Merge ~ahasenack/ubuntu/+source/samba:cosmic-samba-nochange-rebuild into ubuntu/+source/samba:ubuntu/devel

[Andreas Hasenack]

Please use git to review this MP, as launchpad's diff is incorrect.

This is a no-change rebuild to link with the new libldb that is in cosmic-proposed (1.3.3), blocked because it requires a samba rebuild due to dsdb-modules:

ldb (2:1.2.3-1 to 2:1.3.3-1)
Maintainer: Debian Samba Maintainers
47 days old
autopkgtest for samba/2:4.7.6+dfsg~ubuntu-0ubuntu2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, s390x: Pass
Valid candidate

trying: ldb
skipped: ldb (0, 1, 47)
    got: 7+0: a-1:a-2:a-1:i-1:p-1:s-1
    * arm64: samba-dsdb-modules

I have an MP for samba 4.8 (https://code.launchpad.net/~ahasenack/ubuntu/+source/samba/+git/samba/+merge/348424) but that is on hold due to a regression detected in the security team's regression test suite (https://bugzilla.samba.org/show_bug.cgi?id=13486). So far upstream hasn't commented on the bug.

Since ldb is a library, and has been stuck for a while, I believe it's best to migrate it sooner rather than later, since we don't know when the 4.8 bug will get some attention.

[Robie Basak (racb)]

Tagged and uploaded.

review: Approve

diff --git a/debian/changelog b/debian/changelog
index bf75b4e..539294e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+samba (2:4.7.6+dfsg~ubuntu-0ubuntu3) cosmic; urgency=medium
+
+  * No change rebuild to link with new ldb 1.3.3
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 03 Jul 2018 09:57:24 -0300
+
 samba (2:4.7.6+dfsg~ubuntu-0ubuntu2) bionic; urgency=medium
 
   * debian/patches/passdb_dont_return_ok_if_pinfo_not_filled.patch:
diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c
 new file mode 100644
index 0000000..d4e9030
--- /dev/null
+++ b/source4/ldap_server/ldap_backend.c
@@ -0,0 +1,1338 @@
+/* 
+   Unix SMB/CIFS implementation.
+   LDAP server
+   Copyright (C) Stefan Metzmacher 2004
+   Copyright (C) Matthias Dieter Wallnöfer 2009
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "ldap_server/ldap_server.h"
+#include "../lib/util/dlinklist.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h" /* TODO: remove this */
+#include "auth/common_auth.h"
+#include "param/param.h"
+#include "smbd/service_stream.h"
+#include "dsdb/samdb/samdb.h"
+#include <ldb_errors.h>
+#include <ldb_module.h>
+#include "ldb_wrap.h"
+
+static int map_ldb_error(TALLOC_CTX *mem_ctx, int ldb_err,
+	const char *add_err_string, const char **errstring)
+{
+	WERROR err;
+
+	/* Certain LDB modules need to return very special WERROR codes. Proof
+	 * for them here and if they exist skip the rest of the mapping. */
+	if (add_err_string != NULL) {
+		char *endptr;
+		strtol(add_err_string, &endptr, 16);
+		if (endptr != add_err_string) {
+			*errstring = add_err_string;
+			return ldb_err;
+		}
+	}
+
+	/* Otherwise we calculate here a generic, but appropriate WERROR. */
+
+	switch (ldb_err) {
+	case LDB_SUCCESS:
+		err = WERR_OK;
+	break;
+	case LDB_ERR_OPERATIONS_ERROR:
+		err = WERR_DS_OPERATIONS_ERROR;
+	break;
+	case LDB_ERR_PROTOCOL_ERROR:
+		err = WERR_DS_PROTOCOL_ERROR;
+	break;
+	case LDB_ERR_TIME_LIMIT_EXCEEDED:
+		err = WERR_DS_TIMELIMIT_EXCEEDED;
+	break;
+	case LDB_ERR_SIZE_LIMIT_EXCEEDED:
+		err = WERR_DS_SIZELIMIT_EXCEEDED;
+	break;
+	case LDB_ERR_COMPARE_FALSE:
+		err = WERR_DS_COMPARE_FALSE;
+	break;
+	case LDB_ERR_COMPARE_TRUE:
+		err = WERR_DS_COMPARE_TRUE;
+	break;
+	case LDB_ERR_AUTH_METHOD_NOT_SUPPORTED:
+		err = WERR_DS_AUTH_METHOD_NOT_SUPPORTED;
+	break;
+	case LDB_ERR_STRONG_AUTH_REQUIRED:
+		err = WERR_DS_STRONG_AUTH_REQUIRED;
+	break;
+	case LDB_ERR_REFERRAL:
+		err = WERR_DS_REFERRAL;
+	break;
+	case LDB_ERR_ADMIN_LIMIT_EXCEEDED:
+		err = WERR_DS_ADMIN_LIMIT_EXCEEDED;
+	break;
+	case LDB_ERR_UNSUPPORTED_CRITICAL_EXTENSION:
+		err = WERR_DS_UNAVAILABLE_CRIT_EXTENSION;
+	break;
+	case LDB_ERR_CONFIDENTIALITY_REQUIRED:
+		err = WERR_DS_CONFIDENTIALITY_REQUIRED;
+	break;
+	case LDB_ERR_SASL_BIND_IN_PROGRESS:
+		err = WERR_DS_BUSY;
+	break;
+	case LDB_ERR_NO_SUCH_ATTRIBUTE:
+		err = WERR_DS_NO_ATTRIBUTE_OR_VALUE;
+	break;
+	case LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE:
+		err = WERR_DS_ATTRIBUTE_TYPE_UNDEFINED;
+	break;
+	case LDB_ERR_INAPPROPRIATE_MATCHING:
+		err = WERR_DS_INAPPROPRIATE_MATCHING;
+	break;
+	case LDB_ERR_CONSTRAINT_VIOLATION:
+		err = WERR_DS_CONSTRAINT_VIOLATION;
+	break;
+	case LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS:
+		err = WERR_DS_ATTRIBUTE_OR_VALUE_EXISTS;
+	break;
+	case LDB_ERR_INVALID_ATTRIBUTE_SYNTAX:
+		err = WERR_DS_INVALID_ATTRIBUTE_SYNTAX;
+	break;
+	case LDB_ERR_NO_SUCH_OBJECT:
+		err = WERR_DS_NO_SUCH_OBJECT;
+	break;
+	case LDB_ERR_ALIAS_PROBLEM:
+		err = WERR_DS_ALIAS_PROBLEM;
+	break;
+	case LDB_ERR_INVALID_DN_SYNTAX:
+		err = WERR_DS_INVALID_DN_SYNTAX;
+	break;
+	case LDB_ERR_ALIAS_DEREFERENCING_PROBLEM:
+		err = WERR_DS_ALIAS_DEREF_PROBLEM;
+	break;
+	case LDB_ERR_INAPPROPRIATE_AUTHENTICATION:
+		err = WERR_DS_INAPPROPRIATE_AUTH;
+	break;
+	case LDB_ERR_INVALID_CREDENTIALS:
+		err = WERR_ACCESS_DENIED;
+	break;
+	case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
+		err = WERR_DS_INSUFF_ACCESS_RIGHTS;
+	break;
+	case LDB_ERR_BUSY:
+		err = WERR_DS_BUSY;
+	break;
+	case LDB_ERR_UNAVAILABLE:
+		err = WERR_DS_UNAVAILABLE;
+	break;
+	case LDB_ERR_UNWILLING_TO_PERFORM:
+		err = WERR_DS_UNWILLING_TO_PERFORM;
+	break;
+	case LDB_ERR_LOOP_DETECT:
+		err = WERR_DS_LOOP_DETECT;
+	break;
+	case LDB_ERR_NAMING_VIOLATION:
+		err = WERR_DS_NAMING_VIOLATION;
+	break;
+	case LDB_ERR_OBJECT_CLASS_VIOLATION:
+		err = WERR_DS_OBJ_CLASS_VIOLATION;
+	break;
+	case LDB_ERR_NOT_ALLOWED_ON_NON_LEAF:
+		err = WERR_DS_CANT_ON_NON_LEAF;
+	break;
+	case LDB_ERR_NOT_ALLOWED_ON_RDN:
+		err = WERR_DS_CANT_ON_RDN;
+	break;
+	case LDB_ERR_ENTRY_ALREADY_EXISTS:
+		err = WERR_DS_OBJ_STRING_NAME_EXISTS;
+	break;
+	case LDB_ERR_OBJECT_CLASS_MODS_PROHIBITED:
+		err = WERR_DS_CANT_MOD_OBJ_CLASS;
+	break;
+	case LDB_ERR_AFFECTS_MULTIPLE_DSAS:
+		err = WERR_DS_AFFECTS_MULTIPLE_DSAS;
+	break;
+	default:
+		err = WERR_DS_GENERIC_ERROR;
+	break;
+	}
+
+	*errstring = talloc_asprintf(mem_ctx, "%08X: %s", W_ERROR_V(err),
+		add_err_string != NULL ? add_err_string : ldb_strerror(ldb_err));
+
+	/* result is 1:1 for now */
+	return ldb_err;
+}
+
+/*
+  connect to the sam database
+*/
+NTSTATUS ldapsrv_backend_Init(struct ldapsrv_connection *conn) 
+{
+	conn->ldb = samdb_connect(conn, 
+				     conn->connection->event.ctx,
+				     conn->lp_ctx,
+				     conn->session_info,
+				     conn->global_catalog ? LDB_FLG_RDONLY : 0);
+	if (conn->ldb == NULL) {
+		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	}
+
+	if (conn->server_credentials) {
+		char **sasl_mechs = NULL;
+		const struct gensec_security_ops * const *backends = gensec_security_all();
+		const struct gensec_security_ops **ops
+			= gensec_use_kerberos_mechs(conn, backends, conn->server_credentials);
+		unsigned int i, j = 0;
+		for (i = 0; ops && ops[i]; i++) {
+			if (!lpcfg_parm_bool(conn->lp_ctx,  NULL, "gensec", ops[i]->name, ops[i]->enabled))
+				continue;
+
+			if (ops[i]->sasl_name && ops[i]->server_start) {
+				char *sasl_name = talloc_strdup(conn, ops[i]->sasl_name);
+
+				if (!sasl_name) {
+					return NT_STATUS_NO_MEMORY;
+				}
+				sasl_mechs = talloc_realloc(conn, sasl_mechs, char *, j + 2);
+				if (!sasl_mechs) {
+					return NT_STATUS_NO_MEMORY;
+				}
+				sasl_mechs[j] = sasl_name;
+				talloc_steal(sasl_mechs, sasl_name);
+				sasl_mechs[j+1] = NULL;
+				j++;
+			}
+		}
+		talloc_unlink(conn, ops);
+
+		/* ldb can have a different lifetime to conn, so we
+		   need to ensure that sasl_mechs lives as long as the
+		   ldb does */
+		talloc_steal(conn->ldb, sasl_mechs);
+
+		ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs);
+	}
+
+	ldb_set_opaque(conn->ldb, "remoteAddress",
+		       conn->connection->remote_address);
+
+	return NT_STATUS_OK;
+}
+
+struct ldapsrv_reply *ldapsrv_init_reply(struct ldapsrv_call *call, uint8_t type)
+{
+	struct ldapsrv_reply *reply;
+
+	reply = talloc_zero(call, struct ldapsrv_reply);
+	if (!reply) {
+		return NULL;
+	}
+	reply->msg = talloc_zero(reply, struct ldap_message);
+	if (reply->msg == NULL) {
+		talloc_free(reply);
+		return NULL;
+	}
+
+	reply->msg->messageid = call->request->messageid;
+	reply->msg->type = type;
+	reply->msg->controls = NULL;
+
+	return reply;
+}
+
+void ldapsrv_queue_reply(struct ldapsrv_call *call, struct ldapsrv_reply *reply)
+{
+	DLIST_ADD_END(call->replies, reply);
+}
+
+static NTSTATUS ldapsrv_unwilling(struct ldapsrv_call *call, int error)
+{
+	struct ldapsrv_reply *reply;
+	struct ldap_ExtendedResponse *r;
+
+	DEBUG(10,("Unwilling type[%d] id[%d]\n", call->request->type, call->request->messageid));
+
+	reply = ldapsrv_init_reply(call, LDAP_TAG_ExtendedResponse);
+	if (!reply) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	r = &reply->msg->r.ExtendedResponse;
+	r->response.resultcode = error;
+	r->response.dn = NULL;
+	r->response.errormessage = NULL;
+	r->response.referral = NULL;
+	r->oid = NULL;
+	r->value = NULL;
+
+	ldapsrv_queue_reply(call, reply);
+	return NT_STATUS_OK;
+}
+
+static int ldapsrv_add_with_controls(struct ldapsrv_call *call,
+				     const struct ldb_message *message,
+				     struct ldb_control **controls,
+				     struct ldb_result *res)
+{
+	struct ldb_context *ldb = call->conn->ldb;
+	struct ldb_request *req;
+	int ret;
+
+	ret = ldb_msg_sanity_check(ldb, message);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ret = ldb_build_add_req(&req, ldb, ldb,
+					message,
+					controls,
+					res,
+					ldb_modify_default_callback,
+					NULL);
+
+	if (ret != LDB_SUCCESS) return ret;
+
+	if (call->conn->global_catalog) {
+		return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
+	}
+	ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
+
+	ret = ldb_transaction_start(ldb);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	if (!call->conn->is_privileged) {
+		ldb_req_mark_untrusted(req);
+	}
+
+	LDB_REQ_SET_LOCATION(req);
+
+	ret = ldb_request(ldb, req);
+	if (ret == LDB_SUCCESS) {
+		ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+	}
+
+	if (ret == LDB_SUCCESS) {
+		ret = ldb_transaction_commit(ldb);
+	}
+	else {
+		ldb_transaction_cancel(ldb);
+	}
+
+	talloc_free(req);
+	return ret;
+}
+
+/* create and execute a modify request */
+static int ldapsrv_mod_with_controls(struct ldapsrv_call *call,
+				     const struct ldb_message *message,
+				     struct ldb_control **controls,
+				     struct ldb_result *res)
+{
+	struct ldb_context *ldb = call->conn->ldb;
+	struct ldb_request *req;
+	int ret;
+
+	ret = ldb_msg_sanity_check(ldb, message);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	ret = ldb_build_mod_req(&req, ldb, ldb,
+					message,
+					controls,
+					res,
+					ldb_modify_default_callback,
+					NULL);
+
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	if (call->conn->global_catalog) {
+		return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
+	}
+	ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
+
+	ret = ldb_transaction_start(ldb);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	if (!call->conn->is_privileged) {
+		ldb_req_mark_untrusted(req);
+	}
+
+	LDB_REQ_SET_LOCATION(req);
+
+	ret = ldb_request(ldb, req);
+	if (ret == LDB_SUCCESS) {
+		ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+	}
+
+	if (ret == LDB_SUCCESS) {
+		ret = ldb_transaction_commit(ldb);
+	}
+	else {
+		ldb_transaction_cancel(ldb);
+	}
+
+	talloc_free(req);
+	return ret;
+}
+
+/* create and execute a delete request */
+static int ldapsrv_del_with_controls(struct ldapsrv_call *call,
+				     struct ldb_dn *dn,
+				     struct ldb_control **controls,
+				     struct ldb_result *res)
+{
+	struct ldb_context *ldb = call->conn->ldb;
+	struct ldb_request *req;
+	int ret;
+
+	ret = ldb_build_del_req(&req, ldb, ldb,
+					dn,
+					controls,
+					res,
+					ldb_modify_default_callback,
+					NULL);
+
+	if (ret != LDB_SUCCESS) return ret;
+
+	if (call->conn->global_catalog) {
+		return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
+	}
+	ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
+
+	ret = ldb_transaction_start(ldb);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	if (!call->conn->is_privileged) {
+		ldb_req_mark_untrusted(req);
+	}
+
+	LDB_REQ_SET_LOCATION(req);
+
+	ret = ldb_request(ldb, req);
+	if (ret == LDB_SUCCESS) {
+		ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+	}
+
+	if (ret == LDB_SUCCESS) {
+		ret = ldb_transaction_commit(ldb);
+	}
+	else {
+		ldb_transaction_cancel(ldb);
+	}
+
+	talloc_free(req);
+	return ret;
+}
+
+static int ldapsrv_rename_with_controls(struct ldapsrv_call *call,
+					struct ldb_dn *olddn,
+					struct ldb_dn *newdn,
+					struct ldb_control **controls,
+					struct ldb_result *res)
+{
+	struct ldb_context *ldb = call->conn->ldb;
+	struct ldb_request *req;
+	int ret;
+
+	ret = ldb_build_rename_req(&req, ldb, ldb,
+					olddn,
+					newdn,
+					controls,
+					res,
+					ldb_modify_default_callback,
+					NULL);
+
+	if (ret != LDB_SUCCESS) return ret;
+
+	if (call->conn->global_catalog) {
+		return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
+	}
+	ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
+
+	ret = ldb_transaction_start(ldb);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	if (!call->conn->is_privileged) {
+		ldb_req_mark_untrusted(req);
+	}
+
+	LDB_REQ_SET_LOCATION(req);
+
+	ret = ldb_request(ldb, req);
+	if (ret == LDB_SUCCESS) {
+		ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+	}
+
+	if (ret == LDB_SUCCESS) {
+		ret = ldb_transaction_commit(ldb);
+	}
+	else {
+		ldb_transaction_cancel(ldb);
+	}
+
+	talloc_free(req);
+	return ret;
+}
+
+static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
+{
+	struct ldap_SearchRequest *req = &call->request->r.SearchRequest;
+	struct ldap_SearchResEntry *ent;
+	struct ldap_Result *done;
+	struct ldapsrv_reply *ent_r, *done_r;
+	TALLOC_CTX *local_ctx;
+	struct ldb_context *samdb = talloc_get_type(call->conn->ldb, struct ldb_context);
+	struct ldb_dn *basedn;
+	struct ldb_result *res = NULL;
+	struct ldb_request *lreq;
+	struct ldb_control *search_control;
+	struct ldb_search_options_control *search_options;
+	struct ldb_control *extended_dn_control;
+	struct ldb_extended_dn_control *extended_dn_decoded = NULL;
+	struct ldb_control *notification_control = NULL;
+	enum ldb_scope scope = LDB_SCOPE_DEFAULT;
+	const char **attrs = NULL;
+	const char *scope_str, *errstr = NULL;
+	int success_limit = 1;
+	int result = -1;
+	int ldb_ret = -1;
+	unsigned int i, j;
+	int extended_type = 1;
+
+	DEBUG(10, ("SearchRequest"));
+	DEBUGADD(10, (" basedn: %s", req->basedn));
+	DEBUGADD(10, (" filter: %s\n", ldb_filter_from_tree(call, req->tree)));
+
+	local_ctx = talloc_new(call);
+	NT_STATUS_HAVE_NO_MEMORY(local_ctx);
+
+	basedn = ldb_dn_new(local_ctx, samdb, req->basedn);
+	NT_STATUS_HAVE_NO_MEMORY(basedn);
+
+	DEBUG(10, ("SearchRequest: basedn: [%s]\n", req->basedn));
+	DEBUG(10, ("SearchRequest: filter: [%s]\n", ldb_filter_from_tree(call, req->tree)));
+
+	switch (req->scope) {
+		case LDAP_SEARCH_SCOPE_BASE:
+			scope_str = "BASE";
+			scope = LDB_SCOPE_BASE;
+			success_limit = 0;
+			break;
+		case LDAP_SEARCH_SCOPE_SINGLE:
+			scope_str = "ONE";
+			scope = LDB_SCOPE_ONELEVEL;
+			success_limit = 0;
+			break;
+		case LDAP_SEARCH_SCOPE_SUB:
+			scope_str = "SUB";
+			scope = LDB_SCOPE_SUBTREE;
+			success_limit = 0;
+			break;
+	        default:
+			result = LDAP_PROTOCOL_ERROR;
+			map_ldb_error(local_ctx, LDB_ERR_PROTOCOL_ERROR, NULL,
+				&errstr);
+			errstr = talloc_asprintf(local_ctx,
+				"%s. Invalid scope", errstr);
+			goto reply;
+	}
+	DEBUG(10,("SearchRequest: scope: [%s]\n", scope_str));
+
+	if (req->num_attributes >= 1) {
+		attrs = talloc_array(local_ctx, const char *, req->num_attributes+1);
+		NT_STATUS_HAVE_NO_MEMORY(attrs);
+
+		for (i=0; i < req->num_attributes; i++) {
+			DEBUG(10,("SearchRequest: attrs: [%s]\n",req->attributes[i]));
+			attrs[i] = req->attributes[i];
+		}
+		attrs[i] = NULL;
+	}
+
+	DEBUG(5,("ldb_request %s dn=%s filter=%s\n", 
+		 scope_str, req->basedn, ldb_filter_from_tree(call, req->tree)));
+
+	res = talloc_zero(local_ctx, struct ldb_result);
+	NT_STATUS_HAVE_NO_MEMORY(res);
+
+	ldb_ret = ldb_build_search_req_ex(&lreq, samdb, local_ctx,
+					  basedn, scope,
+					  req->tree, attrs,
+					  call->request->controls,
+					  res, ldb_search_default_callback,
+					  NULL);
+
+	if (ldb_ret != LDB_SUCCESS) {
+		goto reply;
+	}
+
+	if (call->conn->global_catalog) {
+		search_control = ldb_request_get_control(lreq, LDB_CONTROL_SEARCH_OPTIONS_OID);
+
+		search_options = NULL;
+		if (search_control) {
+			search_options = talloc_get_type(search_control->data, struct ldb_search_options_control);
+			search_options->search_options |= LDB_SEARCH_OPTION_PHANTOM_ROOT;
+		} else {
+			search_options = talloc(lreq, struct ldb_search_options_control);
+			NT_STATUS_HAVE_NO_MEMORY(search_options);
+			search_options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
+			ldb_request_add_control(lreq, LDB_CONTROL_SEARCH_OPTIONS_OID, false, search_options);
+		}
+	} else {
+		ldb_request_add_control(lreq, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
+	}
+
+	extended_dn_control = ldb_request_get_control(lreq, LDB_CONTROL_EXTENDED_DN_OID);
+
+	if (extended_dn_control) {
+		if (extended_dn_control->data) {
+			extended_dn_decoded = talloc_get_type(extended_dn_control->data, struct ldb_extended_dn_control);
+			extended_type = extended_dn_decoded->type;
+		} else {
+			extended_type = 0;
+		}
+	}
+
+	notification_control = ldb_request_get_control(lreq, LDB_CONTROL_NOTIFICATION_OID);
+	if (notification_control != NULL) {
+		const struct ldapsrv_call *pc = NULL;
+		size_t count = 0;
+
+		for (pc = call->conn->pending_calls; pc != NULL; pc = pc->next) {
+			count += 1;
+		}
+
+		if (count >= call->conn->limits.max_notifications) {
+			DEBUG(10,("SearchRequest: error MaxNotificationPerConn\n"));
+			result = map_ldb_error(local_ctx,
+					       LDB_ERR_ADMIN_LIMIT_EXCEEDED,
+					       "MaxNotificationPerConn reached",
+					       &errstr);
+			goto reply;
+		}
+
+		/*
+		 * For now we need to do periodic retries on our own.
