Adding upstream version 2:4.20.0+dfsg.upstream/2%4.20.0+dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

21 files changed, 6374 insertions, 0 deletions

diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
new file mode 100644
index 0000000..ddda18e
--- /dev/null
+++ b/source3/librpc/crypto/gse.c
@@ -0,0 +1,1438 @@
+/*
+ *  GSSAPI Security Extensions
+ *  RPC Pipe client and server routines
+ *  Copyright (C) Simo Sorce 2010.
+ *  Copyright (C) Andrew Bartlett 2004-2011.
+ *  Copyright (C) Stefan Metzmacher <metze@samba.org> 2004-2005
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* We support only GSSAPI/KRB5 here */
+
+#include "includes.h"
+#include <tevent.h>
+#include "lib/util/tevent_ntstatus.h"
+#include "gse.h"
+#include "libads/kerberos_proto.h"
+#include "auth/common_auth.h"
+#include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h"
+#include "auth/credentials/credentials.h"
+#include "../librpc/gen_ndr/dcerpc.h"
+#include "param/param.h"
+
+#if defined(HAVE_KRB5)
+
+#include "auth/kerberos/pac_utils.h"
+#include "auth/kerberos/gssapi_helper.h"
+#include "gse_krb5.h"
+
+static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min);
+static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
+				  size_t data_size);
+
+struct gse_context {
+	gss_ctx_id_t gssapi_context;
+	gss_name_t server_name;
+	gss_name_t client_name;
+	OM_uint32 gss_want_flags, gss_got_flags;
+	size_t max_wrap_buf_size;
+	size_t sig_size;
+
+	gss_cred_id_t delegated_cred_handle;
+
+	NTTIME expire_time;
+
+	/* gensec_gse only */
+	krb5_context k5ctx;
+	krb5_ccache ccache;
+	krb5_keytab keytab;
+
+	gss_OID_desc gss_mech;
+	gss_cred_id_t creds;
+
+	gss_OID ret_mech;
+};
+
+/* free non talloc dependent contexts */
+static int gse_context_destructor(void *ptr)
+{
+	struct gse_context *gse_ctx;
+	OM_uint32 gss_min;
+
+	gse_ctx = talloc_get_type_abort(ptr, struct gse_context);
+	if (gse_ctx->k5ctx) {
+		if (gse_ctx->ccache) {
+			krb5_cc_close(gse_ctx->k5ctx, gse_ctx->ccache);
+			gse_ctx->ccache = NULL;
+		}
+		if (gse_ctx->keytab) {
+			krb5_kt_close(gse_ctx->k5ctx, gse_ctx->keytab);
+			gse_ctx->keytab = NULL;
+		}
+		krb5_free_context(gse_ctx->k5ctx);
+		gse_ctx->k5ctx = NULL;
+	}
+	if (gse_ctx->gssapi_context != GSS_C_NO_CONTEXT) {
+		(void)gss_delete_sec_context(&gss_min,
+						 &gse_ctx->gssapi_context,
+						 GSS_C_NO_BUFFER);
+	}
+	if (gse_ctx->server_name) {
+		(void)gss_release_name(&gss_min,
+					   &gse_ctx->server_name);
+	}
+	if (gse_ctx->client_name) {
+		(void)gss_release_name(&gss_min,
+					   &gse_ctx->client_name);
+	}
+	if (gse_ctx->creds) {
+		(void)gss_release_cred(&gss_min,
+					   &gse_ctx->creds);
+	}
+	if (gse_ctx->delegated_cred_handle) {
+		(void)gss_release_cred(&gss_min,
+					   &gse_ctx->delegated_cred_handle);
+	}
+
+	/* MIT and Heimdal differ as to if you can call
+	 * gss_release_oid() on this OID, generated by
+	 * gss_{accept,init}_sec_context().  However, as long as the
+	 * oid is gss_mech_krb5 (which it always is at the moment),
+	 * then this is a moot point, as both declare this particular
+	 * OID static, and so no memory is lost.  This assert is in
+	 * place to ensure that the programmer who wishes to extend
+	 * this code to EAP or other GSS mechanisms determines an
+	 * implementation-dependent way of releasing any dynamically
+	 * allocated OID */
+	SMB_ASSERT(smb_gss_oid_equal(&gse_ctx->gss_mech, GSS_C_NO_OID) ||
+		   smb_gss_oid_equal(&gse_ctx->gss_mech, gss_mech_krb5));
+
+	return 0;
+}
+
+static NTSTATUS gse_setup_server_principal(TALLOC_CTX *mem_ctx,
+					   const char *target_principal,
+					   const char *service,
+					   const char *hostname,
+					   const char *realm,
+					   char **pserver_principal,
+					   gss_name_t *pserver_name)
+{
+	char *server_principal = NULL;
+	gss_buffer_desc name_token;
+	gss_OID name_type;
+	OM_uint32 maj_stat, min_stat = 0;
+
+	if (target_principal != NULL) {
+		server_principal = talloc_strdup(mem_ctx, target_principal);
+		name_type = GSS_C_NULL_OID;
+	} else {
+		server_principal = talloc_asprintf(mem_ctx,
+						   "%s/%s@%s",
+						   service,
+						   hostname,
+						   realm);
+		name_type = GSS_C_NT_USER_NAME;
+	}
+	if (server_principal == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	name_token.value = (uint8_t *)server_principal;
+	name_token.length = strlen(server_principal);
+
+	maj_stat = gss_import_name(&min_stat,
+				   &name_token,
+				   name_type,
+				   pserver_name);
+	if (maj_stat) {
+		DBG_WARNING("GSS Import name of %s failed: %s\n",
+			    server_principal,
+			    gse_errstr(mem_ctx, maj_stat, min_stat));
+		TALLOC_FREE(server_principal);
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	*pserver_principal = server_principal;
+
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
+				 bool do_sign, bool do_seal,
+				 const char *ccache_name,
+				 uint32_t add_gss_c_flags,
+				 struct gse_context **_gse_ctx)
+{
+	struct gse_context *gse_ctx;
+	krb5_error_code k5ret;
+	NTSTATUS status;
+
+	gse_ctx = talloc_zero(mem_ctx, struct gse_context);
+	if (!gse_ctx) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	talloc_set_destructor((TALLOC_CTX *)gse_ctx, gse_context_destructor);
+
+	gse_ctx->expire_time = GENSEC_EXPIRE_TIME_INFINITY;
+	gse_ctx->max_wrap_buf_size = UINT16_MAX;
+
+	memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
+
+	gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
+				GSS_C_DELEG_POLICY_FLAG |
+				GSS_C_REPLAY_FLAG |
+				GSS_C_SEQUENCE_FLAG;
+	if (do_sign) {
+		gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
+	}
+	if (do_seal) {
+		gse_ctx->gss_want_flags |= GSS_C_INTEG_FLAG;
+		gse_ctx->gss_want_flags |= GSS_C_CONF_FLAG;
+	}
+
+	gse_ctx->gss_want_flags |= add_gss_c_flags;
+
+	/* Initialize Kerberos Context */
+	k5ret = smb_krb5_init_context_common(&gse_ctx->k5ctx);
+	if (k5ret) {
+		DBG_ERR("kerberos init context failed (%s)\n",
+			error_message(k5ret));
+		status = NT_STATUS_INTERNAL_ERROR;
+		goto err_out;
+	}
+
+#ifdef SAMBA4_USES_HEIMDAL
+	k5ret = gsskrb5_set_dns_canonicalize(false);
+	if (k5ret) {
+		DBG_ERR("gsskrb5_set_dns_canonicalize() failed (%s)\n",
+			error_message(k5ret));
+		status = NT_STATUS_INTERNAL_ERROR;
+		goto err_out;
+	}
+#endif
+
+	if (!ccache_name) {
+		ccache_name = krb5_cc_default_name(gse_ctx->k5ctx);
+	}
+	k5ret = krb5_cc_resolve(gse_ctx->k5ctx, ccache_name,
+				&gse_ctx->ccache);
+	if (k5ret) {
+		DEBUG(1, ("Failed to resolve credential cache '%s'! (%s)\n",
+			  ccache_name, error_message(k5ret)));
+		status = NT_STATUS_INTERNAL_ERROR;
+		goto err_out;
+	}
+
+	/* TODO: Should we enforce a enc_types list ?
+	ret = krb5_set_default_tgs_ktypes(gse_ctx->k5ctx, enc_types);
+	*/
+
+	*_gse_ctx = gse_ctx;
+	return NT_STATUS_OK;
+
+err_out:
+	TALLOC_FREE(gse_ctx);
+	return status;
+}
+
+static NTSTATUS gse_init_client(struct gensec_security *gensec_security,
+				bool do_sign, bool do_seal,
+				const char *ccache_name,
+				const char *server,
+				const char *service,
+				const char *realm,
+				const char *username,
+				const char *password,
+				uint32_t add_gss_c_flags,
+				struct gse_context **_gse_ctx)
+{
+	struct gse_context *gse_ctx;
+	OM_uint32 gss_maj, gss_min;
+#ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
+	gss_buffer_desc empty_buffer = GSS_C_EMPTY_BUFFER;
+	gss_OID oid = discard_const(GSS_KRB5_CRED_NO_CI_FLAGS_X);
+#endif
+	NTSTATUS status;
+
+	if (!server || !service) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	status = gse_context_init(gensec_security, do_sign, do_seal,
+				  ccache_name, add_gss_c_flags,
+				  &gse_ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+#ifdef SAMBA4_USES_HEIMDAL
+	{
+		int ret;
+		bool set_dns_canon = gensec_setting_bool(
+				gensec_security->settings,
+				"krb5", "set_dns_canonicalize",
+				false);
+		const char *server_realm = lpcfg_realm(
+				gensec_security->settings->lp_ctx);
+		if (server_realm != NULL) {
+			ret = gsskrb5_set_default_realm(server_realm);
+			if (ret) {
+				DBG_ERR("gsskrb5_set_default_realm failed\n");
+				return NT_STATUS_INTERNAL_ERROR;
+			}
+		}
+
+		/*
+		 * don't do DNS lookups of any kind, it might/will
+		 * fail for a netbios name
+		 */
+		ret = gsskrb5_set_dns_canonicalize(set_dns_canon);
+		if (ret != GSS_S_COMPLETE) {
+			DBG_ERR("gsskrb5_set_dns_canonicalize failed\n");
+			return NT_STATUS_INTERNAL_ERROR;
+		}
+	}
+#endif
+
+	/* TODO: get krb5 ticket using username/password, if no valid
+	 * one already available in ccache */
+
+	gss_maj = smb_gss_krb5_import_cred(&gss_min,
+					   gse_ctx->k5ctx,
+					   gse_ctx->ccache,
+					   NULL, /* keytab_principal */
+					   NULL, /* keytab */
+					   &gse_ctx->creds);
+	if (gss_maj) {
+		char *ccache = NULL;
+		int kret;
+
+		kret = krb5_cc_get_full_name(gse_ctx->k5ctx,
+					     gse_ctx->ccache,
+					     &ccache);
+		if (kret != 0) {
+			ccache = NULL;
+		}
+
+		DEBUG(5, ("smb_gss_krb5_import_cred ccache[%s] failed with [%s] -"
+			  "the caller may retry after a kinit.\n",
+			  ccache, gse_errstr(gse_ctx, gss_maj, gss_min)));
+		krb5_free_string(gse_ctx->k5ctx, ccache);
+		status = NT_STATUS_INTERNAL_ERROR;
+		goto err_out;
+	}
+
+#ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
+	/*
+	 * Don't force GSS_C_CONF_FLAG and GSS_C_INTEG_FLAG.
