROR_IS_OK(werr);
+        return werr;
+}
+
+static bool import_precheck(const char *fname, const char *parse_options)
+{
+        TALLOC_CTX *mem_ctx = talloc_tos();
+        struct precheck_ctx precheck_ctx = {
+                .mem_ctx = mem_ctx,
+                .failed = false,
+        };
+        struct reg_import_callback precheck_callback = {
+                .openkey     = NULL,
+                .closekey    = (reg_import_callback_closekey_t)&precheck_close_key,
+                .createkey   = (reg_import_callback_createkey_t)&precheck_create_key,
+                .deletekey   = (reg_import_callback_deletekey_t)&precheck_delete_key,
+                .deleteval   = (reg_import_callback_deleteval_t)&precheck_delete_val,
+                .setval      = {
+                        .registry_value = (reg_import_callback_setval_registry_value_t)
+                                          &precheck_create_val,
+                },
+                .setval_type = REGISTRY_VALUE,
+                .data        = &precheck_ctx
+        };
+        struct reg_parse_callback *parse_callback;
+        int ret;
+
+        if (!fname) {
+                return true;
+        }
+
+        parse_callback = reg_import_adapter(mem_ctx, precheck_callback);
+        if (parse_callback == NULL) {
+                d_printf("talloc failed\n");
+                return false;
+        }
+
+        ret = reg_parse_file(fname, parse_callback, parse_options);
+
+        if (ret < 0 || precheck_ctx.failed) {
+                d_printf("Precheck failed\n");
+                return false;
+        }
+        return true;
+}
+
+static int import_with_precheck_action(const char *import_fname,
+                                       const char *precheck_fname,
+                                       const char *parse_options)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct import_ctx import_ctx = {
+                .mem_ctx = frame,
+        };
         struct reg_import_callback import_callback = {
                 .openkey     = NULL,
@@ -1047 +1241 @@
                 .data        = &import_ctx
         };
-
-        int ret;
+        struct reg_parse_callback *parse_callback;
+        int ret = -1;
+        bool precheck_ok;
+
+        precheck_ok = import_precheck(precheck_fname, parse_options);
+        if (!precheck_ok) {
+                goto done;
+        }
+
+        parse_callback = reg_import_adapter(frame, import_callback);
+        if (parse_callback == NULL) {
+                d_printf("talloc failed\n");
+                goto done;
+        }
+
+        ret = reg_parse_file(import_fname, parse_callback, parse_options);
+
+done:
+        talloc_free(frame);
+        return ret;
+}
+
+static int net_registry_import(struct net_context *c, int argc,
+                               const char **argv)
+{
+        const char *parse_options =  (argc > 1) ? argv[1] : NULL;
+        int ret = -1;
+        WERROR werr;
 
         if (argc < 1 || argc > 2 || c->display_usage) {
@@ -1060 +1280 @@
         }
 
-        ZERO_STRUCT(import_ctx);
-        import_ctx.mem_ctx = talloc_stackframe();
-
-        regdb_open();
-        regdb_transaction_start();
-
-        ret = reg_parse_file(argv[0],
-                             reg_import_adapter(import_ctx.mem_ctx,
-                                                import_callback),
-                             (argc > 1) ? argv[1] : NULL
-                );
+        werr = regdb_open();
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Failed to open regdb: %s\n", win_errstr(werr));
+                return -1;
+        }
+
+        werr = regdb_transaction_start();
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Failed to start transaction on regdb: %s\n",
+                         win_errstr(werr));
+                goto done;
+        }
+
+        ret = import_with_precheck_action(argv[0], c->opt_precheck,
+                                          parse_options);
+
         if (ret < 0) {
-                d_printf("reg_parse_file failed: transaction canceled\n");
+                d_printf("Transaction canceled!\n");
                 regdb_transaction_cancel();
-        } else{
-                regdb_transaction_commit();
-        }
-
+                goto done;
+        }
+
+        SMB_ASSERT(ret == 0);
+
+        if (c->opt_testmode) {
+                d_printf("Testmode: not committing changes.\n");
+                regdb_transaction_cancel();
+                goto done;
+        }
+
+        werr = regdb_transaction_commit();
+        if (!W_ERROR_IS_OK(werr)) {
+                d_printf("Failed to commit transaction on regdb: %s\n",
+                         win_errstr(werr));
+                ret = -1;
+        }
+
+done:
         regdb_close();
-        talloc_free(import_ctx.mem_ctx);
-
         return ret;
 }
@@ -1093 +1331 @@
  */
 
-static int registry_export(TALLOC_CTX *ctx, /*const*/ struct registry_key* key,
-                           struct reg_format* f)
+static int registry_export(TALLOC_CTX *ctx, /*const*/ struct registry_key *key,
+                           struct reg_format *f)
 {
         int ret=-1;
@@ -1103 +1341 @@
         char *valname = NULL;
 
-        struct registry_key* subkey = NULL;
         char *subkey_name = NULL;
         NTTIME modtime = 0;
@@ -1129 +1366 @@
              count++)
         {
+                struct registry_key *subkey = NULL;
+
                 werr = reg_openkey(ctx, key, subkey_name, REG_KEY_READ,
                                    &subkey);
@@ -1138 +1377 @@
 
                 registry_export(ctx, subkey, f);
+                TALLOC_FREE(subkey);
         }
         if (!W_ERROR_EQUAL(WERR_NO_MORE_ITEMS, werr)) {
@@ -1156 +1396 @@
         struct registry_key *key = NULL;
         TALLOC_CTX *ctx = talloc_stackframe();
-        struct reg_format* f=NULL;
+        struct reg_format *f=NULL;
 
         if (argc < 2 || argc > 3 || c->display_usage) {
@@ -1200 +1440 @@
 {
         int ret;
-        void* mem_ctx;
-        const char* in_opt  = NULL;
-        const char* out_opt = NULL;
+        TALLOC_CTX *mem_ctx;
+        const char *in_opt  = NULL;
+        const char *out_opt = NULL;
 
         if (argc < 2 || argc > 4|| c->display_usage) {
@@ -1242 +1482 @@
 /**@}*/
 
+static int net_registry_check(struct net_context *c, int argc,
+                              const char **argv)
+{
+        char *dbfile;
+        struct check_options opts;
+        int ret;
+
+        if (argc > 1|| c->display_usage) {
+                d_printf("%s\n%s",
+                         _("Usage:"),
+                         _("net registry check  [-vraTfl] [-o <ODB>] [--wipe] [<TDB>]\n"
+                           "  Check a registry database.\n"
+                           "    -v|--verbose\t be verbose\n"
+                           "    -r|--repair\t\t interactive repair mode\n"
+                           "    -a|--auto\t\t noninteractive repair mode\n"
+                           "    -T|--test\t\t dry run\n"
+                           "    -f|--force\t\t force\n"
+                           "    -l|--lock\t\t lock <TDB> while doing the check\n"
+                           "    -o|--output=<ODB>\t output database\n"
+                           "    --reg-version=n\t assume database format version {n|1,2,3}\n"
+                           "    --wipe\t\t create a new database from scratch\n"
+                           "    --db=<TDB>\t\t registry database to open\n"));
+                return c->display_usage ? 0 : -1;
+        }
+
+        if (c->opt_db != NULL) {
+                dbfile = talloc_strdup(talloc_tos(), c->opt_db);
+        } else if (argc > 0) {
+                dbfile = talloc_strdup(talloc_tos(), argv[0]);
+        } else {
+                dbfile = state_path("registry.tdb");
+        }
+        if (dbfile == NULL) {
+                return -1;
+        }
+
+        opts = (struct check_options) {
+                .lock = c->opt_lock || c->opt_long_list_entries,
+                .test = c->opt_testmode,
+                .automatic = c->opt_auto,
+                .verbose = c->opt_verbose,
+                .force = c->opt_force,
+                .repair = c->opt_repair || c->opt_reboot,
+                .version = c->opt_reg_version,
+                .output  = c->opt_output,
+                .wipe = c->opt_wipe,
+                .implicit_db = (c->opt_db == NULL) && (argc == 0),
+        };
+
+        ret = net_registry_check_db(dbfile, &opts);
+        talloc_free(dbfile);
+        return ret;
+}
+
+
 /******************************************************************************/
 
@@ -1385 +1680 @@
                            "    Convert .reg file")
                 },
+                {
+                        "check",
+                        net_registry_check,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Check a registry database"),
+                        N_("net registry check\n"
+                           "    Check a registry database")
+                },
         { NULL, NULL, 0, NULL, NULL }
         };
 
-        if (!W_ERROR_IS_OK(registry_init_basic())) {
-                return -1;
+        if (!c->display_usage
+            && argc > 0
+            && (strcasecmp_m(argv[0], "convert") != 0)
+            && (strcasecmp_m(argv[0], "check") != 0))
+        {
+                if (!W_ERROR_IS_OK(registry_init_basic())) {
+                        return -1;
+                }
         }
 

vendor/current/source3/utils/net_registry_util.c

@@ -28 +28 @@
 void print_registry_key(const char *keyname, NTTIME *modtime)
 {
+        const char *ts = _("None");
+        char *freeme = NULL;
+
+        if (modtime != 0) {
+                freeme = http_timestring(talloc_tos(),
+                                         nt_time_to_unix(*modtime));
+                ts = freeme;
+        }
+
         d_printf(_("Keyname   = %s\n"), keyname);
-        d_printf(_("Modtime   = %s\n"),
-                 modtime
-                 ? http_timestring(talloc_tos(), nt_time_to_unix(*modtime))
-                 : _("None"));
+        d_printf(_("Modtime   = %s\n"), ts);
         d_printf("\n");
+
+        TALLOC_FREE(freeme);
 }
 
@@ -51 +59 @@
                         d_printf(_("Value      = "));
                 }
-                d_printf("%d\n", v);
+                d_printf("%u\n", v);
                 break;
         }
@@ -72 +80 @@
         }
         case REG_MULTI_SZ: {
-                uint32 j;
+                uint32_t j;
                 const char **a;
 

vendor/current/source3/utils/net_rpc.c

@@ -38 +38 @@
 #include "lib/netapi/netapi.h"
 #include "lib/netapi/netapi_net.h"
+#include "librpc/gen_ndr/libnet_join.h"
+#include "libnet/libnet_join.h"
 #include "rpc_client/init_lsa.h"
 #include "../libcli/security/security.h"
@@ -44 +46 @@
 #include "nsswitch/libwbclient/wbclient.h"
 #include "passdb.h"
+#include "../libcli/smb/smbXcli_base.h"
 
 static int net_mode_share;
@@ -82 +85 @@
         struct dcerpc_binding_handle *b;
 
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
                                           &lsa_pipe);
         if (!NT_STATUS_IS_OK(status)) {
@@ -142 +145 @@
 int run_rpc_command(struct net_context *c,
                         struct cli_state *cli_arg,
-                        const struct ndr_syntax_id *interface,
+                        const struct ndr_interface_table *table,
                         int conn_flags,
                         rpc_command_fn fn,
@@ -187 +190 @@
         if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
                 if (lp_client_schannel()
-                    && (ndr_syntax_id_equal(interface,
+                    && (ndr_syntax_id_equal(&table->syntax_id,
                                             &ndr_table_netlogon.syntax_id))) {
                         /* Always try and create an schannel netlogon pipe. */
+                        TALLOC_FREE(c->netlogon_creds);
                         nt_status = cli_rpc_pipe_open_schannel(
-                                cli, interface, NCACN_NP,
-                                DCERPC_AUTH_LEVEL_PRIVACY, domain_name,
-                                &pipe_hnd);
+                                cli, c->msg_ctx, table, NCACN_NP,
+                                domain_name,
+                                &pipe_hnd, c, &c->netlogon_creds);
                         if (!NT_STATUS_IS_OK(nt_status)) {
                                 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
@@ -201 +205 @@
                 } else {
                         if (conn_flags & NET_FLAGS_SEAL) {
-                                nt_status = cli_rpc_pipe_open_ntlmssp(
-                                        cli, interface,
+                                nt_status = cli_rpc_pipe_open_generic_auth(
+                                        cli, table,
                                         (conn_flags & NET_FLAGS_TCP) ?
                                         NCACN_IP_TCP : NCACN_NP,
+                                        CRED_DONT_USE_KERBEROS,
+                                        DCERPC_AUTH_TYPE_NTLMSSP,
                                         DCERPC_AUTH_LEVEL_PRIVACY,
+                                        smbXcli_conn_remote_name(cli->conn),
                                         lp_workgroup(), c->opt_user_name,
                                         c->opt_password, &pipe_hnd);
                         } else {
                                 nt_status = cli_rpc_pipe_open_noauth(
-                                        cli, interface,
+                                        cli, table,
                                         &pipe_hnd);
                         }
                         if (!NT_STATUS_IS_OK(nt_status)) {
                                 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
-                                          get_pipe_name_from_syntax(
-                                                  talloc_tos(), interface),
+                                          table->name,
                                         nt_errstr(nt_status) ));
                                 goto fail;
@@ -275 +281 @@
         NTSTATUS status;
 
-        status = trust_pw_find_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup);
+        status = trust_pw_change(c->netlogon_creds,
+                                 c->msg_ctx,
+                                 pipe_hnd->binding_handle,
+                                 c->opt_target_workgroup,
+                                 true); /* force */
         if (!NT_STATUS_IS_OK(status)) {
                 d_fprintf(stderr, _("Failed to change machine account password: %s\n"),
@@ -306 +316 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
+        return run_rpc_command(c, NULL, &ndr_table_netlogon,
                                NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
                                rpc_changetrustpw_internals,
@@ -313 +323 @@
 
 /**
- * Join a domain, the old way.
+ * Join a domain, the old way.  This function exists to allow
+ * the message to be displayed when oldjoin was explicitly
+ * requested, but not when it was implied by "net rpc join".
  *
  * This uses 'machinename' as the inital password, and changes it.
@@ -319 +331 @@
  * The password should be created with 'server manager' or equiv first.
  *
- * All parameters are provided by the run_rpc_command function, except for
- * argc, argv which are passed through.
- *
- * @param domain_sid The domain sid acquired from the remote server.
- * @param cli A cli_state connected to the server.
- * @param mem_ctx Talloc context, destroyed on completion of the function.
  * @param argc  Standard main() style argc.
  * @param argv  Standard main() style argv. Initial components are already
  *              stripped.
  *
- * @return Normal NTSTATUS return.
+ * @return A shell status integer (0 for success).
  **/
 
-static NTSTATUS rpc_oldjoin_internals(struct net_context *c,
-                                        const struct dom_sid *domain_sid,
-                                        const char *domain_name,
-                                        struct cli_state *cli,
-                                        struct rpc_pipe_client *pipe_hnd,
-                                        TALLOC_CTX *mem_ctx,
-                                        int argc,
-                                        const char **argv)
-{
-
-        fstring trust_passwd;
-        unsigned char orig_trust_passwd_hash[16];
-        NTSTATUS result;
-        enum netr_SchannelType sec_channel_type;
-
-        result = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
-                                          &pipe_hnd);
-        if (!NT_STATUS_IS_OK(result)) {
-                DEBUG(0,("rpc_oldjoin_internals: netlogon pipe open to machine %s failed. "
-                        "error was %s\n",
-                        cli->desthost,
-                        nt_errstr(result) ));
-                return result;
+static int net_rpc_oldjoin(struct net_context *c, int argc, const char **argv)
+{
+        struct libnet_JoinCtx *r = NULL;
+        TALLOC_CTX *mem_ctx;
+        WERROR werr;
+        const char *domain = lp_workgroup(); /* FIXME */
+        bool modify_config = lp_config_backend_is_registry();
+        enum netr_SchannelType sec_chan_type;
+        char *pw = NULL;
+
+        if (c->display_usage) {
+                d_printf("Usage:\n"
+                         "net rpc oldjoin\n"
+                         "    Join a domain the old way\n");
+                return 0;
+        }
+
+        mem_ctx = talloc_init("net_rpc_oldjoin");
+        if (!mem_ctx) {
+                return -1;
+        }
+
+        werr = libnet_init_JoinCtx(mem_ctx, &r);
+        if (!W_ERROR_IS_OK(werr)) {
+                goto fail;
         }
 
@@ -362 +370 @@
         */
         if (argc >= 0) {
-                sec_channel_type = get_sec_channel_type(argv[0]);
+                sec_chan_type = get_sec_channel_type(argv[0]);
         } else {
-                sec_channel_type = get_sec_channel_type(NULL);
-        }
-
-        fstrcpy(trust_passwd, global_myname());
-        strlower_m(trust_passwd);
+                sec_chan_type = get_sec_channel_type(NULL);
+        }
+
+        if (!c->msg_ctx) {
+                d_fprintf(stderr, _("Could not initialise message context. "
+                        "Try running as root\n"));
+                werr = WERR_ACCESS_DENIED;
+                goto fail;
+        }
+
+        pw = talloc_strndup(r, lp_netbios_name(), 14);
+        if (pw == NULL) {
+                werr = WERR_NOMEM;
+                goto fail;
+        }
+
+        r->in.msg_ctx                   = c->msg_ctx;
+        r->in.domain_name               = domain;
+        r->in.secure_channel_type       = sec_chan_type;
+        r->in.dc_name                   = c->opt_host;
+        r->in.admin_account             = "";
+        r->in.admin_password            = strlower_talloc(r, pw);
+        if (r->in.admin_password == NULL) {
+                werr = WERR_NOMEM;
+                goto fail;
+        }
+        r->in.debug                     = true;
+        r->in.modify_config             = modify_config;
+        r->in.join_flags                = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
+                                          WKSSVC_JOIN_FLAGS_JOIN_UNSECURE |
+                                          WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED;
+
+        werr = libnet_Join(mem_ctx, r);
+        if (!W_ERROR_IS_OK(werr)) {
+                goto fail;
+        }
+
+        /* Check the short name of the domain */
+
+        if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
+                d_printf("The workgroup in %s does not match the short\n", get_dyn_CONFIGFILE());
+                d_printf("domain name obtained from the server.\n");
+                d_printf("Using the name [%s] from the server.\n", r->out.netbios_domain_name);
+                d_printf("You should set \"workgroup = %s\" in %s.\n",
+                         r->out.netbios_domain_name, get_dyn_CONFIGFILE());
+        }
+
+        d_printf("Using short domain name -- %s\n", r->out.netbios_domain_name);
+
+        if (r->out.dns_domain_name) {
+                d_printf("Joined '%s' to realm '%s'\n", r->in.machine_name,
+                        r->out.dns_domain_name);
+        } else {
+                d_printf("Joined '%s' to domain '%s'\n", r->in.machine_name,
+                        r->out.netbios_domain_name);
+        }
+
+        TALLOC_FREE(mem_ctx);
+
+        return 0;
+
+fail:
+        if (c->opt_flags & NET_FLAGS_EXPECT_FALLBACK) {
+                goto cleanup;
+        }
+
+        /* issue an overall failure message at the end. */
+        d_fprintf(stderr, _("Failed to join domain: %s\n"),
+                r && r->out.error_string ? r->out.error_string :
+                get_friendly_werror_msg(werr));
+
+cleanup:
+        TALLOC_FREE(mem_ctx);
+
+        return -1;
+}
+
+/**
+ * check that a join is OK
+ *
+ * @return A shell status integer (0 for success)
+ *
+ **/
+int net_rpc_testjoin(struct net_context *c, int argc, const char **argv)
+{
+        NTSTATUS status;
+        TALLOC_CTX *mem_ctx;
+        const char *domain = c->opt_target_workgroup;
+        const char *dc = c->opt_host;
+
+        if (c->display_usage) {
+                d_printf("Usage\n"
+                         "net rpc testjoin\n"
+                         "    Test if a join is OK\n");
+                return 0;
+        }
+
+        mem_ctx = talloc_init("net_rpc_testjoin");
+        if (!mem_ctx) {
+                return -1;
+        }
+
+        if (!dc) {
+                struct netr_DsRGetDCNameInfo *info;
+
+                if (!c->msg_ctx) {
+                        d_fprintf(stderr, _("Could not initialise message context. "
+                                "Try running as root\n"));
+                        talloc_destroy(mem_ctx);
+                        return -1;
+                }
+
+                status = dsgetdcname(mem_ctx,
+                                     c->msg_ctx,
+                                     domain,
+                                     NULL,
+                                     NULL,
+                                     DS_RETURN_DNS_NAME,
+                                     &info);
+                if (!NT_STATUS_IS_OK(status)) {
+                        talloc_destroy(mem_ctx);
+                        return -1;
+                }
+
+                dc = strip_hostname(info->dc_unc);
+        }
+
+        /* Display success or failure */
+        status = libnet_join_ok(c->msg_ctx,
+                                c->opt_workgroup,
+                                dc,
+                                c->opt_kerberos);
+        if (!NT_STATUS_IS_OK(status)) {
+                fprintf(stderr,"Join to domain '%s' is not valid: %s\n",
+                        domain, nt_errstr(status));
+                talloc_destroy(mem_ctx);
+                return -1;
+        }
+
+        printf("Join to '%s' is OK\n",domain);
+        talloc_destroy(mem_ctx);
+
+        return 0;
+}
+
+/**
+ * Join a domain using the administrator username and password
+ *
+ * @param argc  Standard main() style argc
+ * @param argc  Standard main() style argv.  Initial components are already
+ *              stripped.  Currently not used.
+ * @return A shell status integer (0 for success)
+ *
+ **/
+
+static int net_rpc_join_newstyle(struct net_context *c, int argc, const char **argv)
+{
+        struct libnet_JoinCtx *r = NULL;
+        TALLOC_CTX *mem_ctx;
+        WERROR werr;
+        const char *domain = lp_workgroup(); /* FIXME */
+        bool modify_config = lp_config_backend_is_registry();
+        enum netr_SchannelType sec_chan_type;
+
+        if (c->display_usage) {
+                d_printf("Usage:\n"
+                         "net rpc join\n"
+                         "    Join a domain the new way\n");
+                return 0;
+        }
+
+        mem_ctx = talloc_init("net_rpc_join_newstyle");
+        if (!mem_ctx) {
+                return -1;
+        }
+
+        werr = libnet_init_JoinCtx(mem_ctx, &r);
+        if (!W_ERROR_IS_OK(werr)) {
+                goto fail;
+        }
 
         /*
-         * Machine names can be 15 characters, but the max length on
-         * a password is 14.  --jerry
-         */
-
-        trust_passwd[14] = '\0';
-
-        E_md4hash(trust_passwd, orig_trust_passwd_hash);
-
-        result = trust_pw_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup,
-                                              global_myname(),
-                                              orig_trust_passwd_hash,
-                                              sec_channel_type);
-
-        if (NT_STATUS_IS_OK(result))
-                printf(_("Joined domain %s.\n"), c->opt_target_workgroup);
-
-
-        if (!secrets_store_domain_sid(c->opt_target_workgroup, domain_sid)) {
-                DEBUG(0, ("error storing domain sid for %s\n", c->opt_target_workgroup));
-                result = NT_STATUS_UNSUCCESSFUL;
-        }
-
-        return result;
-}
-
-/**
- * Join a domain, the old way.
- *
- * @param argc  Standard main() style argc.
- * @param argv  Standard main() style argv. Initial components are already
- *              stripped.
- *
- * @return A shell status integer (0 for success).
- **/
-
-static int net_rpc_perform_oldjoin(struct net_context *c, int argc, const char **argv)
-{
-        return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
-                               NET_FLAGS_NO_PIPE | NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
-                               rpc_oldjoin_internals,
-                               argc, argv);
-}
-
-/**
- * Join a domain, the old way.  This function exists to allow
- * the message to be displayed when oldjoin was explicitly
- * requested, but not when it was implied by "net rpc join".
- *
- * @param argc  Standard main() style argc.
- * @param argv  Standard main() style argv. Initial components are already
- *              stripped.
- *
- * @return A shell status integer (0 for success).
- **/
-
-static int net_rpc_oldjoin(struct net_context *c, int argc, const char **argv)
-{
-        int rc = -1;
-
-        if (c->display_usage) {
-                d_printf(  "%s\n"
-                           "net rpc oldjoin\n"
-                           "    %s\n",
-                         _("Usage:"),
-                         _("Join a domain the old way"));
-                return 0;
-        }
-
-        rc = net_rpc_perform_oldjoin(c, argc, argv);
-
-        if (rc) {
-                d_fprintf(stderr, _("Failed to join domain\n"));
-        }
-
-        return rc;
+           check what type of join - if the user want's to join as
+           a BDC, the server must agree that we are a BDC.
+        */
+        if (argc >= 0) {
+                sec_chan_type = get_sec_channel_type(argv[0]);
+        } else {
+                sec_chan_type = get_sec_channel_type(NULL);
+        }
+
+        if (!c->msg_ctx) {
+                d_fprintf(stderr, _("Could not initialise message context. "
+                        "Try running as root\n"));
+                werr = WERR_ACCESS_DENIED;
+                goto fail;
+        }
+
+        r->in.msg_ctx                   = c->msg_ctx;
+        r->in.domain_name               = domain;
+        r->in.secure_channel_type       = sec_chan_type;
+        r->in.dc_name                   = c->opt_host;
+        r->in.admin_account             = c->opt_user_name;
+        r->in.admin_password            = net_prompt_pass(c, c->opt_user_name);
+        r->in.debug                     = true;
+        r->in.use_kerberos              = c->opt_kerberos;
+        r->in.modify_config             = modify_config;
+        r->in.join_flags                = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
+                                          WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
+                                          WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
+
+        werr = libnet_Join(mem_ctx, r);
+        if (!W_ERROR_IS_OK(werr)) {
+                goto fail;
+        }
+
+        /* Check the short name of the domain */
+
+        if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
+                d_printf("The workgroup in %s does not match the short\n", get_dyn_CONFIGFILE());
+                d_printf("domain name obtained from the server.\n");
+                d_printf("Using the name [%s] from the server.\n", r->out.netbios_domain_name);
+                d_printf("You should set \"workgroup = %s\" in %s.\n",
+                         r->out.netbios_domain_name, get_dyn_CONFIGFILE());
+        }
+
+        d_printf("Using short domain name -- %s\n", r->out.netbios_domain_name);
+
+        if (r->out.dns_domain_name) {
+                d_printf("Joined '%s' to realm '%s'\n", r->in.machine_name,
+                        r->out.dns_domain_name);
+        } else {
+                d_printf("Joined '%s' to domain '%s'\n", r->in.machine_name,
+                        r->out.netbios_domain_name);
+        }
+
+        TALLOC_FREE(mem_ctx);
+
+        return 0;
+
+fail:
+        /* issue an overall failure message at the end. */
+        d_printf("Failed to join domain: %s\n",
+                r && r->out.error_string ? r->out.error_string :
+                get_friendly_werror_msg(werr));
+
+        TALLOC_FREE(mem_ctx);
+
+        return -1;
 }
 
@@ -462 +637 @@
 int net_rpc_join(struct net_context *c, int argc, const char **argv)
 {
+        int ret;
+
         if (c->display_usage) {
                 d_printf("%s\n%s",
@@ -482 +659 @@
         }
 
-        if (strlen(global_myname()) > 15) {
+        if (strlen(lp_netbios_name()) > 15) {
                 d_printf(_("Our netbios name can be at most 15 chars long, "
                            "\"%s\" is %u chars long\n"),
-                         global_myname(), (unsigned int)strlen(global_myname()));
+                         lp_netbios_name(), (unsigned int)strlen(lp_netbios_name()));
                 return -1;
         }
 
-        if ((net_rpc_perform_oldjoin(c, argc, argv) == 0))
+        c->opt_flags |= NET_FLAGS_EXPECT_FALLBACK;
+        ret = net_rpc_oldjoin(c, argc, argv);
+        c->opt_flags &= ~NET_FLAGS_EXPECT_FALLBACK;
+        if (ret == 0) {
                 return 0;
+        }
 
         return net_rpc_join_newstyle(c, argc, argv);
@@ -551 +732 @@
                                         &connect_pol,
                                         MAXIMUM_ALLOWED_ACCESS,
-                                        CONST_DISCARD(struct dom_sid2 *, domain_sid),
+                                        discard_const_p(struct dom_sid2, domain_sid),
                                         &domain_pol,
                                         &result);
@@ -608 +789 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id,
+        return run_rpc_command(c, NULL, &ndr_table_samr,
                                NET_FLAGS_PDC, rpc_info_internals,
                                argc, argv);
@@ -676 +857 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id,
+        return run_rpc_command(c, NULL, &ndr_table_samr,
                                conn_flags,
                                rpc_getsid_internals,
@@ -885 +1066 @@
                 u1003.usri1003_password = argv[1];
         } else {
+                char pwd[256] = {0};
                 ret = asprintf(&prompt, _("Enter new password for %s:"),
                                argv[0]);
@@ -890 +1072 @@
                         return -1;
                 }
-                u1003.usri1003_password = talloc_strdup(c, getpass(prompt));
+
+                ret = samba_getpass(prompt, pwd, sizeof(pwd), false, false);
                 SAFE_FREE(prompt);
+                if (ret < 0) {
+                        return -1;
+                }
+
+                u1003.usri1003_password = talloc_strdup(c, pwd);
                 if (u1003.usri1003_password == NULL) {
                         return -1;
@@ -1149 +1337 @@
         NTSTATUS status, result;
         struct dom_sid sid;
-        uint32 rid;
+        uint32_t rid;
         enum lsa_SidType type;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
@@ -1163 +1351 @@
         ZERO_STRUCT(user_pol);
 
-        status = net_rpc_lookup_name(c, mem_ctx, rpc_pipe_np_smb_conn(pipe_hnd),
+        status = net_rpc_lookup_name(c, mem_ctx, ctx->cli,
                                      argv[0], NULL, NULL, &sid, &type);
         if (!NT_STATUS_IS_OK(status)) {
@@ -1403 +1591 @@
         const char *username;
         const char *oldval = "unknown";
-        uint32 oldflags, newflags;
+        uint32_t oldflags, newflags;
         bool newval;
         union samr_UserInfo *info = NULL;
@@ -1487 +1675 @@
         static struct rpc_sh_cmd cmds[] = {
 
-                { "fullname", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
+                { "fullname", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
                   N_("Show/Set a user's full name") },
 
-                { "homedir", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
+                { "homedir", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
                   N_("Show/Set a user's home directory") },
 
-                { "homedrive", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
+                { "homedrive", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
                   N_("Show/Set a user's home drive") },
 
-                { "logonscript", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
+                { "logonscript", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
                   N_("Show/Set a user's logon script") },
 
-                { "profilepath", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
+                { "profilepath", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
                   N_("Show/Set a user's profile path") },
 
-                { "description", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
+                { "description", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
                   N_("Show/Set a user's description") },
 
-                { "disabled", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
+                { "disabled", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
                   N_("Show/Set whether a user is disabled") },
 
-                { "autolock", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
+                { "autolock", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
                   N_("Show/Set whether a user locked out") },
 
-                { "pwnotreq", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
+                { "pwnotreq", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
                   N_("Show/Set whether a user does not need a password") },
 
-                { "pwnoexp", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
+                { "pwnoexp", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
                   N_("Show/Set whether a user's password does not expire") },
 
@@ -1529 +1717 @@
         static struct rpc_sh_cmd cmds[] = {
 
-                { "list", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_list,
+                { "list", NULL, &ndr_table_samr, rpc_sh_user_list,
                   N_("List available users") },
 
-                { "info", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_info,
+                { "info", NULL, &ndr_table_samr, rpc_sh_user_info,
                   N_("List the domain groups a user is member of") },
 
-                { "show", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_show,
+                { "show", NULL, &ndr_table_samr, rpc_sh_user_show,
                   N_("Show info about a user") },
 
@@ -1624 +1812 @@
                                         &connect_pol,
                                         MAXIMUM_ALLOWED_ACCESS,
-                                        CONST_DISCARD(struct dom_sid2 *, domain_sid),
+                                        discard_const_p(struct dom_sid2, domain_sid),
                                         &domain_pol,
                                         &result);
@@ -1865 +2053 @@
 static int rpc_group_delete(struct net_context *c, int argc, const char **argv)
 {
-        return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_samr, 0,
                                rpc_group_delete_internals, argc,argv);
 }
@@ -1956 +2144 @@
         struct dcerpc_binding_handle *b;
 
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
                                           &pipe_hnd);
         if (!NT_STATUS_IS_OK(status)) {
@@ -1986 +2174 @@
         }
 
-        if (!NT_STATUS_IS_OK(status) && (StrnCaseCmp(name, "S-", 2) == 0)) {
+        if (!NT_STATUS_IS_OK(status) && (strncasecmp_m(name, "S-", 2) == 0)) {
 
                 /* Try as S-1-5-whatever */
@@ -2009 +2197 @@
         struct policy_handle connect_pol, domain_pol;
         NTSTATUS status, result;
-        uint32 group_rid;
+        uint32_t group_rid;
         struct policy_handle group_pol;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
@@ -2113 +2301 @@
 
 static NTSTATUS rpc_add_aliasmem(struct rpc_pipe_client *pipe_hnd,
-                                TALLOC_CTX *mem_ctx,
-                                const struct dom_sid *alias_sid,
-                                const char *member)
+                                 struct cli_state *cli,
+                                 TALLOC_CTX *mem_ctx,
+                                 const struct dom_sid *alias_sid,
+                                 const char *member)
 {
         struct policy_handle connect_pol, domain_pol;
         NTSTATUS status, result;
-        uint32 alias_rid;
+        uint32_t alias_rid;
         struct policy_handle alias_pol;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
@@ -2134 +2323 @@
         }
 
-        result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
+        result = get_sid_from_name(cli, mem_ctx,
                                    member, &member_sid, &member_type);
 
@@ -2241 +2430 @@
 
         if (group_type == SID_NAME_ALIAS) {
-                NTSTATUS result = rpc_add_aliasmem(pipe_hnd, mem_ctx,
+                NTSTATUS result = rpc_add_aliasmem(pipe_hnd, cli, mem_ctx,
                                                    &group_sid, argv[1]);
 
@@ -2259 +2448 @@
 static int rpc_group_addmem(struct net_context *c, int argc, const char **argv)
 {
-        return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_samr, 0,
                                rpc_group_addmem_internals,
                                argc, argv);
@@ -2272 +2461 @@
         struct policy_handle connect_pol, domain_pol;
         NTSTATUS status, result;
-        uint32 group_rid;
+        uint32_t group_rid;
         struct policy_handle group_pol;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
@@ -2373 +2562 @@
 
 static NTSTATUS rpc_del_aliasmem(struct rpc_pipe_client *pipe_hnd,
-                                TALLOC_CTX *mem_ctx,
-                                const struct dom_sid *alias_sid,
-                                const char *member)
+                                 struct cli_state *cli,
+                                 TALLOC_CTX *mem_ctx,
+                                 const struct dom_sid *alias_sid,
+                                 const char *member)
 {
         struct policy_handle connect_pol, domain_pol;
         NTSTATUS status, result;
-        uint32 alias_rid;
+        uint32_t alias_rid;
         struct policy_handle alias_pol;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
@@ -2393 +2583 @@
                 return NT_STATUS_UNSUCCESSFUL;
 
-        result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
+        result = get_sid_from_name(cli, mem_ctx,
                                    member, &member_sid, &member_type);
 
@@ -2502 +2692 @@
 
         if (group_type == SID_NAME_ALIAS) {
-                NTSTATUS result = rpc_del_aliasmem(pipe_hnd, mem_ctx,
+                NTSTATUS result = rpc_del_aliasmem(pipe_hnd, cli, mem_ctx,
                                                    &group_sid, argv[1]);
 
@@ -2520 +2710 @@
 static int rpc_group_delmem(struct net_context *c, int argc, const char **argv)
 {
-        return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_samr, 0,
                                rpc_group_delmem_internals,
                                argc, argv);
@@ -2552 +2742 @@
         struct policy_handle connect_pol, domain_pol;
         NTSTATUS status, result;
-        uint32 start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
+        uint32_t start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
         struct samr_SamArray *groups = NULL;
         bool global = false;
@@ -2610 +2800 @@
                                         &connect_pol,
                                         MAXIMUM_ALLOWED_ACCESS,
-                                        CONST_DISCARD(struct dom_sid2 *, domain_sid),
+                                        discard_const_p(struct dom_sid2, domain_sid),
                                         &domain_pol,
                                         &result);
@@ -2736 +2926 @@
                                         &connect_pol,
                                         MAXIMUM_ALLOWED_ACCESS,
-                                        CONST_DISCARD(struct dom_sid2 *, &global_sid_Builtin),
+                                        discard_const_p(struct dom_sid2, &global_sid_Builtin),
                                         &domain_pol,
                                         &result);
@@ -2819 +3009 @@
 static int rpc_group_list(struct net_context *c, int argc, const char **argv)
 {
-        return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_samr, 0,
                                rpc_group_list_internals,
                                argc, argv);
@@ -2830 +3020 @@
                                         const struct dom_sid *domain_sid,
                                         struct policy_handle *domain_pol,
-                                        uint32 rid)
+                                        uint32_t rid)
 {
         NTSTATUS result, status;
         struct policy_handle group_pol;
-        uint32 num_members, *group_rids;
+        uint32_t num_members, *group_rids;
         int i;
         struct samr_RidAttrArray *rids = NULL;
@@ -2920 +3110 @@
 
 static NTSTATUS rpc_list_alias_members(struct net_context *c,
-                                        struct rpc_pipe_client *pipe_hnd,
-                                        TALLOC_CTX *mem_ctx,
-                                        struct policy_handle *domain_pol,
-                                        uint32 rid)
+                                       struct rpc_pipe_client *pipe_hnd,
+                                       struct cli_state *cli,
+                                       TALLOC_CTX *mem_ctx,
+                                       struct policy_handle *domain_pol,
+                                       uint32_t rid)
 {
         NTSTATUS result, status;
         struct rpc_pipe_client *lsa_pipe;
         struct policy_handle alias_pol, lsa_pol;
-        uint32 num_members;
+        uint32_t num_members;
         struct dom_sid *alias_sids;
         char **domains;
@@ -2969 +3160 @@
         }
 
-        result = cli_rpc_pipe_open_noauth(rpc_pipe_np_smb_conn(pipe_hnd),
-                                          &ndr_table_lsarpc.syntax_id,
+        result = cli_rpc_pipe_open_noauth(cli,
+                                          &ndr_table_lsarpc,
                                           &lsa_pipe);
         if (!NT_STATUS_IS_OK(result)) {
@@ -2987 +3178 @@
         }
 
-        alias_sids = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, num_members);
+        alias_sids = talloc_zero_array(mem_ctx, struct dom_sid, num_members);
         if (!alias_sids) {
                 d_fprintf(stderr, _("Out of memory\n"));
@@ -3063 +3254 @@
                                         &connect_pol,
                                         MAXIMUM_ALLOWED_ACCESS,
-                                        CONST_DISCARD(struct dom_sid2 *, domain_sid),
+                                        discard_const_p(struct dom_sid2, domain_sid),
                                         &domain_pol,
                                         &result);
@@ -3147 +3338 @@
 
         if (rid_types.ids[0] == SID_NAME_ALIAS) {
-                return rpc_list_alias_members(c, pipe_hnd, mem_ctx, &domain_pol,
+                return rpc_list_alias_members(c, pipe_hnd, cli, mem_ctx, &domain_pol,
                                               rids.ids[0]);
         }
@@ -3160 +3351 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_samr, 0,
                                rpc_group_members_internals,
                                argc, argv);
@@ -3295 +3486 @@
                 }
 
-                return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
+                return run_rpc_command(c, NULL, &ndr_table_samr, 0,
                                        rpc_group_list_internals,
                                        argc, argv);
@@ -3325 +3516 @@
         char *sharename;
         char *path;
-        uint32 type = STYPE_DISKTREE; /* only allow disk shares to be added */
-        uint32 num_users=0, perms=0;
+        uint32_t type = STYPE_DISKTREE; /* only allow disk shares to be added */
+        uint32_t num_users=0, perms=0;
         char *password=NULL; /* don't allow a share password */
         struct SHARE_INFO_2 i2;
@@ -3408 +3599 @@
                              struct rpc_pipe_client *pipe_hnd,
                              TALLOC_CTX *mem_ctx,
-                             uint32 level,
+                             uint32_t level,
                              int argc,
                              const char **argv,
@@ -3467 +3658 @@
                 struct srvsvc_NetShareCtr1 *ctr1;
 
-                ctr1 = TALLOC_ZERO_P(mem_ctx, struct srvsvc_NetShareCtr1);
+                ctr1 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr1);
                 W_ERROR_HAVE_NO_MEMORY(ctr1);
 
@@ -3481 +3672 @@
                 struct srvsvc_NetShareCtr2 *ctr2;
 
-                ctr2 = TALLOC_ZERO_P(mem_ctx, struct srvsvc_NetShareCtr2);
+                ctr2 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr2);
                 W_ERROR_HAVE_NO_MEMORY(ctr2);
 
@@ -3495 +3686 @@
                 struct srvsvc_NetShareCtr502 *ctr502;
 
-                ctr502 = TALLOC_ZERO_P(mem_ctx, struct srvsvc_NetShareCtr502);
+                ctr502 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr502);
                 W_ERROR_HAVE_NO_MEMORY(ctr502);
 
@@ -3563 +3754 @@
         NTSTATUS status;
 
-        status = cli_tcon_andx(cli, netname, "A:", "", 0);
+        status = cli_tree_connect(cli, netname, "A:", "", 0);
         if (!NT_STATUS_IS_OK(status)) {
                 d_printf(_("skipping   [%s]: not a file share.\n"), netname);
@@ -3579 +3770 @@
 
 static bool check_share_sanity(struct net_context *c, struct cli_state *cli,
-                               const char *netname, uint32 type)
+                               const char *netname, uint32_t type)
 {
         /* only support disk shares */
@@ -3630 +3821 @@
         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
         struct srvsvc_NetShareInfoCtr ctr_src;
-        uint32 i;
+        uint32_t i;
         struct rpc_pipe_client *srvsvc_pipe = NULL;
         struct cli_state *cli_dst = NULL;
-        uint32 level = 502; /* includes secdesc */
+        uint32_t level = 502; /* includes secdesc */
         uint32_t parm_error = 0;
         struct dcerpc_binding_handle *b;
@@ -3644 +3835 @@
         /* connect destination PI_SRVSVC */
         nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
-                                     &ndr_table_srvsvc.syntax_id);
+                                     &ndr_table_srvsvc);
         if (!NT_STATUS_IS_OK(nt_status))
                 return nt_status;
@@ -3733 +3924 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
                                rpc_share_migrate_shares_internals,
                                argc, argv);
@@ -3800 +3991 @@
 
                 /* search below that directory */
-                fstrcpy(new_mask, dir);
-                fstrcat(new_mask, "\\*");
+                if (strlcpy(new_mask, dir, sizeof(new_mask)) >= sizeof(new_mask)) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                if (strlcat(new_mask, "\\*", sizeof(new_mask)) >= sizeof(new_mask)) {
+                        return NT_STATUS_NO_MEMORY;
+                }
 
                 old_dir = local_state->cwd;
@@ -3863 +4058 @@
         DEBUG(3,("calling cli_list with mask: %s\n", mask));
 
-        if ( !cli_resolve_path(talloc_tos(), "", NULL, cp_clistate->cli_share_src,
-                                mask, &targetcli, &targetpath ) ) {
+        status = cli_resolve_path(talloc_tos(), "", NULL,
+                                  cp_clistate->cli_share_src,
+                                  mask, &targetcli, &targetpath);
+        if (!NT_STATUS_IS_OK(status)) {
                 d_fprintf(stderr, _("cli_resolve_path %s failed with error: "
                                     "%s\n"),
-                        mask, cli_errstr(cp_clistate->cli_share_src));
-                return cli_nt_error(cp_clistate->cli_share_src);
+                        mask, nt_errstr(status));
+                return status;
         }
 
@@ -3949 +4146 @@
         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
         struct srvsvc_NetShareInfoCtr ctr_src;
-        uint32 i;
-        uint32 level = 502;
+        uint32_t i;
+        uint32_t level = 502;
         struct copy_clistate cp_clistate;
         bool got_src_share = false;
@@ -4010 +4207 @@
                 /* open share source */
                 nt_status = connect_to_service(c, &cp_clistate.cli_share_src,
-                                               &cli->dest_ss, cli->desthost,
+                                               smbXcli_conn_remote_sockaddr(cli->conn),
+                                               smbXcli_conn_remote_name(cli->conn),
                                                info502.name, "A:");
                 if (!NT_STATUS_IS_OK(nt_status))
@@ -4074 +4272 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
                                rpc_share_migrate_files_internals,
                                argc, argv);
@@ -4108 +4306 @@
         struct srvsvc_NetShareInfoCtr ctr_src;
         union srvsvc_NetShareInfo info;
-        uint32 i;
+        uint32_t i;
         struct rpc_pipe_client *srvsvc_pipe = NULL;
         struct cli_state *cli_dst = NULL;
-        uint32 level = 502; /* includes secdesc */
+        uint32_t level = 502; /* includes secdesc */
         uint32_t parm_error = 0;
         struct dcerpc_binding_handle *b;
@@ -4123 +4321 @@
         /* connect destination PI_SRVSVC */
         nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
-                                     &ndr_table_srvsvc.syntax_id);
+                                     &ndr_table_srvsvc);
         if (!NT_STATUS_IS_OK(nt_status))
                 return nt_status;
@@ -4209 +4407 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
                                rpc_share_migrate_security_internals,
                                argc, argv);
@@ -4247 +4445 @@
          * before copying files - gd */
 
-        ret = run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
+        ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
                               rpc_share_migrate_shares_internals, argc, argv);
         if (ret)
                 return ret;
 
-        ret = run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
+        ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
                               rpc_share_migrate_files_internals, argc, argv);
         if (ret)
                 return ret;
 
-        return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
                                rpc_share_migrate_security_internals, argc,
                                argv);
@@ -4315 +4513 @@
 struct full_alias {
         struct dom_sid sid;
-        uint32 num_members;
+        uint32_t num_members;
         struct dom_sid *members;
 };
@@ -4325 +4523 @@
  * Add an alias to the static list.
  */
-static void push_alias(TALLOC_CTX *mem_ctx, struct full_alias *alias)
-{
-        if (server_aliases == NULL)
-                server_aliases = SMB_MALLOC_ARRAY(struct full_alias, 100);
+static void push_alias(struct full_alias *alias)
+{
+        size_t array_size;
+
+        if (server_aliases == NULL) {
+                server_aliases = talloc_array(NULL, struct full_alias, 100);
+                if (server_aliases == NULL) {
+                        smb_panic("talloc_array failed");
+                }
+        }
+
+        array_size = talloc_array_length(server_aliases);
+        if (array_size == num_server_aliases) {
+                server_aliases = talloc_realloc(NULL, server_aliases,
+                                                struct full_alias, array_size + 100);
+                if (server_aliases == NULL) {
+                        smb_panic("talloc_realloc failed");
+                }
+        }
 
         server_aliases[num_server_aliases] = *alias;
@@ -4344 +4557 @@
                                         const struct dom_sid *domain_sid)
 {
-        uint32 start_idx, max_entries, num_entries, i;
+        uint32_t start_idx, max_entries, num_entries, i;
         struct samr_SamArray *groups = NULL;
         NTSTATUS result, status;
@@ -4355 +4568 @@
                                         connect_pol,
                                         MAXIMUM_ALLOWED_ACCESS,
-                                        CONST_DISCARD(struct dom_sid2 *, domain_sid),
+                                        discard_const_p(struct dom_sid2, domain_sid),
                                         &domain_pol,
                                         &result);
@@ -4437 +4650 @@
                                     groups->entries[i].idx);
 
-                        push_alias(mem_ctx, &alias);
+                        push_alias(&alias);
                 }
         } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
@@ -4505 +4718 @@
                 for (j=0; j<alias->num_members; j++)
                         DEBUG(1, ("%s\\%s (%d); ",
-                                  domains[j] ? domains[j] : "*unknown*", 
+                                  domains[j] ? domains[j] : "*unknown*",
                                   names[j] ? names[j] : "*unknown*",types[j]));
                 DEBUG(1, ("\n"));
@@ -4702 +4915 @@
                 gid_t gid = groups[i];
                 struct dom_sid sid;
+                bool ok;
 
                 wbc_status = wbcGidToSid(gid, &wsid);
@@ -4715 +4929 @@
                 DEBUG(3, (" %s\n", sid_str));
 
-                string_to_sid(&sid, sid_str);
+                ok = string_to_sid(&sid, sid_str);
+                if (!ok) {
+                        DEBUG(1, ("Failed to convert string to SID\n"));
+                        wbcFreeMemory(groups);
+                        return false;
+                }
                 add_sid_to_token(token, &sid);
         }
@@ -4777 +4996 @@
                         *p++ = '\0';
                         fstrcpy(domain, users[i]);
-                        strupper_m(domain);
+                        if (!strupper_m(domain)) {
+                                DEBUG(1, ("strupper_m %s failed\n", domain));
+                                wbcFreeMemory(users);
+                                return false;
+                        }
                         fstrcpy(user, p);
                 }
@@ -4839 +5062 @@
                 token = &((*tokens)[*num_tokens-1]);
 
-                fstrcpy(token->name, line);
+                if (strlcpy(token->name, line, sizeof(token->name)) >= sizeof(token->name)) {
+                        return false;
+                }
                 token->token.num_sids = 0;
                 token->token.sids = NULL;
                 continue;
         }
-        
+
         return false;
 }
@@ -4854 +5079 @@
 
 static void show_userlist(struct rpc_pipe_client *pipe_hnd,
-                        TALLOC_CTX *mem_ctx,
-                        const char *netname,
-                        int num_tokens,
-                        struct user_token *tokens)
+                          struct cli_state *cli,
+                          TALLOC_CTX *mem_ctx,
+                          const char *netname,
+                          int num_tokens,
+                          struct user_token *tokens)
 {
         uint16_t fnum;
         struct security_descriptor *share_sd = NULL;
         struct security_descriptor *root_sd = NULL;
-        struct cli_state *cli = rpc_pipe_np_smb_conn(pipe_hnd);
         int i;
         union srvsvc_NetShareInfo info;
         WERROR result;
         NTSTATUS status;
-        uint16 cnum;
+        uint16_t cnum;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 
@@ -4889 +5114 @@
         }
 
-        cnum = cli->cnum;
-
-        if (!NT_STATUS_IS_OK(cli_tcon_andx(cli, netname, "A:", "", 0))) {
+        cnum = cli_state_get_tid(cli);
+
+        if (!NT_STATUS_IS_OK(cli_tree_connect(cli, netname, "A:", "", 0))) {
                 return;
         }
 
         if (!NT_STATUS_IS_OK(cli_ntcreate(cli, "\\", 0, READ_CONTROL_ACCESS, 0,
-                        FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
-                root_sd = cli_query_secdesc(cli, fnum, mem_ctx);
+                        FILE_SHARE_READ|FILE_SHARE_WRITE,
+                        FILE_OPEN, 0x0, 0x0, &fnum, NULL))) {
+                cli_query_secdesc(cli, fnum, mem_ctx, &root_sd);
         }
 
         for (i=0; i<num_tokens; i++) {
-                uint32 acc_granted;
+                uint32_t acc_granted;
 
                 if (share_sd != NULL) {
@@ -4933 +5159 @@
                 cli_close(cli, fnum);
         cli_tdis(cli);
-        cli->cnum = cnum;
-        
+        cli_state_set_tid(cli, cnum);
+
         return;
 }
@@ -5046 +5272 @@
                 d_printf("%s\n", netname);
 
-                show_userlist(pipe_hnd, mem_ctx, netname,
+                show_userlist(pipe_hnd, cli, mem_ctx, netname,
                               num_tokens, tokens);
         }
@@ -5054 +5280 @@
         }
         SAFE_FREE(tokens);
+        TALLOC_FREE(server_aliases);
 
         return nt_status;
@@ -5072 +5299 @@
         }
 
-        result = run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
+        result = run_rpc_command(c, NULL, &ndr_table_samr, 0,
                                  rpc_aliaslist_internals,
                                  argc, argv);
@@ -5078 +5305 @@
                 return result;
 
-        result = run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
+        result = run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
                                  rpc_aliaslist_dump,
                                  argc, argv);
@@ -5084 +5311 @@
                 return result;
 
-        return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
                                rpc_share_allowedusers_internals,
                                argc, argv);
@@ -5102 +5329 @@
         if (!get_user_tokens(c, &num_tokens, &tokens)) {
                 DEBUG(0, ("Could not get the user/sid list\n"));
-                return 0;
+                return -1;
         }
 
@@ -5111 +5338 @@
 
         SAFE_FREE(tokens);
-        return 1;
+        return 0;
 }
 
@@ -5308 +5535 @@
         static struct rpc_sh_cmd cmds[] = {
 
-        { "list", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_list,
+        { "list", NULL, &ndr_table_srvsvc, rpc_sh_share_list,
           N_("List available shares") },
 
-        { "add", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_add,
+        { "add", NULL, &ndr_table_srvsvc, rpc_sh_share_add,
           N_("Add a share") },
 
-        { "delete", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_delete,
+        { "delete", NULL, &ndr_table_srvsvc, rpc_sh_share_delete,
           N_("Delete a share") },
 
-        { "info", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_info,
+        { "info", NULL, &ndr_table_srvsvc, rpc_sh_share_info,
           N_("Get information about a share") },
 
@@ -5377 +5604 @@
 {
         NET_API_STATUS status;
-        uint32 preferred_len = 0xffffffff, i;
-        const char *username=NULL;
+        uint32_t preferred_len = 0xffffffff, i;
+        char *username=NULL;
         uint32_t total_entries = 0;
         uint32_t entries_read = 0;
@@ -5417 +5644 @@
         }
  done:
+        SAFE_FREE(username);
         return status;
 }
@@ -5598 +5826 @@
         }
 
-        rc = run_rpc_command(c, NULL, &ndr_table_initshutdown.syntax_id, 0,
+        rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
                              rpc_shutdown_abort_internals, argc, argv);
 
@@ -5606 +5834 @@
         DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
 
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                                rpc_reg_shutdown_abort_internals,
                                argc, argv);
@@ -5640 +5868 @@
         WERROR result;
         const char *msg = N_("This machine will be shutdown shortly");
-        uint32 timeout = 20;
+        uint32_t timeout = 20;
         struct lsa_StringLarge msg_string;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
@@ -5696 +5924 @@
 {
         const char *msg = N_("This machine will be shutdown shortly");
-        uint32 timeout = 20;
+        uint32_t timeout = 20;
         struct lsa_StringLarge msg_string;
         NTSTATUS result;
@@ -5756 +5984 @@
         }
 
-        rc = run_rpc_command(c, NULL, &ndr_table_initshutdown.syntax_id, 0,
+        rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
                              rpc_init_shutdown_internals, argc, argv);
 
         if (rc) {
                 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
-                rc = run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+                rc = run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                                      rpc_reg_shutdown_internals, argc, argv);
         }
@@ -5801 +6029 @@
         char *acct_name;
         struct lsa_String lsa_acct_name;
-        uint32 acb_info;
-        uint32 acct_flags=0;
-        uint32 user_rid;
+        uint32_t acb_info;
+        uint32_t acct_flags=0;
+        uint32_t user_rid;
         uint32_t access_granted = 0;
         union samr_UserInfo info;
         unsigned int orig_timeout;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
+        DATA_BLOB session_key = data_blob_null;
 
         if (argc != 2) {
@@ -5825 +6054 @@
         }
 
-        strupper_m(acct_name);
+        if (!strupper_m(acct_name)) {
+                SAFE_FREE(acct_name);
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         init_lsa_String(&lsa_acct_name, acct_name);
+
+        status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
+                        nt_errstr(status)));
+                goto done;
+        }
 
         /* Get samr policy handle */
@@ -5847 +6086 @@
                                         &connect_pol,
                                         MAXIMUM_ALLOWED_ACCESS,
-                                        CONST_DISCARD(struct dom_sid2 *, domain_sid),
+                                        discard_const_p(struct dom_sid2, domain_sid),
                                         &domain_pol,
                                         &result);
@@ -5899 +6138 @@
 
                 init_samr_CryptPassword(argv[1],
-                                        &cli->user_session_key,
+                                        &session_key,
                                         &crypt_pwd);
 
@@ -5926 +6165 @@
  done:
         SAFE_FREE(acct_name);
+        data_blob_clear_free(&session_key);
         return status;
 }
@@ -5941 +6181 @@
 {
         if (argc > 0 && !c->display_usage) {
-                return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
+                return run_rpc_command(c, NULL, &ndr_table_samr, 0,
                                        rpc_trustdom_add_internals, argc, argv);
         } else {
@@ -6001 +6241 @@
                 return NT_STATUS_NO_MEMORY;
 
-        strupper_m(acct_name);
+        if (!strupper_m(acct_name)) {
+                TALLOC_FREE(acct_name);
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 
         /* Get samr policy handle */
@@ -6021 +6264 @@
                                         &connect_pol,
                                         MAXIMUM_ALLOWED_ACCESS,
-                                        CONST_DISCARD(struct dom_sid2 *, domain_sid),
+                                        discard_const_p(struct dom_sid2, domain_sid),
                                         &domain_pol,
                                         &result);
@@ -6152 +6395 @@
 {
         if (argc > 0 && !c->display_usage) {
-                return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
+                return run_rpc_command(c, NULL, &ndr_table_samr, 0,
                                        rpc_trustdom_del_internals, argc, argv);
         } else {
@@ -6186 +6429 @@
         /* Try netr_GetDcName */
 
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon,
                                           &netr);
         if (!NT_STATUS_IS_OK(status)) {
@@ -6195 +6438 @@
 
         status = dcerpc_netr_GetDcName(b, mem_ctx,
-                                       cli->desthost,
+                                       netr->desthost,
                                        domain_name,
                                        &buffer,
@@ -6255 +6498 @@
 
         domain_name = smb_xstrdup(argv[0]);
-        strupper_m(domain_name);
+        if (!strupper_m(domain_name)) {
+                SAFE_FREE(domain_name);
+                return -1;
+        }
 
         /* account name used at first is our domain's name with '$' */
@@ -6261 +6507 @@
                 return -1;
         }
-        strupper_m(acct_name);
+        if (!strupper_m(acct_name)) {
+                SAFE_FREE(domain_name);
+                SAFE_FREE(acct_name);
+                return -1;
+        }
 
         /*
@@ -6326 +6576 @@
          */
 
-        nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
+        nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
                                              &pipe_hnd);
         if (!NT_STATUS_IS_OK(nt_status)) {
@@ -6433 +6683 @@
         /* generate upper cased domain name */
         domain_name = smb_xstrdup(argv[0]);
-        strupper_m(domain_name);
+        if (!strupper_m(domain_name)) {
+                SAFE_FREE(domain_name);
+                return -1;
+        }
 
         /* delete password of the trust */
@@ -6484 +6737 @@
         union lsa_TrustedDomainInfo *info = NULL;
         char *cleartextpwd = NULL;
-        uint8_t session_key[16];
-        DATA_BLOB session_key_blob;
+        DATA_BLOB session_key;
         DATA_BLOB data = data_blob_null;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
@@ -6510 +6762 @@
                          info->password.password->length);
 
-        if (!rpccli_get_pwd_hash(pipe_hnd, session_key)) {
-                DEBUG(0, ("Could not retrieve password hash\n"));
-                goto done;
-        }
-
-        session_key_blob = data_blob_const(session_key, sizeof(session_key));
-        cleartextpwd = sess_decrypt_string(mem_ctx, &data, &session_key_blob);
+        nt_status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(nt_status)));
+                goto done;
+        }
+
+        cleartextpwd = sess_decrypt_string(mem_ctx, &data, &session_key);
+        data_blob_free(&session_key);
 
         if (cleartextpwd == NULL) {
@@ -6552 +6805 @@
         NTSTATUS nt_status, result;
         const char *domain_name = NULL;
-        struct dom_sid *queried_dom_sid;
         struct policy_handle connect_hnd;
         union lsa_PolicyInformation *info = NULL;
@@ -6583 +6835 @@
          */
 
-        if (StrCaseCmp(c->opt_workgroup, lp_workgroup())) {
+        if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
                 domain_name = c->opt_workgroup;
                 c->opt_target_workgroup = c->opt_workgroup;
         } else {
-                fstrcpy(pdc_name, global_myname());
+                fstrcpy(pdc_name, lp_netbios_name());
                 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
                 c->opt_target_workgroup = domain_name;
@@ -6601 +6853 @@
         };
 
-        nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
+        nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
                                              &pipe_hnd);
         if (!NT_STATUS_IS_OK(nt_status)) {
@@ -6644 +6896 @@
                 return -1;
         }
-
-        queried_dom_sid = info->account_domain.sid;
 
         /*
@@ -6683 +6933 @@
                                              dom_list.domains[i].name.string);
 
-                        nt_status = vampire_trusted_domain(pipe_hnd, mem_ctx, &connect_hnd, 
+                        nt_status = vampire_trusted_domain(pipe_hnd, mem_ctx, &connect_hnd,
                                                            *dom_list.domains[i].sid,
                                                            dom_list.domains[i].name.string);
@@ -6763 +7013 @@
          */
 
-        if (StrCaseCmp(c->opt_workgroup, lp_workgroup())) {
+        if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
                 domain_name = c->opt_workgroup;
                 c->opt_target_workgroup = c->opt_workgroup;
         } else {
-                fstrcpy(pdc_name, global_myname());
+                fstrcpy(pdc_name, lp_netbios_name());
                 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
                 c->opt_target_workgroup = domain_name;
@@ -6781 +7031 @@
         };
 
-        nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
+        nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
                                              &pipe_hnd);
         if (!NT_STATUS_IS_OK(nt_status)) {
@@ -6802 +7052 @@
                 return -1;
         };
-        
+
         /* query info level 5 to obtain sid of a domain being queried */
         nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
@@ -6885 +7135 @@
                 return -1;
         };
-        
+
         TALLOC_FREE(pipe_hnd);
 
@@ -6891 +7141 @@
          * Listing trusting domains (stored in passdb backend, if local)
          */
-        
+
         d_printf(_("\nTrusting domains list:\n\n"));
 
@@ -6897 +7147 @@
          * Open \PIPE\samr and get needed policy handles
          */
-        nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
+        nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
                                              &pipe_hnd);
         if (!NT_STATUS_IS_OK(nt_status)) {
@@ -6989 +7239 @@
                 for (i = 0; i < num_domains; i++) {
 
-                        char *str = CONST_DISCARD(char *, trusts->entries[i].name.string);
+                        char *str = discard_const_p(char, trusts->entries[i].name.string);
 
                         found_domain = true;
@@ -7005 +7255 @@
 
                         /* set opt_* variables to remote domain */
-                        strupper_m(str);
+                        if (!strupper_m(str)) {
+                                cli_shutdown(cli);
+                                talloc_destroy(mem_ctx);
+                                return -1;
+                        }
                         c->opt_workgroup = talloc_strdup(mem_ctx, str);
                         c->opt_target_workgroup = c->opt_workgroup;
@@ -7019 +7273 @@
                                 if (run_rpc_command(
                                             c, remote_cli,
-                                            &ndr_table_lsarpc.syntax_id, 0,
+                                            &ndr_table_lsarpc, 0,
                                             rpc_query_domain_sid, argc,
                                             argv))
@@ -7142 +7396 @@
                 return false;
 
-        if ((cli = cli_initialise()) == NULL) {
+        status = cli_connect_nb(server_name, &server_ss, 0, 0x20,
+                                lp_netbios_name(), SMB_SIGNING_IPC_DEFAULT,
+                                0, &cli);
+        if (!NT_STATUS_IS_OK(status)) {
                 return false;
         }
-
-        status = cli_connect(cli, server_name, &server_ss);
+        status = smbXcli_negprot(cli->conn, cli->timeout, PROTOCOL_CORE,
+                                 PROTOCOL_NT1);
         if (!NT_STATUS_IS_OK(status))
                 goto done;
-        if (!attempt_netbios_session_request(&cli, global_myname(),
-                                             server_name, &server_ss))
-                goto done;
-        status = cli_negprot(cli);
-        if (!NT_STATUS_IS_OK(status))
-                goto done;
-        if (cli->protocol < PROTOCOL_NT1)
+        if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_NT1)
                 goto done;
 
@@ -7175 +7426 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
+        return run_rpc_command(c, NULL, &ndr_table_netlogon,
                                NET_FLAGS_ANONYMOUS,
                                rpc_samdump_internals, argc, argv);
@@ -7264 +7515 @@
         }
 
-        ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                               rpc_printer_migrate_printers_internals, argc,
                               argv);
@@ -7270 +7521 @@
                 return ret;
 
-        ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                               rpc_printer_migrate_drivers_internals, argc,
                               argv);
@@ -7276 +7527 @@
                 return ret;
 
-        ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                               rpc_printer_migrate_forms_internals, argc, argv);
         if (ret)
                 return ret;
 
-        ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                               rpc_printer_migrate_settings_internals, argc,
                               argv);
@@ -7287 +7538 @@
                 return ret;
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_migrate_security_internals, argc,
                                argv);
@@ -7320 +7571 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_migrate_drivers_internals,
                                argc, argv);
@@ -7352 +7603 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_migrate_forms_internals,
                                argc, argv);
@@ -7384 +7635 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_migrate_printers_internals,
                                argc, argv);
@@ -7416 +7667 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_migrate_security_internals,
                                argc, argv);
@@ -7449 +7700 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_migrate_settings_internals,
                                argc, argv);
@@ -7547 +7798 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_list_internals,
                                argc, argv);
@@ -7574 +7825 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_driver_list_internals,
                                argc, argv);
@@ -7601 +7852 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_publish_publish_internals,
                                argc, argv);
@@ -7627 +7878 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_publish_update_internals,
                                argc, argv);
@@ -7654 +7905 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_publish_unpublish_internals,
                                argc, argv);
@@ -7681 +7932 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_publish_list_internals,
                                argc, argv);
@@ -7747 +7998 @@
                         return 0;
                 }
-                return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+                return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_publish_list_internals,
                                argc, argv);
@@ -7850 +8101 @@
                         return 0;
                 }
-                return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
+                return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
                                rpc_printer_list_internals,
                                argc, argv);
@@ -8057 +8308 @@
                            "    Manage trusts")
                 },
+                {
+                        "conf",
+                        net_rpc_conf,
+                        NET_TRANSPORT_RPC,
+                        N_("Configure a remote samba server"),
+                        N_("net rpc conf\n"
+                           "    Configure a remote samba server")
+                },
                 {NULL, NULL, 0, NULL, NULL}
         };

vendor/current/source3/utils/net_rpc_audit.c

@@ -412 +412 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
                 rpc_audit_get_internal, argc, argv);
 }
@@ -430 +430 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
                 rpc_audit_set_internal, argc, argv);
 }
@@ -448 +448 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
                 rpc_audit_enable_internal, argc, argv);
 }
@@ -466 +466 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
                 rpc_audit_disable_internal, argc, argv);
 }
@@ -484 +484 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
                 rpc_audit_list_internal, argc, argv);
 }

vendor/current/source3/utils/net_rpc_printer.c

@@ -25 +25 @@
 #include "rpc_client/init_spoolss.h"
 #include "nt_printing.h"
-#include "registry/reg_objects.h"
+#include "registry.h"
 #include "../libcli/security/security.h"
 #include "../libcli/registry/util_reg.h"
 #include "libsmb/libsmb.h"
+#include "../libcli/smb/smbXcli_base.h"
+#include "auth/gensec/gensec.h"
+#include "auth/credentials/credentials.h"
 
 /* support itanium as well */
@@ -81 +84 @@
 }
 
-static void display_reg_value(const char *subkey, struct regval_blob *value)
+static void display_reg_value(const char *subkey, const char *name, struct registry_value *value)
 {
         const char *text;
-        DATA_BLOB blob;
-
-        switch(regval_type(value)) {
+
+        switch(value->type) {
         case REG_DWORD:
-                d_printf(_("\t[%s:%s]: REG_DWORD: 0x%08x\n"), subkey,
-                        regval_name(value), *((uint32_t *) regval_data_p(value)));
+                if (value->data.length == sizeof(uint32_t)) {
+                        d_printf(_("\t[%s:%s]: REG_DWORD: 0x%08x\n"), subkey,
+                                 name, IVAL(value->data.data,0));
+                } else {
+                        d_printf(_("\t[%s:%s]: REG_DWORD: <invalid>\n"), subkey,
+                                 name);
+                }
                 break;
 
         case REG_SZ:
-                blob = data_blob_const(regval_data_p(value), regval_size(value));
-                pull_reg_sz(talloc_tos(), &blob, &text);
+                pull_reg_sz(talloc_tos(), &value->data, &text);
                 if (!text) {
                         break;
                 }
-                d_printf(_("\t[%s:%s]: REG_SZ: %s\n"), subkey, regval_name(value),
-                         text);
+                d_printf(_("\t[%s:%s]: REG_SZ: %s\n"), subkey, name, text);
                 break;
 