+		 * As the dsdb_notification module will return after each run.
+		 */
+		call->notification.busy = true;
+	}
+
+	ldb_set_timeout(samdb, lreq, req->timelimit);
+
+	if (!call->conn->is_privileged) {
+		ldb_req_mark_untrusted(lreq);
+	}
+
+	LDB_REQ_SET_LOCATION(lreq);
+
+	ldb_ret = ldb_request(samdb, lreq);
+
+	if (ldb_ret != LDB_SUCCESS) {
+		goto reply;
+	}
+
+	ldb_ret = ldb_wait(lreq->handle, LDB_WAIT_ALL);
+
+	if (ldb_ret == LDB_SUCCESS) {
+		for (i = 0; i < res->count; i++) {
+			ent_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultEntry);
+			NT_STATUS_HAVE_NO_MEMORY(ent_r);
+
+			/* Better to have the whole message kept here,
+			 * than to find someone further up didn't put
+			 * a value in the right spot in the talloc tree */
+			talloc_steal(ent_r, res->msgs[i]);
+			
+			ent = &ent_r->msg->r.SearchResultEntry;
+			ent->dn = ldb_dn_get_extended_linearized(ent_r, res->msgs[i]->dn, extended_type);
+			ent->num_attributes = 0;
+			ent->attributes = NULL;
+			if (res->msgs[i]->num_elements == 0) {
+				goto queue_reply;
+			}
+			ent->num_attributes = res->msgs[i]->num_elements;
+			ent->attributes = talloc_array(ent_r, struct ldb_message_element, ent->num_attributes);
+			NT_STATUS_HAVE_NO_MEMORY(ent->attributes);
+			for (j=0; j < ent->num_attributes; j++) {
+				ent->attributes[j].name = res->msgs[i]->elements[j].name;
+				ent->attributes[j].num_values = 0;
+				ent->attributes[j].values = NULL;
+				if (req->attributesonly && (res->msgs[i]->elements[j].num_values == 0)) {
+					continue;
+				}
+				ent->attributes[j].num_values = res->msgs[i]->elements[j].num_values;
+				ent->attributes[j].values = res->msgs[i]->elements[j].values;
+			}
+queue_reply:
+			ldapsrv_queue_reply(call, ent_r);
+		}
+
+		if (call->notification.busy) {
+			/* Move/Add it to the end */
+			DLIST_DEMOTE(call->conn->pending_calls, call);
+			call->notification.generation =
+				call->conn->service->notification.generation;
+
+			if (res->count != 0) {
+				call->notification.generation += 1;
+				ldapsrv_notification_retry_setup(call->conn->service,
+								 true);
+			}
+
+			talloc_free(local_ctx);
+			return NT_STATUS_OK;
+		}
+
+		/* Send back referrals if they do exist (search operations) */
+		if (res->refs != NULL) {
+			char **ref;
+			struct ldap_SearchResRef *ent_ref;
+
+			for (ref = res->refs; *ref != NULL; ++ref) {
+				ent_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultReference);
+				NT_STATUS_HAVE_NO_MEMORY(ent_r);
+
+				/* Better to have the whole referrals kept here,
+				 * than to find someone further up didn't put
+				 * a value in the right spot in the talloc tree
+				 */
+				talloc_steal(ent_r, *ref);
+
+				ent_ref = &ent_r->msg->r.SearchResultReference;
+				ent_ref->referral = *ref;
+
+				ldapsrv_queue_reply(call, ent_r);
+			}
+		}
+	}
+
+reply:
+	DLIST_REMOVE(call->conn->pending_calls, call);
+	call->notification.busy = false;
+
+	done_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultDone);
+	NT_STATUS_HAVE_NO_MEMORY(done_r);
+
+	done = &done_r->msg->r.SearchResultDone;
+	done->dn = NULL;
+	done->referral = NULL;
+
+	if (result != -1) {
+	} else if (ldb_ret == LDB_SUCCESS) {
+		if (res->count >= success_limit) {
+			DEBUG(10,("SearchRequest: results: [%d]\n", res->count));
+			result = LDAP_SUCCESS;
+			errstr = NULL;
+		}
+		if (res->controls) {
+			done_r->msg->controls = res->controls;
+			talloc_steal(done_r, res->controls);
+		}
+	} else {
+		DEBUG(10,("SearchRequest: error\n"));
+		result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
+				       &errstr);
+	}
+
+	done->resultcode = result;
+	done->errormessage = (errstr?talloc_strdup(done_r, errstr):NULL);
+
+	talloc_free(local_ctx);
+
+	ldapsrv_queue_reply(call, done_r);
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ldapsrv_ModifyRequest(struct ldapsrv_call *call)
+{
+	struct ldap_ModifyRequest *req = &call->request->r.ModifyRequest;
+	struct ldap_Result *modify_result;
+	struct ldapsrv_reply *modify_reply;
+	TALLOC_CTX *local_ctx;
+	struct ldb_context *samdb = call->conn->ldb;
+	struct ldb_message *msg = NULL;
+	struct ldb_dn *dn;
+	const char *errstr = NULL;
+	int result = LDAP_SUCCESS;
+	int ldb_ret;
+	unsigned int i,j;
+	struct ldb_result *res = NULL;
+
+	DEBUG(10, ("ModifyRequest"));
+	DEBUGADD(10, (" dn: %s\n", req->dn));
+
+	local_ctx = talloc_named(call, 0, "ModifyRequest local memory context");
+	NT_STATUS_HAVE_NO_MEMORY(local_ctx);
+
+	dn = ldb_dn_new(local_ctx, samdb, req->dn);
+	NT_STATUS_HAVE_NO_MEMORY(dn);
+
+	DEBUG(10, ("ModifyRequest: dn: [%s]\n", req->dn));
+
+	msg = talloc(local_ctx, struct ldb_message);
+	NT_STATUS_HAVE_NO_MEMORY(msg);
+
+	msg->dn = dn;
+	msg->num_elements = 0;
+	msg->elements = NULL;
+
+	if (req->num_mods > 0) {
+		msg->num_elements = req->num_mods;
+		msg->elements = talloc_array(msg, struct ldb_message_element, req->num_mods);
+		NT_STATUS_HAVE_NO_MEMORY(msg->elements);
+
+		for (i=0; i < msg->num_elements; i++) {
+			msg->elements[i].name = discard_const_p(char, req->mods[i].attrib.name);
+			msg->elements[i].num_values = 0;
+			msg->elements[i].values = NULL;
+
+			switch (req->mods[i].type) {
+			default:
+				result = LDAP_PROTOCOL_ERROR;
+				map_ldb_error(local_ctx,
+					LDB_ERR_PROTOCOL_ERROR, NULL, &errstr);
+				errstr = talloc_asprintf(local_ctx,
+					"%s. Invalid LDAP_MODIFY_* type", errstr);
+				goto reply;
+			case LDAP_MODIFY_ADD:
+				msg->elements[i].flags = LDB_FLAG_MOD_ADD;
+				break;
+			case LDAP_MODIFY_DELETE:
+				msg->elements[i].flags = LDB_FLAG_MOD_DELETE;
+				break;
+			case LDAP_MODIFY_REPLACE:
+				msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
+				break;
+			}
+
+			msg->elements[i].num_values = req->mods[i].attrib.num_values;
+			if (msg->elements[i].num_values > 0) {
+				msg->elements[i].values = talloc_array(msg->elements, struct ldb_val,
+								       msg->elements[i].num_values);
+				NT_STATUS_HAVE_NO_MEMORY(msg->elements[i].values);
+
+				for (j=0; j < msg->elements[i].num_values; j++) {
+					msg->elements[i].values[j].length = req->mods[i].attrib.values[j].length;
+					msg->elements[i].values[j].data = req->mods[i].attrib.values[j].data;			
+				}
+			}
+		}
+	}
+
+reply:
+	modify_reply = ldapsrv_init_reply(call, LDAP_TAG_ModifyResponse);
+	NT_STATUS_HAVE_NO_MEMORY(modify_reply);
+
+	if (result == LDAP_SUCCESS) {
+		res = talloc_zero(local_ctx, struct ldb_result);
+		NT_STATUS_HAVE_NO_MEMORY(res);
+		ldb_ret = ldapsrv_mod_with_controls(call, msg, call->request->controls, res);
+		result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
+				       &errstr);
+	}
+
+	modify_result = &modify_reply->msg->r.ModifyResponse;
+	modify_result->dn = NULL;
+	if ((res != NULL) && (res->refs != NULL)) {
+		modify_result->resultcode = map_ldb_error(local_ctx,
+							  LDB_ERR_REFERRAL,
+							  NULL, &errstr);
+		modify_result->errormessage = (errstr?talloc_strdup(modify_reply, errstr):NULL);
+		modify_result->referral = talloc_strdup(call, *res->refs);
+	} else {
+		modify_result->resultcode = result;
+		modify_result->errormessage = (errstr?talloc_strdup(modify_reply, errstr):NULL);
+		modify_result->referral = NULL;
+	}
+	talloc_free(local_ctx);
+
+	ldapsrv_queue_reply(call, modify_reply);
+	return NT_STATUS_OK;
+
+}
+
+static NTSTATUS ldapsrv_AddRequest(struct ldapsrv_call *call)
+{
+	struct ldap_AddRequest *req = &call->request->r.AddRequest;
+	struct ldap_Result *add_result;
+	struct ldapsrv_reply *add_reply;
+	TALLOC_CTX *local_ctx;
+	struct ldb_context *samdb = call->conn->ldb;
+	struct ldb_message *msg = NULL;
+	struct ldb_dn *dn;
+	const char *errstr = NULL;
+	int result = LDAP_SUCCESS;
+	int ldb_ret;
+	unsigned int i,j;
+	struct ldb_result *res = NULL;
+
+	DEBUG(10, ("AddRequest"));
+	DEBUGADD(10, (" dn: %s\n", req->dn));
+
+	local_ctx = talloc_named(call, 0, "AddRequest local memory context");
+	NT_STATUS_HAVE_NO_MEMORY(local_ctx);
+
+	dn = ldb_dn_new(local_ctx, samdb, req->dn);
+	NT_STATUS_HAVE_NO_MEMORY(dn);
+
+	DEBUG(10, ("AddRequest: dn: [%s]\n", req->dn));
+
+	msg = talloc(local_ctx, struct ldb_message);
+	NT_STATUS_HAVE_NO_MEMORY(msg);
+
+	msg->dn = dn;
+	msg->num_elements = 0;
+	msg->elements = NULL;
+
+	if (req->num_attributes > 0) {
+		msg->num_elements = req->num_attributes;
+		msg->elements = talloc_array(msg, struct ldb_message_element, msg->num_elements);
+		NT_STATUS_HAVE_NO_MEMORY(msg->elements);
+
+		for (i=0; i < msg->num_elements; i++) {
+			msg->elements[i].name = discard_const_p(char, req->attributes[i].name);
+			msg->elements[i].flags = 0;
+			msg->elements[i].num_values = 0;
+			msg->elements[i].values = NULL;
+			
+			if (req->attributes[i].num_values > 0) {
+				msg->elements[i].num_values = req->attributes[i].num_values;
+				msg->elements[i].values = talloc_array(msg->elements, struct ldb_val,
+								       msg->elements[i].num_values);
+				NT_STATUS_HAVE_NO_MEMORY(msg->elements[i].values);
+
+				for (j=0; j < msg->elements[i].num_values; j++) {
+					msg->elements[i].values[j].length = req->attributes[i].values[j].length;
+					msg->elements[i].values[j].data = req->attributes[i].values[j].data;			
+				}
+			}
+		}
+	}
+
+	add_reply = ldapsrv_init_reply(call, LDAP_TAG_AddResponse);
+	NT_STATUS_HAVE_NO_MEMORY(add_reply);
+
+	if (result == LDAP_SUCCESS) {
+		res = talloc_zero(local_ctx, struct ldb_result);
+		NT_STATUS_HAVE_NO_MEMORY(res);
+		ldb_ret = ldapsrv_add_with_controls(call, msg, call->request->controls, res);
+		result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
+				       &errstr);
+	}
+
+	add_result = &add_reply->msg->r.AddResponse;
+	add_result->dn = NULL;
+	if ((res != NULL) && (res->refs != NULL)) {
+		add_result->resultcode =  map_ldb_error(local_ctx,
+							LDB_ERR_REFERRAL, NULL,
+							&errstr);
+		add_result->errormessage = (errstr?talloc_strdup(add_reply,errstr):NULL);
+		add_result->referral = talloc_strdup(call, *res->refs);
+	} else {
+		add_result->resultcode = result;
+		add_result->errormessage = (errstr?talloc_strdup(add_reply,errstr):NULL);
+		add_result->referral = NULL;
+	}
+	talloc_free(local_ctx);
+
+	ldapsrv_queue_reply(call, add_reply);
+	return NT_STATUS_OK;
+
+}
+
+static NTSTATUS ldapsrv_DelRequest(struct ldapsrv_call *call)
+{
+	struct ldap_DelRequest *req = &call->request->r.DelRequest;
+	struct ldap_Result *del_result;
+	struct ldapsrv_reply *del_reply;
+	TALLOC_CTX *local_ctx;
+	struct ldb_context *samdb = call->conn->ldb;
+	struct ldb_dn *dn;
+	const char *errstr = NULL;
+	int result = LDAP_SUCCESS;
+	int ldb_ret;
+	struct ldb_result *res = NULL;
+
+	DEBUG(10, ("DelRequest"));
+	DEBUGADD(10, (" dn: %s\n", req->dn));
+
+	local_ctx = talloc_named(call, 0, "DelRequest local memory context");
+	NT_STATUS_HAVE_NO_MEMORY(local_ctx);
+
+	dn = ldb_dn_new(local_ctx, samdb, req->dn);
+	NT_STATUS_HAVE_NO_MEMORY(dn);
+
+	DEBUG(10, ("DelRequest: dn: [%s]\n", req->dn));
+
+	del_reply = ldapsrv_init_reply(call, LDAP_TAG_DelResponse);
+	NT_STATUS_HAVE_NO_MEMORY(del_reply);
+
+	if (result == LDAP_SUCCESS) {
+		res = talloc_zero(local_ctx, struct ldb_result);
+		NT_STATUS_HAVE_NO_MEMORY(res);
+		ldb_ret = ldapsrv_del_with_controls(call, dn, call->request->controls, res);
+		result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
+				       &errstr);
+	}
+
+	del_result = &del_reply->msg->r.DelResponse;
+	del_result->dn = NULL;
+	if ((res != NULL) && (res->refs != NULL)) {
+		del_result->resultcode = map_ldb_error(local_ctx,
+						       LDB_ERR_REFERRAL, NULL,
+						       &errstr);
+		del_result->errormessage = (errstr?talloc_strdup(del_reply,errstr):NULL);
+		del_result->referral = talloc_strdup(call, *res->refs);
+	} else {
+		del_result->resultcode = result;
+		del_result->errormessage = (errstr?talloc_strdup(del_reply,errstr):NULL);
+		del_result->referral = NULL;
+	}
+
+	talloc_free(local_ctx);
+
+	ldapsrv_queue_reply(call, del_reply);
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ldapsrv_ModifyDNRequest(struct ldapsrv_call *call)
+{
+	struct ldap_ModifyDNRequest *req = &call->request->r.ModifyDNRequest;
+	struct ldap_Result *modifydn;
+	struct ldapsrv_reply *modifydn_r;
+	TALLOC_CTX *local_ctx;
+	struct ldb_context *samdb = call->conn->ldb;
+	struct ldb_dn *olddn, *newdn=NULL, *newrdn;
+	struct ldb_dn *parentdn = NULL;
+	const char *errstr = NULL;
+	int result = LDAP_SUCCESS;
+	int ldb_ret;
+	struct ldb_result *res = NULL;
+
+	DEBUG(10, ("ModifyDNRequest"));
+	DEBUGADD(10, (" dn: %s", req->dn));
+	DEBUGADD(10, (" newrdn: %s\n", req->newrdn));
+
+	local_ctx = talloc_named(call, 0, "ModifyDNRequest local memory context");
+	NT_STATUS_HAVE_NO_MEMORY(local_ctx);
+
+	olddn = ldb_dn_new(local_ctx, samdb, req->dn);
+	NT_STATUS_HAVE_NO_MEMORY(olddn);
+
+	newrdn = ldb_dn_new(local_ctx, samdb, req->newrdn);
+	NT_STATUS_HAVE_NO_MEMORY(newrdn);
+
+	DEBUG(10, ("ModifyDNRequest: olddn: [%s]\n", req->dn));
+	DEBUG(10, ("ModifyDNRequest: newrdn: [%s]\n", req->newrdn));
+
+	if (ldb_dn_get_comp_num(newrdn) == 0) {
+		result = LDAP_PROTOCOL_ERROR;
+		map_ldb_error(local_ctx, LDB_ERR_PROTOCOL_ERROR, NULL,
+			      &errstr);
+		goto reply;
+	}
+
+	if (ldb_dn_get_comp_num(newrdn) > 1) {
+		result = LDAP_NAMING_VIOLATION;
+		map_ldb_error(local_ctx, LDB_ERR_NAMING_VIOLATION, NULL,
+			      &errstr);
+		goto reply;
+	}
+
+	/* we can't handle the rename if we should not remove the old dn */
+	if (!req->deleteolddn) {
+		result = LDAP_UNWILLING_TO_PERFORM;
+		map_ldb_error(local_ctx, LDB_ERR_UNWILLING_TO_PERFORM, NULL,
+			      &errstr);
+		errstr = talloc_asprintf(local_ctx,
+			"%s. Old RDN must be deleted", errstr);
+		goto reply;
+	}
+
+	if (req->newsuperior) {
+		DEBUG(10, ("ModifyDNRequest: newsuperior: [%s]\n", req->newsuperior));
+		parentdn = ldb_dn_new(local_ctx, samdb, req->newsuperior);
+	}
+
+	if (!parentdn) {
+		parentdn = ldb_dn_get_parent(local_ctx, olddn);
+	}
+	if (!parentdn) {
+		result = LDAP_NO_SUCH_OBJECT;
+		map_ldb_error(local_ctx, LDB_ERR_NO_SUCH_OBJECT, NULL, &errstr);
+		goto reply;
+	}
+
+	if ( ! ldb_dn_add_child(parentdn, newrdn)) {
+		result = LDAP_OTHER;
+		map_ldb_error(local_ctx, LDB_ERR_OTHER, NULL, &errstr);
+		goto reply;
+	}
+	newdn = parentdn;
+
+reply:
+	modifydn_r = ldapsrv_init_reply(call, LDAP_TAG_ModifyDNResponse);
+	NT_STATUS_HAVE_NO_MEMORY(modifydn_r);
+
+	if (result == LDAP_SUCCESS) {
+		res = talloc_zero(local_ctx, struct ldb_result);
+		NT_STATUS_HAVE_NO_MEMORY(res);
+		ldb_ret = ldapsrv_rename_with_controls(call, olddn, newdn, call->request->controls, res);
+		result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
+				       &errstr);
+	}
+
+	modifydn = &modifydn_r->msg->r.ModifyDNResponse;
+	modifydn->dn = NULL;
+	if ((res != NULL) && (res->refs != NULL)) {
+		modifydn->resultcode = map_ldb_error(local_ctx,
+						     LDB_ERR_REFERRAL, NULL,
+						     &errstr);;
+		modifydn->errormessage = (errstr?talloc_strdup(modifydn_r,errstr):NULL);
+		modifydn->referral = talloc_strdup(call, *res->refs);
+	} else {
+		modifydn->resultcode = result;
+		modifydn->errormessage = (errstr?talloc_strdup(modifydn_r,errstr):NULL);
+		modifydn->referral = NULL;
+	}
+
+	talloc_free(local_ctx);
+
+	ldapsrv_queue_reply(call, modifydn_r);
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ldapsrv_CompareRequest(struct ldapsrv_call *call)
+{
+	struct ldap_CompareRequest *req = &call->request->r.CompareRequest;
+	struct ldap_Result *compare;
+	struct ldapsrv_reply *compare_r;
+	TALLOC_CTX *local_ctx;
+	struct ldb_context *samdb = call->conn->ldb;
+	struct ldb_result *res = NULL;
+	struct ldb_dn *dn;
+	const char *attrs[1];
+	const char *errstr = NULL;
+	const char *filter = NULL;
+	int result = LDAP_SUCCESS;
+	int ldb_ret;
+
+	DEBUG(10, ("CompareRequest"));
+	DEBUGADD(10, (" dn: %s\n", req->dn));
+
+	local_ctx = talloc_named(call, 0, "CompareRequest local_memory_context");
+	NT_STATUS_HAVE_NO_MEMORY(local_ctx);
+
+	dn = ldb_dn_new(local_ctx, samdb, req->dn);
+	NT_STATUS_HAVE_NO_MEMORY(dn);
+
+	DEBUG(10, ("CompareRequest: dn: [%s]\n", req->dn));
+	filter = talloc_asprintf(local_ctx, "(%s=%*s)", req->attribute, 
+				 (int)req->value.length, req->value.data);
+	NT_STATUS_HAVE_NO_MEMORY(filter);
+
+	DEBUGADD(10, ("CompareRequest: attribute: [%s]\n", filter));
+
+	attrs[0] = NULL;
+
+	compare_r = ldapsrv_init_reply(call, LDAP_TAG_CompareResponse);
+	NT_STATUS_HAVE_NO_MEMORY(compare_r);
+
+	if (result == LDAP_SUCCESS) {
+		ldb_ret = ldb_search(samdb, local_ctx, &res,
+				     dn, LDB_SCOPE_BASE, attrs, "%s", filter);
+		if (ldb_ret != LDB_SUCCESS) {
+			result = map_ldb_error(local_ctx, ldb_ret,
+					       ldb_errstring(samdb), &errstr);
+			DEBUG(10,("CompareRequest: error: %s\n", errstr));
+		} else if (res->count == 0) {
+			DEBUG(10,("CompareRequest: doesn't matched\n"));
+			result = LDAP_COMPARE_FALSE;
+			errstr = NULL;
+		} else if (res->count == 1) {
+			DEBUG(10,("CompareRequest: matched\n"));
+			result = LDAP_COMPARE_TRUE;
+			errstr = NULL;
+		} else if (res->count > 1) {
+			result = LDAP_OTHER;
+			map_ldb_error(local_ctx, LDB_ERR_OTHER, NULL, &errstr);
+			errstr = talloc_asprintf(local_ctx,
+				"%s. Too many objects match!", errstr);
+			DEBUG(10,("CompareRequest: %d results: %s\n", res->count, errstr));
+		}
+	}
+
+	compare = &compare_r->msg->r.CompareResponse;
+	compare->dn = NULL;
+	compare->resultcode = result;
+	compare->errormessage = (errstr?talloc_strdup(compare_r,errstr):NULL);
+	compare->referral = NULL;
+
+	talloc_free(local_ctx);
+
+	ldapsrv_queue_reply(call, compare_r);
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ldapsrv_AbandonRequest(struct ldapsrv_call *call)
+{
+	struct ldap_AbandonRequest *req = &call->request->r.AbandonRequest;
+	struct ldapsrv_call *c = NULL;
+	struct ldapsrv_call *n = NULL;
+
+	DEBUG(10, ("AbandonRequest\n"));
+
+	for (c = call->conn->pending_calls; c != NULL; c = n) {
+		n = c->next;
+
+		if (c->request->messageid != req->messageid) {
+			continue;
+		}
+
+		DLIST_REMOVE(call->conn->pending_calls, c);
+		TALLOC_FREE(c);
+	}
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ldapsrv_do_call(struct ldapsrv_call *call)
+{
+	unsigned int i;
+	struct ldap_message *msg = call->request;
+	NTSTATUS status;
+
+	/* Check for undecoded critical extensions */
+	for (i=0; msg->controls && msg->controls[i]; i++) {
+		if (!msg->controls_decoded[i] && 
+		    msg->controls[i]->critical) {
+			DEBUG(3, ("ldapsrv_do_call: Critical extension %s is not known to this server\n",
+				  msg->controls[i]->oid));
+			return ldapsrv_unwilling(call, LDAP_UNAVAILABLE_CRITICAL_EXTENSION);
+		}
+	}
+
+	if (call->conn->authz_logged == false) {
+		bool log = true;
+
+		/*
+		 * We do not want to log anonymous access if the query
+		 * is just for the rootDSE, or it is a startTLS or a
+		 * Bind.