+	 *
+	 * This allows us to disable SIGN and SEAL for
+	 * AUTH_LEVEL_CONNECT and AUTH_LEVEL_INTEGRITY.
+	 *
+	 * https://groups.yahoo.com/neo/groups/cat-ietf/conversations/topics/575
+	 * http://krbdev.mit.edu/rt/Ticket/Display.html?id=6938
+	 */
+	gss_maj = gss_set_cred_option(&gss_min, &gse_ctx->creds,
+				      oid,
+				      &empty_buffer);
+	if (gss_maj) {
+		DEBUG(0, ("gss_set_cred_option(GSS_KRB5_CRED_NO_CI_FLAGS_X), "
+			  "failed with [%s]\n",
+			  gse_errstr(gse_ctx, gss_maj, gss_min)));
+		status = NT_STATUS_INTERNAL_ERROR;
+		goto err_out;
+	}
+#endif
+
+	*_gse_ctx = gse_ctx;
+	return NT_STATUS_OK;
+
+err_out:
+	TALLOC_FREE(gse_ctx);
+	return status;
+}
+
+static NTSTATUS gse_get_client_auth_token(TALLOC_CTX *mem_ctx,
+					  struct gensec_security *gensec_security,
+					  const DATA_BLOB *token_in,
+					  DATA_BLOB *token_out)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+				      struct gse_context);
+	OM_uint32 gss_maj = 0;
+	OM_uint32 gss_min;
+	gss_buffer_desc in_data;
+	gss_buffer_desc out_data;
+	DATA_BLOB blob = data_blob_null;
+	NTSTATUS status;
+	OM_uint32 time_rec = 0;
+	struct timeval tv;
+	struct cli_credentials *cli_creds = gensec_get_credentials(gensec_security);
+	const char *target_principal = gensec_get_target_principal(gensec_security);
+	const char *hostname = gensec_get_target_hostname(gensec_security);
+	const char *service = gensec_get_target_service(gensec_security);
+	const char *client_realm = cli_credentials_get_realm(cli_creds);
+	char *server_principal = NULL;
+	char *server_realm = NULL;
+	bool fallback = false;
+	OM_uint32 time_req = 0;
+
+	time_req = gensec_setting_int(gensec_security->settings,
+				      "gensec_gssapi",
+				      "requested_life_time",
+				      time_req);
+
+	in_data.value = token_in->data;
+	in_data.length = token_in->length;
+
+	/*
+	 * With credentials for administrator@FOREST1.EXAMPLE.COM this patch
+	 * changes the target_principal for the ldap service of host
+	 * dc2.forest2.example.com from
+	 *
+	 *   ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM
+	 *
+	 * to
+	 *
+	 *   ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM
+	 *
+	 * Typically ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM should be
+	 * used in order to allow the KDC of FOREST1.EXAMPLE.COM to generate a
+	 * referral ticket for krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM.
+	 *
+	 * The problem is that KDCs only return such referral tickets if
+	 * there's a forest trust between FOREST1.EXAMPLE.COM and
+	 * FOREST2.EXAMPLE.COM. If there's only an external domain trust
+	 * between FOREST1.EXAMPLE.COM and FOREST2.EXAMPLE.COM the KDC of
+	 * FOREST1.EXAMPLE.COM will respond with S_PRINCIPAL_UNKNOWN when being
+	 * asked for ldap/dc2.forest2.example.com@FOREST1.EXAMPLE.COM.
+	 *
+	 * In the case of an external trust the client can still ask explicitly
+	 * for krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM and the KDC of
+	 * FOREST1.EXAMPLE.COM will generate it.
+	 *
+	 * From there the client can use the
+	 * krbtgt/FOREST2.EXAMPLE.COM@FOREST1.EXAMPLE.COM ticket and ask a KDC
+	 * of FOREST2.EXAMPLE.COM for a service ticket for
+	 * ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM.
+	 *
+	 * With Heimdal we'll get the fallback on S_PRINCIPAL_UNKNOWN behavior
+	 * when we pass ldap/dc2.forest2.example.com@FOREST2.EXAMPLE.COM as
+	 * target principal. As _krb5_get_cred_kdc_any() first calls
+	 * get_cred_kdc_referral() (which always starts with the client realm)
+	 * and falls back to get_cred_kdc_capath() (which starts with the given
+	 * realm).
+	 *
+	 * MIT krb5 only tries the given realm of the target principal, if we
+	 * want to autodetect support for transitive forest trusts, would have
+	 * to do the fallback ourself.
+	 */
+#ifndef SAMBA4_USES_HEIMDAL
+	if (gse_ctx->server_name == NULL) {
+		OM_uint32 gss_min2 = 0;
+
+		status = gse_setup_server_principal(mem_ctx,
+						    target_principal,
+						    service,
+						    hostname,
+						    client_realm,
+						    &server_principal,
+						    &gse_ctx->server_name);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+
+		gss_maj = gss_init_sec_context(&gss_min,
+					       gse_ctx->creds,
+					       &gse_ctx->gssapi_context,
+					       gse_ctx->server_name,
+					       &gse_ctx->gss_mech,
+					       gse_ctx->gss_want_flags,
+					       time_req,
+					       GSS_C_NO_CHANNEL_BINDINGS,
+					       &in_data,
+					       NULL,
+					       &out_data,
+					       &gse_ctx->gss_got_flags,
+					       &time_rec);
+		if (gss_maj != GSS_S_FAILURE) {
+			goto init_sec_context_done;
+		}
+		if (gss_min != (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
+			goto init_sec_context_done;
+		}
+		if (target_principal != NULL) {
+			goto init_sec_context_done;
+		}
+
+		fallback = true;
+		TALLOC_FREE(server_principal);
+		gss_release_name(&gss_min2, &gse_ctx->server_name);
+	}
+#endif /* !SAMBA4_USES_HEIMDAL */
+
+	if (gse_ctx->server_name == NULL) {
+		server_realm = smb_krb5_get_realm_from_hostname(mem_ctx,
+								hostname,
+								client_realm);
+		if (server_realm == NULL) {
+			return NT_STATUS_NO_MEMORY;
+		}
+
+		if (fallback &&
+		    strequal(client_realm, server_realm)) {
+			goto init_sec_context_done;
+		}
+
+		status = gse_setup_server_principal(mem_ctx,
+						    target_principal,
+						    service,
+						    hostname,
+						    server_realm,
+						    &server_principal,
+						    &gse_ctx->server_name);
+		TALLOC_FREE(server_realm);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+
+		TALLOC_FREE(server_principal);
+	}
+
+	gss_maj = gss_init_sec_context(&gss_min,
+					gse_ctx->creds,
+					&gse_ctx->gssapi_context,
+					gse_ctx->server_name,
+					&gse_ctx->gss_mech,
+					gse_ctx->gss_want_flags,
+					time_req, GSS_C_NO_CHANNEL_BINDINGS,
+					&in_data, NULL, &out_data,
+					&gse_ctx->gss_got_flags, &time_rec);
+	goto init_sec_context_done;
+	/* JUMP! */
+init_sec_context_done:
+
+	switch (gss_maj) {
+	case GSS_S_COMPLETE:
+		/* we are done with it */
+		tv = timeval_current_ofs(time_rec, 0);
+		gse_ctx->expire_time = timeval_to_nttime(&tv);
+
+		status = NT_STATUS_OK;
+		break;
+	case GSS_S_CONTINUE_NEEDED:
+		/* we will need a third leg */
+		status = NT_STATUS_MORE_PROCESSING_REQUIRED;
+		break;
+	case GSS_S_CONTEXT_EXPIRED:
+		/* Make SPNEGO ignore us, we can't go any further here */
+		DBG_NOTICE("Context expired\n");
+		status = NT_STATUS_INVALID_PARAMETER;
+		goto done;
+	case GSS_S_FAILURE:
+		switch (gss_min) {
+		case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: {
+			gss_buffer_desc name_token = {
+				.length = 0,
+			};
+
+			gss_maj = gss_display_name(&gss_min,
+						   gse_ctx->server_name,
+						   &name_token,
+						   NULL);
+			if (gss_maj == GSS_S_COMPLETE) {
+				DBG_NOTICE("Server principal %.*s not found\n",
+					   (int)name_token.length,
+					   (char *)name_token.value);
+				gss_release_buffer(&gss_maj, &name_token);
+			} else {
+				DBG_NOTICE("Server principal not found\n");
+			}
+
+			/* Make SPNEGO ignore us, we can't go any further here */
+			status = NT_STATUS_INVALID_PARAMETER;
+			goto done;
+		}
+		case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED:
+			DBG_NOTICE("Ticket expired\n");
+			/* Make SPNEGO ignore us, we can't go any further here */
+			status = NT_STATUS_INVALID_PARAMETER;
+			goto done;
+		case (OM_uint32)KRB5KRB_AP_ERR_TKT_NYV:
+			DBG_NOTICE("Clockskew\n");
+			/* Make SPNEGO ignore us, we can't go any further here */
+			status = NT_STATUS_TIME_DIFFERENCE_AT_DC;
+			goto done;
+		case (OM_uint32)KRB5_KDC_UNREACH:
+			DBG_NOTICE("KDC unreachable\n");
+			/* Make SPNEGO ignore us, we can't go any further here */
+			status = NT_STATUS_NO_LOGON_SERVERS;
+			goto done;
+		case (OM_uint32)KRB5KRB_AP_ERR_MSG_TYPE:
+			/* Garbage input, possibly from the auto-mech detection */
+			status = NT_STATUS_INVALID_PARAMETER;
+			goto done;
+		case (OM_uint32)KRB5KDC_ERR_ETYPE_NOSUPP:
+			status = NT_STATUS_KDC_UNKNOWN_ETYPE;
+			goto done;
+		default:
+			DBG_ERR("gss_init_sec_context failed with [%s](%u)\n",
+				gse_errstr(talloc_tos(), gss_maj, gss_min),
+				gss_min);
+			status = NT_STATUS_LOGON_FAILURE;
+			goto done;
+		}
+		break;
+	default:
+		DBG_ERR("gss_init_sec_context failed with [%s]\n",
+			gse_errstr(talloc_tos(), gss_maj, gss_min));
+		status = NT_STATUS_INTERNAL_ERROR;
+		goto done;
+	}
+
+	/* we may be told to return nothing */
+	if (out_data.length) {
+		blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
+		if (!blob.data) {
+			status = NT_STATUS_NO_MEMORY;
+		}
+
+		gss_release_buffer(&gss_min, &out_data);
+	}
+
+done:
+	*token_out = blob;
+	return status;
+}
+
+static NTSTATUS gse_init_server(TALLOC_CTX *mem_ctx,
+				bool do_sign, bool do_seal,
+				uint32_t add_gss_c_flags,
+				struct gse_context **_gse_ctx)
+{
+	struct gse_context *gse_ctx;
+	OM_uint32 gss_maj, gss_min;
+	krb5_error_code ret;
+	NTSTATUS status;
+
+	status = gse_context_init(mem_ctx, do_sign, do_seal,
+				  NULL, add_gss_c_flags, &gse_ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	ret = gse_krb5_get_server_keytab(gse_ctx->k5ctx,
+					 &gse_ctx->keytab);
+	if (ret) {
+		status = NT_STATUS_INTERNAL_ERROR;
+		goto done;
+	}
+
+	/* This creates a GSSAPI cred_id_t with the keytab set */
+	gss_maj = smb_gss_krb5_import_cred(&gss_min, gse_ctx->k5ctx,
+					   NULL, NULL, gse_ctx->keytab,
+					   &gse_ctx->creds);
+
+	if (gss_maj != 0) {
+		DEBUG(0, ("smb_gss_krb5_import_cred failed with [%s]\n",
+			  gse_errstr(gse_ctx, gss_maj, gss_min)));
+		status = NT_STATUS_INTERNAL_ERROR;
+		goto done;
+	}
+
+	status = NT_STATUS_OK;
+
+done:
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(gse_ctx);
+	}
+
+	*_gse_ctx = gse_ctx;
+	return status;
+}
+
+static NTSTATUS gse_get_server_auth_token(TALLOC_CTX *mem_ctx,
+					  struct gensec_security *gensec_security,
+					  const DATA_BLOB *token_in,
+					  DATA_BLOB *token_out)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+				      struct gse_context);
+	OM_uint32 gss_maj, gss_min;
+	gss_buffer_desc in_data;
+	gss_buffer_desc out_data;
+	DATA_BLOB blob = data_blob_null;
+	NTSTATUS status;
+	OM_uint32 time_rec = 0;
+	struct timeval tv;
+
+	in_data.value = token_in->data;
+	in_data.length = token_in->length;
+
+	gss_maj = gss_accept_sec_context(&gss_min,
+					 &gse_ctx->gssapi_context,
+					 gse_ctx->creds,
+					 &in_data,
+					 GSS_C_NO_CHANNEL_BINDINGS,
+					 &gse_ctx->client_name,
+					 &gse_ctx->ret_mech,
+					 &out_data,
+					 &gse_ctx->gss_got_flags,
+					 &time_rec,
+					 &gse_ctx->delegated_cred_handle);
+	switch (gss_maj) {
+	case GSS_S_COMPLETE:
+		/* we are done with it */
+		tv = timeval_current_ofs(time_rec, 0);
+		gse_ctx->expire_time = timeval_to_nttime(&tv);
+
+		status = NT_STATUS_OK;
+		break;
+	case GSS_S_CONTINUE_NEEDED:
+		/* we will need a third leg */
+		status = NT_STATUS_MORE_PROCESSING_REQUIRED;
+		break;
+	default:
+		DEBUG(1, ("gss_accept_sec_context failed with [%s]\n",
+			  gse_errstr(talloc_tos(), gss_maj, gss_min)));
+
+		if (gse_ctx->gssapi_context) {
+			gss_delete_sec_context(&gss_min,
+						&gse_ctx->gssapi_context,
+						GSS_C_NO_BUFFER);
+		}
+
+		/*
+		 * If we got an output token, make Windows aware of it
+		 * by telling it that more processing is needed
+		 */
+		if (out_data.length > 0) {
+			status = NT_STATUS_MORE_PROCESSING_REQUIRED;
+			/* Fall through to handle the out token */
+		} else {
+			status = NT_STATUS_LOGON_FAILURE;
+			goto done;
+		}
+	}
+
+	/* we may be told to return nothing */
+	if (out_data.length) {
+		blob = data_blob_talloc(mem_ctx, out_data.value, out_data.length);
+		if (!blob.data) {
+			status = NT_STATUS_NO_MEMORY;
+		}
+		gss_release_buffer(&gss_min, &out_data);
+	}
+
+
+done:
+	*token_out = blob;
+	return status;
+}
+
+static char *gse_errstr(TALLOC_CTX *mem_ctx, OM_uint32 maj, OM_uint32 min)
+{
+	OM_uint32 gss_min, gss_maj;
+	gss_buffer_desc msg_min;
+	gss_buffer_desc msg_maj;
+	OM_uint32 msg_ctx = 0;
+
+	char *errstr = NULL;
+
+	ZERO_STRUCT(msg_min);
+	ZERO_STRUCT(msg_maj);
+
+	gss_maj = gss_display_status(&gss_min, maj, GSS_C_GSS_CODE,
+				     GSS_C_NO_OID, &msg_ctx, &msg_maj);
+	if (gss_maj) {
+		goto done;
+	}
+	errstr = talloc_strndup(mem_ctx,
+				(char *)msg_maj.value,
+					msg_maj.length);
+	if (!errstr) {
+		goto done;
+	}
+	gss_maj = gss_display_status(&gss_min, min, GSS_C_MECH_CODE,
+				     (gss_OID)discard_const(gss_mech_krb5),
+				     &msg_ctx, &msg_min);
+	if (gss_maj) {
+		goto done;
+	}
+
+	errstr = talloc_strdup_append_buffer(errstr, ": ");
+	if (!errstr) {
+		goto done;
+	}
+	errstr = talloc_strndup_append_buffer(errstr,
+						(char *)msg_min.value,
+							msg_min.length);
+	if (!errstr) {
+		goto done;
+	}
+
+done:
+	if (msg_min.value) {
+		gss_release_buffer(&gss_min, &msg_min);
+	}
+	if (msg_maj.value) {
+		gss_release_buffer(&gss_min, &msg_maj);
+	}
+	return errstr;
+}
+
+static NTSTATUS gensec_gse_client_start(struct gensec_security *gensec_security)
+{
+	struct gse_context *gse_ctx;
+	struct cli_credentials *creds = gensec_get_credentials(gensec_security);
+	NTSTATUS nt_status;
+	OM_uint32 want_flags = 0;
+	bool do_sign = false, do_seal = false;
+	const char *hostname = gensec_get_target_hostname(gensec_security);
+	const char *service = gensec_get_target_service(gensec_security);
+	const char *username = cli_credentials_get_username(creds);
+	const char *password = cli_credentials_get_password(creds);
+	const char *realm = cli_credentials_get_realm(creds);
+
+	if (!hostname) {
+		DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	if (is_ipaddress(hostname)) {
+		DEBUG(2, ("Cannot do GSE to an IP address\n"));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	if (strcmp(hostname, "localhost") == 0) {
+		DEBUG(2, ("GSE to 'localhost' does not make sense\n"));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
+		do_sign = true;
+	}
+	if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
+		do_sign = true;
+	}
+	if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
+		do_seal = true;
+	}
+	if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
+		want_flags |= GSS_C_DCE_STYLE;
+	}
+
+	nt_status = gse_init_client(gensec_security, do_sign, do_seal, NULL,
+				    hostname, service, realm,
+				    username, password, want_flags,
+				    &gse_ctx);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		return nt_status;
+	}
+	gensec_security->private_data = gse_ctx;
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_gse_server_start(struct gensec_security *gensec_security)
+{
+	struct gse_context *gse_ctx;
+	NTSTATUS nt_status;
+	OM_uint32 want_flags = 0;
+	bool do_sign = false, do_seal = false;
+
+	if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
+		do_sign = true;
+	}
+	if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
+		do_seal = true;
+	}
+	if (gensec_security->want_features & GENSEC_FEATURE_DCE_STYLE) {
+		want_flags |= GSS_C_DCE_STYLE;
+	}
+
+	nt_status = gse_init_server(gensec_security, do_sign, do_seal, want_flags,
+				    &gse_ctx);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		return nt_status;
+	}
+	gensec_security->private_data = gse_ctx;
+	return NT_STATUS_OK;
+}
+
+struct gensec_gse_update_state {
+	NTSTATUS status;
+	DATA_BLOB out;
+};
+
+static NTSTATUS gensec_gse_update_internal(struct gensec_security *gensec_security,
+					   TALLOC_CTX *mem_ctx,
+					   const DATA_BLOB in,
+					   DATA_BLOB *out);
+
+static struct tevent_req *gensec_gse_update_send(TALLOC_CTX *mem_ctx,
+						 struct tevent_context *ev,
+						 struct gensec_security *gensec_security,
+						 const DATA_BLOB in)
+{
+	struct tevent_req *req = NULL;
+	struct gensec_gse_update_state *state = NULL;
+	NTSTATUS status;
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct gensec_gse_update_state);
+	if (req == NULL) {
+		return NULL;
+	}
+
+	status = gensec_gse_update_internal(gensec_security,
+					    state, in,
+					    &state->out);
+	state->status = status;
+	if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+		tevent_req_done(req);
+		return tevent_req_post(req, ev);
+	}
+	if (tevent_req_nterror(req, status)) {
+		return tevent_req_post(req, ev);
+	}
+
+	tevent_req_done(req);
+	return tevent_req_post(req, ev);
+}
+
+static NTSTATUS gensec_gse_update_internal(struct gensec_security *gensec_security,
+					   TALLOC_CTX *mem_ctx,
+					   const DATA_BLOB in,
+					   DATA_BLOB *out)
+{
+	NTSTATUS status;
+
+	switch (gensec_security->gensec_role) {
+	case GENSEC_CLIENT:
+		status = gse_get_client_auth_token(mem_ctx,
+						   gensec_security,
+						   &in, out);
+		break;
+	case GENSEC_SERVER:
+		status = gse_get_server_auth_token(mem_ctx,
+						   gensec_security,
+						   &in, out);
+		break;
+	}
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_gse_update_recv(struct tevent_req *req,
+				       TALLOC_CTX *out_mem_ctx,
+				       DATA_BLOB *out)
+{
+	struct gensec_gse_update_state *state =
+		tevent_req_data(req,
+		struct gensec_gse_update_state);
+	NTSTATUS status;
+
+	*out = data_blob_null;
+
+	if (tevent_req_is_nterror(req, &status)) {
+		tevent_req_received(req);
+		return status;
+	}
+
+	*out = state->out;
+	talloc_steal(out_mem_ctx, state->out.data);
+	status = state->status;
+	tevent_req_received(req);
+	return status;
+}
+
+static NTSTATUS gensec_gse_wrap(struct gensec_security *gensec_security,
+				TALLOC_CTX *mem_ctx,
+				const DATA_BLOB *in,
+				DATA_BLOB *out)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+	OM_uint32 maj_stat, min_stat;
+	gss_buffer_desc input_token, output_token;
+	int conf_state;
+	input_token.length = in->length;
+	input_token.value = in->data;
+
+	maj_stat = gss_wrap(&min_stat,
+			    gse_ctx->gssapi_context,
+			    gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
+			    GSS_C_QOP_DEFAULT,
+			    &input_token,
+			    &conf_state,
+			    &output_token);
+	if (GSS_ERROR(maj_stat)) {
+		DEBUG(0, ("gensec_gse_wrap: GSS Wrap failed: %s\n",
+			  gse_errstr(talloc_tos(), maj_stat, min_stat)));
+		return NT_STATUS_ACCESS_DENIED;
+	}
+
+	*out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
+	gss_release_buffer(&min_stat, &output_token);
+
+	if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
+	    && !conf_state) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_gse_unwrap(struct gensec_security *gensec_security,
+				     TALLOC_CTX *mem_ctx,
+				     const DATA_BLOB *in,
+				     DATA_BLOB *out)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+	OM_uint32 maj_stat, min_stat;
+	gss_buffer_desc input_token, output_token;
+	int conf_state;
+	gss_qop_t qop_state;
+	input_token.length = in->length;
+	input_token.value = in->data;
+
+	maj_stat = gss_unwrap(&min_stat,
+			      gse_ctx->gssapi_context,
+			      &input_token,
+			      &output_token,
+			      &conf_state,
+			      &qop_state);
+	if (GSS_ERROR(maj_stat)) {
+		DEBUG(0, ("gensec_gse_unwrap: GSS UnWrap failed: %s\n",
+			  gse_errstr(talloc_tos(), maj_stat, min_stat)));
+		return NT_STATUS_ACCESS_DENIED;
+	}
+
+	*out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
+	gss_release_buffer(&min_stat, &output_token);
+
+	if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)
+	    && !conf_state) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_gse_seal_packet(struct gensec_security *gensec_security,
+				       TALLOC_CTX *mem_ctx,
+				       uint8_t *data, size_t length,
+				       const uint8_t *whole_pdu, size_t pdu_length,
+				       DATA_BLOB *sig)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+	bool hdr_signing = false;
+	size_t sig_size = 0;
+	NTSTATUS status;
+
+	if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+		hdr_signing = true;
+	}
+
+	sig_size = gensec_gse_sig_size(gensec_security, length);
+
+	status = gssapi_seal_packet(gse_ctx->gssapi_context,
+				    &gse_ctx->gss_mech,
+				    hdr_signing, sig_size,
+				    data, length,
+				    whole_pdu, pdu_length,
+				    mem_ctx, sig);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0, ("gssapi_seal_packet(hdr_signing=%u,sig_size=%zu,"
+			  "data=%zu,pdu=%zu) failed: %s\n",
+			  hdr_signing, sig_size, length, pdu_length,
+			  nt_errstr(status)));
+		return status;
+	}
+
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_gse_unseal_packet(struct gensec_security *gensec_security,
+					 uint8_t *data, size_t length,
+					 const uint8_t *whole_pdu, size_t pdu_length,
+					 const DATA_BLOB *sig)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+	bool hdr_signing = false;
+	NTSTATUS status;
+
+	if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+		hdr_signing = true;
+	}
+
+	status = gssapi_unseal_packet(gse_ctx->gssapi_context,
+				      &gse_ctx->gss_mech,
+				      hdr_signing,
+				      data, length,
+				      whole_pdu, pdu_length,
+				      sig);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0, ("gssapi_unseal_packet(hdr_signing=%u,sig_size=%zu,"
+			  "data=%zu,pdu=%zu) failed: %s\n",
+			  hdr_signing, sig->length, length, pdu_length,
+			  nt_errstr(status)));
+		return status;
+	}
+
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_gse_sign_packet(struct gensec_security *gensec_security,
+				       TALLOC_CTX *mem_ctx,
+				       const uint8_t *data, size_t length,
+				       const uint8_t *whole_pdu, size_t pdu_length,
+				       DATA_BLOB *sig)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+	bool hdr_signing = false;
+	NTSTATUS status;
+
+	if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+		hdr_signing = true;
+	}
+
+	status = gssapi_sign_packet(gse_ctx->gssapi_context,
+				    &gse_ctx->gss_mech,
+				    hdr_signing,
+				    data, length,
+				    whole_pdu, pdu_length,
+				    mem_ctx, sig);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0, ("gssapi_sign_packet(hdr_signing=%u,"
+			  "data=%zu,pdu=%zu) failed: %s\n",
+			  hdr_signing, length, pdu_length,
+			  nt_errstr(status)));
+		return status;
+	}
+
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS gensec_gse_check_packet(struct gensec_security *gensec_security,
+					const uint8_t *data, size_t length,
+					const uint8_t *whole_pdu, size_t pdu_length,
+					const DATA_BLOB *sig)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+	bool hdr_signing = false;
+	NTSTATUS status;
+
+	if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+		hdr_signing = true;
+	}
+
+	status = gssapi_check_packet(gse_ctx->gssapi_context,
+				     &gse_ctx->gss_mech,
+				     hdr_signing,
+				     data, length,
+				     whole_pdu, pdu_length,
+				     sig);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0, ("gssapi_check_packet(hdr_signing=%u,sig_size=%zu"
+			  "data=%zu,pdu=%zu) failed: %s\n",
+			  hdr_signing, sig->length, length, pdu_length,
+			  nt_errstr(status)));
+		return status;
+	}
+
+	return NT_STATUS_OK;
+}
+
+/* Try to figure out what features we actually got on the connection */
+static bool gensec_gse_have_feature(struct gensec_security *gensec_security,
+				    uint32_t feature)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+
+	if (feature & GENSEC_FEATURE_SESSION_KEY) {
+		return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
+	}
+	if (feature & GENSEC_FEATURE_SIGN) {
+		return gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG;
+	}
+	if (feature & GENSEC_FEATURE_SEAL) {
+		return gse_ctx->gss_got_flags & GSS_C_CONF_FLAG;
+	}
+	if (feature & GENSEC_FEATURE_DCE_STYLE) {
+		return gse_ctx->gss_got_flags & GSS_C_DCE_STYLE;
+	}
+	if (feature & GENSEC_FEATURE_NEW_SPNEGO) {
+		NTSTATUS status;
+		uint32_t keytype;
+
+		if (!(gse_ctx->gss_got_flags & GSS_C_INTEG_FLAG)) {
+			return false;
+		}
+
+		status = gssapi_get_session_key(talloc_tos(),
+						gse_ctx->gssapi_context, NULL, &keytype);
+		/*
+		 * We should do a proper sig on the mechListMic unless
+		 * we know we have to be backwards compatible with
+		 * earlier windows versions.
+		 *
+		 * Negotiating a non-krb5
+		 * mech for example should be regarded as having
+		 * NEW_SPNEGO
+		 */
+		if (NT_STATUS_IS_OK(status)) {
+			switch (keytype) {
+			case ENCTYPE_DES_CBC_CRC:
+			case ENCTYPE_DES_CBC_MD5:
+			case ENCTYPE_ARCFOUR_HMAC:
+			case ENCTYPE_DES3_CBC_SHA1:
+				return false;
+			}
+		}
+		return true;
+	}
+	/* We can always do async (rather than strict request/reply) packets.  */
+	if (feature & GENSEC_FEATURE_ASYNC_REPLIES) {
+		return true;
+	}
+	if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+		return true;
+	}
+	return false;
+}
+
+static NTTIME gensec_gse_expire_time(struct gensec_security *gensec_security)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+
+	return gse_ctx->expire_time;
+}
+
+/*
+ * Extract the 'session key' needed by SMB signing and ncacn_np
+ * (for encrypting some passwords).
+ *
+ * This breaks all the abstractions, but what do you expect...