@@ -105 +110 @@
                 d_printf(_("\t[%s:%s]: REG_BINARY: unknown length value not "
                            "displayed\n"),
-                         subkey, regval_name(value));
+                         subkey, name);
                 break;
 
@@ -111 +116 @@
                 uint32_t i;
                 const char **values;
-                blob = data_blob_const(regval_data_p(value), regval_size(value));
-
-                if (!pull_reg_multi_sz(NULL, &blob, &values)) {
+
+                if (!pull_reg_multi_sz(NULL, &value->data, &values)) {
                         d_printf("pull_reg_multi_sz failed\n");
                         break;
                 }
 
-                printf("%s: REG_MULTI_SZ: \n", regval_name(value));
+                printf("%s: REG_MULTI_SZ: \n", name);
                 for (i=0; values[i] != NULL; i++) {
                         d_printf("%s\n", values[i]);
@@ -127 +131 @@
 
         default:
-                d_printf(_("\t%s: unknown type %d\n"), regval_name(value),
-                         regval_type(value));
+                d_printf(_("\t%s: unknown type %d\n"), name, value->type);
         }
 
@@ -159 +162 @@
                   bool copy_timestamps, bool is_file)
 {
-        NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
+        NTSTATUS nt_status;
         uint16_t fnum_src = 0;
         uint16_t fnum_dst = 0;
@@ -166 +169 @@
         time_t f_atime, f_ctime, f_mtime;
 
-
         if (!copy_timestamps && !copy_acls && !copy_attrs)
                 return NT_STATUS_OK;
@@ -175 +177 @@
                 is_file?"file":"dir", src_name));
 
-        if (!NT_STATUS_IS_OK(cli_ntcreate(cli_share_src, src_name, 0, READ_CONTROL_ACCESS, 0,
-                                FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum_src))) {
+        nt_status = cli_ntcreate(cli_share_src, src_name, 0,
+                                 READ_CONTROL_ACCESS, 0,
+                                 FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN,
+                                 0x0, 0x0, &fnum_src, NULL);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 DEBUGADD(0,("cannot open %s %s on originating server %s\n",
-                        is_file?"file":"dir", src_name, cli_errstr(cli_share_src)));
-                nt_status = cli_nt_error(cli_share_src);
+                        is_file?"file":"dir", src_name, nt_errstr(nt_status)));
                 goto out;
         }
 
-
         if (copy_acls) {
-
                 /* get the security descriptor */
-                sd = cli_query_secdesc(cli_share_src, fnum_src, mem_ctx);
-                if (!sd) {
+                nt_status = cli_query_secdesc(cli_share_src, fnum_src,
+                                              mem_ctx, &sd);
+                if (!NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(0,("failed to get security descriptor: %s\n",
-                                cli_errstr(cli_share_src)));
-                        nt_status = cli_nt_error(cli_share_src);
+                                 nt_errstr(nt_status)));
                         goto out;
                 }
@@ -199 +201 @@
         }
 
-
         if (copy_attrs || copy_timestamps) {
 
                 /* get file attributes */
-                if (!NT_STATUS_IS_OK(cli_getattrE(cli_share_src, fnum_src, &attr, NULL,
-                                 &f_ctime, &f_atime, &f_mtime))) {
+                nt_status = cli_getattrE(cli_share_src, fnum_src, &attr, NULL,
+                                      &f_ctime, &f_atime, &f_mtime);
+                if (!NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(0,("failed to get file-attrs: %s\n",
-                                cli_errstr(cli_share_src)));
-                        nt_status = cli_nt_error(cli_share_src);
+                                nt_errstr(nt_status)));
                         goto out;
                 }
         }
 
-
         /* open the file/dir on the destination server */
-
-        if (!NT_STATUS_IS_OK(cli_ntcreate(cli_share_dst, dst_name, 0, WRITE_DAC_ACCESS | WRITE_OWNER_ACCESS, 0,
-                                FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum_dst))) {
+        nt_status = cli_ntcreate(cli_share_dst, dst_name, 0,
+                                 WRITE_DAC_ACCESS | WRITE_OWNER_ACCESS, 0,
+                                 FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN,
+                                 0x0, 0x0, &fnum_dst, NULL);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 DEBUG(0,("failed to open %s on the destination server: %s: %s\n",
-                        is_file?"file":"dir", dst_name, cli_errstr(cli_share_dst)));
-                nt_status = cli_nt_error(cli_share_dst);
+                        is_file?"file":"dir", dst_name, nt_errstr(nt_status)));
                 goto out;
         }
 
         if (copy_timestamps) {
-
                 /* set timestamps */
-                if (!NT_STATUS_IS_OK(cli_setattrE(cli_share_dst, fnum_dst, f_ctime, f_atime, f_mtime))) {
+                nt_status = cli_setattrE(cli_share_dst, fnum_dst, f_ctime, f_atime, f_mtime);
+                if (!NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(0,("failed to set file-attrs (timestamps): %s\n",
-                                cli_errstr(cli_share_dst)));
-                        nt_status = cli_nt_error(cli_share_dst);
+                                nt_errstr(nt_status)));
                         goto out;
                 }
@@ -235 +235 @@
 
         if (copy_acls) {
-                NTSTATUS status;
-
                 /* set acls */
-                status = cli_set_secdesc(cli_share_dst, fnum_dst, sd);
-                if (!NT_STATUS_IS_OK(status)) {
+                nt_status = cli_set_secdesc(cli_share_dst, fnum_dst, sd);
+                if (!NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(0, ("could not set secdesc on %s: %s\n",
-                                  dst_name, nt_errstr(status)));
-                        nt_status = status;
+                                  dst_name, nt_errstr(nt_status)));
                         goto out;
                 }
@@ -248 +245 @@
 
         if (copy_attrs) {
-
                 /* set attrs */
-                if (!NT_STATUS_IS_OK(cli_setatr(cli_share_dst, dst_name, attr, 0))) {
+                nt_status = cli_setatr(cli_share_dst, dst_name, attr, 0);
+                if (!NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(0,("failed to set file-attrs: %s\n",
-                                cli_errstr(cli_share_dst)));
-                        nt_status = cli_nt_error(cli_share_dst);
+                                nt_errstr(nt_status)));
                         goto out;
                 }
@@ -260 +256 @@
 
         /* closing files */
-
-        if (!NT_STATUS_IS_OK(cli_close(cli_share_src, fnum_src))) {
+        nt_status = cli_close(cli_share_src, fnum_src);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 d_fprintf(stderr,
                         _("could not close %s on originating server: %s\n"),
-                        is_file?"file":"dir", cli_errstr(cli_share_src));
-                nt_status = cli_nt_error(cli_share_src);
+                        is_file?"file":"dir", nt_errstr(nt_status));
                 goto out;
         }
 
-        if (!NT_STATUS_IS_OK(cli_close(cli_share_dst, fnum_dst))) {
+        nt_status = cli_close(cli_share_dst, fnum_dst);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 d_fprintf(stderr,
                         _("could not close %s on destination server: %s\n"),
-                        is_file?"file":"dir", cli_errstr(cli_share_dst));
-                nt_status = cli_nt_error(cli_share_dst);
+                        is_file?"file":"dir", nt_errstr(nt_status));
                 goto out;
         }
@@ -339 +334 @@
         else
                 nt_status = cli_ntcreate(cli_share_src, src_name, 0, READ_CONTROL_ACCESS, 0,
-                                FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum_src);
+                                FILE_SHARE_READ|FILE_SHARE_WRITE,
+                                FILE_OPEN, 0x0, 0x0, &fnum_src, NULL);
 
         if (!NT_STATUS_IS_OK(nt_status)) {
                 DEBUGADD(0,("cannot open %s %s on originating server %s\n",
                         is_file ? "file":"dir",
-                        src_name, cli_errstr(cli_share_src)));
+                        src_name, nt_errstr(nt_status)));
                 goto out;
         }
@@ -358 +354 @@
                 if (!NT_STATUS_IS_OK(nt_status)) {
                         DEBUGADD(1,("cannot create file %s on destination server: %s\n", 
-                                dst_name, cli_errstr(cli_share_dst)));
+                                dst_name, nt_errstr(nt_status)));
                         goto out;
                 }
@@ -377 +373 @@
                 d_printf(_("copying [\\\\%s\\%s%s] => [\\\\%s\\%s%s] "
                            "%s ACLs and %s DOS Attributes %s\n"),
-                        cli_share_src->desthost, cli_share_src->share, src_name,
-                        cli_share_dst->desthost, cli_share_dst->share, dst_name,
+                        smbXcli_conn_remote_name(cli_share_src->conn),
+                        cli_share_src->share, src_name,
+                        smbXcli_conn_remote_name(cli_share_dst->conn),
+                        cli_share_dst->share, dst_name,
                         copy_acls ?  _("with") : _("without"),
                         copy_attrs ? _("with") : _("without"),
@@ -388 +386 @@
 
                 /* copying file */
-                int n;
-                n = cli_read(cli_share_src, fnum_src, data, nread,
-                                read_size);
-
-                if (n <= 0)
+                size_t n;
+
+                nt_status = cli_read(cli_share_src, fnum_src, data, nread,
+                                     read_size, &n);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        d_fprintf(stderr,
+                                  _("Error reading file [\\\\%s\\%s%s]: %s\n"),
+                                  smbXcli_conn_remote_name(cli_share_src->conn),
+                                  cli_share_src->share,
+                                  src_name, nt_errstr(nt_status));
+                        goto out;
+                }
+
+                if (n == 0)
                         break;
 
@@ -399 +406 @@
 
                 if (!NT_STATUS_IS_OK(nt_status)) {
-                        d_fprintf(stderr, _("Error writing file: %s\n"),
-                                  nt_errstr(nt_status));
+                        d_fprintf(stderr,
+                                  _("Error writing file: [\\\\%s\\%s%s]: %s\n"),
+                                  smbXcli_conn_remote_name(cli_share_dst->conn),
+                                  cli_share_dst->share,
+                                  dst_name, nt_errstr(nt_status));
                         goto out;
                 }
@@ -414 +424 @@
                         dst_name));
 
-                if (!NT_STATUS_IS_OK(cli_mkdir(cli_share_dst, dst_name))) {
+                nt_status = cli_mkdir(cli_share_dst, dst_name);
+                if (!NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(0,("cannot create directory %s: %s\n",
-                                dst_name, cli_errstr(cli_share_dst)));
+                                dst_name, nt_errstr(nt_status)));
                         nt_status = NT_STATUS_NO_SUCH_FILE;
                 }
 
-                if (!NT_STATUS_IS_OK(cli_chkpath(cli_share_dst, dst_name))) {
+
+                nt_status = cli_chkpath(cli_share_dst, dst_name);
+                if (!NT_STATUS_IS_OK(nt_status)) {
                         d_fprintf(stderr,
                                 _("cannot check for directory %s: %s\n"),
-                                dst_name, cli_errstr(cli_share_dst));
+                                dst_name, nt_errstr(nt_status));
                         goto out;
                 }
@@ -430 +443 @@
 
         /* closing files */
-        if (!NT_STATUS_IS_OK(cli_close(cli_share_src, fnum_src))) {
+        nt_status = cli_close(cli_share_src, fnum_src);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 d_fprintf(stderr,
                         _("could not close file on originating server: %s\n"),
-                        cli_errstr(cli_share_src));
-                nt_status = cli_nt_error(cli_share_src);
+                        nt_errstr(nt_status));
                 goto out;
         }
 
-        if (is_file && !NT_STATUS_IS_OK(cli_close(cli_share_dst, fnum_dst))) {
-                d_fprintf(stderr,
+        if (is_file) {
+                nt_status = cli_close(cli_share_dst, fnum_dst);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        d_fprintf(stderr,
                         _("could not close file on destination server: %s\n"),
-                        cli_errstr(cli_share_dst));
-                nt_status = cli_nt_error(cli_share_dst);
-                goto out;
+                        nt_errstr(nt_status));
+                        goto out;
+                }
         }
 
@@ -563 +578 @@
                 short_archi));
 
-        if (!NT_STATUS_IS_OK(cli_mkdir(cli_share, dir))) {
+        nt_status = cli_mkdir(cli_share, dir);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 DEBUG(1,("cannot create directory %s: %s\n",
-                         dir, cli_errstr(cli_share)));
-                nt_status = NT_STATUS_NO_SUCH_FILE;
+                         dir, nt_errstr(nt_status)));
         }
 
-        if (!NT_STATUS_IS_OK(cli_chkpath(cli_share, dir))) {
+        nt_status = cli_chkpath(cli_share, dir);
+        if (!NT_STATUS_IS_OK(nt_status)) {
                 d_fprintf(stderr, _("cannot check %s: %s\n"),
-                        dir, cli_errstr(cli_share));
+                        dir, nt_errstr(nt_status));
                 goto out;
         }
@@ -691 +707 @@
                                         const char *printername,
                                         uint32_t access_required,
-                                        const char *username,
                                         struct policy_handle *hnd)
 {
+        struct cli_credentials *creds = gensec_get_credentials(pipe_hnd->auth->auth_ctx);
+        const char *username = cli_credentials_get_username(creds);
         WERROR result;
         fstring printername2;
@@ -922 +939 @@
 
 static bool net_spoolss_setprinterdataex(struct rpc_pipe_client *pipe_hnd,
-                                        TALLOC_CTX *mem_ctx,
-                                        struct policy_handle *hnd,
-                                        const char *keyname,
-                                        struct regval_blob *value)
+                                         TALLOC_CTX *mem_ctx,
+                                         struct policy_handle *hnd,
+                                         const char *keyname,
+                                         const char *name,
+                                         struct registry_value *value)
 {
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
@@ -935 +953 @@
                                                  hnd,
                                                  keyname,
-                                                 regval_name(value),
-                                                 regval_type(value),
-                                                 regval_data_p(value),
-                                                 regval_size(value),
+                                                 name,
+                                                 value->type,
+                                                 value->data.data,
+                                                 value->data.length,
                                                  &result);
         if (!NT_STATUS_IS_OK(status)) {
@@ -1122 +1140 @@
         if (!net_spoolss_open_printer_ex(pipe_hnd, mem_ctx, argv[0],
                                          MAXIMUM_ALLOWED_ACCESS,
-                                         pipe_hnd->auth->user_name,
                                          &hnd))
                 return false;
@@ -1298 +1315 @@
         struct spoolss_DevmodeContainer devmode_ctr;
         struct sec_desc_buf secdesc_ctr;
-        struct policy_handle hnd;
+        struct policy_handle hnd = { 0, };
         WERROR result;
         const char *action_str;
@@ -1316 +1333 @@
                 /* open printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd, mem_ctx, sharename,
-                        PRINTER_ALL_ACCESS, pipe_hnd->auth->user_name, &hnd))
+                        PRINTER_ALL_ACCESS, &hnd))
                         goto done;
 
@@ -1454 +1471 @@
         union spoolss_PrinterInfo *info_enum;
         union spoolss_PrinterInfo info;
-        struct policy_handle hnd;
+        struct policy_handle hnd = { 0, };
         int state;
         WERROR werr;
@@ -1473 +1490 @@
                 /* open printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd, mem_ctx, sharename,
-                        PRINTER_ALL_ACCESS, cli->user_name, &hnd))
+                        PRINTER_ALL_ACCESS, &hnd))
                         goto done;
 
@@ -1553 +1570 @@
         struct rpc_pipe_client *pipe_hnd_dst = NULL;
         struct dcerpc_binding_handle *b_dst = NULL;
-        struct policy_handle hnd_src, hnd_dst;
+        struct policy_handle hnd_src = { 0, };
+        struct policy_handle hnd_dst = { 0, };
         union spoolss_PrinterInfo *info_enum;
         struct cli_state *cli_dst = NULL;
@@ -1563 +1581 @@
         /* connect destination PI_SPOOLSS */
         nt_status = connect_dst_pipe(c, &cli_dst, &pipe_hnd_dst,
-                                     &ndr_table_spoolss.syntax_id);
+                                     &ndr_table_spoolss);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
@@ -1608 +1626 @@
                 /* open src printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd, mem_ctx, sharename,
-                        MAXIMUM_ALLOWED_ACCESS, cli->user_name, &hnd_src))
+                        MAXIMUM_ALLOWED_ACCESS, &hnd_src))
                         goto done;
 
                 /* open dst printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd_dst, mem_ctx, sharename,
-                        PRINTER_ALL_ACCESS, cli_dst->user_name, &hnd_dst))
+                        PRINTER_ALL_ACCESS, &hnd_dst))
                         goto done;
 
@@ -1628 +1646 @@
                 /* copy secdesc (info level 2) */
                 info_dst.info2.devmode = NULL;
-                info_dst.info2.secdesc = dup_sec_desc(mem_ctx, info_src.info3.secdesc);
+                if (info_src.info3.secdesc == NULL) {
+                        info_dst.info2.secdesc = NULL;
+                } else {
+                        info_dst.info2.secdesc
+                                = security_descriptor_copy(mem_ctx,
+                                                        info_src.info3.secdesc);
+                        if (info_dst.info2.secdesc == NULL) {
+                                nt_status = NT_STATUS_NO_MEMORY;
+                                goto done;
+                        }
+                }
 
                 if (c->opt_verbose)
@@ -1703 +1731 @@
         struct rpc_pipe_client *pipe_hnd_dst = NULL;
         struct dcerpc_binding_handle *b_dst = NULL;
-        struct policy_handle hnd_src, hnd_dst;
+        struct policy_handle hnd_src = { 0, };
+        struct policy_handle hnd_dst = { 0, };
         union spoolss_PrinterInfo *info_enum;
         union spoolss_PrinterInfo info_dst;
@@ -1714 +1743 @@
         /* connect destination PI_SPOOLSS */
         nt_status = connect_dst_pipe(c, &cli_dst, &pipe_hnd_dst,
-                                     &ndr_table_spoolss.syntax_id);
+                                     &ndr_table_spoolss);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
@@ -1753 +1782 @@
                 /* open src printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd, mem_ctx, sharename,
-                        MAXIMUM_ALLOWED_ACCESS, cli->user_name, &hnd_src))
+                        MAXIMUM_ALLOWED_ACCESS, &hnd_src))
                         goto done;
 
                 /* open dst printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd_dst, mem_ctx, sharename,
-                        PRINTER_ALL_ACCESS, cli->user_name, &hnd_dst))
+                        PRINTER_ALL_ACCESS, &hnd_dst))
                         goto done;
 
@@ -1774 +1803 @@
                 for (f = 0; f < num_forms; f++) {
 
-                        union spoolss_AddFormInfo info;
+                        struct spoolss_AddFormInfoCtr info_ctr;
                         NTSTATUS status;
 
@@ -1787 +1816 @@
                                         f, forms[f].info1.form_name,
                                         forms[f].info1.flags);
-
-                        info.info1 = (struct spoolss_AddFormInfo1 *)
+                        info_ctr.level = 1;
+                        info_ctr.info.info1 = (struct spoolss_AddFormInfo1 *)
                                 (void *)&forms[f].info1;
 
@@ -1795 +1824 @@
                         status = dcerpc_spoolss_AddForm(b_dst, mem_ctx,
                                                         &hnd_dst,
-                                                        1,
-                                                        info,
+                                                        &info_ctr,
                                                         &result);
                         if (!NT_STATUS_IS_OK(status)) {
@@ -1878 +1906 @@
         struct rpc_pipe_client *pipe_hnd_dst = NULL;
         struct dcerpc_binding_handle *b_dst = NULL;
-        struct policy_handle hnd_src, hnd_dst;
+        struct policy_handle hnd_src = { 0, };
+        struct policy_handle hnd_dst = { 0, };
         union spoolss_DriverInfo drv_info_src;
         union spoolss_PrinterInfo *info_enum;
@@ -1891 +1920 @@
 
         nt_status = connect_dst_pipe(c, &cli_dst, &pipe_hnd_dst,
-                                     &ndr_table_spoolss.syntax_id);
+                                     &ndr_table_spoolss);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
@@ -1898 +1927 @@
 
         /* open print$-share on the src server */
-        nt_status = connect_to_service(c, &cli_share_src, &cli->dest_ss,
-                        cli->desthost, "print$", "A:");
+        nt_status = connect_to_service(c, &cli_share_src,
+                                       smbXcli_conn_remote_sockaddr(cli->conn),
+                                       smbXcli_conn_remote_name(cli->conn),
+                                       "print$", "A:");
         if (!NT_STATUS_IS_OK(nt_status))
                 goto done;
@@ -1907 +1938 @@
 
         /* open print$-share on the dst server */
-        nt_status = connect_to_service(c, &cli_share_dst, &cli_dst->dest_ss,
-                        cli_dst->desthost, "print$", "A:");
+        nt_status = connect_to_service(c, &cli_share_dst,
+                                       smbXcli_conn_remote_sockaddr(cli_dst->conn),
+                                       smbXcli_conn_remote_name(cli_dst->conn),
+                                       "print$", "A:");
         if (!NT_STATUS_IS_OK(nt_status))
                 return nt_status;
@@ -1949 +1982 @@
                 /* open dst printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd_dst, mem_ctx, sharename,
-                        PRINTER_ALL_ACCESS, cli->user_name, &hnd_dst))
+                        PRINTER_ALL_ACCESS, &hnd_dst))
                         goto done;
 
@@ -1960 +1993 @@
                 if (!net_spoolss_open_printer_ex(pipe_hnd, mem_ctx, sharename,
                                                  MAXIMUM_ALLOWED_ACCESS,
-                                                 pipe_hnd->auth->user_name,
                                                  &hnd_src))
                         goto done;
@@ -2000 +2032 @@
                         }
 
-                        DEBUGADD(1,("Sucessfully added driver [%s] for printer [%s]\n",
+                        DEBUGADD(1,("Successfully added driver [%s] for printer [%s]\n",
                                 drivername, printername));
 
@@ -2019 +2051 @@
                 }
 
-                DEBUGADD(1,("Sucessfully set driver %s for printer %s\n",
+                DEBUGADD(1,("Successfully set driver %s for printer %s\n",
                         drivername, printername));
 
@@ -2095 +2127 @@
         union spoolss_PrinterInfo *info_enum;
         struct cli_state *cli_dst = NULL;
-        struct policy_handle hnd_dst, hnd_src;
+        struct policy_handle hnd_src = { 0, };
+        struct policy_handle hnd_dst = { 0, };
         const char *printername, *sharename;
         struct rpc_pipe_client *pipe_hnd_dst = NULL;
@@ -2105 +2138 @@
         /* connect destination PI_SPOOLSS */
         nt_status = connect_dst_pipe(c, &cli_dst, &pipe_hnd_dst,
-                                     &ndr_table_spoolss.syntax_id);
+                                     &ndr_table_spoolss);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
@@ -2145 +2178 @@
                 /* open dst printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd_dst, mem_ctx, sharename,
-                        PRINTER_ALL_ACCESS, cli->user_name, &hnd_dst)) {
+                        PRINTER_ALL_ACCESS, &hnd_dst)) {
 
                         DEBUG(1,("could not open printer: %s\n", sharename));
@@ -2167 +2200 @@
                 /* open src printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd, mem_ctx, sharename,
-                        MAXIMUM_ALLOWED_ACCESS, cli->user_name, &hnd_src))
+                        MAXIMUM_ALLOWED_ACCESS, &hnd_src))
                         goto done;
 
@@ -2264 +2297 @@
         struct rpc_pipe_client *pipe_hnd_dst = NULL;
         struct dcerpc_binding_handle *b_dst = NULL;
-        struct policy_handle hnd_src, hnd_dst;
+        struct policy_handle hnd_src = { 0, };
+        struct policy_handle hnd_dst = { 0, };
         union spoolss_PrinterInfo *info_enum;
         union spoolss_PrinterInfo info_dst_publish;
         union spoolss_PrinterInfo info_dst;
         struct cli_state *cli_dst = NULL;
-        char *devicename = NULL, *unc_name = NULL, *url = NULL;
         const char *longname;
         const char **keylist = NULL;
@@ -2280 +2313 @@
         /* connect destination PI_SPOOLSS */
         nt_status = connect_dst_pipe(c, &cli_dst, &pipe_hnd_dst,
-                                     &ndr_table_spoolss.syntax_id);
+                                     &ndr_table_spoolss);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
@@ -2332 +2365 @@
                 /* open src printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd, mem_ctx, sharename,
-                        MAXIMUM_ALLOWED_ACCESS, cli->user_name, &hnd_src))
+                        MAXIMUM_ALLOWED_ACCESS, &hnd_src))
                         goto done;
 
                 /* open dst printer handle */
                 if (!net_spoolss_open_printer_ex(pipe_hnd_dst, mem_ctx, sharename,
-                        PRINTER_ALL_ACCESS, cli_dst->user_name, &hnd_dst))
+                        PRINTER_ALL_ACCESS, &hnd_dst))
                         goto done;
 
@@ -2434 +2467 @@
                                 /* display_value */
                                 if (c->opt_verbose) {
-                                        struct regval_blob *v;
-
-                                        v = regval_compose(talloc_tos(),
-                                                           r.out.value_name,
-                                                           *r.out.type,
-                                                           r.out.data,
-                                                           r.in.data_offered);
-                                        if (v == NULL) {
-                                                nt_status = NT_STATUS_NO_MEMORY;
-                                                goto done;
-                                        }
-
-                                        display_reg_value(SPOOL_PRINTERDATA_KEY, v);
-                                        talloc_free(v);
+                                        struct registry_value v;
+                                        v.type = *r.out.type;
+                                        v.data = data_blob_const(
+                                                r.out.data, r.in.data_offered);
+
+                                        display_reg_value(SPOOL_PRINTERDATA_KEY,
+                                                          r.out.value_name, &v);
                                 }
 
@@ -2496 +2522 @@
                         for (j=0; j < count; j++) {
 
-                                struct regval_blob *value;
-                                DATA_BLOB blob;
-
-                                ZERO_STRUCT(blob);
+                                struct registry_value value;
+                                const char *value_name = info[j].value_name;
+                                bool ok;
+
+                                value.type = REG_SZ;
 
                                 /* although samba replies with sane data in most cases we
                                    should try to avoid writing wrong registry data */
 
-                                if (strequal(info[j].value_name, SPOOL_REG_PORTNAME) ||
-                                    strequal(info[j].value_name, SPOOL_REG_UNCNAME) ||
-                                    strequal(info[j].value_name, SPOOL_REG_URL) ||
-                                    strequal(info[j].value_name, SPOOL_REG_SHORTSERVERNAME) ||
-                                    strequal(info[j].value_name, SPOOL_REG_SERVERNAME)) {
-
-                                        if (strequal(info[j].value_name, SPOOL_REG_PORTNAME)) {
-
-                                                /* although windows uses a multi-sz, we use a sz */
-                                                push_reg_sz(mem_ctx, &blob, SAMBA_PRINTER_PORT_NAME);
-                                        }
-
-                                        if (strequal(info[j].value_name, SPOOL_REG_UNCNAME)) {
-
-                                                if (asprintf(&unc_name, "\\\\%s\\%s", longname, sharename) < 0) {
-                                                        nt_status = NT_STATUS_NO_MEMORY;
-                                                        goto done;
-                                                }
-                                                push_reg_sz(mem_ctx, &blob, unc_name);
-                                        }
-
-                                        if (strequal(info[j].value_name, SPOOL_REG_URL)) {
-
-                                                continue;
-
-#if 0
-                                                /* FIXME: should we really do that ??? */
-                                                if (asprintf(&url, "http://%s:631/printers/%s", longname, sharename) < 0) {
-                                                        nt_status = NT_STATUS_NO_MEMORY;
-                                                        goto done;
-                                                }
-                                                push_reg_sz(mem_ctx, NULL, &blob, url);
-                                                fstrcpy(value.valuename, SPOOL_REG_URL);
-#endif
-                                        }
-
-                                        if (strequal(info[j].value_name, SPOOL_REG_SERVERNAME)) {
-
-                                                push_reg_sz(mem_ctx, &blob, longname);
-                                        }
-
-                                        if (strequal(info[j].value_name, SPOOL_REG_SHORTSERVERNAME)) {
-
-                                                push_reg_sz(mem_ctx, &blob, global_myname());
-                                        }
-
-                                        value = regval_compose(talloc_tos(),
-                                                               info[j].value_name,
-                                                               REG_SZ,
-                                                               blob.length == 0 ? NULL : blob.data,
-                                                               blob.length);
-                                        if (value == NULL) {
+                                if (strequal(value_name, SPOOL_REG_PORTNAME)) {
+                                        /* although windows uses a multi-sz, we use a sz */
+                                        ok = push_reg_sz(mem_ctx, &value.data, SAMBA_PRINTER_PORT_NAME);
+                                        if (!ok) {
                                                 nt_status = NT_STATUS_NO_MEMORY;
                                                 goto done;
                                         }
-
-                                        if (c->opt_verbose)
-                                                display_reg_value(subkey, value);
-
-                                        /* here we have to set all subkeys on the dst server */
-                                        if (!net_spoolss_setprinterdataex(pipe_hnd_dst, mem_ctx, &hnd_dst,
-                                                        subkey, value))
-                                        {
-                                                talloc_free(value);
-                                                goto done;
-                                        }
-
-                                        talloc_free(value);
-                                } else {
-
-                                        struct regval_blob *v;
-
-                                        v = regval_compose(talloc_tos(),
-                                                           info[j].value_name,
-                                                           info[j].type,
-                                                           info[j].data->data,
-                                                           info[j].data->length);
-                                        if (v == NULL) {
+                                }
+                                else if (strequal(value_name, SPOOL_REG_UNCNAME)) {
+                                        char *unc_name;
+                                        if (asprintf(&unc_name, "\\\\%s\\%s", longname, sharename) < 0) {
                                                 nt_status = NT_STATUS_NO_MEMORY;
                                                 goto done;
                                         }
-
-                                        if (c->opt_verbose) {
-                                                display_reg_value(subkey, v);
-                                        }
-
-                                        /* here we have to set all subkeys on the dst server */
-                                        if (!net_spoolss_setprinterdataex(pipe_hnd_dst, mem_ctx, &hnd_dst,
-                                                        subkey, v)) {
+                                        ok = push_reg_sz(mem_ctx, &value.data, unc_name);
+                                        if (!ok) {
+                                                nt_status = NT_STATUS_NO_MEMORY;
                                                 goto done;
                                         }
-
-                                        talloc_free(v);
+                                        free(unc_name);
+                                }
+                                else if (strequal(value_name, SPOOL_REG_URL)) {
+                                        continue;
+#if 0
+                                        /* FIXME: should we really do that ??? */
+                                        if (asprintf(&url, "http://%s:631/printers/%s", longname, sharename) < 0) {
+                                                nt_status = NT_STATUS_NO_MEMORY;
+                                                goto done;
+                                        }
+                                        push_reg_sz(mem_ctx, NULL, &value.data, url);
+                                        free(url);
+#endif
+                                }
+                                else if (strequal(value_name, SPOOL_REG_SERVERNAME)) {
+                                        ok = push_reg_sz(mem_ctx, &value.data, longname);
+                                        if (!ok) {
+                                                nt_status = NT_STATUS_NO_MEMORY;
+                                                goto done;
+                                        }
+                                }
+                                else if (strequal(value_name, SPOOL_REG_SHORTSERVERNAME)) {
+                                        ok = push_reg_sz(mem_ctx, &value.data, lp_netbios_name());
+                                        if (!ok) {
+                                                nt_status = NT_STATUS_NO_MEMORY;
+                                                goto done;
+                                        }
+                                }
+                                else {
+                                        value.type = info[j].type;
+                                        value.data = *info[j].data;
+                                }
+
+                                if (c->opt_verbose) {
+                                        display_reg_value(subkey, value_name, &value);
+                                }
+
+                                /* here we have to set all subkeys on the dst server */
+                                if (!net_spoolss_setprinterdataex(pipe_hnd_dst, mem_ctx, &hnd_dst,
+                                                                  subkey, value_name, &value))
+                                {
+                                        goto done;
                                 }
 
@@ -2620 +2615 @@
 
 done:
-        SAFE_FREE(devicename);
-        SAFE_FREE(url);
-        SAFE_FREE(unc_name);
-
         if (is_valid_policy_hnd(&hnd_src)) {
                 dcerpc_spoolss_ClosePrinter(b_src, mem_ctx, &hnd_src, &result);

vendor/current/source3/utils/net_rpc_registry.c

@@ -76 +76 @@
 
 static bool reg_hive_key(TALLOC_CTX *ctx, const char *fullname,
-                         uint32 *reg_type, const char **key_name)
+                         uint32_t *reg_type, const char **key_name)
 {
         WERROR werr;
@@ -129 +129 @@
 static NTSTATUS registry_openkey(TALLOC_CTX *mem_ctx,
                                  struct rpc_pipe_client *pipe_hnd,
-                                 const char *name, uint32 access_mask,
+                                 const char *name, uint32_t access_mask,
                                  struct policy_handle *hive_hnd,
                                  struct policy_handle *key_hnd)
 {
-        uint32 hive;
+        uint32_t hive;
         NTSTATUS status;
         WERROR werr;
@@ -172 +172 @@
                                   struct rpc_pipe_client *pipe_hnd,
                                   struct policy_handle *key_hnd,
-                                  uint32 *pnum_keys, char ***pnames,
+                                  uint32_t *pnum_keys, char ***pnames,
                                   char ***pclasses, NTTIME ***pmodtimes)
 {
@@ -178 +178 @@
         NTSTATUS status;
         WERROR werr;
-        uint32 num_subkeys, max_subkeylen, max_classlen;
-        uint32 num_values, max_valnamelen, max_valbufsize;
-        uint32 i;
+        uint32_t num_subkeys, max_subkeylen, max_classlen;
+        uint32_t num_values, max_valnamelen, max_valbufsize;
+        uint32_t i;
         NTTIME last_changed_time;
-        uint32 secdescsize;
+        uint32_t secdescsize;
         struct winreg_String classname;
         char **names, **classes;
@@ -212 +212 @@
         }
 
-        if ((!(names = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_subkeys))) ||
-            (!(classes = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_subkeys))) ||
-            (!(modtimes = TALLOC_ZERO_ARRAY(mem_ctx, NTTIME *,
+        if ((!(names = talloc_zero_array(mem_ctx, char *, num_subkeys))) ||
+            (!(classes = talloc_zero_array(mem_ctx, char *, num_subkeys))) ||
+            (!(modtimes = talloc_zero_array(mem_ctx, NTTIME *,
                                             num_subkeys)))) {
                 status = NT_STATUS_NO_MEMORY;
@@ -294 +294 @@
                                     struct rpc_pipe_client *pipe_hnd,
                                     struct policy_handle *key_hnd,
-                                    uint32 *pnum_values, char ***pvalnames,
+                                    uint32_t *pnum_values, char ***pvalnames,
                                     struct registry_value ***pvalues)
 {
@@ -300 +300 @@
         NTSTATUS status;
         WERROR werr;
-        uint32 num_subkeys, max_subkeylen, max_classlen;
-        uint32 num_values, max_valnamelen, max_valbufsize;
-        uint32 i;
+        uint32_t num_subkeys, max_subkeylen, max_classlen;
+        uint32_t num_values, max_valnamelen, max_valbufsize;
+        uint32_t i;
         NTTIME last_changed_time;
-        uint32 secdescsize;
+        uint32_t secdescsize;
         struct winreg_String classname;
         struct registry_value **values;
@@ -334 +334 @@
         }
 
-        if ((!(names = TALLOC_ARRAY(mem_ctx, char *, num_values))) ||
-            (!(values = TALLOC_ARRAY(mem_ctx, struct registry_value *,
+        if ((!(names = talloc_array(mem_ctx, char *, num_values))) ||
+            (!(values = talloc_array(mem_ctx, struct registry_value *,
                                      num_values)))) {
                 status = NT_STATUS_NO_MEMORY;
@@ -343 +343 @@
         for (i=0; i<num_values; i++) {
                 enum winreg_Type type = REG_NONE;
-                uint8 *data = NULL;
-                uint32 data_size;
-                uint32 value_length;
+                uint8_t *data = NULL;
+                uint32_t data_size;
+                uint32_t value_length;
 
                 char n;
@@ -356 +356 @@
 
                 data_size = max_valbufsize;
-                data = (uint8 *)TALLOC(mem_ctx, data_size);
+                data = (uint8_t *)TALLOC(mem_ctx, data_size);
                 value_length = 0;
 
@@ -417 +417 @@
                                      struct rpc_pipe_client *pipe_hnd,
                                      struct policy_handle *key_hnd,
-                                     uint32 *pnum_values, char ***pvalnames,
+                                     uint32_t *pnum_values, char ***pvalnames,
                                      struct regval_blob ***pvalues)
 {
@@ -423 +423 @@
         NTSTATUS status;
         WERROR werr;
-        uint32 num_subkeys, max_subkeylen, max_classlen;
-        uint32 num_values, max_valnamelen, max_valbufsize;
-        uint32 i;
+        uint32_t num_subkeys, max_subkeylen, max_classlen;
+        uint32_t num_values, max_valnamelen, max_valbufsize;
+        uint32_t i;
         NTTIME last_changed_time;
-        uint32 secdescsize;
+        uint32_t secdescsize;
         struct winreg_String classname;
         struct regval_blob **values;
@@ -457 +457 @@
         }
 
-        if ((!(names = TALLOC_ARRAY(mem_ctx, char *, num_values))) ||
-            (!(values = TALLOC_ARRAY(mem_ctx, struct regval_blob *,
+        if ((!(names = talloc_array(mem_ctx, char *, num_values))) ||
+            (!(values = talloc_array(mem_ctx, struct regval_blob *,
                                      num_values)))) {
                 status = NT_STATUS_NO_MEMORY;
@@ -466 +466 @@
         for (i=0; i<num_values; i++) {
                 enum winreg_Type type = REG_NONE;
-                uint8 *data = NULL;
-                uint32 data_size;
-                uint32 value_length;
+                uint8_t *data = NULL;
+                uint32_t data_size;
+                uint32_t value_length;
 
                 char n;
@@ -479 +479 @@
 
                 data_size = max_valbufsize;
-                data = (uint8 *)TALLOC(mem_ctx, data_size);
+                data = (uint8_t *)TALLOC(mem_ctx, data_size);
                 value_length = 0;
 
@@ -510 +510 @@
                 }
 
-                assert(value_length<=data_size); //???
+                assert(value_length<=data_size); /*??? */
 
                 values[i] = regval_compose(values,
@@ -648 +648 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                 rpc_registry_setvalue_internal, argc, argv );
 }
@@ -708 +708 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                 rpc_registry_deletevalue_internal, argc, argv );
 }
@@ -836 +836 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                 rpc_registry_getvalue_full, argc, argv);
 }
@@ -864 +864 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                 rpc_registry_getvalue_raw, argc, argv);
 }
@@ -877 +877 @@
                                                 const char **argv )
 {
-        uint32 hive;
+        uint32_t hive;
         struct policy_handle hive_hnd, key_hnd;
         struct winreg_String key, keyclass;
@@ -950 +950 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                 rpc_registry_createkey_internal, argc, argv );
 }
@@ -963 +963 @@
                                                 const char **argv )
 {
-        uint32 hive;
+        uint32_t hive;
         struct policy_handle hive_hnd;
         struct winreg_String key;
@@ -1016 +1016 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                 rpc_registry_deletekey_internal, argc, argv );
 }
@@ -1035 +1035 @@
         NTSTATUS status;
         WERROR werr;
-        uint32 num_subkeys = 0;
-        uint32 num_values = 0;
+        uint32_t num_subkeys = 0;
+        uint32_t num_values = 0;
         char **names = NULL, **classes = NULL;
         NTTIME **modtimes = NULL;
-        uint32 i;
+        uint32_t i;
         struct registry_value **values = NULL;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
@@ -1096 +1096 @@
                                   const char **argv )
 {
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                 rpc_registry_enumerate_internal, argc, argv );
 }
@@ -1137 +1137 @@
         if (!NT_STATUS_IS_OK(status)) {
                 d_fprintf(stderr, _("Unable to save [%s] to %s:%s\n"), argv[0],
-                          cli->desthost, argv[1]);
+                          pipe_hnd->desthost, argv[1]);
         }
         if (!W_ERROR_IS_OK(result)) {
                 status = werror_to_ntstatus(result);
                 d_fprintf(stderr, _("Unable to save [%s] to %s:%s\n"), argv[0],
-                          cli->desthost, argv[1]);
+                          pipe_hnd->desthost, argv[1]);
         }
 
@@ -1158 +1158 @@
 static int rpc_registry_save(struct net_context *c, int argc, const char **argv )
 {
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                 rpc_registry_save_internal, argc, argv );
 }
@@ -1170 +1170 @@
         int i, j;
         const char *data_str = NULL;
-        uint32 data_size, data;
+        uint32_t data_size, data;
         DATA_BLOB blob;
 
@@ -1184 +1184 @@
                         case REG_SZ:
                                 blob = data_blob_const(nk->values[i].data, data_size);
-                                pull_reg_sz(talloc_tos(), &blob, &data_str);
+                                if (!pull_reg_sz(talloc_tos(), &blob,
+                                                 &data_str)) {
+                                        data_str = NULL;
+                                }
                                 if (!data_str) {
                                         break;
@@ -1452 +1455 @@
         }
 
-        sd = TALLOC_ZERO_P(mem_ctx, struct KeySecurityData);
+        sd = talloc_zero(mem_ctx, struct KeySecurityData);
         if (!sd) {
                 status = NT_STATUS_NO_MEMORY;
@@ -1502 +1505 @@
 static int rpc_registry_getsd(struct net_context *c, int argc, const char **argv)
 {
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                 rpc_registry_getsd_internal, argc, argv);
 }
@@ -1526 +1529 @@
 {
         NTSTATUS status;
-        uint32 num_subkeys = 0;
-        uint32 num_values = 0;
+        uint32_t num_subkeys = 0;
+        uint32_t num_values = 0;
         char **names = NULL, **classes = NULL;
         NTTIME **modtimes = NULL;
         struct regval_blob **values = NULL;
-        uint32 i;
+        uint32_t i;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 
@@ -1657 +1660 @@
                                const char **argv )
 {
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                                rpc_registry_export_internal, argc, argv );
 }
@@ -1695 +1698 @@
 
         if (parent == NULL) {
-                uint32 hive_idx = 0;
+                uint32_t hive_idx = 0;
                 if (!reg_hive_key(mem_ctx, name, &hive_idx, &keyname.name)) {
                         werr = WERR_FOOBAR;
@@ -1793 +1796 @@
 
         if (parent == NULL) {
-                uint32 hive_idx;
+                uint32_t hive_idx;
                 if (!reg_hive_key(mem_ctx, name, &hive_idx, &keyname.name)) {
                         werr = WERR_FOOBAR;
@@ -1995 +1998 @@
                                const char **argv )
 {
-        return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
                                rpc_registry_import_internal, argc, argv );
 }

vendor/current/source3/utils/net_rpc_rights.c

@@ -101 +101 @@
 {
         NTSTATUS status, result;
-        uint32 enum_context = 0;
-        uint32 pref_max_length=0x1000;
+        uint32_t enum_context = 0;
+        uint32_t pref_max_length=0x1000;
         int i;
-        uint16 lang_id=0;
-        uint16 lang_id_sys=0;
-        uint16 lang_id_desc;
+        uint16_t lang_id=0;
+        uint16_t lang_id_sys=0;
+        uint16_t lang_id_desc;
         struct lsa_StringLarge *description = NULL;
         struct lsa_PrivArray priv_array;
@@ -191 +191 @@
 
         for (i = 0; i < rights.count; i++) {
-                if (StrCaseCmp(rights.names[i].string, right) == 0) {
+                if (strcasecmp_m(rights.names[i].string, right) == 0) {
                         return NT_STATUS_OK;
                 }
@@ -242 +242 @@
 {
         NTSTATUS status, result;
-        uint32 enum_context=0;
-        uint32 pref_max_length=0x1000;
+        uint32_t enum_context=0;
+        uint32_t pref_max_length=0x1000;
         struct lsa_SidArray sid_array;
         int i;
@@ -295 +295 @@
 {
         NTSTATUS status, result;
-        uint32 enum_context=0;
-        uint32 pref_max_length=0x1000;
+        uint32_t enum_context=0;
+        uint32_t pref_max_length=0x1000;
         struct lsa_SidArray sid_array;
         int i;
@@ -353 +353 @@
         struct lsa_String lsa_name;
         struct lsa_StringLarge *description = NULL;
-        uint16 lang_id = 0;
-        uint16 lang_id_sys = 0;
-        uint16 lang_id_desc;
+        uint16_t lang_id = 0;
+        uint16_t lang_id_sys = 0;
+        uint16_t lang_id_desc;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 
@@ -507 +507 @@
 
         rights.count = argc-1;
-        rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
+        rights.names = talloc_array(mem_ctx, struct lsa_StringLarge,
                                     rights.count);
         if (!rights.names) {
@@ -580 +580 @@
 
         rights.count = argc-1;
-        rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
+        rights.names = talloc_array(mem_ctx, struct lsa_StringLarge,
                                     rights.count);
         if (!rights.names) {
@@ -631 +631 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
                 rpc_rights_list_internal, argc, argv );
 }
@@ -653 +653 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
                 rpc_rights_grant_internal, argc, argv );
 }
@@ -675 +675 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
                 rpc_rights_revoke_internal, argc, argv );
 }
@@ -752 +752 @@
         static struct rpc_sh_cmd cmds[] = {
 
-        { "list", NULL, &ndr_table_lsarpc.syntax_id, rpc_sh_rights_list,
+        { "list", NULL, &ndr_table_lsarpc, rpc_sh_rights_list,
           N_("View available or assigned privileges") },
 
-        { "grant", NULL, &ndr_table_lsarpc.syntax_id, rpc_sh_rights_grant,
+        { "grant", NULL, &ndr_table_lsarpc, rpc_sh_rights_grant,
           N_("Assign privilege[s]") },
 
-        { "revoke", NULL, &ndr_table_lsarpc.syntax_id, rpc_sh_rights_revoke,
+        { "revoke", NULL, &ndr_table_lsarpc, rpc_sh_rights_revoke,
           N_("Revoke privilege[s]") },
 

vendor/current/source3/utils/net_rpc_samsync.c

@@ -52 +52 @@
                 ZERO_STRUCT(o);
 
-                if (!StrnCaseCmp(argv[i], "user_rid=", strlen("user_rid="))) {
+                if (!strncasecmp_m(argv[i], "user_rid=", strlen("user_rid="))) {
                         o.object_identifier.rid         = get_int_param(argv[i]);
                         o.object_type                   = NETR_DELTA_USER;
                         o.database_id                   = SAM_DATABASE_DOMAIN;
                 }
-                if (!StrnCaseCmp(argv[i], "group_rid=", strlen("group_rid="))) {
+                if (!strncasecmp_m(argv[i], "group_rid=", strlen("group_rid="))) {
                         o.object_identifier.rid         = get_int_param(argv[i]);
                         o.object_type                   = NETR_DELTA_GROUP;
                         o.database_id                   = SAM_DATABASE_DOMAIN;
                 }
-                if (!StrnCaseCmp(argv[i], "group_member_rid=", strlen("group_member_rid="))) {
+                if (!strncasecmp_m(argv[i], "group_member_rid=", strlen("group_member_rid="))) {
                         o.object_identifier.rid         = get_int_param(argv[i]);
                         o.object_type                   = NETR_DELTA_GROUP_MEMBER;
                         o.database_id                   = SAM_DATABASE_DOMAIN;
                 }
-                if (!StrnCaseCmp(argv[i], "alias_rid=", strlen("alias_rid="))) {
+                if (!strncasecmp_m(argv[i], "alias_rid=", strlen("alias_rid="))) {
                         o.object_identifier.rid         = get_int_param(argv[i]);
                         o.object_type                   = NETR_DELTA_ALIAS;
                         o.database_id                   = SAM_DATABASE_BUILTIN;
                 }
-                if (!StrnCaseCmp(argv[i], "alias_member_rid=", strlen("alias_member_rid="))) {
+                if (!strncasecmp_m(argv[i], "alias_member_rid=", strlen("alias_member_rid="))) {
                         o.object_identifier.rid         = get_int_param(argv[i]);
                         o.object_type                   = NETR_DELTA_ALIAS_MEMBER;
                         o.database_id                   = SAM_DATABASE_BUILTIN;
                 }
-                if (!StrnCaseCmp(argv[i], "account_sid=", strlen("account_sid="))) {
+                if (!strncasecmp_m(argv[i], "account_sid=", strlen("account_sid="))) {
                         const char *sid_str = get_string_param(argv[i]);
                         string_to_sid(&o.object_identifier.sid, sid_str);
@@ -83 +83 @@
                         o.database_id                   = SAM_DATABASE_PRIVS;
                 }
-                if (!StrnCaseCmp(argv[i], "policy_sid=", strlen("policy_sid="))) {
+                if (!strncasecmp_m(argv[i], "policy_sid=", strlen("policy_sid="))) {
                         const char *sid_str = get_string_param(argv[i]);
                         string_to_sid(&o.object_identifier.sid, sid_str);
@@ -89 +89 @@
                         o.database_id                   = SAM_DATABASE_PRIVS;
                 }
-                if (!StrnCaseCmp(argv[i], "trustdom_sid=", strlen("trustdom_sid="))) {
+                if (!strncasecmp_m(argv[i], "trustdom_sid=", strlen("trustdom_sid="))) {
                         const char *sid_str = get_string_param(argv[i]);
                         string_to_sid(&o.object_identifier.sid, sid_str);
@@ -95 +95 @@
                         o.database_id                   = SAM_DATABASE_PRIVS;
                 }
-                if (!StrnCaseCmp(argv[i], "secret_name=", strlen("secret_name="))) {
+                if (!strncasecmp_m(argv[i], "secret_name=", strlen("secret_name="))) {
                         o.object_identifier.name        = get_string_param(argv[i]);
                         o.object_type                   = NETR_DELTA_SECRET;
@@ -130 +130 @@
         ctx->mode               = NET_SAMSYNC_MODE_DUMP;
         ctx->cli                = pipe_hnd;
+        ctx->netlogon_creds     = c->netlogon_creds;
         ctx->ops                = &libnet_samsync_display_ops;
         ctx->domain_name        = domain_name;
@@ -336 +337 @@
         if (!dc_info.is_ad) {
                 printf(_("DC is not running Active Directory\n"));
-                ret = run_rpc_command(c, cli, &ndr_table_netlogon.syntax_id,
+                ret = run_rpc_command(c, cli, &ndr_table_netlogon,
                                       0,
                                       rpc_vampire_internals, argc, argv);
@@ -351 +352 @@
         }
 
-        ret = run_rpc_command(c, cli, &ndr_table_drsuapi.syntax_id,
+        ret = run_rpc_command(c, cli, &ndr_table_drsuapi,
                               NET_FLAGS_SEAL | NET_FLAGS_TCP,
                               rpc_vampire_ds_internals, argc, argv);
@@ -357 +358 @@
                 printf(_("Fallback to NT4 vampire on Mixed-Mode AD "
                          "Domain\n"));
-                ret = run_rpc_command(c, cli, &ndr_table_netlogon.syntax_id,
+                ret = run_rpc_command(c, cli, &ndr_table_netlogon,
                                       0,
                                       rpc_vampire_internals, argc, argv);
@@ -445 +446 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_netlogon, 0,
                                rpc_vampire_ldif_internals, argc, argv);
 }
@@ -602 +603 @@
         if (!dc_info.is_ad) {
                 printf(_("DC is not running Active Directory\n"));
-                ret = run_rpc_command(c, cli, &ndr_table_netlogon.syntax_id,
+                ret = run_rpc_command(c, cli, &ndr_table_netlogon,
                                       0,
                                       rpc_vampire_keytab_internals, argc, argv);
         } else {
-                ret = run_rpc_command(c, cli, &ndr_table_drsuapi.syntax_id,
+                ret = run_rpc_command(c, cli, &ndr_table_drsuapi,
                                       NET_FLAGS_SEAL | NET_FLAGS_TCP,
                                       rpc_vampire_keytab_ds_internals, argc, argv);
@@ -612 +613 @@
                         printf(_("Fallback to NT4 vampire on Mixed-Mode AD "
                                  "Domain\n"));
-                        ret = run_rpc_command(c, cli, &ndr_table_netlogon.syntax_id,
+                        ret = run_rpc_command(c, cli, &ndr_table_netlogon,
                                               0,
                                               rpc_vampire_keytab_internals, argc, argv);
+                } else {
+#ifndef HAVE_ADS
+                        printf(_("Vampire requested against AD DC but ADS"
+                                " support not built in: HAVE_ADS is not defined\n"));
+#endif
                 }
         }

vendor/current/source3/utils/net_rpc_service.c

@@ -24 +24 @@
 
 struct svc_state_msg {
-        uint32 flag;
+        uint32_t flag;
         const char *message;
 };
@@ -42 +42 @@
 /********************************************************************
 ********************************************************************/
-const char *svc_status_string( uint32 state )
+const char *svc_status_string( uint32_t state )
 {
         fstring msg;
@@ -135 +135 @@
                                 struct policy_handle *hSCM,
                                 const char *service,
-                                uint32 *state )
+                                uint32_t *state )
 {
         struct policy_handle hService;
@@ -182 +182 @@
                                 struct policy_handle *hSCM,
                                 const char *service,
-                                uint32 watch_state,
-                                uint32 *final_state )
-{
-        uint32 i;
-        uint32 state = 0;
+                                uint32_t watch_state,
+                                uint32_t *final_state )
+{
+        uint32_t i;
+        uint32_t state = 0;
         WERROR result = WERR_GENERAL_FAILURE;
 
@@ -201 +201 @@
                 d_printf(".");
                 i++;
-                sys_usleep( 100 );
+                usleep( 100 );
         }
         d_printf("\n");
@@ -217 +217 @@
                                 struct policy_handle *hSCM,
                                 const char *service,
-                                uint32 control,
-                                uint32 watch_state )
+                                uint32_t control,
+                                uint32_t watch_state )
 {
         struct policy_handle hService;
@@ -224 +224 @@
         NTSTATUS status;
         struct SERVICE_STATUS service_status;
-        uint32 state = 0;
+        uint32_t state = 0;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 
@@ -290 +290 @@
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 
-        uint8_t *buffer = NULL;
+        uint8_t *buffer;
         uint32_t buf_size = 0;
         uint32_t bytes_needed = 0;
@@ -306 +306 @@
         if (!W_ERROR_IS_OK(result)) {
                 return werror_to_ntstatus(result);
+        }
+
+        buffer = talloc_array(mem_ctx, uint8_t, buf_size);
+        if (buffer == NULL) {
+                status = NT_STATUS_NO_MEMORY;
+                goto done;
         }
 
@@ -328 +334 @@
 
                 if (W_ERROR_EQUAL(result, WERR_MORE_DATA) && bytes_needed > 0) {
-                        buffer = talloc_array(mem_ctx, uint8_t, bytes_needed);
                         buf_size = bytes_needed;
+                        buffer = talloc_realloc(mem_ctx, buffer, uint8_t, bytes_needed);
+                        if (buffer == NULL) {
+                                status = NT_STATUS_NO_MEMORY;
+                                break;
+                        }
                         continue;
                 }
@@ -382 +392 @@
         } while (W_ERROR_EQUAL(result, WERR_MORE_DATA));
 
+done:
         if (is_valid_policy_hnd(&hSCM)) {
                 WERROR _result;
@@ -674 +685 @@
         WERROR result = WERR_GENERAL_FAILURE;
         NTSTATUS status;
-        uint32 state = 0;
+        uint32_t state = 0;
         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 
@@ -919 +930 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_svcctl.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_svcctl, 0,
                 rpc_service_list_internal, argc, argv );
 }
@@ -937 +948 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_svcctl.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_svcctl, 0,
                 rpc_service_start_internal, argc, argv );
 }
@@ -955 +966 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_svcctl.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_svcctl, 0,
                 rpc_service_stop_internal, argc, argv );
 }
@@ -973 +984 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_svcctl.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_svcctl, 0,
                 rpc_service_resume_internal, argc, argv );
 }
@@ -991 +1002 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_svcctl.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_svcctl, 0,
                 rpc_service_pause_internal, argc, argv );
 }
@@ -1009 +1020 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_svcctl.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_svcctl, 0,
                 rpc_service_status_internal, argc, argv );
 }
@@ -1027 +1038 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_svcctl.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_svcctl, 0,
                 rpc_service_delete_internal, argc, argv);
 }
@@ -1045 +1056 @@
         }
 
-        return run_rpc_command(c, NULL, &ndr_table_svcctl.syntax_id, 0,
+        return run_rpc_command(c, NULL, &ndr_table_svcctl, 0,
                 rpc_service_create_internal, argc, argv);
 }

vendor/current/source3/utils/net_rpc_sh_acct.c

@@ -466 +466 @@
 {
         static struct rpc_sh_cmd cmds[9] = {
-                { "show", NULL, &ndr_table_samr.syntax_id, rpc_sh_acct_pol_show,
+                { "show", NULL, &ndr_table_samr, rpc_sh_acct_pol_show,
                   N_("Show current account policy settings") },
-                { "badpw", NULL, &ndr_table_samr.syntax_id, rpc_sh_acct_set_badpw,
+                { "badpw", NULL, &ndr_table_samr, rpc_sh_acct_set_badpw,
                   N_("Set bad password count before lockout") },
-                { "lockduration", NULL, &ndr_table_samr.syntax_id, rpc_sh_acct_set_lockduration,
+                { "lockduration", NULL, &ndr_table_samr, rpc_sh_acct_set_lockduration,
                   N_("Set account lockout duration") },
-                { "resetduration", NULL, &ndr_table_samr.syntax_id,
+                { "resetduration", NULL, &ndr_table_samr,
                   rpc_sh_acct_set_resetduration,
                   N_("Set bad password count reset duration") },
-                { "minpwage", NULL, &ndr_table_samr.syntax_id, rpc_sh_acct_set_minpwage,
+                { "minpwage", NULL, &ndr_table_samr, rpc_sh_acct_set_minpwage,
                   N_("Set minimum password age") },
-                { "maxpwage", NULL, &ndr_table_samr.syntax_id, rpc_sh_acct_set_maxpwage,
+                { "maxpwage", NULL, &ndr_table_samr, rpc_sh_acct_set_maxpwage,
                   N_("Set maximum password age") },
-                { "minpwlen", NULL, &ndr_table_samr.syntax_id, rpc_sh_acct_set_minpwlen,
+                { "minpwlen", NULL, &ndr_table_samr, rpc_sh_acct_set_minpwlen,
                   N_("Set minimum password length") },
-                { "pwhistlen", NULL, &ndr_table_samr.syntax_id, rpc_sh_acct_set_pwhistlen,
+                { "pwhistlen", NULL, &ndr_table_samr, rpc_sh_acct_set_pwhistlen,
                   N_("Set the password history length") },
                 { NULL, NULL, 0, NULL, NULL }

vendor/current/source3/utils/net_rpc_shell.c

@@ -86 +86 @@
         }
 
-        status = cli_rpc_pipe_open_noauth(ctx->cli, cmd->interface,
+        status = cli_rpc_pipe_open_noauth(ctx->cli, cmd->table,
                                           &pipe_hnd);
         if (!NT_STATUS_IS_OK(status)) {
@@ -155 +155 @@
         }
 
-        new_ctx = TALLOC_P(ctx, struct rpc_sh_ctx);
+        new_ctx = talloc(ctx, struct rpc_sh_ctx);
         if (new_ctx == NULL) {
                 d_fprintf(stderr, _("talloc failed\n"));
@@ -198 +198 @@
 static struct rpc_sh_cmd sh_cmds[6] = {
 
-        { "info", NULL, &ndr_table_samr.syntax_id, rpc_sh_info,
+        { "info", NULL, &ndr_table_samr, rpc_sh_info,
           N_("Print information about the domain connected to") },
 
@@ -235 +235 @@
         }
 
-        ctx = TALLOC_P(NULL, struct rpc_sh_ctx);
+        ctx = talloc(NULL, struct rpc_sh_ctx);
         if (ctx == NULL) {
                 d_fprintf(stderr, _("talloc failed\n"));

vendor/current/source3/utils/net_rpc_trust.c

@@ -129 +129 @@
         r.in.policy_handle = pol_hnd;
         r.in.info = &trustinfo;
-        r.in.auth_info = authinfo;
+        r.in.auth_info_internal = authinfo;
         r.in.access_mask = LSA_TRUSTED_SET_POSIX | LSA_TRUSTED_SET_AUTH |
                            LSA_TRUSTED_QUERY_DOMAIN_NAME;
@@ -197 +197 @@
                                      struct rpc_pipe_client **pipe_hnd,
                                      struct policy_handle *pol_hnd,
-                                     struct dom_data *dom_data)
+                                     struct dom_data *dom_data,
+                                     DATA_BLOB *session_key)
 {
         NTSTATUS status;
@@ -210 +211 @@
         }
 
-        status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id, pipe_hnd);
+        status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc, pipe_hnd);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0, ("Failed to initialise lsa pipe with error [%s]\n",
@@ -245 +246 @@
         }
 
+        status = cli_get_session_key(mem_ctx, *pipe_hnd, session_key);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("Error getting session_key of LSA pipe. Error was %s\n",
+                        nt_errstr(status)));
+                return status;
+        }
+
         return NT_STATUS_OK;
 }
@@ -270 +278 @@
                                   strlen(password),
                                   &auth_info_array[0].AuthInfo.clear.password,
-                                  &converted_size, true)) {
+                                  &converted_size)) {
                 return false;
         }
@@ -413 +421 @@
         struct cli_state *cli[2] = {NULL, NULL};
         struct rpc_pipe_client *pipe_hnd[2] = {NULL, NULL};
+        DATA_BLOB session_key[2];
         struct policy_handle pol_hnd[2];
         struct lsa_TrustDomainInfoAuthInfoInternal authinfo;
@@ -421 +430 @@
         struct dom_data dom_data[2];
         void (*usage)(void);
+
+        ZERO_STRUCT(session_key);
 
         switch (op) {
@@ -481 +492 @@
 
         status = connect_and_get_info(mem_ctx, net_ctx, &cli[0], &pipe_hnd[0],
-                                      &pol_hnd[0], &dom_data[0]);
+                                      &pol_hnd[0], &dom_data[0], &session_key[0]);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0, ("connect_and_get_info failed with error [%s]\n",
@@ -491 +502 @@
                 status = connect_and_get_info(mem_ctx, other_net_ctx,
                                               &cli[1], &pipe_hnd[1],
-                                              &pol_hnd[1], &dom_data[1]);
+                                              &pol_hnd[1], &dom_data[1],
+                                              &session_key[1]);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(0, ("connect_and_get_info failed with error [%s]\n",
@@ -507 +519 @@
 
                         DEBUG(0, ("Using random trust password.\n"));
-        /* FIXME: why only 8 characters work? Would it be possible to use a
-         * random binary password? */
-                        trust_pw = generate_random_str(mem_ctx, 8);
+                        trust_pw = generate_random_password(mem_ctx,
+                                        DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
+                                        DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
                         if (trust_pw == NULL) {
-                                DEBUG(0, ("generate_random_str failed.\n"));
+                                DEBUG(0, ("generate_random_password failed.\n"));
                                 goto done;
                         }
@@ -535 +547 @@
                 arcfour_crypt_blob(authinfo.auth_blob.data,
                                    authinfo.auth_blob.size,
-                                   &cli[0]->user_session_key);
+                                   &session_key[0]);
 
                 status = create_trust(mem_ctx, pipe_hnd[0]->binding_handle,
@@ -562 +574 @@
                         arcfour_crypt_blob(authinfo.auth_blob.data,
                                            authinfo.auth_blob.size,
-                                           &cli[1]->user_session_key);
+                                           &session_key[1]);
 
                         status = create_trust(mem_ctx,
@@ -618 +630 @@
 
 done:
+        data_blob_clear_free(&session_key[0]);
+        data_blob_clear_free(&session_key[1]);
         cli_shutdown(cli[0]);
         cli_shutdown(cli[1]);

vendor/current/source3/utils/net_sam.c

@@ -27 +27 @@
 #include "lib/winbind_util.h"
 #include "passdb.h"
+#include "passdb/pdb_ldap_util.h"
+#include "passdb/pdb_ldap_schema.h"
 #include "lib/privileges.h"
+#include "secrets.h"
+#include "idmap.h"
 
 /*
@@ -139 +143 @@
 static int net_sam_set_userflag(struct net_context *c, int argc,
                                 const char **argv, const char *field,
-                                uint16 flag)
+                                uint16_t flag)
 {
         struct samu *sam_acct = NULL;
@@ -300 +304 @@
                                const char **argv)
 {
-        GROUP_MAP map;
+        GROUP_MAP *map;
         struct dom_sid sid;
         enum lsa_SidType type;
@@ -331 +335 @@
         }
 
-        if (!pdb_getgrsid(&map, sid)) {
+        map = talloc_zero(talloc_tos(), GROUP_MAP);
+        if (!map) {
+                d_fprintf(stderr, _("Out of memory!\n"));
+                return -1;
+        }
+
+        if (!pdb_getgrsid(map, sid)) {
                 d_fprintf(stderr, _("Could not load group %s\n"), argv[0]);
                 return -1;
         }
 
-        fstrcpy(map.comment, argv[1]);
-
-        status = pdb_update_group_mapping_entry(&map);
+        map->comment = talloc_strdup(map, argv[1]);
+        if (!map->comment) {
+                d_fprintf(stderr, _("Out of memory!\n"));
+                return -1;
+        }
+
+        status = pdb_update_group_mapping_entry(map);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -349 +363 @@
                  argv[1]);
 
+        TALLOC_FREE(map);
         return 0;
 }
@@ -466 +481 @@
 {
         const char *account_policy = NULL;
-        uint32 value = 0;
-        uint32 old_value = 0;
+        uint32_t value = 0;
+        uint32_t old_value = 0;
         enum pdb_policy_type field;
         char *endptr;
@@ -500 +515 @@
                 int i, count;
 
-                account_policy_names_list(&names, &count);
+                account_policy_names_list(talloc_tos(), &names, &count);
                 d_fprintf(stderr, _("No account policy \"%s\"!\n\n"), argv[0]);
                 d_fprintf(stderr, _("Valid account policies are:\n"));
@@ -508 +523 @@
                 }
 
-                SAFE_FREE(names);
+                TALLOC_FREE(names);
+
                 return -1;
         }
@@ -535 +551 @@
 {
         const char *account_policy = NULL;
-        uint32 old_value;
+        uint32_t old_value;
         enum pdb_policy_type field;
 
@@ -552 +568 @@
                 int count;
                 int i;
-                account_policy_names_list(&names, &count);
+                account_policy_names_list(talloc_tos(), &names, &count);
                 d_fprintf(stderr, _("No account policy by that name!\n"));
                 if (count != 0) {
@@ -561 +577 @@
                         }
                 }
-                SAFE_FREE(names);
+                TALLOC_FREE(names);
                 return -1;
         }
@@ -593 +609 @@
         }
 
-        account_policy_names_list(&names, &count);
+        account_policy_names_list(talloc_tos(), &names, &count);
         if (count != 0) {
                 d_fprintf(stderr, _("Valid account policies "
@@ -601 +617 @@
                 }
         }
-        SAFE_FREE(names);
+        TALLOC_FREE(names);
         return -1;
 }
@@ -807 +823 @@
  */
 
-static NTSTATUS map_unix_group(const struct group *grp, GROUP_MAP *pmap)
-{
-        NTSTATUS status;
-        GROUP_MAP map;
-        const char *grpname, *dom, *name;
-        uint32 rid;
-
-        if (pdb_getgrgid(&map, grp->gr_gid)) {
+static NTSTATUS map_unix_group(const struct group *grp, GROUP_MAP *map)
+{
+        const char *dom, *name;
+        uint32_t rid;
+
+        if (pdb_getgrgid(map, grp->gr_gid)) {
                 return NT_STATUS_GROUP_EXISTS;
         }
 