+		 *
+		 * A rootDSE search could also be done over
+		 * CLDAP anonymously for example, so these don't
+		 * really count.
+		 * Essentially we want to know about
+		 * access beyond that normally done prior to a
+		 * bind.
+		 */
+
+		switch(call->request->type) {
+		case LDAP_TAG_BindRequest:
+		case LDAP_TAG_UnbindRequest:
+		case LDAP_TAG_AbandonRequest:
+			log = false;
+			break;
+		case LDAP_TAG_ExtendedResponse: {
+			struct ldap_ExtendedRequest *req = &call->request->r.ExtendedRequest;
+			if (strcmp(req->oid, LDB_EXTENDED_START_TLS_OID) == 0) {
+				log = false;
+			}
+			break;
+		}
+		case LDAP_TAG_SearchRequest: {
+			struct ldap_SearchRequest *req = &call->request->r.SearchRequest;
+			if (req->scope == LDAP_SEARCH_SCOPE_BASE) {
+				if (req->basedn[0] == '\0') {
+					log = false;
+				}
+			}
+			break;
+		}
+		default:
+			break;
+		}
+
+		if (log) {
+			const char *transport_protection = AUTHZ_TRANSPORT_PROTECTION_NONE;
+			if (call->conn->sockets.active == call->conn->sockets.tls) {
+				transport_protection = AUTHZ_TRANSPORT_PROTECTION_TLS;
+			}
+
+			log_successful_authz_event(call->conn->connection->msg_ctx,
+						   call->conn->connection->lp_ctx,
+						   call->conn->connection->remote_address,
+						   call->conn->connection->local_address,
+						   "LDAP",
+						   "no bind",
+						   transport_protection,
+						   call->conn->session_info);
+
+			call->conn->authz_logged = true;
+		}
+	}
+
+	switch(call->request->type) {
+	case LDAP_TAG_BindRequest:
+		return ldapsrv_BindRequest(call);
+	case LDAP_TAG_UnbindRequest:
+		return ldapsrv_UnbindRequest(call);
+	case LDAP_TAG_SearchRequest:
+		return ldapsrv_SearchRequest(call);
+	case LDAP_TAG_ModifyRequest:
+		status = ldapsrv_ModifyRequest(call);
+		break;
+	case LDAP_TAG_AddRequest:
+		status = ldapsrv_AddRequest(call);
+		break;
+	case LDAP_TAG_DelRequest:
+		status = ldapsrv_DelRequest(call);
+		break;
+	case LDAP_TAG_ModifyDNRequest:
+		status = ldapsrv_ModifyDNRequest(call);
+		break;
+	case LDAP_TAG_CompareRequest:
+		return ldapsrv_CompareRequest(call);
+	case LDAP_TAG_AbandonRequest:
+		return ldapsrv_AbandonRequest(call);
+	case LDAP_TAG_ExtendedRequest:
+		status = ldapsrv_ExtendedRequest(call);
+		break;
+	default:
+		return ldapsrv_unwilling(call, LDAP_PROTOCOL_ERROR);
+	}
+
+	if (NT_STATUS_IS_OK(status)) {
+		ldapsrv_notification_retry_setup(call->conn->service, true);
+	}
+
+	return status;
+}
diff --git a/source4/ldap_server/ldap_bind.c b/source4/ldap_server/ldap_bind.c
 new file mode 100644
index 0000000..21cbb7b
--- /dev/null
+++ b/source4/ldap_server/ldap_bind.c
@@ -0,0 +1,759 @@
+/* 
+   Unix SMB/CIFS implementation.
+   LDAP server
+   Copyright (C) Stefan Metzmacher 2004
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "ldap_server/ldap_server.h"
+#include "auth/auth.h"
+#include "smbd/service.h"
+#include <ldb.h>
+#include <ldb_errors.h>
+#include "../lib/util/dlinklist.h"
+#include "dsdb/samdb/samdb.h"
+#include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_tstream.h"
+#include "param/param.h"
+#include "../lib/util/tevent_ntstatus.h"
+
+static char *ldapsrv_bind_error_msg(TALLOC_CTX *mem_ctx,
+				    HRESULT hresult,
+				    uint32_t DSID,
+				    NTSTATUS status)
+{
+	WERROR werr;
+	char *msg = NULL;
+
+	status = nt_status_squash(status);
+	werr = ntstatus_to_werror(status);
+
+	/*
+	 * There are 4 lower case hex digits following 'v' at the end,
+	 * but different Windows Versions return different values:
+	 *
+	 * Windows 2008R2 uses 'v1db1'
+	 * Windows 2012R2 uses 'v2580'
+	 *
+	 * We just match Windows 2008R2 as that's what was referenced
+	 * in https://bugzilla.samba.org/show_bug.cgi?id=9048
+	 */
+	msg = talloc_asprintf(mem_ctx, "%08X: LdapErr: DSID-%08X, comment: "
+			      "AcceptSecurityContext error, data %x, v1db1",
+			      (unsigned)HRES_ERROR_V(hresult),
+			      (unsigned)DSID,
+			      (unsigned)W_ERROR_V(werr));
+
+	return msg;
+}
+
+struct ldapsrv_bind_wait_context {
+	struct ldapsrv_reply *reply;
+	struct tevent_req *req;
+	NTSTATUS status;
+	bool done;
+};
+
+struct ldapsrv_bind_wait_state {
+	uint8_t dummy;
+};
+
+static struct tevent_req *ldapsrv_bind_wait_send(TALLOC_CTX *mem_ctx,
+						 struct tevent_context *ev,
+						 void *private_data)
+{
+	struct ldapsrv_bind_wait_context *bind_wait =
+		talloc_get_type_abort(private_data,
+		struct ldapsrv_bind_wait_context);
+	struct tevent_req *req;
+	struct ldapsrv_bind_wait_state *state;
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct ldapsrv_bind_wait_state);
+	if (req == NULL) {
+		return NULL;
+	}
+	bind_wait->req = req;
+
+	tevent_req_defer_callback(req, ev);
+
+	if (!bind_wait->done) {
+		return req;
+	}
+
+	if (tevent_req_nterror(req, bind_wait->status)) {
+		return tevent_req_post(req, ev);
+	}
+
+	tevent_req_done(req);
+	return tevent_req_post(req, ev);
+}
+
+static NTSTATUS ldapsrv_bind_wait_recv(struct tevent_req *req)
+{
+	return tevent_req_simple_recv_ntstatus(req);
+}
+
+static NTSTATUS ldapsrv_bind_wait_setup(struct ldapsrv_call *call,
+					struct ldapsrv_reply *reply)
+{
+	struct ldapsrv_bind_wait_context *bind_wait = NULL;
+
+	if (call->wait_private != NULL) {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	bind_wait = talloc_zero(call, struct ldapsrv_bind_wait_context);
+	if (bind_wait == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	bind_wait->reply = reply;
+
+	call->wait_private = bind_wait;
+	call->wait_send = ldapsrv_bind_wait_send;
+	call->wait_recv = ldapsrv_bind_wait_recv;
+	return NT_STATUS_OK;
+}
+
+static void ldapsrv_bind_wait_finished(struct ldapsrv_call *call,
+				       NTSTATUS status)
+{
+	struct ldapsrv_bind_wait_context *bind_wait =
+		talloc_get_type_abort(call->wait_private,
+		struct ldapsrv_bind_wait_context);
+
+	bind_wait->done = true;
+	bind_wait->status = status;
+
+	if (bind_wait->req == NULL) {
+		return;
+	}
+
+	if (tevent_req_nterror(bind_wait->req, status)) {
+		return;
+	}
+
+	tevent_req_done(bind_wait->req);
+}
+
+static void ldapsrv_BindSimple_done(struct tevent_req *subreq);
+
+static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
+{
+	struct ldap_BindRequest *req = &call->request->r.BindRequest;
+	struct ldapsrv_reply *reply = NULL;
+	struct ldap_BindResponse *resp = NULL;
+	int result;
+	const char *errstr = NULL;
+	NTSTATUS status;
+	bool using_tls = call->conn->sockets.active == call->conn->sockets.tls;
+	struct tevent_req *subreq = NULL;
+
+	DEBUG(10, ("BindSimple dn: %s\n",req->dn));
+
+	reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
+	if (!reply) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	if (req->dn != NULL &&
+	    strlen(req->dn) != 0 &&
+	    call->conn->require_strong_auth > LDAP_SERVER_REQUIRE_STRONG_AUTH_NO &&
+	    !using_tls)
+	{
+		status = NT_STATUS_NETWORK_ACCESS_DENIED;
+		result = LDAP_STRONG_AUTH_REQUIRED;
+		errstr = talloc_asprintf(reply,
+					 "BindSimple: Transport encryption required.");
+		goto do_reply;
+	}
+
+	subreq = authenticate_ldap_simple_bind_send(call,
+					call->conn->connection->event.ctx,
+					call->conn->connection->msg_ctx,
+					call->conn->lp_ctx,
+					call->conn->connection->remote_address,
+					call->conn->connection->local_address,
+					using_tls,
+					req->dn,
+					req->creds.password);
+	if (subreq == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	tevent_req_set_callback(subreq, ldapsrv_BindSimple_done, call);
+
+	status = ldapsrv_bind_wait_setup(call, reply);
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(subreq);
+		return status;
+	}
+
+	/*
+	 * The rest will be async.
+	 */
+	return NT_STATUS_OK;
+
+do_reply:
+	resp = &reply->msg->r.BindResponse;
+	resp->response.resultcode = result;
+	resp->response.errormessage = errstr;
+	resp->response.dn = NULL;
+	resp->response.referral = NULL;
+	resp->SASL.secblob = NULL;
+
+	ldapsrv_queue_reply(call, reply);
+	return NT_STATUS_OK;
+}
+
+static void ldapsrv_BindSimple_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_call *call =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_call);
+	struct ldapsrv_bind_wait_context *bind_wait =
+		talloc_get_type_abort(call->wait_private,
+		struct ldapsrv_bind_wait_context);
+	struct ldapsrv_reply *reply = bind_wait->reply;
+	struct auth_session_info *session_info = NULL;
+	NTSTATUS status;
+	struct ldap_BindResponse *resp = NULL;
+	int result;
+	const char *errstr = NULL;
+
+	status = authenticate_ldap_simple_bind_recv(subreq,
+						    call,
+						    &session_info);
+	if (NT_STATUS_IS_OK(status)) {
+		result = LDAP_SUCCESS;
+		errstr = NULL;
+
+		talloc_unlink(call->conn, call->conn->session_info);
+		call->conn->session_info = talloc_steal(call->conn, session_info);
+
+		call->conn->authz_logged = true;
+
+		/* don't leak the old LDB */
+		talloc_unlink(call->conn, call->conn->ldb);
+
+		status = ldapsrv_backend_Init(call->conn);		
+		
+		if (!NT_STATUS_IS_OK(status)) {
+			result = LDAP_OPERATIONS_ERROR;
+			errstr = talloc_asprintf(reply, "Simple Bind: Failed to advise ldb new credentials: %s", nt_errstr(status));
+		}
+	} else {
+		status = nt_status_squash(status);
+
+		result = LDAP_INVALID_CREDENTIALS;
+		errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_INVALID_TOKEN,
+						0x0C0903A9, status);
+	}
+
+	resp = &reply->msg->r.BindResponse;
+	resp->response.resultcode = result;
+	resp->response.errormessage = errstr;
+	resp->response.dn = NULL;
+	resp->response.referral = NULL;
+	resp->SASL.secblob = NULL;
+
+	ldapsrv_queue_reply(call, reply);
+	ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
+}
+
+struct ldapsrv_sasl_postprocess_context {
+	struct ldapsrv_connection *conn;
+	struct tstream_context *sasl;
+};
+
+struct ldapsrv_sasl_postprocess_state {
+	uint8_t dummy;
+};
+
+static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
+						struct tevent_context *ev,
+						void *private_data)
+{
+	struct ldapsrv_sasl_postprocess_context *context =
+		talloc_get_type_abort(private_data,
+		struct ldapsrv_sasl_postprocess_context);
+	struct tevent_req *req;
+	struct ldapsrv_sasl_postprocess_state *state;
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct ldapsrv_sasl_postprocess_state);
+	if (req == NULL) {
+		return NULL;
+	}
+
+	TALLOC_FREE(context->conn->sockets.sasl);
+	context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
+	context->conn->sockets.active = context->conn->sockets.sasl;
+
+	tevent_req_done(req);
+	return tevent_req_post(req, ev);
+}
+
+static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
+{
+	return tevent_req_simple_recv_ntstatus(req);
+}
+
+static NTSTATUS ldapsrv_setup_gensec(struct ldapsrv_connection *conn,
+				     const char *sasl_mech,
+				     struct gensec_security **_gensec_security)
+{
+	NTSTATUS status;
+
+	struct gensec_security *gensec_security;
+
+	status = samba_server_gensec_start(conn,
+					   conn->connection->event.ctx,
+					   conn->connection->msg_ctx,
+					   conn->lp_ctx,
+					   conn->server_credentials,
+					   "ldap",
+					   &gensec_security);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	status = gensec_set_target_service_description(gensec_security,
+						       "LDAP");
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	status = gensec_set_remote_address(gensec_security,
+					   conn->connection->remote_address);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	status = gensec_set_local_address(gensec_security,
+					  conn->connection->local_address);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
+	gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAP_STYLE);
+
+	if (conn->sockets.active == conn->sockets.tls) {
+		gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAPS_TRANSPORT);
+	}
+
+	status = gensec_start_mech_by_sasl_name(gensec_security, sasl_mech);
+
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	*_gensec_security = gensec_security;
+	return status;
+}
+
+static void ldapsrv_BindSASL_done(struct tevent_req *subreq);
+
+static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
+{
+	struct ldap_BindRequest *req = &call->request->r.BindRequest;
+	struct ldapsrv_reply *reply;
+	struct ldap_BindResponse *resp;
+	struct ldapsrv_connection *conn;
+	int result = 0;
+	const char *errstr=NULL;
+	NTSTATUS status = NT_STATUS_OK;
+	DATA_BLOB input = data_blob_null;
+	struct tevent_req *subreq = NULL;
+
+	DEBUG(10, ("BindSASL dn: %s\n",req->dn));
+
+	reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
+	if (!reply) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	resp = &reply->msg->r.BindResponse;
+	/* Windows 2000 mmc doesn't like secblob == NULL and reports a decoding error */
+	resp->SASL.secblob = talloc_zero(reply, DATA_BLOB);
+	if (resp->SASL.secblob == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	conn = call->conn;
+
+	/* 
+	 * TODO: a SASL bind with a different mechanism
+	 *       should cancel an inprogress SASL bind.
+	 *       (see RFC 4513)
+	 */
+
+	if (!conn->gensec) {
+		status = ldapsrv_setup_gensec(conn, req->creds.SASL.mechanism,
+					      &conn->gensec);
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(1, ("Failed to start GENSEC server for [%s] code: %s\n",
+				  ldb_binary_encode_string(call, req->creds.SASL.mechanism),
+				  nt_errstr(status)));
+			result = LDAP_OPERATIONS_ERROR;
+			errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s", 
+						 nt_errstr(status));
+			goto do_reply;
+		}
+	}
+
+	if (req->creds.SASL.secblob) {
+		input = *req->creds.SASL.secblob;
+	}
+
+	subreq = gensec_update_send(call, conn->connection->event.ctx,
+				    conn->gensec, input);
+	if (subreq == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	tevent_req_set_callback(subreq, ldapsrv_BindSASL_done, call);
+
+	status = ldapsrv_bind_wait_setup(call, reply);
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(subreq);
+		return status;
+	}
+
+	/*
+	 * The rest will be async.
+	 */
+	return NT_STATUS_OK;
+
+do_reply:
+	if (result != LDAP_SASL_BIND_IN_PROGRESS) {
+		/*
+		 * We should destroy the gensec context
+		 * when we hit a fatal error.
+		 *
+		 * Note: conn->gensec is already cleared
+		 * for the LDAP_SUCCESS case.