+ */
+static NTSTATUS gensec_gse_session_key(struct gensec_security *gensec_security,
+				       TALLOC_CTX *mem_ctx,
+				       DATA_BLOB *session_key)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+
+	return gssapi_get_session_key(mem_ctx, gse_ctx->gssapi_context, session_key, NULL);
+}
+
+/* Get some basic (and authorization) information about the user on
+ * this session.  This uses either the PAC (if present) or a local
+ * database lookup */
+static NTSTATUS gensec_gse_session_info(struct gensec_security *gensec_security,
+					TALLOC_CTX *mem_ctx,
+					struct auth_session_info **_session_info)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+	NTSTATUS nt_status;
+	TALLOC_CTX *tmp_ctx;
+	struct auth_session_info *session_info = NULL;
+	OM_uint32 maj_stat, min_stat;
+	DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
+
+	gss_buffer_desc name_token;
+	char *principal_string;
+
+	tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gse_session_info context");
+	NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
+
+	maj_stat = gss_display_name(&min_stat,
+				    gse_ctx->client_name,
+				    &name_token,
+				    NULL);
+	if (GSS_ERROR(maj_stat)) {
+		DEBUG(1, ("GSS display_name failed: %s\n",
+			  gse_errstr(talloc_tos(), maj_stat, min_stat)));
+		talloc_free(tmp_ctx);
+		return NT_STATUS_FOOBAR;
+	}
+
+	principal_string = talloc_strndup(tmp_ctx,
+					  (const char *)name_token.value,
+					  name_token.length);
+
+	gss_release_buffer(&min_stat, &name_token);
+
+	if (!principal_string) {
+		talloc_free(tmp_ctx);
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	nt_status = gssapi_obtain_pac_blob(tmp_ctx,  gse_ctx->gssapi_context,
+					   gse_ctx->client_name,
+					   &pac_blob);
+
+	/* IF we have the PAC - otherwise we need to get this
+	 * data from elsewhere
+	 */
+	if (NT_STATUS_IS_OK(nt_status)) {
+		pac_blob_ptr = &pac_blob;
+	}
+	nt_status = gensec_generate_session_info_pac(tmp_ctx,
+						     gensec_security,
+						     NULL,
+						     pac_blob_ptr, principal_string,
+						     gensec_get_remote_address(gensec_security),
+						     &session_info);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		talloc_free(tmp_ctx);
+		return nt_status;
+	}
+
+	nt_status = gensec_gse_session_key(gensec_security, session_info,
+					   &session_info->session_key);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		talloc_free(tmp_ctx);
+		return nt_status;
+	}
+
+	*_session_info = talloc_move(mem_ctx, &session_info);
+	talloc_free(tmp_ctx);
+
+	return NT_STATUS_OK;
+}
+
+static size_t gensec_gse_max_input_size(struct gensec_security *gensec_security)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+	OM_uint32 maj_stat, min_stat;
+	OM_uint32 max_input_size;
+
+	maj_stat = gss_wrap_size_limit(&min_stat,
+				       gse_ctx->gssapi_context,
+				       gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL),
+				       GSS_C_QOP_DEFAULT,
+				       gse_ctx->max_wrap_buf_size,
+				       &max_input_size);
+	if (GSS_ERROR(maj_stat)) {
+		TALLOC_CTX *mem_ctx = talloc_new(NULL);
+		DEBUG(1, ("gensec_gssapi_max_input_size: determining signature size with gss_wrap_size_limit failed: %s\n",
+			  gse_errstr(mem_ctx, maj_stat, min_stat)));
+		talloc_free(mem_ctx);
+		return 0;
+	}
+
+	return max_input_size;
+}
+
+/* Find out the maximum output size negotiated on this connection */
+static size_t gensec_gse_max_wrapped_size(struct gensec_security *gensec_security)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+	return gse_ctx->max_wrap_buf_size;
+}
+
+static size_t gensec_gse_sig_size(struct gensec_security *gensec_security,
+				  size_t data_size)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+
+	if (gse_ctx->sig_size > 0) {
+		return gse_ctx->sig_size;
+	}
+
+	gse_ctx->sig_size = gssapi_get_sig_size(gse_ctx->gssapi_context,
+					        &gse_ctx->gss_mech,
+					        gse_ctx->gss_got_flags,
+					        data_size);
+	return gse_ctx->sig_size;
+}
+
+static const char *gensec_gse_final_auth_type(struct gensec_security *gensec_security)
+{
+	struct gse_context *gse_ctx =
+		talloc_get_type_abort(gensec_security->private_data,
+		struct gse_context);
+
+	/* Only return the string for GSSAPI/Krb5 */
+	if (smb_gss_oid_equal(&gse_ctx->gss_mech,
+			      gss_mech_krb5)) {
+		return GENSEC_FINAL_AUTH_TYPE_KRB5;
+	} else {
+		return "gensec_gse: UNKNOWN MECH";
+	}
+}
+
+static const char *gensec_gse_krb5_oids[] = {
+	GENSEC_OID_KERBEROS5_OLD,
+	GENSEC_OID_KERBEROS5,
+	NULL
+};
+
+const struct gensec_security_ops gensec_gse_krb5_security_ops = {
+	.name		= "gse_krb5",
+	.auth_type	= DCERPC_AUTH_TYPE_KRB5,
+	.oid            = gensec_gse_krb5_oids,
+	.client_start   = gensec_gse_client_start,
+	.server_start   = gensec_gse_server_start,
+	.magic  	= gensec_magic_check_krb5_oid,
+	.update_send	= gensec_gse_update_send,
+	.update_recv	= gensec_gse_update_recv,
+	.session_key	= gensec_gse_session_key,
+	.session_info	= gensec_gse_session_info,
+	.sig_size	= gensec_gse_sig_size,
+	.sign_packet	= gensec_gse_sign_packet,
+	.check_packet	= gensec_gse_check_packet,
+	.seal_packet	= gensec_gse_seal_packet,
+	.unseal_packet	= gensec_gse_unseal_packet,
+	.max_input_size	  = gensec_gse_max_input_size,
+	.max_wrapped_size = gensec_gse_max_wrapped_size,
+	.wrap           = gensec_gse_wrap,
+	.unwrap         = gensec_gse_unwrap,
+	.have_feature   = gensec_gse_have_feature,
+	.expire_time    = gensec_gse_expire_time,
+	.final_auth_type  = gensec_gse_final_auth_type,
+	.enabled        = true,
+	.kerberos       = true,
+	.priority       = GENSEC_GSSAPI
+};
+
+#endif /* HAVE_KRB5 */
diff --git a/source3/librpc/crypto/gse.h b/source3/librpc/crypto/gse.h
new file mode 100644
index 0000000..8618573
--- /dev/null
+++ b/source3/librpc/crypto/gse.h
@@ -0,0 +1,26 @@
+/*
+ *  GSSAPI Security Extensions
+ *  Copyright (C) Simo Sorce 2010.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _GSE_H_
+#define _GSE_H_
+
+struct gse_context;
+
+extern const struct gensec_security_ops gensec_gse_krb5_security_ops;
+
+#endif /* _GSE_H_ */
diff --git a/source3/librpc/crypto/gse_krb5.c b/source3/librpc/crypto/gse_krb5.c
new file mode 100644
index 0000000..f1e0e51
--- /dev/null
+++ b/source3/librpc/crypto/gse_krb5.c
@@ -0,0 +1,609 @@
+/*
+ *  GSSAPI Security Extensions
+ *  Krb5 helpers
+ *  Copyright (C) Simo Sorce 2010.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "includes.h"
+#include "smb_krb5.h"
+#include "secrets.h"
+#include "librpc/gen_ndr/secrets.h"
+#include "gse_krb5.h"
+#include "lib/param/loadparm.h"
+#include "libads/kerberos_proto.h"
+#include "lib/util/string_wrappers.h"
+
+#ifdef HAVE_KRB5
+
+static krb5_error_code flush_keytab(krb5_context krbctx, krb5_keytab keytab)
+{
+	krb5_error_code ret;
+	krb5_kt_cursor kt_cursor;
+	krb5_keytab_entry kt_entry;
+
+	ZERO_STRUCT(kt_entry);
+
+	ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor);
+	if (ret != 0) {
+		return ret;
+	}
+
+	ret = krb5_kt_next_entry(krbctx, keytab, &kt_entry, &kt_cursor);
+	while (ret == 0) {
+
+		/* we need to close and reopen enumeration because we modify
+		 * the keytab */
+		ret = krb5_kt_end_seq_get(krbctx, keytab, &kt_cursor);
+		if (ret != 0) {
+			DEBUG(1, (__location__ ": krb5_kt_end_seq_get() "
+				  "failed (%s)\n", error_message(ret)));
+			goto out;
+		}
+
+		/* remove the entry */
+		ret = krb5_kt_remove_entry(krbctx, keytab, &kt_entry);
+		if (ret != 0) {
+			DEBUG(1, (__location__ ": krb5_kt_remove_entry() "
+				  "failed (%s)\n", error_message(ret)));
+			goto out;
+		}
+		smb_krb5_kt_free_entry(krbctx, &kt_entry);
+		ZERO_STRUCT(kt_entry);
+
+		/* now reopen */
+		ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor);
+		if (ret != 0) {
+			DEBUG(1, (__location__ ": krb5_kt_start_seq() failed "
+				  "(%s)\n", error_message(ret)));
+			goto out;
+		}
+
+		ret = krb5_kt_next_entry(krbctx, keytab,
+					 &kt_entry, &kt_cursor);
+	}
+
+	if (ret != KRB5_KT_END && ret != ENOENT) {
+		DEBUG(1, (__location__ ": flushing keytab we got [%s]!\n",
+			  error_message(ret)));
+	}
+
+	ret = krb5_kt_end_seq_get(krbctx, keytab, &kt_cursor);
+	if (ret != 0) {
+		DEBUG(1, (__location__ ": krb5_kt_end_seq_get() "
+			  "failed (%s)\n", error_message(ret)));
+		goto out;
+	}
+	ret = 0;
+
+out:
+	return ret;
+}
+
+static krb5_error_code fill_keytab_from_password(krb5_context krbctx,
+						 krb5_keytab keytab,
+						 krb5_principal princ,
+						 krb5_kvno vno,
+						 struct secrets_domain_info1_password *pw)
+{
+	krb5_error_code ret;