-        map.gid = grp->gr_gid;
-        grpname = grp->gr_name;
-
-        if (lookup_name(talloc_tos(), grpname, LOOKUP_NAME_LOCAL,
+        map->gid = grp->gr_gid;
+
+        if (lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
                         &dom, &name, NULL, NULL)) {
 
-                const char *tmp = talloc_asprintf(
-                        talloc_tos(), "Unix Group %s", grp->gr_name);
+                map->nt_name = talloc_asprintf(map, "Unix Group %s",
+                                                        grp->gr_name);
 
                 DEBUG(5, ("%s exists as %s\\%s, retrying as \"%s\"\n",
-                          grpname, dom, name, tmp));
-                grpname = tmp;
-        }
-
-        if (lookup_name(talloc_tos(), grpname, LOOKUP_NAME_LOCAL,
+                          grp->gr_name, dom, name, map->nt_name));
+        }
+
+        if (lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
                         NULL, NULL, NULL, NULL)) {
                 DEBUG(3, ("\"%s\" exists, can't map it\n", grp->gr_name));
                 return NT_STATUS_GROUP_EXISTS;
         }
-
-        fstrcpy(map.nt_name, grpname);
 
         if (pdb_capabilities() & PDB_CAP_STORE_RIDS) {
@@ -850 +860 @@
         }
 
-        sid_compose(&map.sid, get_global_sam_sid(), rid);
-        map.sid_name_use = SID_NAME_DOM_GRP;
-        fstrcpy(map.comment, talloc_asprintf(talloc_tos(), "Unix Group %s",
-                                             grp->gr_name));
-
-        status = pdb_add_group_mapping_entry(&map);
-        if (NT_STATUS_IS_OK(status)) {
-                *pmap = map;
-        }
-        return status;
+        sid_compose(&map->sid, get_global_sam_sid(), rid);
+        map->sid_name_use = SID_NAME_DOM_GRP;
+        map->comment = talloc_asprintf(map, "Unix Group %s", grp->gr_name);
+
+        return pdb_add_group_mapping_entry(map);
 }
 
@@ -865 +870 @@
 {
         NTSTATUS status;
-        GROUP_MAP map;
+        GROUP_MAP *map;
         struct group *grp;
 
@@ -881 +886 @@
         }
 
-        status = map_unix_group(grp, &map);
+        map = talloc_zero(talloc_tos(), GROUP_MAP);
+        if (!map) {
+                d_fprintf(stderr, _("Out of memory!\n"));
+                return -1;
+        }
+
+        status = map_unix_group(grp, map);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -890 +901 @@
 
         d_printf(_("Mapped unix group %s to SID %s\n"), argv[0],
-                 sid_string_tos(&map.sid));
-
+                 sid_string_tos(&map->sid));
+
+        TALLOC_FREE(map);
         return 0;
 }
@@ -899 +911 @@
  */
 
-static NTSTATUS unmap_unix_group(const struct group *grp, GROUP_MAP *pmap)
-{
-        GROUP_MAP map;
-        const char *grpname;
+static NTSTATUS unmap_unix_group(const struct group *grp)
+{
         struct dom_sid dom_sid;
-
-        map.gid = grp->gr_gid;
-        grpname = grp->gr_name;
-
-        if (!lookup_name(talloc_tos(), grpname, LOOKUP_NAME_LOCAL,
+        struct unixid id;
+
+        if (!lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
                         NULL, NULL, NULL, NULL)) {
                 DEBUG(3, ("\"%s\" does not exist, can't unmap it\n", grp->gr_name));
@@ -914 +922 @@
         }
 
-        fstrcpy(map.nt_name, grpname);
-
-        if (!pdb_gid_to_sid(map.gid, &dom_sid)) {
+        id.id = grp->gr_gid;
+        id.type = ID_TYPE_GID;
+        if (!pdb_id_to_sid(&id, &dom_sid)) {
                 return NT_STATUS_UNSUCCESSFUL;
         }
@@ -926 +934 @@
 {
         NTSTATUS status;
-        GROUP_MAP map;
         struct group *grp;
 
@@ -943 +950 @@
         }
 
-        status = unmap_unix_group(grp, &map);
+        status = unmap_unix_group(grp);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -964 +971 @@
 {
         NTSTATUS status;
-        uint32 rid;
+        uint32_t rid;
 
         if (argc != 1 || c->display_usage) {
@@ -1040 +1047 @@
 {
         NTSTATUS status;
-        uint32 rid;
+        uint32_t rid;
 
         if (argc != 1 || c->display_usage) {
@@ -1118 +1125 @@
 {
         NTSTATUS status;
-        uint32 rid;
+        uint32_t rid;
         enum lsa_SidType type;
         fstring groupname;
@@ -1153 +1160 @@
         }
 
-        status = pdb_create_builtin_alias( rid );
+        status = pdb_create_builtin(rid);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -1214 +1221 @@
         if ((grouptype == SID_NAME_ALIAS) || (grouptype == SID_NAME_WKN_GRP)) {
                 if ((membertype != SID_NAME_USER) &&
+                    (membertype != SID_NAME_ALIAS) &&
                     (membertype != SID_NAME_DOM_GRP)) {
-                        d_fprintf(stderr, _("%s is a local group, only users "
-                                  "and domain groups can be added.\n"
-                                  "%s is a %s\n"), argv[0], argv[1],
+                        d_fprintf(stderr, _("Can't add %s: only users, domain "
+                                            "groups and domain local groups "
+                                            "can be added. %s is a %s\n"),
+                                  argv[0], argv[1],
                                   sid_type_lookup(membertype));
                         return -1;
@@ -1582 +1591 @@
         char *ldap_uri = NULL;
         char *p;
-        struct smbldap_state *ls;
-        GROUP_MAP gmap;
+        struct smbldap_state *state = NULL;
+        GROUP_MAP *gmap = NULL;
         struct dom_sid gsid;
         gid_t domusers_gid = -1;
@@ -1590 +1599 @@
         struct passwd *pwd;
         bool is_ipa = false;
+        char *bind_dn = NULL;
+        char *bind_secret = NULL;
+        NTSTATUS status;
 
         if (c->display_usage) {
@@ -1644 +1656 @@
         }
 
-        if (!NT_STATUS_IS_OK(smbldap_init(tc, NULL, ldap_uri, &ls))) {
+        if (!fetch_ldap_pw(&bind_dn, &bind_secret)) {
+                d_fprintf(stderr, _("Failed to retrieve LDAP password from secrets.tdb\n"));
+                goto failed;
+        }
+
+        status = smbldap_init(tc, NULL, ldap_uri, false, bind_dn, bind_secret, &state);
+
+        memset(bind_secret, '\0', strlen(bind_secret));
+        SAFE_FREE(bind_secret);
+        SAFE_FREE(bind_dn);
+
+        if (!NT_STATUS_IS_OK(status)) {
                 d_fprintf(stderr, _("Unable to connect to the LDAP server.\n"));
                 goto failed;
@@ -1653 +1676 @@
         sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_USERS);
 
-        if (!pdb_getgrsid(&gmap, gsid)) {
+        gmap = talloc_zero(tc, GROUP_MAP);
+        if (!gmap) {
+                d_printf(_("Out of memory!\n"));
+                goto failed;
+        }
+
+        if (!pdb_getgrsid(gmap, gsid)) {
                 LDAPMod **mods = NULL;
                 char *dn;
@@ -1677 +1706 @@
                 uname = talloc_strdup(tc, "domusers");
                 wname = talloc_strdup(tc, "Domain Users");
-                dn = talloc_asprintf(tc, "cn=%s,%s", "domusers", lp_ldap_group_suffix());
+                dn = talloc_asprintf(tc, "cn=%s,%s", "domusers",
+                                     lp_ldap_group_suffix(talloc_tos()));
                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domusers_gid);
                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
@@ -1700 +1730 @@
                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
 
-                talloc_autofree_ldapmod(tc, mods);
-
-                rc = smbldap_add(ls, dn, mods);
+                smbldap_talloc_autofree_ldapmod(tc, mods);
+
+                rc = smbldap_add(state, dn, mods);
 
                 if (rc != LDAP_SUCCESS) {
@@ -1710 +1740 @@
 
                 if (is_ipa) {
-                        if (!pdb_getgrsid(&gmap, gsid)) {
+                        if (!pdb_getgrsid(gmap, gsid)) {
                                 d_fprintf(stderr, _("Failed to read just "
                                                     "created domain group.\n"));
                                 goto failed;
                         } else {
-                                domusers_gid = gmap.gid;
+                                domusers_gid = gmap->gid;
                         }
                 }
         } else {
-                domusers_gid = gmap.gid;
+                domusers_gid = gmap->gid;
                 d_printf(_("found!\n"));
         }
@@ -1729 +1759 @@
         sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_ADMINS);
 
-        if (!pdb_getgrsid(&gmap, gsid)) {
+        if (!pdb_getgrsid(gmap, gsid)) {
                 LDAPMod **mods = NULL;
                 char *dn;
@@ -1753 +1783 @@
                 uname = talloc_strdup(tc, "domadmins");
                 wname = talloc_strdup(tc, "Domain Admins");
-                dn = talloc_asprintf(tc, "cn=%s,%s", "domadmins", lp_ldap_group_suffix());
+                dn = talloc_asprintf(tc, "cn=%s,%s", "domadmins",
+                                     lp_ldap_group_suffix(talloc_tos()));
                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
@@ -1776 +1807 @@
                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
 
-                talloc_autofree_ldapmod(tc, mods);
-
-                rc = smbldap_add(ls, dn, mods);
+                smbldap_talloc_autofree_ldapmod(tc, mods);
+
+                rc = smbldap_add(state, dn, mods);
 
                 if (rc != LDAP_SUCCESS) {
@@ -1786 +1817 @@
 
                 if (is_ipa) {
-                        if (!pdb_getgrsid(&gmap, gsid)) {
+                        if (!pdb_getgrsid(gmap, gsid)) {
                                 d_fprintf(stderr, _("Failed to read just "
                                                     "created domain group.\n"));
                                 goto failed;
                         } else {
-                                domadmins_gid = gmap.gid;
+                                domadmins_gid = gmap->gid;
                         }
                 }
         } else {
-                domadmins_gid = gmap.gid;
+                domadmins_gid = gmap->gid;
                 d_printf(_("found!\n"));
         }
@@ -1843 +1874 @@
 
                 name = talloc_strdup(tc, "Administrator");
-                dn = talloc_asprintf(tc, "uid=Administrator,%s", lp_ldap_user_suffix());
+                dn = talloc_asprintf(tc, "uid=Administrator,%s",
+                                     lp_ldap_user_suffix(talloc_tos()));
                 uidstr = talloc_asprintf(tc, "%u", (unsigned int)uid);
                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
                 dir = talloc_sub_specified(tc, lp_template_homedir(),
                                                 "Administrator",
+                                                NULL,
                                                 get_global_sam_name(),
                                                 uid, domadmins_gid);
                 shell = talloc_sub_specified(tc, lp_template_shell(),
                                                 "Administrator",
+                                                NULL,
                                                 get_global_sam_name(),
                                                 uid, domadmins_gid);
@@ -1861 +1895 @@
 
                 sid_compose(&sid, get_global_sam_sid(), DOMAIN_RID_ADMINISTRATOR);
-
-                if (!winbind_allocate_uid(&uid)) {
-                        d_fprintf(stderr,
-                                  _("Unable to allocate a new uid to create "
-                                    "the Administrator user!\n"));
-                        goto done;
-                }
 
                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
@@ -1900 +1927 @@
                                 NEW_PW_FORMAT_SPACE_PADDED_LEN));
 
-                talloc_autofree_ldapmod(tc, mods);
-
-                rc = smbldap_add(ls, dn, mods);
+                smbldap_talloc_autofree_ldapmod(tc, mods);
+
+                rc = smbldap_add(state, dn, mods);
 
                 if (rc != LDAP_SUCCESS) {
@@ -1928 +1955 @@
         }
 
-        if (!pdb_getsampwnam(samuser, lp_guestaccount())) {
+        if (!pdb_getsampwnam(samuser, lp_guest_account())) {
                 LDAPMod **mods = NULL;
                 struct dom_sid sid;
@@ -1940 +1967 @@
                 sid_compose(&sid, get_global_sam_sid(), DOMAIN_RID_GUEST);
 
-                pwd = Get_Pwnam_alloc(tc, lp_guestaccount());
+                pwd = Get_Pwnam_alloc(tc, lp_guest_account());
 
                 if (!pwd) {
@@ -1953 +1980 @@
                                 goto done;
                         }
-                        pwd->pw_name = talloc_strdup(pwd, lp_guestaccount());
+                        pwd->pw_name = talloc_strdup(pwd, lp_guest_account());
 
                         if (is_ipa) {
@@ -1974 +2001 @@
                 }
 
-                dn = talloc_asprintf(tc, "uid=%s,%s", pwd->pw_name, lp_ldap_user_suffix ());
+                dn = talloc_asprintf(tc, "uid=%s,%s", pwd->pw_name,
+                                     lp_ldap_user_suffix (talloc_tos()));
                 uidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_uid);
                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
@@ -2011 +2039 @@
                                 NEW_PW_FORMAT_SPACE_PADDED_LEN));
 
-                talloc_autofree_ldapmod(tc, mods);
-
-                rc = smbldap_add(ls, dn, mods);
+                smbldap_talloc_autofree_ldapmod(tc, mods);
+
+                rc = smbldap_add(state, dn, mods);
 
                 if (rc != LDAP_SUCCESS) {
@@ -2021 +2049 @@
 
                 if (is_ipa) {
-                        if (!pdb_getsampwnam(samuser, lp_guestaccount())) {
+                        if (!pdb_getsampwnam(samuser, lp_guest_account())) {
                                 d_fprintf(stderr, _("Failed to read just "
                                                     "created user.\n"));
@@ -2033 +2061 @@
         d_printf(_("Checking Guest's group.\n"));
 
-        pwd = Get_Pwnam_alloc(tc, lp_guestaccount());
+        pwd = Get_Pwnam_alloc(tc, lp_guest_account());
         if (!pwd) {
                 d_fprintf(stderr,
@@ -2046 +2074 @@
         }
 
-        if (!pdb_getgrgid(&gmap, pwd->pw_gid)) {
+        if (!pdb_getgrgid(gmap, pwd->pw_gid)) {
                 LDAPMod **mods = NULL;
                 char *dn;
@@ -2059 +2087 @@
                 uname = talloc_strdup(tc, "domguests");
                 wname = talloc_strdup(tc, "Domain Guests");
-                dn = talloc_asprintf(tc, "cn=%s,%s", "domguests", lp_ldap_group_suffix());
+                dn = talloc_asprintf(tc, "cn=%s,%s", "domguests",
+                                     lp_ldap_group_suffix(talloc_tos()));
                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
@@ -2084 +2113 @@
                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
 
-                talloc_autofree_ldapmod(tc, mods);
-
-                rc = smbldap_add(ls, dn, mods);
+                smbldap_talloc_autofree_ldapmod(tc, mods);
+
+                rc = smbldap_add(state, dn, mods);
 
                 if (rc != LDAP_SUCCESS) {
@@ -2099 +2128 @@
 
 done:
-        talloc_free(tc);
+        talloc_free(state);
         return 0;
 
 failed:
-        talloc_free(tc);
+        talloc_free(state);
         return -1;
 }

vendor/current/source3/utils/net_serverid.c

@@ -20 +20 @@
 #include "includes.h"
 #include "utils/net.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_rbt.h"
 #include "serverid.h"
 #include "session.h"
+#include "lib/conn_tdb.h"
+#include "smbd/globals.h"
+#include "util_tdb.h"
+#include "librpc/gen_ndr/ndr_open_files.h"
 
 static int net_serverid_list_fn(const struct server_id *id,
                                 uint32_t msg_flags, void *priv)
 {
-        char *str = procid_str(talloc_tos(), id);
-        d_printf("%s %llu 0x%x\n", str, (unsigned long long)id->unique_id,
+        struct server_id_buf idbuf;
+        d_printf("%s %llu 0x%x\n", server_id_str_buf(*id, &idbuf),
+                 (unsigned long long)id->unique_id,
                  (unsigned int)msg_flags);
-        TALLOC_FREE(str);
         return 0;
 }
@@ -37 +42 @@
                              const char **argv)
 {
-        if (!serverid_init_readonly(c)) {
-                d_printf("failed to open serverid.tdb\n");
-                return -1;
-        }
         d_printf("pid unique_id msg_flags\n");
         return serverid_traverse_read(net_serverid_list_fn, NULL) ? 0 : -1;
@@ -51 +52 @@
         NTSTATUS status;
 
-        if (id->vnn != get_my_vnn()) {
+        if (!procid_is_local(id)) {
                 return 0;
         }
-        status = rec->delete_rec(rec);
-        if (!NT_STATUS_IS_OK(status)) {
-                char *str = procid_str(talloc_tos(), id);
+        status = dbwrap_record_delete(rec);
+        if (!NT_STATUS_IS_OK(status)) {
+                struct server_id_buf idbuf;
                 DEBUG(1, ("Could not delete serverid.tdb record %s: %s\n",
-                          str, nt_errstr(status)));
-                TALLOC_FREE(str);
+                          server_id_str_buf(*id, &idbuf), nt_errstr(status)));
         }
         return 0;
@@ -70 +70 @@
 }
 
-static int net_serverid_wipedbs_conn(
-        struct db_record *rec,
-        const struct connections_key *key,
-        const struct connections_data *data,
-        void *private_data)
-{
-        if (!serverid_exists(&key->pid)) {
-                NTSTATUS status;
-
-                DEBUG(10, ("Deleting connections.tdb record for pid %s\n",
-                           procid_str(talloc_tos(), &key->pid)));
-
-                status = rec->delete_rec(rec);
+
+struct wipedbs_record_marker {
+        struct wipedbs_record_marker *prev, *next;
+        TDB_DATA key, val;
+        const char *desc;
+};
+
+struct wipedbs_server_data {
+        struct server_id server_id;
+        const char *server_id_str;
+        bool exists;
+        struct wipedbs_record_marker *session_records;
+        struct wipedbs_record_marker *tcon_records;
+        struct wipedbs_record_marker *open_records;
+};
+
+struct wipedbs_state {
+        struct db_context *id2server_data;
+        struct {
+                struct {
+                        int total;
+                        int existing;
+                        int disconnected;
+                } server;
+                struct {
+                        int total;
+                        int disconnected;
+                        int todelete;
+                        int failure;
+                } session, tcon, open;
+                int open_timed_out;
+        } stat;
+        struct server_id *server_ids;
+        bool *server_exists;
+        int idx;
+        struct db_context *session_db;
+        struct db_context *tcon_db;
+        struct db_context *open_db;
+        struct timeval now;
+        bool testmode;
+        bool verbose;
+};
+
+static struct wipedbs_server_data *get_server_data(struct wipedbs_state *state,
+                                                   const struct server_id *id)
+{
+        struct wipedbs_server_data *ret = NULL;
+        TDB_DATA key, val = tdb_null;
+        NTSTATUS status;
+
+        key = make_tdb_data((const void*)&id->unique_id, sizeof(id->unique_id));
+        status = dbwrap_fetch(state->id2server_data, talloc_tos(), key, &val);
+        if (NT_STATUS_IS_OK(status)) {
+                ret = *(struct wipedbs_server_data**) val.dptr;
+                TALLOC_FREE(val.dptr);
+        } else if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
+                struct server_id_buf idbuf;
+
+                server_id_str_buf(*id, &idbuf);
+
+                ret = talloc_zero(state->id2server_data,
+                                  struct wipedbs_server_data);
+                if (ret == NULL) {
+                        DEBUG(0, ("Failed to allocate server entry for %s\n",
+                                  idbuf.buf));
+                        goto done;
+                }
+                ret->server_id = *id;
+                ret->server_id_str = talloc_strdup(ret, idbuf.buf);
+                ret->exists = true;
+                val = make_tdb_data((const void*)&ret, sizeof(ret));
+                status = dbwrap_store(state->id2server_data,
+                                      key, val, TDB_INSERT);
                 if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(1, ("Could not delete connections.tdb record "
-                                  "for pid %s: %s\n",
-                                  procid_str(talloc_tos(), &key->pid),
-                                  nt_errstr(status)));
+                        DEBUG(0, ("Failed to store server entry for %s: %s\n",
+                                  idbuf.buf, nt_errstr(status)));
                 }
-        }
+                goto done;
+        } else {
+                struct server_id_buf idbuf;
+                DEBUG(0, ("Failed to fetch server entry for %s: %s\n",
+                          server_id_str_buf(*id, &idbuf), nt_errstr(status)));
+                goto done;
+        }
+        if (!server_id_equal(id, &ret->server_id)) {
+                struct server_id_buf idbuf1, idbuf2;
+                DEBUG(0, ("uniq id collision for %s and %s\n",
+                          server_id_str_buf(*id, &idbuf1),
+                          server_id_str_buf(ret->server_id, &idbuf2)));
+                smb_panic("server_id->unique_id not unique!");
+        }
+done:
+        return ret;
+}
+
+static int wipedbs_traverse_sessions(struct smbXsrv_session_global0 *session,
+                                     void *wipedbs_state)
+{
+        struct wipedbs_state *state =
+                talloc_get_type_abort(wipedbs_state,
+                struct wipedbs_state);
+        struct wipedbs_server_data *sd;
+        struct wipedbs_record_marker *rec;
+        TDB_DATA tmp;
+        int ret = -1;
+
+        assert(session->num_channels == 1);
+
+        state->stat.session.total++;
+
+        sd = get_server_data(state, &session->channels[0].server_id);
+        if (sd == NULL) {
+                goto done;
+        }
+
+        if (server_id_is_disconnected(&sd->server_id)) {
+                state->stat.session.disconnected++;
+        }
+
+        rec = talloc_zero(sd, struct wipedbs_record_marker);
+        if (rec == NULL) {
+                DEBUG(0, ("Out of memory!\n"));
+                goto done;
+        }
+
+        tmp = dbwrap_record_get_key(session->db_rec);
+        rec->key = tdb_data_talloc_copy(rec, tmp);
+        tmp = dbwrap_record_get_value(session->db_rec);
+        rec->val = tdb_data_talloc_copy(rec, tmp);
+
+        rec->desc = talloc_asprintf(
+                rec, "session[global: %u wire: %llu]",
+                session->session_global_id,
+                (long long unsigned)session->session_wire_id);
+
+        if ((rec->key.dptr == NULL) || (rec->val.dptr == NULL) ||
+            (rec->desc == NULL))
+        {
+                DEBUG(0, ("Out of memory!\n"));
+                goto done;
+        }
+
+        state->session_db = dbwrap_record_get_db(session->db_rec);
+
+        DLIST_ADD(sd->session_records, rec);
+        ret = 0;
+done:
+        return ret;
+}
+
+static int wipedbs_traverse_tcon(struct smbXsrv_tcon_global0 *tcon,
+                                 void *wipedbs_state)
+{
+        struct wipedbs_state *state =
+                talloc_get_type_abort(wipedbs_state,
+                struct wipedbs_state);
+        struct wipedbs_server_data *sd;
+        struct wipedbs_record_marker *rec;
+        TDB_DATA tmp;
+        int ret = -1;
+
+        state->stat.tcon.total++;
+
+        sd = get_server_data(state, &tcon->server_id);
+        if (sd == NULL) {
+                goto done;
+        }
+
+        if (server_id_is_disconnected(&sd->server_id)) {
+                state->stat.tcon.disconnected++;
+        }
+
+        rec = talloc_zero(sd, struct wipedbs_record_marker);
+        if (rec == NULL) {
+                DEBUG(0, ("Out of memory!\n"));
+                goto done;
+        }
+
+        tmp = dbwrap_record_get_key(tcon->db_rec);
+        rec->key = tdb_data_talloc_copy(rec, tmp);
+        tmp = dbwrap_record_get_value(tcon->db_rec);
+        rec->val = tdb_data_talloc_copy(rec, tmp);
+
+        rec->desc = talloc_asprintf(
+                rec, "tcon[global: %u wire: %u session: %u share: %s]",
+                tcon->tcon_global_id, tcon->tcon_wire_id,
+                tcon->session_global_id, tcon->share_name);
+
+        if ((rec->key.dptr == NULL) || (rec->val.dptr == NULL) ||
+            (rec->desc == NULL))
+        {
+                DEBUG(0, ("Out of memory!\n"));
+                goto done;
+        }
+
+        state->tcon_db = dbwrap_record_get_db(tcon->db_rec);
+
+        DLIST_ADD(sd->tcon_records, rec);
+        ret = 0;
+
+done:
+        return ret;
+}
+
+static int wipedbs_traverse_open(struct smbXsrv_open_global0 *open,
+                                 void *wipedbs_state)
+{
+        struct wipedbs_state *state =
+                talloc_get_type_abort(wipedbs_state,
+                struct wipedbs_state);
+        struct wipedbs_server_data *sd;
+        struct wipedbs_record_marker *rec;
+        TDB_DATA tmp;
+        int ret = -1;
+
+        state->stat.open.total++;
+
+        sd = get_server_data(state, &open->server_id);
+        if (sd == NULL) {
+                goto done;
+        }
+
+        if (server_id_is_disconnected(&sd->server_id)) {
+                struct timeval disconnect_time;
+                int64_t tdiff;
+                bool reached;
+
+                state->stat.open.disconnected++;
+
+                nttime_to_timeval(&disconnect_time, open->disconnect_time);
+                tdiff = usec_time_diff(&state->now, &disconnect_time);
+                reached = (tdiff >= 1000*open->durable_timeout_msec);
+
+                if (state->verbose) {
+                        TALLOC_CTX *mem_ctx = talloc_new(talloc_tos());
+                        enum ndr_err_code ndr_err;
+                        struct vfs_default_durable_cookie cookie;
+
+                        ndr_err = ndr_pull_struct_blob(
+                                &open->backend_cookie, mem_ctx, &cookie,
+                                (ndr_pull_flags_fn_t)ndr_pull_vfs_default_durable_cookie);
+                        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                                d_printf("ndr_pull_struct_blob failed\n");
+                                ret = -1;
+                                goto done;
+                        }
+
+                        d_printf("open[%s/%s id: 0x%" PRIx32 "] disconnected at "
+                                 "[%s] %us ago with timeout of %us "
+                                 "-%s reached\n",
+                                 cookie.servicepath, cookie.base_name,
+                                 open->open_global_id,
+                                 nt_time_string(mem_ctx, open->disconnect_time),
+                                 (unsigned)(tdiff/1000000),
+                                 open->durable_timeout_msec / 1000,
+                                 reached ? "" : " not");
+                        talloc_free(mem_ctx);
+                }
+
+                if (!reached) {
+                        ret = 0;
+                        goto done;
+                }
+                state->stat.open_timed_out++;
+        }
+
+        rec = talloc_zero(sd, struct wipedbs_record_marker);
+        if (rec == NULL) {
+                DEBUG(0, ("Out of memory!\n"));
+                goto done;
+        }
+
+        tmp = dbwrap_record_get_key(open->db_rec);
+        rec->key = tdb_data_talloc_copy(rec, tmp);
+        tmp = dbwrap_record_get_value(open->db_rec);
+        rec->val = tdb_data_talloc_copy(rec, tmp);
+
+        rec->desc = talloc_asprintf(
+                rec, "open[global: %u persistent: %llu volatile: %llu]",
+                open->open_global_id,
+                (long long unsigned)open->open_persistent_id,
+                (long long unsigned)open->open_volatile_id);
+
+        if ((rec->key.dptr == NULL) || (rec->val.dptr == NULL) ||
+            (rec->desc == NULL))
+        {
+                DEBUG(0, ("Out of memory!\n"));
+                goto done;
+        }
+
+        state->open_db = dbwrap_record_get_db(open->db_rec);
+
+        DLIST_ADD(sd->open_records, rec);
+        ret = 0;
+
+done:
+        return ret;
+}
+
+static int wipedbs_traverse_nop(struct db_record *rec, void *private_data)
+{
         return 0;
 }
 
-static int net_serverid_wipedbs_sessionid(struct db_record *rec,
-                                          const char *key,
-                                          struct sessionid *session,
-                                          void *private_data)
-{
-        if (!serverid_exists(&session->pid)) {
-                NTSTATUS status;
-
-                DEBUG(10, ("Deleting sessionid.tdb record for pid %s\n",
-                           procid_str(talloc_tos(), &session->pid)));
-
-                status = rec->delete_rec(rec);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(1, ("Could not delete session.tdb record "
-                                  "for pid %s: %s\n",
-                                  procid_str(talloc_tos(), &session->pid),
-                                  nt_errstr(status)));
+static int wipedbs_traverse_fill_ids(struct db_record *rec, void *wipedbs_state)
+{
+        struct wipedbs_state *state = talloc_get_type_abort(
+                wipedbs_state, struct wipedbs_state);
+
+        TDB_DATA val = dbwrap_record_get_value(rec);
+
+        struct wipedbs_server_data *sd = talloc_get_type_abort(
+                *(void**)val.dptr, struct wipedbs_server_data);
+
+        state->server_ids[state->idx] = sd->server_id;
+        state->idx++;
+        return 0;
+}
+
+static int wipedbs_traverse_set_exists(struct db_record *rec,
+                                       void *wipedbs_state)
+{
+        struct wipedbs_state *state = talloc_get_type_abort(
+                wipedbs_state, struct wipedbs_state);
+
+        TDB_DATA val = dbwrap_record_get_value(rec);
+
+        struct wipedbs_server_data *sd = talloc_get_type_abort(
+                *(void**)val.dptr, struct wipedbs_server_data);
+
+        /* assume a stable traverse order for rbt */
+        SMB_ASSERT(server_id_equal(&state->server_ids[state->idx],
+                                   &sd->server_id));
+        sd->exists = state->server_exists[state->idx];
+
+        if (sd->exists) {
+                state->stat.server.existing++;
+        }
+        if (server_id_is_disconnected(&sd->server_id)) {
+                state->stat.server.disconnected++;
+        }
+
+        state->idx++;
+        return 0;
+}
+
+static bool serverids_exist(const struct server_id *ids, int num_ids,
+                            bool *results)
+{
+        int i;
+
+        for (i=0; i<num_ids; i++) {
+                results[i] = serverid_exists(&ids[i]);
+        }
+
+        return true;
+}
+
+
+static NTSTATUS wipedbs_check_server_exists(struct wipedbs_state *state)
+{
+        NTSTATUS status;
+        bool ok;
+        int num_servers;
+
+        status = dbwrap_traverse_read(state->id2server_data,
+                                      wipedbs_traverse_nop, NULL, &num_servers);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("Failed to traverse temporary database\n"));
+                goto done;
+        }
+        state->stat.server.total = num_servers;
+
+        state->server_ids = talloc_array(state, struct server_id, num_servers);
+        state->server_exists = talloc_array(state, bool, num_servers);
+        if (state->server_ids == NULL || state->server_exists == NULL) {
+                DEBUG(0, ("Out of memory\n"));
+                goto done;
+        }
+
+        state->idx = 0;
+        status = dbwrap_traverse_read(state->id2server_data,
+                                      wipedbs_traverse_fill_ids,
+                                      state, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("Failed to traverse temporary database\n"));
+                goto done;
+        }
+
+        ok = serverids_exist(state->server_ids, num_servers, state->server_exists);
+        if (!ok) {
+                DEBUG(0, ("Calling serverids_exist failed\n"));
+                status = NT_STATUS_UNSUCCESSFUL;
+                goto done;
+        }
+
+        state->idx = 0;
+        status = dbwrap_traverse_read(state->id2server_data,
+                                      wipedbs_traverse_set_exists, state, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("Failed to traverse temporary database\n"));
+                goto done;
+        }
+done:
+        TALLOC_FREE(state->server_ids);
+        TALLOC_FREE(state->server_exists);
+        return status;
+}
+
+static int wipedbs_delete_records(struct db_context *db,
+                                  struct wipedbs_record_marker *records,
+                                  bool dry_run, bool verbose, int *count)
+{
+        struct wipedbs_record_marker *cur;
+        struct db_record *rec;
+        TDB_DATA val;
+        NTSTATUS status;
+        unsigned num=0, total=0;
+
+        if (db == NULL) {
+                return 0;
+        }
+
+        for (cur = records; cur != NULL; cur = cur->next) {
+                total++;
+                rec = dbwrap_fetch_locked(db, talloc_tos(), cur->key);
+                if (rec == NULL) {
+                        DEBUG(0, ("Failed to fetch record <%s> from %s",
+                                  cur->desc, dbwrap_name(db)));
+                        continue;
                 }
-        }
+                val = dbwrap_record_get_value(rec);
+                if (tdb_data_equal(val, cur->val)) {
+                        if (dry_run) {
+                                status = NT_STATUS_OK;
+                        } else {
+                                status = dbwrap_record_delete(rec);
+                        }
+                        if (NT_STATUS_IS_OK(status)) {
+                                num ++;
+                        } else {
+                                DEBUG(0, ("Failed to delete record <%s> from %s"
+                                          ": %s\n", cur->desc, dbwrap_name(db),
+                                          nt_errstr(status)));
+                        }
+                } else {
+                        DEBUG(0, ("Warning: record <%s> from %s changed"
+                                  ", skip record!\n",
+                                  cur->desc, dbwrap_name(db)));
+                }
+                if (verbose) {
+                        d_printf("deleting %s\n", cur->desc);
+                }
+                TALLOC_FREE(rec);
+        }
+
+        if (verbose) {
+                d_printf("Deleted %u of %u records from %s\n",
+                         num, total, dbwrap_name(db));
+        }
+
+        if (count) {
+                *count += total;
+        }
+
+        return total - num;
+}
+
+static int wipedbs_traverse_server_data(struct db_record *rec,
+                                        void *wipedbs_state)
+{
+        struct wipedbs_state *state = talloc_get_type_abort(
+                wipedbs_state, struct wipedbs_state);
+        bool dry_run = state->testmode;
+        TDB_DATA val = dbwrap_record_get_value(rec);
+        int ret;
+        struct wipedbs_server_data *sd = talloc_get_type_abort(
+                *(void**)val.dptr, struct wipedbs_server_data);
+
+        if (state->verbose) {
+                d_printf("Server: '%s' %s\n", sd->server_id_str,
+                         sd->exists ?
+                         "exists" :
+                         "does not exist, cleaning up...");
+        }
+
+        if (sd->exists) {
+                return 0;
+        }
+
+        ret = wipedbs_delete_records(state->session_db, sd->session_records,
+                                     dry_run, state->verbose,
+                                     &state->stat.session.todelete);
+        state->stat.session.failure += ret;
+
+        ret = wipedbs_delete_records(state->tcon_db, sd->tcon_records,
+                                     dry_run, state->verbose,
+                                     &state->stat.tcon.todelete);
+        state->stat.tcon.failure += ret;
+
+        ret = wipedbs_delete_records(state->open_db, sd->open_records,
+                                     dry_run, state->verbose,
+                                     &state->stat.open.todelete);
+        state->stat.open.failure += ret;
+
         return 0;
 }
@@ -118 +581 @@
                                 const char **argv)
 {
-        if (!sessionid_init()) {
-                d_printf("failed to open sessionid.tdb\n");
+        int ret = -1;
+        NTSTATUS status;
+        struct wipedbs_state *state = talloc_zero(talloc_tos(),
+                                                  struct wipedbs_state);
+
+        if (c->display_usage) {
+                d_printf("%s\n%s",
+                         _("Usage:"),
+                         _("net serverid wipedbs [--test] [--verbose]\n"));
+                d_printf("%s\n%s",
+                         _("Example:"),
+                         _("net serverid wipedbs -v\n"));
                 return -1;
-        };
-
-        connections_forall(net_serverid_wipedbs_conn, NULL);
-        sessionid_traverse(net_serverid_wipedbs_sessionid, NULL);
+        }
+
+        state->now = timeval_current();
+        state->testmode = c->opt_testmode;
+        state->verbose = c->opt_verbose;
+
+        state->id2server_data = db_open_rbt(state);
+        if (state->id2server_data == NULL) {
+                DEBUG(0, ("Failed to open temporary database\n"));
+                goto done;
+        }
+
+        status = smbXsrv_session_global_traverse(wipedbs_traverse_sessions,
+                                                 state);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
+
+        status = smbXsrv_tcon_global_traverse(wipedbs_traverse_tcon, state);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
+
+        status = smbXsrv_open_global_traverse(wipedbs_traverse_open, state);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
+
+        status = wipedbs_check_server_exists(state);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
+
+        status = dbwrap_traverse_read(state->id2server_data,
+                                      wipedbs_traverse_server_data,
+                                      state, NULL);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("Failed to traverse db: %s\n", nt_errstr(status)));
+                goto done;
+        }
+
+        d_printf("Found %d serverids, %d alive and %d disconnected\n",
+                 state->stat.server.total,
+                 state->stat.server.existing,
+                 state->stat.server.disconnected);
+        d_printf("Found %d sessions, %d alive and %d disconnected"
+                 ", cleaned up %d of %d entries\n",
+                 state->stat.session.total,
+                 state->stat.session.total - state->stat.session.todelete,
+                 state->stat.session.disconnected,
+                 state->stat.session.todelete - state->stat.session.failure,
+                 state->stat.session.todelete);
+        d_printf("Found %d tcons, %d alive and %d disconnected"
+                 ", cleaned up %d of %d entries\n",
+                 state->stat.tcon.total,
+                 state->stat.tcon.total - state->stat.tcon.todelete,
+                 state->stat.tcon.disconnected,
+                 state->stat.tcon.todelete - state->stat.tcon.failure,
+                 state->stat.tcon.todelete);
+        d_printf("Found %d opens, %d alive, %d disconnected and %d timed out"
+                 ", cleaned up %d of %d entries\n",
+                 state->stat.open.total,
+                 state->stat.open.total - state->stat.open.todelete
+                 - (state->stat.open.disconnected - state->stat.open_timed_out),
+                 state->stat.open.disconnected,
+                 state->stat.open_timed_out,
+                 state->stat.open.todelete - state->stat.open.failure,
+                 state->stat.open.todelete);
+
+        ret = 0;
+done:
+        talloc_free(state);
+        return ret;
+}
+
+static int net_serverid_exists(struct net_context *c, int argc,
+                               const char **argv)
+{
+        struct server_id pid;
+        bool ok;
+
+        if ((argc != 1) || (c->display_usage)) {
+                d_printf("Usage:\n"
+                         "net serverid exists <serverid>\n");
+                return -1;
+        }
+
+        pid = server_id_from_string(get_my_vnn(), argv[0]);
+        ok = serverid_exists(&pid);
+
+        if (ok) {
+                d_printf("%s exists\n", argv[0]);
+        } else {
+                d_printf("%s does not exist\n", argv[0]);
+        }
+
         return 0;
 }
@@ -151 +716 @@
                         net_serverid_wipedbs,
                         NET_TRANSPORT_LOCAL,
-                        N_("Clean dead entries from connections.tdb and "
-                           "sessionid.tdb"),
+                        N_("Clean dead entries from temporary databases"),
                         N_("net serverid wipedbs\n"
-                           "    Clean dead entries from connections.tdb and "
-                           "sessionid.tdb")
+                           "    Clean dead entries from temporary databases")
+                },
+                {
+                        "exists",
+                        net_serverid_exists,
+                        NET_TRANSPORT_LOCAL,
+                        N_("Show existence of a serverid"),
+                        N_("net serverid exists <id>")
                 },
                 {NULL, NULL, 0, NULL, NULL}

vendor/current/source3/utils/net_share.c

@@ -63 +63 @@
 int net_share(struct net_context *c, int argc, const char **argv)
 {
-        if (argc > 0 && StrCaseCmp(argv[0], "HELP") == 0) {
+        if (argc > 0 && strcasecmp_m(argv[0], "HELP") == 0) {
                         net_share_usage(c, argc, argv);
                         return 0;

vendor/current/source3/utils/net_status.c

@@ -21 +21 @@
 #include "session.h"
 #include "messages.h"
+#include "lib/conn_tdb.h"
 
 int net_status_usage(struct net_context *c, int argc, const char **argv)
@@ -34 +35 @@
                         void *private_data)
 {
+        struct server_id_buf tmp;
         bool *parseable = (bool *)private_data;
 
@@ -42 +44 @@
         if (*parseable) {
                 d_printf("%s\\%s\\%s\\%s\\%s\n",
-                         procid_str_static(&session->pid),
+                         server_id_str_buf(session->pid, &tmp),
                          uidtoname(session->uid),
                          gidtoname(session->gid),
@@ -48 +50 @@
         } else {
                 d_printf("%7s   %-12s  %-12s  %-12s (%s)\n",
-                         procid_str_static(&session->pid),
+                         server_id_str_buf(session->pid, &tmp),
                          uidtoname(session->uid),
                          gidtoname(session->gid),
@@ -91 +93 @@
 }
 
-static int show_share(struct db_record *rec,
-                      const struct connections_key *key,
+static int show_share(const struct connections_key *key,
                       const struct connections_data *crec,
                       void *state)
 {
-        if (crec->cnum == -1)
+        struct server_id_buf tmp;
+
+        if (crec->cnum == TID_FIELD_INVALID)
                 return 0;
 
@@ -104 +107 @@
 
         d_printf("%-10.10s   %s   %-12s  %s",
-               crec->servicename, procid_str_static(&crec->pid),
+               crec->servicename, server_id_str_buf(crec->pid, &tmp),
                crec->machine,
                time_to_asc(crec->start));
@@ -140 +143 @@
 {
         struct sessionids *ids = (struct sessionids *)state;
+        struct server_id_buf tmp;
         int i;
         bool guest = true;
 
-        if (crec->cnum == -1)
+        if (crec->cnum == TID_FIELD_INVALID)
                 return 0;
 
@@ -152 +156 @@
         for (i=0; i<ids->num_entries; i++) {
                 struct server_id id = ids->entries[i].pid;
-                if (procid_equal(&id, &crec->pid)) {
+                if (serverid_equal(&id, &crec->pid)) {
                         guest = false;
                         break;
@@ -159 +163 @@
 
         d_printf("%s\\%s\\%s\\%s\\%s\\%s\\%s",
-                 crec->servicename,procid_str_static(&crec->pid),
+                 crec->servicename, server_id_str_buf(crec->pid, &tmp),
                  guest ? "" : uidtoname(ids->entries[i].uid),
                  guest ? "" : gidtoname(ids->entries[i].gid),
@@ -205 +209 @@
                            "------------------\n"));
 
-                connections_forall(show_share, NULL);
+                connections_forall_read(show_share, NULL);
 
                 return 0;
@@ -240 +244 @@
                 {NULL, NULL, 0, NULL, NULL}
         };
-
-        if (!sessionid_init_readonly()) {
-                d_printf("failed to open sessionid.tdb\n");
-                return -1;
-        }
-
         return net_run_function(c, argc, argv, "net status", func);
 }

vendor/current/source3/utils/net_time.c

@@ -21 +21 @@
 #include "libsmb/nmblib.h"
 #include "libsmb/libsmb.h"
+#include "../libcli/smb/smbXcli_base.h"
 
 /*
   return the time on a server. This does not require any authentication
 */
-static time_t cli_servertime(const char *host, struct sockaddr_storage *pss, int *zone)
-{
-        struct nmb_name calling, called;
+static time_t cli_servertime(const char *host,
+                             const struct sockaddr_storage *dest_ss,
+                             int *zone)
+{
         time_t ret = 0;
         struct cli_state *cli = NULL;
         NTSTATUS status;
 
-        cli = cli_initialise();
-        if (!cli) {
-                goto done;
-        }
-
-        status = cli_connect(cli, host, pss);
+        status = cli_connect_nb(host, dest_ss, 0, 0x20, lp_netbios_name(),
+                                SMB_SIGNING_DEFAULT, 0, &cli);
         if (!NT_STATUS_IS_OK(status)) {
                 fprintf(stderr, _("Can't contact server %s. Error %s\n"),
@@ -44 +42 @@
         }
 
-        make_nmb_name(&calling, global_myname(), 0x0);
-        if (host) {
-                make_nmb_name(&called, host, 0x20);
-        } else {
-                make_nmb_name(&called, "*SMBSERVER", 0x20);
-        }
-
-        if (!cli_session_request(cli, &calling, &called)) {
-                fprintf(stderr, _("Session request failed\n"));
-                goto done;
-        }
-        status = cli_negprot(cli);
+        status = smbXcli_negprot(cli->conn, cli->timeout, PROTOCOL_CORE,
+                                 PROTOCOL_NT1);
         if (!NT_STATUS_IS_OK(status)) {
                 fprintf(stderr, _("Protocol negotiation failed: %s\n"),
@@ -62 +50 @@
         }
 
-        ret = cli->servertime;
-        if (zone) *zone = cli->serverzone;
+        ret = cli_state_server_time(cli);
+        if (zone) *zone = smb1cli_conn_server_time_zone(cli->conn);
 
 done:
@@ -97 +85 @@
 {
         d_printf(_(
-"net time\n\tdisplays time on a server\n\n"
-"net time system\n\tdisplays time on a server in a format ready for /bin/date\n\n"
-"net time set\n\truns /bin/date with the time from the server\n\n"
-"net time zone\n\tdisplays the timezone in hours from GMT on the remote computer\n\n"
+"net time\n\tdisplays time on a server (-S server)\n\n"
+"net time system\n\tdisplays time on a server (-S server) in a format ready for /bin/date\n\n"
+"net time set\n\truns /bin/date with the time from the server (-S server)\n\n"
+"net time zone\n\tdisplays the timezone in hours from GMT on the remote server (-S server)\n\n"
 "\n"));
         net_common_flags_usage(c, argc, argv);
@@ -112 +100 @@
         int result;
 
+        if (c->display_usage || c->opt_host == NULL) {
+                d_printf(  "%s\n"
+                           "net time set\n"
+                           "    %s\n",
+                         _("Usage:"),
+                         _("Set local time to that of remote time "
+                                "server (-S server) "));
+                return 0;
+        }
+
         tv.tv_sec = nettime(c, NULL);
         tv.tv_usec=0;
@@ -131 +129 @@
         time_t t;
 
-        if (c->display_usage) {
+        if (c->display_usage || c->opt_host == NULL) {
                 d_printf(  "%s\n"
                            "net time system\n"
                            "    %s\n",
                          _("Usage:"),
-                         _("Output remote time server time in a format "
-                           "ready for /bin/date"));
+                         _("Output remote time server (-S server) "
+                                "time in a format ready for /bin/date"));
                 return 0;
         }
@@ -157 +155 @@
         time_t t;
 
-        if (c->display_usage) {
+        if (c->display_usage || c->opt_host == NULL) {
                 d_printf(  "%s\n"
                            "net time zone\n"
                            "   %s\n",
                          _("Usage:"),
-                         _("Display the remote time server's offset to "
-                           "UTC"));
+                         _("Display the remote time server's (-S server) "
+                                "offset to UTC"));
                 return 0;
         }
@@ -229 +227 @@
         }
 
-        if (!c->opt_host && !c->opt_have_ip &&
-            !find_master_ip(c->opt_target_workgroup, &c->opt_dest_ip)) {
-                d_fprintf(stderr, _("Could not locate a time server.  Try "
-                                    "specifying a target host.\n"));
-                net_time_usage(c, argc,argv);
-                return -1;
+        if (c->opt_host == NULL && !c->opt_have_ip) {
+                bool ok;
+
+                ok = find_master_ip(c->opt_target_workgroup, &c->opt_dest_ip);
+                if (!ok) {
+                        d_fprintf(stderr,
+                                  _("Could not locate a time server.  "
+                                    "Try specifying a target host.\n"));
+                        net_time_usage(c, argc, argv);
+                        return -1;
+                }
+                c->opt_have_ip = true;
         }
 
         /* default - print the time */
-        t = cli_servertime(c->opt_host, c->opt_have_ip? &c->opt_dest_ip : NULL,
+        t = cli_servertime(c->opt_host,
+                           c->opt_have_ip? &c->opt_dest_ip : NULL,
                            NULL);
         if (t == 0) return -1;

vendor/current/source3/utils/net_user.c

@@ -51 +51 @@
                 return net_user_usage(c, argc, argv);
 
-        if (StrCaseCmp(argv[0], "HELP") == 0) {
+        if (strcasecmp_m(argv[0], "HELP") == 0) {
                 net_user_usage(c, argc, argv);
                 return 0;

vendor/current/source3/utils/net_usershare.c

@@ -136 +136 @@
 static char *get_basepath(TALLOC_CTX *ctx)
 {
-        char *basepath = talloc_strdup(ctx, lp_usershare_path());
+        char *basepath = lp_usershare_path(ctx);
 
         if (!basepath) {
@@ -175 +175 @@
         us_path = talloc_asprintf(talloc_tos(),
                                 "%s/%s",
-                                lp_usershare_path(),
+                                lp_usershare_path(talloc_tos()),
                                 sharename);
         if (!us_path) {
@@ -209 +209 @@
 static int get_share_list(TALLOC_CTX *ctx, const char *wcard, bool only_ours)
 {
-        SMB_STRUCT_DIR *dp;
-        SMB_STRUCT_DIRENT *de;
+        DIR *dp;
+        struct dirent *de;
         uid_t myuid = geteuid();
         struct file_list *fl = NULL;
@@ -218 +218 @@
                 return -1;
         }
-        dp = sys_opendir(basepath);
+        dp = opendir(basepath);
         if (!dp) {
                 d_fprintf(stderr,
@@ -227 +227 @@
         }
 
-        while((de = sys_readdir(dp)) != 0) {
+        while((de = readdir(dp)) != 0) {
                 SMB_STRUCT_STAT sbuf;
                 char *path;
@@ -250 +250 @@
                                         n);
                 if (!path) {
-                        sys_closedir(dp);
+                        closedir(dp);
                         return -1;
                 }
@@ -279 +279 @@
 
                 /* (Finally) - add to list. */
-                fl = TALLOC_P(ctx, struct file_list);
+                fl = talloc(ctx, struct file_list);
                 if (!fl) {
-                        sys_closedir(dp);
+                        closedir(dp);
                         return -1;
                 }
                 fl->pathname = talloc_strdup(ctx, n);
                 if (!fl->pathname) {
-                        sys_closedir(dp);
+                        closedir(dp);
                         return -1;
                 }
@@ -293 +293 @@
         }
 
-        sys_closedir(dp);
+        closedir(dp);
         return 0;
 }
@@ -360 +360 @@
 
 #ifdef O_NOFOLLOW
-        fd = sys_open(basepath, O_RDONLY|O_NOFOLLOW, 0);
+        fd = open(basepath, O_RDONLY|O_NOFOLLOW, 0);
 #else
-        fd = sys_open(basepath, O_RDONLY, 0);
+        fd = open(basepath, O_RDONLY, 0);
 #endif
 
@@ -524 +524 @@
         }
 
-        strlower_m(wcard);
+        if (!strlower_m(wcard)) {
+                return -1;
+        }
 
         ctx = talloc_init("share_info");
@@ -547 +549 @@
 static int count_num_usershares(void)
 {
-        SMB_STRUCT_DIR *dp;
-        SMB_STRUCT_DIRENT *de;
+        DIR *dp;
+        struct dirent *de;
         int num_usershares = 0;
         TALLOC_CTX *ctx = talloc_tos();
@@ -557 +559 @@
         }
 
-        dp = sys_opendir(basepath);
+        dp = opendir(basepath);
         if (!dp) {
                 d_fprintf(stderr,
@@ -566 +568 @@
         }
 
-        while((de = sys_readdir(dp)) != 0) {
+        while((de = readdir(dp)) != 0) {
                 SMB_STRUCT_STAT sbuf;
                 char *path;
@@ -589 +591 @@
                                 n);
                 if (!path) {
-                        sys_closedir(dp);
+                        closedir(dp);
                         return -1;
                 }
@@ -611 +613 @@
         }
 
-        sys_closedir(dp);
+        closedir(dp);
         return num_usershares;
 }
@@ -641 +643 @@
         bool guest_ok = false;
         int num_usershares;
+        mode_t mask;
 
         us_comment = "";
@@ -894 +897 @@
 
         /* Create a temporary filename for this share. */
+        mask = umask(S_IRWXO | S_IRWXG);
         tmpfd = mkstemp(full_path_tmp);
+        umask(mask);
 
         if (tmpfd == -1) {
@@ -1037 +1042 @@
         }
 
-        strlower_m(wcard);
+        if (!strlower_m(wcard)) {
+                return -1;
+        }
 
         ctx = talloc_init("share_list");
@@ -1060 +1067 @@
 int net_usershare(struct net_context *c, int argc, const char **argv)
 {
-        SMB_STRUCT_DIR *dp;
+        DIR *dp;
 
         struct functable func[] = {
@@ -1105 +1112 @@
         }
 
-        dp = sys_opendir(lp_usershare_path());
+        dp = opendir(lp_usershare_path(talloc_tos()));
         if (!dp) {
                 int err = errno;
@@ -1111 +1118 @@
                         _("net usershare: cannot open usershare directory %s. "
                           "Error %s\n"),
-                        lp_usershare_path(), strerror(err) );
+                        lp_usershare_path(talloc_tos()), strerror(err) );
                 if (err == EACCES) {
                         d_fprintf(stderr,
@@ -1124 +1131 @@
                 return -1;
         }
-        sys_closedir(dp);
+        closedir(dp);
 
         return net_run_function(c, argc, argv, "net usershare", func);

vendor/current/source3/utils/net_util.c

@@ -46 +46 @@
         ZERO_STRUCT(pol);
 
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
                                           &lsa_pipe);
         if (!NT_STATUS_IS_OK(status)) {
@@ -99 +99 @@
 
 NTSTATUS connect_to_service(struct net_context *c,
-                                        struct cli_state **cli_ctx,
-                                        struct sockaddr_storage *server_ss,
-                                        const char *server_name,
-                                        const char *service_name,
-                                        const char *service_type)
+                            struct cli_state **cli_ctx,
+                            const struct sockaddr_storage *server_ss,
+                            const char *server_name,
+                            const char *service_name,
+                            const char *service_type)
 {
         NTSTATUS nt_status;
@@ -126 +126 @@
                                         service_name, service_type,
                                         c->opt_user_name, c->opt_workgroup,
-                                        c->opt_password, flags, Undefined);
+                                        c->opt_password, flags,
+                                        SMB_SIGNING_IPC_DEFAULT);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 d_fprintf(stderr, _("Could not connect to server %s\n"),
@@ -188 +189 @@
 NTSTATUS connect_to_ipc(struct net_context *c,
                         struct cli_state **cli_ctx,
-                        struct sockaddr_storage *server_ss,
+                        const struct sockaddr_storage *server_ss,
                         const char *server_name)
 {
@@ -201 +202 @@
 NTSTATUS connect_to_ipc_anonymous(struct net_context *c,
                                 struct cli_state **cli_ctx,
-                                struct sockaddr_storage *server_ss,
+                                const struct sockaddr_storage *server_ss,
                                 const char *server_name)
 {
@@ -210 +211 @@
                                         "IPC$", "IPC",
                                         "", "",
-                                        "", 0, Undefined);
+                                        "", 0, SMB_SIGNING_DEFAULT);
 
         if (NT_STATUS_IS_OK(nt_status)) {
@@ -218 +219 @@
                 return nt_status;
         }
-}
-
-/****************************************************************************
- Return malloced user@realm for krb5 login.
-****************************************************************************/
-
-static char *get_user_and_realm(const char *username)
-{
-        char *user_and_realm = NULL;
-
-        if (!username) {
-                return NULL;
-        }
-        if (strchr_m(username, '@')) {
-                user_and_realm = SMB_STRDUP(username);
-        } else {
-                if (asprintf(&user_and_realm, "%s@%s", username, lp_realm()) == -1) {
-                        user_and_realm = NULL;
-                }
-        }
-        return user_and_realm;
-}
-
-/****************************************************************************
- Connect to \\server\ipc$ using KRB5.
-****************************************************************************/
-
-NTSTATUS connect_to_ipc_krb5(struct net_context *c,
-                        struct cli_state **cli_ctx,
-                        struct sockaddr_storage *server_ss,
-                        const char *server_name)
-{
-        NTSTATUS nt_status;
-        char *user_and_realm = NULL;
-
-        /* FIXME: Should get existing kerberos ticket if possible. */
-        c->opt_password = net_prompt_pass(c, c->opt_user_name);
-        if (!c->opt_password) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        user_and_realm = get_user_and_realm(c->opt_user_name);
-        if (!user_and_realm) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        nt_status = cli_full_connection(cli_ctx, NULL, server_name,
-                                        server_ss, c->opt_port,
-                                        "IPC$", "IPC",
-                                        user_and_realm, c->opt_workgroup,
-                                        c->opt_password,
-                                        CLI_FULL_CONNECTION_USE_KERBEROS,
-                                        Undefined);
-
-        SAFE_FREE(user_and_realm);
-
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                DEBUG(1,("Cannot connect to server using kerberos.  Error was %s\n", nt_errstr(nt_status)));
-                return nt_status;
-        }
-
-        if (c->smb_encrypt) {
-                nt_status = cli_cm_force_encryption(*cli_ctx,
-                                        user_and_realm,
-                                        c->opt_password,
-                                        c->opt_workgroup,
-                                        "IPC$");
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        cli_shutdown(*cli_ctx);
-                        *cli_ctx = NULL;
-                }
-        }
-
-        return nt_status;
 }
 
@@ -305 +232 @@
 NTSTATUS connect_dst_pipe(struct net_context *c, struct cli_state **cli_dst,
                           struct rpc_pipe_client **pp_pipe_hnd,
-                          const struct ndr_syntax_id *interface)
+                          const struct ndr_interface_table *table)
 {
         NTSTATUS nt_status;
@@ -330 +257 @@
         }
 
-        nt_status = cli_rpc_pipe_open_noauth(cli_tmp, interface,
+        nt_status = cli_rpc_pipe_open_noauth(cli_tmp, table,
                                              &pipe_hnd);
         if (!NT_STATUS_IS_OK(nt_status)) {
@@ -361 +288 @@
         c->opt_password = secrets_fetch_machine_password(
                                 c->opt_target_workgroup, NULL, NULL);
-        if (asprintf(&user_name, "%s$@%s", global_myname(), lp_realm()) == -1) {
+        if (asprintf(&user_name, "%s$@%s", lp_netbios_name(), lp_realm()) == -1) {
                 return -1;
         }
@@ -383 +310 @@
         c->opt_password = secrets_fetch_machine_password(
                                 c->opt_target_workgroup, NULL, NULL);
-        if (asprintf(&user_name, "%s$", global_myname()) == -1) {
+        if (asprintf(&user_name, "%s$", lp_netbios_name()) == -1) {
                 return -1;
         }
@@ -500 +427 @@
 NTSTATUS net_make_ipc_connection_ex(struct net_context *c ,const char *domain,
                                     const char *server,
-                                    struct sockaddr_storage *pss,
+                                    const struct sockaddr_storage *pss,
                                     unsigned flags, struct cli_state **pcli)
 {
@@ -532 +459 @@
 
         if ( (flags & NET_FLAGS_PDC) && NT_STATUS_IS_OK(nt_status) )
-                saf_store( cli->server_domain, cli->desthost );
+                saf_store(cli->server_domain, server_name);
 
         SAFE_FREE(server_name);
@@ -556 +483 @@
 {
         char *prompt = NULL;
-        const char *pass = NULL;
+        char pwd[256] = {0};
+        int rc;
 
         if (c->opt_password) {
@@ -574 +502 @@
         }
 
-        pass = getpass(prompt);
+        rc = samba_getpass(prompt, pwd, sizeof(pwd), false, false);
         SAFE_FREE(prompt);
-
-        return pass;
+        if (rc < 0) {
+                return NULL;
+        }
+
+        return SMB_STRDUP(pwd);
 }
 
@@ -587 +518 @@
         if (argc != 0) {
                 for (i=0; table[i].funcname != NULL; i++) {
-                        if (StrCaseCmp(argv[0], table[i].funcname) == 0)
+                        if (strcasecmp_m(argv[0], table[i].funcname) == 0)
                                 return table[i].fn(c, argc-1, argv+1);
                 }
@@ -641 +572 @@
         ZERO_STRUCT(pol);
 
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
                                           &pipe_hnd);
         if (!NT_STATUS_IS_OK(status)) {
@@ -704 +635 @@
         ZERO_STRUCTP(dc_info);
 
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_dssetup.syntax_id,
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_dssetup,
                                           &dssetup_pipe);
         if (!NT_STATUS_IS_OK(status)) {

vendor/current/source3/utils/netlookup.c

@@ -79 +79 @@
         }
 
-        cs = TALLOC_P(ctx, struct con_struct);
+        cs = talloc(ctx, struct con_struct);
         if (!cs) {
                 *perr = NT_STATUS_NO_MEMORY;
@@ -99 +99 @@
 #endif
 
-        nt_status = cli_full_connection(&cs->cli, global_myname(), global_myname(),
+        nt_status = cli_full_connection(&cs->cli, lp_netbios_name(), lp_netbios_name(),
                                         &loopback_ss, 0,
                                         "IPC$", "IPC",
@@ -112 +112 @@
 #endif
                                         0,
-                                        Undefined);
+                                        SMB_SIGNING_DEFAULT);
 
         if (!NT_STATUS_IS_OK(nt_status)) {
@@ -123 +123 @@
 
         nt_status = cli_rpc_pipe_open_noauth(cs->cli,
-                                        &ndr_table_lsarpc.syntax_id,
+                                        &ndr_table_lsarpc,
                                         &cs->lsapipe);
 

vendor/current/source3/utils/nmblookup.c

@@ -41 +41 @@
 {
         struct sockaddr_storage ss;
-        const char *sock_addr = lp_socket_address();
+        const char *sock_addr = lp_nbt_client_socket_address();
 
         if (!interpret_string_addr(&ss, sock_addr,
@@ -108 +108 @@
 ****************************************************************************/
 
-static void do_node_status(const char *name,
+static bool do_node_status(const char *name,
                 int type,
                 struct sockaddr_storage *pss)
@@ -143 +143 @@
                 d_printf("\n");
                 TALLOC_FREE(addrs);
+                return true;
         } else {
                 d_printf("No reply from %s\n\n",addr);
+                return false;
         }
 }
@@ -169 +171 @@
                                     &ip_list, &count, &flags);
         } else {
-                const struct in_addr *bcast;
-                for (j=iface_count() - 1;
-                     !ip_list && j >= 0;
-                     j--) {
-                        char addr[INET6_ADDRSTRLEN];
-                        struct sockaddr_storage bcast_ss;
-
-                        bcast = iface_n_bcast_v4(j);
-                        if (!bcast) {
-                                continue;
-                        }
-                        in_addr_to_sockaddr_storage(&bcast_ss, *bcast);
-                        print_sockaddr(addr, sizeof(addr), &bcast_ss);
-                        d_printf("querying %s on %s\n",
-                               lookup, addr);
-                        status = name_query(lookup,lookup_type,
-                                            use_bcast,
-                                            use_bcast?True:recursion_desired,
-                                            &bcast_ss, talloc_tos(),
-                                            &ip_list, &count, &flags);
-                }
+                status = name_resolve_bcast(
+                        lookup, lookup_type,
+                        talloc_tos(), &ip_list, &count);
         }
 
@@ -220 +204 @@
                  */
                 if (find_status) {
-                        do_node_status(lookup, lookup_type, &ip_list[j]);
+                        if (!do_node_status(lookup, lookup_type, &ip_list[j])) {
+                                status = NT_STATUS_UNSUCCESSFUL;
+                        }
                 }
         }
@@ -233 +219 @@
   main program
 ****************************************************************************/
-int main(int argc,char *argv[])
+int main(int argc, const char *argv[])
 {
         int opt;
@@ -240 +226 @@
         static bool find_master=False;
         static bool lookup_by_ip = False;
-        poptContext pc;
+        poptContext pc = NULL;
         TALLOC_CTX *frame = talloc_stackframe();
+        int rc = 0;
 
         struct poptOption long_options[] = {
@@ -261 +248 @@
         *lookup = 0;
 
-        load_case_tables();
+        smb_init_locale();
 
         setup_logging(argv[0], DEBUG_STDOUT);
 
-        pc = poptGetContext("nmblookup", argc, (const char **)argv,
+        pc = poptGetContext("nmblookup", argc, argv,
                         long_options, POPT_CONTEXT_KEEP_FIRST);
 
@@ -316 +303 @@
         if(!poptPeekArg(pc)) {
                 poptPrintUsage(pc, stderr, 0);
-                exit(1);
-        }
-
-        if (!lp_load(get_dyn_CONFIGFILE(),True,False,False,True)) {
+                rc = 1;
+                goto out;
+        }
+
+        if (!lp_load_global(get_dyn_CONFIGFILE())) {
                 fprintf(stderr, "Can't load %s - run testparm to debug it\n",
                                 get_dyn_CONFIGFILE());
@@ -326 +314 @@
         load_interfaces();
         if (!open_sockets()) {
-                return(1);
+                rc = 1;
+                goto out;
         }
 
@@ -332 +321 @@
                 char *p;
                 struct in_addr ip;
+                size_t nbt_len;
 
                 fstrcpy(lookup,poptGetArg(pc));
@@ -340 +330 @@
                         in_addr_to_sockaddr_storage(&ss, ip);
                         fstrcpy(lookup,"*");
-                        do_node_status(lookup, lookup_type, &ss);
+                        if (!do_node_status(lookup, lookup_type, &ss)) {
+                                rc = 1;
+                        }
                         continue;
                 }
@@ -359 +351 @@
                 }
 
+                nbt_len = strlen(lookup);
+                if (nbt_len > MAX_NETBIOSNAME_LEN - 1) {
+                        d_printf("The specified netbios name [%s] is too long!\n",
+                                 lookup);
+                        continue;
+                }
+
+
                 if (!query_one(lookup, lookup_type)) {
+                        rc = 1;
                         d_printf( "name_query failed to find name %s", lookup );
                         if( 0 != lookup_type ) {
@@ -368 +369 @@
         }
 
+out:
         poptFreeContext(pc);
         TALLOC_FREE(frame);
-        return(0);
-}
+        return rc;
+}

vendor/current/source3/utils/ntlm_auth.c

@@ -9 +9 @@
    Copyright (C) Robert O'Callahan 2006 (added cached credential code).
    Copyright (C) Kai Blin <kai@samba.org> 2008
+   Copyright (C) Simo Sorce 2010
 
    This program is free software; you can redistribute it and/or modify
@@ -25 +26 @@
 
 #include "includes.h"
+#include "lib/param/param.h"
 #include "popt_common.h"
 #include "utils/ntlm_auth.h"
 #include "../libcli/auth/libcli_auth.h"
-#include "../libcli/auth/spnego.h"
-#include "../libcli/auth/ntlmssp.h"
+#include "auth/ntlmssp/ntlmssp.h"
+#include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h"
+#include "auth/credentials/credentials.h"
+#include "librpc/crypto/gse.h"
 #include "smb_krb5.h"
-#include <iniparser.h>
+#include "lib/util/tiniparser.h"
 #include "../lib/crypto/arcfour.h"
-#include "libads/kerberos_proto.h"
 #include "nsswitch/winbind_client.h"
 #include "librpc/gen_ndr/krb5pac.h"
 #include "../lib/util/asn1.h"
+#include "auth/common_auth.h"
+#include "source3/include/auth.h"
+#include "source3/auth/proto.h"
+#include "nsswitch/libwbclient/wbclient.h"
+#include "lib/param/loadparm.h"
+
+#if HAVE_KRB5
+#include "auth/kerberos/pac_utils.h"
+#endif
 
 #ifndef PAM_WINBIND_CONFIG_FILE
@@ -55 +68 @@
         SQUID_2_5_NTLMSSP,
         NTLMSSP_CLIENT_1,
-        GSS_SPNEGO,
+        GSS_SPNEGO_SERVER,
         GSS_SPNEGO_CLIENT,
         NTLM_SERVER_1,
@@ -69 +82 @@
 };
 