+		 */
+		talloc_unlink(conn, conn->gensec);
+		conn->gensec = NULL;
+	}
+
+	resp->response.resultcode = result;
+	resp->response.dn = NULL;
+	resp->response.errormessage = errstr;
+	resp->response.referral = NULL;
+
+	ldapsrv_queue_reply(call, reply);
+	return NT_STATUS_OK;
+}
+
+static void ldapsrv_BindSASL_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_call *call =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_call);
+	struct ldapsrv_bind_wait_context *bind_wait =
+		talloc_get_type_abort(call->wait_private,
+		struct ldapsrv_bind_wait_context);
+	struct ldap_BindRequest *req = &call->request->r.BindRequest;
+	struct ldapsrv_reply *reply = bind_wait->reply;
+	struct ldap_BindResponse *resp = &reply->msg->r.BindResponse;
+	struct ldapsrv_connection *conn = call->conn;
+	struct auth_session_info *session_info = NULL;
+	struct ldapsrv_sasl_postprocess_context *context = NULL;
+	NTSTATUS status;
+	int result;
+	const char *errstr = NULL;
+	DATA_BLOB output = data_blob_null;
+
+	status = gensec_update_recv(subreq, call, &output);
+	TALLOC_FREE(subreq);
+
+	if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
+		*resp->SASL.secblob = output;
+		result = LDAP_SASL_BIND_IN_PROGRESS;
+		errstr = NULL;
+		goto do_reply;
+	}
+
+	if (!NT_STATUS_IS_OK(status)) {
+		status = nt_status_squash(status);
+		result = LDAP_INVALID_CREDENTIALS;
+		errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_LOGON_DENIED,
+						0x0C0904DC, status);
+		goto do_reply;
+	}
+
+	if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
+	    gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
+
+		context = talloc_zero(call, struct ldapsrv_sasl_postprocess_context);
+		if (context == NULL) {
+			ldapsrv_bind_wait_finished(call, NT_STATUS_NO_MEMORY);
+			return;
+		}
+	}
+
+	if (context && conn->sockets.tls) {
+		TALLOC_FREE(context);
+		status = NT_STATUS_NOT_SUPPORTED;
+		result = LDAP_UNWILLING_TO_PERFORM;
+		errstr = talloc_asprintf(reply,
+					 "SASL:[%s]: Sign or Seal are not allowed if TLS is used",
+					 req->creds.SASL.mechanism);
+		goto do_reply;
+	}
+
+	if (context && conn->sockets.sasl) {
+		TALLOC_FREE(context);
+		status = NT_STATUS_NOT_SUPPORTED;
+		result = LDAP_UNWILLING_TO_PERFORM;
+		errstr = talloc_asprintf(reply,
+					 "SASL:[%s]: Sign or Seal are not allowed if SASL encryption has already been set up",
+					 req->creds.SASL.mechanism);
+		goto do_reply;
+	}
+
+	if (context == NULL) {
+		switch (call->conn->require_strong_auth) {
+		case LDAP_SERVER_REQUIRE_STRONG_AUTH_NO:
+			break;
+		case LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS:
+			if (call->conn->sockets.active == call->conn->sockets.tls) {
+				break;
+			}
+			status = NT_STATUS_NETWORK_ACCESS_DENIED;
+			result = LDAP_STRONG_AUTH_REQUIRED;
+			errstr = talloc_asprintf(reply,
+					"SASL:[%s]: not allowed if TLS is used.",
+					 req->creds.SASL.mechanism);
+			goto do_reply;
+
+		case LDAP_SERVER_REQUIRE_STRONG_AUTH_YES:
+			status = NT_STATUS_NETWORK_ACCESS_DENIED;
+			result = LDAP_STRONG_AUTH_REQUIRED;
+			errstr = talloc_asprintf(reply,
+					 "SASL:[%s]: Sign or Seal are required.",
+					 req->creds.SASL.mechanism);
+			goto do_reply;
+		}
+	}
+
+	if (context != NULL) {
+		context->conn = conn;
+		status = gensec_create_tstream(context,
+					       context->conn->gensec,
+					       context->conn->sockets.raw,
+					       &context->sasl);
+		if (!NT_STATUS_IS_OK(status)) {
+			result = LDAP_OPERATIONS_ERROR;
+			errstr = talloc_asprintf(reply,
+					 "SASL:[%s]: Failed to setup SASL socket: %s",
+					 req->creds.SASL.mechanism, nt_errstr(status));
+			goto do_reply;
+		}
+	}
+
+	status = gensec_session_info(conn->gensec, call, &session_info);
+	if (!NT_STATUS_IS_OK(status)) {
+		result = LDAP_OPERATIONS_ERROR;
+		errstr = talloc_asprintf(reply,
+					 "SASL:[%s]: Failed to get session info: %s",
+					 req->creds.SASL.mechanism, nt_errstr(status));
+		goto do_reply;
+	}
+
+	talloc_unlink(conn, conn->session_info);
+	conn->session_info = talloc_steal(conn, session_info);
+
+	/* don't leak the old LDB */
+	talloc_unlink(conn, conn->ldb);
+
+	call->conn->authz_logged = true;
+
+	status = ldapsrv_backend_Init(conn);
+
+	if (!NT_STATUS_IS_OK(status)) {
+		result = LDAP_OPERATIONS_ERROR;
+		errstr = talloc_asprintf(reply,
+					 "SASL:[%s]: Failed to advise samdb of new credentials: %s",
+					 req->creds.SASL.mechanism,
+					 nt_errstr(status));
+		goto do_reply;
+	}
+
+	if (context != NULL) {
+		const void *ptr = NULL;
+
+		ptr = talloc_reparent(conn, context->sasl, conn->gensec);
+		if (ptr == NULL) {
+			ldapsrv_bind_wait_finished(call, NT_STATUS_NO_MEMORY);
+			return;
+		}
+
+		call->postprocess_send = ldapsrv_sasl_postprocess_send;
+		call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
+		call->postprocess_private = context;
+	} else {
+		talloc_unlink(conn, conn->gensec);
+	}
+	conn->gensec = NULL;
+
+	*resp->SASL.secblob = output;
+	result = LDAP_SUCCESS;
+	errstr = NULL;
+
+do_reply:
+	if (result != LDAP_SASL_BIND_IN_PROGRESS) {
+		/*
+		 * We should destroy the gensec context
+		 * when we hit a fatal error.
+		 *
+		 * Note: conn->gensec is already cleared
+		 * for the LDAP_SUCCESS case.
+		 */
+		talloc_unlink(conn, conn->gensec);
+		conn->gensec = NULL;
+	}
+
+	resp->response.resultcode = result;
+	resp->response.dn = NULL;
+	resp->response.errormessage = errstr;
+	resp->response.referral = NULL;
+
+	ldapsrv_queue_reply(call, reply);
+	ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
+}
+
+NTSTATUS ldapsrv_BindRequest(struct ldapsrv_call *call)
+{
+	struct ldap_BindRequest *req = &call->request->r.BindRequest;
+	struct ldapsrv_reply *reply;
+	struct ldap_BindResponse *resp;
+
+	if (call->conn->pending_calls != NULL) {
+		reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
+		if (!reply) {
+			return NT_STATUS_NO_MEMORY;
+		}
+
+		resp = &reply->msg->r.BindResponse;
+		resp->response.resultcode = LDAP_BUSY;
+		resp->response.dn = NULL;
+		resp->response.errormessage = talloc_asprintf(reply, "Pending requests on this LDAP session");
+		resp->response.referral = NULL;
+		resp->SASL.secblob = NULL;
+
+		ldapsrv_queue_reply(call, reply);
+		return NT_STATUS_OK;
+	}
+
+	/* 
+	 * TODO: a simple bind should cancel an
+	 *       inprogress SASL bind.
+	 *       (see RFC 4513)
+	 */
+	switch (req->mechanism) {
+		case LDAP_AUTH_MECH_SIMPLE:
+			return ldapsrv_BindSimple(call);
+		case LDAP_AUTH_MECH_SASL:
+			return ldapsrv_BindSASL(call);
+	}
+
+	reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
+	if (!reply) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	resp = &reply->msg->r.BindResponse;
+	resp->response.resultcode = LDAP_AUTH_METHOD_NOT_SUPPORTED;
+	resp->response.dn = NULL;
+	resp->response.errormessage = talloc_asprintf(reply, "Bad AuthenticationChoice [%d]", req->mechanism);
+	resp->response.referral = NULL;
+	resp->SASL.secblob = NULL;
+
+	ldapsrv_queue_reply(call, reply);
+	return NT_STATUS_OK;
+}
+
+struct ldapsrv_unbind_wait_context {
+	uint8_t dummy;
+};
+
+struct ldapsrv_unbind_wait_state {
+	uint8_t dummy;
+};
+
+static struct tevent_req *ldapsrv_unbind_wait_send(TALLOC_CTX *mem_ctx,
+						 struct tevent_context *ev,
+						 void *private_data)
+{
+	struct ldapsrv_unbind_wait_context *unbind_wait =
+		talloc_get_type_abort(private_data,
+		struct ldapsrv_unbind_wait_context);
+	struct tevent_req *req;
+	struct ldapsrv_unbind_wait_state *state;
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct ldapsrv_unbind_wait_state);
+	if (req == NULL) {
+		return NULL;
+	}
+
+	(void)unbind_wait;
+
+	tevent_req_nterror(req, NT_STATUS_LOCAL_DISCONNECT);
+	return tevent_req_post(req, ev);
+}
+
+static NTSTATUS ldapsrv_unbind_wait_recv(struct tevent_req *req)
+{
+	return tevent_req_simple_recv_ntstatus(req);
+}
+
+static NTSTATUS ldapsrv_unbind_wait_setup(struct ldapsrv_call *call)
+{
+	struct ldapsrv_unbind_wait_context *unbind_wait = NULL;
+
+	if (call->wait_private != NULL) {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	unbind_wait = talloc_zero(call, struct ldapsrv_unbind_wait_context);
+	if (unbind_wait == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	call->wait_private = unbind_wait;
+	call->wait_send = ldapsrv_unbind_wait_send;
+	call->wait_recv = ldapsrv_unbind_wait_recv;
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ldapsrv_UnbindRequest(struct ldapsrv_call *call)
+{
+	struct ldapsrv_call *c = NULL;
+	struct ldapsrv_call *n = NULL;
+
+	DEBUG(10, ("UnbindRequest\n"));
+
+	for (c = call->conn->pending_calls; c != NULL; c = n) {
+		n = c->next;
+
+		DLIST_REMOVE(call->conn->pending_calls, c);
+		TALLOC_FREE(c);
+	}
+
+	return ldapsrv_unbind_wait_setup(call);
+}
diff --git a/source4/ldap_server/ldap_extended.c b/source4/ldap_server/ldap_extended.c
 new file mode 100644
index 0000000..2d4a534
--- /dev/null
+++ b/source4/ldap_server/ldap_extended.c
@@ -0,0 +1,215 @@
+/* 
+   Unix SMB/CIFS implementation.
+   LDAP server
+   Copyright (C) Stefan Metzmacher 2004
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "ldap_server/ldap_server.h"
+#include "../lib/util/dlinklist.h"
+#include "lib/tls/tls.h"
+#include "smbd/service_stream.h"
+#include "../lib/util/tevent_ntstatus.h"
+
+struct ldapsrv_starttls_postprocess_context {
+	struct ldapsrv_connection *conn;
+};
+
+struct ldapsrv_starttls_postprocess_state {
+	struct ldapsrv_connection *conn;
+};
+
+static void ldapsrv_starttls_postprocess_done(struct tevent_req *subreq);
+
+static struct tevent_req *ldapsrv_starttls_postprocess_send(TALLOC_CTX *mem_ctx,
+						struct tevent_context *ev,
+						void *private_data)
+{
+	struct ldapsrv_starttls_postprocess_context *context =
+		talloc_get_type_abort(private_data,
+		struct ldapsrv_starttls_postprocess_context);
+	struct ldapsrv_connection *conn = context->conn;
+	struct tevent_req *req;
+	struct ldapsrv_starttls_postprocess_state *state;
+	struct tevent_req *subreq;
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct ldapsrv_starttls_postprocess_state);
+	if (req == NULL) {
+		return NULL;
+	}
+
+	state->conn = conn;
+
+	subreq = tstream_tls_accept_send(conn,
+					 conn->connection->event.ctx,
+					 conn->sockets.raw,
+					 conn->service->tls_params);
+	if (tevent_req_nomem(subreq, req)) {
+		return tevent_req_post(req, ev);
+	}
+	tevent_req_set_callback(subreq, ldapsrv_starttls_postprocess_done, req);
+
+	return req;
+}
+
+static void ldapsrv_starttls_postprocess_done(struct tevent_req *subreq)
+{
+	struct tevent_req *req =
+		tevent_req_callback_data(subreq,
+		struct tevent_req);
+	struct ldapsrv_starttls_postprocess_state *state =
+		tevent_req_data(req,
+		struct ldapsrv_starttls_postprocess_state);
+	struct ldapsrv_connection *conn = state->conn;
+	int ret;
+	int sys_errno;
+
+	ret = tstream_tls_accept_recv(subreq, &sys_errno,
+				      conn, &conn->sockets.tls);
+	TALLOC_FREE(subreq);
+	if (ret == -1) {
+		NTSTATUS status = map_nt_error_from_unix_common(sys_errno);
+
+		DEBUG(1,("ldapsrv_starttls_postprocess_done: accept_tls_loop: "
+			 "tstream_tls_accept_recv() - %d:%s => %s",
+			 sys_errno, strerror(sys_errno), nt_errstr(status)));
+
+		tevent_req_nterror(req, status);
+		return;
+	}
+
+	conn->sockets.active = conn->sockets.tls;
+
+	tevent_req_done(req);
+}
+
+static NTSTATUS ldapsrv_starttls_postprocess_recv(struct tevent_req *req)
+{
+	return tevent_req_simple_recv_ntstatus(req);
+}
+
+static NTSTATUS ldapsrv_StartTLS(struct ldapsrv_call *call,
+				 struct ldapsrv_reply *reply,
+				 const char **errstr)
+{
+	struct ldapsrv_starttls_postprocess_context *context;
+
+	(*errstr) = NULL;
+
+	/*
+	 * TODO: give LDAP_OPERATIONS_ERROR also when
+	 *       there's a SASL bind in progress
+	 *       (see rfc4513 section 3.1.1)
+	 */
+	if (call->conn->sockets.tls) {
+		(*errstr) = talloc_asprintf(reply, "START-TLS: TLS is already enabled on this LDAP session");
+		return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
+	}
+
+	if (call->conn->sockets.sasl) {
+		(*errstr) = talloc_asprintf(reply, "START-TLS: SASL is already enabled on this LDAP session");
+		return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
+	}
+
+	if (call->conn->pending_calls != NULL) {
+		(*errstr) = talloc_asprintf(reply, "START-TLS: pending requests on this LDAP session");
+		return NT_STATUS_LDAP(LDAP_BUSY);
+	}
+
+	context = talloc(call, struct ldapsrv_starttls_postprocess_context);
+	NT_STATUS_HAVE_NO_MEMORY(context);
+
+	context->conn = call->conn;
+
+	call->postprocess_send = ldapsrv_starttls_postprocess_send;
+	call->postprocess_recv = ldapsrv_starttls_postprocess_recv;
+	call->postprocess_private = context;
+
+	reply->msg->r.ExtendedResponse.response.resultcode = LDAP_SUCCESS;
+	reply->msg->r.ExtendedResponse.response.errormessage = NULL;
+
+	ldapsrv_queue_reply(call, reply);
+	return NT_STATUS_OK;
+}
+
+struct ldapsrv_extended_operation {
+	const char *oid;
+	NTSTATUS (*fn)(struct ldapsrv_call *call, struct ldapsrv_reply *reply, const char **errorstr);
+};
+
+static struct ldapsrv_extended_operation extended_ops[] = {
+	{
+		.oid	= LDB_EXTENDED_START_TLS_OID,
+		.fn	= ldapsrv_StartTLS,
+	},{
+		.oid	= NULL,
+		.fn	= NULL,
+	}
+};
+
+NTSTATUS ldapsrv_ExtendedRequest(struct ldapsrv_call *call)
+{
+	struct ldap_ExtendedRequest *req = &call->request->r.ExtendedRequest;
+	struct ldapsrv_reply *reply;
+	int result = LDAP_PROTOCOL_ERROR;
+	const char *error_str = NULL;
+	NTSTATUS status = NT_STATUS_OK;
+	unsigned int i;
+
+	DEBUG(10, ("Extended\n"));
+
+	reply = ldapsrv_init_reply(call, LDAP_TAG_ExtendedResponse);
+	NT_STATUS_HAVE_NO_MEMORY(reply);
+ 
+ 	ZERO_STRUCT(reply->msg->r);
+	reply->msg->r.ExtendedResponse.oid = talloc_steal(reply, req->oid);
+	reply->msg->r.ExtendedResponse.response.resultcode = LDAP_PROTOCOL_ERROR;
+	reply->msg->r.ExtendedResponse.response.errormessage = NULL;
+ 
+	for (i=0; extended_ops[i].oid; i++) {
+		if (strcmp(extended_ops[i].oid,req->oid) != 0) continue;
+ 
+		/* 
+		 * if the backend function returns an error we
+		 * need to send the reply otherwise the reply is already
+		 * send and we need to return directly
+		 */
+		status = extended_ops[i].fn(call, reply, &error_str);
+		if (NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+ 
+		if (NT_STATUS_IS_LDAP(status)) {
+			result = NT_STATUS_LDAP_CODE(status);
+		} else {
+ 			result = LDAP_OPERATIONS_ERROR;
+			error_str = talloc_asprintf(reply, "Extended Operation(%s) failed: %s",
+						    req->oid, nt_errstr(status));
+ 		}
+ 	}
+	/* if we haven't found the oid, then status is still NT_STATUS_OK */
+	if (NT_STATUS_IS_OK(status)) {
+		error_str = talloc_asprintf(reply, "Extended Operation(%s) not supported",
+					    req->oid);
+	}
+ 
+	reply->msg->r.ExtendedResponse.response.resultcode = result;
+	reply->msg->r.ExtendedResponse.response.errormessage = error_str;
+ 
+ 	ldapsrv_queue_reply(call, reply);
+ 	return NT_STATUS_OK;
+}
diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c
 new file mode 100644
index 0000000..d9f24e0
--- /dev/null
+++ b/source4/ldap_server/ldap_server.c
@@ -0,0 +1,1259 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   LDAP server
+
+   Copyright (C) Andrew Tridgell 2005
+   Copyright (C) Volker Lendecke 2004
+   Copyright (C) Stefan Metzmacher 2004
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "system/network.h"
+#include "lib/events/events.h"
+#include "auth/auth.h"
+#include "auth/credentials/credentials.h"
+#include "librpc/gen_ndr/ndr_samr.h"
+#include "../lib/util/dlinklist.h"
+#include "../lib/util/asn1.h"
+#include "ldap_server/ldap_server.h"
+#include "smbd/service_task.h"
+#include "smbd/service_stream.h"
+#include "smbd/service.h"
+#include "smbd/process_model.h"
+#include "lib/tls/tls.h"
+#include "lib/messaging/irpc.h"
+#include <ldb.h>
+#include <ldb_errors.h>
+#include "libcli/ldap/ldap_proto.h"
+#include "system/network.h"
+#include "lib/socket/netif.h"
+#include "dsdb/samdb/samdb.h"
+#include "param/param.h"
+#include "../lib/tsocket/tsocket.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "../libcli/util/tstream.h"
+#include "libds/common/roles.h"
+
+static void ldapsrv_terminate_connection_done(struct tevent_req *subreq);
+
+/*
+  close the socket and shutdown a server_context
+*/
+static void ldapsrv_terminate_connection(struct ldapsrv_connection *conn,
+					 const char *reason)
+{
+	struct tevent_req *subreq;
+
+	if (conn->limits.reason) {
+		return;
+	}
+
+	DLIST_REMOVE(conn->service->connections, conn);
+
+	conn->limits.endtime = timeval_current_ofs(0, 500);
+
+	tevent_queue_stop(conn->sockets.send_queue);
+	TALLOC_FREE(conn->sockets.read_req);
+	if (conn->active_call) {
+		tevent_req_cancel(conn->active_call);
+		conn->active_call = NULL;
+	}
+
+	conn->limits.reason = talloc_strdup(conn, reason);
+	if (conn->limits.reason == NULL) {
+		TALLOC_FREE(conn->sockets.tls);
+		TALLOC_FREE(conn->sockets.sasl);
+		TALLOC_FREE(conn->sockets.raw);
+		stream_terminate_connection(conn->connection, reason);
+		return;
+	}
+
+	subreq = tstream_disconnect_send(conn,
+					 conn->connection->event.ctx,
+					 conn->sockets.active);
+	if (subreq == NULL) {
+		TALLOC_FREE(conn->sockets.tls);
+		TALLOC_FREE(conn->sockets.sasl);
+		TALLOC_FREE(conn->sockets.raw);
+		stream_terminate_connection(conn->connection, reason);
+		return;
+	}
+	tevent_req_set_endtime(subreq,
+			       conn->connection->event.ctx,
+			       conn->limits.endtime);
+	tevent_req_set_callback(subreq, ldapsrv_terminate_connection_done, conn);
+}
+
+static void ldapsrv_terminate_connection_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_connection *conn =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_connection);
+	int sys_errno;
+
+	tstream_disconnect_recv(subreq, &sys_errno);