+	krb5_enctype *enctypes;
+	uint16_t i;
+
+	ret = smb_krb5_get_allowed_etypes(krbctx, &enctypes);
+	if (ret) {
+		DEBUG(1, (__location__
+			  ": Can't determine permitted enctypes!\n"));
+		return ret;
+	}
+
+	for (i = 0; i < pw->num_keys; i++) {
+		krb5_keytab_entry kt_entry;
+		krb5_keyblock *key = NULL;
+		unsigned int ei;
+		bool found_etype = false;
+
+		for (ei=0; enctypes[ei] != 0; ei++) {
+			if ((uint32_t)enctypes[ei] != pw->keys[i].keytype) {
+				continue;
+			}
+
+			found_etype = true;
+			break;
+		}
+
+		if (!found_etype) {
+			continue;
+		}
+
+		ZERO_STRUCT(kt_entry);
+		kt_entry.principal = princ;
+		kt_entry.vno = vno;
+
+		key = KRB5_KT_KEY(&kt_entry);
+		KRB5_KEY_TYPE(key) = pw->keys[i].keytype;
+		KRB5_KEY_DATA(key) = pw->keys[i].value.data;
+		KRB5_KEY_LENGTH(key) = pw->keys[i].value.length;
+
+		ret = krb5_kt_add_entry(krbctx, keytab, &kt_entry);
+		if (ret) {
+			DEBUG(1, (__location__ ": Failed to add entry to "
+				  "keytab for enctype %d (error: %s)\n",
+				  (unsigned)pw->keys[i].keytype,
+				  error_message(ret)));
+			goto out;
+		}
+	}
+
+	ret = 0;
+
+out:
+	krb5_free_enctypes(krbctx, enctypes);
+	return ret;
+}
+
+#define SRV_MEM_KEYTAB_NAME "MEMORY:cifs_srv_keytab"
+#define CLEARTEXT_PRIV_ENCTYPE -99
+
+static krb5_error_code fill_mem_keytab_from_secrets(krb5_context krbctx,
+						    krb5_keytab *keytab)
+{
+	TALLOC_CTX *frame = talloc_stackframe();
+	krb5_error_code ret, ret2;
+	const char *domain = lp_workgroup();
+	struct secrets_domain_info1 *info = NULL;
+	const char *realm = NULL;
+	const DATA_BLOB *ct = NULL;
+	krb5_kt_cursor kt_cursor;
+	krb5_keytab_entry kt_entry;
+	krb5_principal princ = NULL;
+	krb5_kvno kvno = 0; /* FIXME: fetch current vno from KDC ? */
+	NTSTATUS status;
+
+	if (!secrets_init()) {
+		DEBUG(1, (__location__ ": secrets_init failed\n"));
+		TALLOC_FREE(frame);
+		return KRB5_CONFIG_CANTOPEN;
+	}
+
+	status = secrets_fetch_or_upgrade_domain_info(domain,
+						      frame,
+						      &info);
+	if (!NT_STATUS_IS_OK(status)) {
+		DBG_WARNING("secrets_fetch_or_upgrade_domain_info(%s) - %s\n",
+			    domain, nt_errstr(status));
+		TALLOC_FREE(frame);
+		return KRB5_LIBOS_CANTREADPWD;
+	}
+	ct = &info->password->cleartext_blob;
+
+	if (info->domain_info.dns_domain.string != NULL) {
+		realm = strupper_talloc(frame,
+				info->domain_info.dns_domain.string);
+		if (realm == NULL) {
+			TALLOC_FREE(frame);
+			return ENOMEM;
+		}
+	}
+
+	ZERO_STRUCT(kt_entry);
+	ZERO_STRUCT(kt_cursor);
+
+	/* check if the keytab already has any entry */
+	ret = krb5_kt_start_seq_get(krbctx, *keytab, &kt_cursor);
+	if (ret != 0) {
+		goto out;
+	}
+
+	/* check if we have our special enctype used to hold
+	 * the clear text password. If so, check it out so that
+	 * we can verify if the keytab needs to be upgraded */
+	while ((ret = krb5_kt_next_entry(krbctx, *keytab,
+				   &kt_entry, &kt_cursor)) == 0) {
+		if (smb_krb5_kt_get_enctype_from_entry(&kt_entry) ==
+		    CLEARTEXT_PRIV_ENCTYPE) {
+			break;
+		}
+		smb_krb5_kt_free_entry(krbctx, &kt_entry);
+		ZERO_STRUCT(kt_entry);
+	}
+
+	ret2 = krb5_kt_end_seq_get(krbctx, *keytab, &kt_cursor);
+	if (ret2 != 0) {
+		ret = ret2;
+		DEBUG(1, (__location__ ": krb5_kt_end_seq_get() "
+			  "failed (%s)\n", error_message(ret)));
+		goto out;
+	}
+
+	if (ret != 0 && ret != KRB5_KT_END && ret != ENOENT ) {
+		/* Error parsing keytab */
+		DEBUG(1, (__location__ ": Failed to parse memory "
+			  "keytab!\n"));
+		goto out;
+	}
+
+	if (ret == 0) {
+		/* found private entry,
+		 * check if keytab is up to date */
+
+		if ((ct->length == KRB5_KEY_LENGTH(KRB5_KT_KEY(&kt_entry))) &&
+		    (mem_equal_const_time(KRB5_KEY_DATA(KRB5_KT_KEY(&kt_entry)),
+					  ct->data, ct->length))) {
+			/* keytab is already up to date, return */
+			smb_krb5_kt_free_entry(krbctx, &kt_entry);
+			goto out;
+		}
+
+		smb_krb5_kt_free_entry(krbctx, &kt_entry);
+		ZERO_STRUCT(kt_entry);
+
+
+		/* flush keytab, we need to regen it */
+		ret = flush_keytab(krbctx, *keytab);
+		if (ret) {
+			DEBUG(1, (__location__ ": Failed to flush "
+				  "memory keytab!\n"));
+			goto out;
+		}
+	}
+
+	/* keytab is not up to date, fill it up */
+
+	ret = smb_krb5_make_principal(krbctx, &princ, realm,
+				      info->account_name, NULL);
+	if (ret) {
+		DEBUG(1, (__location__ ": Failed to get host principal!\n"));
+		goto out;
+	}
+
+	ret = fill_keytab_from_password(krbctx, *keytab,
+					princ, kvno,
+					info->password);
+	if (ret) {
+		DBG_WARNING("fill_keytab_from_password() failed for "
+			    "info->password.\n.");
+		goto out;
+	}
+
+	if (info->old_password != NULL) {
+		ret = fill_keytab_from_password(krbctx, *keytab,
+						princ, kvno - 1,
+						info->old_password);
+		if (ret) {
+			DBG_WARNING("fill_keytab_from_password() failed for "
+				    "info->old_password.\n.");
+			goto out;
+		}
+	}
+
+	if (info->older_password != NULL) {
+		ret = fill_keytab_from_password(krbctx, *keytab,
+						princ, kvno - 2,
+						info->older_password);
+		if (ret) {
+			DBG_WARNING("fill_keytab_from_password() failed for "
+				    "info->older_password.\n.");
+			goto out;
+		}
+	}
+
+	if (info->next_change != NULL) {
+		ret = fill_keytab_from_password(krbctx, *keytab,
+						princ, kvno - 3,
+						info->next_change->password);
+		if (ret) {
+			DBG_WARNING("fill_keytab_from_password() failed for "
+				    "info->next_change->password.\n.");
+			goto out;
+		}
+	}
+
+	/* add our private enctype + cleartext password so that we can
+	 * update the keytab if secrets change later on */
+	ZERO_STRUCT(kt_entry);
+	kt_entry.principal = princ;
+	kt_entry.vno = 0;
+
+	KRB5_KEY_TYPE(KRB5_KT_KEY(&kt_entry)) = CLEARTEXT_PRIV_ENCTYPE;
+	KRB5_KEY_LENGTH(KRB5_KT_KEY(&kt_entry)) = ct->length;
+	KRB5_KEY_DATA(KRB5_KT_KEY(&kt_entry)) = ct->data;
+
+	ret = krb5_kt_add_entry(krbctx, *keytab, &kt_entry);
+	if (ret) {
+		DEBUG(1, (__location__ ": Failed to add entry to "
+			  "keytab for private enctype (%d) (error: %s)\n",
+			   CLEARTEXT_PRIV_ENCTYPE, error_message(ret)));
+		goto out;
+	}
+
+	ret = 0;
+
+out:
+
+	if (princ) {
+		krb5_free_principal(krbctx, princ);
+	}
+
+	TALLOC_FREE(frame);
+	return ret;
+}
+
+static krb5_error_code fill_mem_keytab_from_system_keytab(krb5_context krbctx,
+							  krb5_keytab *mkeytab)
+{
+	krb5_error_code ret = 0;
+	krb5_keytab keytab = NULL;
+	krb5_kt_cursor kt_cursor = { 0, };
+	krb5_keytab_entry kt_entry = { 0, };
+	char *valid_princ_formats[7] = { NULL, NULL, NULL,
+					 NULL, NULL, NULL, NULL };
+	char *entry_princ_s = NULL;
+	fstring my_name, my_fqdn;
+	unsigned i;
+	int err;
+
+	/* Generate the list of principal names which we expect
+	 * clients might want to use for authenticating to the file
+	 * service.  We allow name$,{host,cifs}/{name,fqdn,name.REALM}. */
+
+	fstrcpy(my_name, lp_netbios_name());
+
+	my_fqdn[0] = '\0';
+	name_to_fqdn(my_fqdn, lp_netbios_name());
+
+	err = asprintf(&valid_princ_formats[0],
+			"%s$@%s", my_name, lp_realm());
+	if (err == -1) {
+		ret = ENOMEM;
+		goto out;
+	}
+	err = asprintf(&valid_princ_formats[1],
+			"host/%s@%s", my_name, lp_realm());
+	if (err == -1) {
+		ret = ENOMEM;
+		goto out;
+	}
+	err = asprintf(&valid_princ_formats[2],
+			"host/%s@%s", my_fqdn, lp_realm());
+	if (err == -1) {
+		ret = ENOMEM;
+		goto out;
+	}
+	err = asprintf(&valid_princ_formats[3],
+			"host/%s.%s@%s", my_name, lp_realm(), lp_realm());
+	if (err == -1) {
+		ret = ENOMEM;
+		goto out;
+	}
+	err = asprintf(&valid_princ_formats[4],
+			"cifs/%s@%s", my_name, lp_realm());
+	if (err == -1) {
+		ret = ENOMEM;
+		goto out;
+	}
+	err = asprintf(&valid_princ_formats[5],
+			"cifs/%s@%s", my_fqdn, lp_realm());
+	if (err == -1) {
+		ret = ENOMEM;
+		goto out;
+	}
+	err = asprintf(&valid_princ_formats[6],
+			"cifs/%s.%s@%s", my_name, lp_realm(), lp_realm());
+	if (err == -1) {
+		ret = ENOMEM;
+		goto out;
+	}
+
+	ret = smb_krb5_kt_open_relative(krbctx, NULL, false, &keytab);
+	if (ret) {
+		DEBUG(1, ("smb_krb5_kt_open failed (%s)\n",
+			  error_message(ret)));
+		goto out;
+	}
+
+	/*
+	 * Iterate through the keytab.  For each key, if the principal
+	 * name case-insensitively matches one of the allowed formats,
+	 * copy it to the memory keytab.
+	 */
+
+	ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor);
+	if (ret) {
+		DEBUG(1, (__location__ ": krb5_kt_start_seq_get failed (%s)\n",
+			  error_message(ret)));
+		/*
+		 * krb5_kt_start_seq_get() may leaves bogus data
+		 * in kt_cursor. And we want to use the all_zero()
+		 * logic below.