-enum ntlm_auth_svr_state {
-        SERVER_INITIAL = 0,
-        SERVER_CHALLENGE,
-        SERVER_FINISHED,
-        SERVER_ERROR
-};
-
 struct ntlm_auth_state {
         TALLOC_CTX *mem_ctx;
         enum stdio_helper_mode helper_mode;
         enum ntlm_auth_cli_state cli_state;
-        enum ntlm_auth_svr_state svr_state;
         struct ntlmssp_state *ntlmssp_state;
         uint32_t neg_flags;
         char *want_feature_list;
-        char *spnego_mech;
-        char *spnego_mech_oid;
         bool have_session_key;
         DATA_BLOB session_key;
         DATA_BLOB initial_message;
+        void *gensec_private_1;
 };
-
-typedef void (*stdio_helper_function)(struct ntlm_auth_state *state, char *buf,
-                                        int length);
-
-static void manage_squid_basic_request (struct ntlm_auth_state *state,
-                                        char *buf, int length);
-
-static void manage_squid_ntlmssp_request (struct ntlm_auth_state *state,
-                                        char *buf, int length);
-
-static void manage_client_ntlmssp_request (struct ntlm_auth_state *state,
-                                        char *buf, int length);
-
-static void manage_gss_spnego_request (struct ntlm_auth_state *state,
-                                        char *buf, int length);
-
-static void manage_gss_spnego_client_request (struct ntlm_auth_state *state,
-                                        char *buf, int length);
-
-static void manage_ntlm_server_1_request (struct ntlm_auth_state *state,
-                                        char *buf, int length);
-
-static void manage_ntlm_change_password_1_request(struct ntlm_auth_state *state,
-                                        char *buf, int length);
+typedef void (*stdio_helper_function)(enum stdio_helper_mode stdio_helper_mode,
+                                      struct loadparm_context *lp_ctx,
+                                      struct ntlm_auth_state *state, char *buf,
+                                        int length, void **private2);
+
+static void manage_gensec_request(enum stdio_helper_mode stdio_helper_mode,
+                                  struct loadparm_context *lp_ctx,
+                                  char *buf, int length, void **private1);
+
+static void manage_squid_request(enum stdio_helper_mode stdio_helper_mode,
+                                 struct loadparm_context *lp_ctx,
+                                 struct ntlm_auth_state *state,
+                                 stdio_helper_function fn, void **private2);
+
+static void manage_squid_basic_request (enum stdio_helper_mode stdio_helper_mode,
+                                      struct loadparm_context *lp_ctx,
+                                      struct ntlm_auth_state *state,
+                                        char *buf, int length, void **private2);
+
+static void manage_squid_ntlmssp_request (enum stdio_helper_mode stdio_helper_mode,
+                                      struct loadparm_context *lp_ctx,
+                                      struct ntlm_auth_state *state,
+                                        char *buf, int length, void **private2);
+
+static void manage_client_ntlmssp_request (enum stdio_helper_mode stdio_helper_mode,
+                                      struct loadparm_context *lp_ctx,
+                                      struct ntlm_auth_state *state,
+                                        char *buf, int length, void **private2);
+
+static void manage_gss_spnego_request (enum stdio_helper_mode stdio_helper_mode,
+                                      struct loadparm_context *lp_ctx,
+                                      struct ntlm_auth_state *state,
+                                        char *buf, int length, void **private2);
+
+static void manage_gss_spnego_client_request (enum stdio_helper_mode stdio_helper_mode,
+                                      struct loadparm_context *lp_ctx,
+                                      struct ntlm_auth_state *state,
+                                        char *buf, int length, void **private2);
+
+static void manage_ntlm_server_1_request (enum stdio_helper_mode stdio_helper_mode,
+                                      struct loadparm_context *lp_ctx,
+                                      struct ntlm_auth_state *state,
+                                        char *buf, int length, void **private2);
+
+static void manage_ntlm_change_password_1_request(enum stdio_helper_mode stdio_helper_mode,
+                                      struct loadparm_context *lp_ctx,
+                                      struct ntlm_auth_state *state,
+                                        char *buf, int length, void **private2);
 
 static const struct {
@@ -124 +152 @@
         { SQUID_2_5_NTLMSSP, "squid-2.5-ntlmssp", manage_squid_ntlmssp_request},
         { NTLMSSP_CLIENT_1, "ntlmssp-client-1", manage_client_ntlmssp_request},
-        { GSS_SPNEGO, "gss-spnego", manage_gss_spnego_request},
+        { GSS_SPNEGO_SERVER, "gss-spnego", manage_gss_spnego_request},
         { GSS_SPNEGO_CLIENT, "gss-spnego-client", manage_gss_spnego_client_request},
         { NTLM_SERVER_1, "ntlm-server-1", manage_ntlm_server_1_request},
@@ -141 +169 @@
 static int request_user_session_key;
 static int use_cached_creds;
+static int offline_logon;
 
 static const char *require_membership_of;
@@ -146 +175 @@
 static const char *opt_pam_winbind_conf;
 
+const char *opt_target_service;
+const char *opt_target_hostname;
+
+
+/* This is a bit hairy, but the basic idea is to do a password callback
+   to the calling application.  The callback comes from within gensec */
+
+static void manage_gensec_get_pw_request(enum stdio_helper_mode stdio_helper_mode,
+                                         struct loadparm_context *lp_ctx,
+                                         struct ntlm_auth_state *state, char *buf, int length,
+                                         void **password)
+{
+        DATA_BLOB in;
+        if (strlen(buf) < 2) {
+                DEBUG(1, ("query [%s] invalid", buf));
+                x_fprintf(x_stdout, "BH Query invalid\n");
+                return;
+        }
+
+        if (strlen(buf) > 3) {
+                in = base64_decode_data_blob(buf + 3);
+        } else {
+                in = data_blob(NULL, 0);
+        }
+
+        if (strncmp(buf, "PW ", 3) == 0) {
+
+                *password = talloc_strndup(NULL,
+                                           (const char *)in.data, in.length);
+
+                if (*password == NULL) {
+                        DEBUG(1, ("Out of memory\n"));
+                        x_fprintf(x_stdout, "BH Out of memory\n");
+                        data_blob_free(&in);
+                        return;
+                }
+
+                x_fprintf(x_stdout, "OK\n");
+                data_blob_free(&in);
+                return;
+        }
+        DEBUG(1, ("Asked for (and expected) a password\n"));
+        x_fprintf(x_stdout, "BH Expected a password\n");
+        data_blob_free(&in);
+}
+
+/**
+ * Callback for password credentials.  This is not async, and when
+ * GENSEC and the credentials code is made async, it will look rather
+ * different.
+ */
+
+static const char *get_password(struct cli_credentials *credentials)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        char *password = NULL;
+        struct ntlm_auth_state *state;
+
+        state = talloc_zero(frame, struct ntlm_auth_state);
+        if (state == NULL) {
+                DEBUG(0, ("squid_stream: Failed to talloc ntlm_auth_state\n"));
+                x_fprintf(x_stderr, "ERR\n");
+                exit(1);
+        }
+
+        state->mem_ctx = state;
+
+        /* Ask for a password */
+        x_fprintf(x_stdout, "PW\n");
+
+        manage_squid_request(NUM_HELPER_MODES /* bogus */, NULL, state, manage_gensec_get_pw_request, (void **)&password);
+        talloc_steal(credentials, password);
+        TALLOC_FREE(frame);
+        return password;
+}
+
+/**
+ * A limited set of features are defined with text strings as needed
+ * by ntlm_auth
+ *
+ */
+static void gensec_want_feature_list(struct gensec_security *state, char* feature_list)
+{
+        if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list, true)) {
+                DEBUG(10, ("want GENSEC_FEATURE_SESSION_KEY\n"));
+                gensec_want_feature(state, GENSEC_FEATURE_SESSION_KEY);
+        }
+        if (in_list("NTLMSSP_FEATURE_SIGN", feature_list, true)) {
+                DEBUG(10, ("want GENSEC_FEATURE_SIGN\n"));
+                gensec_want_feature(state, GENSEC_FEATURE_SIGN);
+        }
+        if (in_list("NTLMSSP_FEATURE_SEAL", feature_list, true)) {
+                DEBUG(10, ("want GENSEC_FEATURE_SEAL\n"));
+                gensec_want_feature(state, GENSEC_FEATURE_SEAL);
+        }
+        if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list, true)) {
+                DEBUG(10, ("want GENSEC_FEATURE_NTLM_CCACHE\n"));
+                gensec_want_feature(state, GENSEC_FEATURE_NTLM_CCACHE);
+        }
+}
+
 static char winbind_separator(void)
 {
@@ -159 +289 @@
         /* Send off request */
 
-        if (winbindd_request_response(WINBINDD_INFO, NULL, &response) !=
+        if (winbindd_request_response(NULL, WINBINDD_INFO, NULL, &response) !=
             NSS_STATUS_SUCCESS) {
                 d_printf("could not obtain winbind separator!\n");
@@ -189 +319 @@
         /* Send off request */
 
-        if (winbindd_request_response(WINBINDD_DOMAIN_NAME, NULL, &response) !=
+        if (winbindd_request_response(NULL, WINBINDD_DOMAIN_NAME, NULL, &response) !=
             NSS_STATUS_SUCCESS) {
-                DEBUG(0, ("could not obtain winbind domain name!\n"));
+                DEBUG(1, ("could not obtain winbind domain name!\n"));
                 return lp_workgroup();
         }
@@ -215 +345 @@
         /* Send off request */
 
-        if (winbindd_request_response(WINBINDD_NETBIOS_NAME, NULL, &response) !=
+        if (winbindd_request_response(NULL, WINBINDD_NETBIOS_NAME, NULL, &response) !=
             NSS_STATUS_SUCCESS) {
-                DEBUG(0, ("could not obtain winbind netbios name!\n"));
-                return global_myname();
+                DEBUG(1, ("could not obtain winbind netbios name!\n"));
+                return lp_netbios_name();
         }
 
@@ -255 +385 @@
         fstrcpy(domain, domuser);
         domain[PTR_DIFF(p, domuser)] = 0;
-        strupper_m(domain);
-
-        return True;
+        return strupper_m(domain);
 }
 
@@ -280 +408 @@
                                          request.data.name.dom_name, 
                                          request.data.name.name)) {
-                DEBUG(0, ("Could not parse %s into seperate domain/name parts!\n", 
+                DEBUG(0, ("Could not parse %s into separate domain/name parts!\n",
                           require_membership_of));
                 return False;
         }
 
-        if (winbindd_request_response(WINBINDD_LOOKUPNAME, &request, &response) !=
+        if (winbindd_request_response(NULL, WINBINDD_LOOKUPNAME, &request, &response) !=
             NSS_STATUS_SUCCESS) {
                 DEBUG(0, ("Winbindd lookupname failed to resolve %s into a SID!\n", 
@@ -308 +436 @@
 {
         int ctrl = 0;
-        dictionary *d = NULL;
+        struct tiniparser_dictionary *d = NULL;
 
         if (!opt_pam_winbind_conf || !*opt_pam_winbind_conf) {
@@ -314 +442 @@
         }
 
-        d = iniparser_load(CONST_DISCARD(char *, opt_pam_winbind_conf));
+        d = tiniparser_load(opt_pam_winbind_conf);
 
         if (!d) {
@@ -320 +448 @@
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:krb5_auth"), false)) {
+        if (tiniparser_getboolean(d, "global:krb5_auth", false)) {
                 ctrl |= WINBIND_KRB5_AUTH;
         }
 
-        iniparser_freedict(d);
+        tiniparser_freedict(d);
 
         return ctrl;
@@ -355 +483 @@
         }
 
-        result = winbindd_request_response(WINBINDD_PAM_AUTH, &request, &response);
+        if (offline_logon) {
+                request.flags |= WBFLAG_PAM_CACHED_LOGIN;
+        }
+
+        result = winbindd_request_response(NULL, WINBINDD_PAM_AUTH, &request, &response);
 
         /* Display response */
@@ -390 +522 @@
                                    const DATA_BLOB *lm_response,
                                    const DATA_BLOB *nt_response,
-                                   uint32 flags,
-                                   uint8 lm_key[8],
-                                   uint8 user_session_key[16],
+                                   uint32_t flags,
+                                   uint32_t extra_logon_parameters,
+                                   uint8_t lm_key[8],
+                                   uint8_t user_session_key[16],
                                    char **error_string,
                                    char **unix_name)
@@ -410 +543 @@
         request.flags = flags;
 
-        request.data.auth_crap.logon_parameters = MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT | MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT;
+        request.data.auth_crap.logon_parameters = extra_logon_parameters
+                | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT | MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT;
 
         if (require_membership_of_sid)
@@ -448 +582 @@
         }
 
-        result = winbindd_request_response(WINBINDD_PAM_AUTH_CRAP, &request, &response);
+        result = winbindd_request_response(NULL, WINBINDD_PAM_AUTH_CRAP, &request, &response);
         SAFE_FREE(request.extra_data.data);
 
@@ -543 +677 @@
         }
 
-        result = winbindd_request_response(WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP, &request, &response);
+        result = winbindd_request_response(NULL, WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP, &request, &response);
 
         /* Display response */
@@ -570 +704 @@
 }
 
-static NTSTATUS winbind_pw_check(struct ntlmssp_state *ntlmssp_state, TALLOC_CTX *mem_ctx,
-                                 DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
+static NTSTATUS ntlm_auth_generate_session_info(struct auth4_context *auth_context,
+                                                TALLOC_CTX *mem_ctx,
+                                                void *server_returned_info,
+                                                const char *original_user_name,
+                                                uint32_t session_info_flags,
+                                                struct auth_session_info **session_info_out)
+{
+        char *unix_username = (char *)server_returned_info;
+        struct auth_session_info *session_info = talloc_zero(mem_ctx, struct auth_session_info);
+        if (!session_info) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        session_info->unix_info = talloc_zero(session_info, struct auth_user_info_unix);
+        if (!session_info->unix_info) {
+                TALLOC_FREE(session_info);
+                return NT_STATUS_NO_MEMORY;
+        }
+        session_info->unix_info->unix_name = talloc_steal(session_info->unix_info, unix_username);
+
+        *session_info_out = session_info;
+
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS ntlm_auth_generate_session_info_pac(struct auth4_context *auth_ctx,
+                                                    TALLOC_CTX *mem_ctx,
+                                                    struct smb_krb5_context *smb_krb5_context,
+                                                    DATA_BLOB *pac_blob,
+                                                    const char *princ_name,
+                                                    const struct tsocket_address *remote_address,
+                                                    uint32_t session_info_flags,
+                                                    struct auth_session_info **session_info)
+{
+        TALLOC_CTX *tmp_ctx;
+        struct PAC_LOGON_INFO *logon_info = NULL;
+        char *unixuser;
+        NTSTATUS status;
+        char *domain = NULL;
+        char *realm = NULL;
+        char *user = NULL;
+        char *p;
+
+        tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (pac_blob) {
+#ifdef HAVE_KRB5
+                status = kerberos_pac_logon_info(tmp_ctx, *pac_blob, NULL, NULL,
+                                                 NULL, NULL, 0, &logon_info);
+#else
+                status = NT_STATUS_ACCESS_DENIED;
+#endif
+                if (!NT_STATUS_IS_OK(status)) {
+                        goto done;
+                }
+        }
+
+        DEBUG(3, ("Kerberos ticket principal name is [%s]\n", princ_name));
+
+        p = strchr_m(princ_name, '@');
+        if (!p) {
+                DEBUG(3, ("[%s] Doesn't look like a valid principal\n",
+                          princ_name));
+                return NT_STATUS_LOGON_FAILURE;
+        }
+
+        user = talloc_strndup(mem_ctx, princ_name, p - princ_name);
+        if (!user) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        realm = talloc_strdup(talloc_tos(), p + 1);
+        if (!realm) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (!strequal(realm, lp_realm())) {
+                DEBUG(3, ("Ticket for foreign realm %s@%s\n", user, realm));
+                if (!lp_allow_trusted_domains()) {
+                        return NT_STATUS_LOGON_FAILURE;
+                }
+        }
+
+        if (logon_info && logon_info->info3.base.logon_domain.string) {
+                domain = talloc_strdup(mem_ctx,
+                                        logon_info->info3.base.logon_domain.string);
+                if (!domain) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                DEBUG(10, ("Domain is [%s] (using PAC)\n", domain));
+        } else {
+
+                /* If we have winbind running, we can (and must) shorten the
+                   username by using the short netbios name. Otherwise we will
+                   have inconsistent user names. With Kerberos, we get the
+                   fully qualified realm, with ntlmssp we get the short
+                   name. And even w2k3 does use ntlmssp if you for example
+                   connect to an ip address. */
+
+                wbcErr wbc_status;
+                struct wbcDomainInfo *info = NULL;
+
+                DEBUG(10, ("Mapping [%s] to short name using winbindd\n",
+                           realm));
+
+                wbc_status = wbcDomainInfo(realm, &info);
+
+                if (WBC_ERROR_IS_OK(wbc_status)) {
+                        domain = talloc_strdup(mem_ctx,
+                                                info->short_name);
+                        wbcFreeMemory(info);
+                } else {
+                        DEBUG(3, ("Could not find short name: %s\n",
+                                  wbcErrorString(wbc_status)));
+                        domain = talloc_strdup(mem_ctx, realm);
+                }
+                if (!domain) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                DEBUG(10, ("Domain is [%s] (using Winbind)\n", domain));
+        }
+
+        unixuser = talloc_asprintf(tmp_ctx, "%s%c%s", domain, winbind_separator(), user);
+        if (!unixuser) {
+                status = NT_STATUS_NO_MEMORY;
+                goto done;
+        }
+
+        status = ntlm_auth_generate_session_info(auth_ctx, mem_ctx, unixuser, NULL, session_info_flags, session_info);
+
+done:
+        TALLOC_FREE(tmp_ctx);
+        return status;
+}
+
+
+
+/**
+ * Return the challenge as determined by the authentication subsystem 
+ * @return an 8 byte random challenge
+ */
+
+static NTSTATUS ntlm_auth_get_challenge(struct auth4_context *auth_ctx,
+                                        uint8_t chal[8])
+{
+        if (auth_ctx->challenge.data.length == 8) {
+                DEBUG(5, ("auth_get_challenge: returning previous challenge by module %s (normal)\n", 
+                          auth_ctx->challenge.set_by));
+                memcpy(chal, auth_ctx->challenge.data.data, 8);
+                return NT_STATUS_OK;
+        }
+
+        if (!auth_ctx->challenge.set_by) {
+                generate_random_buffer(chal, 8);
+
+                auth_ctx->challenge.data                = data_blob_talloc(auth_ctx, chal, 8);
+                NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.data.data);
+                auth_ctx->challenge.set_by              = "random";
+        }
+
+        DEBUG(10,("auth_get_challenge: challenge set by %s\n",
+                 auth_ctx->challenge.set_by));
+
+        return NT_STATUS_OK;
+}
+
+/**
+ * NTLM2 authentication modifies the effective challenge, 
+ * @param challenge The new challenge value
+ */
+static NTSTATUS ntlm_auth_set_challenge(struct auth4_context *auth_ctx, const uint8_t chal[8], const char *set_by) 
+{
+        auth_ctx->challenge.set_by = talloc_strdup(auth_ctx, set_by);
+        NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.set_by);
+
+        auth_ctx->challenge.data = data_blob_talloc(auth_ctx, chal, 8);
+        NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.data.data);
+
+        return NT_STATUS_OK;
+}
+
+/**
+ * Check the password on an NTLMSSP login.  
+ *
+ * Return the session keys used on the connection.
+ */
+
+static NTSTATUS winbind_pw_check(struct auth4_context *auth4_context, 
+                                 TALLOC_CTX *mem_ctx,
+                                 const struct auth_usersupplied_info *user_info, 
+                                 void **server_returned_info,
+                                 DATA_BLOB *session_key, DATA_BLOB *lm_session_key)
 {
         static const char zeros[16] = { 0, };
         NTSTATUS nt_status;
         char *error_string = NULL;
-        uint8 lm_key[8]; 
-        uint8 user_sess_key[16]; 
+        uint8_t lm_key[8]; 
+        uint8_t user_sess_key[16]; 
         char *unix_name = NULL;
 
-        nt_status = contact_winbind_auth_crap(ntlmssp_state->user, ntlmssp_state->domain,
-                                              ntlmssp_state->client.netbios_name,
-                                              &ntlmssp_state->chal,
-                                              &ntlmssp_state->lm_resp,
-                                              &ntlmssp_state->nt_resp, 
+        nt_status = contact_winbind_auth_crap(user_info->client.account_name, user_info->client.domain_name, 
+                                              user_info->workstation_name, 
+                                              &auth4_context->challenge.data,
+                                              &user_info->password.response.lanman,
+                                              &user_info->password.response.nt,
                                               WBFLAG_PAM_LMKEY | WBFLAG_PAM_USER_SESSION_KEY | WBFLAG_PAM_UNIX_NAME,
+                                              0,
                                               lm_key, user_sess_key, 
                                               &error_string, &unix_name);
@@ -597 +925 @@
 
                 if (memcmp(user_sess_key, zeros, 16) != 0) {
-                        *user_session_key = data_blob_talloc(mem_ctx, user_sess_key, 16);
-                }
-                ntlmssp_state->callback_private = talloc_strdup(ntlmssp_state,
-                                                                unix_name);
+                        *session_key = data_blob_talloc(mem_ctx, user_sess_key, 16);
+                }
+                *server_returned_info = talloc_strdup(mem_ctx,
+                                                      unix_name);
         } else {
                 DEBUG(NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED) ? 0 : 3, 
                       ("Login for user [%s]\\[%s]@[%s] failed due to [%s]\n", 
-                       ntlmssp_state->domain, ntlmssp_state->user, 
-                       ntlmssp_state->client.netbios_name,
+                       user_info->client.domain_name, user_info->client.account_name,
+                       user_info->workstation_name, 
                        error_string ? error_string : "unknown error (NULL)"));
-                ntlmssp_state->callback_private = NULL;
         }
 
@@ -615 +942 @@
 }
 
-static NTSTATUS local_pw_check(struct ntlmssp_state *ntlmssp_state, TALLOC_CTX *mem_ctx,
-                               DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
+static NTSTATUS local_pw_check(struct auth4_context *auth4_context, 
+                                TALLOC_CTX *mem_ctx,
+                                const struct auth_usersupplied_info *user_info, 
+                                void **server_returned_info,
+                                DATA_BLOB *session_key, DATA_BLOB *lm_session_key)
 {
         NTSTATUS nt_status;
@@ -625 +955 @@
         nt_status = ntlm_password_check(mem_ctx,
                                         true, true, 0,
-                                        &ntlmssp_state->chal,
-                                        &ntlmssp_state->lm_resp,
-                                        &ntlmssp_state->nt_resp, 
-                                        ntlmssp_state->user, 
-                                        ntlmssp_state->user, 
-                                        ntlmssp_state->domain,
-                                        &lm_pw, &nt_pw, user_session_key, lm_session_key);
+                                        &auth4_context->challenge.data,
+                                        &user_info->password.response.lanman,
+                                        &user_info->password.response.nt,
+                                        user_info->client.account_name,
+                                        user_info->client.account_name,
+                                        user_info->client.domain_name, 
+                                        &lm_pw, &nt_pw, session_key, lm_session_key);
 
         if (NT_STATUS_IS_OK(nt_status)) {
-                ntlmssp_state->callback_private = talloc_asprintf(ntlmssp_state,
-                                                              "%s%c%s", ntlmssp_state->domain, 
-                                                              *lp_winbind_separator(), 
-                                                              ntlmssp_state->user);
+                *server_returned_info = talloc_asprintf(mem_ctx,
+                                                        "%s%c%s", user_info->client.domain_name,
+                                                        *lp_winbind_separator(), 
+                                                        user_info->client.account_name);
         } else {
                 DEBUG(3, ("Login for user [%s]\\[%s]@[%s] failed due to [%s]\n", 
-                          ntlmssp_state->domain, ntlmssp_state->user,
-                          ntlmssp_state->client.netbios_name,
+                          user_info->client.domain_name, user_info->client.account_name,
+                          user_info->workstation_name, 
                           nt_errstr(nt_status)));
-                ntlmssp_state->callback_private = NULL;
         }
         return nt_status;
 }
 
-static NTSTATUS ntlm_auth_start_ntlmssp_client(struct ntlmssp_state **client_ntlmssp_state)
-{
-        NTSTATUS status;
-        if ( (opt_username == NULL) || (opt_domain == NULL) ) {
-                status = NT_STATUS_UNSUCCESSFUL;
-                DEBUG(1, ("Need username and domain for NTLMSSP\n"));
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        status = ntlmssp_client_start(NULL,
-                                      global_myname(),
-                                      lp_workgroup(),
-                                      lp_client_ntlmv2_auth(),
-                                      client_ntlmssp_state);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("Could not start NTLMSSP client: %s\n",
-                          nt_errstr(status)));
-                TALLOC_FREE(*client_ntlmssp_state);
-                return status;
-        }
-
-        status = ntlmssp_set_username(*client_ntlmssp_state, opt_username);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("Could not set username: %s\n",
-                          nt_errstr(status)));
-                TALLOC_FREE(*client_ntlmssp_state);
-                return status;
-        }
-
-        status = ntlmssp_set_domain(*client_ntlmssp_state, opt_domain);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("Could not set domain: %s\n",
-                          nt_errstr(status)));
-                TALLOC_FREE(*client_ntlmssp_state);
-                return status;
-        }
-
+static NTSTATUS ntlm_auth_prepare_gensec_client(TALLOC_CTX *mem_ctx,
+                                                struct loadparm_context *lp_ctx,
+                                                struct gensec_security **gensec_security_out)
+{
+        struct gensec_security *gensec_security = NULL;
+        NTSTATUS nt_status;
+        TALLOC_CTX *tmp_ctx;
+        const struct gensec_security_ops **backends = NULL;
+        struct gensec_settings *gensec_settings = NULL;
+        size_t idx = 0;
+
+        tmp_ctx = talloc_new(mem_ctx);
+        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
+
+        gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
+        if (gensec_settings == NULL) {
+                DEBUG(10, ("lpcfg_gensec_settings failed\n"));
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        backends = talloc_zero_array(gensec_settings,
+                                     const struct gensec_security_ops *, 4);
+        if (backends == NULL) {
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+        gensec_settings->backends = backends;
+
+        gensec_init();
+
+        /* These need to be in priority order, krb5 before NTLMSSP */
+#if defined(HAVE_KRB5)
+        backends[idx++] = &gensec_gse_krb5_security_ops;
+#endif
+
+        backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
+
+        backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_SPNEGO);
+
+        nt_status = gensec_client_start(NULL, &gensec_security,
+                                        gensec_settings);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                TALLOC_FREE(tmp_ctx);
+                return nt_status;
+        }
+
+        talloc_unlink(tmp_ctx, gensec_settings);
+
+        if (opt_target_service != NULL) {
+                nt_status = gensec_set_target_service(gensec_security,
+                                                      opt_target_service);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        TALLOC_FREE(tmp_ctx);
+                        return nt_status;
+                }
+        }
+
+        if (opt_target_hostname != NULL) {
+                nt_status = gensec_set_target_hostname(gensec_security,
+                                                       opt_target_hostname);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        TALLOC_FREE(tmp_ctx);
+                        return nt_status;
+                }
+        }
+
+        *gensec_security_out = talloc_steal(mem_ctx, gensec_security);
+        TALLOC_FREE(tmp_ctx);
+        return NT_STATUS_OK;
+}
+
+static struct auth4_context *make_auth4_context_ntlm_auth(TALLOC_CTX *mem_ctx, bool local_pw)
+{
+        struct auth4_context *auth4_context = talloc_zero(mem_ctx, struct auth4_context);
+        if (auth4_context == NULL) {
+                DEBUG(10, ("failed to allocate auth4_context failed\n"));
+                return NULL;
+        }
+        auth4_context->generate_session_info = ntlm_auth_generate_session_info;
+        auth4_context->generate_session_info_pac = ntlm_auth_generate_session_info_pac;
+        auth4_context->get_ntlm_challenge = ntlm_auth_get_challenge;
+        auth4_context->set_ntlm_challenge = ntlm_auth_set_challenge;
+        if (local_pw) {
+                auth4_context->check_ntlm_password = local_pw_check;
+        } else {
+                auth4_context->check_ntlm_password = winbind_pw_check;
+        }
+        auth4_context->private_data = NULL;
+        return auth4_context;
+}
+
+static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx,
+                                                struct loadparm_context *lp_ctx,
+                                                struct gensec_security **gensec_security_out)
+{
+        struct gensec_security *gensec_security;
+        NTSTATUS nt_status;
+
+        TALLOC_CTX *tmp_ctx;
+        const struct gensec_security_ops **backends;
+        struct gensec_settings *gensec_settings;
+        size_t idx = 0;
+        struct cli_credentials *server_credentials;
+        
+        struct auth4_context *auth4_context;
+
+        tmp_ctx = talloc_new(mem_ctx);
+        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
+
+        auth4_context = make_auth4_context_ntlm_auth(tmp_ctx, opt_password);
+        if (auth4_context == NULL) {
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+        
+        gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
+        if (lp_ctx == NULL) {
+                DEBUG(10, ("lpcfg_gensec_settings failed\n"));
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+        
+        /* 
+         * This should be a 'netbios domain -> DNS domain'
+         * mapping, and can currently validly return NULL on
+         * poorly configured systems.
+         *
+         * This is used for the NTLMSSP server
+         *
+         */
         if (opt_password) {
-                status = ntlmssp_set_password(*client_ntlmssp_state, opt_password);
-
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(1, ("Could not set password: %s\n",
-                                  nt_errstr(status)));
-                        TALLOC_FREE(*client_ntlmssp_state);
-                        return status;
-                }
-        }
-
+                gensec_settings->server_netbios_name = lp_netbios_name();
+                gensec_settings->server_netbios_domain = lp_workgroup();
+        } else {
+                gensec_settings->server_netbios_name = get_winbind_netbios_name();
+                gensec_settings->server_netbios_domain = get_winbind_domain();
+        }
+        
+        gensec_settings->server_dns_domain = strlower_talloc(gensec_settings,
+                                                             get_mydnsdomname(talloc_tos()));
+        gensec_settings->server_dns_name = strlower_talloc(gensec_settings,
+                                                           get_mydnsfullname());
+        
+        backends = talloc_zero_array(gensec_settings,
+                                     const struct gensec_security_ops *, 4);
+        
+        if (backends == NULL) {
+                TALLOC_FREE(tmp_ctx);
+                return NT_STATUS_NO_MEMORY;
+        }
+        gensec_settings->backends = backends;
+
+        gensec_init();
+        
+        /* These need to be in priority order, krb5 before NTLMSSP */
+#if defined(HAVE_KRB5)
+        backends[idx++] = &gensec_gse_krb5_security_ops;
+#endif
+
+        backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
+
+        backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_SPNEGO);
+
+        /*
+         * This is anonymous for now, because we just use it
+         * to set the kerberos state at the moment
+         */
+        server_credentials = cli_credentials_init_anon(tmp_ctx);
+        if (!server_credentials) {
+                DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
+        
+        cli_credentials_set_conf(server_credentials, lp_ctx);
+        
+        if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC || lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
+                cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS);
+        } else {
+                cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS);
+        }
+        
+        nt_status = gensec_server_start(tmp_ctx, gensec_settings,
+                                        auth4_context, &gensec_security);
+        
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                TALLOC_FREE(tmp_ctx);
+                return nt_status;
+        }
+        
+        gensec_set_credentials(gensec_security, server_credentials);
+        
+        gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
+        gensec_want_feature(gensec_security, GENSEC_FEATURE_SEAL);
+
+        talloc_unlink(tmp_ctx, lp_ctx);
+        talloc_unlink(tmp_ctx, server_credentials);
+        talloc_unlink(tmp_ctx, gensec_settings);
+        talloc_unlink(tmp_ctx, auth4_context);
+
+        *gensec_security_out = talloc_steal(mem_ctx, gensec_security);
+        TALLOC_FREE(tmp_ctx);
         return NT_STATUS_OK;
 }
 
-static NTSTATUS ntlm_auth_start_ntlmssp_server(struct ntlmssp_state **ntlmssp_state)
-{
-        NTSTATUS status;
-        const char *netbios_name;
-        const char *netbios_domain;
-        const char *dns_name;
-        char *dns_domain;
-        bool is_standalone = false;
-
-        if (opt_password) {
-                netbios_name = global_myname();
-                netbios_domain = lp_workgroup();
-        } else {
-                netbios_name = get_winbind_netbios_name();
-                netbios_domain = get_winbind_domain();
-        }
-        /* This should be a 'netbios domain -> DNS domain' mapping */
-        dns_domain = get_mydnsdomname(talloc_tos());
-        if (dns_domain) {
-                strlower_m(dns_domain);
-        }
-        dns_name = get_mydnsfullname();
-
-        status = ntlmssp_server_start(NULL,
-                                      is_standalone,
-                                      netbios_name,
-                                      netbios_domain,
-                                      dns_name,
-                                      dns_domain,
-                                      ntlmssp_state);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("Could not start NTLMSSP server: %s\n",
-                          nt_errstr(status)));
-                return status;
-        }
-
-        /* Have we been given a local password, or should we ask winbind? */
-        if (opt_password) {
-                (*ntlmssp_state)->check_password = local_pw_check;
-        } else {
-                (*ntlmssp_state)->check_password = winbind_pw_check;
-        }
-        return NT_STATUS_OK;
-}
-
-/*******************************************************************
- Used by firefox to drive NTLM auth to IIS servers.
-*******************************************************************/
-
-static NTSTATUS do_ccache_ntlm_auth(DATA_BLOB initial_msg, DATA_BLOB challenge_msg,
-                                DATA_BLOB *reply)
-{
-        struct winbindd_request wb_request;
-        struct winbindd_response wb_response;
-        int ctrl = 0;
-        NSS_STATUS result;
-
-        /* get winbindd to do the ntlmssp step on our behalf */
-        ZERO_STRUCT(wb_request);
-        ZERO_STRUCT(wb_response);
-
-        /*
-         * This is tricky here. If we set krb5_auth in pam_winbind.conf
-         * creds for users in trusted domain will be stored the winbindd
-         * child of the trusted domain. If we ask the primary domain for
-         * ntlm_ccache_auth, it will fail. So, we have to ask the trusted
-         * domain's child for ccache_ntlm_auth. that is to say, we have to 
-         * set WBFLAG_PAM_CONTACT_TRUSTDOM in request.flags.
-         */
-        ctrl = get_pam_winbind_config();
-
-        if (ctrl & WINBIND_KRB5_AUTH) {
-                wb_request.flags |= WBFLAG_PAM_CONTACT_TRUSTDOM;
-        }
-
-        fstr_sprintf(wb_request.data.ccache_ntlm_auth.user,
-                "%s%c%s", opt_domain, winbind_separator(), opt_username);
-        wb_request.data.ccache_ntlm_auth.uid = geteuid();
-        wb_request.data.ccache_ntlm_auth.initial_blob_len = initial_msg.length;
-        wb_request.data.ccache_ntlm_auth.challenge_blob_len = challenge_msg.length;
-        wb_request.extra_len = initial_msg.length + challenge_msg.length;
-
-        if (wb_request.extra_len > 0) {
-                wb_request.extra_data.data = SMB_MALLOC_ARRAY(char, wb_request.extra_len);
-                if (wb_request.extra_data.data == NULL) {
-                        return NT_STATUS_NO_MEMORY;
-                }
-
-                memcpy(wb_request.extra_data.data, initial_msg.data, initial_msg.length);
-                memcpy(wb_request.extra_data.data + initial_msg.length,
-                        challenge_msg.data, challenge_msg.length);
-        }
-
-        result = winbindd_request_response(WINBINDD_CCACHE_NTLMAUTH, &wb_request, &wb_response);
-        SAFE_FREE(wb_request.extra_data.data);
-
-        if (result != NSS_STATUS_SUCCESS) {
-                winbindd_free_response(&wb_response);
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        if (reply) {
-                *reply = data_blob(wb_response.extra_data.data,
-                                wb_response.data.ccache_ntlm_auth.auth_blob_len);
-                if (wb_response.data.ccache_ntlm_auth.auth_blob_len > 0 &&
-                                reply->data == NULL) {
-                        winbindd_free_response(&wb_response);
-                        return NT_STATUS_NO_MEMORY;
-                }
-        }
-
-        winbindd_free_response(&wb_response);
-        return NT_STATUS_MORE_PROCESSING_REQUIRED;
-}
-
-static void manage_squid_ntlmssp_request_int(struct ntlm_auth_state *state,
-                                             char *buf, int length,
-                                             TALLOC_CTX *mem_ctx,
-                                             char **response)
-{
-        DATA_BLOB request, reply;
-        NTSTATUS nt_status;
-
-        if (strlen(buf) < 2) {
-                DEBUG(1, ("NTLMSSP query [%s] invalid\n", buf));
-                *response = talloc_strdup(mem_ctx, "BH NTLMSSP query invalid");
-                return;
-        }
-
-        if (strlen(buf) > 3) {
-                if(strncmp(buf, "SF ", 3) == 0){
-                        DEBUG(10, ("Setting flags to negotioate\n"));
-                        TALLOC_FREE(state->want_feature_list);
-                        state->want_feature_list = talloc_strdup(state->mem_ctx,
-                                        buf+3);
-                        *response = talloc_strdup(mem_ctx, "OK");
-                        return;
-                }
-                request = base64_decode_data_blob(buf + 3);
-        } else {
-                request = data_blob_null;
-        }
-
-        if ((strncmp(buf, "PW ", 3) == 0)) {
-                /* The calling application wants us to use a local password
-                 * (rather than winbindd) */
-
-                opt_password = SMB_STRNDUP((const char *)request.data,
-                                request.length);
-
-                if (opt_password == NULL) {
-                        DEBUG(1, ("Out of memory\n"));
-                        *response = talloc_strdup(mem_ctx, "BH Out of memory");
-                        data_blob_free(&request);
-                        return;
-                }
-
-                *response = talloc_strdup(mem_ctx, "OK");
-                data_blob_free(&request);
-                return;
-        }
-
-        if (strncmp(buf, "YR", 2) == 0) {
-                TALLOC_FREE(state->ntlmssp_state);
-                state->svr_state = SERVER_INITIAL;
-        } else if (strncmp(buf, "KK", 2) == 0) {
-                /* No special preprocessing required */
-        } else if (strncmp(buf, "GF", 2) == 0) {
-                DEBUG(10, ("Requested negotiated NTLMSSP flags\n"));
-
-                if (state->svr_state == SERVER_FINISHED) {
-                        *response = talloc_asprintf(mem_ctx, "GF 0x%08x",
-                                                 state->neg_flags);
-                }
-                else {
-                        *response = talloc_strdup(mem_ctx, "BH\n");
-                }
-                data_blob_free(&request);
-                return;
-        } else if (strncmp(buf, "GK", 2) == 0) {
-                DEBUG(10, ("Requested NTLMSSP session key\n"));
-                if(state->have_session_key) {
-                        char *key64 = base64_encode_data_blob(state->mem_ctx,
-                                        state->session_key);
-                        *response = talloc_asprintf(mem_ctx, "GK %s",
-                                                 key64 ? key64 : "<NULL>");
-                        TALLOC_FREE(key64);
-                } else {
-                        *response = talloc_strdup(mem_ctx, "BH");
-                }
-
-                data_blob_free(&request);
-                return;
-        } else {
-                DEBUG(1, ("NTLMSSP query [%s] invalid\n", buf));
-                *response = talloc_strdup(mem_ctx, "BH NTLMSSP query invalid");
-                return;
-        }
-
-        if (!state->ntlmssp_state) {
-                nt_status = ntlm_auth_start_ntlmssp_server(
-                                &state->ntlmssp_state);
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        *response = talloc_asprintf(
-                                mem_ctx, "BH %s", nt_errstr(nt_status));
-                        return;
-                }
-                ntlmssp_want_feature_list(state->ntlmssp_state,
-                                state->want_feature_list);
-        }
-
-        DEBUG(10, ("got NTLMSSP packet:\n"));
-        dump_data(10, request.data, request.length);
-
-        nt_status = ntlmssp_update(state->ntlmssp_state, request, &reply);
-
-        if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-                char *reply_base64 = base64_encode_data_blob(state->mem_ctx,
-                                reply);
-                *response = talloc_asprintf(mem_ctx, "TT %s", reply_base64);
-                TALLOC_FREE(reply_base64);
-                data_blob_free(&reply);
-                state->svr_state = SERVER_CHALLENGE;
-                DEBUG(10, ("NTLMSSP challenge\n"));
-        } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) {
-                *response = talloc_asprintf(mem_ctx, "BH %s",
-                                         nt_errstr(nt_status));
-                DEBUG(0, ("NTLMSSP BH: %s\n", nt_errstr(nt_status)));
-
-                TALLOC_FREE(state->ntlmssp_state);
-        } else if (!NT_STATUS_IS_OK(nt_status)) {
-                *response = talloc_asprintf(mem_ctx, "NA %s",
-                                         nt_errstr(nt_status));
-                DEBUG(10, ("NTLMSSP %s\n", nt_errstr(nt_status)));
-        } else {
-                *response = talloc_asprintf(
-                        mem_ctx, "AF %s",
-                        (char *)state->ntlmssp_state->callback_private);
-                DEBUG(10, ("NTLMSSP OK!\n"));
-
-                if(state->have_session_key)
-                        data_blob_free(&state->session_key);
-                state->session_key = data_blob(
-                                state->ntlmssp_state->session_key.data,
-                                state->ntlmssp_state->session_key.length);
-                state->neg_flags = state->ntlmssp_state->neg_flags;
-                state->have_session_key = true;
-                state->svr_state = SERVER_FINISHED;
-        }
-
-        data_blob_free(&request);
-}
-
-static void manage_squid_ntlmssp_request(struct ntlm_auth_state *state,
-                                         char *buf, int length)
-{
-        char *response;
-
-        manage_squid_ntlmssp_request_int(state, buf, length,
-                                         talloc_tos(), &response);
-
-        if (response == NULL) {
-                x_fprintf(x_stdout, "BH Out of memory\n");
-                return;
-        }
-        x_fprintf(x_stdout, "%s\n", response);
-        TALLOC_FREE(response);
-}
-
-static void manage_client_ntlmssp_request(struct ntlm_auth_state *state,
-                                                char *buf, int length)
-{
-        DATA_BLOB request, reply;
-        NTSTATUS nt_status;
-
-        if (!opt_username || !*opt_username) {
-                x_fprintf(x_stderr, "username must be specified!\n\n");
-                exit(1);
-        }
-
-        if (strlen(buf) < 2) {
-                DEBUG(1, ("NTLMSSP query [%s] invalid\n", buf));
-                x_fprintf(x_stdout, "BH NTLMSSP query invalid\n");
-                return;
-        }
-
-        if (strlen(buf) > 3) {
-                if(strncmp(buf, "SF ", 3) == 0) {
-                        DEBUG(10, ("Looking for flags to negotiate\n"));
-                        talloc_free(state->want_feature_list);
-                        state->want_feature_list = talloc_strdup(state->mem_ctx,
-                                        buf+3);
-                        x_fprintf(x_stdout, "OK\n");
-                        return;
-                }
-                request = base64_decode_data_blob(buf + 3);
-        } else {
-                request = data_blob_null;
-        }
-
-        if (strncmp(buf, "PW ", 3) == 0) {
-                /* We asked for a password and obviously got it :-) */
-
-                opt_password = SMB_STRNDUP((const char *)request.data,
-                                request.length);
-
-                if (opt_password == NULL) {
-                        DEBUG(1, ("Out of memory\n"));
-                        x_fprintf(x_stdout, "BH Out of memory\n");
-                        data_blob_free(&request);
-                        return;
-                }
-
-                x_fprintf(x_stdout, "OK\n");
-                data_blob_free(&request);
-                return;
-        }
-
-        if (!state->ntlmssp_state && use_cached_creds) {
-                /* check whether cached credentials are usable. */
-                DATA_BLOB empty_blob = data_blob_null;
-
-                nt_status = do_ccache_ntlm_auth(empty_blob, empty_blob, NULL);
-                if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-                        /* failed to use cached creds */
-                        use_cached_creds = False;
-                }
-        }
-
-        if (opt_password == NULL && !use_cached_creds) {
-                /* Request a password from the calling process.  After
-                   sending it, the calling process should retry asking for the
-                   negotiate. */
-
-                DEBUG(10, ("Requesting password\n"));
-                x_fprintf(x_stdout, "PW\n");
-                return;
-        }
-
-        if (strncmp(buf, "YR", 2) == 0) {
-                TALLOC_FREE(state->ntlmssp_state);
-                state->cli_state = CLIENT_INITIAL;
-        } else if (strncmp(buf, "TT", 2) == 0) {
-                /* No special preprocessing required */
-        } else if (strncmp(buf, "GF", 2) == 0) {
-                DEBUG(10, ("Requested negotiated NTLMSSP flags\n"));
-
-                if(state->cli_state == CLIENT_FINISHED) {
-                        x_fprintf(x_stdout, "GF 0x%08x\n", state->neg_flags);
-                }
-                else {
-                        x_fprintf(x_stdout, "BH\n");
-                }
-
-                data_blob_free(&request);
-                return;
-        } else if (strncmp(buf, "GK", 2) == 0 ) {
-                DEBUG(10, ("Requested session key\n"));
-
-                if(state->cli_state == CLIENT_FINISHED) {
-                        char *key64 = base64_encode_data_blob(state->mem_ctx,
-                                        state->session_key);
-                        x_fprintf(x_stdout, "GK %s\n", key64?key64:"<NULL>");
-                        TALLOC_FREE(key64);
-                }
-                else {
-                        x_fprintf(x_stdout, "BH\n");
-                }
-
-                data_blob_free(&request);
-                return;
-        } else {
-                DEBUG(1, ("NTLMSSP query [%s] invalid\n", buf));
-                x_fprintf(x_stdout, "BH NTLMSSP query invalid\n");
-                return;
-        }
-
-        if (!state->ntlmssp_state) {
-                nt_status = ntlm_auth_start_ntlmssp_client(
-                                &state->ntlmssp_state);
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
-                        return;
-                }
-                ntlmssp_want_feature_list(state->ntlmssp_state,
-                                state->want_feature_list);
-                state->initial_message = data_blob_null;
-        }
-
-        DEBUG(10, ("got NTLMSSP packet:\n"));
-        dump_data(10, request.data, request.length);
-
-        if (use_cached_creds && !opt_password &&
-                        (state->cli_state == CLIENT_RESPONSE)) {
-                nt_status = do_ccache_ntlm_auth(state->initial_message, request,
-                                &reply);
-        } else {
-                nt_status = ntlmssp_update(state->ntlmssp_state, request,
-                                &reply);
-        }
-
-        if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-                char *reply_base64 = base64_encode_data_blob(state->mem_ctx,
-                                reply);
-                if (state->cli_state == CLIENT_INITIAL) {
-                        x_fprintf(x_stdout, "YR %s\n", reply_base64);
-                        state->initial_message = reply;
-                        state->cli_state = CLIENT_RESPONSE;
-                } else {
-                        x_fprintf(x_stdout, "KK %s\n", reply_base64);
-                        data_blob_free(&reply);
-                }
-                TALLOC_FREE(reply_base64);
-                DEBUG(10, ("NTLMSSP challenge\n"));
-        } else if (NT_STATUS_IS_OK(nt_status)) {
-                char *reply_base64 = base64_encode_data_blob(talloc_tos(),
-                                reply);
-                x_fprintf(x_stdout, "AF %s\n", reply_base64);
-                TALLOC_FREE(reply_base64);
-
-                if(state->have_session_key)
-                        data_blob_free(&state->session_key);
-
-                state->session_key = data_blob(
-                                state->ntlmssp_state->session_key.data,
-                                state->ntlmssp_state->session_key.length);
-                state->neg_flags = state->ntlmssp_state->neg_flags;
-                state->have_session_key = true;
-
-                DEBUG(10, ("NTLMSSP OK!\n"));
-                state->cli_state = CLIENT_FINISHED;
-                TALLOC_FREE(state->ntlmssp_state);
-        } else {
-                x_fprintf(x_stdout, "BH %s\n", nt_errstr(nt_status));
-                DEBUG(0, ("NTLMSSP BH: %s\n", nt_errstr(nt_status)));
-                state->cli_state = CLIENT_ERROR;
-                TALLOC_FREE(state->ntlmssp_state);
-        }
-
-        data_blob_free(&request);
-}
-
-static void manage_squid_basic_request(struct ntlm_auth_state *state,
-                                        char *buf, int length)
+static void manage_client_ntlmssp_request(enum stdio_helper_mode stdio_helper_mode,
+                                   struct loadparm_context *lp_ctx,
+                                   struct ntlm_auth_state *state,
+                                                char *buf, int length, void **private2)
+{
+        manage_gensec_request(stdio_helper_mode, lp_ctx, buf, length, &state->gensec_private_1);
+        return;
+}
+
+static void manage_squid_basic_request(enum stdio_helper_mode stdio_helper_mode,
+                                   struct loadparm_context *lp_ctx,
+                                   struct ntlm_auth_state *state,
+                                        char *buf, int length, void **private2)
 {
         char *user, *pass;      
@@ -1171 +1220 @@
 }
 
-static void offer_gss_spnego_mechs(void) {
-
-        DATA_BLOB token;
-        struct spnego_data spnego;
-        ssize_t len;
-        char *reply_base64;
-        TALLOC_CTX *ctx = talloc_tos();
-        char *principal;
-        char *myname_lower;
-
-        ZERO_STRUCT(spnego);
-
-        myname_lower = talloc_strdup(ctx, global_myname());
-        if (!myname_lower) {
+static void manage_gensec_request(enum stdio_helper_mode stdio_helper_mode,
+                                  struct loadparm_context *lp_ctx,
+                                  char *buf, int length, void **private1)
+{
+        DATA_BLOB in;
+        DATA_BLOB out = data_blob(NULL, 0);
+        char *out_base64 = NULL;
+        const char *reply_arg = NULL;
+        struct gensec_ntlm_state {
+                struct gensec_security *gensec_state;
+                const char *set_password;
+        };
+        struct gensec_ntlm_state *state;
+
+        NTSTATUS nt_status;
+        bool first = false;
+        const char *reply_code;
+        struct cli_credentials *creds;
+
+        static char *want_feature_list = NULL;
+        static DATA_BLOB session_key;
+
+        TALLOC_CTX *mem_ctx;
+
+        if (*private1) {
+                state = (struct gensec_ntlm_state *)*private1;
+        } else {
+                state = talloc_zero(NULL, struct gensec_ntlm_state);
+                if (!state) {
+                        x_fprintf(x_stdout, "BH No Memory\n");
+                        exit(1);
+                }
+                *private1 = state;
+                if (opt_password) {
+                        state->set_password = opt_password;
+                }
+        }
+
+        if (strlen(buf) < 2) {
+                DEBUG(1, ("query [%s] invalid", buf));
+                x_fprintf(x_stdout, "BH Query invalid\n");
                 return;
         }
-        strlower_m(myname_lower);
-
-        principal = talloc_asprintf(ctx, "%s$@%s", myname_lower, lp_realm());
-        if (!principal) {
+
+        if (strlen(buf) > 3) {
+                if(strncmp(buf, "SF ", 3) == 0) {
+                        DEBUG(10, ("Setting flags to negotiate\n"));
+                        talloc_free(want_feature_list);
+                        want_feature_list = talloc_strndup(state, buf+3, strlen(buf)-3);
+                        x_fprintf(x_stdout, "OK\n");
+                        return;
+                }
+                in = base64_decode_data_blob(buf + 3);
+        } else {
+                in = data_blob(NULL, 0);
+        }
+
+        if (strncmp(buf, "YR", 2) == 0) {
+                if (state->gensec_state) {
+                        talloc_free(state->gensec_state);
+                        state->gensec_state = NULL;
+                }
+        } else if ( (strncmp(buf, "OK", 2) == 0)) {
+                /* Just return BH, like ntlm_auth from Samba 3 does. */
+                x_fprintf(x_stdout, "BH Command expected\n");
+                data_blob_free(&in);
                 return;
-        }
-
-        /* Server negTokenInit (mech offerings) */
-        spnego.type = SPNEGO_NEG_TOKEN_INIT;
-        spnego.negTokenInit.mechTypes = talloc_array(ctx, const char *, 4);
-#ifdef HAVE_KRB5
-        spnego.negTokenInit.mechTypes[0] = talloc_strdup(ctx, OID_KERBEROS5_OLD);
-        spnego.negTokenInit.mechTypes[1] = talloc_strdup(ctx, OID_KERBEROS5);
-        spnego.negTokenInit.mechTypes[2] = talloc_strdup(ctx, OID_NTLMSSP);
-        spnego.negTokenInit.mechTypes[3] = NULL;
-#else
-        spnego.negTokenInit.mechTypes[0] = talloc_strdup(ctx, OID_NTLMSSP);
-        spnego.negTokenInit.mechTypes[1] = NULL;
-#endif
-
-
-        spnego.negTokenInit.mechListMIC = data_blob_talloc(ctx, principal,
-                                                    strlen(principal));
-
-        len = spnego_write_data(ctx, &token, &spnego);
-        spnego_free_data(&spnego);
-
-        if (len == -1) {
-                DEBUG(1, ("Could not write SPNEGO data blob\n"));
-                x_fprintf(x_stdout, "BH Could not write SPNEGO data blob\n");
+        } else if ( (strncmp(buf, "TT ", 3) != 0) &&
+                    (strncmp(buf, "KK ", 3) != 0) &&
+                    (strncmp(buf, "AF ", 3) != 0) &&
+                    (strncmp(buf, "NA ", 3) != 0) &&
+                    (strncmp(buf, "UG", 2) != 0) &&
+                    (strncmp(buf, "PW ", 3) != 0) &&
+                    (strncmp(buf, "GK", 2) != 0) &&
+                    (strncmp(buf, "GF", 2) != 0)) {
+                DEBUG(1, ("SPNEGO request [%s] invalid prefix\n", buf));
+                x_fprintf(x_stdout, "BH SPNEGO request invalid prefix\n");
+                data_blob_free(&in);
                 return;
         }
 