+	TALLOC_FREE(subreq);
+
+	if (conn->sockets.active == conn->sockets.raw) {
+		TALLOC_FREE(conn->sockets.tls);
+		TALLOC_FREE(conn->sockets.sasl);
+		TALLOC_FREE(conn->sockets.raw);
+		stream_terminate_connection(conn->connection,
+					    conn->limits.reason);
+		return;
+	}
+
+	TALLOC_FREE(conn->sockets.tls);
+	TALLOC_FREE(conn->sockets.sasl);
+	conn->sockets.active = conn->sockets.raw;
+
+	subreq = tstream_disconnect_send(conn,
+					 conn->connection->event.ctx,
+					 conn->sockets.active);
+	if (subreq == NULL) {
+		TALLOC_FREE(conn->sockets.raw);
+		stream_terminate_connection(conn->connection,
+					    conn->limits.reason);
+		return;
+	}
+	tevent_req_set_endtime(subreq,
+			       conn->connection->event.ctx,
+			       conn->limits.endtime);
+	tevent_req_set_callback(subreq, ldapsrv_terminate_connection_done, conn);
+}
+
+/*
+  called when a LDAP socket becomes readable
+*/
+void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
+{
+	smb_panic(__location__);
+}
+
+/*
+  called when a LDAP socket becomes writable
+*/
+static void ldapsrv_send(struct stream_connection *c, uint16_t flags)
+{
+	smb_panic(__location__);
+}
+
+static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
+{
+	TALLOC_CTX *tmp_ctx;
+	const char *attrs[] = { "configurationNamingContext", NULL };
+	const char *attrs2[] = { "lDAPAdminLimits", NULL };
+	struct ldb_message_element *el;
+	struct ldb_result *res = NULL;
+	struct ldb_dn *basedn;
+	struct ldb_dn *conf_dn;
+	struct ldb_dn *policy_dn;
+	unsigned int i;
+	int ret;
+
+	/* set defaults limits in case of failure */
+	conn->limits.initial_timeout = 120;
+	conn->limits.conn_idle_time = 900;
+	conn->limits.max_page_size = 1000;
+	conn->limits.max_notifications = 5;
+	conn->limits.search_timeout = 120;
+
+
+	tmp_ctx = talloc_new(conn);
+	if (tmp_ctx == NULL) {
+		return -1;
+	}
+
+	basedn = ldb_dn_new(tmp_ctx, conn->ldb, NULL);
+	if (basedn == NULL) {
+		goto failed;
+	}
+
+	ret = ldb_search(conn->ldb, tmp_ctx, &res, basedn, LDB_SCOPE_BASE, attrs, NULL);
+	if (ret != LDB_SUCCESS) {
+		goto failed;
+	}
+
+	if (res->count != 1) {
+		goto failed;
+	}
+
+	conf_dn = ldb_msg_find_attr_as_dn(conn->ldb, tmp_ctx, res->msgs[0], "configurationNamingContext");
+	if (conf_dn == NULL) {
+		goto failed;
+	}
+
+	policy_dn = ldb_dn_copy(tmp_ctx, conf_dn);
+	ldb_dn_add_child_fmt(policy_dn, "CN=Default Query Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services");
+	if (policy_dn == NULL) {
+		goto failed;
+	}
+
+	ret = ldb_search(conn->ldb, tmp_ctx, &res, policy_dn, LDB_SCOPE_BASE, attrs2, NULL);
+	if (ret != LDB_SUCCESS) {
+		goto failed;
+	}
+
+	if (res->count != 1) {
+		goto failed;
+	}
+
+	el = ldb_msg_find_element(res->msgs[0], "lDAPAdminLimits");
+	if (el == NULL) {
+		goto failed;
+	}
+
+	for (i = 0; i < el->num_values; i++) {
+		char policy_name[256];
+		int policy_value, s;
+
+		s = sscanf((const char *)el->values[i].data, "%255[^=]=%d", policy_name, &policy_value);
+		if (s != 2 || policy_value == 0)
+			continue;
+		if (strcasecmp("InitRecvTimeout", policy_name) == 0) {
+			conn->limits.initial_timeout = policy_value;
+			continue;
+		}
+		if (strcasecmp("MaxConnIdleTime", policy_name) == 0) {
+			conn->limits.conn_idle_time = policy_value;
+			continue;
+		}
+		if (strcasecmp("MaxPageSize", policy_name) == 0) {
+			conn->limits.max_page_size = policy_value;
+			continue;
+		}
+		if (strcasecmp("MaxNotificationPerConn", policy_name) == 0) {
+			conn->limits.max_notifications = policy_value;
+			continue;
+		}
+		if (strcasecmp("MaxQueryDuration", policy_name) == 0) {
+			conn->limits.search_timeout = policy_value;
+			continue;
+		}
+	}
+
+	return 0;
+
+failed:
+	DEBUG(0, ("Failed to load ldap server query policies\n"));
+	talloc_free(tmp_ctx);
+	return -1;
+}
+
+static int ldapsrv_call_destructor(struct ldapsrv_call *call)
+{
+	if (call->conn == NULL) {
+		return 0;
+	}
+
+	DLIST_REMOVE(call->conn->pending_calls, call);
+
+	call->conn = NULL;
+	return 0;
+}
+
+static struct tevent_req *ldapsrv_process_call_send(TALLOC_CTX *mem_ctx,
+						    struct tevent_context *ev,
+						    struct tevent_queue *call_queue,
+						    struct ldapsrv_call *call);
+static NTSTATUS ldapsrv_process_call_recv(struct tevent_req *req);
+
+static bool ldapsrv_call_read_next(struct ldapsrv_connection *conn);
+static void ldapsrv_accept_tls_done(struct tevent_req *subreq);
+
+/*
+  initialise a server_context from a open socket and register a event handler
+  for reading from that socket
+*/
+static void ldapsrv_accept(struct stream_connection *c,
+			   struct auth_session_info *session_info,
+			   bool is_privileged)
+{
+	struct ldapsrv_service *ldapsrv_service = 
+		talloc_get_type(c->private_data, struct ldapsrv_service);
+	struct ldapsrv_connection *conn;
+	struct cli_credentials *server_credentials;
+	struct socket_address *socket_address;
+	NTSTATUS status;
+	int port;
+	int ret;
+	struct tevent_req *subreq;
+	struct timeval endtime;
+
+	conn = talloc_zero(c, struct ldapsrv_connection);
+	if (!conn) {
+		stream_terminate_connection(c, "ldapsrv_accept: out of memory");
+		return;
+	}
+	conn->is_privileged = is_privileged;
+
+	conn->sockets.send_queue = tevent_queue_create(conn, "ldapsev send queue");
+	if (conn->sockets.send_queue == NULL) {
+		stream_terminate_connection(c,
+					    "ldapsrv_accept: tevent_queue_create failed");
+		return;
+	}
+
+	TALLOC_FREE(c->event.fde);
+
+	ret = tstream_bsd_existing_socket(conn,
+					  socket_get_fd(c->socket),
+					  &conn->sockets.raw);
+	if (ret == -1) {
+		stream_terminate_connection(c,
+					    "ldapsrv_accept: out of memory");
+		return;
+	}
+	socket_set_flags(c->socket, SOCKET_FLAG_NOCLOSE);
+
+	conn->connection  = c;
+	conn->service     = ldapsrv_service;
+	conn->lp_ctx      = ldapsrv_service->task->lp_ctx;
+
+	c->private_data   = conn;
+
+	socket_address = socket_get_my_addr(c->socket, conn);
+	if (!socket_address) {
+		ldapsrv_terminate_connection(conn, "ldapsrv_accept: failed to obtain local socket address!");
+		return;
+	}
+	port = socket_address->port;
+	talloc_free(socket_address);
+	if (port == 3268 || port == 3269) /* Global catalog */ {
+		conn->global_catalog = true;
+	}
+
+	server_credentials = cli_credentials_init(conn);
+	if (!server_credentials) {
+		stream_terminate_connection(c, "Failed to init server credentials\n");
+		return;
+	}
+
+	cli_credentials_set_conf(server_credentials, conn->lp_ctx);
+	status = cli_credentials_set_machine_account(server_credentials, conn->lp_ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		stream_terminate_connection(c, talloc_asprintf(conn, "Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(status)));
+		return;
+	}
+	conn->server_credentials = server_credentials;
+
+	conn->session_info = session_info;
+
+	conn->sockets.active = conn->sockets.raw;
+
+	if (conn->is_privileged) {
+		conn->require_strong_auth = LDAP_SERVER_REQUIRE_STRONG_AUTH_NO;
+	} else {
+		conn->require_strong_auth = lpcfg_ldap_server_require_strong_auth(conn->lp_ctx);
+	}
+
+	if (!NT_STATUS_IS_OK(ldapsrv_backend_Init(conn))) {
+		ldapsrv_terminate_connection(conn, "backend Init failed");
+		return;
+	}
+
+	/* load limits from the conf partition */
+	ldapsrv_load_limits(conn); /* should we fail on error ? */
+
+	/* register the server */	
+	irpc_add_name(c->msg_ctx, "ldap_server");
+
+	DLIST_ADD_END(ldapsrv_service->connections, conn);
+
+	if (port != 636 && port != 3269) {
+		ldapsrv_call_read_next(conn);
+		return;
+	}
+
+	endtime = timeval_current_ofs(conn->limits.conn_idle_time, 0);
+
+	subreq = tstream_tls_accept_send(conn,
+					 conn->connection->event.ctx,
+					 conn->sockets.raw,
+					 conn->service->tls_params);
+	if (subreq == NULL) {
+		ldapsrv_terminate_connection(conn, "ldapsrv_accept: "
+				"no memory for tstream_tls_accept_send");
+		return;
+	}
+	tevent_req_set_endtime(subreq,
+			       conn->connection->event.ctx,
+			       endtime);
+	tevent_req_set_callback(subreq, ldapsrv_accept_tls_done, conn);
+}
+
+static void ldapsrv_accept_tls_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_connection *conn =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_connection);
+	int ret;
+	int sys_errno;
+
+	ret = tstream_tls_accept_recv(subreq, &sys_errno,
+				      conn, &conn->sockets.tls);
+	TALLOC_FREE(subreq);
+	if (ret == -1) {
+		const char *reason;
+
+		reason = talloc_asprintf(conn, "ldapsrv_accept_tls_loop: "
+					 "tstream_tls_accept_recv() - %d:%s",
+					 sys_errno, strerror(sys_errno));
+		if (!reason) {
+			reason = "ldapsrv_accept_tls_loop: "
+				 "tstream_tls_accept_recv() - failed";
+		}
+
+		ldapsrv_terminate_connection(conn, reason);
+		return;
+	}
+
+	conn->sockets.active = conn->sockets.tls;
+	ldapsrv_call_read_next(conn);
+}
+
+static void ldapsrv_call_read_done(struct tevent_req *subreq);
+
+static bool ldapsrv_call_read_next(struct ldapsrv_connection *conn)
+{
+	struct tevent_req *subreq;
+
+	if (conn->pending_calls != NULL) {
+		conn->limits.endtime = timeval_zero();
+
+		ldapsrv_notification_retry_setup(conn->service, false);
+	} else if (timeval_is_zero(&conn->limits.endtime)) {
+		conn->limits.endtime =
+			timeval_current_ofs(conn->limits.initial_timeout, 0);
+	} else {
+		conn->limits.endtime =
+			timeval_current_ofs(conn->limits.conn_idle_time, 0);
+	}
+
+	if (conn->sockets.read_req != NULL) {
+		return true;
+	}
+
+	/*
+	 * The minimum size of a LDAP pdu is 7 bytes
+	 *
+	 * dumpasn1 -hh ldap-unbind-min.dat
+	 *
+	 *     <30 05 02 01 09 42 00>
+	 *    0    5: SEQUENCE {
+	 *     <02 01 09>
+	 *    2    1:   INTEGER 9
+	 *     <42 00>
+	 *    5    0:   [APPLICATION 2]
+	 *          :     Error: Object has zero length.
+	 *          :   }
+	 *
+	 * dumpasn1 -hh ldap-unbind-windows.dat
+	 *
+	 *     <30 84 00 00 00 05 02 01 09 42 00>
+	 *    0    5: SEQUENCE {
+	 *     <02 01 09>
+	 *    6    1:   INTEGER 9
+	 *     <42 00>
+	 *    9    0:   [APPLICATION 2]
+	 *          :     Error: Object has zero length.
+	 *          :   }
+	 *
+	 * This means using an initial read size
+	 * of 7 is ok.
+	 */
+	subreq = tstream_read_pdu_blob_send(conn,
+					    conn->connection->event.ctx,
+					    conn->sockets.active,
+					    7, /* initial_read_size */
+					    ldap_full_packet,
+					    conn);
+	if (subreq == NULL) {
+		ldapsrv_terminate_connection(conn, "ldapsrv_call_read_next: "
+				"no memory for tstream_read_pdu_blob_send");
+		return false;
+	}
+	if (!timeval_is_zero(&conn->limits.endtime)) {
+		tevent_req_set_endtime(subreq,
+				       conn->connection->event.ctx,
+				       conn->limits.endtime);
+	}
+	tevent_req_set_callback(subreq, ldapsrv_call_read_done, conn);
+	conn->sockets.read_req = subreq;
+	return true;
+}
+
+static void ldapsrv_call_process_done(struct tevent_req *subreq);
+
+static void ldapsrv_call_read_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_connection *conn =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_connection);
+	NTSTATUS status;
+	struct ldapsrv_call *call;
+	struct asn1_data *asn1;
+	DATA_BLOB blob;
+
+	conn->sockets.read_req = NULL;
+
+	call = talloc_zero(conn, struct ldapsrv_call);
+	if (!call) {
+		ldapsrv_terminate_connection(conn, "no memory");
+		return;
+	}
+	talloc_set_destructor(call, ldapsrv_call_destructor);
+
+	call->conn = conn;
+
+	status = tstream_read_pdu_blob_recv(subreq,
+					    call,
+					    &blob);
+	TALLOC_FREE(subreq);
+	if (!NT_STATUS_IS_OK(status)) {
+		const char *reason;
+
+		reason = talloc_asprintf(call, "ldapsrv_call_loop: "
+					 "tstream_read_pdu_blob_recv() - %s",
+					 nt_errstr(status));
+		if (!reason) {
+			reason = nt_errstr(status);
+		}
+
+		ldapsrv_terminate_connection(conn, reason);
+		return;
+	}
+
+	asn1 = asn1_init(call);
+	if (asn1 == NULL) {
+		ldapsrv_terminate_connection(conn, "no memory");
+		return;
+	}
+
+	call->request = talloc(call, struct ldap_message);
+	if (call->request == NULL) {
+		ldapsrv_terminate_connection(conn, "no memory");
+		return;
+	}
+
+	if (!asn1_load(asn1, blob)) {
+		ldapsrv_terminate_connection(conn, "asn1_load failed");
+		return;
+	}
+
+	status = ldap_decode(asn1, samba_ldap_control_handlers(),
+			     call->request);
+	if (!NT_STATUS_IS_OK(status)) {
+		ldapsrv_terminate_connection(conn, nt_errstr(status));
+		return;
+	}
+
+	data_blob_free(&blob);
+
+
+	/* queue the call in the global queue */
+	subreq = ldapsrv_process_call_send(call,
+					   conn->connection->event.ctx,
+					   conn->service->call_queue,
+					   call);
+	if (subreq == NULL) {
+		ldapsrv_terminate_connection(conn, "ldapsrv_process_call_send failed");
+		return;
+	}
+	tevent_req_set_callback(subreq, ldapsrv_call_process_done, call);
+	conn->active_call = subreq;
+}
+
+static void ldapsrv_call_wait_done(struct tevent_req *subreq);
+static void ldapsrv_call_writev_start(struct ldapsrv_call *call);
+static void ldapsrv_call_writev_done(struct tevent_req *subreq);
+
+static void ldapsrv_call_process_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_call *call =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_call);
+	struct ldapsrv_connection *conn = call->conn;
+	NTSTATUS status;
+
+	conn->active_call = NULL;
+
+	status = ldapsrv_process_call_recv(subreq);
+	TALLOC_FREE(subreq);
+	if (!NT_STATUS_IS_OK(status)) {
+		ldapsrv_terminate_connection(conn, nt_errstr(status));
+		return;
+	}
+
+	if (call->wait_send != NULL) {
+		subreq = call->wait_send(call,
+					 conn->connection->event.ctx,
+					 call->wait_private);
+		if (subreq == NULL) {
+			ldapsrv_terminate_connection(conn,
+					"ldapsrv_call_process_done: "
+					"call->wait_send - no memory");
+			return;
+		}
+		tevent_req_set_callback(subreq,
+					ldapsrv_call_wait_done,
+					call);
+		conn->active_call = subreq;
+		return;
+	}
+
+	ldapsrv_call_writev_start(call);
+}
+
+static void ldapsrv_call_wait_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_call *call =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_call);
+	struct ldapsrv_connection *conn = call->conn;
+	NTSTATUS status;
+
+	conn->active_call = NULL;
+
+	status = call->wait_recv(subreq);
+	TALLOC_FREE(subreq);
+	if (!NT_STATUS_IS_OK(status)) {
+		const char *reason;
+
+		reason = talloc_asprintf(call, "ldapsrv_call_wait_done: "
+					 "call->wait_recv() - %s",
+					 nt_errstr(status));
+		if (reason == NULL) {
+			reason = nt_errstr(status);
+		}
+
+		ldapsrv_terminate_connection(conn, reason);
+		return;
+	}
+
+	ldapsrv_call_writev_start(call);
+}
+
+static void ldapsrv_call_writev_start(struct ldapsrv_call *call)
+{
+	struct ldapsrv_connection *conn = call->conn;
+	DATA_BLOB blob = data_blob_null;
+	struct tevent_req *subreq = NULL;
+
+	/* build all the replies into a single blob */
+	while (call->replies) {
+		DATA_BLOB b;
+		bool ret;
+
+		if (!ldap_encode(call->replies->msg, samba_ldap_control_handlers(), &b, call)) {
+			DEBUG(0,("Failed to encode ldap reply of type %d\n",
+				 call->replies->msg->type));
+			ldapsrv_terminate_connection(conn, "ldap_encode failed");
+			return;
+		}
+
+		ret = data_blob_append(call, &blob, b.data, b.length);
+		data_blob_free(&b);
+
+		talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet");
+
+		if (!ret) {
+			ldapsrv_terminate_connection(conn, "data_blob_append failed");
+			return;
+		}
+
+		DLIST_REMOVE(call->replies, call->replies);
+	}
+
+	if (blob.length == 0) {
+		if (!call->notification.busy) {
+			TALLOC_FREE(call);
+		}
+
+		ldapsrv_call_read_next(conn);
+		return;
+	}
+
+	call->out_iov.iov_base = blob.data;
+	call->out_iov.iov_len = blob.length;
+
+	subreq = tstream_writev_queue_send(call,
+					   conn->connection->event.ctx,
+					   conn->sockets.active,
+					   conn->sockets.send_queue,
+					   &call->out_iov, 1);
+	if (subreq == NULL) {
+		ldapsrv_terminate_connection(conn, "stream_writev_queue_send failed");
+		return;
+	}
+	tevent_req_set_callback(subreq, ldapsrv_call_writev_done, call);
+}
+
+static void ldapsrv_call_postprocess_done(struct tevent_req *subreq);
+
+static void ldapsrv_call_writev_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_call *call =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_call);
+	struct ldapsrv_connection *conn = call->conn;
+	int sys_errno;
+	int rc;
+
+	rc = tstream_writev_queue_recv(subreq, &sys_errno);
+	TALLOC_FREE(subreq);
+	if (rc == -1) {
+		const char *reason;
+
+		reason = talloc_asprintf(call, "ldapsrv_call_writev_done: "
+					 "tstream_writev_queue_recv() - %d:%s",
+					 sys_errno, strerror(sys_errno));
+		if (reason == NULL) {
+			reason = "ldapsrv_call_writev_done: "
+				 "tstream_writev_queue_recv() failed";
+		}
+
+		ldapsrv_terminate_connection(conn, reason);
+		return;
+	}
+
+	if (call->postprocess_send) {
+		subreq = call->postprocess_send(call,
+						conn->connection->event.ctx,
+						call->postprocess_private);
+		if (subreq == NULL) {
+			ldapsrv_terminate_connection(conn, "ldapsrv_call_writev_done: "
+					"call->postprocess_send - no memory");
+			return;
+		}
+		tevent_req_set_callback(subreq,
+					ldapsrv_call_postprocess_done,
+					call);
+		return;
+	}
+
+	if (!call->notification.busy) {
+		TALLOC_FREE(call);
+	}
+
+	ldapsrv_call_read_next(conn);
+}
+
+static void ldapsrv_call_postprocess_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_call *call =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_call);
+	struct ldapsrv_connection *conn = call->conn;
+	NTSTATUS status;
+
+	status = call->postprocess_recv(subreq);
+	TALLOC_FREE(subreq);
+	if (!NT_STATUS_IS_OK(status)) {
+		const char *reason;
+
+		reason = talloc_asprintf(call, "ldapsrv_call_postprocess_done: "
+					 "call->postprocess_recv() - %s",
+					 nt_errstr(status));
+		if (reason == NULL) {
+			reason = nt_errstr(status);
+		}