+		 *
+		 * See bug #10490
+		 */
+		ZERO_STRUCT(kt_cursor);
+		goto out;
+	}
+
+	while ((krb5_kt_next_entry(krbctx, keytab,
+				   &kt_entry, &kt_cursor) == 0)) {
+		ret = smb_krb5_unparse_name(talloc_tos(), krbctx,
+					    kt_entry.principal,
+					    &entry_princ_s);
+		if (ret) {
+			DEBUG(1, (__location__ ": smb_krb5_unparse_name "
+				  "failed (%s)\n", error_message(ret)));
+			goto out;
+		}
+
+		for (i = 0; i < ARRAY_SIZE(valid_princ_formats); i++) {
+
+			if (!strequal(entry_princ_s, valid_princ_formats[i])) {
+				continue;
+			}
+
+			ret = krb5_kt_add_entry(krbctx, *mkeytab, &kt_entry);
+			if (ret) {
+				DEBUG(1, (__location__ ": smb_krb5_unparse_name "
+					  "failed (%s)\n", error_message(ret)));
+				goto out;
+			}
+		}
+
+		/* Free the name we parsed. */
+		TALLOC_FREE(entry_princ_s);
+
+		/* Free the entry we just read. */
+		smb_krb5_kt_free_entry(krbctx, &kt_entry);
+		ZERO_STRUCT(kt_entry);
+	}
+	krb5_kt_end_seq_get(krbctx, keytab, &kt_cursor);
+
+	ZERO_STRUCT(kt_cursor);
+
+out:
+
+	for (i = 0; i < ARRAY_SIZE(valid_princ_formats); i++) {
+		SAFE_FREE(valid_princ_formats[i]);
+	}
+
+	TALLOC_FREE(entry_princ_s);
+
+	if (!all_zero((uint8_t *)&kt_entry, sizeof(kt_entry))) {
+		smb_krb5_kt_free_entry(krbctx, &kt_entry);
+	}
+
+	if (!all_zero((uint8_t *)&kt_cursor, sizeof(kt_cursor)) && keytab) {
+		krb5_kt_end_seq_get(krbctx, keytab, &kt_cursor);
+	}
+
+	if (keytab) {
+		krb5_kt_close(krbctx, keytab);
+	}
+
+	return ret;
+}
+
+static krb5_error_code fill_mem_keytab_from_dedicated_keytab(krb5_context krbctx,
+							     krb5_keytab *mkeytab)
+{
+	krb5_error_code ret = 0;
+	krb5_keytab keytab = NULL;
+	krb5_kt_cursor kt_cursor;
+	krb5_keytab_entry kt_entry;
+
+	ret = smb_krb5_kt_open(krbctx, lp_dedicated_keytab_file(),
+				   false, &keytab);
+	if (ret) {
+		DEBUG(1, ("smb_krb5_kt_open of %s failed (%s)\n",
+			  lp_dedicated_keytab_file(),
+			  error_message(ret)));
+		return ret;
+	}
+
+	/*
+	 * Copy the dedicated keyab to our in-memory keytab.
+	 */
+
+	ret = krb5_kt_start_seq_get(krbctx, keytab, &kt_cursor);
+	if (ret) {
+		DEBUG(1, (__location__ ": krb5_kt_start_seq_get on %s "
+			  "failed (%s)\n",
+			  lp_dedicated_keytab_file(),
+			  error_message(ret)));
+		goto out;
+	}
+
+	while ((krb5_kt_next_entry(krbctx, keytab,
+				   &kt_entry, &kt_cursor) == 0)) {
+
+		ret = krb5_kt_add_entry(krbctx, *mkeytab, &kt_entry);
+
+		/* Free the entry we just read. */
+		smb_krb5_kt_free_entry(krbctx, &kt_entry);
+
+		if (ret) {
+			DEBUG(1, (__location__ ": smb_krb5_unparse_name "
+				  "failed (%s)\n", error_message(ret)));
+			break;
+		}
+	}
+	krb5_kt_end_seq_get(krbctx, keytab, &kt_cursor);
+
+out:
+
+	krb5_kt_close(krbctx, keytab);
+
+	return ret;
+}
+
+krb5_error_code gse_krb5_get_server_keytab(krb5_context krbctx,
+					   krb5_keytab *keytab)
+{
+	krb5_error_code ret = 0;
+	krb5_error_code ret1 = 0;
+	krb5_error_code ret2 = 0;
+
+	*keytab = NULL;
+
+	/* create memory keytab */
+	ret = krb5_kt_resolve(krbctx, SRV_MEM_KEYTAB_NAME, keytab);
+	if (ret) {
+		DEBUG(1, (__location__ ": Failed to get memory "
+			  "keytab!\n"));
+		return ret;
+	}
+
+	switch (lp_kerberos_method()) {
+	default:
+	case KERBEROS_VERIFY_SECRETS:
+		ret = fill_mem_keytab_from_secrets(krbctx, keytab);
+		break;
+	case KERBEROS_VERIFY_SYSTEM_KEYTAB:
+		ret = fill_mem_keytab_from_system_keytab(krbctx, keytab);
+		break;
+	case KERBEROS_VERIFY_DEDICATED_KEYTAB:
+		/* just use whatever keytab is configured */
+		ret = fill_mem_keytab_from_dedicated_keytab(krbctx, keytab);
+		break;
+	case KERBEROS_VERIFY_SECRETS_AND_KEYTAB:
+		ret1 = fill_mem_keytab_from_secrets(krbctx, keytab);
+		if (ret1) {
+			DEBUG(3, (__location__ ": Warning! Unable to set mem "
+				  "keytab from secrets!\n"));
+		}
+		/* Now append system keytab keys too */
+		ret2 = fill_mem_keytab_from_system_keytab(krbctx, keytab);
+		if (ret2) {
+			DEBUG(3, (__location__ ": Warning! Unable to set mem "
+				  "keytab from system keytab!\n"));
+		}
+		if (ret1 == 0 || ret2 == 0) {
+			ret = 0;
+		} else {
+			ret = ret1;
+		}
+		break;
+	}
+
+	if (ret) {
+		krb5_kt_close(krbctx, *keytab);
+		*keytab = NULL;
+		DEBUG(1,("%s: Error! Unable to set mem keytab - %d\n",
+			 __location__, ret));
+	}
+
+	return ret;
+}
+
+#endif /* HAVE_KRB5 */
diff --git a/source3/librpc/crypto/gse_krb5.h b/source3/librpc/crypto/gse_krb5.h
new file mode 100644
index 0000000..ea789c9
--- /dev/null
+++ b/source3/librpc/crypto/gse_krb5.h
@@ -0,0 +1,30 @@
+/*
+ *  GSSAPI Security Extensions
+ *  Krb5 helpers
+ *  Copyright (C) Simo Sorce 2010.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _GSE_KRB5_H_
+#define _GSE_KRB5_H_
+
+#ifdef HAVE_KRB5
+
+krb5_error_code gse_krb5_get_server_keytab(krb5_context krbctx,
+					   krb5_keytab *keytab);
+
+#endif /* HAVE_KRB5 */
+
+#endif /* _GSE_KRB5_H_ */
diff --git a/source3/librpc/gen_ndr/README b/source3/librpc/gen_ndr/README
new file mode 100644
index 0000000..5ccb89d
--- /dev/null
+++ b/source3/librpc/gen_ndr/README
@@ -0,0 +1,4 @@
+This contains the generated files from PIDL for the IDL files in ../idl/*.idl
+
+DO NOT REMOVE THIS FILE. The waf 1.5 build relies on this directory
+existing in the source tree.
diff --git a/source3/librpc/idl/IDL_LICENSE.txt b/source3/librpc/idl/IDL_LICENSE.txt
new file mode 100644
index 0000000..01ae670
--- /dev/null
+++ b/source3/librpc/idl/IDL_LICENSE.txt
@@ -0,0 +1,9 @@
+The IDL files in this directory are made available by the Samba Team
+under the following license:
+
+  Permission to use, copy, modify, and distribute these interface
+  definitions for any purpose is hereby granted without fee.
+
+  This work is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
diff --git a/source3/librpc/idl/ads.idl b/source3/librpc/idl/ads.idl
new file mode 100644
index 0000000..4f3a387
--- /dev/null
+++ b/source3/librpc/idl/ads.idl
@@ -0,0 +1,130 @@
+#include "idl_types.h"
+#include "config.h"
+
+/*
+  ads interface definition
+*/
+
+import "nbt.idl";
+
+cpp_quote("#include <system/network.h>")
+
+[
+	pointer_default(unique)
+]
+interface ads
+{
+	typedef [public] enum {
+		ADS_SASLWRAP_TYPE_PLAIN = 1,
+		ADS_SASLWRAP_TYPE_SIGN = 2,
+		ADS_SASLWRAP_TYPE_SEAL = 4
+	} ads_saslwrap_type;
+
+	/* ads auth control flags */
+	typedef [public] bitmap {
+		ADS_AUTH_DISABLE_KERBEROS	= 0x0001,
+		ADS_AUTH_NO_BIND		= 0x0002,
+		ADS_AUTH_ANON_BIND		= 0x0004,
+		ADS_AUTH_SIMPLE_BIND		= 0x0008,
+		ADS_AUTH_ALLOW_NTLMSSP		= 0x0010,
+		ADS_AUTH_SASL_SIGN		= 0x0020,
+		ADS_AUTH_SASL_SEAL		= 0x0040,
+		ADS_AUTH_SASL_FORCE		= 0x0080,
+		ADS_AUTH_USER_CREDS		= 0x0100
+	} ads_auth_flags;
+
+	const int ADS_SASL_WRAPPING_IN_MAX_WRAPPED = 0x0FFFFFFF;
+	const int ADS_SASL_WRAPPING_OUT_MAX_WRAPPED = 0x00A00000;
+
+	typedef [nopull,nopush] struct {
+		string realm;
+		string workgroup;
+		string ldap_server;
+		boolean8 gc;     /* Is this a global catalog server? */
+		boolean8 no_fallback; /* Bail if the ldap_server is not available */
+	} ads_server;
+
+	typedef [nopull,nopush] struct {
+		string realm;
+		string password;
+		string user_name;
+		string kdc_server;
+		ads_auth_flags flags;
+		int time_offset;
+		string ccache_name;
+		time_t tgt_expire;
+		time_t tgs_expire;
+		time_t renewable;
+	} ads_auth;
+
+	typedef [nopull,nopush] struct {
+		nbt_server_type flags; /* cldap flags identifying the services. */
+		string realm;
+		string bind_path;
+		string ldap_server_name;
+		string server_site_name;
+		string client_site_name;
+		time_t current_time;
+		string schema_path;
+		string config_path;
+		int ldap_page_size;
+	} ads_config;
+
+	typedef [nopull,nopush] struct {
+		uint32 ofs;
+		uint32 needed;
+		uint32 left;
+		uint32 max_wrapped;
+		uint32 min_wrapped;
+		uint32 size;
+		uint8 *buf;
+	} ads_ldap_buf_in;
+
+	typedef [nopull,nopush] struct {
+		uint32 ofs;
+		uint32 left;
+		uint32 max_unwrapped;
+		uint32 sig_size;
+		uint32 size;
+		uint8 *buf;
+	} ads_ldap_buf_out;
+
+	typedef [nopull,nopush] struct {
+		ads_saslwrap_type wrap_type;
+		[ignore] ads_saslwrap_ops *wrap_ops;
+#ifdef HAVE_LDAP_SASL_WRAPPING
+		[ignore] Sockbuf_IO_Desc *sbiod; /* lowlevel state for LDAP wrapping */
+#endif /* HAVE_LDAP_SASL_WRAPPING */
+		[ignore] TALLOC_CTX *mem_ctx;
+		[ignore] void *wrap_private_data;
+		ads_ldap_buf_in in;
+		ads_ldap_buf_out out;
+	} ads_saslwrap;
+
+	typedef [nopull,nopush] struct {
+		[ignore] ldap *ld;
+		sockaddr_storage ss; /* the ip of the active connection, if any */
+		time_t last_attempt; /* last attempt to reconnect, monotonic clock */
+		int port;
+	} ads_ldap;
+
+	typedef [public,nopull,nopush] struct {
+		/* info needed to find the server */
+		ads_server server;
+
+		/* info needed to authenticate */
+		ads_auth auth;
+
+		/* info derived from the servers config */
+		ads_config config;
+
+#ifdef HAVE_LDAP
+		ads_saslwrap ldap_wrap_data;
+		/* info about the current LDAP connection */
+		ads_ldap ldap;
+#endif /* HAVE_LDAP */
+
+	} ads_struct;
+}
+
+
diff --git a/source3/librpc/idl/leases_db.idl b/source3/librpc/idl/leases_db.idl
new file mode 100644
index 0000000..2551dfc
--- /dev/null
+++ b/source3/librpc/idl/leases_db.idl
@@ -0,0 +1,54 @@
+#include "idl_types.h"
+
+import "misc.idl";
+import "smb2_lease_struct.idl";
+import "file_id.idl";
+
+[
+	pointer_default(unique)
+]
+interface leases_db
+{
+	typedef [public] struct {
+		GUID client_guid;
+		smb2_lease_key lease_key;
+	} leases_db_key;
+
+	typedef [public] struct {
+		file_id id;
+		[string,charset(UTF8)] char *servicepath;
+		[string,charset(UTF8)] char *base_name;
+		[string,charset(UTF8)] char *stream_name;
+	} leases_db_file;
+
+	typedef [public] struct {
+		smb2_lease_state	current_state;
+		/*
+		 * 'breaking' indicates that we're waiting
+		 * for a lease break ack from the client
+		 * and breaking_to_requested and breaking_to_required
+		 * have a meaning.