-        reply_base64 = base64_encode_data_blob(talloc_tos(), token);
-        x_fprintf(x_stdout, "TT %s *\n", reply_base64);
-
-        TALLOC_FREE(reply_base64);
-        data_blob_free(&token);
-        DEBUG(10, ("sent SPNEGO negTokenInit\n"));
-        return;
-}
-
-bool spnego_parse_krb5_wrap(TALLOC_CTX *ctx, DATA_BLOB blob, DATA_BLOB *ticket, uint8 tok_id[2])
-{
-        bool ret;
-        ASN1_DATA *data;
-        int data_remaining;
-
-        data = asn1_init(talloc_tos());
-        if (data == NULL) {
-                return false;
-        }
-
-        asn1_load(data, blob);
-        asn1_start_tag(data, ASN1_APPLICATION(0));
-        asn1_check_OID(data, OID_KERBEROS5);
-
-        data_remaining = asn1_tag_remaining(data);
-
-        if (data_remaining < 3) {
-                data->has_error = True;
+        mem_ctx = talloc_named(NULL, 0, "manage_gensec_request internal mem_ctx");
+
+        /* setup gensec */
+        if (!(state->gensec_state)) {
+                switch (stdio_helper_mode) {
+                case GSS_SPNEGO_CLIENT:
+                        /*
+                         * cached credentials are only supported by
+                         * NTLMSSP_CLIENT_1 for now.
+                         */
+                        use_cached_creds = false;
+                        /* fall through */
+                case NTLMSSP_CLIENT_1:
+                        /* setup the client side */
+
+                        if (state->set_password != NULL) {
+                                use_cached_creds = false;
+                        }
+
+                        if (use_cached_creds) {
+                                struct wbcCredentialCacheParams params;
+                                struct wbcCredentialCacheInfo *info = NULL;
+                                struct wbcAuthErrorInfo *error = NULL;
+                                wbcErr wbc_status;
+
+                                params.account_name = opt_username;
+                                params.domain_name = opt_domain;
+                                params.level = WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP;
+                                params.num_blobs = 0;
+                                params.blobs = NULL;
+
+                                wbc_status = wbcCredentialCache(&params, &info,
+                                                                &error);
+                                wbcFreeMemory(error);
+                                if (!WBC_ERROR_IS_OK(wbc_status)) {
+                                        use_cached_creds = false;
+                                }
+                                wbcFreeMemory(info);
+                        }
+
+                        nt_status = ntlm_auth_prepare_gensec_client(state, lp_ctx,
+                                                                    &state->gensec_state);
+                        if (!NT_STATUS_IS_OK(nt_status)) {
+                                x_fprintf(x_stdout, "BH GENSEC mech failed to start: %s\n", nt_errstr(nt_status));
+                                talloc_free(mem_ctx);
+                                return;
+                        }
+
+                        creds = cli_credentials_init(state->gensec_state);
+                        cli_credentials_set_conf(creds, lp_ctx);
+                        if (opt_username) {
+                                cli_credentials_set_username(creds, opt_username, CRED_SPECIFIED);
+                        }
+                        if (opt_domain) {
+                                cli_credentials_set_domain(creds, opt_domain, CRED_SPECIFIED);
+                        }
+                        if (use_cached_creds) {
+                                gensec_want_feature(state->gensec_state,
+                                                    GENSEC_FEATURE_NTLM_CCACHE);
+                        } else if (state->set_password) {
+                                cli_credentials_set_password(creds, state->set_password, CRED_SPECIFIED);
+                        } else {
+                                cli_credentials_set_password_callback(creds, get_password);
+                        }
+                        if (opt_workstation) {
+                                cli_credentials_set_workstation(creds, opt_workstation, CRED_SPECIFIED);
+                        }
+
+                        gensec_set_credentials(state->gensec_state, creds);
+
+                        break;
+                case GSS_SPNEGO_SERVER:
+                case SQUID_2_5_NTLMSSP:
+                {
+                        nt_status = ntlm_auth_prepare_gensec_server(state, lp_ctx,
+                                                                    &state->gensec_state);
+                        if (!NT_STATUS_IS_OK(nt_status)) {
+                                x_fprintf(x_stdout, "BH GENSEC mech failed to start: %s\n", nt_errstr(nt_status));
+                                talloc_free(mem_ctx);
+                                return;
+                        }
+                        break;
+                }
+                default:
+                        talloc_free(mem_ctx);
+                        abort();
+                }
+
+                gensec_want_feature_list(state->gensec_state, want_feature_list);
+
+                switch (stdio_helper_mode) {
+                case GSS_SPNEGO_CLIENT:
+                case GSS_SPNEGO_SERVER:
+                        nt_status = gensec_start_mech_by_oid(state->gensec_state, GENSEC_OID_SPNEGO);
+                        if (!in.length) {
+                                first = true;
+                        }
+                        break;
+                case NTLMSSP_CLIENT_1:
+                        if (!in.length) {
+                                first = true;
+                        }
+                        /* fall through */
+                case SQUID_2_5_NTLMSSP:
+                        nt_status = gensec_start_mech_by_oid(state->gensec_state, GENSEC_OID_NTLMSSP);
+                        break;
+                default:
+                        talloc_free(mem_ctx);
+                        abort();
+                }
+
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        DEBUG(1, ("GENSEC mech failed to start: %s\n", nt_errstr(nt_status)));
+                        x_fprintf(x_stdout, "BH GENSEC mech failed to start\n");
+                        talloc_free(mem_ctx);
+                        return;
+                }
+
+        }
+
+        /* update */
+
+        if (strncmp(buf, "PW ", 3) == 0) {
+                state->set_password = talloc_strndup(state,
+                                                     (const char *)in.data,
+                                                     in.length);
+
+                cli_credentials_set_password(gensec_get_credentials(state->gensec_state),
+                                             state->set_password,
+                                             CRED_SPECIFIED);
+                x_fprintf(x_stdout, "OK\n");
+                data_blob_free(&in);
+                talloc_free(mem_ctx);
+                return;
+        }
+
+        if (strncmp(buf, "GK", 2) == 0) {
+                char *base64_key;
+                DEBUG(10, ("Requested session key\n"));
+                nt_status = gensec_session_key(state->gensec_state, mem_ctx, &session_key);
+                if(!NT_STATUS_IS_OK(nt_status)) {
+                        DEBUG(1, ("gensec_session_key failed: %s\n", nt_errstr(nt_status)));
+                        x_fprintf(x_stdout, "BH No session key\n");
+                        talloc_free(mem_ctx);
+                        return;
+                } else {
+                        base64_key = base64_encode_data_blob(state, session_key);
+                        x_fprintf(x_stdout, "GK %s\n", base64_key);
+                        talloc_free(base64_key);
+                }
+                talloc_free(mem_ctx);
+                return;
+        }
+
+        if (strncmp(buf, "GF", 2) == 0) {
+                uint32_t neg_flags;
+
+                DEBUG(10, ("Requested negotiated NTLMSSP feature flags\n"));
+
+                neg_flags = gensec_ntlmssp_neg_flags(state->gensec_state);
+                if (neg_flags == 0) {
+                        x_fprintf(x_stdout, "BH\n");
+                        return;
+                }
+
+                x_fprintf(x_stdout, "GF 0x%08x\n", neg_flags);
+                return;
+        }
+
+        nt_status = gensec_update(state->gensec_state, mem_ctx, in, &out);
+
+        /* don't leak 'bad password'/'no such user' info to the network client */
+        nt_status = nt_status_squash(nt_status);
+
+        if (out.length) {
+                out_base64 = base64_encode_data_blob(mem_ctx, out);
         } else {
-                asn1_read(data, tok_id, 2);
-                data_remaining -= 2;
-                *ticket = data_blob_talloc(ctx, NULL, data_remaining);
-                asn1_read(data, ticket->data, ticket->length);
-        }
-
-        asn1_end_tag(data);
-
-        ret = !data->has_error;
-
-        if (data->has_error) {
-                data_blob_free(ticket);
-        }
-
-        asn1_free(data);
-
-        return ret;
-}
-
-static void manage_gss_spnego_request(struct ntlm_auth_state *state,
-                                        char *buf, int length)
-{
-        struct spnego_data request, response;
-        DATA_BLOB token;
-        DATA_BLOB raw_in_token = data_blob_null;
-        DATA_BLOB raw_out_token = data_blob_null;
-        NTSTATUS status;
-        ssize_t len;
-        TALLOC_CTX *ctx = talloc_tos();
-
-        char *user = NULL;
-        char *domain = NULL;
-
-        const char *reply_code;
-        char       *reply_base64;
-        char *reply_argument = NULL;
-        char *supportedMech = NULL;
-
-        if (strlen(buf) < 2) {
-                DEBUG(1, ("SPENGO query [%s] invalid\n", buf));
-                x_fprintf(x_stdout, "BH SPENGO query invalid\n");
-                return;
-        }
-
-        if (strncmp(buf, "YR", 2) == 0) {
-                TALLOC_FREE(state->ntlmssp_state);
-                TALLOC_FREE(state->spnego_mech);
-                TALLOC_FREE(state->spnego_mech_oid);
-        } else if (strncmp(buf, "KK", 2) == 0) {
-                ;
+                out_base64 = NULL;
+        }
+
+        if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+                reply_arg = "*";
+                if (first && state->gensec_state->gensec_role == GENSEC_CLIENT) {
+                        reply_code = "YR";
+                } else if (state->gensec_state->gensec_role == GENSEC_CLIENT) {
+                        reply_code = "KK";
+                } else if (state->gensec_state->gensec_role == GENSEC_SERVER) {
+                        reply_code = "TT";
+                } else {
+                        abort();
+                }
+
+
+        } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) {
+                reply_code = "BH NT_STATUS_ACCESS_DENIED";
+                reply_arg = nt_errstr(nt_status);
+                DEBUG(1, ("GENSEC login failed: %s\n", nt_errstr(nt_status)));
+        } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_UNSUCCESSFUL)) {
+                reply_code = "BH NT_STATUS_UNSUCCESSFUL";
+                reply_arg = nt_errstr(nt_status);
+                DEBUG(1, ("GENSEC login failed: %s\n", nt_errstr(nt_status)));
+        } else if (!NT_STATUS_IS_OK(nt_status)) {
+                reply_code = "NA";
+                reply_arg = nt_errstr(nt_status);
+                DEBUG(1, ("GENSEC login failed: %s\n", nt_errstr(nt_status)));
+        } else if /* OK */ (state->gensec_state->gensec_role == GENSEC_SERVER) {
+                struct auth_session_info *session_info;
+
+                nt_status = gensec_session_info(state->gensec_state, mem_ctx, &session_info);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        reply_code = "BH Failed to retrive session info";
+                        reply_arg = nt_errstr(nt_status);
+                        DEBUG(1, ("GENSEC failed to retrieve the session info: %s\n", nt_errstr(nt_status)));
+                } else {
+
+                        reply_code = "AF";
+                        reply_arg = talloc_strdup(state->gensec_state, session_info->unix_info->unix_name);
+                        if (reply_arg == NULL) {
+                                reply_code = "BH out of memory";
+                                reply_arg = nt_errstr(NT_STATUS_NO_MEMORY);
+                        }
+                        talloc_free(session_info);
+                }
+        } else if (state->gensec_state->gensec_role == GENSEC_CLIENT) {
+                reply_code = "AF";
+                reply_arg = out_base64;
         } else {
-                DEBUG(1, ("SPENGO query [%s] invalid\n", buf));
-                x_fprintf(x_stdout, "BH SPENGO query invalid\n");
-                return;
-        }
-
-        if ( (strlen(buf) == 2)) {
-
-                /* no client data, get the negTokenInit offering
-                   mechanisms */
-
-                offer_gss_spnego_mechs();
-                return;
-        }
-
-        /* All subsequent requests have a blob. This might be negTokenInit or negTokenTarg */
-
-        if (strlen(buf) <= 3) {
-                DEBUG(1, ("GSS-SPNEGO query [%s] invalid\n", buf));
-                x_fprintf(x_stdout, "BH GSS-SPNEGO query invalid\n");
-                return;
-        }
-
-        token = base64_decode_data_blob(buf + 3);
-
-        if ((token.length >= 7)
-            && (strncmp((char *)token.data, "NTLMSSP", 7) == 0)) {
-                char *reply;
-
-                data_blob_free(&token);
-
-                DEBUG(10, ("Could not parse GSS-SPNEGO, trying raw "
-                           "ntlmssp\n"));
-
-                manage_squid_ntlmssp_request_int(state, buf, length,
-                                                 talloc_tos(), &reply);
-                if (reply == NULL) {
-                        x_fprintf(x_stdout, "BH Out of memory\n");
-                        return;
-                }
-
-                if (strncmp(reply, "AF ", 3) == 0) {
-                        x_fprintf(x_stdout, "AF * %s\n", reply+3);
-                } else {
-                        x_fprintf(x_stdout, "%s *\n", reply);
-                }
-
-                TALLOC_FREE(reply);
-                return;
-        }
-
-        ZERO_STRUCT(request);
-        len = spnego_read_data(ctx, token, &request);
-        data_blob_free(&token);
-
-        if (len == -1) {
-                DEBUG(1, ("GSS-SPNEGO query [%s] invalid\n", buf));
-                x_fprintf(x_stdout, "BH GSS-SPNEGO query invalid\n");
-                return;
-        }
-
-        if (request.type == SPNEGO_NEG_TOKEN_INIT) {
-#ifdef HAVE_KRB5
-                int krb5_idx = -1;
-#endif
-                int ntlm_idx = -1;
-                int used_idx = -1;
-                int i;
-
-                if (state->spnego_mech) {
-                        DEBUG(1, ("Client restarted SPNEGO with NegTokenInit "
-                                  "while mech[%s] was already negotiated\n",
-                                  state->spnego_mech));
-                        x_fprintf(x_stdout, "BH Client send NegTokenInit twice\n");
-                        return;
-                }
-
-                /* Second request from Client. This is where the
-                   client offers its mechanism to use. */
-
-                if ( (request.negTokenInit.mechTypes == NULL) ||
-                     (request.negTokenInit.mechTypes[0] == NULL) ) {
-                        DEBUG(1, ("Client did not offer any mechanism\n"));
-                        x_fprintf(x_stdout, "BH Client did not offer any "
-                                            "mechanism\n");
-                        return;
-                }
-
-                status = NT_STATUS_UNSUCCESSFUL;
-                for (i = 0; request.negTokenInit.mechTypes[i] != NULL; i++) {
-                        DEBUG(10,("got mech[%d][%s]\n",
-                                i, request.negTokenInit.mechTypes[i]));
-#ifdef HAVE_KRB5
-                        if (strcmp(request.negTokenInit.mechTypes[i], OID_KERBEROS5_OLD) == 0) {
-                                krb5_idx = i;
-                                break;
-                        }
-                        if (strcmp(request.negTokenInit.mechTypes[i], OID_KERBEROS5) == 0) {
-                                krb5_idx = i;
-                                break;
-                        }
-#endif
-                        if (strcmp(request.negTokenInit.mechTypes[i], OID_NTLMSSP) == 0) {
-                                ntlm_idx = i;
-                                break;
-                        }
-                }
-
-                used_idx = ntlm_idx;
-#ifdef HAVE_KRB5
-                if (krb5_idx != -1) {
-                        ntlm_idx = -1;
-                        used_idx = krb5_idx;
-                }
-#endif
-                if (ntlm_idx > -1) {
-                        state->spnego_mech = talloc_strdup(state, "ntlmssp");
-                        if (state->spnego_mech == NULL) {
-                                x_fprintf(x_stdout, "BH Out of memory\n");
-                                return;
-                        }
-
-                        if (state->ntlmssp_state) {
-                                DEBUG(1, ("Client wants a new NTLMSSP challenge, but "
-                                          "already got one\n"));
-                                x_fprintf(x_stdout, "BH Client wants a new "
-                                                    "NTLMSSP challenge, but "
-                                                    "already got one\n");
-                                TALLOC_FREE(state->ntlmssp_state);
-                                return;
-                        }
-
-                        status = ntlm_auth_start_ntlmssp_server(&state->ntlmssp_state);
-                        if (!NT_STATUS_IS_OK(status)) {
-                                x_fprintf(x_stdout, "BH %s\n", nt_errstr(status));
-                                return;
-                        }
-                }
-
-#ifdef HAVE_KRB5
-                if (krb5_idx > -1) {
-                        state->spnego_mech = talloc_strdup(state, "krb5");
-                        if (state->spnego_mech == NULL) {
-                                x_fprintf(x_stdout, "BH Out of memory\n");
-                                return;
-                        }
-                }
-#endif
-                if (used_idx > -1) {
-                        state->spnego_mech_oid = talloc_strdup(state,
-                                request.negTokenInit.mechTypes[used_idx]);
-                        if (state->spnego_mech_oid == NULL) {
-                                x_fprintf(x_stdout, "BH Out of memory\n");
-                                return;
-                        }
-                        supportedMech = talloc_strdup(ctx, state->spnego_mech_oid);
-                        if (supportedMech == NULL) {
-                                x_fprintf(x_stdout, "BH Out of memory\n");
-                                return;
-                        }
-
-                        status = NT_STATUS_MORE_PROCESSING_REQUIRED;
-                } else {
-                        status = NT_STATUS_NOT_SUPPORTED;
-                }
-                if (used_idx == 0) {
-                        status = NT_STATUS_OK;
-                        raw_in_token = request.negTokenInit.mechToken;
-                }
-        } else {
-                if (state->spnego_mech == NULL) {
-                        DEBUG(1,("Got netTokenTarg without negTokenInit\n"));
-                        x_fprintf(x_stdout, "BH Got a negTokenTarg without "
-                                            "negTokenInit\n");
-                        return;
-                }
-
-                if ((request.negTokenTarg.supportedMech != NULL) &&
-                     (strcmp(request.negTokenTarg.supportedMech, state->spnego_mech_oid) != 0 ) ) {
-                        DEBUG(1, ("Got a negTokenTarg with mech[%s] while [%s] was already negotiated\n",
-                                  request.negTokenTarg.supportedMech,
-                                  state->spnego_mech_oid));
-                        x_fprintf(x_stdout, "BH Got a negTokenTarg with speficied mech\n");
-                        return;
-                }
-
-                status = NT_STATUS_OK;
-                raw_in_token = request.negTokenTarg.responseToken;
-        }
-
-        if (!NT_STATUS_IS_OK(status)) {
-                /* error or more processing */
-        } else if (strcmp(state->spnego_mech, "ntlmssp") == 0) {
-
-                DEBUG(10, ("got NTLMSSP packet:\n"));
-                dump_data(10, raw_in_token.data, raw_in_token.length);
-
-                status = ntlmssp_update(state->ntlmssp_state,
-                                        raw_in_token,
-                                        &raw_out_token);
-                if (NT_STATUS_IS_OK(status)) {
-                        user = talloc_strdup(ctx, state->ntlmssp_state->user);
-                        domain = talloc_strdup(ctx, state->ntlmssp_state->domain);
-                }
-                if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-                        TALLOC_FREE(state->ntlmssp_state);
-                }
-#ifdef HAVE_KRB5
-        } else if (strcmp(state->spnego_mech, "krb5") == 0) {
-                char *principal;
-                DATA_BLOB ap_rep;
-                DATA_BLOB session_key;
-                struct PAC_LOGON_INFO *logon_info = NULL;
-                DATA_BLOB ticket;
-                uint8_t tok_id[2];
-
-                if (!spnego_parse_krb5_wrap(ctx, raw_in_token,
-                                            &ticket, tok_id)) {
-                        DEBUG(1, ("spnego_parse_krb5_wrap failed\n"));
-                        x_fprintf(x_stdout, "BH spnego_parse_krb5_wrap failed\n");
-                        return;
-                }
-
-                status = ads_verify_ticket(ctx, lp_realm(), 0,
-                                           &ticket,
-                                           &principal, &logon_info, &ap_rep,
-                                           &session_key, True);
-
-                /* Now in "principal" we have the name we are authenticated as. */
-
-                if (NT_STATUS_IS_OK(status)) {
-
-                        domain = strchr_m(principal, '@');
-
-                        if (domain == NULL) {
-                                DEBUG(1, ("Did not get a valid principal "
-                                          "from ads_verify_ticket\n"));
-                                x_fprintf(x_stdout, "BH Did not get a "
-                                          "valid principal from "
-                                          "ads_verify_ticket\n");
-                                return;
-                        }
-
-                        *domain++ = '\0';
-                        domain = talloc_strdup(ctx, domain);
-                        user = talloc_strdup(ctx, principal);
-
-                        if (logon_info) {
-                                netsamlogon_cache_store(
-                                        user, &logon_info->info3);
-                        }
-
-                        data_blob_free(&ap_rep);
-                        data_blob_free(&session_key);
-                }
-                data_blob_free(&ticket);
-#endif
-        }
-
-        spnego_free_data(&request);
-        ZERO_STRUCT(response);
-        response.type = SPNEGO_NEG_TOKEN_TARG;
-
-        if (NT_STATUS_IS_OK(status)) {
-                TALLOC_FREE(state->spnego_mech);
-                TALLOC_FREE(state->spnego_mech_oid);
-                response.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
-                response.negTokenTarg.responseToken = raw_out_token;
-                reply_code = "AF";
-                reply_argument = talloc_asprintf(ctx, "%s\\%s", domain, user);
-        } else if (NT_STATUS_EQUAL(status,
-                                   NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-                response.negTokenTarg.supportedMech = supportedMech;
-                response.negTokenTarg.responseToken = raw_out_token;
-                response.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
-                reply_code = "TT";
-                reply_argument = talloc_strdup(ctx, "*");
-        } else {
-                TALLOC_FREE(state->spnego_mech);
-                TALLOC_FREE(state->spnego_mech_oid);
-                data_blob_free(&raw_out_token);
-                response.negTokenTarg.negResult = SPNEGO_REJECT;
-                reply_code = "NA";
-                reply_argument = talloc_strdup(ctx, nt_errstr(status));
-        }
-
-        if (!reply_argument) {
-                DEBUG(1, ("Could not write SPNEGO data blob\n"));
-                x_fprintf(x_stdout, "BH Could not write SPNEGO data blob\n");
-                spnego_free_data(&response);
-                return;
-        }
-
-        len = spnego_write_data(ctx, &token, &response);
-        spnego_free_data(&response);
-
-        if (len == -1) {
-                DEBUG(1, ("Could not write SPNEGO data blob\n"));
-                x_fprintf(x_stdout, "BH Could not write SPNEGO data blob\n");
-                return;
-        }
-
-        reply_base64 = base64_encode_data_blob(talloc_tos(), token);
-
-        x_fprintf(x_stdout, "%s %s %s\n",
-                  reply_code, reply_base64, reply_argument);
-
-        TALLOC_FREE(reply_base64);
-        data_blob_free(&token);
-
-        return;
-}
-
-static struct ntlmssp_state *client_ntlmssp_state = NULL;
-
-static bool manage_client_ntlmssp_init(struct spnego_data spnego)
-{
-        NTSTATUS status;
-        DATA_BLOB null_blob = data_blob_null;
-        DATA_BLOB to_server;
-        char *to_server_base64;
-        const char *my_mechs[] = {OID_NTLMSSP, NULL};
-        TALLOC_CTX *ctx = talloc_tos();
-
-        DEBUG(10, ("Got spnego negTokenInit with NTLMSSP\n"));
-
-        if (client_ntlmssp_state != NULL) {
-                DEBUG(1, ("Request for initial SPNEGO request where "
-                          "we already have a state\n"));
-                return False;
-        }
-
-        if (!client_ntlmssp_state) {
-                if (!NT_STATUS_IS_OK(status = ntlm_auth_start_ntlmssp_client(&client_ntlmssp_state))) {
-                        x_fprintf(x_stdout, "BH %s\n", nt_errstr(status));
-                        return False;
-                }
-        }
-
-
-        if (opt_password == NULL) {
-
-                /* Request a password from the calling process.  After
-                   sending it, the calling process should retry with
-                   the negTokenInit. */
-
-                DEBUG(10, ("Requesting password\n"));
-                x_fprintf(x_stdout, "PW\n");
-                return True;
-        }
-
-        spnego.type = SPNEGO_NEG_TOKEN_INIT;
-        spnego.negTokenInit.mechTypes = my_mechs;
-        spnego.negTokenInit.reqFlags = data_blob_null;
-        spnego.negTokenInit.reqFlagsPadding = 0;
-        spnego.negTokenInit.mechListMIC = null_blob;
-
-        status = ntlmssp_update(client_ntlmssp_state, null_blob,
-                                       &spnego.negTokenInit.mechToken);
-
-        if ( !(NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) ||
-                        NT_STATUS_IS_OK(status)) ) {
-                DEBUG(1, ("Expected OK or MORE_PROCESSING_REQUIRED, got: %s\n",
-                          nt_errstr(status)));
-                TALLOC_FREE(client_ntlmssp_state);
-                return False;
-        }
-
-        spnego_write_data(ctx, &to_server, &spnego);
-        data_blob_free(&spnego.negTokenInit.mechToken);
-
-        to_server_base64 = base64_encode_data_blob(talloc_tos(), to_server);
-        data_blob_free(&to_server);
-        x_fprintf(x_stdout, "KK %s\n", to_server_base64);
-        TALLOC_FREE(to_server_base64);
-        return True;
-}
-
-static void manage_client_ntlmssp_targ(struct spnego_data spnego)
-{
-        NTSTATUS status;
-        DATA_BLOB null_blob = data_blob_null;
-        DATA_BLOB request;
-        DATA_BLOB to_server;
-        char *to_server_base64;
-        TALLOC_CTX *ctx = talloc_tos();
-
-        DEBUG(10, ("Got spnego negTokenTarg with NTLMSSP\n"));
-
-        if (client_ntlmssp_state == NULL) {
-                DEBUG(1, ("Got NTLMSSP tArg without a client state\n"));
-                x_fprintf(x_stdout, "BH Got NTLMSSP tArg without a client state\n");
-                return;
-        }
-
-        if (spnego.negTokenTarg.negResult == SPNEGO_REJECT) {
-                x_fprintf(x_stdout, "NA\n");
-                TALLOC_FREE(client_ntlmssp_state);
-                return;
-        }
-
-        if (spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_COMPLETED) {
-                x_fprintf(x_stdout, "AF\n");
-                TALLOC_FREE(client_ntlmssp_state);
-                return;
-        }
-
-        status = ntlmssp_update(client_ntlmssp_state,
-                                       spnego.negTokenTarg.responseToken,
-                                       &request);
-
-        if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-                DEBUG(1, ("Expected MORE_PROCESSING_REQUIRED from "
-                          "ntlmssp_client_update, got: %s\n",
-                          nt_errstr(status)));
-                x_fprintf(x_stdout, "BH Expected MORE_PROCESSING_REQUIRED from "
-                                    "ntlmssp_client_update\n");
-                data_blob_free(&request);
-                TALLOC_FREE(client_ntlmssp_state);
-                return;
-        }
-
-        spnego.type = SPNEGO_NEG_TOKEN_TARG;
-        spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
-        spnego.negTokenTarg.supportedMech = (char *)OID_NTLMSSP;
-        spnego.negTokenTarg.responseToken = request;
-        spnego.negTokenTarg.mechListMIC = null_blob;
-
-        spnego_write_data(ctx, &to_server, &spnego);
-        data_blob_free(&request);
-
-        to_server_base64 = base64_encode_data_blob(talloc_tos(), to_server);
-        data_blob_free(&to_server);
-        x_fprintf(x_stdout, "KK %s\n", to_server_base64);
-        TALLOC_FREE(to_server_base64);
-        return;
-}
-
-#ifdef HAVE_KRB5
-
-static bool manage_client_krb5_init(struct spnego_data spnego)
-{
-        char *principal;
-        DATA_BLOB tkt, to_server;
-        DATA_BLOB session_key_krb5 = data_blob_null;
-        struct spnego_data reply;
-        char *reply_base64;
-        int retval;
-
-        const char *my_mechs[] = {OID_KERBEROS5_OLD, NULL};
-        ssize_t len;
-        TALLOC_CTX *ctx = talloc_tos();
-
-        if ( (spnego.negTokenInit.mechListMIC.data == NULL) ||
-             (spnego.negTokenInit.mechListMIC.length == 0) ) {
-                DEBUG(1, ("Did not get a principal for krb5\n"));
-                return False;
-        }
-
-        principal = (char *)SMB_MALLOC(
-                spnego.negTokenInit.mechListMIC.length+1);
-
-        if (principal == NULL) {
-                DEBUG(1, ("Could not malloc principal\n"));
-                return False;
-        }
-
-        memcpy(principal, spnego.negTokenInit.mechListMIC.data,
-               spnego.negTokenInit.mechListMIC.length);
-        principal[spnego.negTokenInit.mechListMIC.length] = '\0';
-
-        retval = cli_krb5_get_ticket(ctx, principal, 0,
-                                          &tkt, &session_key_krb5,
-                                          0, NULL, NULL, NULL);
-        if (retval) {
-                char *user = NULL;
-
-                /* Let's try to first get the TGT, for that we need a
-                   password. */
-
-                if (opt_password == NULL) {
-                        DEBUG(10, ("Requesting password\n"));
-                        x_fprintf(x_stdout, "PW\n");
-                        return True;
-                }
-
-                user = talloc_asprintf(talloc_tos(), "%s@%s", opt_username, opt_domain);
-                if (!user) {
-                        return false;
-                }
-
-                if ((retval = kerberos_kinit_password(user, opt_password, 0, NULL))) {
-                        DEBUG(10, ("Requesting TGT failed: %s\n", error_message(retval)));
-                        return False;
-                }
-
-                retval = cli_krb5_get_ticket(ctx, principal, 0,
-                                                  &tkt, &session_key_krb5,
-                                                  0, NULL, NULL, NULL);
-                if (retval) {
-                        DEBUG(10, ("Kinit suceeded, but getting a ticket failed: %s\n", error_message(retval)));
-                        return False;
-                }
-        }
-
-        data_blob_free(&session_key_krb5);
-
-        ZERO_STRUCT(reply);
-
-        reply.type = SPNEGO_NEG_TOKEN_INIT;
-        reply.negTokenInit.mechTypes = my_mechs;
-        reply.negTokenInit.reqFlags = data_blob_null;
-        reply.negTokenInit.reqFlagsPadding = 0;
-        reply.negTokenInit.mechToken = tkt;
-        reply.negTokenInit.mechListMIC = data_blob_null;
-
-        len = spnego_write_data(ctx, &to_server, &reply);
-        data_blob_free(&tkt);
-
-        if (len == -1) {
-                DEBUG(1, ("Could not write SPNEGO data blob\n"));
-                return False;
-        }
-
-        reply_base64 = base64_encode_data_blob(talloc_tos(), to_server);
-        x_fprintf(x_stdout, "KK %s *\n", reply_base64);
-
-        TALLOC_FREE(reply_base64);
-        data_blob_free(&to_server);
-        DEBUG(10, ("sent GSS-SPNEGO KERBEROS5 negTokenInit\n"));
-        return True;
-}
-
-static void manage_client_krb5_targ(struct spnego_data spnego)
-{
-        switch (spnego.negTokenTarg.negResult) {
-        case SPNEGO_ACCEPT_INCOMPLETE:
-                DEBUG(1, ("Got a Kerberos negTokenTarg with ACCEPT_INCOMPLETE\n"));
-                x_fprintf(x_stdout, "BH Got a Kerberos negTokenTarg with "
-                                    "ACCEPT_INCOMPLETE\n");
-                break;
-        case SPNEGO_ACCEPT_COMPLETED:
-                DEBUG(10, ("Accept completed\n"));
-                x_fprintf(x_stdout, "AF\n");
-                break;
-        case SPNEGO_REJECT:
-                DEBUG(10, ("Rejected\n"));
-                x_fprintf(x_stdout, "NA\n");
+                abort();
+        }
+
+        switch (stdio_helper_mode) {
+        case GSS_SPNEGO_SERVER:
+                x_fprintf(x_stdout, "%s %s %s\n", reply_code,
+                          out_base64 ? out_base64 : "*",
+                          reply_arg ? reply_arg : "*");
                 break;
         default:
-                DEBUG(1, ("Got an invalid negTokenTarg\n"));
-                x_fprintf(x_stdout, "AF\n");
-        }
-}
-
-#endif
-
-static void manage_gss_spnego_client_request(struct ntlm_auth_state *state,
-                                                char *buf, int length)
-{
-        DATA_BLOB request;
-        struct spnego_data spnego;
-        ssize_t len;
-        TALLOC_CTX *ctx = talloc_tos();
-
-        if (!opt_username || !*opt_username) {
-                x_fprintf(x_stderr, "username must be specified!\n\n");
-                exit(1);
-        }
-
-        if (strlen(buf) <= 3) {
-                DEBUG(1, ("SPNEGO query [%s] too short\n", buf));
-                x_fprintf(x_stdout, "BH SPNEGO query too short\n");
-                return;
-        }
-
-        request = base64_decode_data_blob(buf+3);
-
-        if (strncmp(buf, "PW ", 3) == 0) {
-
-                /* We asked for a password and obviously got it :-) */
-
-                opt_password = SMB_STRNDUP((const char *)request.data, request.length);
-
-                if (opt_password == NULL) {
-                        DEBUG(1, ("Out of memory\n"));
-                        x_fprintf(x_stdout, "BH Out of memory\n");
-                        data_blob_free(&request);
-                        return;
-                }
-
-                x_fprintf(x_stdout, "OK\n");
-                data_blob_free(&request);
-                return;
-        }
-
-        if ( (strncmp(buf, "TT ", 3) != 0) &&
-             (strncmp(buf, "AF ", 3) != 0) &&
-             (strncmp(buf, "NA ", 3) != 0) ) {
-                DEBUG(1, ("SPNEGO request [%s] invalid\n", buf));
-                x_fprintf(x_stdout, "BH SPNEGO request invalid\n");
-                data_blob_free(&request);
-                return;
-        }
-
-        /* So we got a server challenge to generate a SPNEGO
-           client-to-server request... */
-
-        len = spnego_read_data(ctx, request, &spnego);
-        data_blob_free(&request);
-
-        if (len == -1) {
-                DEBUG(1, ("Could not read SPNEGO data for [%s]\n", buf));
-                x_fprintf(x_stdout, "BH Could not read SPNEGO data\n");
-                return;
-        }
-
-        if (spnego.type == SPNEGO_NEG_TOKEN_INIT) {
-
-                /* The server offers a list of mechanisms */
-
-                const char **mechType = (const char **)spnego.negTokenInit.mechTypes;
-
-                while (*mechType != NULL) {
-
-#ifdef HAVE_KRB5
-                        if ( (strcmp(*mechType, OID_KERBEROS5_OLD) == 0) ||
-                             (strcmp(*mechType, OID_KERBEROS5) == 0) ) {
-                                if (manage_client_krb5_init(spnego))
-                                        goto out;
-                        }
-#endif
-
-                        if (strcmp(*mechType, OID_NTLMSSP) == 0) {
-                                if (manage_client_ntlmssp_init(spnego))
-                                        goto out;
-                        }
-
-                        mechType++;
-                }
-
-                DEBUG(1, ("Server offered no compatible mechanism\n"));
-                x_fprintf(x_stdout, "BH Server offered no compatible mechanism\n");
-                return;
-        }
-
-        if (spnego.type == SPNEGO_NEG_TOKEN_TARG) {
-
-                if (spnego.negTokenTarg.supportedMech == NULL) {
-                        /* On accept/reject Windows does not send the
-                           mechanism anymore. Handle that here and
-                           shut down the mechanisms. */
-
-                        switch (spnego.negTokenTarg.negResult) {
-                        case SPNEGO_ACCEPT_COMPLETED:
-                                x_fprintf(x_stdout, "AF\n");
-                                break;
-                        case SPNEGO_REJECT:
-                                x_fprintf(x_stdout, "NA\n");
-                                break;
-                        default:
-                                DEBUG(1, ("Got a negTokenTarg with no mech and an "
-                                          "unknown negResult: %d\n",
-                                          spnego.negTokenTarg.negResult));
-                                x_fprintf(x_stdout, "BH Got a negTokenTarg with"
-                                                    " no mech and an unknown "
-                                                    "negResult\n");
-                        }
-
-                        TALLOC_FREE(client_ntlmssp_state);
-                        goto out;
-                }
-
-                if (strcmp(spnego.negTokenTarg.supportedMech,
-                           OID_NTLMSSP) == 0) {
-                        manage_client_ntlmssp_targ(spnego);
-                        goto out;
-                }
-
-#if HAVE_KRB5
-                if (strcmp(spnego.negTokenTarg.supportedMech,
-                           OID_KERBEROS5_OLD) == 0) {
-                        manage_client_krb5_targ(spnego);
-                        goto out;
-                }
-#endif
-
-        }
-
-        DEBUG(1, ("Got an SPNEGO token I could not handle [%s]!\n", buf));
-        x_fprintf(x_stdout, "BH Got an SPNEGO token I could not handle\n");
+                if (out_base64) {
+                        x_fprintf(x_stdout, "%s %s\n", reply_code, out_base64);
+                } else if (reply_arg) {
+                        x_fprintf(x_stdout, "%s %s\n", reply_code, reply_arg);
+                } else {
+                        x_fprintf(x_stdout, "%s\n", reply_code);
+                }
+        }
+
+        talloc_free(mem_ctx);
         return;
-
- out:
-        spnego_free_data(&spnego);
+}
+
+static void manage_gss_spnego_request(enum stdio_helper_mode stdio_helper_mode,
+                                   struct loadparm_context *lp_ctx,
+                                   struct ntlm_auth_state *state,
+                                      char *buf, int length, void **private2)
+{
+        manage_gensec_request(stdio_helper_mode, lp_ctx, buf, length, &state->gensec_private_1);
         return;
 }
 
-static void manage_ntlm_server_1_request(struct ntlm_auth_state *state,
-                                                char *buf, int length)
+static void manage_squid_ntlmssp_request(enum stdio_helper_mode stdio_helper_mode,
+                                   struct loadparm_context *lp_ctx,
+                                   struct ntlm_auth_state *state,
+                                         char *buf, int length, void **private2)
+{
+        manage_gensec_request(stdio_helper_mode, lp_ctx, buf, length, &state->gensec_private_1);
+        return;
+}
+
+static void manage_gss_spnego_client_request(enum stdio_helper_mode stdio_helper_mode,
+                                   struct loadparm_context *lp_ctx,
+                                   struct ntlm_auth_state *state,
+                                             char *buf, int length, void **private2)
+{
+        manage_gensec_request(stdio_helper_mode, lp_ctx, buf, length, &state->gensec_private_1);
+        return;
+}
+
+static void manage_ntlm_server_1_request(enum stdio_helper_mode stdio_helper_mode,
+                                   struct loadparm_context *lp_ctx,
+                                   struct ntlm_auth_state *state,
+                                                char *buf, int length, void **private2)
 {
         char *request, *parameter;      
@@ -2035 +1618 @@
                         uchar lm_key[8];
                         uchar user_session_key[16];
-                        uint32 flags = 0;
-
+                        uint32_t flags = 0;
+                        NTSTATUS nt_status;
                         if (full_username && !username) {
                                 fstring fstr_user;
@@ -2051 +1634 @@
                         }
 
-                        if (!domain) {
-                                domain = smb_xstrdup(get_winbind_domain());
-                        }
-
-                        if (ntlm_server_1_lm_session_key) 
-                                flags |= WBFLAG_PAM_LMKEY;
-
-                        if (ntlm_server_1_user_session_key) 
-                                flags |= WBFLAG_PAM_USER_SESSION_KEY;
-
-                        if (!NT_STATUS_IS_OK(
-                                    contact_winbind_auth_crap(username, 
-                                                              domain, 
-                                                              global_myname(),
-                                                              &challenge, 
-                                                              &lm_response, 
-                                                              &nt_response, 
-                                                              flags, 
-                                                              lm_key, 
-                                                              user_session_key,
-                                                              &error_string,
-                                                              NULL))) {
-
+                        if (opt_password) {
+                                DATA_BLOB nt_session_key, lm_session_key;
+                                struct samr_Password lm_pw, nt_pw;
+                                TALLOC_CTX *mem_ctx = talloc_new(NULL);
+                                ZERO_STRUCT(user_session_key);
+                                ZERO_STRUCT(lm_key);
+
+                                nt_lm_owf_gen (opt_password, nt_pw.hash, lm_pw.hash);
+                                nt_status = ntlm_password_check(mem_ctx,
+                                                                true, true, 0,
+                                                                &challenge,
+                                                                &lm_response,
+                                                                &nt_response,
+                                                                username,
+                                                                username,
+                                                                domain,
+                                                                &lm_pw, &nt_pw,
+                                                                &nt_session_key,
+                                                                &lm_session_key);
+                                error_string = smb_xstrdup(get_friendly_nt_error_msg(nt_status));
+                                if (ntlm_server_1_user_session_key) {
+                                        if (nt_session_key.length == sizeof(user_session_key)) {
+                                                memcpy(user_session_key,
+                                                       nt_session_key.data,
+                                                       sizeof(user_session_key));
+                                        }
+                                }
+                                if (ntlm_server_1_lm_session_key) {
+                                        if (lm_session_key.length == sizeof(lm_key)) {
+                                                memcpy(lm_key,
+                                                       lm_session_key.data,
+                                                       sizeof(lm_key));
+                                        }
+                                }
+                                TALLOC_FREE(mem_ctx);
+
+                        } else {
+                                if (!domain) {
+                                        domain = smb_xstrdup(get_winbind_domain());
+                                }
+
+                                if (ntlm_server_1_lm_session_key)
+                                        flags |= WBFLAG_PAM_LMKEY;
+
+                                if (ntlm_server_1_user_session_key)
+                                        flags |= WBFLAG_PAM_USER_SESSION_KEY;
+
+                                nt_status = contact_winbind_auth_crap(username,
+                                                                      domain,
+                                                                      lp_netbios_name(),
+                                                                      &challenge,
+                                                                      &lm_response,
+                                                                      &nt_response,
+                                                                      flags, 0,
+                                                                      lm_key,
+                                                                      user_session_key,
+                                                                      &error_string,
+                                                                      NULL);
+                        }
+
+                        if (!NT_STATUS_IS_OK(nt_status)) {
                                 x_fprintf(x_stdout, "Authenticated: No\n");
                                 x_fprintf(x_stdout, "Authentication-Error: %s\n.\n", error_string);
@@ -2190 +1811 @@
 }
 
-static void manage_ntlm_change_password_1_request(struct ntlm_auth_state *state,
-                                                        char *buf, int length)
+static void manage_ntlm_change_password_1_request(enum stdio_helper_mode stdio_helper_mode,
+                                                  struct loadparm_context *lp_ctx,
+                                                  struct ntlm_auth_state *state,
+                                                  char *buf, int length, void **private2)
 {
         char *request, *parameter;      
@@ -2401 +2024 @@
 }
 
-static void manage_squid_request(struct ntlm_auth_state *state,
-                stdio_helper_function fn)
+static void manage_squid_request(enum stdio_helper_mode stdio_helper_mode,
+                                   struct loadparm_context *lp_ctx,
+                                   struct ntlm_auth_state *state,
+                stdio_helper_function fn, void **private2)
 {
         char *buf;
@@ -2456 +2081 @@
         }
 
-        fn(state, buf, length);
+        fn(stdio_helper_mode, lp_ctx, state, buf, length, private2);
         talloc_free(buf);
 }
 
 
-static void squid_stream(enum stdio_helper_mode stdio_mode, stdio_helper_function fn) {
+static void squid_stream(enum stdio_helper_mode stdio_mode,
+                         struct loadparm_context *lp_ctx,
+                         stdio_helper_function fn) {
         TALLOC_CTX *mem_ctx;
         struct ntlm_auth_state *state;
@@ -2488 +2115 @@
         while(1) {
                 TALLOC_CTX *frame = talloc_stackframe();
-                manage_squid_request(state, fn);
+                manage_squid_request(stdio_mode, lp_ctx, state, fn, NULL);
                 TALLOC_FREE(frame);
         }
@@ -2499 +2126 @@
 {
         NTSTATUS nt_status;
-        uint32 flags = 0;
+        uint32_t flags = 0;
         char lm_key[8];
         char user_session_key[16];
@@ -2505 +2132 @@
         char *hex_user_session_key;
         char *error_string;
-        static uint8 zeros[16];
+        static uint8_t zeros[16];
 
         x_setbuf(x_stdout, NULL);
@@ -2522 +2149 @@
                                               &opt_lm_response, 
                                               &opt_nt_response, 
-                                              flags,
+                                              flags, 0,
                                               (unsigned char *)lm_key, 
                                               (unsigned char *)user_session_key, 
@@ -2571 +2198 @@
         OPT_REQUIRE_MEMBERSHIP,
         OPT_USE_CACHED_CREDS,
-        OPT_PAM_WINBIND_CONF
+        OPT_PAM_WINBIND_CONF,
+        OPT_TARGET_SERVICE,
+        OPT_TARGET_HOSTNAME,
+        OPT_OFFLINE_LOGON
 };
 
@@ -2584 +2214 @@
         static const char *hex_lm_response;
         static const char *hex_nt_response;
-
+        struct loadparm_context *lp_ctx;
         poptContext pc;
 
@@ -2608 +2238 @@
                 { "request-nt-key", 0, POPT_ARG_NONE, &request_user_session_key, OPT_USER_SESSION_KEY, "Retrieve User (NT) session key"},
                 { "use-cached-creds", 0, POPT_ARG_NONE, &use_cached_creds, OPT_USE_CACHED_CREDS, "Use cached credentials if no password is given"},
+                { "offline-logon", 0, POPT_ARG_NONE, &offline_logon,
+                  OPT_OFFLINE_LOGON,
+                  "Use cached passwords when DC is offline"},
                 { "diagnostics", 0, POPT_ARG_NONE, &diagnostics,
                   OPT_DIAGNOSTICS,
@@ -2613 +2246 @@
                 { "require-membership-of", 0, POPT_ARG_STRING, &require_membership_of, OPT_REQUIRE_MEMBERSHIP, "Require that a user be a member of this group (either name or SID) for authentication to succeed" },
                 { "pam-winbind-conf", 0, POPT_ARG_STRING, &opt_pam_winbind_conf, OPT_PAM_WINBIND_CONF, "Require that request must set WBFLAG_PAM_CONTACT_TRUSTDOM when krb5 auth is required" },
+                { "target-service", 0, POPT_ARG_STRING, &opt_target_service, OPT_TARGET_SERVICE, "Target service (eg http)" },
+                { "target-hostname", 0, POPT_ARG_STRING, &opt_target_hostname, OPT_TARGET_HOSTNAME, "Target hostname" },
                 POPT_COMMON_CONFIGFILE
                 POPT_COMMON_VERSION
+                POPT_COMMON_OPTION
                 POPT_TABLEEND
         };
 
         /* Samba client initialisation */
-        load_case_tables();
+        smb_init_locale();
 
         setup_logging("ntlm_auth", DEBUG_STDERR);
@@ -2640 +2276 @@
         poptFreeContext(pc);
 
-        if (!lp_load(get_dyn_CONFIGFILE(), True, False, False, True)) {
+        if (!lp_load_global(get_dyn_CONFIGFILE())) {
                 d_fprintf(stderr, "ntlm_auth: error opening config file %s. Error was %s\n",
                         get_dyn_CONFIGFILE(), strerror(errno));
@@ -2681 +2317 @@
 
                 case OPT_REQUIRE_MEMBERSHIP:
-                        if (StrnCaseCmp("S-", require_membership_of, 2) == 0) {
+                        if (strncasecmp_m("S-", require_membership_of, 2) == 0) {
                                 require_membership_of_sid = require_membership_of;
                         }
@@ -2716 +2352 @@
         }
 
+        lp_ctx = loadparm_init_s3(NULL, loadparm_s3_helpers());
+        if (lp_ctx == NULL) {
+                x_fprintf(x_stderr, "loadparm_init_s3() failed!\n");
+                exit(1);
+        }
+
         if (helper_protocol) {
                 int i;
                 for (i=0; i<NUM_HELPER_MODES; i++) {
                         if (strcmp(helper_protocol, stdio_helper_protocols[i].name) == 0) {
-                                squid_stream(stdio_helper_protocols[i].mode, stdio_helper_protocols[i].fn);
+                                squid_stream(stdio_helper_protocols[i].mode, lp_ctx, stdio_helper_protocols[i].fn);
                                 exit(0);
                         }
@@ -2747 +2389 @@
 
         if (!opt_password) {
-                opt_password = getpass("password: ");
+                char pwd[256] = {0};
+                int rc;
+
+                rc = samba_getpass("Password: ", pwd, sizeof(pwd), false, false);
+                if (rc == 0) {
+                        opt_password = SMB_STRDUP(pwd);
+                }
         }
 

vendor/current/source3/utils/ntlm_auth_diagnostics.c

@@ -51 +51 @@
         bool pass = True;
         NTSTATUS nt_status;
-        uint32 flags = 0;
+        uint32_t flags = 0;
         DATA_BLOB lm_response = data_blob(NULL, 24);
         DATA_BLOB nt_response = data_blob(NULL, 24);
@@ -99 +99 @@
                                               &lm_response,
                                               &nt_response,
-                                              flags,
+                                              flags, 0,
                                               lm_key, 
                                               user_session_key,
@@ -175 +175 @@
         bool pass = True;
         NTSTATUS nt_status;
-        uint32 flags = 0;
+        uint32_t flags = 0;
         DATA_BLOB nt_response = data_blob(NULL, 24);
 
@@ -198 +198 @@
                                               &nt_response,
                                               NULL,
-                                              flags,
+                                              flags, 0,
                                               lm_key,
                                               user_session_key,
@@ -241 +241 @@
         bool pass = True;
         NTSTATUS nt_status;
-        uint32 flags = 0;
+        uint32_t flags = 0;
         DATA_BLOB nt_response = data_blob(NULL, 24);
         DATA_BLOB session_key = data_blob(NULL, 16);
 
-        uint8 lm_key[8];
-        uint8 lm_hash[16];
-        uint8 user_session_key[16];
-        uint8 nt_hash[16];
+        uint8_t lm_key[8];
+        uint8_t lm_hash[16];
+        uint8_t user_session_key[16];
+        uint8_t nt_hash[16];
         DATA_BLOB chall = get_challenge();
         char *error_string;
@@ -269 +269 @@
                                               &nt_response,
                                               &nt_response,
-                                              flags,
+                                              flags, 0,
                                               lm_key,
                                               user_session_key,
@@ -315 +315 @@
         bool pass = True;
         NTSTATUS nt_status;
-        uint32 flags = 0;
+        uint32_t flags = 0;
         DATA_BLOB ntlmv2_response = data_blob_null;
         DATA_BLOB lmv2_response = data_blob_null;
@@ -360 +360 @@
                                               &lmv2_response,
                                               &ntlmv2_response,
-                                              flags,
+                                              flags, 0,
                                               NULL, 
                                               user_session_key,
@@ -443 +443 @@
 {
         NTSTATUS nt_status;
-        uint32 flags = 0;
+        uint32_t flags = 0;
         DATA_BLOB nt_response = data_blob_null;
         DATA_BLOB lm_response = data_blob_null;
@@ -480 +480 @@
                                    strlen(password)+1, 
                                    &lm_response.data,
-                                   &lm_response.length, True)) {
+                                   &lm_response.length)) {
                 DEBUG(0, ("convert_string_talloc failed!\n"));
                 exit(1);
@@ -511 +511 @@
                                               &lm_response,
                                               &nt_response,
-                                              flags,
+                                              flags, MSV1_0_CLEARTEXT_PASSWORD_ALLOWED,
                                               lm_key,
                                               user_session_key,

vendor/current/source3/utils/ntlm_auth_proto.h

@@ -36 +36 @@
                                    const DATA_BLOB *lm_response,
                                    const DATA_BLOB *nt_response,
-                                   uint32 flags,
-                                   uint8 lm_key[8],
-                                   uint8 user_session_key[16],
+                                   uint32_t flags,
+                                   uint32_t extra_logon_parameters,
+                                   uint8_t lm_key[8],
+                                   uint8_t user_session_key[16],
                                    char **error_string,
                                    char **unix_name);

vendor/current/source3/utils/passwd_util.c

@@ -43 +43 @@
          * a null terminator.
          */
-        if ( fgets(new_pw, sizeof(new_pw), stdin) != NULL) {
-                if ((len = strlen(new_pw)) > 0) {
-                        if(new_pw[len-1] == '\n')
-                                new_pw[len - 1] = 0;
-                }
+        if ( fgets(new_pw, sizeof(new_pw), stdin) == NULL) {
+                return NULL;
+        }
+        if ((len = strlen(new_pw)) > 0) {
+                if(new_pw[len-1] == '\n')
+                        new_pw[len - 1] = 0;
         }
         return(new_pw);
@@ -59 +60 @@
 char *get_pass( const char *prompt, bool stdin_get)
 {
+        char pwd[256] = {0};
         char *p;
+        int rc;
+
         if (stdin_get) {
                 p = stdin_new_passwd();
+                if (p == NULL) {
+                        return NULL;
+                }
         } else {
-                p = getpass( prompt);
+                rc = samba_getpass(prompt, pwd, sizeof(pwd), false, false);
+                if (rc < 0) {
+                        return NULL;
+                }
+                p = pwd;
         }
         return smb_xstrdup( p);

vendor/current/source3/utils/pdbedit.c

@@ -56 +56 @@
 #define BIT_KICKOFFTIME 0x20000000
 #define BIT_DESCRIPTION 0x40000000
+#define BIT_PWSETNTHASH 0x80000000
 
 #define MASK_ALWAYS_GOOD        0x0000001F
-#define MASK_USER_GOOD          0x60405FE0
+#define MASK_USER_GOOD          0xE0405FE0
 
 static int get_sid_from_cli_string(struct dom_sid *sid, const char *str_sid)
@@ -176 +177 @@
 static int export_groups (struct pdb_methods *in, struct pdb_methods *out)
 {
-        GROUP_MAP *maps = NULL;
+        GROUP_MAP **maps = NULL;
         size_t i, entries = 0;
         NTSTATUS status;
@@ -189 +190 @@
 
         for (i=0; i<entries; i++) {
-                out->add_group_mapping_entry(out, &(maps[i]));
-        }
-
-        SAFE_FREE( maps );
+                out->add_group_mapping_entry(out, maps[i]);
+        }
+
+        TALLOC_FREE(maps);
 
         return 0;
@@ -318 +319 @@
                 pdb_sethexhours(temp, hours);
                 printf ("Logon hours         : %s\n", temp);
+                if (smbpwdstyle){
+                        pdb_sethexpwd(temp, pdb_get_lanman_passwd(sam_pwent), pdb_get_acct_ctrl(sam_pwent));
+                        printf ("LM hash             : %s\n", temp);
+                        pdb_sethexpwd(temp, pdb_get_nt_passwd(sam_pwent), pdb_get_acct_ctrl(sam_pwent));
+                        printf ("NT hash             : %s\n", temp);
+                }       
 
         } else if (smbpwdstyle) {
@@ -333 +340 @@
                        nt_passwd,
                        pdb_encode_acct_ctrl(pdb_get_acct_ctrl(sam_pwent),NEW_PW_FORMAT_SPACE_PADDED_LEN),
-                       (uint32)convert_time_t_to_uint32_t(pdb_get_pass_last_set_time(sam_pwent)));
+                       (uint32_t)convert_time_t_to_uint32_t(pdb_get_pass_last_set_time(sam_pwent)));
         } else {
                 uid = nametouid(pdb_get_username(sam_pwent));
@@ -500 +507 @@
                          const char *user_sid, const char *user_domain,
                          const bool badpw, const bool hours,
-                         const char *kickoff_time)
+                         const char *kickoff_time, const char *str_hex_pwd)
 {
         bool updated_autolock = False, updated_badpw = False;
@@ -602 +609 @@
                 pdb_set_kickoff_time(sam_pwent, value, PDB_CHANGED);
         }
+        if (str_hex_pwd) {
+                unsigned char  new_nt_p16[NT_HASH_LEN];
+                if(strlen(str_hex_pwd) != (NT_HASH_LEN *2)){
+                        fprintf(stderr, "Invalid hash\n");
+                        return -1;
+                }
+                                         
+                pdb_gethexpwd(str_hex_pwd, new_nt_p16);
+                
+                if (!pdb_set_nt_passwd (sam_pwent, new_nt_p16 , PDB_CHANGED)) {
+                        fprintf(stderr, "Failed to set password from nt-hash\n");
+                        return -1;
+                }       
+
+                if (!pdb_set_pass_last_set_time (sam_pwent, time(NULL), PDB_CHANGED)){
+                        fprintf(stderr, "Failed to set last password set time\n");
+                        return -1;
+                }       
+                if (!pdb_update_history(sam_pwent, new_nt_p16)){
+                        fprintf(stderr, "Failed to update password history\n");
+                        return -1;
+                }
+        }
 
         if (NT_STATUS_IS_OK(pdb_update_sam_account(sam_pwent))) {
-                print_user_info(username, True, False);
+                
+                print_user_info(username, True, (str_hex_pwd != NULL ));
         } else {
                 fprintf (stderr, "Unable to modify entry!\n");
@@ -656 +687 @@
         }
 
-        strlower_m(name);
+        if (!strlower_m(name)) {
+                fprintf(stderr, "strlower_m %s failed\n", name);
+                TALLOC_FREE(sam_pwent);
+                return -1;
+        }
 
         ret = pdb_getsampwnam(sam_pwent, name);
@@ -854 +889 @@
         }
 
-        strlower_m(name);
+        if (!strlower_m(name)) {
+                fprintf(stderr, "strlower_m %s failed\n", name);
+                return -1;
+        }
 
         flags = LOCAL_ADD_USER | LOCAL_TRUST_ACCOUNT | LOCAL_SET_PASSWORD;
@@ -959 +997 @@
                 fprintf (stderr,
                          "machine %s does not exist in the passdb\n", name);
-                return -1;
                 TALLOC_FREE(samaccount);
+                return -1;
         }
 
@@ -977 +1015 @@
 **********************************************************/
 
-int main (int argc, char **argv)
+int main(int argc, const char **argv)
 {
         static int list_users = False;
@@ -986 +1024 @@
         static int delete_user = False;
         static int modify_user = False;
-        uint32  setparms, checkparms;
+        uint32_t   setparms, checkparms;
         int opt;
         static char *full_name = NULL;
@@ -1015 +1053 @@
         struct pdb_methods *bin, *bout;
         static char *kickoff_time = NULL;
+        static char *str_hex_pwd = NULL;
         TALLOC_CTX *frame = talloc_stackframe();
         NTSTATUS status;
@@ -1052 +1091 @@
                 {"password-from-stdin", 't', POPT_ARG_NONE, &pw_from_stdin, 0, "get password from standard in", NULL},
                 {"kickoff-time", 'K', POPT_ARG_STRING, &kickoff_time, 0, "set the kickoff time", NULL},
+                {"set-nt-hash", 0, POPT_ARG_STRING, &str_hex_pwd, 0, "set password from nt-hash", NULL},
                 POPT_COMMON_SAMBA
                 POPT_TABLEEND
@@ -1058 +1098 @@
         bin = bout = NULL;
 
-        load_case_tables();
+        smb_init_locale();
 
         setup_logging("pdbedit", DEBUG_STDOUT);
 
-        pc = poptGetContext(NULL, argc, (const char **) argv, long_options,
+        pc = poptGetContext(NULL, argc, argv, long_options,
                             POPT_CONTEXT_KEEP_FIRST);
 
@@ -1078 +1118 @@
                 user_name = poptGetArg(pc);
 
-        if (!lp_load(get_dyn_CONFIGFILE(),True,False,False,True)) {
+        if (!lp_load_global(get_dyn_CONFIGFILE())) {
                 fprintf(stderr, "Can't load %s - run testparm to debug it\n", get_dyn_CONFIGFILE());
                 exit(1);
@@ -1112 +1152 @@
                         (hours_reset ? BIT_LOGONHOURS : 0) +
                         (kickoff_time ? BIT_KICKOFFTIME : 0) +
+                        (str_hex_pwd ? BIT_PWSETNTHASH : 0 ) +
                         (acct_desc ? BIT_DESCRIPTION : 0);
+                        
 
         if (setparms & BIT_BACKEND) {
@@ -1118 +1160 @@
                  * This way we can use regular pdb functions for default
                  * operations that do not involve passdb migrations */
-                lp_set_passdb_backend(backend);
+                lp_set_cmdline("passdb backend", backend);
         } else {
                 backend = lp_passdb_backend();
@@ -1143 +1185 @@
                         int count;
                         int i;
-                        account_policy_names_list(&names, &count);
+                        account_policy_names_list(talloc_tos(), &names, &count);
                         fprintf(stderr, "No account policy by that name!\n");
                         if (count !=0) {
@@ -1151 +1193 @@
                                 }
                         }
-                        SAFE_FREE(names);
+                        TALLOC_FREE(names);
                         exit(1);
                 }
@@ -1175 +1217 @@
 
         if (reset_account_policies) {
-                if (!reinit_account_policies()) {
+                if (reinit_account_policies()) {
                         exit(1);
                 }
@@ -1309 +1351 @@
                                                      user_sid, user_domain,
                                                      badpw_reset, hours_reset,
-                                                     kickoff_time);
+                                                     kickoff_time, str_hex_pwd);
                         }
                 }

vendor/current/source3/utils/profiles.c

@@ -130 +130 @@
         /* swap out the SIDs in the security descriptor */
 
-        if ( !(new_sd = dup_sec_desc( outfile->mem_ctx, nk->sec_desc->sec_desc )) ) {
-                fprintf( stderr, "Failed to copy security descriptor!\n" );
+        if (nk->sec_desc->sec_desc == NULL) {
+                fprintf(stderr, "Invalid (NULL) security descriptor!\n");
+                return false;
+        }
+
+        new_sd = security_descriptor_copy(outfile->mem_ctx,
+                                          nk->sec_desc->sec_desc);
+        if (new_sd == NULL) {
+                fprintf(stderr, "Failed to copy security descriptor!\n");
                 return False;
         }
@@ -183 +190 @@
         }
 
+
+        verbose_output("[%s]\n", path);
+
         /* values is a talloc()'d child of subkeys here so just throw it all away */
-
-        TALLOC_FREE( subkeys );
-
-        verbose_output("[%s]\n", path);
+        TALLOC_FREE(subkeys);
 
         return True;
@@ -195 +202 @@
 *********************************************************************/
 
-int main( int argc, char *argv[] )
+int main( int argc, const char *argv[] )
 {
         TALLOC_CTX *frame = talloc_stackframe();
@@ -213 +220 @@
         poptContext pc;
 
-        load_case_tables();
+        smb_init_locale();
 
         /* setup logging options */
@@ -219 +226 @@
         setup_logging( "profiles", DEBUG_STDERR);
 
-        pc = poptGetContext("profiles", argc, (const char **)argv, long_options,
+        pc = poptGetContext("profiles", argc, argv, long_options,
                 POPT_CONTEXT_KEEP_FIRST);
 

vendor/current/source3/utils/sharesec.c

@@ -22 +22 @@
  */
 
+struct cli_state;
 
 #include "includes.h"
@@ -27 +28 @@
 #include "../libcli/security/security.h"
 #include "passdb/machine_sid.h"
+#include "util_sd.h"
 
 static TALLOC_CTX *ctx;
@@ -35 +37 @@
                 SMB_ACL_SET,
                 SMB_SD_DELETE,
-                SMB_ACL_VIEW };
-
-struct perm_value {
-        const char *perm;
-        uint32 mask;
-};
-
-/* These values discovered by inspection */
-
-static const struct perm_value special_values[] = {
-        { "R", SEC_RIGHTS_FILE_READ },
-        { "W", SEC_RIGHTS_FILE_WRITE },
-        { "X", SEC_RIGHTS_FILE_EXECUTE },
-        { "D", SEC_STD_DELETE },
-        { "P", SEC_STD_WRITE_DAC },
-        { "O", SEC_STD_WRITE_OWNER },
-        { NULL, 0 },
-};
-
-#define SEC_RIGHTS_DIR_CHANGE ( SEC_RIGHTS_DIR_READ|SEC_STD_DELETE|\
-                                SEC_RIGHTS_DIR_WRITE|SEC_DIR_TRAVERSE )
-
-static const struct perm_value standard_values[] = {
-        { "READ",   SEC_RIGHTS_DIR_READ|SEC_DIR_TRAVERSE },
-        { "CHANGE", SEC_RIGHTS_DIR_CHANGE },
-        { "FULL",   SEC_RIGHTS_DIR_ALL },
-        { NULL, 0 },
-};
-
-/********************************************************************
- print an ACE on a FILE
-********************************************************************/
-
-static void print_ace(FILE *f, struct security_ace *ace)
-{
-        const struct perm_value *v;
-        int do_print = 0;
-        uint32 got_mask;
-
-        fprintf(f, "%s:", sid_string_tos(&ace->trustee));
-
-        /* Ace type */
-
-        if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
-                fprintf(f, "ALLOWED");
-        } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
-                fprintf(f, "DENIED");
-        } else {
-                fprintf(f, "%d", ace->type);
-        }
-
-        /* Not sure what flags can be set in a file ACL */
-
-        fprintf(f, "/%d/", ace->flags);
-
-        /* Standard permissions */
-
-        for (v = standard_values; v->perm; v++) {
-                if (ace->access_mask == v->mask) {
-                        fprintf(f, "%s", v->perm);
-                        return;
-                }
-        }
-
-        /* Special permissions.  Print out a hex value if we have
-           leftover bits in the mask. */
-
-        got_mask = ace->access_mask;
-
- again:
-        for (v = special_values; v->perm; v++) {
-                if ((ace->access_mask & v->mask) == v->mask) {
-                        if (do_print) {
-                                fprintf(f, "%s", v->perm);
-                        }
-                        got_mask &= ~v->mask;
-                }
-        }
-
-        if (!do_print) {
-                if (got_mask != 0) {
-                        fprintf(f, "0x%08x", ace->access_mask);
-                } else {
-                        do_print = 1;
-                        goto again;
-                }
-        }
-}
-
-/********************************************************************
- print an ascii version of a security descriptor on a FILE handle
-********************************************************************/
-
-static void sec_desc_print(FILE *f, struct security_descriptor *sd)
-{
-        uint32 i;
-
-        fprintf(f, "REVISION:%d\n", sd->revision);
-
-        /* Print owner and group sid */
-
-        fprintf(f, "OWNER:%s\n", sid_string_tos(sd->owner_sid));
-
-        fprintf(f, "GROUP:%s\n", sid_string_tos(sd->group_sid));
-
-        /* Print aces */
-        for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
-                struct security_ace *ace = &sd->dacl->aces[i];
-                fprintf(f, "ACL:");
-                print_ace(f, ace);
-                fprintf(f, "\n");
-        }
-}
-
-/********************************************************************
- parse an ACE in the same format as print_ace()
-********************************************************************/
-
-static bool parse_ace(struct security_ace *ace, const char *orig_str)
-{
-        char *p;
-        const char *cp;
-        char *tok;
-        unsigned int atype = 0;
-        unsigned int aflags = 0;
-        unsigned int amask = 0;
-        struct dom_sid sid;
-        uint32_t mask;
-        const struct perm_value *v;
-        char *str = SMB_STRDUP(orig_str);
-        TALLOC_CTX *frame = talloc_stackframe();
-
-        if (!str) {
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        ZERO_STRUCTP(ace);
-        p = strchr_m(str,':');
-        if (!p) {
-                fprintf(stderr, "ACE '%s': missing ':'.\n", orig_str);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-        *p = '\0';
-        p++;
-        /* Try to parse numeric form */
-
-        if (sscanf(p, "%i/%i/%i", &atype, &aflags, &amask) == 3 &&
-            string_to_sid(&sid, str)) {
-                goto done;
-        }
-
-        /* Try to parse text form */
-
-        if (!string_to_sid(&sid, str)) {
-                fprintf(stderr, "ACE '%s': failed to convert '%s' to SID\n",
-                        orig_str, str);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        cp = p;
-        if (!next_token_talloc(frame, &cp, &tok, "/")) {
-                fprintf(stderr, "ACE '%s': failed to find '/' character.\n",
-                        orig_str);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        if (strncmp(tok, "ALLOWED", strlen("ALLOWED")) == 0) {
-                atype = SEC_ACE_TYPE_ACCESS_ALLOWED;
-        } else if (strncmp(tok, "DENIED", strlen("DENIED")) == 0) {
-                atype = SEC_ACE_TYPE_ACCESS_DENIED;
-        } else {
-                fprintf(stderr, "ACE '%s': missing 'ALLOWED' or 'DENIED' "
-                        "entry at '%s'\n", orig_str, tok);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        /* Only numeric form accepted for flags at present */
-        /* no flags on share permissions */
-
-        if (!(next_token_talloc(frame, &cp, &tok, "/") &&
-              sscanf(tok, "%i", &aflags) && aflags == 0)) {
-                fprintf(stderr, "ACE '%s': bad integer flags entry at '%s'\n",
-                        orig_str, tok);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        if (!next_token_talloc(frame, &cp, &tok, "/")) {
-                fprintf(stderr, "ACE '%s': missing / at '%s'\n",
-                        orig_str, tok);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        if (strncmp(tok, "0x", 2) == 0) {
-                if (sscanf(tok, "%i", &amask) != 1) {
-                        fprintf(stderr, "ACE '%s': bad hex number at '%s'\n",
-                                orig_str, tok);
-                        TALLOC_FREE(frame);
-                        SAFE_FREE(str);
-                        return False;
-                }
-                goto done;
-        }
-
-        for (v = standard_values; v->perm; v++) {
-                if (strcmp(tok, v->perm) == 0) {
-                        amask = v->mask;
-                        goto done;
-                }
-        }
-
-        p = tok;
-
-        while(*p) {
-                bool found = False;
-
-                for (v = special_values; v->perm; v++) {
-                        if (v->perm[0] == *p) {
-                                amask |= v->mask;
-                                found = True;
-                        }
-                }
-
-                if (!found) {
-                        fprintf(stderr, "ACE '%s': bad permission value at "
-                                "'%s'\n", orig_str, p);
-                        TALLOC_FREE(frame);
-                        SAFE_FREE(str);
-                        return False;
-                }
-                p++;
-        }
-
-        if (*p) {
-                TALLOC_FREE(frame);
-                SAFE_FREE(str);
-                return False;
-        }
-
- done:
-        mask = amask;
-        init_sec_ace(ace, &sid, atype, mask, aflags);
-        SAFE_FREE(str);
-        TALLOC_FREE(frame);
-        return True;
-}
-
+                SMB_SD_SETSDDL,
+                SMB_SD_VIEWSDDL,
+                SMB_ACL_VIEW,
+                SMB_ACL_VIEW_ALL };
 
 /********************************************************************
@@ -313 +60 @@
         num_ace = count_chars( pacl, ',' ) + 1;
 
-        if ( !(ace = TALLOC_ZERO_ARRAY( mem_ctx, struct security_ace, num_ace )) )
+        if ( !(ace = talloc_zero_array( mem_ctx, struct security_ace, num_ace )) )
                 return NULL;
 
@@ -323 +70 @@
                 acl_string[MIN( PTR_DIFF( end_acl, pacl ), sizeof(fstring)-1)] = '\0';
 
-                if ( !parse_ace( &ace[i], acl_string ) )
+                if ( !parse_ace(NULL, &ace[i], acl_string ) )
                         return NULL;
 
@@ -367 +114 @@
 static int ace_compare(struct security_ace *ace1, struct security_ace *ace2)
 {
-        if (sec_ace_equal(ace1, ace2))
+        if (security_ace_equal(ace1, ace2))
                 return 0;
 
@@ -390 +137 @@
 static void sort_acl(struct security_acl *the_acl)
 {
-        uint32 i;
+        uint32_t i;
         if (!the_acl) return;
 
@@ -396 +143 @@
 
         for (i=1;i<the_acl->num_aces;) {
-                if (sec_ace_equal(&the_acl->aces[i-1], &the_acl->aces[i])) {
+                if (security_ace_equal(&the_acl->aces[i-1],
+                                       &the_acl->aces[i])) {
                         int j;
                         for (j=i; j<the_acl->num_aces-1; j++) {
@@ -414 +162 @@
         struct security_descriptor *old = NULL;
         size_t sd_size = 0;
-        uint32 i, j;
+        uint32_t i, j;
 
         if (mode != SMB_ACL_SET && mode != SMB_SD_DELETE) {
@@ -431 +179 @@
 
         switch (mode) {
+        case SMB_ACL_VIEW_ALL:
+                /* should not happen */
+                return 0;
         case SMB_ACL_VIEW:
-                sec_desc_print( stdout, old);
+                sec_desc_print(NULL, stdout, old, false);
                 return 0;
         case SMB_ACL_DELETE:
@@ -439 +190 @@
 
                 for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
-                    if (sec_ace_equal(&sd->dacl->aces[i], &old->dacl->aces[j])) {
-                        uint32 k;
+                    if (security_ace_equal(&sd->dacl->aces[i],
+                                           &old->dacl->aces[j])) {
+                        uint32_t k;
                         for (k=j; k<old->dacl->num_aces-1;k++) {
                             old->dacl->aces[k] = old->dacl->aces[k+1];
@@ -451 +203 @@
 
                 if (!found) {
-                printf("ACL for ACE:");
-                print_ace(stdout, &sd->dacl->aces[i]);
-                printf(" not found\n");
+                        printf("ACL for ACE:");
+                        print_ace(NULL, stdout, &sd->dacl->aces[i], false);
+                        printf(" not found\n");
                 }
             }
@@ -498 +250 @@
             }
             return 0;
+        default:
+                fprintf(stderr, "invalid command\n");
+                return -1;
         }
 
@@ -510 +265 @@
 }
 
+static int set_sharesec_sddl(const char *sharename, const char *sddl)
+{
+        struct security_descriptor *sd;
+        bool ret;
+
+        sd = sddl_decode(talloc_tos(), sddl, get_global_sam_sid());
+        if (sd == NULL) {
+                fprintf(stderr, "Failed to parse acl\n");
+                return -1;
+        }
+
+        ret = set_share_security(sharename, sd);
+        TALLOC_FREE(sd);
+        if (!ret) {
+                fprintf(stderr, "Failed to store acl for share [%s]\n",
+                        sharename);
+                return -1;
+        }
+
+        return 0;
+}
+
+static int view_sharesec_sddl(const char *sharename)
+{
+        struct security_descriptor *sd;
+        size_t sd_size;
+        char *acl;
+
+        sd = get_share_security(talloc_tos(), sharename, &sd_size);
+        if (sd == NULL) {
+                fprintf(stderr, "Unable to retrieve permissions for share "
+                        "[%s]\n", sharename);
+                return -1;
+        }
+
+        acl = sddl_encode(talloc_tos(), sd, get_global_sam_sid());
+        TALLOC_FREE(sd);
+        if (acl == NULL) {
+                fprintf(stderr, "Unable to sddl-encode permissions for share "
+                        "[%s]\n", sharename);
+                return -1;
+        }
+        printf("%s\n", acl);
+        TALLOC_FREE(acl);
+        return 0;
+}
+
 /********************************************************************
   main program
 ********************************************************************/
+
+enum {
+        OPT_VIEW_ALL = 1000,
+};
 
 int main(int argc, const char *argv[])
@@ -532 +338 @@
                 { "replace", 'R', POPT_ARG_STRING, &the_acl, 'R', "Overwrite share permission ACL", "ACLS" },
                 { "delete", 'D', POPT_ARG_NONE, NULL, 'D', "Delete the entire security descriptor" },
+                { "setsddl", 'S', POPT_ARG_STRING, the_acl, 'S',
+                  "Set the SD in sddl format" },
+                { "viewsddl", 'V', POPT_ARG_NONE, the_acl, 'V',
+                  "View the SD in sddl format" },
                 { "view", 'v', POPT_ARG_NONE, NULL, 'v', "View current share permissions" },
+                { "view-all", 0, POPT_ARG_NONE, NULL, OPT_VIEW_ALL,
+                  "View all current share permissions" },
                 { "machine-sid", 'M', POPT_ARG_NONE, NULL, 'M', "Initialize the machine SID" },
                 { "force", 'F', POPT_ARG_NONE, NULL, 'F', "Force storing the ACL", "ACLS" },
@@ -547 +359 @@
         setup_logging( "sharesec", DEBUG_STDERR);
 
-        load_case_tables();
+        smb_init_locale();
 
         lp_set_cmdline("log level", "1");
@@ -581 +393 @@
                         break;
 
+                case 'S':
+                        mode = SMB_SD_SETSDDL;
+                        the_acl = smb_xstrdup(poptGetOptArg(pc));
+                        break;
+
+                case 'V':
+                        mode = SMB_SD_VIEWSDDL;
+                        break;
+
                 case 'v':
                         mode = SMB_ACL_VIEW;
@@ -592 +413 @@
                         initialize_sid = True;
                         break;
+                case OPT_VIEW_ALL:
+                        mode = SMB_ACL_VIEW_ALL;
+                        break;
                 }
         }
@@ -597 +421 @@
         setlinebuf(stdout);
 
-        lp_load_with_registry_shares( get_dyn_CONFIGFILE(), False, False, False,
-                                      True );
+        lp_load_with_registry_shares(get_dyn_CONFIGFILE());
 
         /* check for initializing secrets.tdb first */
@@ -619 +442 @@
         }
 
+        if (mode == SMB_ACL_VIEW_ALL) {
+                int i;
+
+                for (i=0; i<lp_numservices(); i++) {
+                        TALLOC_CTX *frame = talloc_stackframe();
+                        const char *service = lp_servicename(frame, i);
+
+                        if (service == NULL) {
+                                continue;
+                        }
+
+                        printf("[%s]\n", service);
+                        change_share_sec(frame, service, NULL, SMB_ACL_VIEW);
+                        printf("\n");
+                        TALLOC_FREE(frame);
+                }
+                goto done;
+        }
+
         /* get the sharename */
 
@@ -635 +477 @@
         }
 
-        retval = change_share_sec(ctx, sharename, the_acl, mode);
-
+        switch (mode) {
+        case SMB_SD_SETSDDL:
+                retval = set_sharesec_sddl(sharename, the_acl);
+                break;
+        case SMB_SD_VIEWSDDL:
+                retval = view_sharesec_sddl(sharename);
+                break;
+        default:
+                retval = change_share_sec(ctx, sharename, the_acl, mode);
+                break;
+        }
+
+done:
         talloc_destroy(ctx);
 

vendor/current/source3/utils/smbcacls.c

@@ -31 +31 @@
 #include "libsmb/clirap.h"
 #include "passdb/machine_sid.h"
+#include "../librpc/gen_ndr/ndr_lsa_c.h"
+#include "util_sd.h"
 
 static int test_args;
@@ -36 +38 @@
 #define CREATE_ACCESS_READ READ_CONTROL_ACCESS
 
-/* numeric is set when the user wants numeric SIDs and ACEs rather
-   than going via LSA calls to resolve them */
-static int numeric;
-
 static int sddl;
+static int query_sec_info = -1;
+static int set_sec_info = -1;
+
+static const char *domain_sid = NULL;
 
 enum acl_mode {SMB_ACL_SET, SMB_ACL_DELETE, SMB_ACL_MODIFY, SMB_ACL_ADD };
@@ -46 +48 @@
 enum exit_values {EXIT_OK, EXIT_FAILED, EXIT_PARSE_ERROR};
 
-struct perm_value {
-        const char *perm;
-        uint32 mask;
-};
-
-/* These values discovered by inspection */
-
-static const struct perm_value special_values[] = {
-        { "R", 0x00120089 },
-        { "W", 0x00120116 },
-        { "X", 0x001200a0 },
-        { "D", 0x00010000 },
-        { "P", 0x00040000 },
-        { "O", 0x00080000 },
-        { NULL, 0 },
-};
-
-static const struct perm_value standard_values[] = {
-        { "READ",   0x001200a9 },
-        { "CHANGE", 0x001301bf },
-        { "FULL",   0x001f01ff },
-        { NULL, 0 },
-};
-
-/* Open cli connection and policy handle */
-
-static NTSTATUS cli_lsa_lookup_sid(struct cli_state *cli,
-                                   const struct dom_sid *sid,
-                                   TALLOC_CTX *mem_ctx,
-                                   enum lsa_SidType *type,
-                                   char **domain, char **name)
-{
-        uint16 orig_cnum = cli->cnum;
-        struct rpc_pipe_client *p = NULL;
+static NTSTATUS cli_lsa_lookup_domain_sid(struct cli_state *cli,
+                                          struct dom_sid *sid)
+{
+        union lsa_PolicyInformation *info = NULL;
+        uint16_t orig_cnum = cli_state_get_tid(cli);
+        struct rpc_pipe_client *rpc_pipe = NULL;
         struct policy_handle handle;
-        NTSTATUS status;
+        NTSTATUS status, result;
         TALLOC_CTX *frame = talloc_stackframe();
-        enum lsa_SidType *types;
-        char **domains;
-        char **names;
-
-        status = cli_tcon_andx(cli, "IPC$", "?????", "", 0);
+
+        status = cli_tree_connect(cli, "IPC$", "?????", "", 0);
         if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
-                                          &p);
+                goto done;
+        }
+
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc, &rpc_pipe);
         if (!NT_STATUS_IS_OK(status)) {
-                goto fail;
-        }
-
-        status = rpccli_lsa_open_policy(p, talloc_tos(), True,
+                goto tdis;
+        }
+
+        status = rpccli_lsa_open_policy(rpc_pipe, frame, True,
                                         GENERIC_EXECUTE_ACCESS, &handle);
         if (!NT_STATUS_IS_OK(status)) {
-                goto fail;
-        }
-
-        status = rpccli_lsa_lookup_sids(p, talloc_tos(), &handle, 1, sid,
-                                        &domains, &names, &types);
-        if (!NT_STATUS_IS_OK(status)) {
-                goto fail;
-        }
-
-        *type = types[0];
-        *domain = talloc_move(mem_ctx, &domains[0]);
-        *name = talloc_move(mem_ctx, &names[0]);
-
-        status = NT_STATUS_OK;
- fail:
-        TALLOC_FREE(p);
+                goto tdis;
+        }
+
+        status = dcerpc_lsa_QueryInfoPolicy2(rpc_pipe->binding_handle,
+                                             frame, &handle,
+                                             LSA_POLICY_INFO_DOMAIN,
+                                             &info, &result);
+
+        if (any_nt_status_not_ok(status, result, &status)) {
+                goto tdis;
+        }
+
+        *sid = *info->domain.sid;
+
+tdis:
+        TALLOC_FREE(rpc_pipe);
         cli_tdis(cli);
-        cli->cnum = orig_cnum;
+done:
+        cli_state_set_tid(cli, orig_cnum);
         TALLOC_FREE(frame);
         return status;
 }
 