+
+		ldapsrv_terminate_connection(conn, reason);
+		return;
+	}
+
+	TALLOC_FREE(call);
+
+	ldapsrv_call_read_next(conn);
+}
+
+static void ldapsrv_notification_retry_done(struct tevent_req *subreq);
+
+void ldapsrv_notification_retry_setup(struct ldapsrv_service *service, bool force)
+{
+	struct ldapsrv_connection *conn = NULL;
+	struct timeval retry;
+	size_t num_pending = 0;
+	size_t num_active = 0;
+
+	if (force) {
+		TALLOC_FREE(service->notification.retry);
+		service->notification.generation += 1;
+	}
+
+	if (service->notification.retry != NULL) {
+		return;
+	}
+
+	for (conn = service->connections; conn != NULL; conn = conn->next) {
+		if (conn->pending_calls == NULL) {
+			continue;
+		}
+
+		num_pending += 1;
+
+		if (conn->pending_calls->notification.generation !=
+		    service->notification.generation)
+		{
+			num_active += 1;
+		}
+	}
+
+	if (num_pending == 0) {
+		return;
+	}
+
+	if (num_active != 0) {
+		retry = timeval_current_ofs(0, 100);
+	} else {
+		retry = timeval_current_ofs(5, 0);
+	}
+
+	service->notification.retry = tevent_wakeup_send(service,
+							 service->task->event_ctx,
+							 retry);
+	if (service->notification.retry == NULL) {
+		/* retry later */
+		return;
+	}
+
+	tevent_req_set_callback(service->notification.retry,
+				ldapsrv_notification_retry_done,
+				service);
+}
+
+static void ldapsrv_notification_retry_done(struct tevent_req *subreq)
+{
+	struct ldapsrv_service *service =
+		tevent_req_callback_data(subreq,
+		struct ldapsrv_service);
+	struct ldapsrv_connection *conn = NULL;
+	struct ldapsrv_connection *conn_next = NULL;
+	bool ok;
+
+	service->notification.retry = NULL;
+
+	ok = tevent_wakeup_recv(subreq);
+	TALLOC_FREE(subreq);
+	if (!ok) {
+		/* ignore */
+	}
+
+	for (conn = service->connections; conn != NULL; conn = conn_next) {
+		struct ldapsrv_call *call = conn->pending_calls;
+
+		conn_next = conn->next;
+
+		if (conn->pending_calls == NULL) {
+			continue;
+		}
+
+		if (conn->active_call != NULL) {
+			continue;
+		}
+
+		DLIST_DEMOTE(conn->pending_calls, call);
+		call->notification.generation =
+				service->notification.generation;
+
+		/* queue the call in the global queue */
+		subreq = ldapsrv_process_call_send(call,
+						   conn->connection->event.ctx,
+						   conn->service->call_queue,
+						   call);
+		if (subreq == NULL) {
+			ldapsrv_terminate_connection(conn,
+					"ldapsrv_process_call_send failed");
+			continue;
+		}
+		tevent_req_set_callback(subreq, ldapsrv_call_process_done, call);
+		conn->active_call = subreq;
+	}
+
+	ldapsrv_notification_retry_setup(service, false);
+}
+
+struct ldapsrv_process_call_state {
+	struct ldapsrv_call *call;
+};
+
+static void ldapsrv_process_call_trigger(struct tevent_req *req,
+					 void *private_data);
+
+static struct tevent_req *ldapsrv_process_call_send(TALLOC_CTX *mem_ctx,
+						    struct tevent_context *ev,
+						    struct tevent_queue *call_queue,
+						    struct ldapsrv_call *call)
+{
+	struct tevent_req *req;
+	struct ldapsrv_process_call_state *state;
+	bool ok;
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct ldapsrv_process_call_state);
+	if (req == NULL) {
+		return req;
+	}
+
+	state->call = call;
+
+	ok = tevent_queue_add(call_queue, ev, req,
+			      ldapsrv_process_call_trigger, NULL);
+	if (!ok) {
+		tevent_req_oom(req);
+		return tevent_req_post(req, ev);
+	}
+
+	return req;
+}
+
+static void ldapsrv_process_call_trigger(struct tevent_req *req,
+					 void *private_data)
+{
+	struct ldapsrv_process_call_state *state =
+		tevent_req_data(req,
+		struct ldapsrv_process_call_state);
+	NTSTATUS status;
+
+	/* make the call */
+	status = ldapsrv_do_call(state->call);
+	if (!NT_STATUS_IS_OK(status)) {
+		tevent_req_nterror(req, status);
+		return;
+	}
+
+	tevent_req_done(req);
+}
+
+static NTSTATUS ldapsrv_process_call_recv(struct tevent_req *req)
+{
+	NTSTATUS status;
+
+	if (tevent_req_is_nterror(req, &status)) {
+		tevent_req_received(req);
+		return status;
+	}
+
+	tevent_req_received(req);
+	return NT_STATUS_OK;
+}
+
+static void ldapsrv_accept_nonpriv(struct stream_connection *c)
+{
+	struct ldapsrv_service *ldapsrv_service = talloc_get_type_abort(
+		c->private_data, struct ldapsrv_service);
+	struct auth_session_info *session_info;
+	NTSTATUS status;
+
+	status = auth_anonymous_session_info(
+		c, ldapsrv_service->task->lp_ctx, &session_info);
+	if (!NT_STATUS_IS_OK(status)) {
+		stream_terminate_connection(c, "failed to setup anonymous "
+					    "session info");
+		return;
+	}
+	ldapsrv_accept(c, session_info, false);
+}
+
+static const struct stream_server_ops ldap_stream_nonpriv_ops = {
+	.name			= "ldap",
+	.accept_connection	= ldapsrv_accept_nonpriv,
+	.recv_handler		= ldapsrv_recv,
+	.send_handler		= ldapsrv_send,
+};
+
+/* The feature removed behind an #ifdef until we can do it properly
+ * with an EXTERNAL bind. */
+
+#define WITH_LDAPI_PRIV_SOCKET
+
+#ifdef WITH_LDAPI_PRIV_SOCKET
+static void ldapsrv_accept_priv(struct stream_connection *c)
+{
+	struct ldapsrv_service *ldapsrv_service = talloc_get_type_abort(
+		c->private_data, struct ldapsrv_service);
+	struct auth_session_info *session_info;
+
+	session_info = system_session(ldapsrv_service->task->lp_ctx);
+	if (!session_info) {
+		stream_terminate_connection(c, "failed to setup system "
+					    "session info");
+		return;
+	}
+	ldapsrv_accept(c, session_info, true);
+}
+
+static const struct stream_server_ops ldap_stream_priv_ops = {
+	.name			= "ldap",
+	.accept_connection	= ldapsrv_accept_priv,
+	.recv_handler		= ldapsrv_recv,
+	.send_handler		= ldapsrv_send,
+};
+
+#endif
+
+
+/*
+  add a socket address to the list of events, one event per port
+*/
+static NTSTATUS add_socket(struct task_server *task,
+			   struct loadparm_context *lp_ctx,
+			   const struct model_ops *model_ops,
+			   const char *address, struct ldapsrv_service *ldap_service)
+{
+	uint16_t port = 389;
+	NTSTATUS status;
+	struct ldb_context *ldb;
+
+	status = stream_setup_socket(task, task->event_ctx, lp_ctx,
+				     model_ops, &ldap_stream_nonpriv_ops,
+				     "ip", address, &port,
+				     lpcfg_socket_options(lp_ctx),
+				     ldap_service);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
+			 address, port, nt_errstr(status)));
+		return status;
+	}
+
+	if (tstream_tls_params_enabled(ldap_service->tls_params)) {
+		/* add ldaps server */
+		port = 636;
+		status = stream_setup_socket(task, task->event_ctx, lp_ctx,
+					     model_ops,
+					     &ldap_stream_nonpriv_ops,
+					     "ip", address, &port,
+					     lpcfg_socket_options(lp_ctx),
+					     ldap_service);
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
+				 address, port, nt_errstr(status)));
+			return status;
+		}
+	}
+
+	/* Load LDAP database, but only to read our settings */
+	ldb = samdb_connect(ldap_service, ldap_service->task->event_ctx, 
+			    lp_ctx, system_session(lp_ctx), 0);
+	if (!ldb) {
+		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	}
+
+	if (samdb_is_gc(ldb)) {
+		port = 3268;
+		status = stream_setup_socket(task, task->event_ctx, lp_ctx,
+					     model_ops,
+					     &ldap_stream_nonpriv_ops,
+					     "ip", address, &port,
+					     lpcfg_socket_options(lp_ctx),
+					     ldap_service);
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
+				 address, port, nt_errstr(status)));
+			return status;
+		}
+		if (tstream_tls_params_enabled(ldap_service->tls_params)) {
+			/* add ldaps server for the global catalog */
+			port = 3269;
+			status = stream_setup_socket(task, task->event_ctx, lp_ctx,
+						     model_ops,
+						     &ldap_stream_nonpriv_ops,
+						     "ip", address, &port,
+						     lpcfg_socket_options(lp_ctx),
+						     ldap_service);
+			if (!NT_STATUS_IS_OK(status)) {
+				DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
+					 address, port, nt_errstr(status)));
+				return status;
+			}
+		}
+	}
+
+	/* And once we are bound, free the temporary ldb, it will
+	 * connect again on each incoming LDAP connection */
+	talloc_unlink(ldap_service, ldb);
+
+	return NT_STATUS_OK;
+}
+
+/*
+  open the ldap server sockets
+*/
+static void ldapsrv_task_init(struct task_server *task)
+{	
+	char *ldapi_path;
+#ifdef WITH_LDAPI_PRIV_SOCKET
+	char *priv_dir;
+#endif
+	const char *dns_host_name;
+	struct ldapsrv_service *ldap_service;
+	NTSTATUS status;
+	const struct model_ops *model_ops;
+
+	switch (lpcfg_server_role(task->lp_ctx)) {
+	case ROLE_STANDALONE:
+		task_server_terminate(task, "ldap_server: no LDAP server required in standalone configuration", 
+				      false);
+		return;
+	case ROLE_DOMAIN_MEMBER:
+		task_server_terminate(task, "ldap_server: no LDAP server required in member server configuration", 
+				      false);
+		return;
+	case ROLE_ACTIVE_DIRECTORY_DC:
+		/* Yes, we want an LDAP server */
+		break;
+	}
+
+	task_server_set_title(task, "task[ldapsrv]");
+
+	/*
+	 * Here we used to run the ldap server as a single process,
+	 * but we don't want transaction locks for one task in a write
+	 * blocking all other reads, so we go multi-process.
+	 */
+	model_ops = task->model_ops;
+
+	ldap_service = talloc_zero(task, struct ldapsrv_service);
+	if (ldap_service == NULL) goto failed;
+
+	ldap_service->task = task;
+
+	dns_host_name = talloc_asprintf(ldap_service, "%s.%s",
+					lpcfg_netbios_name(task->lp_ctx),
+					lpcfg_dnsdomain(task->lp_ctx));
+	if (dns_host_name == NULL) goto failed;
+
+	status = tstream_tls_params_server(ldap_service,
+					   dns_host_name,
+					   lpcfg_tls_enabled(task->lp_ctx),
+					   lpcfg_tls_keyfile(ldap_service, task->lp_ctx),
+					   lpcfg_tls_certfile(ldap_service, task->lp_ctx),
+					   lpcfg_tls_cafile(ldap_service, task->lp_ctx),
+					   lpcfg_tls_crlfile(ldap_service, task->lp_ctx),
+					   lpcfg_tls_dhpfile(ldap_service, task->lp_ctx),
+					   lpcfg_tls_priority(task->lp_ctx),
+					   &ldap_service->tls_params);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0,("ldapsrv failed tstream_tls_params_server - %s\n",
+			 nt_errstr(status)));
+		goto failed;
+	}
+
+	ldap_service->call_queue = tevent_queue_create(ldap_service, "ldapsrv_call_queue");
+	if (ldap_service->call_queue == NULL) goto failed;
+
+	if (lpcfg_interfaces(task->lp_ctx) && lpcfg_bind_interfaces_only(task->lp_ctx)) {
+		struct interface *ifaces;
+		int num_interfaces;
+		int i;
+
+		load_interface_list(task, task->lp_ctx, &ifaces);
+		num_interfaces = iface_list_count(ifaces);
+
+		/* We have been given an interfaces line, and been 
+		   told to only bind to those interfaces. Create a
+		   socket per interface and bind to only these.
+		*/
+		for(i = 0; i < num_interfaces; i++) {
+			const char *address = iface_list_n_ip(ifaces, i);
+			status = add_socket(task, task->lp_ctx, model_ops, address, ldap_service);
+			if (!NT_STATUS_IS_OK(status)) goto failed;
+		}
+	} else {
+		char **wcard;
+		int i;
+		int num_binds = 0;
+		wcard = iface_list_wildcard(task);
+		if (wcard == NULL) {
+			DEBUG(0,("No wildcard addresses available\n"));
+			goto failed;
+		}
+		for (i=0; wcard[i]; i++) {
+			status = add_socket(task, task->lp_ctx, model_ops, wcard[i], ldap_service);
+			if (NT_STATUS_IS_OK(status)) {
+				num_binds++;
+			}
+		}
+		talloc_free(wcard);
+		if (num_binds == 0) {
+			goto failed;
+		}
+	}
+
+	ldapi_path = lpcfg_private_path(ldap_service, task->lp_ctx, "ldapi");
+	if (!ldapi_path) {
+		goto failed;
+	}
+
+	status = stream_setup_socket(task, task->event_ctx, task->lp_ctx,
+				     model_ops, &ldap_stream_nonpriv_ops,
+				     "unix", ldapi_path, NULL, 
+				     lpcfg_socket_options(task->lp_ctx),
+				     ldap_service);
+	talloc_free(ldapi_path);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0,("ldapsrv failed to bind to %s - %s\n",
+			 ldapi_path, nt_errstr(status)));
+	}
+
+#ifdef WITH_LDAPI_PRIV_SOCKET
+	priv_dir = lpcfg_private_path(ldap_service, task->lp_ctx, "ldap_priv");
+	if (priv_dir == NULL) {
+		goto failed;
+	}
+	/*
+	 * Make sure the directory for the privileged ldapi socket exists, and
+	 * is of the correct permissions
+	 */
+	if (!directory_create_or_exist(priv_dir, 0750)) {
+		task_server_terminate(task, "Cannot create ldap "
+				      "privileged ldapi directory", true);
+		return;
+	}
+	ldapi_path = talloc_asprintf(ldap_service, "%s/ldapi", priv_dir);
+	talloc_free(priv_dir);
+	if (ldapi_path == NULL) {
+		goto failed;
+	}
+
+	status = stream_setup_socket(task, task->event_ctx, task->lp_ctx,
+				     model_ops, &ldap_stream_priv_ops,
+				     "unix", ldapi_path, NULL,
+				     lpcfg_socket_options(task->lp_ctx),
+				     ldap_service);
+	talloc_free(ldapi_path);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0,("ldapsrv failed to bind to %s - %s\n",
+			 ldapi_path, nt_errstr(status)));
+	}
+
+#endif
+
+	/* register the server */
+	irpc_add_name(task->msg_ctx, "ldap_server");
+	return;
+
+failed:
+	task_server_terminate(task, "Failed to startup ldap server task", true);
+}
+
+
+NTSTATUS server_service_ldap_init(TALLOC_CTX *ctx)
+{
+	return register_server_service(ctx, "ldap", ldapsrv_task_init);
+}
diff --git a/source4/ldap_server/ldap_server.h b/source4/ldap_server/ldap_server.h
 new file mode 100644
index 0000000..d3e31fb
--- /dev/null
+++ b/source4/ldap_server/ldap_server.h
@@ -0,0 +1,105 @@
+/* 
+   Unix SMB/CIFS implementation.
+   LDAP server
+   Copyright (C) Volker Lendecke 2004
+   Copyright (C) Stefan Metzmacher 2004
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "libcli/ldap/libcli_ldap.h"
+#include "lib/socket/socket.h"
+#include "lib/stream/packet.h"
+#include "system/network.h"
+#include "lib/param/loadparm.h"
+
+struct ldapsrv_connection {
+	struct ldapsrv_connection *next, *prev;
+	struct loadparm_context *lp_ctx;
+	struct stream_connection *connection;
+	struct gensec_security *gensec;
+	struct auth_session_info *session_info;
+	struct ldapsrv_service *service;
+	struct cli_credentials *server_credentials;
+	struct ldb_context *ldb;
+
+	struct {
+		struct tevent_queue *send_queue;
+		struct tevent_req *read_req;
+		struct tstream_context *raw;
+		struct tstream_context *tls;
+		struct tstream_context *sasl;
+		struct tstream_context *active;
+	} sockets;
+
+	bool global_catalog;
+	bool is_privileged;
+	enum ldap_server_require_strong_auth require_strong_auth;
+	bool authz_logged;
+
+	struct {
+		int initial_timeout;
+		int conn_idle_time;
+		int max_page_size;
+		int max_notifications;
+		int search_timeout;
+		struct timeval endtime;
+		const char *reason;
+	} limits;
+
+	struct tevent_req *active_call;
+
+	struct ldapsrv_call *pending_calls;
+};
+
+struct ldapsrv_call {
+	struct ldapsrv_call *prev, *next;
+	struct ldapsrv_connection *conn;
+	struct ldap_message *request;
+	struct ldapsrv_reply {
+		struct ldapsrv_reply *prev, *next;
+		struct ldap_message *msg;
+	} *replies;
+	struct iovec out_iov;
+
+	struct tevent_req *(*wait_send)(TALLOC_CTX *mem_ctx,
+					struct tevent_context *ev,
+					void *private_data);
+	NTSTATUS (*wait_recv)(struct tevent_req *req);
+	void *wait_private;
+
+	struct tevent_req *(*postprocess_send)(TALLOC_CTX *mem_ctx,
+					       struct tevent_context *ev,
+					       void *private_data);
+	NTSTATUS (*postprocess_recv)(struct tevent_req *req);
+	void *postprocess_private;
+
+	struct {
+		bool busy;
+		uint64_t generation;
+	} notification;
+};
+
+struct ldapsrv_service {
+	struct tstream_tls_params *tls_params;
+	struct task_server *task;
+	struct tevent_queue *call_queue;
+	struct ldapsrv_connection *connections;
+	struct {
+		uint64_t generation;
+		struct tevent_req *retry;
+	} notification;
+};
+
+#include "ldap_server/proto.h"
diff --git a/source4/ldap_server/wscript_build b/source4/ldap_server/wscript_build
 new file mode 100644
index 0000000..881cc89
--- /dev/null
+++ b/source4/ldap_server/wscript_build
@@ -0,0 +1,13 @@
+#!/usr/bin/env python
+
+
+bld.SAMBA_MODULE('service_ldap',
+	source='ldap_server.c ldap_backend.c ldap_bind.c ldap_extended.c',
+	autoproto='proto.h',
+	subsystem='service',
+	init_function='server_service_ldap_init',
+	deps='samba-credentials cli-ldap samdb process_model gensec samba-hostconfig samba_server_gensec common_auth',
+	internal_module=False,
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
+	)
+
diff --git a/source4/lib/cmdline/credentials.c b/source4/lib/cmdline/credentials.c
 new file mode 100644
index 0000000..fb517f3
--- /dev/null
+++ b/source4/lib/cmdline/credentials.c
@@ -0,0 +1,54 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   Copyright (C) Jelmer Vernooij 2005
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "system/filesys.h"
+#include "auth/credentials/credentials.h"
+#include "lib/cmdline/credentials.h"
+
+static const char *cmdline_get_userpassword(struct cli_credentials *credentials)
+{
+	TALLOC_CTX *mem_ctx = talloc_new(NULL);
+	const char *prompt_name = cli_credentials_get_unparsed_name(credentials, mem_ctx);
+	const char *prompt;
+	static char pwd[256]; /* FIXME: Return a dup pwd and free it. */
+	int rc;
+
+	prompt = talloc_asprintf(mem_ctx, "Password for [%s]:", 
+				 prompt_name);
+
+	memset(pwd, '\0', sizeof(pwd));
+	rc = samba_getpass(prompt, pwd, sizeof(pwd), false, false);
+	talloc_free(mem_ctx);
+	if (rc < 0) {
+		return NULL;
+	}
+
+	return pwd;
+}
+
+bool cli_credentials_set_cmdline_callbacks(struct cli_credentials *cred)
+{
+	if (isatty(fileno(stdout))) {
+		cli_credentials_set_password_callback(cred, cmdline_get_userpassword);
+		return true;
+	}
+
+	return false;
+}
diff --git a/source4/lib/cmdline/popt_common.c b/source4/lib/cmdline/popt_common.c
 new file mode 100644
index 0000000..5fce312
--- /dev/null
+++ b/source4/lib/cmdline/popt_common.c
@@ -0,0 +1,235 @@
+/* 
+   Unix SMB/CIFS implementation.
+   Common popt routines
+
+   Copyright (C) Tim Potter 2001,2002
+   Copyright (C) Jelmer Vernooij 2002,2003,2005
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "version.h"
+#include "lib/cmdline/popt_common.h"
+#include "param/param.h"
+
+/* Handle command line options:
+ *		-d,--debuglevel 
+ *		-s,--configfile 
+ *		-O,--socket-options 
+ *		-V,--version
+ *		-l,--log-base
+ *		-n,--netbios-name
+ *		-W,--workgroup
+ *		--realm
+ *		-i,--scope
+ */
+
+enum {OPT_OPTION=1,OPT_LEAK_REPORT,OPT_LEAK_REPORT_FULL,OPT_DEBUG_STDERR};
+
+static struct cli_credentials *cmdline_credentials = NULL;
+
+void popt_set_cmdline_credentials(struct cli_credentials *creds)
+{
+	cmdline_credentials = creds;
+}
+
+struct cli_credentials *popt_get_cmdline_credentials(void)
+{
+	return cmdline_credentials;
+}
+
+void popt_free_cmdline_credentials(void)
+{
+	TALLOC_FREE(cmdline_credentials);
+}
+
+struct loadparm_context *cmdline_lp_ctx = NULL;
+
+static void popt_version_callback(poptContext con,
+			   enum poptCallbackReason reason,
+			   const struct poptOption *opt,
+			   const char *arg, const void *data)
+{
+	switch(opt->val) {
+	case 'V':
+		printf("Version %s\n", SAMBA_VERSION_STRING );
+		exit(0);
+	}
+}
+
+static void popt_s4_talloc_log_fn(const char *message)
+{
+	DEBUG(0,("%s", message));
+}
+
+static void popt_samba_callback(poptContext con, 
+			   enum poptCallbackReason reason,
+			   const struct poptOption *opt,
+			   const char *arg, const void *data)
+{
+	const char *pname;
+
+	if (reason == POPT_CALLBACK_REASON_POST) {
+		if (lpcfg_configfile(cmdline_lp_ctx) == NULL) {
+			lpcfg_load_default(cmdline_lp_ctx);
+		}
+		/* Hook any 'every Samba program must do this, after
+		 * the smb.conf is setup' functions here */
+		return;
+	}
+
+	/* Find out basename of current program */
+	pname = strrchr_m(poptGetInvocationName(con),'/');
+
+	if (!pname)
+		pname = poptGetInvocationName(con);
+	else 
+		pname++;
+
+	if (reason == POPT_CALLBACK_REASON_PRE) {
+		/* Hook for 'almost the first thing to do in a samba program' here */
+		/* setup for panics */
+		fault_setup();
+
+		/* and logging */
+		setup_logging(pname, DEBUG_DEFAULT_STDOUT);
+		talloc_set_log_fn(popt_s4_talloc_log_fn);
+		talloc_set_abort_fn(smb_panic);
+
+		cmdline_lp_ctx = loadparm_init_global(false);
+		return;
+	}
+
+	switch(opt->val) {
+
+	case OPT_LEAK_REPORT:
+		talloc_enable_leak_report();
+		break;
+
+	case OPT_LEAK_REPORT_FULL:
+		talloc_enable_leak_report_full();
+		break;
+
+	case OPT_OPTION:
+		if (!lpcfg_set_option(cmdline_lp_ctx, arg)) {
+			fprintf(stderr, "Error setting option '%s'\n", arg);
+			exit(1);
+		}
+		break;
+
+	case 'd':
+		lpcfg_set_cmdline(cmdline_lp_ctx, "log level", arg);
+		break;
+
+	case OPT_DEBUG_STDERR:
+		setup_logging(pname, DEBUG_STDERR);
+		break;
+
+	case 's':
+		if (arg) {
+			lpcfg_load(cmdline_lp_ctx, arg);
+		}
+		break;
+
+	case 'l':
+		if (arg) {
+			char *new_logfile = talloc_asprintf(NULL, "%s/log.%s", arg, pname);
+			lpcfg_set_cmdline(cmdline_lp_ctx, "log file", new_logfile);
+			talloc_free(new_logfile);
+		}
+		break;
+	
+
+	}
+
+}
+
+
+static void popt_common_callback(poptContext con, 
+			   enum poptCallbackReason reason,
+			   const struct poptOption *opt,
+			   const char *arg, const void *data)
+{
+	struct loadparm_context *lp_ctx = cmdline_lp_ctx;
+
+	switch(opt->val) {
+	case 'O':
+		if (arg) {
+			lpcfg_set_cmdline(lp_ctx, "socket options", arg);
+		}
+		break;
+	
+	case 'W':
+		lpcfg_set_cmdline(lp_ctx, "workgroup", arg);
+		break;
+
+	case 'r':
+		lpcfg_set_cmdline(lp_ctx, "realm", arg);
+		break;
+		
+	case 'n':
+		lpcfg_set_cmdline(lp_ctx, "netbios name", arg);
+		break;
+		
+	case 'i':
+		lpcfg_set_cmdline(lp_ctx, "netbios scope", arg);
+		break;
+
+	case 'm':
+		lpcfg_set_cmdline(lp_ctx, "client max protocol", arg);
+		break;
+
+	case 'R':
+		lpcfg_set_cmdline(lp_ctx, "name resolve order", arg);
+		break;
+
+	case 'S':
+		lpcfg_set_cmdline(lp_ctx, "client signing", arg);
+		break;
+
+	}
+}
+
+struct poptOption popt_common_connection4[] = {
+	{ NULL, 0, POPT_ARG_CALLBACK, (void *)popt_common_callback },
+	{ "name-resolve", 'R', POPT_ARG_STRING, NULL, 'R', "Use these name resolution services only", "NAME-RESOLVE-ORDER" },
+	{ "socket-options", 'O', POPT_ARG_STRING, NULL, 'O', "socket options to use", "SOCKETOPTIONS" },
+	{ "netbiosname", 'n', POPT_ARG_STRING, NULL, 'n', "Primary netbios name", "NETBIOSNAME" },
+	{ "signing", 'S', POPT_ARG_STRING, NULL, 'S', "Set the client signing state", "on|off|required" },
+	{ "workgroup", 'W', POPT_ARG_STRING, NULL, 'W', "Set the workgroup name", "WORKGROUP" },
+	{ "realm", 0, POPT_ARG_STRING, NULL, 'r', "Set the realm name", "REALM" },
+	{ "scope", 'i', POPT_ARG_STRING, NULL, 'i', "Use this Netbios scope", "SCOPE" },
+	{ "maxprotocol", 'm', POPT_ARG_STRING, NULL, 'm', "Set max protocol level", "MAXPROTOCOL" },
+	{ NULL }
+};
+
+struct poptOption popt_common_samba4[] = {
+	{ NULL, 0, POPT_ARG_CALLBACK|POPT_CBFLAG_PRE|POPT_CBFLAG_POST, (void *)popt_samba_callback },
+	{ "debuglevel",   'd', POPT_ARG_STRING, NULL, 'd', "Set debug level", "DEBUGLEVEL" },
+	{ "debug-stderr", 0, POPT_ARG_NONE, NULL, OPT_DEBUG_STDERR, "Send debug output to STDERR", NULL },
+	{ "configfile",   's', POPT_ARG_STRING, NULL, 's', "Use alternative configuration file", "CONFIGFILE" },
+	{ "option",         0, POPT_ARG_STRING, NULL, OPT_OPTION, "Set smb.conf option from command line", "name=value" },
+	{ "log-basename", 'l', POPT_ARG_STRING, NULL, 'l', "Basename for log/debug files", "LOGFILEBASE" },
+	{ "leak-report",     0, POPT_ARG_NONE, NULL, OPT_LEAK_REPORT, "enable talloc leak reporting on exit", NULL },	
+	{ "leak-report-full",0, POPT_ARG_NONE, NULL, OPT_LEAK_REPORT_FULL, "enable full talloc leak reporting on exit", NULL },
+	{ NULL }
+};
+
+struct poptOption popt_common_version4[] = {
+	{ NULL, 0, POPT_ARG_CALLBACK, (void *)popt_version_callback },
+	{ "version", 'V', POPT_ARG_NONE, NULL, 'V', "Print version" },
+	{ NULL }
+};
+
diff --git a/source4/lib/cmdline/popt_common.h b/source4/lib/cmdline/popt_common.h
 new file mode 100644
index 0000000..4271aa4
--- /dev/null
+++ b/source4/lib/cmdline/popt_common.h
@@ -0,0 +1,47 @@
+/* 
+   Unix SMB/CIFS implementation.
+   Common popt arguments
+   Copyright (C) Jelmer Vernooij	2003
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _POPT_COMMON_H
+#define _POPT_COMMON_H
+
+#include <popt.h>
+
+/* Common popt structures */
+extern struct poptOption popt_common_samba4[];
+extern struct poptOption popt_common_connection4[];
+extern struct poptOption popt_common_version4[];
+extern struct poptOption popt_common_credentials4[];
+
+#ifndef POPT_TABLEEND
+#define POPT_TABLEEND { NULL, '\0', 0, 0, 0, NULL, NULL }
+#endif
+
+#define POPT_COMMON_SAMBA { NULL, 0, POPT_ARG_INCLUDE_TABLE, popt_common_samba4, 0, "Common Samba options:", NULL },
+#define POPT_COMMON_CONNECTION { NULL, 0, POPT_ARG_INCLUDE_TABLE, popt_common_connection4, 0, "Connection options:", NULL },
+#define POPT_COMMON_VERSION { NULL, 0, POPT_ARG_INCLUDE_TABLE, popt_common_version4, 0, "Version options:", NULL },
+#define POPT_COMMON_CREDENTIALS { NULL, 0, POPT_ARG_INCLUDE_TABLE, popt_common_credentials4, 0, "Authentication options:", NULL },
+
+struct cli_credentials;
+
+void popt_set_cmdline_credentials(struct cli_credentials *creds);
+struct cli_credentials *popt_get_cmdline_credentials(void);
+void popt_free_cmdline_credentials(void);
+extern struct loadparm_context *cmdline_lp_ctx;
+
+#endif /* _POPT_COMMON_H */
diff --git a/source4/lib/cmdline/popt_credentials.c b/source4/lib/cmdline/popt_credentials.c
 new file mode 100644
index 0000000..c06b8c7
--- /dev/null
+++ b/source4/lib/cmdline/popt_credentials.c
@@ -0,0 +1,190 @@
+/* 
+   Unix SMB/CIFS implementation.
+   Credentials popt routines
+
+   Copyright (C) Jelmer Vernooij 2002,2003,2005
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "lib/cmdline/popt_common.h"
+#include "lib/cmdline/credentials.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
+#include "param/param.h"
+
+/* Handle command line options:
+ *		-U,--user
+ *		-A,--authentication-file
+ *		-k,--use-kerberos
+ *		-N,--no-pass
+ *		-S,--signing
+ *		-P,--machine-pass
+ *		--simple-bind-dn
+ *		--password
+ *		--krb5-ccache
+ */
+
+static bool dont_ask;
+static bool machine_account_pending;
+
+enum opt { OPT_SIMPLE_BIND_DN, OPT_PASSWORD, OPT_KERBEROS, OPT_SIGN, OPT_ENCRYPT, OPT_KRB5_CCACHE };
+
+static void popt_common_credentials_callback(poptContext con, 
+						enum poptCallbackReason reason,
+						const struct poptOption *opt,
+						const char *arg, const void *data)
+{
+	if (reason == POPT_CALLBACK_REASON_PRE) {
+		popt_set_cmdline_credentials(cli_credentials_init(NULL));
+		return;
+	}
+	
+	if (reason == POPT_CALLBACK_REASON_POST) {
+		cli_credentials_guess(popt_get_cmdline_credentials(),
+				cmdline_lp_ctx);
+
+		if (!dont_ask) {
+			cli_credentials_set_cmdline_callbacks(
+				popt_get_cmdline_credentials());
+		}
+
+		if (machine_account_pending) {
+			cli_credentials_set_machine_account(
+				popt_get_cmdline_credentials(), cmdline_lp_ctx);
+		}
+
+		return;
+
+	}
+
+	switch(opt->val) {
+	case 'U':
+	{
+		char *lp;
+		
+		cli_credentials_parse_string(
+			popt_get_cmdline_credentials(), arg, CRED_SPECIFIED);
+		/* This breaks the abstraction, including the const above */
+		if ((lp=strchr_m(arg,'%'))) {
+			lp[0]='\0';
+			lp++;
+			/* Try to prevent this showing up in ps */
+			memset(lp,0,strlen(lp));
+		}
+	}
+	break;
+
+	case OPT_PASSWORD:
+		cli_credentials_set_password(popt_get_cmdline_credentials(),
+			arg, CRED_SPECIFIED);
+		/* Try to prevent this showing up in ps */
+		memset(discard_const(arg),0,strlen(arg));
+		break;
+
+	case 'A':
+		cli_credentials_parse_file(popt_get_cmdline_credentials(),
+			arg, CRED_SPECIFIED);
+		break;
+
+	case 'P':
+		/* Later, after this is all over, get the machine account details from the secrets.ldb */
+		machine_account_pending = true;
+		break;
+
+	case OPT_KERBEROS:
+	{
+		bool use_kerberos = true;
+		/* Force us to only use kerberos */
+		if (arg) {
+			if (!set_boolean(arg, &use_kerberos)) {
+				fprintf(stderr, "Error parsing -k %s. Should be "
+					"-k [yes|no]\n", arg);
+				exit(1);
+				break;
+			}
+		}
+		
+		cli_credentials_set_kerberos_state(
+			popt_get_cmdline_credentials(),
+						   use_kerberos 
+						   ? CRED_MUST_USE_KERBEROS
+						   : CRED_DONT_USE_KERBEROS);
+		break;
+	}
+		
+	case OPT_SIMPLE_BIND_DN:
+	{
+		cli_credentials_set_bind_dn(popt_get_cmdline_credentials(),
+				arg);
+		break;
+	}
+	case OPT_KRB5_CCACHE:
+	{
+		const char *error_string;
+		if (cli_credentials_set_ccache(
+			popt_get_cmdline_credentials(), cmdline_lp_ctx,
+			arg, CRED_SPECIFIED,
+					       &error_string) != 0) {
+			fprintf(stderr, "Error reading krb5 credentials cache: '%s' %s", arg, error_string);
+			exit(1);
+		}
+		break;
+	}
+	case OPT_SIGN:
+	{
+		uint32_t gensec_features;
+
+		gensec_features = cli_credentials_get_gensec_features(
+					popt_get_cmdline_credentials());
+
+		gensec_features |= GENSEC_FEATURE_SIGN;
+		cli_credentials_set_gensec_features(
+					popt_get_cmdline_credentials(),
+						    gensec_features);
+		break;
+	}
+	case OPT_ENCRYPT:
+	{
+		uint32_t gensec_features;
+
+		gensec_features = cli_credentials_get_gensec_features(
+					popt_get_cmdline_credentials());
+
+		gensec_features |= GENSEC_FEATURE_SEAL;
+		cli_credentials_set_gensec_features(
+					popt_get_cmdline_credentials(),
+						    gensec_features);
+		break;
+	}
+	}
+}
+
+
+
+struct poptOption popt_common_credentials4[] = {
+	{ NULL, 0, POPT_ARG_CALLBACK|POPT_CBFLAG_PRE|POPT_CBFLAG_POST, (void *)popt_common_credentials_callback },
+	{ "user", 'U', POPT_ARG_STRING, NULL, 'U', "Set the network username", "[DOMAIN/]USERNAME[%PASSWORD]" },
+	{ "no-pass", 'N', POPT_ARG_NONE, &dont_ask, 'N', "Don't ask for a password" },
+	{ "password", 0, POPT_ARG_STRING, NULL, OPT_PASSWORD, "Password" },
+	{ "authentication-file", 'A', POPT_ARG_STRING, NULL, 'A', "Get the credentials from a file", "FILE" },
+	{ "machine-pass", 'P', POPT_ARG_NONE, NULL, 'P', "Use stored machine account password" },
+	{ "simple-bind-dn", 0, POPT_ARG_STRING, NULL, OPT_SIMPLE_BIND_DN, "DN to use for a simple bind" },
+	{ "kerberos", 'k', POPT_ARG_STRING, NULL, OPT_KERBEROS, "Use Kerberos, -k [yes|no]" },
+	{ "krb5-ccache", 0, POPT_ARG_STRING, NULL, OPT_KRB5_CCACHE, "Credentials cache location for Kerberos" },
+	{ "sign", 'S', POPT_ARG_NONE, NULL, OPT_SIGN, "Sign connection to prevent modification in transit" },
+	{ "encrypt", 'e', POPT_ARG_NONE, NULL, OPT_ENCRYPT, "Encrypt connection for privacy" },
+	{ NULL }
+};
diff --git a/source4/lib/cmdline/wscript_build b/source4/lib/cmdline/wscript_build
 new file mode 100644
index 0000000..f8df22a
--- /dev/null
+++ b/source4/lib/cmdline/wscript_build
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+
+bld.SAMBA_LIBRARY('cmdline-credentials',
+                  source='credentials.c',
+                  autoproto='credentials.h',
+                  public_deps='samba-credentials popt',
+                  deps='samba-util',
+                  private_library=True)
+
+bld.SAMBA_SUBSYSTEM('POPT_SAMBA',
+	source='popt_common.c',
+	public_deps='popt',
+	header_path='samba',
+	deps='talloc samba-hostconfig'
+	)
+
+bld.SAMBA_SUBSYSTEM('POPT_CREDENTIALS',
+	source='popt_credentials.c',
+	autoproto='popt_credentials.h',
+	public_deps='samba-credentials CREDENTIALS_SECRETS cmdline-credentials popt',
+	deps='samba-util'
+	)
+
diff --git a/source4/lib/com/README b/source4/lib/com/README
 new file mode 100644
index 0000000..361024e
--- /dev/null
+++ b/source4/lib/com/README
@@ -0,0 +1,9 @@
+This directory contains Samba's very simple COM implementation. 
+It is by no means finished yet. 
+
+The main aim of this implementation is for use by our DCOM implementation, 
+which lives in the dcom subdirectory. The local version is used mostly for
+testing.
+
+More information on this effort can be found in the DCOM whitepaper in 
+the lorikeet repository.
diff --git a/source4/lib/com/classes/simple.c b/source4/lib/com/classes/simple.c
 new file mode 100644
index 0000000..7d05733
--- /dev/null
+++ b/source4/lib/com/classes/simple.c
@@ -0,0 +1,124 @@
+/*
+   Unix SMB/CIFS implementation.
+   Simple class
+   Copyright (C) 2004-2005 Jelmer Vernooij <[e-mail]>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "lib/com/com.h"
+#include "librpc/gen_ndr/com_dcom.h"
+
+NTSTATUS com_simple_init(TALLOC_CTX *);
+
+static struct IClassFactory_vtable simple_classobject_vtable;
+static struct IStream_vtable simple_IStream_vtable;
+
+static WERROR simple_IUnknown_QueryInterface (struct IUnknown *d, TALLOC_CTX *mem_ctx, struct GUID *iid, struct IUnknown **iun)
+{
+	*iun = d;
+	return WERR_OK;
+}
+
+static uint32_t simple_IUnknown_AddRef (struct IUnknown *d, TALLOC_CTX *mem_ctx)
+{
+	return 1;
+}
+
+static uint32_t simple_IUnknown_Release (struct IUnknown *d, TALLOC_CTX *mem_ctx)
+{
+	return 1;
+}
+
+static WERROR simple_IStream_Read (struct IStream *d, TALLOC_CTX *mem_ctx, uint8_t *pv, uint32_t num_requested, uint32_t *num_readx, uint32_t num_read)
+{
+	printf("%d bytes are being read\n", num_read);
+	return WERR_OK;
+}
+
+static WERROR simple_IStream_Write (struct IStream *d, TALLOC_CTX *mem_ctx, uint8_t *data, uint32_t num_requested, uint32_t num_written)
+{
+	printf("%d bytes are being written\n", num_requested);
+	return WERR_OK;
+}
+
+static WERROR simpleclass_IUnknown_QueryInterface (struct IUnknown *d, TALLOC_CTX *mem_ctx, struct GUID *iid, struct IUnknown **iun)
+{
+	/* FIXME: Return WERR_IFACE_NOT_SUPPORTED if IID != IID_IUNKNOWN and IID != IID_CLASSFACTORY */
+	*iun = d;
+	return WERR_OK;
+}
+
+static WERROR simpleclass_IClassFactory_CreateInstance (struct IClassFactory *d, TALLOC_CTX *mem_ctx, struct IUnknown *iunk, struct GUID *iid, struct IUnknown **ppv)
+{
+	struct IStream *ret;
+	/* FIXME: Check whether IID == ISTREAM_IID */
+	ret = talloc(mem_ctx, struct IStream);
+	ret->ctx = NULL;
+	ret->vtable = &simple_IStream_vtable;
+	ret->object_data = NULL;
+
+	*ppv = (struct IUnknown *)ret;
+	
+	return WERR_OK;
+}
+
+static uint32_t simpleclass_IUnknown_AddRef (struct IUnknown *d, TALLOC_CTX *mem_ctx)
+{
+	return 1;
+}
+
+static uint32_t simpleclass_IUnknown_Release (struct IUnknown *d, TALLOC_CTX *mem_ctx)
+{
+	return 1;
+}
+
+/* Everything below this line should be autogenerated later on */
+static struct IClassFactory_vtable simple_classobject_vtable = {
+        { 0, 0, 0, { 0, 0 }, { 0, 0, 0, 0, 0, 0 } },
+	simpleclass_IUnknown_QueryInterface, 
+	simpleclass_IUnknown_AddRef, 
+	simpleclass_IUnknown_Release,
+	simpleclass_IClassFactory_CreateInstance,
+	NULL,
+	NULL,
+	NULL
+};
+
+static struct IStream_vtable simple_IStream_vtable = {
+        { 0, 0, 0, { 0, 0 }, { 0, 0, 0, 0, 0, 0 } },
+	simple_IUnknown_QueryInterface,
+	simple_IUnknown_AddRef, 
+	simple_IUnknown_Release,
+	simple_IStream_Read,
+	simple_IStream_Write
+};
+
+NTSTATUS com_simple_init(TALLOC_CTX *ctx)
+{
+	struct GUID clsid;
+	struct IUnknown *class_object = talloc(ctx, struct IUnknown);
+
+	class_object->ctx = NULL;
+	class_object->object_data = NULL;
+	class_object->vtable = (struct IUnknown_vtable *)&simple_classobject_vtable;
+
+	GUID_from_string(CLSID_SIMPLE, &clsid);
+	GUID_from_string(COM_ICLASSFACTORY_UUID, &simple_classobject_vtable.iid);
+	GUID_from_string(COM_ISTREAM_UUID, &simple_IStream_vtable.iid);
+
+	return com_register_running_class(ctx, &clsid, PROGID_SIMPLE, class_object);
+}
diff --git a/source4/lib/com/com.h b/source4/lib/com/com.h
 new file mode 100644
index 0000000..56cd210
--- /dev/null
+++ b/source4/lib/com/com.h
@@ -0,0 +1,53 @@
+/* 
+   Unix SMB/CIFS implementation.