-static NTSTATUS cli_lsa_lookup_name(struct cli_state *cli,
-                                    const char *name,
-                                    enum lsa_SidType *type,
-                                    struct dom_sid *sid)
-{
-        uint16 orig_cnum = cli->cnum;
-        struct rpc_pipe_client *p;
-        struct policy_handle handle;
+static struct dom_sid *get_domain_sid(struct cli_state *cli)
+{
         NTSTATUS status;
-        TALLOC_CTX *frame = talloc_stackframe();
-        struct dom_sid *sids;
-        enum lsa_SidType *types;
-
-        status = cli_tcon_andx(cli, "IPC$", "?????", "", 0);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
-        }
-
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
-                                          &p);
-        if (!NT_STATUS_IS_OK(status)) {
-                goto fail;
-        }
-
-        status = rpccli_lsa_open_policy(p, talloc_tos(), True,
-                                        GENERIC_EXECUTE_ACCESS, &handle);
-        if (!NT_STATUS_IS_OK(status)) {
-                goto fail;
-        }
-
-        status = rpccli_lsa_lookup_names(p, talloc_tos(), &handle, 1, &name,
-                                         NULL, 1, &sids, &types);
-        if (!NT_STATUS_IS_OK(status)) {
-                goto fail;
-        }
-
-        *type = types[0];
-        *sid = sids[0];
-
-        status = NT_STATUS_OK;
- fail:
-        TALLOC_FREE(p);
-        cli_tdis(cli);
-        cli->cnum = orig_cnum;
-        TALLOC_FREE(frame);
-        return status;
-}
-
-/* convert a SID to a string, either numeric or username/group */
-static void SidToString(struct cli_state *cli, fstring str, const struct dom_sid *sid)
-{
-        char *domain = NULL;
-        char *name = NULL;
-        enum lsa_SidType type;
-        NTSTATUS status;
-
-        sid_to_fstring(str, sid);
-
-        if (numeric) {
-                return;
-        }
-
-        status = cli_lsa_lookup_sid(cli, sid, talloc_tos(), &type,
-                                    &domain, &name);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                return;
-        }
-
-        if (*domain) {
-                slprintf(str, sizeof(fstring) - 1, "%s%s%s",
-                        domain, lp_winbind_separator(), name);
+
+        struct dom_sid *sid = talloc(talloc_tos(), struct dom_sid);
+        if (sid == NULL) {
+                DEBUG(0, ("Out of memory\n"));
+                return NULL;
+        }
+
+        if (domain_sid) {
+                if (!dom_sid_parse(domain_sid, sid)) {
+                        DEBUG(0,("failed to parse domain sid\n"));
+                        TALLOC_FREE(sid);
+                }
         } else {
-                fstrcpy(str, name);
-        }
-}
-
-/* convert a string to a SID, either numeric or username/group */
-static bool StringToSid(struct cli_state *cli, struct dom_sid *sid, const char *str)
-{
-        enum lsa_SidType type;
-
-        if (string_to_sid(sid, str)) {
-                return true;
-        }
-
-        return NT_STATUS_IS_OK(cli_lsa_lookup_name(cli, str, &type, sid));
-}
-
-static void print_ace_flags(FILE *f, uint8_t flags)
-{
-        char *str = talloc_strdup(NULL, "");
-
-        if (!str) {
-                goto out;
-        }
-
-        if (flags & SEC_ACE_FLAG_OBJECT_INHERIT) {
-                str = talloc_asprintf(str, "%s%s",
-                                str, "OI|");
-                if (!str) {
-                        goto out;
-                }
-        }
-        if (flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
-                str = talloc_asprintf(str, "%s%s",
-                                str, "CI|");
-                if (!str) {
-                        goto out;
-                }
-        }
-        if (flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
-                str = talloc_asprintf(str, "%s%s",
-                                str, "NP|");
-                if (!str) {
-                        goto out;
-                }
-        }
-        if (flags & SEC_ACE_FLAG_INHERIT_ONLY) {
-                str = talloc_asprintf(str, "%s%s",
-                                str, "IO|");
-                if (!str) {
-                        goto out;
-                }
-        }
-        if (flags & SEC_ACE_FLAG_INHERITED_ACE) {
-                str = talloc_asprintf(str, "%s%s",
-                                str, "I|");
-                if (!str) {
-                        goto out;
-                }
-        }
-        /* Ignore define SEC_ACE_FLAG_SUCCESSFUL_ACCESS ( 0x40 )
-           and SEC_ACE_FLAG_FAILED_ACCESS ( 0x80 ) as they're
-           audit ace flags. */
-
-        if (str[strlen(str)-1] == '|') {
-                str[strlen(str)-1] = '\0';
-                fprintf(f, "/%s/", str);
-        } else {
-                fprintf(f, "/0x%x/", flags);
-        }
-        TALLOC_FREE(str);
-        return;
-
-  out:
-        fprintf(f, "/0x%x/", flags);
-}
-
-/* print an ACE on a FILE, using either numeric or ascii representation */
-static void print_ace(struct cli_state *cli, FILE *f, struct security_ace *ace)
-{
-        const struct perm_value *v;
-        fstring sidstr;
-        int do_print = 0;
-        uint32 got_mask;
-
-        SidToString(cli, sidstr, &ace->trustee);
-
-        fprintf(f, "%s:", sidstr);
-
-        if (numeric) {
-                fprintf(f, "%d/0x%x/0x%08x",
-                        ace->type, ace->flags, ace->access_mask);
-                return;
-        }
-
-        /* Ace type */
-
-        if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
-                fprintf(f, "ALLOWED");
-        } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
-                fprintf(f, "DENIED");
-        } else {
-                fprintf(f, "%d", ace->type);
-        }
-
-        print_ace_flags(f, ace->flags);
-
-        /* Standard permissions */
-
-        for (v = standard_values; v->perm; v++) {
-                if (ace->access_mask == v->mask) {
-                        fprintf(f, "%s", v->perm);
-                        return;
-                }
-        }
-
-        /* Special permissions.  Print out a hex value if we have
-           leftover bits in the mask. */
-
-        got_mask = ace->access_mask;
-
- again:
-        for (v = special_values; v->perm; v++) {
-                if ((ace->access_mask & v->mask) == v->mask) {
-                        if (do_print) {
-                                fprintf(f, "%s", v->perm);
-                        }
-                        got_mask &= ~v->mask;
-                }
-        }
-
-        if (!do_print) {
-                if (got_mask != 0) {
-                        fprintf(f, "0x%08x", ace->access_mask);
-                } else {
-                        do_print = 1;
-                        goto again;
-                }
-        }
-}
-
-static bool parse_ace_flags(const char *str, unsigned int *pflags)
-{
-        const char *p = str;
-        *pflags = 0;
-
-        while (*p) {
-                if (strnequal(p, "OI", 2)) {
-                        *pflags |= SEC_ACE_FLAG_OBJECT_INHERIT;
-                        p += 2;
-                } else if (strnequal(p, "CI", 2)) {
-                        *pflags |= SEC_ACE_FLAG_CONTAINER_INHERIT;
-                        p += 2;
-                } else if (strnequal(p, "NP", 2)) {
-                        *pflags |= SEC_ACE_FLAG_NO_PROPAGATE_INHERIT;
-                        p += 2;
-                } else if (strnequal(p, "IO", 2)) {
-                        *pflags |= SEC_ACE_FLAG_INHERIT_ONLY;
-                        p += 2;
-                } else if (*p == 'I') {
-                        *pflags |= SEC_ACE_FLAG_INHERITED_ACE;
-                        p += 1;
-                } else if (*p) {
-                        return false;
-                }
-
-                switch (*p) {
-                case '|':
-                        p++;
-                case '\0':
-                        continue;
-                default:
-                        return false;
-                }
-        }
-        return true;
-}
-
-/* parse an ACE in the same format as print_ace() */
-static bool parse_ace(struct cli_state *cli, struct security_ace *ace,
-                      const char *orig_str)
-{
-        char *p;
-        const char *cp;
-        char *tok;
-        unsigned int atype = 0;
-        unsigned int aflags = 0;
-        unsigned int amask = 0;
-        struct dom_sid sid;
-        uint32_t mask;
-        const struct perm_value *v;
-        char *str = SMB_STRDUP(orig_str);
-        TALLOC_CTX *frame = talloc_stackframe();
-
-        if (!str) {
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        ZERO_STRUCTP(ace);
-        p = strchr_m(str,':');
-        if (!p) {
-                printf("ACE '%s': missing ':'.\n", orig_str);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-        *p = '\0';
-        p++;
-        /* Try to parse numeric form */
-
-        if (sscanf(p, "%i/%i/%i", &atype, &aflags, &amask) == 3 &&
-            StringToSid(cli, &sid, str)) {
-                goto done;
-        }
-
-        /* Try to parse text form */
-
-        if (!StringToSid(cli, &sid, str)) {
-                printf("ACE '%s': failed to convert '%s' to SID\n",
-                        orig_str, str);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        cp = p;
-        if (!next_token_talloc(frame, &cp, &tok, "/")) {
-                printf("ACE '%s': failed to find '/' character.\n",
-                        orig_str);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        if (strncmp(tok, "ALLOWED", strlen("ALLOWED")) == 0) {
-                atype = SEC_ACE_TYPE_ACCESS_ALLOWED;
-        } else if (strncmp(tok, "DENIED", strlen("DENIED")) == 0) {
-                atype = SEC_ACE_TYPE_ACCESS_DENIED;
-        } else {
-                printf("ACE '%s': missing 'ALLOWED' or 'DENIED' entry at '%s'\n",
-                        orig_str, tok);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        /* Only numeric form accepted for flags at present */
-
-        if (!next_token_talloc(frame, &cp, &tok, "/")) {
-                printf("ACE '%s': bad flags entry at '%s'\n",
-                        orig_str, tok);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        if (tok[0] < '0' || tok[0] > '9') {
-                if (!parse_ace_flags(tok, &aflags)) {
-                        printf("ACE '%s': bad named flags entry at '%s'\n",
-                                orig_str, tok);
-                        SAFE_FREE(str);
-                        TALLOC_FREE(frame);
-                        return False;
-                }
-        } else if (strnequal(tok, "0x", 2)) {
-                if (!sscanf(tok, "%x", &aflags)) {
-                        printf("ACE '%s': bad hex flags entry at '%s'\n",
-                                orig_str, tok);
-                        SAFE_FREE(str);
-                        TALLOC_FREE(frame);
-                        return False;
-                }
-        } else {
-                if (!sscanf(tok, "%i", &aflags)) {
-                        printf("ACE '%s': bad integer flags entry at '%s'\n",
-                                orig_str, tok);
-                        SAFE_FREE(str);
-                        TALLOC_FREE(frame);
-                        return False;
-                }
-        }
-
-        if (!next_token_talloc(frame, &cp, &tok, "/")) {
-                printf("ACE '%s': missing / at '%s'\n",
-                        orig_str, tok);
-                SAFE_FREE(str);
-                TALLOC_FREE(frame);
-                return False;
-        }
-
-        if (strncmp(tok, "0x", 2) == 0) {
-                if (sscanf(tok, "%i", &amask) != 1) {
-                        printf("ACE '%s': bad hex number at '%s'\n",
-                                orig_str, tok);
-                        SAFE_FREE(str);
-                        TALLOC_FREE(frame);
-                        return False;
-                }
-                goto done;
-        }
-
-        for (v = standard_values; v->perm; v++) {
-                if (strcmp(tok, v->perm) == 0) {
-                        amask = v->mask;
-                        goto done;
-                }
-        }
-
-        p = tok;
-
-        while(*p) {
-                bool found = False;
-
-                for (v = special_values; v->perm; v++) {
-                        if (v->perm[0] == *p) {
-                                amask |= v->mask;
-                                found = True;
-                        }
-                }
-
-                if (!found) {
-                        printf("ACE '%s': bad permission value at '%s'\n",
-                                orig_str, p);
-                        SAFE_FREE(str);
-                        TALLOC_FREE(frame);
-                        return False;
-                }
-                p++;
-        }
-
-        if (*p) {
-                TALLOC_FREE(frame);
-                SAFE_FREE(str);
-                return False;
-        }
-
- done:
-        mask = amask;
-        init_sec_ace(ace, &sid, atype, mask, aflags);
-        TALLOC_FREE(frame);
-        SAFE_FREE(str);
-        return True;
+                status = cli_lsa_lookup_domain_sid(cli, sid);
+
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0,("failed to lookup domain sid: %s\n", nt_errstr(status)));
+                        TALLOC_FREE(sid);
+                }
+
+        }
+
+        DEBUG(2,("Domain SID: %s\n", sid_string_dbg(sid)));
+        return sid;
 }
 
@@ -633 +216 @@
 }
 
-
-/* print a ascii version of a security descriptor on a FILE handle */
-static void sec_desc_print(struct cli_state *cli, FILE *f, struct security_descriptor *sd)
-{
-        fstring sidstr;
-        uint32 i;
-
-        fprintf(f, "REVISION:%d\n", sd->revision);
-        fprintf(f, "CONTROL:0x%x\n", sd->type);
-
-        /* Print owner and group sid */
-
-        if (sd->owner_sid) {
-                SidToString(cli, sidstr, sd->owner_sid);
-        } else {
-                fstrcpy(sidstr, "");
-        }
-
-        fprintf(f, "OWNER:%s\n", sidstr);
-
-        if (sd->group_sid) {
-                SidToString(cli, sidstr, sd->group_sid);
-        } else {
-                fstrcpy(sidstr, "");
-        }
-
-        fprintf(f, "GROUP:%s\n", sidstr);
-
-        /* Print aces */
-        for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
-                struct security_ace *ace = &sd->dacl->aces[i];
-                fprintf(f, "ACL:");
-                print_ace(cli, f, ace);
-                fprintf(f, "\n");
-        }
-
-}
-
 /*****************************************************
 get fileinfo for filename
 *******************************************************/
-static uint16 get_fileinfo(struct cli_state *cli, const char *filename)
+static uint16_t get_fileinfo(struct cli_state *cli, const char *filename)
 {
         uint16_t fnum = (uint16_t)-1;
-        uint16 mode = 0;
+        uint16_t mode = 0;
         NTSTATUS status;
 
@@ -685 +230 @@
         status = cli_ntcreate(cli, filename, 0, CREATE_ACCESS_READ,
                               0, FILE_SHARE_READ|FILE_SHARE_WRITE,
-                              FILE_OPEN, 0x0, 0x0, &fnum);
+                              FILE_OPEN, 0x0, 0x0, &fnum, NULL);
         if (!NT_STATUS_IS_OK(status)) {
                 printf("Failed to open %s: %s\n", filename, nt_errstr(status));
@@ -711 +256 @@
         struct security_descriptor *sd;
         NTSTATUS status;
-
-        /* The desired access below is the only one I could find that works
-           with NT4, W2KP and Samba */
-
-        status = cli_ntcreate(cli, filename, 0, CREATE_ACCESS_READ,
+        uint32_t sec_info;
+        uint32_t desired_access = 0;
+
+        if (query_sec_info == -1) {
+                sec_info = SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL;
+        } else {
+                sec_info = query_sec_info;
+        }
+
+        if (sec_info & (SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL)) {
+                desired_access |= SEC_STD_READ_CONTROL;
+        }
+        if (sec_info & SECINFO_SACL) {
+                desired_access |= SEC_FLAG_SYSTEM_SECURITY;
+        }
+
+        if (desired_access == 0) {
+                desired_access |= SEC_STD_READ_CONTROL;
+        }
+
+        status = cli_ntcreate(cli, filename, 0, desired_access,
                               0, FILE_SHARE_READ|FILE_SHARE_WRITE,
-                              FILE_OPEN, 0x0, 0x0, &fnum);
+                              FILE_OPEN, 0x0, 0x0, &fnum, NULL);
         if (!NT_STATUS_IS_OK(status)) {
                 printf("Failed to open %s: %s\n", filename, nt_errstr(status));
@@ -723 +284 @@
         }
 
-        sd = cli_query_secdesc(cli, fnum, talloc_tos());
+        status = cli_query_security_descriptor(cli, fnum, sec_info,
+                                               talloc_tos(), &sd);
 
         cli_close(cli, fnum);
 
-        if (!sd) {
-                printf("Failed to get security descriptor\n");
+        if (!NT_STATUS_IS_OK(status)) {
+                printf("Failed to get security descriptor: %s\n",
+                       nt_errstr(status));
                 return NULL;
         }
@@ -743 +306 @@
         bool result=true;
         NTSTATUS status;
-
-        /* The desired access below is the only one I could find that works
-           with NT4, W2KP and Samba */
+        uint32_t desired_access = 0;
+        uint32_t sec_info;
+
+        if (set_sec_info == -1) {
+                sec_info = 0;
+
+                if (sd->dacl || (sd->type & SEC_DESC_DACL_PRESENT)) {
+                        sec_info |= SECINFO_DACL;
+                }
+                if (sd->sacl || (sd->type & SEC_DESC_SACL_PRESENT)) {
+                        sec_info |= SECINFO_SACL;
+                }
+                if (sd->owner_sid) {
+                        sec_info |= SECINFO_OWNER;
+                }
+                if (sd->group_sid) {
+                        sec_info |= SECINFO_GROUP;
+                }
+        } else {
+                sec_info = set_sec_info;
+        }
+
+        /* Make the desired_access more specific. */
+        if (sec_info & SECINFO_DACL) {
+                desired_access |= SEC_STD_WRITE_DAC;
+        }
+        if (sec_info & SECINFO_SACL) {
+                desired_access |= SEC_FLAG_SYSTEM_SECURITY;
+        }
+        if (sec_info & (SECINFO_OWNER | SECINFO_GROUP)) {
+                desired_access |= SEC_STD_WRITE_OWNER;
+        }
 
         status = cli_ntcreate(cli, filename, 0,
-                              WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS,
+                              desired_access,
                               0, FILE_SHARE_READ|FILE_SHARE_WRITE,
-                              FILE_OPEN, 0x0, 0x0, &fnum);
+                              FILE_OPEN, 0x0, 0x0, &fnum, NULL);
         if (!NT_STATUS_IS_OK(status)) {
                 printf("Failed to open %s: %s\n", filename, nt_errstr(status));
@@ -756 +348 @@
         }
 
-        status = cli_set_secdesc(cli, fnum, sd);
+        status = cli_set_security_descriptor(cli, fnum, sec_info, sd);
         if (!NT_STATUS_IS_OK(status)) {
                 printf("ERROR: security description set failed: %s\n",
@@ -770 +362 @@
 dump the acls for a file
 *******************************************************/
-static int cacl_dump(struct cli_state *cli, const char *filename)
-{
-        int result = EXIT_FAILED;
+static int cacl_dump(struct cli_state *cli, const char *filename, bool numeric)
+{
         struct security_descriptor *sd;
 
-        if (test_args)
+        if (test_args) {
                 return EXIT_OK;
+        }
 
         sd = get_secdesc(cli, filename);
-
-        if (sd) {
-                if (sddl) {
-                        printf("%s\n", sddl_encode(talloc_tos(), sd,
-                                           get_global_sam_sid()));
-                } else {
-                        sec_desc_print(cli, stdout, sd);
-                }
-                result = EXIT_OK;
-        }
-
-        return result;
+        if (sd == NULL) {
+                return EXIT_FAILED;
+        }
+
+        if (sddl) {
+                char *str = sddl_encode(talloc_tos(), sd, get_domain_sid(cli));
+                if (str == NULL) {
+                        return EXIT_FAILED;
+                }
+                printf("%s\n", str);
+                TALLOC_FREE(str);
+        } else {
+                sec_desc_print(cli, stdout, sd, numeric);
+        }
+
+        return EXIT_OK;
 }
 
@@ -814 +410 @@
         }
 
-        sd = make_sec_desc(talloc_tos(),old->revision, old->type,
+        sd = make_sec_desc(talloc_tos(),old->revision, SEC_DESC_SELF_RELATIVE,
                                 (change_mode == REQUEST_CHOWN) ? &sid : NULL,
                                 (change_mode == REQUEST_CHGRP) ? &sid : NULL,
@@ -837 +433 @@
 static int ace_compare(struct security_ace *ace1, struct security_ace *ace2)
 {
-        if (sec_ace_equal(ace1, ace2))
+        if (security_ace_equal(ace1, ace2))
                 return 0;
 
@@ -870 +466 @@
 static void sort_acl(struct security_acl *the_acl)
 {
-        uint32 i;
+        uint32_t i;
         if (!the_acl) return;
 
@@ -876 +472 @@
 
         for (i=1;i<the_acl->num_aces;) {
-                if (sec_ace_equal(&the_acl->aces[i-1], &the_acl->aces[i])) {
+                if (security_ace_equal(&the_acl->aces[i-1],
+                                       &the_acl->aces[i])) {
                         int j;
                         for (j=i; j<the_acl->num_aces-1; j++) {
@@ -893 +490 @@
 
 static int cacl_set(struct cli_state *cli, const char *filename,
-                    char *the_acl, enum acl_mode mode)
+                    char *the_acl, enum acl_mode mode, bool numeric)
 {
         struct security_descriptor *sd, *old;
-        uint32 i, j;
+        uint32_t i, j;
         size_t sd_size;
         int result = EXIT_OK;
 
         if (sddl) {
-                sd = sddl_decode(talloc_tos(), the_acl, get_global_sam_sid());
+                sd = sddl_decode(talloc_tos(), the_acl, get_domain_sid(cli));
         } else {
                 sd = sec_desc_parse(talloc_tos(), cli, the_acl);
@@ -922 +519 @@
 
                         for (j=0;old->dacl && j<old->dacl->num_aces;j++) {
-                                if (sec_ace_equal(&sd->dacl->aces[i],
-                                                  &old->dacl->aces[j])) {
-                                        uint32 k;
+                                if (security_ace_equal(&sd->dacl->aces[i],
+                                                       &old->dacl->aces[j])) {
+                                        uint32_t k;
                                         for (k=j; k<old->dacl->num_aces-1;k++) {
                                                 old->dacl->aces[k] = old->dacl->aces[k+1];
@@ -936 +533 @@
                         if (!found) {
                                 printf("ACL for ACE:");
-                                print_ace(cli, stdout, &sd->dacl->aces[i]);
+                                print_ace(cli, stdout, &sd->dacl->aces[i],
+                                          numeric);
                                 printf(" not found\n");
                         }
@@ -958 +556 @@
 
                                 SidToString(cli, str,
-                                            &sd->dacl->aces[i].trustee);
+                                            &sd->dacl->aces[i].trustee,
+                                            numeric);
                                 printf("ACL for SID %s not found\n", str);
                         }
@@ -1014 +613 @@
 {
         struct security_descriptor *old,*sd;
-        uint32 oldattr;
+        uint32_t oldattr;
         size_t sd_size;
         int result = EXIT_OK;
@@ -1133 +732 @@
 {
         struct cli_state *c = NULL;
-        struct sockaddr_storage ss;
         NTSTATUS nt_status;
         uint32_t flags = 0;
-
-        zero_sockaddr(&ss);
 
         if (get_cmdline_auth_info_use_kerberos(auth_info)) {
@@ -1151 +747 @@
         set_cmdline_auth_info_getpass(auth_info);
 
-        nt_status = cli_full_connection(&c, global_myname(), server, 
-                                &ss, 0,
+        nt_status = cli_full_connection(&c, lp_netbios_name(), server,
+                                NULL, 0,
                                 share, "?????",
                                 get_cmdline_auth_info_username(auth_info),
@@ -1182 +778 @@
   main program
 ****************************************************************************/
- int main(int argc, const char *argv[])
-{
+int main(int argc, char *argv[])
+{
+        const char **argv_const = discard_const_p(const char *, argv);
         char *share;
         int opt;
@@ -1193 +790 @@
         char *filename = NULL;
         poptContext pc;
+        /* numeric is set when the user wants numeric SIDs and ACEs rather
+           than going via LSA calls to resolve them */
+        int numeric = 0;
+
         struct poptOption long_options[] = {
                 POPT_AUTOHELP
@@ -1204 +805 @@
                 { "numeric", 0, POPT_ARG_NONE, &numeric, 1, "Don't resolve sids or masks to names" },
                 { "sddl", 0, POPT_ARG_NONE, &sddl, 1, "Output and input acls in sddl format" },
+                { "query-security-info", 0, POPT_ARG_INT, &query_sec_info, 1,
+                  "The security-info flags for queries"
+                },
+                { "set-security-info", 0, POPT_ARG_INT, &set_sec_info, 1,
+                  "The security-info flags for modifications"
+                },
                 { "test-args", 't', POPT_ARG_NONE, &test_args, 1, "Test arguments"},
+                { "domain-sid", 0, POPT_ARG_STRING, &domain_sid, 0, "Domain SID for sddl", "SID"},
+                { "max-protocol", 'm', POPT_ARG_STRING, NULL, 'm', "Set the max protocol level", "LEVEL" },
                 POPT_COMMON_SAMBA
                 POPT_COMMON_CONNECTION
@@ -1217 +826 @@
         struct user_auth_info *auth_info;
 
-        load_case_tables();
+        smb_init_locale();
 
         /* set default debug level to 1 regardless of what smb.conf sets */
@@ -1225 +834 @@
         setlinebuf(stdout);
 
-        lp_load(get_dyn_CONFIGFILE(),True,False,False,True);
-        load_interfaces();
 
         auth_info = user_auth_info_init(frame);
@@ -1234 +841 @@
         popt_common_set_auth_info(auth_info);
 
-        pc = poptGetContext("smbcacls", argc, argv, long_options, 0);
+        pc = poptGetContext("smbcacls", argc, argv_const, long_options, 0);
 
         poptSetOtherOptionHelp(pc, "//server1/share1 filename\nACLs look like: "
@@ -1275 +882 @@
                         change_mode = REQUEST_INHERIT;
                         break;
+                case 'm':
+                        lp_set_cmdline("client max protocol", poptGetOptArg(pc));
+                        break;
                 }
         }
@@ -1294 +904 @@
         }
 
+        lp_load_global(get_dyn_CONFIGFILE());
+        load_interfaces();
+
         filename = talloc_strdup(frame, poptGetArg(pc));
         if (!filename) {
                 return -1;
         }
+
+        poptFreeContext(pc);
+        popt_burn_cmdline_password(argc, argv);
 
         string_replace(path,'/','\\');
@@ -1340 +956 @@
                 result = owner_set(cli, change_mode, filename, owner_username);
         } else if (the_acl) {
-                result = cacl_set(cli, filename, the_acl, mode);
+                result = cacl_set(cli, filename, the_acl, mode, numeric);
         } else {
-                result = cacl_dump(cli, filename);
+                result = cacl_dump(cli, filename, numeric);
         }
 

vendor/current/source3/utils/smbcontrol.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -33 +33 @@
 #include "messages.h"
 #include "util_tdb.h"
+#include "../lib/util/pidfile.h"
+#include "serverid.h"
 
 #if HAVE_LIBUNWIND_H
@@ -65 +67 @@
                 return NT_STATUS_IS_OK(
                         messaging_send_buf(msg_ctx, pid, msg_type,
-                                           (uint8 *)buf, len));
+                                           (const uint8_t *)buf, len));
 
         ret = message_send_all(msg_ctx, msg_type, buf, len, &n_sent);
@@ -86 +88 @@
 /* Wait for one or more reply messages */
 
-static void wait_replies(struct messaging_context *msg_ctx,
+static void wait_replies(struct tevent_context *ev_ctx,
+                         struct messaging_context *msg_ctx,
                          bool multiple_replies)
 {
@@ -92 +95 @@
         bool timed_out = False;
 
-        if (!(te = tevent_add_timer(messaging_event_context(msg_ctx), NULL,
-                                    timeval_current_ofs(timeout, 0),
-                                    smbcontrol_timeout, (void *)&timed_out))) {
+        te = tevent_add_timer(ev_ctx, NULL,
+                              timeval_current_ofs(timeout, 0),
+                              smbcontrol_timeout, (void *)&timed_out);
+        if (te == NULL) {
                 DEBUG(0, ("tevent_add_timer failed\n"));
                 return;
@@ -103 +107 @@
                 if (num_replies > 0 && !multiple_replies)
                         break;
-                ret = tevent_loop_once(messaging_event_context(msg_ctx));
+                ret = tevent_loop_once(ev_ctx);
                 if (ret != 0) {
                         break;
@@ -118 +122 @@
                                 DATA_BLOB *data)
 {
-        char *pidstr;
-
-        pidstr = procid_str(talloc_tos(), &pid);
-        printf("PID %s: %.*s", pidstr, (int)data->length,
-               (const char *)data->data);
-        TALLOC_FREE(pidstr);
+        struct server_id_buf pidstr;
+
+        printf("PID %s: %.*s", server_id_str_buf(pid, &pidstr),
+               (int)data->length, (const char *)data->data);
         num_replies++;
 }
@@ -141 +143 @@
 /* Send no message.  Useful for testing. */
 
-static bool do_noop(struct messaging_context *msg_ctx,
+static bool do_noop(struct tevent_context *ev_ctx,
+                    struct messaging_context *msg_ctx,
                     const struct server_id pid,
                     const int argc, const char **argv)
@@ -157 +160 @@
 /* Send a debug string */
 
-static bool do_debug(struct messaging_context *msg_ctx,
+static bool do_debug(struct tevent_context *ev_ctx,
+                     struct messaging_context *msg_ctx,
                      const struct server_id pid,
                      const int argc, const char **argv)
@@ -172 +176 @@
 
 
-static bool do_idmap(struct messaging_context *msg_ctx,
+static bool do_idmap(struct tevent_context *ev,
+                     struct messaging_context *msg_ctx,
                      const struct server_id pid,
                      const int argc, const char **argv)
@@ -178 +183 @@
         static const char* usage = "Usage: "
                 "smbcontrol <dest> idmap <cmd> [arg]\n"
-                "\tcmd:\tflush [gid|uid]\n"
-                "\t\tdelete \"UID <uid>\"|\"GID <gid>\"|<sid>\n"
+                "\tcmd:"
+                "\tdelete \"UID <uid>\"|\"GID <gid>\"|<sid>\n"
                 "\t\tkill \"UID <uid>\"|\"GID <gid>\"|<sid>\n";
         const char* arg = NULL;
@@ -197 +202 @@
         }
 
-        if (strcmp(argv[1], "flush") == 0) {
-                msg_type = MSG_IDMAP_FLUSH;
-        }
-        else if (strcmp(argv[1], "delete") == 0) {
-                msg_type = MSG_IDMAP_DELETE;
+        if (strcmp(argv[1], "delete") == 0) {
+                msg_type = ID_CACHE_DELETE;
         }
         else if (strcmp(argv[1], "kill") == 0) {
-                msg_type = MSG_IDMAP_KILL;
+                msg_type = ID_CACHE_KILL;
         }
         else if (strcmp(argv[1], "help") == 0) {
@@ -222 +224 @@
 
 /* Return the name of a process given it's PID. This will only work on Linux,
- * but that's probably moot since this whole stack tracing implementatino is
+ * but that's probably moot since this whole stack tracing implementation is
  * Linux-specific anyway.
  */
@@ -320 +322 @@
 }
 
-static int stack_trace_connection(const struct connections_key *key,
-                                  const struct connections_data *crec,
-                                  void *priv)
-{
-        print_stack_trace(procid_to_pid(&crec->pid), (int *)priv);
-
+static int stack_trace_server(const struct server_id *id,
+                              uint32_t msg_flags,
+                              void *priv)
+{
+        if (procid_is_local(id)) {
+                print_stack_trace(procid_to_pid(id), (int *)priv);
+        }
         return 0;
 }
 
-static bool do_daemon_stack_trace(struct messaging_context *msg_ctx,
+static bool do_daemon_stack_trace(struct tevent_context *ev_ctx,
+                                  struct messaging_context *msg_ctx,
                                   const struct server_id pid,
-                       const int argc, const char **argv)
+                                  const int argc, const char **argv)
 {
         pid_t   dest;
@@ -351 +355 @@
                 print_stack_trace(dest, &count);
         } else {
-                connections_forall_read(stack_trace_connection, &count);
+                serverid_traverse_read(stack_trace_server, &count);
         }
 
@@ -359 +363 @@
 #else /* defined(HAVE_LIBUNWIND_PTRACE) && defined(HAVE_LINUX_PTRACE) */
 
-static bool do_daemon_stack_trace(struct messaging_context *msg_ctx,
+static bool do_daemon_stack_trace(struct tevent_context *ev_ctx,
+                                  struct messaging_context *msg_ctx,
                                   const struct server_id pid,
-                       const int argc, const char **argv)
+                                  const int argc, const char **argv)
 {
         fprintf(stderr,
@@ -372 +377 @@
 /* Inject a fault (fatal signal) into a running smbd */
 
-static bool do_inject_fault(struct messaging_context *msg_ctx,
+static bool do_inject_fault(struct tevent_context *ev_ctx,
+                            struct messaging_context *msg_ctx,
                             const struct server_id pid,
-                       const int argc, const char **argv)
+                            const int argc, const char **argv)
 {
         if (argc != 2) {
@@ -414 +420 @@
 /* Force a browser election */
 
-static bool do_election(struct messaging_context *msg_ctx,
+static bool do_election(struct tevent_context *ev_ctx,
+                        struct messaging_context *msg_ctx,
                         const struct server_id pid,
                         const int argc, const char **argv)
@@ -434 +441 @@
                     DATA_BLOB *data)
 {
-        char *src_string = procid_str(NULL, &pid);
-        printf("PONG from pid %s\n", src_string);
-        TALLOC_FREE(src_string);
+        struct server_id_buf src_string;
+        printf("PONG from pid %s\n", server_id_str_buf(pid, &src_string));
         num_replies++;
 }
 
-static bool do_ping(struct messaging_context *msg_ctx,
+static bool do_ping(struct tevent_context *ev_ctx,
+                    struct messaging_context *msg_ctx,
                     const struct server_id pid,
                     const int argc, const char **argv)
@@ -456 +463 @@
         messaging_register(msg_ctx, NULL, MSG_PONG, pong_cb);
 
-        wait_replies(msg_ctx, procid_to_pid(&pid) == 0);
+        wait_replies(ev_ctx, msg_ctx, procid_to_pid(&pid) == 0);
 
         /* No replies were received within the timeout period */
@@ -470 +477 @@
 /* Set profiling options */
 
-static bool do_profile(struct messaging_context *msg_ctx,
+static bool do_profile(struct tevent_context *ev_ctx,
+                       struct messaging_context *msg_ctx,
                        const struct server_id pid,
                        const int argc, const char **argv)
@@ -553 +561 @@
 }
 
-static bool do_profilelevel(struct messaging_context *msg_ctx,
+static bool do_profilelevel(struct tevent_context *ev_ctx,
+                            struct messaging_context *msg_ctx,
                             const struct server_id pid,
                             const int argc, const char **argv)
@@ -571 +580 @@
                            profilelevel_rqst);
 
-        wait_replies(msg_ctx, procid_to_pid(&pid) == 0);
+        wait_replies(ev_ctx, msg_ctx, procid_to_pid(&pid) == 0);
 
         /* No replies were received within the timeout period */
@@ -585 +594 @@
 /* Display debug level settings */
 
-static bool do_debuglevel(struct messaging_context *msg_ctx,
+static bool do_debuglevel(struct tevent_context *ev_ctx,
+                          struct messaging_context *msg_ctx,
                           const struct server_id pid,
                           const int argc, const char **argv)
@@ -601 +611 @@
         messaging_register(msg_ctx, NULL, MSG_DEBUGLEVEL, print_pid_string_cb);
 
-        wait_replies(msg_ctx, procid_to_pid(&pid) == 0);
+        wait_replies(ev_ctx, msg_ctx, procid_to_pid(&pid) == 0);
 
         /* No replies were received within the timeout period */
@@ -615 +625 @@
 /* Send a print notify message */
 
-static bool do_printnotify(struct messaging_context *msg_ctx,
+static bool do_printnotify(struct tevent_context *ev_ctx,
+                           struct messaging_context *msg_ctx,
                            const struct server_id pid,
                            const int argc, const char **argv)
@@ -646 +657 @@
                 }
 
-                notify_printer_status_byname(messaging_event_context(msg_ctx),
-                                             msg_ctx, argv[2],
+                notify_printer_status_byname(ev_ctx, msg_ctx, argv[2],
                                              PRINTER_STATUS_PAUSED);
 
@@ -660 +670 @@
                 }
 
-                notify_printer_status_byname(messaging_event_context(msg_ctx),
-                                             msg_ctx, argv[2],
+                notify_printer_status_byname(ev_ctx, msg_ctx, argv[2],
                                              PRINTER_STATUS_OK);
 
@@ -678 +687 @@
 
                 notify_job_status_byname(
-                        messaging_event_context(msg_ctx), msg_ctx,
+                        ev_ctx, msg_ctx,
                         argv[2], jobid, JOB_STATUS_PAUSED,
                         SPOOLSS_NOTIFY_MSG_UNIX_JOBID);
@@ -696 +705 @@
 
                 notify_job_status_byname(
-                        messaging_event_context(msg_ctx), msg_ctx,
+                        ev_ctx, msg_ctx,
                         argv[2], jobid, JOB_STATUS_QUEUED, 
                         SPOOLSS_NOTIFY_MSG_UNIX_JOBID);
@@ -714 +723 @@
 
                 notify_job_status_byname(
-                        messaging_event_context(msg_ctx), msg_ctx,
+                        ev_ctx, msg_ctx,
                         argv[2], jobid, JOB_STATUS_DELETING,
                         SPOOLSS_NOTIFY_MSG_UNIX_JOBID);
 
                 notify_job_status_byname(
-                        messaging_event_context(msg_ctx), msg_ctx,
+                        ev_ctx, msg_ctx,
                         argv[2], jobid, JOB_STATUS_DELETING|
                         JOB_STATUS_DELETED,
@@ -727 +736 @@
 
         } else if (strcmp(cmd, "printer") == 0) {
-                uint32 attribute;
+                uint32_t attribute;
 
                 if (argc != 5) {
@@ -748 +757 @@
                 }
 
-                notify_printer_byname(messaging_event_context(msg_ctx),
-                                      msg_ctx, argv[2], attribute,
-                                      CONST_DISCARD(char *, argv[4]));
+                notify_printer_byname(ev_ctx, msg_ctx, argv[2], attribute,
+                                      discard_const_p(char, argv[4]));
 
                 goto send;
@@ -765 +773 @@
 /* Close a share */
 
-static bool do_closeshare(struct messaging_context *msg_ctx,
+static bool do_closeshare(struct tevent_context *ev_ctx,
+                          struct messaging_context *msg_ctx,
                           const struct server_id pid,
                           const int argc, const char **argv)
@@ -779 +788 @@
 }
 
+/* Kill a client by IP address */
+static bool do_kill_client_by_ip(struct tevent_context *ev_ctx,
+                                 struct messaging_context *msg_ctx,
+                                 const struct server_id pid,
+                                 const int argc, const char **argv)
+{
+        if (argc != 2) {
+                fprintf(stderr, "Usage: smbcontrol <dest> kill-client-ip "
+                        "<IP address>\n");
+                return false;
+        }
+
+        if (!is_ipaddress_v4(argv[1]) && !is_ipaddress_v6(argv[1])) {
+                fprintf(stderr, "%s is not a valid IP address!\n", argv[1]);
+                return false;
+        }
+
+        return send_message(msg_ctx, pid, MSG_SMB_KILL_CLIENT_IP,
+                            argv[1], strlen(argv[1]) + 1);
+}
+
 /* Tell winbindd an IP got dropped */
 
-static bool do_ip_dropped(struct messaging_context *msg_ctx,
+static bool do_ip_dropped(struct tevent_context *ev_ctx,
+                          struct messaging_context *msg_ctx,
                           const struct server_id pid,
                           const int argc, const char **argv)
@@ -797 +828 @@
 /* force a blocking lock retry */
 
-static bool do_lockretry(struct messaging_context *msg_ctx,
+static bool do_lockretry(struct tevent_context *ev_ctx,
+                         struct messaging_context *msg_ctx,
                          const struct server_id pid,
                          const int argc, const char **argv)
@@ -811 +843 @@
 /* force a validation of all brl entries, including re-sends. */
 
-static bool do_brl_revalidate(struct messaging_context *msg_ctx,
+static bool do_brl_revalidate(struct tevent_context *ev_ctx,
+                              struct messaging_context *msg_ctx,
                               const struct server_id pid,
                               const int argc, const char **argv)
@@ -823 +856 @@
 }
 
-/* Force a SAM synchronisation */
-
-static bool do_samsync(struct messaging_context *msg_ctx,
-                       const struct server_id pid,
-                       const int argc, const char **argv)
-{
-        if (argc != 1) {
-                fprintf(stderr, "Usage: smbcontrol <dest> samsync\n");
-                return False;
-        }
-
-        return send_message(msg_ctx, pid, MSG_SMB_SAM_SYNC, NULL, 0);
-}
-
-/* Force a SAM replication */
-
-static bool do_samrepl(struct messaging_context *msg_ctx,
-                       const struct server_id pid,
-                       const int argc, const char **argv)
-{
-        if (argc != 1) {
-                fprintf(stderr, "Usage: smbcontrol <dest> samrepl\n");
-                return False;
-        }
-
-        return send_message(msg_ctx, pid, MSG_SMB_SAM_REPL, NULL, 0);
-}
-
 /* Display talloc pool usage */
 
-static bool do_poolusage(struct messaging_context *msg_ctx,
+static bool do_poolusage(struct tevent_context *ev_ctx,
+                         struct messaging_context *msg_ctx,
                          const struct server_id pid,
                          const int argc, const char **argv)
@@ -869 +875 @@
                 return False;
 
-        wait_replies(msg_ctx, procid_to_pid(&pid) == 0);
+        wait_replies(ev_ctx, msg_ctx, procid_to_pid(&pid) == 0);
 
         /* No replies were received within the timeout period */
@@ -883 +889 @@
 /* Perform a dmalloc mark */
 
-static bool do_dmalloc_mark(struct messaging_context *msg_ctx,
+static bool do_dmalloc_mark(struct tevent_context *ev_ctx,
+                            struct messaging_context *msg_ctx,
                             const struct server_id pid,
                             const int argc, const char **argv)
@@ -897 +904 @@
 /* Perform a dmalloc changed */
 
-static bool do_dmalloc_changed(struct messaging_context *msg_ctx,
+static bool do_dmalloc_changed(struct tevent_context *ev_ctx,
+                               struct messaging_context *msg_ctx,
                                const struct server_id pid,
                                const int argc, const char **argv)
@@ -911 +919 @@
 }
 
+static void print_uint32_cb(struct messaging_context *msg, void *private_data,
+                            uint32_t msg_type, struct server_id pid,
+                            DATA_BLOB *data)
+{
+        uint32_t num_children;
+
+        if (data->length != sizeof(uint32_t)) {
+                printf("Invalid response: %d bytes long\n",
+                       (int)data->length);
+                goto done;
+        }
+        num_children = IVAL(data->data, 0);
+        printf("%u children\n", (unsigned)num_children);
+done:
+        num_replies++;
+}
+
+static bool do_num_children(struct tevent_context *ev_ctx,
+                            struct messaging_context *msg_ctx,
+                            const struct server_id pid,
+                            const int argc, const char **argv)
+{
+        if (argc != 1) {
+                fprintf(stderr, "Usage: smbcontrol <dest> num-children\n");
+                return False;
+        }
+
+        messaging_register(msg_ctx, NULL, MSG_SMB_NUM_CHILDREN,
+                           print_uint32_cb);
+
+        /* Send a message and register our interest in a reply */
+
+        if (!send_message(msg_ctx, pid, MSG_SMB_TELL_NUM_CHILDREN, NULL, 0))
+                return false;
+
+        wait_replies(ev_ctx, msg_ctx, procid_to_pid(&pid) == 0);
+
+        /* No replies were received within the timeout period */
+
+        if (num_replies == 0)
+                printf("No replies received\n");
+
+        messaging_deregister(msg_ctx, MSG_SMB_NUM_CHILDREN, NULL);
+
+        return num_replies;
+}
+
+static bool do_msg_cleanup(struct tevent_context *ev_ctx,
+                           struct messaging_context *msg_ctx,
+                           const struct server_id pid,
+                           const int argc, const char **argv)
+{
+        int ret;
+
+        ret = messaging_cleanup(msg_ctx, pid.pid);
+
+        printf("cleanup(%u) returned %s\n", (unsigned)pid.pid,
+               ret ? strerror(ret) : "ok");
+
+        return (ret == 0);
+}
+
 /* Shutdown a server process */
 
-static bool do_shutdown(struct messaging_context *msg_ctx,
+static bool do_shutdown(struct tevent_context *ev_ctx,
+                        struct messaging_context *msg_ctx,
                         const struct server_id pid,
                         const int argc, const char **argv)
@@ -927 +998 @@
 /* Notify a driver upgrade */
 
-static bool do_drvupgrade(struct messaging_context *msg_ctx,
+static bool do_drvupgrade(struct tevent_context *ev_ctx,
+                          struct messaging_context *msg_ctx,
                           const struct server_id pid,
                           const int argc, const char **argv)
@@ -941 +1013 @@
 }
 
-static bool do_winbind_online(struct messaging_context *msg_ctx,
+static bool do_winbind_online(struct tevent_context *ev_ctx,
+                              struct messaging_context *msg_ctx,
                               const struct server_id pid,
-                             const int argc, const char **argv)
+                              const int argc, const char **argv)
 {
         TDB_CONTEXT *tdb;
+        char *db_path;
 
         if (argc != 1) {
                 fprintf(stderr, "Usage: smbcontrol winbindd online\n");
                 return False;
+        }
+
+        db_path = state_path("winbindd_cache.tdb");
+        if (db_path == NULL) {
+                return false;
         }
 
@@ -955 +1034 @@
            starting winbindd that we're online. */
 
-        tdb = tdb_open_log(cache_path("winbindd_cache.tdb"), 0, TDB_DEFAULT, O_RDWR, 0600);
+        tdb = tdb_open_log(db_path, 0, TDB_DEFAULT, O_RDWR, 0600);
         if (!tdb) {
                 fprintf(stderr, "Cannot open the tdb %s for writing.\n",
-                        cache_path("winbindd_cache.tdb"));
-                return False;
-        }
-
+                        db_path);
+                TALLOC_FREE(db_path);
+                return False;
+        }
+
+        TALLOC_FREE(db_path);
         tdb_delete_bystring(tdb, "WINBINDD_OFFLINE");
         tdb_close(tdb);
@@ -968 +1049 @@
 }
 
-static bool do_winbind_offline(struct messaging_context *msg_ctx,
+static bool do_winbind_offline(struct tevent_context *ev_ctx,
+                               struct messaging_context *msg_ctx,
                                const struct server_id pid,
-                             const int argc, const char **argv)
+                               const int argc, const char **argv)
 {
         TDB_CONTEXT *tdb;
         bool ret = False;
         int retry = 0;
+        char *db_path;
 
         if (argc != 1) {
                 fprintf(stderr, "Usage: smbcontrol winbindd offline\n");
                 return False;
+        }
+
+        db_path = state_path("winbindd_cache.tdb");
+        if (db_path == NULL) {
+                return false;
         }
 
@@ -985 +1073 @@
            it here... */
 
-        tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
+        tdb = tdb_open_log(db_path,
                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
                                 TDB_DEFAULT|TDB_INCOMPATIBLE_HASH /* TDB_CLEAR_IF_FIRST */,
@@ -992 +1080 @@
         if (!tdb) {
                 fprintf(stderr, "Cannot open the tdb %s for writing.\n",
-                        cache_path("winbindd_cache.tdb"));
-                return False;
-        }
+                        db_path);
+                TALLOC_FREE(db_path);
+                return False;
+        }
+        TALLOC_FREE(db_path);
 
         /* There's a potential race condition that if a child
@@ -1004 +1094 @@
 
         for (retry = 0; retry < 5; retry++) {
-                TDB_DATA d;
-                uint8 buf[4];
-
-                ZERO_STRUCT(d);
+                uint8_t buf[4];
+                TDB_DATA d = { .dptr = buf, .dsize = sizeof(buf) };
 
                 SIVAL(buf, 0, time(NULL));
-                d.dptr = buf;
-                d.dsize = 4;
 
                 tdb_store_bystring(tdb, "WINBINDD_OFFLINE", d, TDB_INSERT);
@@ -1034 +1120 @@
 }
 
-static bool do_winbind_onlinestatus(struct messaging_context *msg_ctx,
+static bool do_winbind_onlinestatus(struct tevent_context *ev_ctx,
+                                    struct messaging_context *msg_ctx,
                                     const struct server_id pid,
                                     const int argc, const char **argv)
@@ -1054 +1141 @@
                 return False;
 
-        wait_replies(msg_ctx, procid_to_pid(&pid) == 0);
+        wait_replies(ev_ctx, msg_ctx, procid_to_pid(&pid) == 0);
 
         /* No replies were received within the timeout period */
@@ -1066 +1153 @@
 }
 
-static bool do_dump_event_list(struct messaging_context *msg_ctx,
+static bool do_dump_event_list(struct tevent_context *ev_ctx,
+                               struct messaging_context *msg_ctx,
                                const struct server_id pid,
                                const int argc, const char **argv)
 {
-        struct server_id myid;
-
-        myid = messaging_server_id(msg_ctx);
-
         if (argc != 1) {
                 fprintf(stderr, "Usage: smbcontrol <dest> dump-event-list\n");
@@ -1082 +1166 @@
 }
 
-static bool do_winbind_dump_domain_list(struct messaging_context *msg_ctx,
+static bool do_winbind_dump_domain_list(struct tevent_context *ev_ctx,
+                                        struct messaging_context *msg_ctx,
                                         const struct server_id pid,
                                         const int argc, const char **argv)
@@ -1124 +1209 @@
         }
 
-        wait_replies(msg_ctx, procid_to_pid(&pid) == 0);
+        wait_replies(ev_ctx, msg_ctx, procid_to_pid(&pid) == 0);
 
         /* No replies were received within the timeout period */
@@ -1144 +1229 @@
                                       DATA_BLOB *data)
 {
-        char *src_string = procid_str(NULL, &pid);
+        struct server_id_buf src_string;
         printf("Winbindd cache is %svalid. (answer from pid %s)\n",
-               (*(data->data) == 0 ? "" : "NOT "), src_string);
-        TALLOC_FREE(src_string);
+               (*(data->data) == 0 ? "" : "NOT "),
+               server_id_str_buf(pid, &src_string));
         num_replies++;
 }
 
-static bool do_winbind_validate_cache(struct messaging_context *msg_ctx,
+static bool do_winbind_validate_cache(struct tevent_context *ev_ctx,
+                                      struct messaging_context *msg_ctx,
                                       const struct server_id pid,
                                       const int argc, const char **argv)
@@ -1172 +1258 @@
         }
 
-        wait_replies(msg_ctx, procid_to_pid(&pid) == 0);
+        wait_replies(ev_ctx, msg_ctx, procid_to_pid(&pid) == 0);
 
         if (num_replies == 0) {
@@ -1183 +1269 @@
 }
 
-static bool do_reload_config(struct messaging_context *msg_ctx,
+static bool do_reload_config(struct tevent_context *ev_ctx,
+                             struct messaging_context *msg_ctx,
                              const struct server_id pid,
                              const int argc, const char **argv)
@@ -1193 +1280 @@
 
         return send_message(msg_ctx, pid, MSG_SMB_CONF_UPDATED, NULL, 0);
+}
+
+static bool do_reload_printers(struct tevent_context *ev_ctx,
+                               struct messaging_context *msg_ctx,
+                               const struct server_id pid,
+                               const int argc, const char **argv)
+{
+        if (argc != 1) {
+                fprintf(stderr, "Usage: smbcontrol <dest> reload-printers\n");
+                return False;
+        }
+
+        return send_message(msg_ctx, pid, MSG_PRINTER_PCAP, NULL, 0);
 }
 
@@ -1200 +1300 @@
         memset( (char *)n, '\0', sizeof(struct nmb_name) );
         fstrcpy(unix_name, name);
-        strupper_m(unix_name);
+        (void)strupper_m(unix_name);
         push_ascii(n->name, unix_name, sizeof(n->name), STR_TERMINATE);
         n->name_type = (unsigned int)type & 0xFF;
-        push_ascii(n->scope,  global_scope(), 64, STR_TERMINATE);
-}
-
-static bool do_nodestatus(struct messaging_context *msg_ctx,
+        push_ascii(n->scope,  lp_netbios_scope(), 64, STR_TERMINATE);
+}
+
+static bool do_nodestatus(struct tevent_context *ev_ctx,
+                          struct messaging_context *msg_ctx,
                           const struct server_id pid,
                           const int argc, const char **argv)
@@ -1243 +1344 @@
 }
 
+static bool do_notify_cleanup(struct tevent_context *ev_ctx,
+                              struct messaging_context *msg_ctx,
+                              const struct server_id pid,
+                              const int argc, const char **argv)
+{
+        if (argc != 1) {
+                fprintf(stderr, "Usage: smbcontrol smbd notify-cleanup\n");
+                return false;
+        }
+        return send_message(msg_ctx, pid, MSG_SMB_NOTIFY_CLEANUP, NULL, 0);
+}
+
 /* A list of message type supported */
 
 static const struct {
         const char *name;       /* Option name */
-        bool (*fn)(struct messaging_context *msg_ctx,
+        bool (*fn)(struct tevent_context *ev_ctx,
+                   struct messaging_context *msg_ctx,
                    const struct server_id pid,
                    const int argc, const char **argv);
@@ -1266 +1380 @@
         { "printnotify", do_printnotify, "Send a print notify message" },
         { "close-share", do_closeshare, "Forcibly disconnect a share" },
+        { "kill-client-ip", do_kill_client_by_ip,
+          "Forcibly disconnect a client with a specific IP address" },
         { "ip-dropped", do_ip_dropped, "Tell winbind that an IP got dropped" },
         { "lockretry", do_lockretry, "Force a blocking lock retry" },
         { "brl-revalidate", do_brl_revalidate, "Revalidate all brl entries" },
-        { "samsync", do_samsync, "Initiate SAM synchronisation" },
-        { "samrepl", do_samrepl, "Initiate SAM replication" },
         { "pool-usage", do_poolusage, "Display talloc memory usage" },
         { "dmalloc-mark", do_dmalloc_mark, "" },
@@ -1277 +1391 @@
         { "drvupgrade", do_drvupgrade, "Notify a printer driver has changed" },
         { "reload-config", do_reload_config, "Force smbd or winbindd to reload config file"},
+        { "reload-printers", do_reload_printers, "Force smbd to reload printers"},
         { "nodestatus", do_nodestatus, "Ask nmbd to do a node status request"},
         { "online", do_winbind_online, "Ask winbind to go into online state"},
@@ -1285 +1400 @@
           "Validate winbind's credential cache" },
         { "dump-domain-list", do_winbind_dump_domain_list, "Dump winbind domain list"},
+        { "notify-cleanup", do_notify_cleanup },
+        { "num-children", do_num_children,
+          "Print number of smbd child processes" },
+        { "msg-cleanup", do_msg_cleanup },
         { "noop", do_noop, "Do nothing" },
         { NULL }
@@ -1348 +1467 @@
         /* Look up other destinations in pidfile directory */
 
-        if ((pid = pidfile_pid(dest)) != 0) {
+        if ((pid = pidfile_pid(lp_pid_directory(), dest)) != 0) {
                 return pid_to_procid(pid);
         }
@@ -1359 +1478 @@
 /* Execute smbcontrol command */
 
-static bool do_command(struct messaging_context *msg_ctx,
+static bool do_command(struct tevent_context *ev_ctx,
+                       struct messaging_context *msg_ctx,
                        int argc, const char **argv)
 {
@@ -1377 +1497 @@
         for (i = 0; msg_types[i].name; i++) {
                 if (strequal(command, msg_types[i].name))
-                        return msg_types[i].fn(msg_ctx, pid,
+                        return msg_types[i].fn(ev_ctx, msg_ctx, pid,
                                                argc - 1, argv + 1);
         }
@@ -1431 +1551 @@
         int ret = 0;
 
-        load_case_tables();
+        smb_init_locale();
 
         setup_logging(argv[0], DEBUG_STDOUT);
+        lp_set_cmdline("log level", "0");
 
         /* Parse command line arguments using popt */
@@ -1472 +1593 @@
                 usage(pc);
 
-        lp_load(get_dyn_CONFIGFILE(),False,False,False,True);
+        lp_load_global(get_dyn_CONFIGFILE());
 
         /* Need to invert sense of return code -- samba
@@ -1478 +1599 @@
          * shell needs 0. */ 
 
-        if (!(evt_ctx = tevent_context_init(NULL)) ||
-            !(msg_ctx = messaging_init(NULL, procid_self(), evt_ctx))) {
+        if (!(evt_ctx = samba_tevent_context_init(NULL)) ||
+            !(msg_ctx = messaging_init(NULL, evt_ctx))) {
                 fprintf(stderr, "could not init messaging context\n");
                 TALLOC_FREE(frame);
@@ -1485 +1606 @@
         }
 
-        ret = !do_command(msg_ctx, argc, argv);
+        ret = !do_command(evt_ctx, msg_ctx, argc, argv);
+        TALLOC_FREE(msg_ctx);
         TALLOC_FREE(frame);
         return ret;

vendor/current/source3/utils/smbcquotas.c

@@ -59 +59 @@
                 cli_ipc = connect_one("IPC$");
                 ret = cli_rpc_pipe_open_noauth(cli_ipc,
-                                               &ndr_table_lsarpc.syntax_id,
+                                               &ndr_table_lsarpc,
                                                &global_pipe_hnd);
                 if (!NT_STATUS_IS_OK(ret)) {
@@ -188 +188 @@
         switch (todo) {
                 case PARSE_LIM:
-                        if (sscanf(p,"%"PRIu64"/%"PRIu64,&pqt->softlim,&pqt->hardlim)!=2) {
+                        if (sscanf(p,"%"SCNu64"/%"SCNu64,&pqt->softlim,
+                            &pqt->hardlim) != 2)
+                        {
                                 return -1;
                         }
@@ -235 +237 @@
         const char *result;
 
-        if (!_numeric&&special&&(val == SMB_NTQUOTAS_NO_LIMIT)) {
+        if (!_numeric && special && val == 0) {
                 return "NO LIMIT";
         }
@@ -331 +333 @@
 static int do_quota(struct cli_state *cli,
                 enum SMB_QUOTA_TYPE qtype,
-                uint16 cmd,
+                uint16_t cmd,
                 const char *username_str,
                 SMB_NTQUOTA_STRUCT *pqt)
 {
-        uint32 fs_attrs = 0;
+        uint32_t fs_attrs = 0;
         uint16_t quota_fnum = 0;
         SMB_NTQUOTA_LIST *qtl = NULL;
@@ -505 +507 @@
 {
         struct cli_state *c;
-        struct sockaddr_storage ss;
         NTSTATUS nt_status;
         uint32_t flags = 0;
-
-        zero_sockaddr(&ss);
 
         if (get_cmdline_auth_info_use_machine_account(smbcquotas_auth_info) &&
@@ -524 +523 @@
         set_cmdline_auth_info_getpass(smbcquotas_auth_info);
 
-        nt_status = cli_full_connection(&c, global_myname(), server, 
-                                            &ss, 0,
+        nt_status = cli_full_connection(&c, lp_netbios_name(), server,
+                                            NULL, 0,
                                             share, "?????",
                                             get_cmdline_auth_info_username(smbcquotas_auth_info),
@@ -555 +554 @@
   main program
 ****************************************************************************/
- int main(int argc, const char *argv[])
-{
+int main(int argc, char *argv[])
+{
+        const char **argv_const = discard_const_p(const char *, argv);
         char *share;
         int opt;
@@ -584 +584 @@
                 { "numeric", 'n', POPT_ARG_NONE, NULL, 'n', "Don't resolve sids or limits to names" },
                 { "verbose", 'v', POPT_ARG_NONE, NULL, 'v', "be verbose" },
-                { "test-args", 't', POPT_ARG_NONE, NULL, 'r', "Test arguments"},
+                { "test-args", 't', POPT_ARG_NONE, NULL, 't', "Test arguments"},
                 POPT_COMMON_SAMBA
                 POPT_COMMON_CREDENTIALS
@@ -590 +590 @@
         };
 
-        load_case_tables();
+        smb_init_locale();
 
         ZERO_STRUCT(qt);
@@ -600 +600 @@
         setlinebuf(stdout);
 
-        fault_setup(NULL);
-
-        lp_load(get_dyn_CONFIGFILE(),True,False,False,True);
+        fault_setup();
+
+        lp_load_global(get_dyn_CONFIGFILE());
         load_interfaces();
 
@@ -611 +611 @@
         popt_common_set_auth_info(smbcquotas_auth_info);
 
-        pc = poptGetContext("smbcquotas", argc, argv, long_options, 0);
+        pc = poptGetContext("smbcquotas", argc, argv_const, long_options, 0);
 
         poptSetOtherOptionHelp(pc, "//server1/share1");
@@ -692 +692 @@
         }
 
+        poptFreeContext(pc);
+        popt_burn_cmdline_password(argc, argv);
+
         string_replace(path, '/', '\\');
 

vendor/current/source3/utils/smbfilter.c

@@ -23 +23 @@
 #include "../lib/util/select.h"
 #include "libsmb/nmblib.h"
+#include "lib/util/sys_rw_data.h"
 
 #define SECURITY_MASK 0
@@ -36 +37 @@
 
 static char *netbiosname;
-static char packet[BUFFER_SIZE];
 
 static void save_file(const char *fname, void *ppacket, size_t length)
@@ -86 +86 @@
         unsigned x;
         fstring name1,name2;
-        int name_len1, name_len2;
+        int name_len1 = 0;
+        int name_len2;
         int name_type1, name_type2;
 
@@ -179 +180 @@
         NTSTATUS status;
         int s = -1;
+        char packet[128*1024];
 
         /* we have a connection from a new client, now connect to the server */
-        status = open_socket_out(dest_ss, 445, LONG_CONNECT_TIMEOUT, &s);
-
-        if (s == -1) {
+        status = open_socket_out(dest_ss, TCP_SMB_PORT, LONG_CONNECT_TIMEOUT, &s);
+        if (!NT_STATUS_IS_OK(status)) {
                 char addr[INET6_ADDRSTRLEN];
                 if (dest_ss) {
@@ -190 +191 @@
 
                 d_printf("Unable to connect to %s (%s)\n",
-                         dest_ss?addr:"NULL",strerror(errno));
+                         dest_ss?addr:"NULL", nt_errstr(status));
                 exit(1);
         }
@@ -279 +280 @@
 
         zero_sockaddr(&my_ss);
-        s = open_socket_in(SOCK_STREAM, 445, 0, &my_ss, True);
+        s = open_socket_in(SOCK_STREAM, TCP_SMB_PORT, 0, &my_ss, True);
 
         if (s == -1) {
@@ -323 +324 @@
         TALLOC_CTX *frame = talloc_stackframe();
 
-        load_case_tables();
+        smb_init_locale();
 
         setup_logging(argv[0], DEBUG_STDOUT);
@@ -339 +340 @@
         }
 
-        if (!lp_load(configfile,True,False,False,True)) {
+        if (!lp_load_global(configfile)) {
                 d_printf("Unable to load config file\n");
         }

vendor/current/source3/utils/smbget.c

@@ -1 +1 @@
 /*
-   smbget: a wget-like utility with support for recursive downloading and 
-        smb:// urls
+   smbget: a wget-like utility with support for recursive downloading of
+        smb:// urls
    Copyright (C) 2003-2004 Jelmer Vernooij <jelmer@samba.org>
 
@@ -22 +22 @@
 #include "libsmbclient.h"
 
-#if _FILE_OFFSET_BITS==64
-#define OFF_T_FORMAT "%lld"
-#define OFF_T_FORMAT_CAST long long
-#else
-#define OFF_T_FORMAT "%ld"
-#define OFF_T_FORMAT_CAST long
-#endif
-
 static int columns = 0;
-
-static int debuglevel, update;
-static char *outputfile;
-
 
 static time_t total_start_time = 0;
@@ -41 +29 @@
 #define SMB_MAXPATHLEN MAXPATHLEN
 
-/* Number of bytes to read when checking whether local and remote file are really the same file */
-#define RESUME_CHECK_SIZE                               512
-#define RESUME_DOWNLOAD_OFFSET                  1024
-#define RESUME_CHECK_OFFSET                             RESUME_DOWNLOAD_OFFSET+RESUME_CHECK_SIZE
+/*
+ * Number of bytes to read when checking whether local and remote file
+ * are really the same file
+ */
+#define RESUME_CHECK_SIZE       512
+#define RESUME_DOWNLOAD_OFFSET  1024
+#define RESUME_CHECK_OFFSET     (RESUME_DOWNLOAD_OFFSET+RESUME_CHECK_SIZE)
 /* Number of bytes to read at once */
-#define SMB_DEFAULT_BLOCKSIZE                                   64000
-
-static const char *username = NULL, *password = NULL, *workgroup = NULL;
-static int nonprompt = 0, quiet = 0, dots = 0, keep_permissions = 0, verbose = 0, send_stdout = 0;
-static int blocksize = SMB_DEFAULT_BLOCKSIZE;
-
-static int smb_download_file(const char *base, const char *name, int recursive,
-                             int resume, int toplevel, char *outfile);
+#define SMB_DEFAULT_BLOCKSIZE   64000
+
+struct opt {
+        char *workgroup;
+        bool username_specified;
+        char *username;
+        bool password_specified;
+        char *password;
+
+        char *outputfile;
+        size_t blocksize;
+
+        bool nonprompt;
+        bool quiet;
+        bool dots;
+        bool verbose;
+        bool send_stdout;
+        bool update;
+        int debuglevel;
+};
+static struct opt opt = { .blocksize = SMB_DEFAULT_BLOCKSIZE };
+
+static bool smb_download_file(const char *base, const char *name,
+                              bool recursive, bool resume, bool toplevel,
+                              char *outfile);
 
 static int get_num_cols(void)
@@ -59 +67 @@
 #ifdef TIOCGWINSZ
         struct winsize ws;
-        if(ioctl(STDOUT_FILENO, TIOCGWINSZ, &ws) < 0) {
+        if (ioctl(STDOUT_FILENO, TIOCGWINSZ, &ws) < 0) {
                 return 0;
         }
@@ -66 +74 @@
 #warning No support for TIOCGWINSZ
         char *cols = getenv("COLUMNS");
-        if(!cols) return 0;
+        if (!cols) {
+                return 0;
+        }
         return atoi(cols);
 #endif
@@ -85 +95 @@
                 snprintf(buffer, l, "%.2fkB", 1.0 * s / 1024);
         } else {
-                snprintf(buffer, l, OFF_T_FORMAT"b", (OFF_T_FORMAT_CAST)s);
-        }
-}
-
-static void get_auth_data(const char *srv, const char *shr, char *wg, int wglen, char *un, int unlen, char *pw, int pwlen)
-{
-        static char hasasked = 0;
-        char *wgtmp, *usertmp;
+                snprintf(buffer, l, "%jdb", (intmax_t)s);
+        }
+}
+
+static void get_auth_data(const char *srv, const char *shr, char *wg, int wglen,
+                          char *un, int unlen, char *pw, int pwlen)
+{
+        static bool hasasked = false;
+        static char *savedwg;
+        static char *savedun;
+        static char *savedpw;
         char tmp[128];
 
-        if(hasasked) return;
-        hasasked = 1;
-
-        if(!nonprompt && !username) {
+        if (hasasked) {
+                strncpy(wg, savedwg, wglen - 1);
+                strncpy(un, savedun, unlen - 1);
+                strncpy(pw, savedpw, pwlen - 1);
+                return;
+        }
+        hasasked = true;
+
+        if (!opt.nonprompt && !opt.username_specified) {
                 printf("Username for %s at %s [guest] ", shr, srv);
                 if (fgets(tmp, sizeof(tmp), stdin) == NULL) {
                         return;
                 }
-                if ((strlen(tmp) > 0) && (tmp[strlen(tmp)-1] == '\n')) {
-                        tmp[strlen(tmp)-1] = '\0';
-                }
-                strncpy(un, tmp, unlen-1);
-        } else if(username) strncpy(un, username, unlen-1);
-
-        if(!nonprompt && !password) {
-                char *prompt, *pass;
-                if (asprintf(&prompt, "Password for %s at %s: ", shr, srv) == -1) {
+                if ((strlen(tmp) > 0) && (tmp[strlen(tmp) - 1] == '\n')) {
+                        tmp[strlen(tmp) - 1] = '\0';
+                }
+                strncpy(un, tmp, unlen - 1);
+        } else if (opt.username != NULL) {
+                strncpy(un, opt.username, unlen - 1);
+        }
+
+        if (!opt.nonprompt && !opt.password_specified) {
+                char *prompt;
+                if (asprintf(&prompt, "Password for %s at %s: ", shr, srv) ==
+                    -1) {
                         return;
                 }
-                pass = getpass(prompt);
+                (void)samba_getpass(prompt, pw, pwlen, false, false);
                 free(prompt);
-                strncpy(pw, pass, pwlen-1);
-        } else if(password) strncpy(pw, password, pwlen-1);
-
-        if(workgroup)strncpy(wg, workgroup, wglen-1);
-
-        wgtmp = SMB_STRNDUP(wg, wglen); 
-        usertmp = SMB_STRNDUP(un, unlen);
-        if(!quiet)printf("Using workgroup %s, %s%s\n", wgtmp, *usertmp?"user ":"guest user", usertmp);
-        free(wgtmp); free(usertmp);
-}
-
-/* Return 1 on error, 0 on success. */
-
-static int smb_download_dir(const char *base, const char *name, int resume)
+        } else if (opt.password != NULL) {
+                strncpy(pw, opt.password, pwlen-1);
+        }
+
+        if (opt.workgroup != NULL) {
+                strncpy(wg, opt.workgroup, wglen-1);
+        }
+
+        /* save the values found for later */
+        savedwg = SMB_STRDUP(wg);
+        savedun = SMB_STRDUP(un);
+        savedpw = SMB_STRDUP(pw);
+
+        if (!opt.quiet) {
+                char *wgtmp, *usertmp;
+                wgtmp = SMB_STRNDUP(wg, wglen);
+                usertmp = SMB_STRNDUP(un, unlen);
+                printf("Using workgroup %s, %s%s\n",
+                       wgtmp,
+                       *usertmp ? "user " : "guest user",
+                       usertmp);
+                free(wgtmp);
+                free(usertmp);
+        }
+}
+
+static bool smb_download_dir(const char *base, const char *name, int resume)
 {
         char path[SMB_MAXPATHLEN];
@@ -136 +170 @@
         const char *relname = name;
         char *tmpname;
-        struct stat remotestat;
-        int ret = 0;
-
-        snprintf(path, SMB_MAXPATHLEN-1, "%s%s%s", base, (base[0] && name[0] && name[0] != '/' && base[strlen(base)-1] != '/')?"/":"", name);
+        bool ok = false;
+
+        snprintf(path, SMB_MAXPATHLEN-1, "%s%s%s", base,
+                 (base[0] && name[0] && name[0] != '/' &&
+                  base[strlen(base)-1] != '/') ? "/" : "",
+                 name);
 
         /* List files in directory and call smb_download_file on them */
         dirhandle = smbc_opendir(path);
-        if(dirhandle < 1) {
+        if (dirhandle < 1) {
                 if (errno == ENOTDIR) {
-                        return smb_download_file(base, name, 1, resume,
-                                                 0, NULL);
-                }
-                fprintf(stderr, "Can't open directory %s: %s\n", path, strerror(errno));
-                return 1;
-        }
-
-        while(*relname == '/')relname++;
+                        return smb_download_file(base, name, true, resume,
+                                                 false, NULL);
+                }
+                fprintf(stderr, "Can't open directory %s: %s\n", path,
+                        strerror(errno));
+                return false;
+        }
+
+        while (*relname == '/') {
+                relname++;
+        }
         mkdir(relname, 0755);
 
         tmpname = SMB_STRDUP(name);
 
-        while((dirent = smbc_readdir(dirhandle))) {
+        while ((dirent = smbc_readdir(dirhandle))) {
                 char *newname;
-                if(!strcmp(dirent->name, ".") || !strcmp(dirent->name, ".."))continue;
+                if (!strcmp(dirent->name, ".") || !strcmp(dirent->name, "..")) {
+                        continue;
+                }
                 if (asprintf(&newname, "%s/%s", tmpname, dirent->name) == -1) {
-                        return 1;
-                }
-                switch(dirent->smbc_type) {
+                        free(tmpname);
+                        return false;
+                }
+                switch (dirent->smbc_type) {
                 case SMBC_DIR:
-                        ret = smb_download_dir(base, newname, resume);
+                        ok = smb_download_dir(base, newname, resume);
                         break;
 
                 case SMBC_WORKGROUP:
-                        ret = smb_download_dir("smb://", dirent->name, resume);
+                        ok = smb_download_dir("smb://", dirent->name, resume);
                         break;
 
                 case SMBC_SERVER:
-                        ret = smb_download_dir("smb://", dirent->name, resume);
+                        ok = smb_download_dir("smb://", dirent->name, resume);
                         break;
 
                 case SMBC_FILE:
-                        ret = smb_download_file(base, newname, 1, resume, 0,
-                                                NULL);
+                        ok = smb_download_file(base, newname, true, resume,
+                                                false, NULL);
                         break;
 
                 case SMBC_FILE_SHARE:
-                        ret = smb_download_dir(base, newname, resume);
+                        ok = smb_download_dir(base, newname, resume);
                         break;
 
                 case SMBC_PRINTER_SHARE:
-                        if(!quiet)printf("Ignoring printer share %s\n", dirent->name);
+                        if (!opt.quiet) {
+                                printf("Ignoring printer share %s\n",
+                                       dirent->name);
+                        }
                         break;
 
                 case SMBC_COMMS_SHARE:
-                        if(!quiet)printf("Ignoring comms share %s\n", dirent->name);
+                        if (!opt.quiet) {
+                                printf("Ignoring comms share %s\n",
+                                       dirent->name);
+                        }
                         break;
 
                 case SMBC_IPC_SHARE:
-                        if(!quiet)printf("Ignoring ipc$ share %s\n", dirent->name);
+                        if (!opt.quiet) {
+                                printf("Ignoring ipc$ share %s\n",
+                                       dirent->name);
+                        }
                         break;
 
                 default:
-                        fprintf(stderr, "Ignoring file '%s' of type '%d'\n", newname, dirent->smbc_type);
-                        break;
+                        fprintf(stderr, "Ignoring file '%s' of type '%d'\n",
+                                newname, dirent->smbc_type);
+                        break;
+                }
+
+                if (!ok) {
+                        fprintf(stderr, "Failed to download %s: %s\n",
+                                newname, strerror(errno));
+                        return false;
                 }
                 free(newname);
@@ -205 +263 @@
         free(tmpname);
 
-        if(keep_permissions) {
-                if(smbc_fstat(dirhandle, &remotestat) < 0) {
-                        fprintf(stderr, "Unable to get stats on %s on remote server\n", path);
-                        smbc_closedir(dirhandle);
-                        return 1;
-                }
-
-                if(chmod(relname, remotestat.st_mode) < 0) {
-                        fprintf(stderr, "Unable to change mode of local dir %s to %o\n", relname,
-                                (unsigned int)remotestat.st_mode);
-                        smbc_closedir(dirhandle);
-                        return 1;
-                }
-        }
-
         smbc_closedir(dirhandle);
-        return ret;
+        return ok;
 }
 
@@ -228 +271 @@
         static char buffer[100];
         int secs, mins, hours;
-        if(t < -1) {
+        if (t < -1) {
                 strncpy(buffer, "Unknown", sizeof(buffer));
                 return buffer;
@@ -236 +279 @@
         mins = (int)t / 60 % 60;
         hours = (int)t / (60 * 60);
-        snprintf(buffer, sizeof(buffer)-1, "%02d:%02d:%02d", hours, mins, secs);
+        snprintf(buffer, sizeof(buffer) - 1, "%02d:%02d:%02d", hours, mins,
+                 secs);
         return buffer;
 }
 
-static void print_progress(const char *name, time_t start, time_t now, off_t start_pos, off_t pos, off_t total)
+static void print_progress(const char *name, time_t start, time_t now,
+                           off_t start_pos, off_t pos, off_t total)
 {
         double avg = 0.0;
-        long  eta = -1; 
+        long eta = -1;
         double prcnt = 0.0;
         char hpos[20], htotal[20], havg[20];
         char *status, *filename;
         int len;
-        if(now - start)avg = 1.0 * (pos - start_pos) / (now - start);
+        if (now - start) {
+                avg = 1.0 * (pos - start_pos) / (now - start);
+        }
         eta = (total - pos) / avg;
-        if(total)prcnt = 100.0 * pos / total;
+        if (total) {
+                prcnt = 100.0 * pos / total;
+        }
 
         human_readable(pos, hpos, sizeof(hpos));
@@ -256 +305 @@
         human_readable(avg, havg, sizeof(havg));
 
-        len = asprintf(&status, "%s of %s (%.2f%%) at %s/s ETA: %s", hpos, htotal, prcnt, havg, print_time(eta));
+        len = asprintf(&status, "%s of %s (%.2f%%) at %s/s ETA: %s", hpos,
+                       htotal, prcnt, havg, print_time(eta));
         if (len == -1) {
                 return;
         }
 
-        if(columns) {
-                int required = strlen(name), available = columns - len - strlen("[] ");
-                if(required > available) {
-                        if (asprintf(&filename, "...%s", name + required - available + 3) == -1) {
+        if (columns) {
+                int required = strlen(name),
+                    available = columns - len - strlen("[] ");
+                if (required > available) {
+                        if (asprintf(&filename, "...%s",
+                                     name + required - available + 3) == -1) {
                                 return;
                         }
@@ -270 +322 @@
                         filename = SMB_STRNDUP(name, available);
                 }
-        } else filename = SMB_STRDUP(name);
+        } else {
+                filename = SMB_STRDUP(name);
+        }
 
         fprintf(stderr, "\r[%s] %s", filename, status);
 
-        free(filename); free(status);
-}
-
-/* Return 1 on error, 0 on success. */
-
-static int smb_download_file(const char *base, const char *name, int recursive,
-                             int resume, int toplevel, char *outfile)
+        free(filename);
+        free(status);
+}
+
+/* Return false on error, true on success. */
+
+static bool smb_download_file(const char *base, const char *name,
+                              bool recursive, bool resume, bool toplevel,
+                              char *outfile)
 {
         int remotehandle, localhandle;
@@ -288 +344 @@
         char checkbuf[2][RESUME_CHECK_SIZE];
         char *readbuf = NULL;
-        off_t offset_download = 0, offset_check = 0, curpos = 0, start_offset = 0;
+        off_t offset_download = 0, offset_check = 0, curpos = 0,
+              start_offset = 0;
         struct stat localstat, remotestat;
 
-        snprintf(path, SMB_MAXPATHLEN-1, "%s%s%s", base, (*base && *name && name[0] != '/' && base[strlen(base)-1] != '/')?"/":"", name);
+        snprintf(path, SMB_MAXPATHLEN-1, "%s%s%s", base,
+                 (*base && *name && name[0] != '/' &&
+                  base[strlen(base)-1] != '/') ? "/" : "",
+                 name);
 
         remotehandle = smbc_open(path, O_RDONLY, 0755);
 
-        if(remotehandle < 0) {
-                switch(errno) {
-                case EISDIR: 
-                        if(!recursive) {
-                                fprintf(stderr, "%s is a directory. Specify -R to download recursively\n", path);
-                                return 1;
+        if (remotehandle < 0) {
+                switch (errno) {
+                case EISDIR:
+                        if (!recursive) {
+                                fprintf(stderr,
+                                        "%s is a directory. Specify -R "
+                                        "to download recursively\n",
+                                        path);
+                                return false;
                         }
                         return smb_download_dir(base, name, resume);
 
                 case ENOENT:
-                        fprintf(stderr, "%s can't be found on the remote server\n", path);
-                        return 1;
+                        fprintf(stderr,
+                                "%s can't be found on the remote server\n",
+                                path);
+                        return false;
 
                 case ENOMEM:
                         fprintf(stderr, "Not enough memory\n");
-                        return 1;
+                        return false;
 
                 case ENODEV:
-                        fprintf(stderr, "The share name used in %s does not exist\n", path);
-                        return 1;
+                        fprintf(stderr,
+                                "The share name used in %s does not exist\n",
+                                path);
+                        return false;
 
                 case EACCES:
-                        fprintf(stderr, "You don't have enough permissions to access %s\n", path);
-                        return 1;
+                        fprintf(stderr, "You don't have enough permissions "
+                                "to access %s\n",
+                                path);
+                        return false;
 
                 default:
                         perror("smbc_open");
-                        return 1;
-                }
-        } 
-
-        if(smbc_fstat(remotehandle, &remotestat) < 0) {
+                        return false;
+                }
+        }
+
+        if (smbc_fstat(remotehandle, &remotestat) < 0) {
                 fprintf(stderr, "Can't stat %s: %s\n", path, strerror(errno));
-                return 1;
-        }
-
-        if(outfile) newpath = outfile;
-        else if(!name[0]) {
+                return false;
+        }
+
+        if (outfile) {
+                newpath = outfile;
+        } else if (!name[0]) {
                 newpath = strrchr(base, '/');
-                if(newpath)newpath++; else newpath = base;
-        } else newpath = name;
+                if (newpath) {
+                        newpath++;
+                } else {
+                        newpath = base;
+                }
+        } else {
+                newpath = name;
+        }
 
         if (!toplevel && (newpath[0] == '/')) {
@@ -342 +418 @@
 
         /* Open local file according to the mode */
-        if(update) {
+        if (opt.update) {
                 /* if it is up-to-date, skip */
-                if(stat(newpath, &localstat) == 0 &&
-                                localstat.st_mtime >= remotestat.st_mtime) {
-                        if(verbose)
+                if (stat(newpath, &localstat) == 0 &&
+                    localstat.st_mtime >= remotestat.st_mtime) {
+                        if (opt.verbose) {
                                 printf("%s is up-to-date, skipping\n", newpath);
+                        }
                         smbc_close(remotehandle);
-                        return 0;
+                        return true;
                 }
                 /* else open it for writing and truncate if it exists */
-                localhandle = open(newpath, O_CREAT | O_NONBLOCK | O_RDWR | O_TRUNC, 0775);
-                if(localhandle < 0) {
+                localhandle = open(
+                    newpath, O_CREAT | O_NONBLOCK | O_RDWR | O_TRUNC, 0775);
+                if (localhandle < 0) {
                         fprintf(stderr, "Can't open %s : %s\n", newpath,
-                                        strerror(errno));
+                                strerror(errno));
                         smbc_close(remotehandle);
-                        return 1;
+                        return false;
                 }
                 /* no offset */
-        } else if(!send_stdout) {
-                localhandle = open(newpath, O_CREAT | O_NONBLOCK | O_RDWR | (!resume?O_EXCL:0), 0755);
-                if(localhandle < 0) {
-                        fprintf(stderr, "Can't open %s: %s\n", newpath, strerror(errno));
+        } else if (!opt.send_stdout) {
+                localhandle = open(newpath, O_CREAT | O_NONBLOCK | O_RDWR |
+                                                (!resume ? O_EXCL : 0),
+                                   0755);
+                if (localhandle < 0) {
+                        fprintf(stderr, "Can't open %s: %s\n", newpath,
+                                strerror(errno));
                         smbc_close(remotehandle);
-                        return 1;
+                        return false;
                 }
 
                 if (fstat(localhandle, &localstat) != 0) {
-                        fprintf(stderr, "Can't fstat %s: %s\n", newpath, strerror(errno));
+                        fprintf(stderr, "Can't fstat %s: %s\n", newpath,
+                                strerror(errno));
                         smbc_close(remotehandle);
                         close(localhandle);
-                        return 1;
+                        return false;
                 }
 
                 start_offset = localstat.st_size;
 
-                if(localstat.st_size && localstat.st_size == remotestat.st_size) {
-                        if(verbose)fprintf(stderr, "%s is already downloaded completely.\n", path);
-                        else if(!quiet)fprintf(stderr, "%s\n", path);
+                if (localstat.st_size &&
+                    localstat.st_size == remotestat.st_size) {
+                        if (opt.verbose) {
+                                fprintf(stderr, "%s is already downloaded "
+                                        "completely.\n",
+                                        path);
+                        } else if (!opt.quiet) {
+                                fprintf(stderr, "%s\n", path);
+                        }
                         smbc_close(remotehandle);
                         close(localhandle);
-                        return 0;
-                }
-
-                if(localstat.st_size > RESUME_CHECK_OFFSET && remotestat.st_size > RESUME_CHECK_OFFSET) {
-                        offset_download = localstat.st_size - RESUME_DOWNLOAD_OFFSET;
+                        return true;
+                }
+
+                if (localstat.st_size > RESUME_CHECK_OFFSET &&
+                    remotestat.st_size > RESUME_CHECK_OFFSET) {
+                        offset_download =
+                            localstat.st_size - RESUME_DOWNLOAD_OFFSET;
                         offset_check = localstat.st_size - RESUME_CHECK_OFFSET;
-                        if(verbose)printf("Trying to start resume of %s at "OFF_T_FORMAT"\n"
-                                   "At the moment "OFF_T_FORMAT" of "OFF_T_FORMAT" bytes have been retrieved\n",
-                                newpath, (OFF_T_FORMAT_CAST)offset_check, 
-                                (OFF_T_FORMAT_CAST)localstat.st_size,
-                                (OFF_T_FORMAT_CAST)remotestat.st_size);
-                }
-
-                if(offset_check) { 
+                        if (opt.verbose) {
+                                printf("Trying to start resume of %s at %jd\n"
+                                       "At the moment %jd of %jd bytes have "
+                                       "been retrieved\n",
+                                       newpath, (intmax_t)offset_check,
+                                       (intmax_t)localstat.st_size,
+                                       (intmax_t)remotestat.st_size);
+                        }
+                }
+
+                if (offset_check) {
                         off_t off1, off2;
-                        /* First, check all bytes from offset_check to offset_download */
+                        /* First, check all bytes from offset_check to
+                         * offset_download */
                         off1 = lseek(localhandle, offset_check, SEEK_SET);
-                        if(off1 < 0) {
-                                fprintf(stderr, "Can't seek to "OFF_T_FORMAT" in local file %s\n",
-                                        (OFF_T_FORMAT_CAST)offset_check, newpath);
-                                smbc_close(remotehandle); close(localhandle);
-                                return 1;
-                        }
-
-                        off2 = smbc_lseek(remotehandle, offset_check, SEEK_SET); 
-                        if(off2 < 0) {
-                                fprintf(stderr, "Can't seek to "OFF_T_FORMAT" in remote file %s\n",
-                                        (OFF_T_FORMAT_CAST)offset_check, newpath);
-                                smbc_close(remotehandle); close(localhandle);
-                                return 1;
-                        }
-
-                        if(off1 != off2) {
-                                fprintf(stderr, "Offset in local and remote files is different (local: "OFF_T_FORMAT", remote: "OFF_T_FORMAT")\n",
-                                        (OFF_T_FORMAT_CAST)off1,
-                                        (OFF_T_FORMAT_CAST)off2);
-                                smbc_close(remotehandle); close(localhandle);
-                                return 1;
-                        }
-
-                        if(smbc_read(remotehandle, checkbuf[0], RESUME_CHECK_SIZE) != RESUME_CHECK_SIZE) {
-                                fprintf(stderr, "Can't read %d bytes from remote file %s\n", RESUME_CHECK_SIZE, path);
-                                smbc_close(remotehandle); close(localhandle);
-                                return 1;
-                        }
-
-                        if(read(localhandle, checkbuf[1], RESUME_CHECK_SIZE) != RESUME_CHECK_SIZE) {
-                                fprintf(stderr, "Can't read %d bytes from local file %s\n", RESUME_CHECK_SIZE, name);
-                                smbc_close(remotehandle); close(localhandle);
-                                return 1;
-                        }
-
-                        if(memcmp(checkbuf[0], checkbuf[1], RESUME_CHECK_SIZE) == 0) {
-                                if(verbose)printf("Current local and remote file appear to be the same. Starting download from offset "OFF_T_FORMAT"\n", (OFF_T_FORMAT_CAST)offset_download);
+                        if (off1 < 0) {
+                                fprintf(stderr,
+                                        "Can't seek to %jd in local file %s\n",
+                                        (intmax_t)offset_check, newpath);
+                                smbc_close(remotehandle);
+                                close(localhandle);
+                                return false;
+                        }
+
+                        off2 = smbc_lseek(remotehandle, offset_check, SEEK_SET);
+                        if (off2 < 0) {
+                                fprintf(stderr,
+                                        "Can't seek to %jd in remote file %s\n",
+                                        (intmax_t)offset_check, newpath);
+                                smbc_close(remotehandle);
+                                close(localhandle);
+                                return false;
+                        }
+
+                        if (off1 != off2) {
+                                fprintf(stderr, "Offset in local and remote "
+                                        "files are different "
+                                        "(local: %jd, remote: %jd)\n",
+                                        (intmax_t)off1, (intmax_t)off2);
+                                smbc_close(remotehandle);
+                                close(localhandle);
+                                return false;
+                        }
+
+                        if (smbc_read(remotehandle, checkbuf[0],
+                                      RESUME_CHECK_SIZE) != RESUME_CHECK_SIZE) {
+                                fprintf(stderr, "Can't read %d bytes from "
+                                        "remote file %s\n",
+                                        RESUME_CHECK_SIZE, path);
+                                smbc_close(remotehandle);
+                                close(localhandle);
+                                return false;
+                        }
+
+                        if (read(localhandle, checkbuf[1], RESUME_CHECK_SIZE) !=
+                            RESUME_CHECK_SIZE) {
+                                fprintf(stderr, "Can't read %d bytes from "
+                                        "local file %s\n",
+                                        RESUME_CHECK_SIZE, name);
+                                smbc_close(remotehandle);
+                                close(localhandle);
+                                return false;
+                        }
+
+                        if (memcmp(checkbuf[0], checkbuf[1],
+                                   RESUME_CHECK_SIZE) == 0) {
+                                if (opt.verbose) {
+                                        printf("Current local and remote file "
+                                               "appear to be the same. "
+                                               "Starting download from "
+                                               "offset %jd\n",
+                                               (intmax_t)offset_download);
+                                }
                         } else {
-                                fprintf(stderr, "Local and remote file appear to be different, not doing resume for %s\n", path);
-                                smbc_close(remotehandle); close(localhandle);
-                                return 1;
+                                fprintf(stderr, "Local and remote file appear "
+                                        "to be different, not "
+                                        "doing resume for %s\n",
+                                        path);
+                                smbc_close(remotehandle);
+                                close(localhandle);
+                                return false;
                         }
                 }
@@ -449 +568 @@
         }
 
-        readbuf = (char *)SMB_MALLOC(blocksize);
+        readbuf = (char *)SMB_MALLOC(opt.blocksize);
         if (!readbuf) {
-                return 1;
+                fprintf(stderr, "Failed to allocate %zu bytes for read "
+                                "buffer (%s)", opt.blocksize, strerror(errno));
+                if (localhandle != STDOUT_FILENO) {
+                        close(localhandle);
+                }
+                return false;
         }
 
         /* Now, download all bytes from offset_download to the end */
-        for(curpos = offset_download; curpos < remotestat.st_size; curpos+=blocksize) {
-                ssize_t bytesread = smbc_read(remotehandle, readbuf, blocksize);
+        for (curpos = offset_download; curpos < remotestat.st_size;
+             curpos += opt.blocksize) {
+                ssize_t bytesread;
+                ssize_t byteswritten;
+
+                bytesread = smbc_read(remotehandle, readbuf, opt.blocksize);
                 if(bytesread < 0) {
-                        fprintf(stderr, "Can't read %u bytes at offset "OFF_T_FORMAT", file %s\n", (unsigned int)blocksize, (OFF_T_FORMAT_CAST)curpos, path);
+                        fprintf(stderr,
+                                "Can't read %zu bytes at offset %jd, file %s\n",
+                                opt.blocksize, (intmax_t)curpos, path);
                         smbc_close(remotehandle);
-                        if (localhandle != STDOUT_FILENO) close(localhandle);
+                        if (localhandle != STDOUT_FILENO) {
+                                close(localhandle);
+                        }
                         free(readbuf);
-                        return 1;
+                        return false;
                 }
 
                 total_bytes += bytesread;
 
-                if(write(localhandle, readbuf, bytesread) < 0) {
-                        fprintf(stderr, "Can't write %u bytes to local file %s at offset "OFF_T_FORMAT"\n", (unsigned int)bytesread, path, (OFF_T_FORMAT_CAST)curpos);
+                byteswritten = write(localhandle, readbuf, bytesread);
+                if (byteswritten != bytesread) {
+                        fprintf(stderr,
+                                "Can't write %zd bytes to local file %s at "
+                                "offset %jd\n", bytesread, path,
+                                (intmax_t)curpos);
                         free(readbuf);
                         smbc_close(remotehandle);
-                        if (localhandle != STDOUT_FILENO) close(localhandle);
-                        return 1;
-                }
-
-                if(dots)fputc('.', stderr);
-                else if(!quiet) {
+                        if (localhandle != STDOUT_FILENO) {
+                                close(localhandle);
+                        }
+                        return false;
+                }
+
+                if (opt.dots) {
+                        fputc('.', stderr);
+                } else if (!opt.quiet) {
                         print_progress(newpath, start_time, time_mono(NULL),
-                                        start_offset, curpos, remotestat.st_size);
+                                       start_offset, curpos,
+                                       remotestat.st_size);
                 }
         }
@@ -484 +624 @@
         free(readbuf);
 
-        if(dots){
+        if (opt.dots) {
                 fputc('\n', stderr);
                 printf("%s downloaded\n", path);
-        } else if(!quiet) {
+        } else if (!opt.quiet) {
                 int i;
                 fprintf(stderr, "\r%s", path);
-                if(columns) {
-                        for(i = strlen(path); i < columns; i++) {
+                if (columns) {
+                        for (i = strlen(path); i < columns; i++) {
                                 fputc(' ', stderr);
                         }
@@ -498 +638 @@
         }
 
-        if(keep_permissions && !send_stdout) {
-                if(fchmod(localhandle, remotestat.st_mode) < 0) {
-                        fprintf(stderr, "Unable to change mode of local file %s to %o\n", path,
-                                (unsigned int)remotestat.st_mode);
-                        smbc_close(remotehandle);
-                        close(localhandle);
-                        return 1;
-                }
-        }
-
         smbc_close(remotehandle);
-        if (localhandle != STDOUT_FILENO) close(localhandle);
-        return 0;
+        if (localhandle != STDOUT_FILENO) {
+                close(localhandle);
+        }
+        return true;
 }
 
@@ -517 +649 @@
         char bs[100];
         human_readable(total_bytes, bs, sizeof(bs));
-        if(!quiet)fprintf(stderr, "Downloaded %s in %lu seconds\n", bs,
-                (unsigned long)(time_mono(NULL) - total_start_time));
+        if (!opt.quiet) {
+                fprintf(stderr, "Downloaded %s in %lu seconds\n", bs,
+                        (unsigned long)(time_mono(NULL) - total_start_time));
+        }
         exit(0);
 }
@@ -532 +666 @@
         int lineno = 0, i;
         char var[101], val[101];
-        char found;
-        int *intdata; char **stringdata;
-        if(!fd) {
+        bool found;
+        int *intdata;
+        char **stringdata;
+        if (!fd) {
                 fprintf(stderr, "Can't open RC file %s\n", name);
                 return 1;
         }
 
-        while(!feof(fd)) {
+        while (!feof(fd)) {
                 lineno++;
-                if(fscanf(fd, "%100s %100s\n", var, val) < 2) {
-                        fprintf(stderr, "Can't parse line %d of %s, ignoring.\n", lineno, name);
+                if (fscanf(fd, "%100s %100s\n", var, val) < 2) {
+                        fprintf(stderr,
+                                "Can't parse line %d of %s, ignoring.\n",
+                                lineno, name);
                         continue;
                 }
 
-                found = 0;
-
-                for(i = 0; long_options[i].shortName; i++) {
-                        if(!long_options[i].longName)continue;
-                        if(strcmp(long_options[i].longName, var)) continue;
-                        if(!long_options[i].arg)continue;
-
-                        switch(long_options[i].argInfo) {
+                found = false;
+
+                for (i = 0; long_options[i].argInfo; i++) {
+                        if (!long_options[i].longName) {
+                                continue;
+                        }
+                        if (strcmp(long_options[i].longName, var)) {
+                                continue;
+                        }
+                        if (!long_options[i].arg) {
+                                continue;
+                        }
+
+                        switch (long_options[i].argInfo) {
                         case POPT_ARG_NONE:
                                 intdata = (int *)long_options[i].arg;
-                                if(!strcmp(val, "on")) *intdata = 1;
-                                else if(!strcmp(val, "off")) *intdata = 0;
-                                else fprintf(stderr, "Illegal value %s for %s at line %d in %s\n", val, var, lineno, name);
+                                if (!strcmp(val, "on")) {
+                                        *intdata = 1;
+                                } else if (!strcmp(val, "off")) {
+                                        *intdata = 0;
+                                } else {
+                                        fprintf(stderr, "Illegal value %s for "
+                                                "%s at line %d in %s\n",
+                                                val, var, lineno, name);
+                                }
                                 break;
                         case POPT_ARG_INT:
@@ -567 +716 @@
                                 stringdata = (char **)long_options[i].arg;
                                 *stringdata = SMB_STRDUP(val);
+                                if (long_options[i].shortName == 'U') {
+                                        char *p;
+                                        opt.username_specified = true;
+                                        p = strchr(*stringdata, '%');
+                                        if (p != NULL) {
+                                                *p = '\0';
+                                                opt.password = p + 1;
+                                                opt.password_specified = true;
+                                        }
+                                }
                                 break;
                         default:
-                                fprintf(stderr, "Invalid variable %s at line %d in %s\n", var, lineno, name);
+                                fprintf(stderr, "Invalid variable %s at "
+                                        "line %d in %s\n",
+                                        var, lineno, name);
                                 break;
                         }
 
-                        found = 1;
-                }
-                if(!found) {
-                        fprintf(stderr, "Invalid variable %s at line %d in %s\n", var, lineno, name);
+                        found = true;
+                }
+                if (!found) {
+                        fprintf(stderr,
+                                "Invalid variable %s at line %d in %s\n", var,
+                                lineno, name);
                 }
         }
@@ -584 +747 @@
 }
 
-int main(int argc, const char **argv)
+int main(int argc, char **argv)
 {
         int c = 0;
@@ -592 +755 @@
         int resume = 0, recursive = 0;
         TALLOC_CTX *frame = talloc_stackframe();
-        int ret = 0;
+        bool ret = true;
+        char *p;
+        const char **argv_const = discard_const_p(const char *, argv);
         struct poptOption long_options[] = {
-                {"guest", 'a', POPT_ARG_NONE, NULL, 'a', "Work as user guest" },        
-                {"encrypt", 'e', POPT_ARG_NONE, NULL, 'e', "Encrypt SMB transport (UNIX extended servers only)" },      
-                {"resume", 'r', POPT_ARG_NONE, &resume, 0, "Automatically resume aborted files" },
-                {"update", 'U',  POPT_ARG_NONE, &update, 0, "Download only when remote file is newer than local file or local file is missing"},
-                {"recursive", 'R',  POPT_ARG_NONE, &recursive, 0, "Recursively download files" },
-                {"username", 'u', POPT_ARG_STRING, &username, 'u', "Username to use" },
-                {"password", 'p', POPT_ARG_STRING, &password, 'p', "Password to use" },
-                {"workgroup", 'w', POPT_ARG_STRING, &workgroup, 'w', "Workgroup to use (optional)" },
-                {"nonprompt", 'n', POPT_ARG_NONE, &nonprompt, 'n', "Don't ask anything (non-interactive)" },
-                {"debuglevel", 'd', POPT_ARG_INT, &debuglevel, 'd', "Debuglevel to use" },
-                {"outputfile", 'o', POPT_ARG_STRING, &outputfile, 'o', "Write downloaded data to specified file" },
-                {"stdout", 'O', POPT_ARG_NONE, &send_stdout, 'O', "Write data to stdout" },
-                {"dots", 'D', POPT_ARG_NONE, &dots, 'D', "Show dots as progress indication" },
-                {"quiet", 'q', POPT_ARG_NONE, &quiet, 'q', "Be quiet" },
-                {"verbose", 'v', POPT_ARG_NONE, &verbose, 'v', "Be verbose" },
-                {"keep-permissions", 'P', POPT_ARG_NONE, &keep_permissions, 'P', "Keep permissions" },
-                {"blocksize", 'b', POPT_ARG_INT, &blocksize, 'b', "Change number of bytes in a block"},
-                {"rcfile", 'f', POPT_ARG_STRING, NULL, 'f', "Use specified rc file"},
                 POPT_AUTOHELP
+
+                {"workgroup",  'w', POPT_ARG_STRING, &opt.workgroup,   'w', "Workgroup to use (optional)" },
+                {"user",       'U', POPT_ARG_STRING, &opt.username,    'U', "Username to use" },
+                {"guest",      'a', POPT_ARG_NONE,   NULL,             'a', "Work as user guest" },
+
+                {"nonprompt",  'n', POPT_ARG_NONE,   NULL,             'n',  "Don't ask anything (non-interactive)" },
+                {"debuglevel", 'd', POPT_ARG_INT,    &opt.debuglevel,  'd', "Debuglevel to use" },
+
+                {"encrypt",    'e', POPT_ARG_NONE,   NULL,             'e', "Encrypt SMB transport" },
+                {"resume",     'r', POPT_ARG_NONE,   NULL,             'r',  "Automatically resume aborted files" },
+                {"update",     'u', POPT_ARG_NONE,   NULL,             'u',  "Download only when remote file is newer than local file or local file is missing"},
+                {"recursive",  'R', POPT_ARG_NONE,   NULL,             'R',  "Recursively download files" },
+                {"blocksize",  'b', POPT_ARG_INT,    &opt.blocksize,   'b', "Change number of bytes in a block"},
+
+                {"outputfile", 'o', POPT_ARG_STRING, &opt.outputfile,  'o', "Write downloaded data to specified file" },
+                {"stdout",     'O', POPT_ARG_NONE,   NULL,             'O',  "Write data to stdout" },
+                {"dots",       'D', POPT_ARG_NONE,   NULL,             'D',  "Show dots as progress indication" },
+                {"quiet",      'q', POPT_ARG_NONE,   NULL,             'q',  "Be quiet" },
+                {"verbose",    'v', POPT_ARG_NONE,   NULL,             'v',  "Be verbose" },
+                {"rcfile",     'f', POPT_ARG_STRING, NULL,             'f', "Use specified rc file"},
+
                 POPT_TABLEEND
         };
         poptContext pc;
 
-        load_case_tables();
+        smb_init_locale();
 
         /* only read rcfile if it exists */
@@ -623 +791 @@
                 return 1;
         }
-        if(access(rcfile, F_OK) == 0) 
+        if (access(rcfile, F_OK) == 0) {
                 readrcfile(rcfile, long_options);
+        }
         free(rcfile);
 
@@ -633 +802 @@
         signal(SIGTERM, signal_quit);
 
-        pc = poptGetContext(argv[0], argc, argv, long_options, 0);
-
-        while((c = poptGetNextOpt(pc)) >= 0) {
-                switch(c) {
+        pc = poptGetContext(argv[0], argc, argv_const, long_options, 0);
+
+        while ((c = poptGetNextOpt(pc)) > 0) {
+                switch (c) {
                 case 'f':
                         readrcfile(poptGetOptArg(pc), long_options);
                         break;
                 case 'a':
-                        username = ""; password = "";
+                        opt.username_specified = true;
+                        opt.username = talloc_strdup(frame, "");
+                        opt.password_specified = true;
+                        opt.password = talloc_strdup(frame, "");
                         break;
                 case 'e':
                         smb_encrypt = true;
                         break;
-                }
-        }
-
-        if((send_stdout || resume || outputfile) && update) {
-                fprintf(stderr, "The -o, -R or -O and -U options can not be used together.\n");
+                case 'U':
+                        opt.username_specified = true;
+                        opt.username = talloc_strdup(frame, opt.username);
+                        p = strchr(opt.username,'%');
+                        if (p != NULL) {
+                                *p = '\0';
+                                opt.password = p + 1;
+                                opt.password_specified = true;
+                        }
+                        break;
+                case 'n':
+                        opt.nonprompt = true;
+                        break;
+                case 'r':
+                        resume = true;
+                        break;
+                case 'u':
+                        opt.update = true;
+                        break;
+                case 'R':
+                        recursive = true;
+                        break;
+                case 'O':
+                        opt.send_stdout = true;
+                        break;
+                case 'D':
+                        opt.dots = true;
+                        break;
+                case 'q':
+                        opt.quiet = true;
+                        break;
+                case 'v':
+                        opt.verbose = true;
+                        break;
+                }
+        }
+
+        if (c < -1) {
+                fprintf(stderr, "%s: %s\n",
+                        poptBadOption(pc, POPT_BADOPTION_NOALIAS),
+                        poptStrerror(c));
                 return 1;
         }
-        if((send_stdout || outputfile) && recursive) {
-                fprintf(stderr, "The -o or -O and -R options can not be used together.\n");
+
+        if ((opt.send_stdout || resume || opt.outputfile) && opt.update) {
+                fprintf(stderr, "The -o, -R or -O and -U options can not be "
+                        "used together.\n");
                 return 1;
         }
-
-        if(outputfile && send_stdout) {
-                fprintf(stderr, "The -o and -O options cannot be used together.\n");
+        if ((opt.send_stdout || opt.outputfile) && recursive) {
+                fprintf(stderr, "The -o or -O and -R options can not be "
+                        "used together.\n");
                 return 1;
         }
 
-        if(smbc_init(get_auth_data, debuglevel) < 0) {
+        if (opt.outputfile && opt.send_stdout) {
+                fprintf(stderr, "The -o and -O options can not be "
+                        "used together.\n");
+                return 1;
+        }
+
+        popt_burn_cmdline_password(argc, argv);
+
+        if (smbc_init(get_auth_data, opt.debuglevel) < 0) {
                 fprintf(stderr, "Unable to initialize libsmbclient\n");
                 return 1;
@@ -671 +889 @@
                 SMBCCTX *smb_ctx = smbc_set_context(NULL);
                 smbc_option_set(smb_ctx,
-                        CONST_DISCARD(char *, "smb_encrypt_level"),
-                        "require");
+                                discard_const_p(char, "smb_encrypt_level"),
+                                "require");
         }
 
@@ -679 +897 @@
         total_start_time = time_mono(NULL);
 
-        while ( (file = poptGetArg(pc)) ) {
-                if (!recursive) 
+        while ((file = poptGetArg(pc))) {
+                if (!recursive) {
                         ret = smb_download_file(file, "", recursive, resume,
-                                                1, outputfile);
-                else 
+                                                true, opt.outputfile);
+                } else {
                         ret = smb_download_dir(file, "", resume);
+                }
         }
 
         TALLOC_FREE(frame);
-        if ( ret == 0){
+        if (ret) {
                 clean_exit();
         }
-        return ret;
-}
+        return ret?0:1;
+}

vendor/current/source3/utils/smbpasswd.c

@@ -98 +98 @@
                 switch(ch) {
                 case 'L':
-#if !defined(NSS_WRAPPER)
                         if (getuid() != 0) {
                                 fprintf(stderr, "smbpasswd -L can only be used by root.\n");
                                 exit(1);
                         }
-#endif
                         local_flags |= LOCAL_AM_ROOT;
                         break;
                 case 'c':
                         configfile = optarg;
+                        set_dyn_CONFIGFILE(optarg);
                         break;
                 case 'a':
@@ -137 +136 @@
                         local_flags |= LOCAL_SET_NO_PASSWORD;
                         local_flags &= ~LOCAL_SET_PASSWORD;
+                        SAFE_FREE(new_passwd);
                         new_passwd = smb_xstrdup("NO PASSWORD");
                         break;
@@ -153 +153 @@
                         break;
                 case 'R':
-                        lp_set_name_resolve_order(optarg);
+                        lp_set_cmdline("name resolve order", optarg);
                         break;
                 case 'D':
@@ -196 +196 @@
         }
 
-        if (!lp_load(configfile,True,False,False,True)) {
+        if (!lp_load_global(configfile)) {
                 fprintf(stderr, "Can't load %s - run testparm to debug it\n", 
                         configfile);
@@ -216 +216 @@
 
         p = get_pass("New SMB password:", stdin_get);
+        if (p == NULL) {
+                return NULL;
+        }
 
         fstrcpy(new_pw, p);
@@ -221 +224 @@
 
         p = get_pass("Retype new SMB password:", stdin_get);
+        if (p == NULL) {
+                return NULL;
+        }
 
         if (strcmp(p, new_pw)) {
@@ -286 +292 @@
                 return False;
 
-        return secrets_store_ldap_pw(lp_ldap_admin_dn(), pw);
+        return secrets_store_ldap_pw(lp_ldap_admin_dn(talloc_tos()), pw);
 }
 
@@ -301 +307 @@
 
         if (local_flags & LOCAL_SET_LDAP_ADMIN_PW) {
-                char *ldap_admin_dn = lp_ldap_admin_dn();
+                char *ldap_admin_dn = lp_ldap_admin_dn(talloc_tos());
                 if ( ! *ldap_admin_dn ) {
                         DEBUG(0,("ERROR: 'ldap admin dn' not defined! Please check your smb.conf\n"));
@@ -310 +316 @@
                 if ( ! *ldap_secret ) {
                         new_passwd = prompt_for_new_password(stdin_passwd_get);
+                        if (new_passwd == NULL) {
+                                fprintf(stderr, "Failed to read new password!\n");
+                                exit(1);
+                        }
                         fstrcpy(ldap_secret, new_passwd);
                 }
@@ -370 +380 @@
                         SAFE_FREE(new_passwd);
                         new_passwd = smb_xstrdup(user_name);
-                        strlower_m(new_passwd);
+                        if (!strlower_m(new_passwd)) {
+                                fprintf(stderr, "strlower_m %s failed\n",
+                                        new_passwd);
+                                exit(1);
+                        }
                 }
 
@@ -379 +393 @@
 
                 slprintf(buf, sizeof(buf)-1, "%s$", user_name);
-                fstrcpy(user_name, buf);
+                strlcpy(user_name, buf, sizeof(user_name));
         } else if (local_flags & LOCAL_INTERDOM_ACCOUNT) {
                 static fstring buf;
@@ -396 +410 @@
                 /* prepare uppercased and '$' terminated username */
                 slprintf(buf, sizeof(buf) - 1, "%s$", user_name);
-                fstrcpy(user_name, buf);
+                strlcpy(user_name, buf, sizeof(user_name));
 
         } else {
@@ -533 +547 @@
         if (remote_machine != NULL) {
                 old_pw = get_pass("Old SMB password:",stdin_passwd_get);
+                if (old_pw == NULL) {
+                        fprintf(stderr, "Unable to get old password.\n");
+                        exit(1);
+                }
         }
 
@@ -580 +598 @@
         }
 
-        load_case_tables();
+        smb_init_locale();
 
         local_flags = process_options(argc, argv, local_flags);
@@ -601 +619 @@
 
         if (local_flags & LOCAL_AM_ROOT) {
-                secrets_init();
-                return process_root(local_flags);
-        } 
-
-        ret = process_nonroot(local_flags);
+                bool ok;
+
+                ok = secrets_init();
+                if (!ok) {
+                        return 1;
+                }
+                ret = process_root(local_flags);
+        } else {
+                ret = process_nonroot(local_flags);
+        }
         TALLOC_FREE(frame);
         return ret;

vendor/current/source3/utils/smbtree.c

@@ -39 +39 @@
         struct smb_name_list *prev, *next;
         char *name, *comment;
-        uint32 server_type;
+        uint32_t server_type;
 };
 
@@ -50 +50 @@
 }
 
-static void add_name(const char *machine_name, uint32 server_type,
+static void add_name(const char *machine_name, uint32_t server_type,
                      const char *comment, void *state)
 {
@@ -96 +96 @@
         }
 
-        if (!use_bcast && !find_master_ip(lp_workgroup(), &server_ss)) {
-                DEBUG(4, ("Unable to find master browser for workgroup %s, falling back to broadcast\n", 
-                          master_workgroup));
-                                use_bcast = True;
-                } else if(!use_bcast) {
-                        char addr[INET6_ADDRSTRLEN];
-                        print_sockaddr(addr, sizeof(addr), &server_ss);
-                        if (!(cli = get_ipc_connect(addr, &server_ss, user_info)))
-                                return False;
+        if (!use_bcast && !find_master_ip(lp_workgroup(), &server_ss)) {
+                DEBUG(4,("Unable to find master browser for workgroup %s, "
+                         "falling back to broadcast\n",
+                         master_workgroup));
+                use_bcast = true;
+        }
+
+        if (!use_bcast) {
+                char addr[INET6_ADDRSTRLEN];
+
+                print_sockaddr(addr, sizeof(addr), &server_ss);
+
+                cli = get_ipc_connect(addr, &server_ss, user_info);
+                if (cli == NULL) {
+                        return false;
                 }
-
-                if (!(cli = get_ipc_connect_master_ip_bcast(talloc_tos(),
-                                                        user_info,
-                                                        &master_workgroup))) {
+        } else {
+                cli = get_ipc_connect_master_ip_bcast(talloc_tos(),
+                                                      user_info,
+                                                      &master_workgroup);
+                if (cli == NULL) {
                         DEBUG(4, ("Unable to find master browser by "
                                   "broadcast\n"));
-                        return False;
-        }
+                        return false;
+                }
+        }
 
         if (!cli_NetServerEnum(cli, master_workgroup,
@@ -150 +158 @@
 
 static bool get_rpc_shares(struct cli_state *cli,
-                           void (*fn)(const char *, uint32, const char *, void *),
+                           void (*fn)(const char *, uint32_t, const char *, void *),
                            void *state)
 {
@@ -170 +178 @@
         }
 
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_srvsvc.syntax_id,
+        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_srvsvc,
                                           &pipe_hnd);
 
@@ -202 +210 @@
         }
 
-        for (i=0; i<total_entries; i++) {
+        for (i=0; i < info_ctr.ctr.ctr1->count; i++) {
                 struct srvsvc_NetShareInfo1 info = info_ctr.ctr.ctr1->array[i];
                 fn(info.name, info.type, info.comment, state);
@@ -278 +286 @@
   main program
 ****************************************************************************/
- int main(int argc,char *argv[])
+int main(int argc, char *argv[])
 {
         TALLOC_CTX *frame = talloc_stackframe();
+        const char **argv_const = discard_const_p(const char *, argv);
         struct user_auth_info *auth_info;
         struct poptOption long_options[] = {
@@ -294 +303 @@
 
         /* Initialise samba stuff */
-        load_case_tables();
+        smb_init_locale();
 
         setlinebuf(stdout);
@@ -306 +315 @@
         popt_common_set_auth_info(auth_info);
 
-        pc = poptGetContext("smbtree", argc, (const char **)argv, long_options,
-                                                POPT_CONTEXT_KEEP_FIRST);
+        pc = poptGetContext("smbtree", argc, argv_const, long_options,
+                            POPT_CONTEXT_KEEP_FIRST);
         while(poptGetNextOpt(pc) != -1);
         poptFreeContext(pc);
-
-        lp_load(get_dyn_CONFIGFILE(),True,False,False,True);
+        popt_burn_cmdline_password(argc, argv);
+
+        lp_load_global(get_dyn_CONFIGFILE());
         load_interfaces();
 

vendor/current/source3/utils/split_tokens.c

@@ -41 +41 @@
         };
 
-        load_case_tables();
+        smb_init_locale();
 
         pc = poptGetContext(NULL, argc, argv, long_options,
@@ -57 +57 @@
                 return 1;
         }
-        
+
         lp_set_cmdline("log level", "0");
 
-        if (!lp_load(config_file,false,true,false,true)) {
+        if (!lp_load_global(config_file)) {
                 fprintf(stderr,"Error loading services.\n");
                 return 1;

vendor/current/source3/utils/status.c

@@ -32 +32 @@
 
 #include "includes.h"
+#include "smbd/globals.h"
 #include "system/filesys.h"
 #include "popt_common.h"
-#include "dbwrap.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_open.h"
 #include "../libcli/security/security.h"
 #include "session.h"
 #include "locking/proto.h"
 #include "messages.h"
+#include "librpc/gen_ndr/open_files.h"
+#include "smbd/smbd.h"
+#include "librpc/gen_ndr/notify.h"
+#include "lib/conn_tdb.h"
 #include "serverid.h"
+#include "status_profile.h"
+#include "smbd/notifyd/notifyd.h"
 
 #define SMB_MAXPIDS             2048
@@ -53 +61 @@
 static bool show_brl;
 static bool numeric_only;
+static bool do_checks = true;
 
 const char *username = NULL;
-
-extern bool status_profile_dump(bool be_verbose);
-extern bool status_profile_rates(bool be_verbose);
 
 /* added by OH */
@@ -85 +91 @@
 
         for (i=0;i<Ucrit_MaxPid;i++) {
-                if (cluster_id_equal(&pid, &Ucrit_pid[i])) 
+                if (serverid_equal(&pid, &Ucrit_pid[i])) {
                         return 1;
+                }
         }
 
@@ -109 +116 @@
 }
 
-static void print_share_mode(const struct share_mode_entry *e,
-                             const char *sharepath,
-                             const char *fname,
-                             void *dummy)
+static int print_share_mode(const struct share_mode_entry *e,
+                            const char *sharepath,
+                            const char *fname,
+                            const char *sname,
+                            void *dummy)
 {
         static int count;
 
-        if (!is_valid_share_mode_entry(e)) {
-                return;
-        }
-
-        if (!process_exists(e->pid)) {
-                return;
+        if (do_checks && !is_valid_share_mode_entry(e)) {
+                return 0;
         }
 
@@ -131 +135 @@
         count++;
 
+        if (do_checks && !serverid_exists(&e->pid)) {
+                /* the process for this entry does not exist any more */
+                return 0;
+        }
+
         if (Ucrit_checkPid(e->pid)) {
-                d_printf("%-11s  ",procid_str_static(&e->pid));
+                struct server_id_buf tmp;
+                d_printf("%-11s  ", server_id_str_buf(e->pid, &tmp));
                 d_printf("%-9u  ", (unsigned int)e->uid);
                 switch (map_share_mode_to_deny_mode(e->share_access,
@@ -170 +180 @@
                 } else if (e->op_type & LEVEL_II_OPLOCK) {
                         d_printf("LEVEL_II        ");
+                } else if (e->op_type == LEASE_OPLOCK) {
+                        uint32_t lstate = e->lease->current_state;
+                        d_printf("LEASE(%s%s%s)%s%s%s      ",
+                                 (lstate & SMB2_LEASE_READ)?"R":"",
+                                 (lstate & SMB2_LEASE_WRITE)?"W":"",
+                                 (lstate & SMB2_LEASE_HANDLE)?"H":"",
+                                 (lstate & SMB2_LEASE_READ)?"":" ",
+                                 (lstate & SMB2_LEASE_WRITE)?"":" ",
+                                 (lstate & SMB2_LEASE_HANDLE)?"":" ");
                 } else {
                         d_printf("NONE            ");
                 }
 
-                d_printf(" %s   %s   %s",sharepath, fname, time_to_asc((time_t)e->time.tv_sec));
-        }
+                d_printf(" %s   %s%s   %s",
+                         sharepath, fname,
+                         sname ? sname : "",
+                         time_to_asc((time_t)e->time.tv_sec));
+        }
+
+        return 0;
 }
 
@@ -187 +211 @@
 {
         static int count;
-        int i;
+        unsigned int i;
         static const struct {
                 enum brl_type lock_type;
@@ -202 +226 @@
         char *fname = NULL;
         struct share_mode_lock *share_mode;
+        struct server_id_buf tmp;
 
         if (count==0) {
@@ -212 +237 @@
         share_mode = fetch_share_mode_unlocked(NULL, id);
         if (share_mode) {
-                bool has_stream = share_mode->stream_name != NULL;
-
-                fname = talloc_asprintf(NULL, "%s%s%s", share_mode->base_name,
+                bool has_stream = share_mode->data->stream_name != NULL;
+
+                fname = talloc_asprintf(NULL, "%s%s%s",
+                                        share_mode->data->base_name,
                                         has_stream ? ":" : "",
-                                        has_stream ? share_mode->stream_name :
+                                        has_stream ?
+                                        share_mode->data->stream_name :
                                         "");
         } else {
@@ -231 +258 @@
         }
 
-        d_printf("%-10s %-15s %-4s %-9.0f %-9.0f %-24s %-24s\n", 
-                 procid_str_static(&pid), file_id_string_tos(&id),
+        d_printf("%-10s %-15s %-4s %-9jd %-9jd %-24s %-24s\n",
+                 server_id_str_buf(pid, &tmp), file_id_string_tos(&id),
                  desc,
-                 (double)start, (double)size,
+                 (intmax_t)start, (intmax_t)size,
                  sharepath, fname);
 
@@ -241 +268 @@
 }
 
-static int traverse_fn1(const struct connections_key *key,
-                        const struct connections_data *crec,
-                        void *state)
-{
-        if (crec->cnum == -1)
+static const char *session_dialect_str(uint16_t dialect)
+{
+        static fstring unkown_dialect;
+
+        switch(dialect){
+        case SMB2_DIALECT_REVISION_000:
+                return "NT1";
+        case SMB2_DIALECT_REVISION_202:
+                return "SMB2_02";
+        case SMB2_DIALECT_REVISION_210:
+                return "SMB2_10";
+        case SMB2_DIALECT_REVISION_222:
+                return "SMB2_22";
+        case SMB2_DIALECT_REVISION_224:
+                return "SMB2_24";
+        case SMB3_DIALECT_REVISION_300:
+                return "SMB3_00";
+        case SMB3_DIALECT_REVISION_302:
+                return "SMB3_02";
+        case SMB3_DIALECT_REVISION_310:
+                return "SMB3_10";
+        case SMB3_DIALECT_REVISION_311:
+                return "SMB3_11";
+        }
+
+        fstr_sprintf(unkown_dialect, "Unknown (0x%04x)", dialect);
+        return unkown_dialect;
+}
+
+static int traverse_connections(const struct connections_key *key,
+                                const struct connections_data *crec,
+                                void *private_data)
+{
+        TALLOC_CTX *mem_ctx = (TALLOC_CTX *)private_data;
+        struct server_id_buf tmp;
+        char *timestr = NULL;
+        int result = 0;
+        const char *encryption = "-";
+        const char *signing = "-";
+
+        if (crec->cnum == TID_FIELD_INVALID)
                 return 0;
 
-        if (!process_exists(crec->pid) || !Ucrit_checkUid(crec->uid)) {
+        if (do_checks &&
+            (!process_exists(crec->pid) || !Ucrit_checkUid(crec->uid))) {
                 return 0;
         }
 
-        d_printf("%-10s   %s   %-12s  %s",
-                 crec->servicename,procid_str_static(&crec->pid),
+        timestr = timestring(mem_ctx, crec->start);
+        if (timestr == NULL) {
+                return -1;
+        }
+
+        if (smbXsrv_is_encrypted(crec->encryption_flags)) {
+                switch (crec->cipher) {
+                case SMB_ENCRYPTION_GSSAPI:
+                        encryption = "GSSAPI";
+                        break;
+                case SMB2_ENCRYPTION_AES128_CCM:
+                        encryption = "AES-128-CCM";
+                        break;
+                case SMB2_ENCRYPTION_AES128_GCM:
+                        encryption = "AES-128-GCM";
+                        break;
+                default:
+                        encryption = "???";
+                        result = -1;
+                        break;
+                }
+        }
+
+        if (smbXsrv_is_signed(crec->signing_flags)) {
+                if (crec->dialect >= SMB3_DIALECT_REVISION_302) {
+                        signing = "AES-128-CMAC";
+                } else if (crec->dialect >= SMB2_DIALECT_REVISION_202) {
+                        signing = "HMAC-SHA256";
+                } else {
+                        signing = "HMAC-MD5";
+                }
+        }
+
+        d_printf("%-12s %-7s %-13s %-32s %-12s %-12s\n",
+                 crec->servicename, server_id_str_buf(crec->pid, &tmp),
                  crec->machine,
-                 time_to_asc(crec->start));
-
-        return 0;
+                 timestr,
+                 encryption,
+                 signing);
+
+        TALLOC_FREE(timestr);
+
+        return result;
 }
 
@@ -263 +364 @@
                               void *private_data)
 {
+        TALLOC_CTX *mem_ctx = (TALLOC_CTX *)private_data;
         fstring uid_str, gid_str;
-
-        if (!process_exists(session->pid)
-            || !Ucrit_checkUid(session->uid)) {
+        struct server_id_buf tmp;
+        char *machine_hostname = NULL;
+        int result = 0;
+        const char *encryption = "-";
+        const char *signing = "-";
+
+        if (do_checks &&
+            (!process_exists(session->pid) ||
+             !Ucrit_checkUid(session->uid))) {
                 return 0;
         }
@@ -272 +380 @@
         Ucrit_addPid(session->pid);
 
-        fstr_sprintf(uid_str, "%u", (unsigned int)session->uid);
-        fstr_sprintf(gid_str, "%u", (unsigned int)session->gid);
-
-        d_printf("%-7s   %-12s  %-12s  %-12s (%s)\n",
-                 procid_str_static(&session->pid),
-                 numeric_only ? uid_str : uidtoname(session->uid),
-                 numeric_only ? gid_str : gidtoname(session->gid),
-                 session->remote_machine, session->hostname);
-
-        return 0;
-}
-
-
-
-
- int main(int argc, char *argv[])
+        fstrcpy(uid_str, "-1");
+
+        if (session->uid != -1) {
+                if (numeric_only) {
+                        fstr_sprintf(uid_str, "%u", (unsigned int)session->uid);
+                } else {
+                        fstrcpy(uid_str, uidtoname(session->uid));
+                }
+        }
+
+        fstrcpy(gid_str, "-1");
+
+        if (session->gid != -1) {
+                if (numeric_only) {
+                        fstr_sprintf(gid_str, "%u", (unsigned int)session->gid);
+                } else {
+                        fstrcpy(gid_str, gidtoname(session->gid));
+                }
+        }
+
+        machine_hostname = talloc_asprintf(mem_ctx, "%s (%s)",
+                                           session->remote_machine,
+                                           session->hostname);
+        if (machine_hostname == NULL) {
+                return -1;
+        }
+
+        if (smbXsrv_is_encrypted(session->encryption_flags)) {
+                switch (session->cipher) {
+                case SMB2_ENCRYPTION_AES128_CCM:
+                        encryption = "AES-128-CCM";
+                        break;
+                case SMB2_ENCRYPTION_AES128_GCM:
+                        encryption = "AES-128-GCM";
+                        break;
+                default:
+                        encryption = "???";
+                        result = -1;
+                        break;
+                }
+        } else if (smbXsrv_is_partially_encrypted(session->encryption_flags)) {
+                switch (session->cipher) {
+                case SMB_ENCRYPTION_GSSAPI:
+                        encryption = "partial(GSSAPI)";
+                        break;
+                case SMB2_ENCRYPTION_AES128_CCM:
+                        encryption = "partial(AES-128-CCM)";
+                        break;
+                case SMB2_ENCRYPTION_AES128_GCM:
+                        encryption = "partial(AES-128-GCM)";
+                        break;
+                default:
+                        encryption = "???";
+                        result = -1;
+                        break;
+                }
+        }
+
+        if (smbXsrv_is_signed(session->signing_flags)) {
+                if (session->connection_dialect >= SMB3_DIALECT_REVISION_302) {
+                        signing = "AES-128-CMAC";
+                } else if (session->connection_dialect >= SMB2_DIALECT_REVISION_202) {
+                        signing = "HMAC-SHA256";
+                } else {
+                        signing = "HMAC-MD5";
+                }
+        } else if (smbXsrv_is_partially_signed(session->signing_flags)) {
+                if (session->connection_dialect >= SMB3_DIALECT_REVISION_302) {
+                        signing = "partial(AES-128-CMAC)";
+                } else if (session->connection_dialect >= SMB2_DIALECT_REVISION_202) {
+                        signing = "partial(HMAC-SHA256)";
+                } else {
+                        signing = "partial(HMAC-MD5)";
+                }
+        }
+
+
+        d_printf("%-7s %-12s %-12s %-41s %-17s %-20s %-21s\n",
+                 server_id_str_buf(session->pid, &tmp),
+                 uid_str, gid_str,
+                 machine_hostname,
+                 session_dialect_str(session->connection_dialect),
+                 encryption,
+                 signing);
+
+        TALLOC_FREE(machine_hostname);
+
+        return result;
+}
+
+
+static bool print_notify_rec(const char *path, struct server_id server,
+                             const struct notify_instance *instance,
+                             void *private_data)
+{
+        struct server_id_buf idbuf;
+
+        d_printf("%s\\%s\\%x\\%x\n", path, server_id_str_buf(server, &idbuf),
+                 (unsigned)instance->filter,
+                 (unsigned)instance->subdir_filter);
+
+        return true;
+}
+
+int main(int argc, const char *argv[])
 {
         int c;
         int profile_only = 0;
         bool show_processes, show_locks, show_shares;
+        bool show_notify = false;
         poptContext pc;
         struct poptOption long_options[] = {
@@ -299 +497 @@
                 {"locks",       'L', POPT_ARG_NONE,     NULL, 'L', "Show locks only" },
                 {"shares",      'S', POPT_ARG_NONE,     NULL, 'S', "Show shares only" },
+                {"notify",      'N', POPT_ARG_NONE,     NULL, 'N', "Show notifies" },
                 {"user",        'u', POPT_ARG_STRING,   &username, 'u', "Switch to user" },
                 {"brief",       'b', POPT_ARG_NONE,     NULL, 'b', "Be brief" },
@@ -305 +504 @@
                 {"byterange",   'B', POPT_ARG_NONE,     NULL, 'B', "Include byte range locks"},
                 {"numeric",     'n', POPT_ARG_NONE,     NULL, 'n', "Numeric uid/gid"},
+                {"fast",        'f', POPT_ARG_NONE,     NULL, 'f', "Skip checks if processes still exist"},
                 POPT_COMMON_SAMBA
                 POPT_TABLEEND
@@ -310 +510 @@
         TALLOC_CTX *frame = talloc_stackframe();
         int ret = 0;
-        struct messaging_context *msg_ctx;
+        struct messaging_context *msg_ctx = NULL;
+        char *db_path;
+        bool ok;
 
         sec_init();
-        load_case_tables();
+        smb_init_locale();
 
         setup_logging(argv[0], DEBUG_STDERR);
+        lp_set_cmdline("log level", "0");
 
         if (getuid() != geteuid()) {
@@ -323 +526 @@
         }
 
-        pc = poptGetContext(NULL, argc, (const char **) argv, long_options, 
+        if (getuid() != 0) {
+                d_printf("smbstatus only works as root!\n");
+                ret = 1;
+                goto done;
+        }
+
+
+        pc = poptGetContext(NULL, argc, argv, long_options,
                             POPT_CONTEXT_KEEP_FIRST);
 
@@ -340 +550 @@
                         shares_only = true;
                         break;
+                case 'N':
+                        show_notify = true;
+                        break;
                 case 'b':
                         brief = true;
@@ -355 +568 @@
                 case 'n':
                         numeric_only = true;
+                        break;
+                case 'f':
+                        do_checks = false;
                         break;
                 }
@@ -380 +596 @@
 
 
-        if (!sessionid_init_readonly()) {
-                fprintf(stderr, "Can't open sessionid.tdb\n");
+        /*
+         * This implicitly initializes the global ctdbd connection,
+         * usable by the db_open() calls further down.
+         */
+        msg_ctx = messaging_init(NULL, samba_tevent_context_init(NULL));
+        if (msg_ctx == NULL) {
+                fprintf(stderr, "messaging_init failed\n");
                 ret = -1;
                 goto done;
         }
 
-        if (lp_clustering()) {
-                /*
-                 * This implicitly initializes the global ctdbd
-                 * connection, usable by the db_open() calls further
-                 * down.
-                 */
-                msg_ctx = messaging_init(NULL, procid_self(),
-                                         event_context_init(NULL));
-                if (msg_ctx == NULL) {
-                        fprintf(stderr, "messaging_init failed\n");
-                        ret = -1;
-                        goto done;
-                }
-        }
-
-        if (!lp_load(get_dyn_CONFIGFILE(),False,False,False,True)) {
+        if (!lp_load_global(get_dyn_CONFIGFILE())) {
                 fprintf(stderr, "Can't load %s - run testparm to debug it\n",
                         get_dyn_CONFIGFILE());
@@ -411 +617 @@
                 case 'P':
                         /* Dump profile data */
-                        return status_profile_dump(verbose);
+                        ok = status_profile_dump(verbose);
+                        return ok ? 0 : 1;
                 case 'R':
                         /* Continuously display rate-converted data */
-                        return status_profile_rates(verbose);
+                        ok = status_profile_rates(verbose);
+                        return ok ? 0 : 1;
                 default:
                         break;
@@ -421 +629 @@
         if ( show_processes ) {
                 d_printf("\nSamba version %s\n",samba_version_string());
-                d_printf("PID     Username      Group         Machine                        \n");
-                d_printf("-------------------------------------------------------------------\n");
-                if (lp_security() == SEC_SHARE) {
-                        d_printf(" <processes do not show up in "
-                                 "anonymous mode>\n");
-                }
-
-                sessionid_traverse_read(traverse_sessionid, NULL);
+                d_printf("%-7s %-12s %-12s %-41s %-17s %-20s %-21s\n", "PID", "Username", "Group", "Machine", "Protocol Version", "Encryption", "Signing");
+                d_printf("----------------------------------------------------------------------------------------------------------------------------------------\n");
+
+                sessionid_traverse_read(traverse_sessionid, frame);
 
                 if (processes_only) {
@@ -436 +640 @@
 
         if ( show_shares ) {
-                if (verbose) {
-                        d_printf("Opened %s\n", lock_path("connections.tdb"));
-                }
-
                 if (brief) {
                         goto done;
                 }
 
-                d_printf("\nService      pid     machine       Connected at\n");
-                d_printf("-------------------------------------------------------\n");
-
-                connections_forall_read(traverse_fn1, NULL);
+                d_printf("\n%-12s %-7s %-13s %-32s %-12s %-12s\n", "Service", "pid", "Machine", "Connected at", "Encryption", "Signing");
+                d_printf("---------------------------------------------------------------------------------------------\n");
+
+                connections_forall_read(traverse_connections, frame);
 
                 d_printf("\n");
@@ -459 +659 @@
                 int result;
                 struct db_context *db;
-                db = db_open(NULL, lock_path("locking.tdb"), 0,
-                             TDB_CLEAR_IF_FIRST|TDB_INCOMPATIBLE_HASH, O_RDONLY, 0);
+
+                db_path = lock_path("locking.tdb");
+                if (db_path == NULL) {
+                        d_printf("Out of memory - exiting\n");
+                        ret = -1;
+                        goto done;
+                }
+
+                db = db_open(NULL, db_path, 0,
+                             TDB_CLEAR_IF_FIRST|TDB_INCOMPATIBLE_HASH, O_RDONLY, 0,
+                             DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
 
                 if (!db) {
-                        d_printf("%s not initialised\n",
-                                 lock_path("locking.tdb"));
+                        d_printf("%s not initialised\n", db_path);
                         d_printf("This is normal if an SMB client has never "
                                  "connected to your server.\n");
+                        TALLOC_FREE(db_path);
                         exit(0);
                 } else {
                         TALLOC_FREE(db);
+                        TALLOC_FREE(db_path);
                 }
 