+   Utility functions for Samba
+   Copyright (C) Jelmer Vernooij 2008
+    
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef __SAMBA_COM_H__
+#define __SAMBA_COM_H__
+
+#include <talloc.h>
+#include "librpc/gen_ndr/misc.h"
+
+struct com_context;
+struct tevent_context;
+
+struct com_context 
+{
+	struct dcom_client_context *dcom;
+	struct tevent_context *event_ctx;
+        struct com_extension {
+                uint32_t id;
+                void *data;
+                struct com_extension *prev, *next;
+        } *extensions;
+	struct loadparm_context *lp_ctx;
+};
+
+struct IUnknown *com_class_by_clsid(struct com_context *ctx, const struct GUID *clsid);
+NTSTATUS com_register_running_class(TALLOC_CTX *ctx, struct GUID *clsid, const char *progid, struct IUnknown *p);
+
+struct dcom_interface_p *dcom_get_local_iface_p(struct GUID *ipid);
+
+WERROR com_init_ctx(struct com_context **ctx, struct tevent_context *event_ctx);
+WERROR com_create_object(struct com_context *ctx, struct GUID *clsid, int num_ifaces, struct GUID *iid, struct IUnknown **ip, WERROR *results);
+WERROR com_get_class_object(struct com_context *ctx, struct GUID *clsid, struct GUID *iid, struct IUnknown **ip);
+NTSTATUS com_init(void);
+
+typedef struct IUnknown *(*get_class_object_function) (const struct GUID *clsid);
+
+#endif /* __SAMBA_COM_H__ */
diff --git a/source4/lib/com/dcom/dcom.h b/source4/lib/com/dcom/dcom.h
 new file mode 100644
index 0000000..cb549b1
--- /dev/null
+++ b/source4/lib/com/dcom/dcom.h
@@ -0,0 +1,85 @@
+/* 
+   Unix SMB/CIFS implementation.
+   COM standard objects
+   Copyright (C) Jelmer Vernooij					  2004-2005.
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef _DCOM_H /* _DCOM_H */
+#define _DCOM_H 
+
+struct cli_credentials;
+struct dcerpc_pipe;
+
+#include "lib/com/com.h"
+#include "librpc/gen_ndr/orpc.h"
+
+struct dcom_client_context {
+	struct dcom_server_credentials {
+		const char *server;
+		struct cli_credentials *credentials;
+		struct dcom_server_credentials *prev, *next;
+	} *credentials;
+	struct dcom_object_exporter {
+		uint64_t oxid;
+		char *host;
+		struct IRemUnknown *rem_unknown;
+		struct DUALSTRINGARRAY *bindings;
+		struct dcerpc_pipe *pipe;
+		struct dcom_object_exporter *prev, *next;
+	} *object_exporters;
+};
+
+typedef enum ndr_err_code (*marshal_fn)(TALLOC_CTX *mem_ctx, struct IUnknown *pv, struct OBJREF *o);
+typedef enum ndr_err_code (*unmarshal_fn)(TALLOC_CTX *mem_ctx, struct OBJREF *o, struct IUnknown **pv);
+
+
+struct dcom_client_context *dcom_client_init(struct com_context *ctx, struct cli_credentials *credentials);
+struct dcom_object_exporter *object_exporter_by_oxid(struct com_context *ctx, uint64_t oxid);
+struct dcom_object_exporter *object_exporter_by_ip(struct com_context *ctx, struct IUnknown *ip);
+WERROR dcom_create_object(struct com_context *ctx, struct GUID *clsid, const char *server, int num_ifaces, struct GUID *iid, struct IUnknown ***ip, HRESULT *results);
+WERROR dcom_get_class_object(struct com_context *ctx, struct GUID *clsid, const char *server, struct GUID *iid, struct IUnknown **ip);
+NTSTATUS dcom_get_pipe(struct IUnknown *iface, struct dcerpc_pipe **pp);
+NTSTATUS dcom_OBJREF_from_IUnknown(struct OBJREF *o, struct IUnknown *p);
+NTSTATUS dcom_IUnknown_from_OBJREF(TALLOC_CTX *mem_ctx, struct com_context *ctx, struct IUnknown **_p, struct OBJREF *o);
+uint64_t dcom_get_current_oxid(void);
+void dcom_add_server_credentials(struct com_context *ctx, const char *server, struct cli_credentials *credentials);
+WERROR dcom_query_interface(struct IUnknown *d, uint32_t cRefs, uint16_t cIids, struct GUID *iids, struct IUnknown **ip, WERROR *results);
+
+#include "librpc/gen_ndr/com_dcom.h"
+
+NTSTATUS dcom_register_proxy(struct IUnknown_vtable *proxy_vtable);
+struct IUnknown_vtable *dcom_proxy_vtable_by_iid(struct GUID *iid);
+NTSTATUS dcom_register_marshal(struct GUID *clsid, marshal_fn marshal, unmarshal_fn unmarshal);
+
+#include "libcli/composite/composite.h"
+void dcom_release_continue(struct composite_context *cr);
+#define IUnknown_ipid(d) ((d)->obj.u_objref.u_standard.std.ipid)
+struct composite_context *dcom_release_send(struct IUnknown *d, TALLOC_CTX *mem_ctx);
+marshal_fn dcom_marshal_by_clsid(struct GUID *clsid);
+unmarshal_fn dcom_unmarshal_by_clsid(struct GUID *clsid);
+
+struct dcom_proxy_async_call_state {
+	struct IUnknown *d;
+	const struct ndr_interface_table *table;
+	uint32_t opnum;
+	void (*continuation)(struct rpc_request *);
+	TALLOC_CTX *mem_ctx;
+	void *r;
+};
+
+
+#endif /* _DCOM_H */
diff --git a/source4/lib/com/dcom/main.c b/source4/lib/com/dcom/main.c
 new file mode 100644
index 0000000..088d7fe
--- /dev/null
+++ b/source4/lib/com/dcom/main.c
@@ -0,0 +1,704 @@
+/*
+   Unix SMB/CIFS implementation.
+   Main DCOM functionality
+   Copyright (C) 2004 Jelmer Vernooij <[e-mail]>
+   Copyright (C) 2006 Andrzej Hajda <[e-mail]>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "system/filesys.h"
+#include "librpc/gen_ndr/epmapper.h"
+#include "librpc/gen_ndr/ndr_remact_c.h"
+#include "librpc/gen_ndr/com_dcom.h"
+#include "librpc/gen_ndr/dcom.h"
+#include "librpc/rpc/dcerpc.h"
+#include "lib/com/dcom/dcom.h"
+#include "librpc/ndr/ndr_table.h"
+#include "../lib/util/dlinklist.h"
+#include "auth/credentials/credentials.h"
+#include "libcli/composite/composite.h"
+
+#define DCOM_NEGOTIATED_PROTOCOLS { EPM_PROTOCOL_TCP, EPM_PROTOCOL_SMB, EPM_PROTOCOL_NCALRPC }
+
+static NTSTATUS dcerpc_binding_from_STRINGBINDING(TALLOC_CTX *mem_ctx, struct dcerpc_binding **b_out, struct STRINGBINDING *bd)
+{
+	char *tstr;
+	char *bstr;
+	enum dcerpc_transport_t transport;
+	struct dcerpc_binding *b;
+
+	transport = dcerpc_transport_by_endpoint_protocol(bd->wTowerId);
+	if (transport == NCA_UNKNOWN) {
+		DEBUG(1, ("Can't find transport match endpoint protocol %d\n", bd->wTowerId));
+		return NT_STATUS_NOT_SUPPORTED;
+	}
+
+	tstr = derpc_transport_string_by_transport(transport);
+	bstr = talloc_asprintf(mem_ctx, "%s:%s", tstr, bd->NetworkAddr);
+	if (bstr == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	status = dcerpc_parse_binding(mem_ctx, bstr, &b);
+	TALLOC_FREE(bstr);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	*b_out = b;
+	return NT_STATUS_OK;
+}
+
+struct cli_credentials *dcom_get_server_credentials(struct com_context *ctx, const char *server)
+{
+	struct dcom_server_credentials *c;
+	struct cli_credentials *d;
+
+	d = NULL;
+	for (c = ctx->dcom->credentials; c; c = c->next) {
+		if (c->server == NULL) {
+			d = c->credentials;
+			continue;
+		}
+		if (server && !strcmp(c->server, server)) return c->credentials;
+	}
+	return d;
+}
+
+/**
+ * Register credentials for a specific server.
+ *
+ * @param ctx COM context
+ * @param server Name of server, can be NULL
+ * @param credentials Credentials object
+ */
+void dcom_add_server_credentials(struct com_context *ctx, const char *server, 
+								 struct cli_credentials *credentials)
+{
+	struct dcom_server_credentials *c;
+
+	/* FIXME: Don't use talloc_find_parent_bytype */
+	for (c = ctx->dcom->credentials; c; c = c->next) {
+		if ((server == NULL && c->server == NULL) ||
+			(server != NULL && c->server != NULL && 
+			 !strcmp(c->server, server))) {
+			if (c->credentials && c->credentials != credentials) {
+				talloc_unlink(c, c->credentials);
+				c->credentials = credentials;
+				if (talloc_find_parent_bytype(c->credentials, struct dcom_server_credentials))
+					(void)talloc_reference(c, c->credentials);
+				else
+					talloc_steal(c, c->credentials);
+			}
+
+			return;
+		}
+	}
+
+	c = talloc(ctx->event_ctx, struct dcom_server_credentials);
+	c->server = talloc_strdup(c, server);
+	c->credentials = credentials;
+	if (talloc_find_parent_bytype(c->credentials, struct dcom_server_credentials))
+		(void)talloc_reference(c, c->credentials);
+	else
+		talloc_steal(c, c->credentials);
+
+	DLIST_ADD(ctx->dcom->credentials, c);
+}
+
+void dcom_update_credentials_for_aliases(struct com_context *ctx, 
+										 const char *server, 
+										 struct DUALSTRINGARRAY *pds)
+{
+	struct cli_credentials *cc;
+	struct dcerpc_binding *b;
+	uint32_t i;
+	NTSTATUS status;
+
+	cc = dcom_get_server_credentials(ctx, server);
+        for (i = 0; pds->stringbindings[i]; ++i) {
+                if (pds->stringbindings[i]->wTowerId != EPM_PROTOCOL_TCP) 
+					continue;
+                status = dcerpc_binding_from_STRINGBINDING(ctx, &b, pds->stringbindings[i]);
+		if (!NT_STATUS_IS_OK(status)) 
+			continue;
+		dcom_add_server_credentials(ctx, b->host, cc);
+		talloc_free(b);
+	}
+}
+
+struct dcom_client_context *dcom_client_init(struct com_context *ctx, struct cli_credentials *credentials)
+{
+	ctx->dcom = talloc_zero(ctx, struct dcom_client_context);
+	if (!credentials) {
+                credentials = cli_credentials_init(ctx);
+                cli_credentials_set_conf(credentials, ctx->lp_ctx);
+                cli_credentials_parse_string(credentials, "%", CRED_SPECIFIED);
+	}
+	dcom_add_server_credentials(ctx, NULL, credentials);
+	return ctx->dcom;
+}
+
+static NTSTATUS dcom_connect_host(struct com_context *ctx, 
+								  struct dcerpc_pipe **p, const char *server)
+{
+	struct dcerpc_binding *bd;
+	const char * available_transports[] = { "ncacn_ip_tcp", "ncacn_np" };
+	int i;
+	NTSTATUS status;
+	TALLOC_CTX *loc_ctx;
+
+	if (server == NULL) { 
+		return dcerpc_pipe_connect(ctx->event_ctx, p, "ncalrpc", 
+								   &ndr_table_IRemoteActivation,
+								   dcom_get_server_credentials(ctx, NULL), ctx->event_ctx, ctx->lp_ctx);
+	}
+	loc_ctx = talloc_new(ctx);
+
+	/* Allow server name to contain a binding string */
+	if (strchr(server, ':') && 
+		NT_STATUS_IS_OK(dcerpc_parse_binding(loc_ctx, server, &bd))) {
+		if (DEBUGLVL(11))
+			bd->flags |= DCERPC_DEBUG_PRINT_BOTH;
+		status = dcerpc_pipe_connect_b(ctx->event_ctx, p, bd, 
+									   &ndr_table_IRemoteActivation,
+								   dcom_get_server_credentials(ctx, bd->host), ctx->event_ctx, ctx->lp_ctx);
+		goto end;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(available_transports); i++)
+	{
+		char *binding = talloc_asprintf(loc_ctx, "%s:%s", available_transports[i], server);
+		if (!binding) {
+			status = NT_STATUS_NO_MEMORY;
+			goto end;
+		}
+		status = dcerpc_pipe_connect(ctx->event_ctx, p, binding, 
+									 &ndr_table_IRemoteActivation, 
+									 dcom_get_server_credentials(ctx, server), 
+									 ctx->event_ctx, ctx->lp_ctx);
+
+		if (NT_STATUS_IS_OK(status)) {
+			if (DEBUGLVL(11))
+				(*p)->conn->flags |= DCERPC_DEBUG_PRINT_BOTH;
+			goto end;
+		} else {
+			DEBUG(1,(__location__": dcom_connect_host : %s\n", get_friendly_nt_error_msg(status)));
+		}
+	}
+
+end:
+	talloc_free(loc_ctx);
+	return status;
+}
+
+struct dcom_object_exporter *object_exporter_by_oxid(struct com_context *ctx, 
+													 uint64_t oxid)
+{
+	struct dcom_object_exporter *ox;
+	for (ox = ctx->dcom->object_exporters; ox; ox = ox->next) {
+		if (ox->oxid == oxid) {
+			return ox;
+		}
+	}
+
+	return NULL; 
+}
+
+struct dcom_object_exporter *object_exporter_update_oxid(struct com_context *ctx, uint64_t oxid, struct DUALSTRINGARRAY *bindings)
+{
+	struct dcom_object_exporter *ox;
+	ox = object_exporter_by_oxid(ctx, oxid);
+	if (!ox) {
+		ox = talloc_zero(ctx, struct dcom_object_exporter);
+		DLIST_ADD(ctx->dcom->object_exporters, ox);
+		ox->oxid = oxid;
+	} else {
+		talloc_free(ox->bindings);
+	}
+	ox->bindings = bindings;
+	talloc_steal(ox, bindings);
+	return ox;
+}
+
+struct dcom_object_exporter *object_exporter_by_ip(struct com_context *ctx, struct IUnknown *ip)
+{
+	return object_exporter_by_oxid(ctx, ip->obj.u_objref.u_standard.std.oxid);
+}
+
+WERROR dcom_create_object(struct com_context *ctx, struct GUID *clsid, const char *server, int num_ifaces, struct GUID *iid, struct IUnknown ***ip, HRESULT *results)
+{
+	uint16_t protseq[] = DCOM_NEGOTIATED_PROTOCOLS;
+	struct dcerpc_pipe *p;
+	struct dcom_object_exporter *m;
+	NTSTATUS status;
+	struct RemoteActivation r;
+	struct DUALSTRINGARRAY *pds;
+	int i;
+	HRESULT hr;
+	uint64_t oxid;
+	struct GUID ipidRemUnknown;
+	struct IUnknown *ru_template;
+	struct ORPCTHAT that;
+	uint32_t AuthnHint;
+	struct COMVERSION ServerVersion;
+	struct MInterfacePointer **ifaces;
+	TALLOC_CTX *loc_ctx;
+
+	status = dcom_connect_host(ctx, &p, server);
+	if (NT_STATUS_IS_ERR(status)) {
+		DEBUG(1, ("Unable to connect to %s - %s\n", server, get_friendly_nt_error_msg(status)));
+		return ntstatus_to_werror(status);
+	}
+	loc_ctx = talloc_new(ctx);
+
+	ifaces = talloc_array(loc_ctx, struct MInterfacePointer *, num_ifaces);
+
+	ZERO_STRUCT(r.in);
+	r.in.this.version.MajorVersion = COM_MAJOR_VERSION;
+	r.in.this.version.MinorVersion = COM_MINOR_VERSION;
+	r.in.this.cid = GUID_random();
+	r.in.Clsid = *clsid;
+	r.in.ClientImpLevel = RPC_C_IMP_LEVEL_IDENTIFY;
+	r.in.num_protseqs = ARRAY_SIZE(protseq);
+	r.in.protseq = protseq;
+	r.in.Interfaces = num_ifaces;
+	r.in.pIIDs = iid;
+	r.out.that = &that;
+	r.out.pOxid = &oxid;
+	r.out.pdsaOxidBindings = &pds;
+	r.out.ipidRemUnknown = &ipidRemUnknown;
+	r.out.AuthnHint = &AuthnHint;
+	r.out.ServerVersion = &ServerVersion;
+	r.out.hr = &hr;
+	r.out.ifaces = ifaces;
+	r.out.results = results;
+
+	status = dcerpc_RemoteActivation(p, loc_ctx, &r);
+	talloc_free(p);
+
+	if(NT_STATUS_IS_ERR(status)) {
+		DEBUG(1, ("Error while running RemoteActivation %s\n", nt_errstr(status)));
+		hr = ntstatus_to_werror(status);
+		goto end;
+	}
+
+	if(!W_ERROR_IS_OK(r.out.result)) {
+		hr = r.out.result;
+		goto end;
+	}
+
+	if(!HRES_IS_OK(hr)) {
+		goto end;
+	}
+
+	m = object_exporter_update_oxid(ctx, oxid, pds);
+
+	ru_template = NULL;
+	*ip = talloc_array(ctx, struct IUnknown *, num_ifaces);
+	for (i = 0; i < num_ifaces; i++) {
+		(*ip)[i] = NULL;
+		if (W_ERROR_IS_OK(results[i])) {
+			status = dcom_IUnknown_from_OBJREF(ctx, &(*ip)[i], &r.out.ifaces[i]->obj);
+			if (!NT_STATUS_IS_OK(status)) {
+				results[i] = ntstatus_to_werror(status);
+			} else if (!ru_template)
+				ru_template = (*ip)[i];
+		}
+	}
+
+	/* TODO:avg check when exactly oxid should be updated,its lifetime etc */
+	if (m->rem_unknown && memcmp(&m->rem_unknown->obj.u_objref.u_standard.std.ipid, &ipidRemUnknown, sizeof(ipidRemUnknown))) {
+		talloc_free(m->rem_unknown);
+		m->rem_unknown = NULL;
+	}
+	if (!m->rem_unknown) {
+		if (!ru_template) {
+			DEBUG(1,("dcom_create_object: Cannot Create IRemUnknown - template interface not available\n"));
+			hr = WERR_GEN_FAILURE;
+		}
+		m->rem_unknown = talloc_zero(m, struct IRemUnknown);
+		memcpy(m->rem_unknown, ru_template, sizeof(struct IUnknown));
+		GUID_from_string(COM_IREMUNKNOWN_UUID, &m->rem_unknown->obj.iid);
+		m->rem_unknown->obj.u_objref.u_standard.std.ipid = ipidRemUnknown;
+		m->rem_unknown->vtable = (struct IRemUnknown_vtable *)dcom_proxy_vtable_by_iid(&m->rem_unknown->obj.iid);
+		/* TODO:avg copy stringbindigs?? */
+	}
+
+	dcom_update_credentials_for_aliases(ctx, server, pds);
+	{ 
+		char *c; 
+		c = strchr(server, '['); 
+		if (m->host) talloc_free(m->host); 
+		m->host = c ? talloc_strndup(m, server, c - server) : talloc_strdup(m, server); 
+	}
+	hr = WERR_OK;
+end:
+	talloc_free(loc_ctx);
+	return hr;
+}
+
+int find_similar_binding(struct STRINGBINDING **sb, const char *host)
+{ 
+	int i, l;
+	l = strlen(host);
+	for (i = 0; sb[i]; ++i) {
+		if ((sb[i]->wTowerId == EPM_PROTOCOL_TCP) && !strncasecmp(host, sb[i]->NetworkAddr, l) && (sb[i]->NetworkAddr[l] == '['))
+		break;
+	}
+	return i;
+}
+
+WERROR dcom_query_interface(struct IUnknown *d, uint32_t cRefs, uint16_t cIids, struct GUID *iids, struct IUnknown **ip, WERROR *results)
+{
+	struct dcom_object_exporter *ox;
+	struct REMQIRESULT *rqir;
+	WERROR result;
+	NTSTATUS status;
+	int i;
+	TALLOC_CTX *loc_ctx;
+	struct IUnknown ru;
+
+	loc_ctx = talloc_new(d);
+	ox = object_exporter_by_ip(d->ctx, d);
+
+	result = IRemUnknown_RemQueryInterface(ox->rem_unknown, loc_ctx, &IUnknown_ipid(d), cRefs, cIids, iids, &rqir);
+	if (!W_ERROR_IS_OK(result)) {
+		DEBUG(1, ("dcom_query_interface failed: %08X\n", W_ERROR_V(result)));