@@ -478 +688 @@
                 }
 
-                if (!serverid_init_readonly(frame)) {
-                        d_printf("Can't initialise serverid tdb - exiting\n");
-                        ret = 1;
-                        goto done;
-                }
-                result = share_mode_forall(print_share_mode, NULL);
+                result = share_entry_forall(print_share_mode, NULL);
 
                 if (result == 0) {
                         d_printf("No locked files\n");
-                } else if (result == -1) {
+                } else if (result < 0) {
                         d_printf("locked file list truncated\n");
                 }
@@ -498 +703 @@
 
                 locking_end();
+        }
+
+        if (show_notify) {
+                struct notify_context *n;
+
+                n = notify_init(talloc_tos(), msg_ctx,
+                                messaging_tevent_context(msg_ctx));
+                if (n == NULL) {
+                        goto done;
+                }
+                notify_walk(n, print_notify_rec, NULL);
+                TALLOC_FREE(n);
         }
 

vendor/current/source3/utils/status_profile.c

@@ -21 +21 @@
 #include "includes.h"
 #include "smbprofile.h"
-
-bool status_profile_dump(bool be_verbose);
-bool status_profile_rates(bool be_verbose);
-
-#ifdef WITH_PROFILE
+#include "status_profile.h"
+
 static void profile_separator(const char * title)
 {
@@ -40 +37 @@
     d_printf("%s\n", line);
 }
-#endif
 
 /*******************************************************************
@@ -47 +43 @@
 bool status_profile_dump(bool verbose)
 {
-#ifdef WITH_PROFILE
+        struct profile_stats stats = {};
+
         if (!profile_setup(NULL, True)) {
                 fprintf(stderr,"Failed to initialise profile memory\n");
@@ -53 +50 @@
         }
 
-        d_printf("smb_count:                      %u\n", profile_p->smb_count);
-        d_printf("uid_changes:                    %u\n", profile_p->uid_changes);
-
-        profile_separator("System Calls");
-        d_printf("opendir_count:                  %u\n", profile_p->syscall_opendir_count);
-        d_printf("opendir_time:                   %u\n", profile_p->syscall_opendir_time);
-        d_printf("fdopendir_count:                %u\n", profile_p->syscall_fdopendir_count);
-        d_printf("fdopendir_time:                 %u\n", profile_p->syscall_fdopendir_time);
-        d_printf("readdir_count:                  %u\n", profile_p->syscall_readdir_count);
-        d_printf("readdir_time:                   %u\n", profile_p->syscall_readdir_time);
-        d_printf("mkdir_count:                    %u\n", profile_p->syscall_mkdir_count);
-        d_printf("mkdir_time:                     %u\n", profile_p->syscall_mkdir_time);
-        d_printf("rmdir_count:                    %u\n", profile_p->syscall_rmdir_count);
-        d_printf("rmdir_time:                     %u\n", profile_p->syscall_rmdir_time);
-        d_printf("closedir_count:                 %u\n", profile_p->syscall_closedir_count);
-        d_printf("closedir_time:                  %u\n", profile_p->syscall_closedir_time);
-        d_printf("open_count:                     %u\n", profile_p->syscall_open_count);
-        d_printf("open_time:                      %u\n", profile_p->syscall_open_time);
-        d_printf("close_count:                    %u\n", profile_p->syscall_close_count);
-        d_printf("close_time:                     %u\n", profile_p->syscall_close_time);
-        d_printf("read_count:                     %u\n", profile_p->syscall_read_count);
-        d_printf("read_time:                      %u\n", profile_p->syscall_read_time);
-        d_printf("read_bytes:                     %u\n", profile_p->syscall_read_bytes);
-        d_printf("write_count:                    %u\n", profile_p->syscall_write_count);
-        d_printf("write_time:                     %u\n", profile_p->syscall_write_time);
-        d_printf("write_bytes:                    %u\n", profile_p->syscall_write_bytes);
-        d_printf("pread_count:                    %u\n", profile_p->syscall_pread_count);
-        d_printf("pread_time:                     %u\n", profile_p->syscall_pread_time);
-        d_printf("pread_bytes:                    %u\n", profile_p->syscall_pread_bytes);
-        d_printf("pwrite_count:                   %u\n", profile_p->syscall_pwrite_count);
-        d_printf("pwrite_time:                    %u\n", profile_p->syscall_pwrite_time);
-        d_printf("pwrite_bytes:                   %u\n", profile_p->syscall_pwrite_bytes);
-        d_printf("sendfile_count:                 %u\n", profile_p->syscall_sendfile_count);
-        d_printf("sendfile_time:                  %u\n", profile_p->syscall_sendfile_time);
-        d_printf("sendfile_bytes:                 %u\n", profile_p->syscall_sendfile_bytes);
-        d_printf("lseek_count:                    %u\n", profile_p->syscall_lseek_count);
-        d_printf("lseek_time:                     %u\n", profile_p->syscall_lseek_time);
-        d_printf("rename_count:                   %u\n", profile_p->syscall_rename_count);
-        d_printf("rename_time:                    %u\n", profile_p->syscall_rename_time);
-        d_printf("fsync_count:                    %u\n", profile_p->syscall_fsync_count);
-        d_printf("fsync_time:                     %u\n", profile_p->syscall_fsync_time);
-        d_printf("stat_count:                     %u\n", profile_p->syscall_stat_count);
-        d_printf("stat_time:                      %u\n", profile_p->syscall_stat_time);
-        d_printf("fstat_count:                    %u\n", profile_p->syscall_fstat_count);
-        d_printf("fstat_time:                     %u\n", profile_p->syscall_fstat_time);
-        d_printf("lstat_count:                    %u\n", profile_p->syscall_lstat_count);
-        d_printf("lstat_time:                     %u\n", profile_p->syscall_lstat_time);
-        d_printf("unlink_count:                   %u\n", profile_p->syscall_unlink_count);
-        d_printf("unlink_time:                    %u\n", profile_p->syscall_unlink_time);
-        d_printf("chmod_count:                    %u\n", profile_p->syscall_chmod_count);
-        d_printf("chmod_time:                     %u\n", profile_p->syscall_chmod_time);
-        d_printf("fchmod_count:                   %u\n", profile_p->syscall_fchmod_count);
-        d_printf("fchmod_time:                    %u\n", profile_p->syscall_fchmod_time);
-        d_printf("chown_count:                    %u\n", profile_p->syscall_chown_count);
-        d_printf("chown_time:                     %u\n", profile_p->syscall_chown_time);
-        d_printf("fchown_count:                   %u\n", profile_p->syscall_fchown_count);
-        d_printf("fchown_time:                    %u\n", profile_p->syscall_fchown_time);
-        d_printf("chdir_count:                    %u\n", profile_p->syscall_chdir_count);
-        d_printf("chdir_time:                     %u\n", profile_p->syscall_chdir_time);
-        d_printf("getwd_count:                    %u\n", profile_p->syscall_getwd_count);
-        d_printf("getwd_time:                     %u\n", profile_p->syscall_getwd_time);
-        d_printf("ntimes_count:                   %u\n", profile_p->syscall_ntimes_count);
-        d_printf("ntimes_time:                    %u\n", profile_p->syscall_ntimes_time);
-        d_printf("ftruncate_count:                %u\n", profile_p->syscall_ftruncate_count);
-        d_printf("ftruncate_time:                 %u\n", profile_p->syscall_ftruncate_time);
-        d_printf("fcntl_lock_count:               %u\n", profile_p->syscall_fcntl_lock_count);
-        d_printf("fcntl_lock_time:                %u\n", profile_p->syscall_fcntl_lock_time);
-        d_printf("readlink_count:                 %u\n", profile_p->syscall_readlink_count);
-        d_printf("readlink_time:                  %u\n", profile_p->syscall_readlink_time);
-        d_printf("symlink_count:                  %u\n", profile_p->syscall_symlink_count);
-        d_printf("symlink_time:                   %u\n", profile_p->syscall_symlink_time);
-
-        profile_separator("Stat Cache");
-        d_printf("lookups:                        %u\n", profile_p->statcache_lookups);
-        d_printf("misses:                         %u\n", profile_p->statcache_misses);
-        d_printf("hits:                           %u\n", profile_p->statcache_hits);
-
-        profile_separator("Write Cache");
-        d_printf("read_hits:                      %u\n", profile_p->writecache_read_hits);
-        d_printf("abutted_writes:                 %u\n", profile_p->writecache_abutted_writes);
-        d_printf("total_writes:                   %u\n", profile_p->writecache_total_writes);
-        d_printf("non_oplock_writes:              %u\n", profile_p->writecache_non_oplock_writes);
-        d_printf("direct_writes:                  %u\n", profile_p->writecache_direct_writes);
-        d_printf("init_writes:                    %u\n", profile_p->writecache_init_writes);
-        d_printf("flushed_writes[SEEK]:           %u\n", profile_p->writecache_flushed_writes[SEEK_FLUSH]);
-        d_printf("flushed_writes[READ]:           %u\n", profile_p->writecache_flushed_writes[READ_FLUSH]);
-        d_printf("flushed_writes[WRITE]:          %u\n", profile_p->writecache_flushed_writes[WRITE_FLUSH]);
-        d_printf("flushed_writes[READRAW]:        %u\n", profile_p->writecache_flushed_writes[READRAW_FLUSH]);
-        d_printf("flushed_writes[OPLOCK_RELEASE]: %u\n", profile_p->writecache_flushed_writes[OPLOCK_RELEASE_FLUSH]);
-        d_printf("flushed_writes[CLOSE]:          %u\n", profile_p->writecache_flushed_writes[CLOSE_FLUSH]);
-        d_printf("flushed_writes[SYNC]:           %u\n", profile_p->writecache_flushed_writes[SYNC_FLUSH]);
-        d_printf("flushed_writes[SIZECHANGE]:     %u\n", profile_p->writecache_flushed_writes[SIZECHANGE_FLUSH]);
-        d_printf("num_perfect_writes:             %u\n", profile_p->writecache_num_perfect_writes);
-        d_printf("num_write_caches:               %u\n", profile_p->writecache_num_write_caches);
-        d_printf("allocated_write_caches:         %u\n", profile_p->writecache_allocated_write_caches);
-
-        profile_separator("SMB Calls");
-        d_printf("mkdir_count:                    %u\n", profile_p->SMBmkdir_count);
-        d_printf("mkdir_time:                     %u\n", profile_p->SMBmkdir_time);
-        d_printf("rmdir_count:                    %u\n", profile_p->SMBrmdir_count);
-        d_printf("rmdir_time:                     %u\n", profile_p->SMBrmdir_time);
-        d_printf("open_count:                     %u\n", profile_p->SMBopen_count);
-        d_printf("open_time:                      %u\n", profile_p->SMBopen_time);
-        d_printf("create_count:                   %u\n", profile_p->SMBcreate_count);
-        d_printf("create_time:                    %u\n", profile_p->SMBcreate_time);
-        d_printf("close_count:                    %u\n", profile_p->SMBclose_count);
-        d_printf("close_time:                     %u\n", profile_p->SMBclose_time);
-        d_printf("flush_count:                    %u\n", profile_p->SMBflush_count);
-        d_printf("flush_time:                     %u\n", profile_p->SMBflush_time);
-        d_printf("unlink_count:                   %u\n", profile_p->SMBunlink_count);
-        d_printf("unlink_time:                    %u\n", profile_p->SMBunlink_time);
-        d_printf("mv_count:                       %u\n", profile_p->SMBmv_count);
-        d_printf("mv_time:                        %u\n", profile_p->SMBmv_time);
-        d_printf("getatr_count:                   %u\n", profile_p->SMBgetatr_count);
-        d_printf("getatr_time:                    %u\n", profile_p->SMBgetatr_time);
-        d_printf("setatr_count:                   %u\n", profile_p->SMBsetatr_count);
-        d_printf("setatr_time:                    %u\n", profile_p->SMBsetatr_time);
-        d_printf("read_count:                     %u\n", profile_p->SMBread_count);
-        d_printf("read_time:                      %u\n", profile_p->SMBread_time);
-        d_printf("write_count:                    %u\n", profile_p->SMBwrite_count);
-        d_printf("write_time:                     %u\n", profile_p->SMBwrite_time);
-        d_printf("lock_count:                     %u\n", profile_p->SMBlock_count);
-        d_printf("lock_time:                      %u\n", profile_p->SMBlock_time);
-        d_printf("unlock_count:                   %u\n", profile_p->SMBunlock_count);
-        d_printf("unlock_time:                    %u\n", profile_p->SMBunlock_time);
-        d_printf("ctemp_count:                    %u\n", profile_p->SMBctemp_count);
-        d_printf("ctemp_time:                     %u\n", profile_p->SMBctemp_time);
-        d_printf("mknew_count:                    %u\n", profile_p->SMBmknew_count);
-        d_printf("mknew_time:                     %u\n", profile_p->SMBmknew_time);
-        d_printf("checkpath_count:                %u\n", profile_p->SMBcheckpath_count);
-        d_printf("checkpath_time:                 %u\n", profile_p->SMBcheckpath_time);
-        d_printf("exit_count:                     %u\n", profile_p->SMBexit_count);
-        d_printf("exit_time:                      %u\n", profile_p->SMBexit_time);
-        d_printf("lseek_count:                    %u\n", profile_p->SMBlseek_count);
-        d_printf("lseek_time:                     %u\n", profile_p->SMBlseek_time);
-        d_printf("lockread_count:                 %u\n", profile_p->SMBlockread_count);
-        d_printf("lockread_time:                  %u\n", profile_p->SMBlockread_time);
-        d_printf("writeunlock_count:              %u\n", profile_p->SMBwriteunlock_count);
-        d_printf("writeunlock_time:               %u\n", profile_p->SMBwriteunlock_time);
-        d_printf("readbraw_count:                 %u\n", profile_p->SMBreadbraw_count);
-        d_printf("readbraw_time:                  %u\n", profile_p->SMBreadbraw_time);
-        d_printf("readBmpx_count:                 %u\n", profile_p->SMBreadBmpx_count);
-        d_printf("readBmpx_time:                  %u\n", profile_p->SMBreadBmpx_time);
-        d_printf("readBs_count:                   %u\n", profile_p->SMBreadBs_count);
-        d_printf("readBs_time:                    %u\n", profile_p->SMBreadBs_time);
-        d_printf("writebraw_count:                %u\n", profile_p->SMBwritebraw_count);
-        d_printf("writebraw_time:                 %u\n", profile_p->SMBwritebraw_time);
-        d_printf("writeBmpx_count:                %u\n", profile_p->SMBwriteBmpx_count);
-        d_printf("writeBmpx_time:                 %u\n", profile_p->SMBwriteBmpx_time);
-        d_printf("writeBs_count:                  %u\n", profile_p->SMBwriteBs_count);
-        d_printf("writeBs_time:                   %u\n", profile_p->SMBwriteBs_time);
-        d_printf("writec_count:                   %u\n", profile_p->SMBwritec_count);
-        d_printf("writec_time:                    %u\n", profile_p->SMBwritec_time);
-        d_printf("setattrE_count:                 %u\n", profile_p->SMBsetattrE_count);
-        d_printf("setattrE_time:                  %u\n", profile_p->SMBsetattrE_time);
-        d_printf("getattrE_count:                 %u\n", profile_p->SMBgetattrE_count);
-        d_printf("getattrE_time:                  %u\n", profile_p->SMBgetattrE_time);
-        d_printf("lockingX_count:                 %u\n", profile_p->SMBlockingX_count);
-        d_printf("lockingX_time:                  %u\n", profile_p->SMBlockingX_time);
-        d_printf("trans_count:                    %u\n", profile_p->SMBtrans_count);
-        d_printf("trans_time:                     %u\n", profile_p->SMBtrans_time);
-        d_printf("transs_count:                   %u\n", profile_p->SMBtranss_count);
-        d_printf("transs_time:                    %u\n", profile_p->SMBtranss_time);
-        d_printf("ioctl_count:                    %u\n", profile_p->SMBioctl_count);
-        d_printf("ioctl_time:                     %u\n", profile_p->SMBioctl_time);
-        d_printf("ioctls_count:                   %u\n", profile_p->SMBioctls_count);
-        d_printf("ioctls_time:                    %u\n", profile_p->SMBioctls_time);
-        d_printf("copy_count:                     %u\n", profile_p->SMBcopy_count);
-        d_printf("copy_time:                      %u\n", profile_p->SMBcopy_time);
-        d_printf("move_count:                     %u\n", profile_p->SMBmove_count);
-        d_printf("move_time:                      %u\n", profile_p->SMBmove_time);
-        d_printf("echo_count:                     %u\n", profile_p->SMBecho_count);
-        d_printf("echo_time:                      %u\n", profile_p->SMBecho_time);
-        d_printf("writeclose_count:               %u\n", profile_p->SMBwriteclose_count);
-        d_printf("writeclose_time:                %u\n", profile_p->SMBwriteclose_time);
-        d_printf("openX_count:                    %u\n", profile_p->SMBopenX_count);
-        d_printf("openX_time:                     %u\n", profile_p->SMBopenX_time);
-        d_printf("readX_count:                    %u\n", profile_p->SMBreadX_count);
-        d_printf("readX_time:                     %u\n", profile_p->SMBreadX_time);
-        d_printf("writeX_count:                   %u\n", profile_p->SMBwriteX_count);
-        d_printf("writeX_time:                    %u\n", profile_p->SMBwriteX_time);
-        d_printf("trans2_count:                   %u\n", profile_p->SMBtrans2_count);
-        d_printf("trans2_time:                    %u\n", profile_p->SMBtrans2_time);
-        d_printf("transs2_count:                  %u\n", profile_p->SMBtranss2_count);
-        d_printf("transs2_time:                   %u\n", profile_p->SMBtranss2_time);
-        d_printf("findclose_count:                %u\n", profile_p->SMBfindclose_count);
-        d_printf("findclose_time:                 %u\n", profile_p->SMBfindclose_time);
-        d_printf("findnclose_count:               %u\n", profile_p->SMBfindnclose_count);
-        d_printf("findnclose_time:                %u\n", profile_p->SMBfindnclose_time);
-        d_printf("tcon_count:                     %u\n", profile_p->SMBtcon_count);
-        d_printf("tcon_time:                      %u\n", profile_p->SMBtcon_time);
-        d_printf("tdis_count:                     %u\n", profile_p->SMBtdis_count);
-        d_printf("tdis_time:                      %u\n", profile_p->SMBtdis_time);
-        d_printf("negprot_count:                  %u\n", profile_p->SMBnegprot_count);
-        d_printf("negprot_time:                   %u\n", profile_p->SMBnegprot_time);
-        d_printf("sesssetupX_count:               %u\n", profile_p->SMBsesssetupX_count);
-        d_printf("sesssetupX_time:                %u\n", profile_p->SMBsesssetupX_time);
-        d_printf("ulogoffX_count:                 %u\n", profile_p->SMBulogoffX_count);
-        d_printf("ulogoffX_time:                  %u\n", profile_p->SMBulogoffX_time);
-        d_printf("tconX_count:                    %u\n", profile_p->SMBtconX_count);
-        d_printf("tconX_time:                     %u\n", profile_p->SMBtconX_time);
-        d_printf("dskattr_count:                  %u\n", profile_p->SMBdskattr_count);
-        d_printf("dskattr_time:                   %u\n", profile_p->SMBdskattr_time);
-        d_printf("search_count:                   %u\n", profile_p->SMBsearch_count);
-        d_printf("search_time:                    %u\n", profile_p->SMBsearch_time);
-        d_printf("ffirst_count:                   %u\n", profile_p->SMBffirst_count);
-        d_printf("ffirst_time:                    %u\n", profile_p->SMBffirst_time);
-        d_printf("funique_count:                  %u\n", profile_p->SMBfunique_count);
-        d_printf("funique_time:                   %u\n", profile_p->SMBfunique_time);
-        d_printf("fclose_count:                   %u\n", profile_p->SMBfclose_count);
-        d_printf("fclose_time:                    %u\n", profile_p->SMBfclose_time);
-        d_printf("nttrans_count:                  %u\n", profile_p->SMBnttrans_count);
-        d_printf("nttrans_time:                   %u\n", profile_p->SMBnttrans_time);
-        d_printf("nttranss_count:                 %u\n", profile_p->SMBnttranss_count);
-        d_printf("nttranss_time:                  %u\n", profile_p->SMBnttranss_time);
-        d_printf("ntcreateX_count:                %u\n", profile_p->SMBntcreateX_count);
-        d_printf("ntcreateX_time:                 %u\n", profile_p->SMBntcreateX_time);
-        d_printf("ntcancel_count:                 %u\n", profile_p->SMBntcancel_count);
-        d_printf("ntcancel_time:                  %u\n", profile_p->SMBntcancel_time);
-        d_printf("splopen_count:                  %u\n", profile_p->SMBsplopen_count);
-        d_printf("splopen_time:                   %u\n", profile_p->SMBsplopen_time);
-        d_printf("splwr_count:                    %u\n", profile_p->SMBsplwr_count);
-        d_printf("splwr_time:                     %u\n", profile_p->SMBsplwr_time);
-        d_printf("splclose_count:                 %u\n", profile_p->SMBsplclose_count);
-        d_printf("splclose_time:                  %u\n", profile_p->SMBsplclose_time);
-        d_printf("splretq_count:                  %u\n", profile_p->SMBsplretq_count);
-        d_printf("splretq_time:                   %u\n", profile_p->SMBsplretq_time);
-        d_printf("sends_count:                    %u\n", profile_p->SMBsends_count);
-        d_printf("sends_time:                     %u\n", profile_p->SMBsends_time);
-        d_printf("sendb_count:                    %u\n", profile_p->SMBsendb_count);
-        d_printf("sendb_time:                     %u\n", profile_p->SMBsendb_time);
-        d_printf("fwdname_count:                  %u\n", profile_p->SMBfwdname_count);
-        d_printf("fwdname_time:                   %u\n", profile_p->SMBfwdname_time);
-        d_printf("cancelf_count:                  %u\n", profile_p->SMBcancelf_count);
-        d_printf("cancelf_time:                   %u\n", profile_p->SMBcancelf_time);
-        d_printf("getmac_count:                   %u\n", profile_p->SMBgetmac_count);
-        d_printf("getmac_time:                    %u\n", profile_p->SMBgetmac_time);
-        d_printf("sendstrt_count:                 %u\n", profile_p->SMBsendstrt_count);
-        d_printf("sendstrt_time:                  %u\n", profile_p->SMBsendstrt_time);
-        d_printf("sendend_count:                  %u\n", profile_p->SMBsendend_count);
-        d_printf("sendend_time:                   %u\n", profile_p->SMBsendend_time);
-        d_printf("sendtxt_count:                  %u\n", profile_p->SMBsendtxt_count);
-        d_printf("sendtxt_time:                   %u\n", profile_p->SMBsendtxt_time);
-        d_printf("invalid_count:                  %u\n", profile_p->SMBinvalid_count);
-        d_printf("invalid_time:                   %u\n", profile_p->SMBinvalid_time);
-
-        profile_separator("Pathworks Calls");
-        d_printf("setdir_count:                   %u\n", profile_p->pathworks_setdir_count);
-        d_printf("setdir_time:                    %u\n", profile_p->pathworks_setdir_time);
-
-        profile_separator("Trans2 Calls");
-        d_printf("open_count:                     %u\n", profile_p->Trans2_open_count);
-        d_printf("open_time:                      %u\n", profile_p->Trans2_open_time);
-        d_printf("findfirst_count:                %u\n", profile_p->Trans2_findfirst_count);
-        d_printf("findfirst_time:                 %u\n", profile_p->Trans2_findfirst_time);
-        d_printf("findnext_count:                 %u\n", profile_p->Trans2_findnext_count);
-        d_printf("findnext_time:                  %u\n", profile_p->Trans2_findnext_time);
-        d_printf("qfsinfo_count:                  %u\n", profile_p->Trans2_qfsinfo_count);
-        d_printf("qfsinfo_time:                   %u\n", profile_p->Trans2_qfsinfo_time);
-        d_printf("setfsinfo_count:                %u\n", profile_p->Trans2_setfsinfo_count);
-        d_printf("setfsinfo_time:                 %u\n", profile_p->Trans2_setfsinfo_time);
-        d_printf("qpathinfo_count:                %u\n", profile_p->Trans2_qpathinfo_count);
-        d_printf("qpathinfo_time:                 %u\n", profile_p->Trans2_qpathinfo_time);
-        d_printf("setpathinfo_count:              %u\n", profile_p->Trans2_setpathinfo_count);
-        d_printf("setpathinfo_time:               %u\n", profile_p->Trans2_setpathinfo_time);
-        d_printf("qfileinfo_count:                %u\n", profile_p->Trans2_qfileinfo_count);
-        d_printf("qfileinfo_time:                 %u\n", profile_p->Trans2_qfileinfo_time);
-        d_printf("setfileinfo_count:              %u\n", profile_p->Trans2_setfileinfo_count);
-        d_printf("setfileinfo_time:               %u\n", profile_p->Trans2_setfileinfo_time);
-        d_printf("fsctl_count:                    %u\n", profile_p->Trans2_fsctl_count);
-        d_printf("fsctl_time:                     %u\n", profile_p->Trans2_fsctl_time);
-        d_printf("ioctl_count:                    %u\n", profile_p->Trans2_ioctl_count);
-        d_printf("ioctl_time:                     %u\n", profile_p->Trans2_ioctl_time);
-        d_printf("findnotifyfirst_count:          %u\n", profile_p->Trans2_findnotifyfirst_count);
-        d_printf("findnotifyfirst_time:           %u\n", profile_p->Trans2_findnotifyfirst_time);
-        d_printf("findnotifynext_count:           %u\n", profile_p->Trans2_findnotifynext_count);
-        d_printf("findnotifynext_time:            %u\n", profile_p->Trans2_findnotifynext_time);
-        d_printf("mkdir_count:                    %u\n", profile_p->Trans2_mkdir_count);
-        d_printf("mkdir_time:                     %u\n", profile_p->Trans2_mkdir_time);
-        d_printf("session_setup_count:            %u\n", profile_p->Trans2_session_setup_count);
-        d_printf("session_setup_time:             %u\n", profile_p->Trans2_session_setup_time);
-        d_printf("get_dfs_referral_count:         %u\n", profile_p->Trans2_get_dfs_referral_count);
-        d_printf("get_dfs_referral_time:          %u\n", profile_p->Trans2_get_dfs_referral_time);
-        d_printf("report_dfs_inconsistancy_count: %u\n", profile_p->Trans2_report_dfs_inconsistancy_count);
-        d_printf("report_dfs_inconsistancy_time:  %u\n", profile_p->Trans2_report_dfs_inconsistancy_time);
-
-        profile_separator("NT Transact Calls");
-        d_printf("create_count:                   %u\n", profile_p->NT_transact_create_count);
-        d_printf("create_time:                    %u\n", profile_p->NT_transact_create_time);
-        d_printf("ioctl_count:                    %u\n", profile_p->NT_transact_ioctl_count);
-        d_printf("ioctl_time:                     %u\n", profile_p->NT_transact_ioctl_time);
-        d_printf("set_security_desc_count:        %u\n", profile_p->NT_transact_set_security_desc_count);
-        d_printf("set_security_desc_time:         %u\n", profile_p->NT_transact_set_security_desc_time);
-        d_printf("notify_change_count:            %u\n", profile_p->NT_transact_notify_change_count);
-        d_printf("notify_change_time:             %u\n", profile_p->NT_transact_notify_change_time);
-        d_printf("rename_count:                   %u\n", profile_p->NT_transact_rename_count);
-        d_printf("rename_time:                    %u\n", profile_p->NT_transact_rename_time);
-        d_printf("query_security_desc_count:      %u\n", profile_p->NT_transact_query_security_desc_count);
-        d_printf("query_security_desc_time:       %u\n", profile_p->NT_transact_query_security_desc_time);
-
-        profile_separator("ACL Calls");
-        d_printf("get_nt_acl_count:               %u\n", profile_p->get_nt_acl_count);
-        d_printf("get_nt_acl_time:                %u\n", profile_p->get_nt_acl_time);
-        d_printf("fget_nt_acl_count:              %u\n", profile_p->fget_nt_acl_count);
-        d_printf("fget_nt_acl_time:               %u\n", profile_p->fget_nt_acl_time);
-        d_printf("fset_nt_acl_count:              %u\n", profile_p->fset_nt_acl_count);
-        d_printf("fset_nt_acl_time:               %u\n", profile_p->fset_nt_acl_time);
-        d_printf("chmod_acl_count:                %u\n", profile_p->chmod_acl_count);
-        d_printf("chmod_acl_time:                 %u\n", profile_p->chmod_acl_time);
-        d_printf("fchmod_acl_count:               %u\n", profile_p->fchmod_acl_count);
-        d_printf("fchmod_acl_time:                %u\n", profile_p->fchmod_acl_time);
-
-        profile_separator("NMBD Calls");
-        d_printf("name_release_count:             %u\n", profile_p->name_release_count);
-        d_printf("name_release_time:              %u\n", profile_p->name_release_time);
-        d_printf("name_refresh_count:             %u\n", profile_p->name_refresh_count);
-        d_printf("name_refresh_time:              %u\n", profile_p->name_refresh_time);
-        d_printf("name_registration_count:        %u\n", profile_p->name_registration_count);
-        d_printf("name_registration_time:         %u\n", profile_p->name_registration_time);
-        d_printf("node_status_count:              %u\n", profile_p->node_status_count);
-        d_printf("node_status_time:               %u\n", profile_p->node_status_time);
-        d_printf("name_query_count:               %u\n", profile_p->name_query_count);
-        d_printf("name_query_time:                %u\n", profile_p->name_query_time);
-        d_printf("host_announce_count:            %u\n", profile_p->host_announce_count);
-        d_printf("host_announce_time:             %u\n", profile_p->host_announce_time);
-        d_printf("workgroup_announce_count:       %u\n", profile_p->workgroup_announce_count);
-        d_printf("workgroup_announce_time:        %u\n", profile_p->workgroup_announce_time);
-        d_printf("local_master_announce_count:    %u\n", profile_p->local_master_announce_count);
-        d_printf("local_master_announce_time:     %u\n", profile_p->local_master_announce_time);
-        d_printf("master_browser_announce_count:  %u\n", profile_p->master_browser_announce_count);
-        d_printf("master_browser_announce_time:   %u\n", profile_p->master_browser_announce_time);
-        d_printf("lm_host_announce_count:         %u\n", profile_p->lm_host_announce_count);
-        d_printf("lm_host_announce_time:          %u\n", profile_p->lm_host_announce_time);
-        d_printf("get_backup_list_count:          %u\n", profile_p->get_backup_list_count);
-        d_printf("get_backup_list_time:           %u\n", profile_p->get_backup_list_time);
-        d_printf("reset_browser_count:            %u\n", profile_p->reset_browser_count);
-        d_printf("reset_browser_time:             %u\n", profile_p->reset_browser_time);
-        d_printf("announce_request_count:         %u\n", profile_p->announce_request_count);
-        d_printf("announce_request_time:          %u\n", profile_p->announce_request_time);
-        d_printf("lm_announce_request_count:      %u\n", profile_p->lm_announce_request_count);
-        d_printf("lm_announce_request_time:       %u\n", profile_p->lm_announce_request_time);
-        d_printf("domain_logon_count:             %u\n", profile_p->domain_logon_count);
-        d_printf("domain_logon_time:              %u\n", profile_p->domain_logon_time);
-        d_printf("sync_browse_lists_count:        %u\n", profile_p->sync_browse_lists_count);
-        d_printf("sync_browse_lists_time:         %u\n", profile_p->sync_browse_lists_time);
-        d_printf("run_elections_count:            %u\n", profile_p->run_elections_count);
-        d_printf("run_elections_time:             %u\n", profile_p->run_elections_time);
-        d_printf("election_count:                 %u\n", profile_p->election_count);
-        d_printf("election_time:                  %u\n", profile_p->election_time);
-        profile_separator("SMB2 Calls");
-        d_printf("smb2_negprot_count:             %u\n", profile_p->smb2_negprot_count);
-        d_printf("smb2_negprot_time:              %u\n", profile_p->smb2_negprot_time);
-        d_printf("smb2_sesssetup_count:           %u\n", profile_p->smb2_sesssetup_count);
-        d_printf("smb2_sesssetup_time:            %u\n", profile_p->smb2_sesssetup_time);
-        d_printf("smb2_logoff_count:              %u\n", profile_p->smb2_logoff_count);
-        d_printf("smb2_logoff_time:               %u\n", profile_p->smb2_logoff_time);
-        d_printf("smb2_tcon_count:                %u\n", profile_p->smb2_tcon_count);
-        d_printf("smb2_tcon_time:                 %u\n", profile_p->smb2_tcon_time);
-        d_printf("smb2_tdis_count:                %u\n", profile_p->smb2_tdis_count);
-        d_printf("smb2_tdis_time:                 %u\n", profile_p->smb2_tdis_time);
-        d_printf("smb2_create_count:              %u\n", profile_p->smb2_create_count);
-        d_printf("smb2_create_time:               %u\n", profile_p->smb2_create_time);
-        d_printf("smb2_close_count:               %u\n", profile_p->smb2_close_count);
-        d_printf("smb2_close_time:                %u\n", profile_p->smb2_close_time);
-        d_printf("smb2_flush_count:               %u\n", profile_p->smb2_flush_count);
-        d_printf("smb2_flush_time:                %u\n", profile_p->smb2_flush_time);
-        d_printf("smb2_read_count:                %u\n", profile_p->smb2_read_count);
-        d_printf("smb2_read_time:                 %u\n", profile_p->smb2_read_time);
-        d_printf("smb2_write_count:               %u\n", profile_p->smb2_write_count);
-        d_printf("smb2_write_time:                %u\n", profile_p->smb2_write_time);
-        d_printf("smb2_lock_count:                %u\n", profile_p->smb2_lock_count);
-        d_printf("smb2_lock_time:                 %u\n", profile_p->smb2_lock_time);
-        d_printf("smb2_ioctl_count:               %u\n", profile_p->smb2_ioctl_count);
-        d_printf("smb2_ioctl_time:                %u\n", profile_p->smb2_ioctl_time);
-        d_printf("smb2_cancel_count:              %u\n", profile_p->smb2_cancel_count);
-        d_printf("smb2_cancel_time:               %u\n", profile_p->smb2_cancel_time);
-        d_printf("smb2_keepalive_count:           %u\n", profile_p->smb2_keepalive_count);
-        d_printf("smb2_keepalive_time:            %u\n", profile_p->smb2_keepalive_time);
-        d_printf("smb2_find_count:                %u\n", profile_p->smb2_find_count);
-        d_printf("smb2_find_time:                 %u\n", profile_p->smb2_find_time);
-        d_printf("smb2_notify_count:              %u\n", profile_p->smb2_notify_count);
-        d_printf("smb2_notify_time:               %u\n", profile_p->smb2_notify_time);
-        d_printf("smb2_getinfo_count:             %u\n", profile_p->smb2_getinfo_count);
-        d_printf("smb2_getinfo_time:              %u\n", profile_p->smb2_getinfo_time);
-        d_printf("smb2_setinfo_count:             %u\n", profile_p->smb2_setinfo_count);
-        d_printf("smb2_setinfo_time:              %u\n", profile_p->smb2_setinfo_time);
-        d_printf("smb2_break_count:               %u\n", profile_p->smb2_break_count);
-        d_printf("smb2_break_time:                %u\n", profile_p->smb2_break_time);
-
-#else /* WITH_PROFILE */
-
-        fprintf(stderr, "Profile data unavailable\n");
-#endif /* WITH_PROFILE */
+        smbprofile_collect(&stats);
+
+#define __PRINT_FIELD_LINE(name, _stats, field) do { \
+        d_printf("%-59s%20ju\n", \
+                 name "_" #field ":", \
+                 (uintmax_t)stats.values._stats.field); \
+} while(0);
+#define SMBPROFILE_STATS_START
+#define SMBPROFILE_STATS_SECTION_START(name, display) profile_separator(#display);
+#define SMBPROFILE_STATS_COUNT(name) do { \
+        __PRINT_FIELD_LINE(#name, name##_stats,  count); \
+} while(0);
+#define SMBPROFILE_STATS_TIME(name) do { \
+        __PRINT_FIELD_LINE(#name, name##_stats,  time); \
+} while(0);
+#define SMBPROFILE_STATS_BASIC(name) do { \
+        __PRINT_FIELD_LINE(#name, name##_stats,  count); \
+        __PRINT_FIELD_LINE(#name, name##_stats,  time); \
+} while(0);
+#define SMBPROFILE_STATS_BYTES(name) do { \
+        __PRINT_FIELD_LINE(#name, name##_stats,  count); \
+        __PRINT_FIELD_LINE(#name, name##_stats,  time); \
+        __PRINT_FIELD_LINE(#name, name##_stats,  idle); \
+        __PRINT_FIELD_LINE(#name, name##_stats,  bytes); \
+} while(0);
+#define SMBPROFILE_STATS_IOBYTES(name) do { \
+        __PRINT_FIELD_LINE(#name, name##_stats,  count); \
+        __PRINT_FIELD_LINE(#name, name##_stats,  time); \
+        __PRINT_FIELD_LINE(#name, name##_stats,  idle); \
+        __PRINT_FIELD_LINE(#name, name##_stats,  inbytes); \
+        __PRINT_FIELD_LINE(#name, name##_stats,  outbytes); \
+} while(0);
+#define SMBPROFILE_STATS_SECTION_END
+#define SMBPROFILE_STATS_END
+        SMBPROFILE_STATS_ALL_SECTIONS
+#undef __PRINT_FIELD_LINE
+#undef SMBPROFILE_STATS_START
+#undef SMBPROFILE_STATS_SECTION_START
+#undef SMBPROFILE_STATS_COUNT
+#undef SMBPROFILE_STATS_TIME
+#undef SMBPROFILE_STATS_BASIC
+#undef SMBPROFILE_STATS_BYTES
+#undef SMBPROFILE_STATS_IOBYTES
+#undef SMBPROFILE_STATS_SECTION_END
+#undef SMBPROFILE_STATS_END
 
         return True;
 }
-
-#ifdef WITH_PROFILE
 
 /* Convert microseconds to milliseconds. */
@@ -463 +110 @@
 #define percent_time(used, period) ((double)(used) / (double)(period) * 100.0 )
 
-static int print_count_samples(
+static uint64_t print_count_count_samples(
+        char *buf, const size_t buflen,
+        const char *name,
+        const struct smbprofile_stats_count * const current,
+        const struct smbprofile_stats_count * const last,
+        uint64_t delta_usec)
+{
+        uint64_t step = current->count - last->count;
+        uint64_t count = 0;
+
+        if (step != 0) {
+                uint64_t delta_sec = usec_to_sec(delta_usec);
+
+                count++;
+
+                if (buf[0] == '\0') {
+                        snprintf(buf, buflen,
+                                "%s %ju/sec",
+                                name, (uintmax_t)(step / delta_sec));
+                } else {
+                        printf("%-40s %s %ju/sec\n",
+                                buf, name, (uintmax_t)(step / delta_sec));
+                        buf[0] = '\0';
+                }
+        }
+
+        return count;
+}
+
+static uint64_t print_basic_count_samples(
+        char *buf, const size_t buflen,
+        const char *name,
+        const struct smbprofile_stats_basic * const current,
+        const struct smbprofile_stats_basic * const last,
+        uint64_t delta_usec)
+{
+        uint64_t step = current->count - last->count;
+        uint64_t spent = current->time - last->time;
+        uint64_t count = 0;
+
+        if (step != 0) {
+                uint64_t delta_sec = usec_to_sec(delta_usec);
+
+                count++;
+
+                if (buf[0] == '\0') {
+                        snprintf(buf, buflen,
+                                "%s %ju/sec (%.2f%%)",
+                                name, (uintmax_t)(step / delta_sec),
+                                percent_time(spent, delta_usec));
+                } else {
+                        printf("%-40s %s %ju/sec (%.2f%%)\n",
+                                buf, name, (uintmax_t)(step / delta_sec),
+                                percent_time(spent, delta_usec));
+                        buf[0] = '\0';
+                }
+        }
+
+        return count;
+}
+
+static uint64_t print_bytes_count_samples(
+        char *buf, const size_t buflen,
+        const char *name,
+        const struct smbprofile_stats_bytes * const current,
+        const struct smbprofile_stats_bytes * const last,
+        uint64_t delta_usec)
+{
+        uint64_t step = current->count - last->count;
+        uint64_t spent = current->time - last->time;
+        uint64_t count = 0;
+
+        if (step != 0) {
+                uint64_t delta_sec = usec_to_sec(delta_usec);
+
+                count++;
+
+                if (buf[0] == '\0') {
+                        snprintf(buf, buflen,
+                                "%s %ju/sec (%.2f%%)",
+                                name, (uintmax_t)(step / delta_sec),
+                                percent_time(spent, delta_usec));
+                } else {
+                        printf("%-40s %s %ju/sec (%.2f%%)\n",
+                                buf, name, (uintmax_t)(step / delta_sec),
+                                percent_time(spent, delta_usec));
+                        buf[0] = '\0';
+                }
+        }
+
+        return count;
+}
+
+static uint64_t print_iobytes_count_samples(
+        char *buf, const size_t buflen,
+        const char *name,
+        const struct smbprofile_stats_iobytes * const current,
+        const struct smbprofile_stats_iobytes * const last,
+        uint64_t delta_usec)
+{
+        uint64_t step = current->count - last->count;
+        uint64_t spent = current->time - last->time;
+        uint64_t count = 0;
+
+        if (step != 0) {
+                uint64_t delta_sec = usec_to_sec(delta_usec);
+
+                count++;
+
+                if (buf[0] == '\0') {
+                        snprintf(buf, buflen,
+                                "%s %ju/sec (%.2f%%)",
+                                name, (uintmax_t)(step / delta_sec),
+                                percent_time(spent, delta_usec));
+                } else {
+                        printf("%-40s %s %ju/sec (%.2f%%)\n",
+                                buf, name, (uintmax_t)(step / delta_sec),
+                                percent_time(spent, delta_usec));
+                        buf[0] = '\0';
+                }
+        }
+
+        return count;
+}
+
+static uint64_t print_count_samples(
         const struct profile_stats * const current,
         const struct profile_stats * const last,
         uint64_t delta_usec)
 {
-        int i;
-        int count = 0;
-        unsigned step;
-        uint64_t spent;
-        int delta_sec;
-        const char * name;
-        char buf[40];
+        uint64_t count = 0;
+        char buf[40] = { '\0', };
 
         if (delta_usec == 0) {
@@ -480 +247 @@
         }
 
-        buf[0] = '\0';
-        delta_sec = usec_to_sec(delta_usec);
-
-        for (i = 0; i < PR_VALUE_MAX; ++i) {
-                step = current->count[i] - last->count[i];
-                spent = current->time[i] - last->time[i];
-
-                if (step) {
-                        ++count;
-
-                        name = profile_value_name(i);
-
-                        if (buf[0] == '\0') {
-                                snprintf(buf, sizeof(buf),
-                                        "%s %d/sec (%.2f%%)",
-                                        name, step / delta_sec,
-                                        percent_time(spent, delta_usec));
-                        } else {
-                                printf("%-40s %s %d/sec (%.2f%%)\n",
-                                        buf, name, step / delta_sec,
-                                        percent_time(spent, delta_usec));
-                                buf[0] = '\0';
-                        }
-                }
+#define SMBPROFILE_STATS_START
+#define SMBPROFILE_STATS_SECTION_START(name, display)
+#define SMBPROFILE_STATS_COUNT(name) do { \
+        count += print_count_count_samples(buf, sizeof(buf), \
+                                           #name, \
+                                           &current->values.name##_stats, \
+                                           &last->values.name##_stats, \
+                                           delta_usec); \
+} while(0);
+#define SMBPROFILE_STATS_TIME(name) do { \
+} while(0);
+#define SMBPROFILE_STATS_BASIC(name) do { \
+        count += print_basic_count_samples(buf, sizeof(buf), \
+                                           #name, \
+                                           &current->values.name##_stats, \
+                                           &last->values.name##_stats, \
+                                           delta_usec); \
+} while(0);
+#define SMBPROFILE_STATS_BYTES(name) do { \
+        count += print_bytes_count_samples(buf, sizeof(buf), \
+                                           #name, \
+                                           &current->values.name##_stats, \
+                                           &last->values.name##_stats, \
+                                           delta_usec); \
+} while(0);
+#define SMBPROFILE_STATS_IOBYTES(name) do { \
+        count += print_iobytes_count_samples(buf, sizeof(buf), \
+                                             #name, \
+                                             &current->values.name##_stats, \
+                                             &last->values.name##_stats, \
+                                             delta_usec); \
+} while(0);
+#define SMBPROFILE_STATS_SECTION_END
+#define SMBPROFILE_STATS_END
+        SMBPROFILE_STATS_ALL_SECTIONS
+#undef SMBPROFILE_STATS_START
+#undef SMBPROFILE_STATS_SECTION_START
+#undef SMBPROFILE_STATS_COUNT
+#undef SMBPROFILE_STATS_TIME
+#undef SMBPROFILE_STATS_BASIC
+#undef SMBPROFILE_STATS_BYTES
+#undef SMBPROFILE_STATS_IOBYTES
+#undef SMBPROFILE_STATS_SECTION_END
+#undef SMBPROFILE_STATS_END
+
+        if (buf[0] != '\0') {
+                printf("%-40s\n", buf);
+                buf[0] = '\0';
         }
 
@@ -532 +323 @@
         }
 
-        memcpy(&sample_data[last], profile_p, sizeof(*profile_p));
+        smbprofile_collect(&sample_data[last]);
         for (;;) {
                 sample_time[current] = profile_timestamp();
@@ -538 +329 @@
 
                 /* Take a sample. */
-                memcpy(&sample_data[current], profile_p, sizeof(*profile_p));
+                smbprofile_collect(&sample_data[current]);
 
                 /* Rate convert some values and print results. */
@@ -564 +355 @@
                         }
 
-                        sys_usleep(remain_usec);
+                        usleep(remain_usec);
                 }
 
@@ -571 +362 @@
         return True;
 }
-
-#else /* WITH_PROFILE */
-
-bool status_profile_rates(bool verbose)
-{
-        fprintf(stderr, "Profile data unavailable\n");
-        return False;
-}
-
-#endif /* WITH_PROFILE */
-

vendor/current/source3/utils/testparm.c

@@ -35 +35 @@
 #include "system/filesys.h"
 #include "popt_common.h"
+#include "lib/param/loadparm.h"
 
 /*******************************************************************
@@ -40 +41 @@
 ********************************************************************/
 
-static bool directory_exist_stat(char *dname,SMB_STRUCT_STAT *st)
+static bool directory_exist_stat(const char *dname,SMB_STRUCT_STAT *st)
 {
         SMB_STRUCT_STAT st2;
@@ -66 +67 @@
         int ret = 0;
         SMB_STRUCT_STAT st;
-
-        if (lp_security() >= SEC_DOMAIN && !lp_encrypted_passwords()) {
-                fprintf(stderr, "ERROR: in 'security=domain' mode the 'encrypt passwords' parameter must always be set to 'true'.\n");
-                ret = 1;
-        }
-
-        if (lp_wins_support() && lp_wins_server_list()) {
-                fprintf(stderr, "ERROR: both 'wins support = true' and 'wins server = <server list>' \
-cannot be set in the smb.conf file. nmbd will abort with this setting.\n");
-                ret = 1;
-        }
-
-        if (strequal(lp_workgroup(), global_myname())) {
-                fprintf(stderr, "WARNING: 'workgroup' and 'netbios name' " \
-                        "must differ.\n");
-                ret = 1;
-        }
-
-        if (!directory_exist_stat(lp_lockdir(), &st)) {
-                fprintf(stderr, "ERROR: lock directory %s does not exist\n",
-                       lp_lockdir());
+        const char *socket_options;
+
+        if (lp_security() >= SEC_DOMAIN && !lp_encrypt_passwords()) {
+                fprintf(stderr, "ERROR: in 'security=domain' mode the "
+                                "'encrypt passwords' parameter must always be "
+                                "set to 'true'.\n\n");
+                ret = 1;
+        }
+
+        if (lp_we_are_a_wins_server() && lp_wins_server_list()) {
+                fprintf(stderr, "ERROR: both 'wins support = true' and "
+                                "'wins server = <server list>' cannot be set in "
+                                "the smb.conf file. nmbd will abort with this "
+                                "setting.\n\n");
+                ret = 1;
+        }
+
+        if (strequal(lp_workgroup(), lp_netbios_name())) {
+                fprintf(stderr, "WARNING: 'workgroup' and 'netbios name' "
+                                "must differ.\n\n");
+        }
+
+        if (strlen(lp_netbios_name()) > 15) {
+                fprintf(stderr, "WARNING: The 'netbios name' is too long "
+                                "(max. 15 chars).\n\n");
+        }
+
+        if (!directory_exist_stat(lp_lock_directory(), &st)) {
+                fprintf(stderr, "ERROR: lock directory %s does not exist\n\n",
+                       lp_lock_directory());
                 ret = 1;
         } else if ((st.st_ex_mode & 0777) != 0755) {
-                fprintf(stderr, "WARNING: lock directory %s should have permissions 0755 for browsing to work\n",
-                       lp_lockdir());
-                ret = 1;
-        }
-
-        if (!directory_exist_stat(lp_statedir(), &st)) {
-                fprintf(stderr, "ERROR: state directory %s does not exist\n",
-                       lp_statedir());
+                fprintf(stderr, "WARNING: lock directory %s should have "
+                                "permissions 0755 for browsing to work\n\n",
+                       lp_lock_directory());
+        }
+
+        if (!directory_exist_stat(lp_state_directory(), &st)) {
+                fprintf(stderr, "ERROR: state directory %s does not exist\n\n",
+                       lp_state_directory());
                 ret = 1;
         } else if ((st.st_ex_mode & 0777) != 0755) {
-                fprintf(stderr, "WARNING: state directory %s should have permissions 0755 for browsing to work\n",
-                       lp_statedir());
-                ret = 1;
-        }
-
-        if (!directory_exist_stat(lp_cachedir(), &st)) {
-                fprintf(stderr, "ERROR: cache directory %s does not exist\n",
-                       lp_cachedir());
+                fprintf(stderr, "WARNING: state directory %s should have "
+                                "permissions 0755 for browsing to work\n\n",
+                       lp_state_directory());
+        }
+
+        if (!directory_exist_stat(lp_cache_directory(), &st)) {
+                fprintf(stderr, "ERROR: cache directory %s does not exist\n\n",
+                       lp_cache_directory());
                 ret = 1;
         } else if ((st.st_ex_mode & 0777) != 0755) {
-                fprintf(stderr, "WARNING: cache directory %s should have permissions 0755 for browsing to work\n",
-                       lp_cachedir());
-                ret = 1;
-        }
-
-        if (!directory_exist_stat(lp_piddir(), &st)) {
-                fprintf(stderr, "ERROR: pid directory %s does not exist\n",
-                       lp_piddir());
+                fprintf(stderr, "WARNING: cache directory %s should have "
+                                "permissions 0755 for browsing to work\n\n",
+                       lp_cache_directory());
+        }
+
+        if (!directory_exist_stat(lp_pid_directory(), &st)) {
+                fprintf(stderr, "ERROR: pid directory %s does not exist\n\n",
+                       lp_pid_directory());
                 ret = 1;
         }
@@ -122 +132 @@
         if (lp_passdb_expand_explicit()) {
                 fprintf(stderr, "WARNING: passdb expand explicit = yes is "
-                        "deprecated\n");
+                                "deprecated\n\n");
+        }
+
+        /*
+         * Socket options.
+         */
+        socket_options = lp_socket_options();
+        if (socket_options != NULL &&
+            (strstr(socket_options, "SO_SNDBUF") ||
+             strstr(socket_options, "SO_RCVBUF") ||
+             strstr(socket_options, "SO_SNDLOWAT") ||
+             strstr(socket_options, "SO_RCVLOWAT")))
+        {
+                fprintf(stderr,
+                        "WARNING: socket options = %s\n"
+                        "This warning is printed because you set one of the\n"
+                        "following options: SO_SNDBUF, SO_RCVBUF, SO_SNDLOWAT,\n"
+                        "SO_RCVLOWAT\n"
+                        "Modern server operating systems are tuned for\n"
+                        "high network performance in the majority of situations;\n"
+                        "when you set 'socket options' you are overriding those\n"
+                        "settings.\n"
+                        "Linux in particular has an auto-tuning mechanism for\n"
+                        "buffer sizes (SO_SNDBUF, SO_RCVBUF) that will be\n"
+                        "disabled if you specify a socket buffer size. This can\n"
+                        "potentially cripple your TCP/IP stack.\n\n"
+                        "Getting the 'socket options' correct can make a big\n"
+                        "difference to your performance, but getting them wrong\n"
+                        "can degrade it by just as much. As with any other low\n"
+                        "level setting, if you must make changes to it, make\n "
+                        "small changes and test the effect before making any\n"
+                        "large changes.\n\n",
+                        socket_options);
         }
 
@@ -129 +171 @@
          */
 
-        if((lp_security() == SEC_SERVER || lp_security() >= SEC_DOMAIN) && !*lp_passwordserver()) {
-                const char *sec_setting;
-                if(lp_security() == SEC_SERVER)
-                        sec_setting = "server";
-                else if(lp_security() == SEC_DOMAIN)
-                        sec_setting = "domain";
-                else if(lp_security() == SEC_ADS)
-                        sec_setting = "ads";
-                else
-                        sec_setting = "";
-
-                fprintf(stderr, "ERROR: The setting 'security=%s' requires the 'password server' parameter be set\n"
-                        "to the default value * or a valid password server.\n", sec_setting );
-                ret = 1;
-        }
-
-        if((lp_security() >= SEC_DOMAIN) && (strcmp(lp_passwordserver(), "*") != 0)) {
+        if((lp_security() >= SEC_DOMAIN) && !*lp_password_server()) {
                 const char *sec_setting;
                 if(lp_security() == SEC_DOMAIN)
@@ -154 +180 @@
                         sec_setting = "";
 
-                fprintf(stderr, "WARNING: The setting 'security=%s' should NOT be combined with the 'password server' parameter.\n"
-                        "(by default Samba will discover the correct DC to contact automatically).\n", sec_setting );
+                fprintf(stderr, "ERROR: The setting 'security=%s' requires the "
+                                "'password server' parameter be set to the "
+                                "default value * or a valid password server.\n\n",
+                                sec_setting );
+                ret = 1;
+        }
+
+        if((lp_security() >= SEC_DOMAIN) && (strcmp(lp_password_server(), "*") != 0)) {
+                const char *sec_setting;
+                if(lp_security() == SEC_DOMAIN)
+                        sec_setting = "domain";
+                else if(lp_security() == SEC_ADS)
+                        sec_setting = "ads";
+                else
+                        sec_setting = "";
+
+                fprintf(stderr, "WARNING: The setting 'security=%s' should NOT "
+                                "be combined with the 'password server' "
+                                "parameter.\n"
+                                "(by default Samba will discover the correct DC "
+                                "to contact automatically).\n\n",
+                                sec_setting );
         }
 
@@ -172 +218 @@
 #endif
 
-                        if((lp_passwd_program() == NULL) ||
-                           (strlen(lp_passwd_program()) == 0))
+                        if((lp_passwd_program(talloc_tos()) == NULL) ||
+                           (strlen(lp_passwd_program(talloc_tos())) == 0))
                         {
-                                fprintf( stderr, "ERROR: the 'unix password sync' parameter is set and there is no valid 'passwd program' \
-parameter.\n" );
+                                fprintf(stderr,
+                                        "ERROR: the 'unix password sync' "
+                                        "parameter is set and there is no valid "
+                                        "'passwd program' parameter.\n\n");
                                 ret = 1;
                         } else {
@@ -183 +231 @@
                                 const char *p;
 
-                                passwd_prog = lp_passwd_program();
+                                passwd_prog = lp_passwd_program(talloc_tos());
                                 p = passwd_prog;
                                 next_token_talloc(talloc_tos(),
@@ -189 +237 @@
                                                 &truncated_prog, NULL);
                                 if (truncated_prog && access(truncated_prog, F_OK) == -1) {
-                                        fprintf(stderr, "ERROR: the 'unix password sync' parameter is set and the 'passwd program' (%s) \
-cannot be executed (error was %s).\n", truncated_prog, strerror(errno) );
+                                        fprintf(stderr,
+                                                "ERROR: the 'unix password sync' "
+                                                "parameter is set and the "
+                                                "'passwd program' (%s) cannot be "
+                                                "executed (error was %s).\n\n",
+                                                truncated_prog,
+                                                strerror(errno));
                                         ret = 1;
                                 }
@@ -199 +252 @@
 #endif
 
-                if(lp_passwd_chat() == NULL) {
-                        fprintf(stderr, "ERROR: the 'unix password sync' parameter is set and there is no valid 'passwd chat' \
-parameter.\n");
+                if(lp_passwd_chat(talloc_tos()) == NULL) {
+                        fprintf(stderr,
+                                "ERROR: the 'unix password sync' parameter is "
+                                "set and there is no valid 'passwd chat' "
+                                "parameter.\n\n");
                         ret = 1;
                 }
 
-                if ((lp_passwd_program() != NULL) &&
-                    (strlen(lp_passwd_program()) > 0))
+                if ((lp_passwd_program(talloc_tos()) != NULL) &&
+                    (strlen(lp_passwd_program(talloc_tos())) > 0))
                 {
                         /* check if there's a %u parameter present */
-                        if(strstr_m(lp_passwd_program(), "%u") == NULL) {
-                                fprintf(stderr, "ERROR: the 'passwd program' (%s) requires a '%%u' parameter.\n", lp_passwd_program());
+                        if(strstr_m(lp_passwd_program(talloc_tos()), "%u") == NULL) {
+                                fprintf(stderr,
+                                        "ERROR: the 'passwd program' (%s) "
+                                        "requires a '%%u' parameter.\n\n",
+                                        lp_passwd_program(talloc_tos()));
                                 ret = 1;
                         }
@@ -220 +278 @@
                  */
 
-                if(lp_encrypted_passwords()) {
-                        if(strstr_m( lp_passwd_chat(), "%o")!=NULL) {
-                                fprintf(stderr, "ERROR: the 'passwd chat' script [%s] expects to use the old plaintext password \
-via the %%o substitution. With encrypted passwords this is not possible.\n", lp_passwd_chat() );
+                if(lp_encrypt_passwords()) {
+                        if(strstr_m( lp_passwd_chat(talloc_tos()), "%o")!=NULL) {
+                                fprintf(stderr,
+                                        "ERROR: the 'passwd chat' script [%s] "
+                                        "expects to use the old plaintext "
+                                        "password via the %%o substitution. With "
+                                        "encrypted passwords this is not "
+                                        "possible.\n\n",
+                                        lp_passwd_chat(talloc_tos()) );
                                 ret = 1;
                         }
@@ -230 +293 @@
 
         if (strlen(lp_winbind_separator()) != 1) {
-                fprintf(stderr,"ERROR: the 'winbind separator' parameter must be a single character.\n");
+                fprintf(stderr, "ERROR: the 'winbind separator' parameter must "
+                                "be a single character.\n\n");
                 ret = 1;
         }
 
         if (*lp_winbind_separator() == '+') {
-                fprintf(stderr,"'winbind separator = +' might cause problems with group membership.\n");
+                fprintf(stderr, "'winbind separator = +' might cause problems "
+                                "with group membership.\n\n");
         }
 
@@ -241 +306 @@
                 /* Try to prevent admin foot-shooting, we can't put algorithmic
                    rids below 1000, that's the 'well known RIDs' on NT */
-                fprintf(stderr,"'algorithmic rid base' must be equal to or above %lu\n", BASE_RID);
+                fprintf(stderr, "'algorithmic rid base' must be equal to or "
+                                "above %lu\n\n", BASE_RID);
         }
 
         if (lp_algorithmic_rid_base() & 1) {
-                fprintf(stderr,"'algorithmic rid base' must be even.\n");
+                fprintf(stderr, "'algorithmic rid base' must be even.\n\n");
         }
 
 #ifndef HAVE_DLOPEN
         if (lp_preload_modules()) {
-                fprintf(stderr,"WARNING: 'preload modules = ' set while loading plugins not supported.\n");
+                fprintf(stderr, "WARNING: 'preload modules = ' set while loading "
+                                "plugins not supported.\n\n");
         }
 #endif
 
         if (!lp_passdb_backend()) {
-                fprintf(stderr,"ERROR: passdb backend must have a value or be left out\n");
+                fprintf(stderr, "ERROR: passdb backend must have a value or be "
+                                "left out\n\n");
         }
         
         if (lp_os_level() > 255) {
-                fprintf(stderr,"WARNING: Maximum value for 'os level' is 255!\n");      
+                fprintf(stderr, "WARNING: Maximum value for 'os level' is "
+                                "255!\n\n");
+        }
+
+        if (strequal(lp_dos_charset(), "UTF8") || strequal(lp_dos_charset(), "UTF-8")) {
+                fprintf(stderr, "ERROR: 'dos charset' must not be UTF8\n\n");
+                ret = 1;
         }
 
@@ -270 +344 @@
 static void do_per_share_checks(int s)
 {
-        const char **deny_list = lp_hostsdeny(s);
-        const char **allow_list = lp_hostsallow(s);
+        const char **deny_list = lp_hosts_deny(s);
+        const char **allow_list = lp_hosts_allow(s);
         int i;
 
@@ -279 +353 @@
                         char *hasquery = strchr_m(deny_list[i], '?');
                         if(hasstar || hasquery) {
-                                fprintf(stderr,"Invalid character %c in hosts deny list (%s) for service %s.\n",
-                                           hasstar ? *hasstar : *hasquery, deny_list[i], lp_servicename(s) );
+                                fprintf(stderr,
+                                        "Invalid character %c in hosts deny list "
+                                        "(%s) for service %s.\n\n",
+                                        hasstar ? *hasstar : *hasquery,
+                                        deny_list[i],
+                                        lp_servicename(talloc_tos(), s));
                         }
                 }
@@ -290 +368 @@
                         char *hasquery = strchr_m(allow_list[i], '?');
                         if(hasstar || hasquery) {
-                                fprintf(stderr,"Invalid character %c in hosts allow list (%s) for service %s.\n",
-                                           hasstar ? *hasstar : *hasquery, allow_list[i], lp_servicename(s) );
+                                fprintf(stderr,
+                                        "Invalid character %c in hosts allow "
+                                        "list (%s) for service %s.\n\n",
+                                        hasstar ? *hasstar : *hasquery,
+                                        allow_list[i],
+                                        lp_servicename(talloc_tos(), s));
                         }
                 }
@@ -297 +379 @@
 
         if(lp_level2_oplocks(s) && !lp_oplocks(s)) {
-                fprintf(stderr,"Invalid combination of parameters for service %s. \
-                           Level II oplocks can only be set if oplocks are also set.\n",
-                           lp_servicename(s) );
-        }
-
-        if (lp_map_hidden(s) && !(lp_create_mask(s) & S_IXOTH)) {
-                fprintf(stderr,"Invalid combination of parameters for service %s. \
-                           Map hidden can only work if create mask includes octal 01 (S_IXOTH).\n",
-                           lp_servicename(s) );
-        }
-        if (lp_map_hidden(s) && (lp_force_create_mode(s) & S_IXOTH)) {
-                fprintf(stderr,"Invalid combination of parameters for service %s. \
-                           Map hidden can only work if force create mode excludes octal 01 (S_IXOTH).\n",
-                           lp_servicename(s) );
-        }
-        if (lp_map_system(s) && !(lp_create_mask(s) & S_IXGRP)) {
-                fprintf(stderr,"Invalid combination of parameters for service %s. \
-                           Map system can only work if create mask includes octal 010 (S_IXGRP).\n",
-                           lp_servicename(s) );
-        }
-        if (lp_map_system(s) && (lp_force_create_mode(s) & S_IXGRP)) {
-                fprintf(stderr,"Invalid combination of parameters for service %s. \
-                           Map system can only work if force create mode excludes octal 010 (S_IXGRP).\n",
-                           lp_servicename(s) );
-        }
-#ifdef HAVE_CUPS
-        if (lp_printing(s) == PRINT_CUPS && *(lp_printcommand(s)) != '\0') {
-                 fprintf(stderr,"Warning: Service %s defines a print command, but \
-rameter is ignored when using CUPS libraries.\n",
-                           lp_servicename(s) );
-        }
-#endif
+                fprintf(stderr, "Invalid combination of parameters for service "
+                                "%s. Level II oplocks can only be set if oplocks "
+                                "are also set.\n\n",
+                                lp_servicename(talloc_tos(), s));
+        }
+
+        if (!lp_store_dos_attributes(s) && lp_map_hidden(s)
+            && !(lp_create_mask(s) & S_IXOTH))
+        {
+                fprintf(stderr,
+                        "Invalid combination of parameters for service %s. Map "
+                        "hidden can only work if create mask includes octal "
+                        "01 (S_IXOTH).\n\n",
+                        lp_servicename(talloc_tos(), s));
+        }
+        if (!lp_store_dos_attributes(s) && lp_map_hidden(s)
+            && (lp_force_create_mode(s) & S_IXOTH))
+        {
+                fprintf(stderr,
+                        "Invalid combination of parameters for service "
+                        "%s. Map hidden can only work if force create mode "
+                        "excludes octal 01 (S_IXOTH).\n\n",
+                        lp_servicename(talloc_tos(), s));
+        }
+        if (!lp_store_dos_attributes(s) && lp_map_system(s)
+            && !(lp_create_mask(s) & S_IXGRP))
+        {
+                fprintf(stderr,
+                        "Invalid combination of parameters for service "
+                        "%s. Map system can only work if create mask includes "
+                        "octal 010 (S_IXGRP).\n\n",
+                        lp_servicename(talloc_tos(), s));
+        }
+        if (!lp_store_dos_attributes(s) && lp_map_system(s)
+            && (lp_force_create_mode(s) & S_IXGRP))
+        {
+                fprintf(stderr,
+                        "Invalid combination of parameters for service "
+                        "%s. Map system can only work if force create mode "
+                        "excludes octal 010 (S_IXGRP).\n\n",
+                        lp_servicename(talloc_tos(), s));
+        }
+        if (lp_printing(s) == PRINT_CUPS && *(lp_print_command(talloc_tos(), s)) != '\0') {
+                fprintf(stderr,
+                        "Warning: Service %s defines a print command, but "
+                        "parameter is ignored when using CUPS libraries.\n\n",
+                        lp_servicename(talloc_tos(), s));
+        }
 }
 
@@ -362 +460 @@
         TALLOC_CTX *frame = talloc_stackframe();
 
-        load_case_tables();
+        smb_init_locale();
         /*
          * Set the default debug level to 2.
@@ -399 +497 @@
         fprintf(stderr,"Load smb config files from %s\n",config_file);
 
-        if (!lp_load_with_registry_shares(config_file,False,True,False,True)) {
+        if (!lp_load_with_registry_shares(config_file)) {
                 fprintf(stderr,"Error loading services.\n");
                 ret = 1;
@@ -413 +511 @@
         for (s=0;s<1000;s++) {
                 if (VALID_SNUM(s))
-                        if (strlen(lp_servicename(s)) > 12) {
+                        if (strlen(lp_servicename(talloc_tos(), s)) > 12) {
                                 fprintf(stderr, "WARNING: You have some share names that are longer than 12 characters.\n" );
                                 fprintf(stderr, "These may not be accessible to some older clients.\n" );
@@ -429 +527 @@
 
         if (!section_name && !parameter_name) {
-                fprintf(stderr,"Server role: %s\n", server_role_str(lp_server_role()));
+                fprintf(stderr,
+                        "Server role: %s\n\n",
+                        server_role_str(lp_server_role()));
         }
 
@@ -475 +575 @@
                 for (s=0;s<1000;s++) {
                         if (VALID_SNUM(s)) {
-                                if (allow_access(lp_hostsdeny(-1), lp_hostsallow(-1), cname, caddr)
-                                    && allow_access(lp_hostsdeny(s), lp_hostsallow(s), cname, caddr)) {
+                                if (allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1), cname, caddr)
+                                    && allow_access(lp_hosts_deny(s), lp_hosts_allow(s), cname, caddr)) {
                                         fprintf(stderr,"Allow connection from %s (%s) to %s\n",
-                                                   cname,caddr,lp_servicename(s));
+                                                   cname,caddr,lp_servicename(talloc_tos(), s));
                                 } else {
                                         fprintf(stderr,"Deny connection from %s (%s) to %s\n",
-                                                   cname,caddr,lp_servicename(s));
+                                                   cname,caddr,lp_servicename(talloc_tos(), s));
                                 }
                         }