+		 *
+		 * breaking_to_requested is the value already sent to
+		 * the client, the client needs to ack to this (or less).
+		 *
+		 * breaking_to_required is the internal value that needs to
+		 * be reached before we can reset breaking = false, this
+		 * may requires multiple roundtrips to the client, e.g.
+		 * when the lease broken to a more reduced value, while
+		 * the lease break is still in progress.
+		 *
+		 * The following can be assumed (if breaking == true):
+		 *
+		 * current_state>breaking_to_requested>=breaking_to_required
+		 */
+		boolean8		breaking;
+		smb2_lease_state	breaking_to_requested;
+		smb2_lease_state	breaking_to_required;
+		uint16			lease_version;
+		uint16			epoch;
+
+		uint32 num_files;
+		leases_db_file files[num_files];
+	} leases_db_value;
+}
diff --git a/source3/librpc/idl/libnet_join.idl b/source3/librpc/idl/libnet_join.idl
new file mode 100644
index 0000000..4c8e658
--- /dev/null
+++ b/source3/librpc/idl/libnet_join.idl
@@ -0,0 +1,91 @@
+#include "idl_types.h"
+
+import "wkssvc.idl", "security.idl", "misc.idl", "netlogon.idl", "ODJ.idl", "ads.idl";
+
+/*
+  libnetjoin interface definition
+*/
+
+[
+	pointer_default(unique)
+]
+interface libnetjoin
+{
+	typedef bitmap wkssvc_joinflags wkssvc_joinflags;
+	typedef enum netr_SchannelType netr_SchannelType;
+
+	typedef [public] enum {
+		JoinDomNameTypeUnknown = 0,
+		JoinDomNameTypeDNS = 1,
+		JoinDomNameTypeNBT = 2
+	} libnetjoin_JoinDomNameType;
+
+	[nopush,nopull,noopnum] WERROR libnet_JoinCtx(
+		[in] string dc_name,
+		[in] string machine_name,
+		[in,ref] string *domain_name,
+		[in] libnetjoin_JoinDomNameType domain_name_type,
+		[in] string account_ou,
+		[in] string admin_account,
+		[in] string admin_domain,
+		[in,noprint] string admin_password,
+		[in] string machine_password,
+		[in] wkssvc_joinflags join_flags,
+		[in] string os_version,
+		[in] string os_name,
+		[in] string os_servicepack,
+		[in] boolean8 create_upn,
+		[in] string upn,
+		[in] string dnshostname,
+		[in] boolean8 modify_config,
+		[in,unique] ads_struct *ads,
+		[in] boolean8 debug,
+		[in] boolean8 use_kerberos,
+		[in] netr_SchannelType secure_channel_type,
+		[in,noprint] messaging_context *msg_ctx,
+		[in] uint32 desired_encryption_types,
+		[in] boolean8 provision_computer_account_only,
+		[in,out,unique] ODJ_PROVISION_DATA *odj_provision_data,
+		[in] boolean8 request_offline_join,
+		[out] string account_name,
+		[out] string netbios_domain_name,
+		[out] string dns_domain_name,
+		[out] string forest_name,
+		[out] string dn,
+		[out] GUID domain_guid,
+		[out] dom_sid *domain_sid,
+		[out] boolean8 modified_config,
+		[out] string error_string,
+		[out] boolean8 domain_is_ad,
+		[out] uint32 set_encryption_types,
+		[out] string krb5_salt,
+		[out,unique] netr_DsRGetDCNameInfo *dcinfo,
+		[out] uint32 account_rid
+		);
+
+	[nopush,nopull,noopnum] WERROR libnet_UnjoinCtx(
+		[in] string dc_name,
+		[in] string machine_name,
+		[in] string domain_name,
+		[in] string account_ou,
+		[in] string admin_account,
+		[in] string admin_domain,
+		[in,noprint] string admin_password,
+		[in] string machine_password,
+		[in] wkssvc_joinflags unjoin_flags,
+		[in] boolean8 delete_machine_account,
+		[in] boolean8 modify_config,
+		[in] dom_sid *domain_sid,
+		[in,unique] ads_struct *ads,
+		[in] boolean8 debug,
+		[in] boolean8 use_kerberos,
+		[in,noprint] messaging_context *msg_ctx,
+		[out] string netbios_domain_name,
+		[out] string dns_domain_name,
+		[out] string forest_name,
+		[out] boolean8 modified_config,
+		[out] string error_string,
+		[out] boolean8 disabled_machine_account,
+		[out] boolean8 deleted_machine_account
+		);
+}
diff --git a/source3/librpc/idl/libnetapi.idl b/source3/librpc/idl/libnetapi.idl
new file mode 100644
index 0000000..4675af6
--- /dev/null
+++ b/source3/librpc/idl/libnetapi.idl
@@ -0,0 +1,2070 @@
+/*
+  libnetapi interface definition
+*/
+
+cpp_quote("#define LIBNETAPI_LOCAL_SERVER(x) (!x || is_myname_or_ipaddr(x))")
+cpp_quote("#ifndef MAXSUBAUTHS")
+cpp_quote("#define MAXSUBAUTHS 15 /* max sub authorities in a SID */")
+cpp_quote("#endif")
+
+import "misc.idl";
+
+[
+	pointer_default(unique)
+]
+interface libnetapi
+{
+	const int ERROR_MORE_DATA = 234L;
+
+	[public] typedef [v1_enum] enum {
+		NERR_Success				= 0,
+		NERR_NoOfflineJoinInfo			= 2709,
+		NERR_BadOfflineJoinInfo			= 2710,
+		NERR_CantCreateJoinInfo			= 2711,
+		NERR_BadDomainJoinInfo			= 2712,
+		NERR_JoinPerformedMustRestart		= 2713,
+		NERR_NoJoinPending			= 2714,
+		NERR_ValuesNotSet			= 2715,
+		NERR_CantVerifyHostname			= 2716,
+		NERR_CantLoadOfflineHive		= 2717,
+		NERR_Connectionsecure			= 2718,
+		NERR_ProvisioningBlobUnsupported	= 2719
+	} NET_API_STATUS;
+
+	[public] typedef struct {
+		uint8 sid_rev_num;
+		uint8 num_auths;
+		uint8 id_auth[6];
+		uint32 sub_auths[MAXSUBAUTHS];
+	} domsid;
+
+	/*******************************************/
+	/* NetJoinDomain                           */
+	/*******************************************/
+
+	typedef [public,bitmap32bit] bitmap {
+		NETSETUP_JOIN_DOMAIN			= 0x00000001,
+		NETSETUP_ACCT_CREATE			= 0x00000002,
+		NETSETUP_ACCT_DELETE			= 0x00000004,
+		NETSETUP_WIN9X_UPGRADE			= 0x00000010,
+		NETSETUP_DOMAIN_JOIN_IF_JOINED		= 0x00000020,
+		NETSETUP_JOIN_UNSECURE			= 0x00000040,
+		NETSETUP_MACHINE_PWD_PASSED		= 0x00000080,
+		NETSETUP_DEFER_SPN_SET			= 0x00000100,
+		NETSETUP_JOIN_DC_ACCOUNT		= 0x00000200,
+		NETSETUP_JOIN_WITH_NEW_NAME		= 0x00000400,
+		NETSETUP_JOIN_READONLY			= 0x00000800,
+		NETSETUP_AMBIGUOUS_DC			= 0x00001000,
+		NETSETUP_NO_NETLOGON_CACHE		= 0x00002000,
+		NETSETUP_DONT_CONTROL_SERVICES		= 0x00004000,
+		NETSETUP_SET_MACHINE_NAME		= 0x00008000,
+		NETSETUP_FORCE_SPN_SET			= 0x00010000,
+		NETSETUP_NO_ACCT_REUSE			= 0x00020000,
+		NETSETUP_INSTALL_INVOCATION		= 0x00040000,
+		NETSETUP_IGNORE_UNSUPPORTED_FLAGS	= 0x10000000
+	} NetJoinFlags;
+
+	[nopush,nopull] NET_API_STATUS NetJoinDomain(
+		[in,unique] string *server,
+		[in,ref] string *domain,
+		[in,unique] string *account_ou,
+		[in,unique] string *account,
+		[in,unique] string *password,
+		[in] NetJoinFlags join_flags
+		);
+
+	/*******************************************/
+	/* NetUnjoinDomain                         */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetUnjoinDomain(
+		[in,unique] string *server_name,
+		[in,unique] string *account,
+		[in,unique] string *password,
+		[in] NetJoinFlags unjoin_flags
+		);
+
+	/*******************************************/
+	/* NetGetJoinInformation                   */
+	/*******************************************/
+
+	typedef enum {
+		NetSetupUnknownStatus = 0,
+		NetSetupUnjoined = 1,
+		NetSetupWorkgroupName = 2,
+		NetSetupDomainName = 3
+	} NETSETUP_JOIN_STATUS;
+
+	[nopush,nopull] NET_API_STATUS NetGetJoinInformation(
+		[in,unique] string *server_name,
+		[out] string **name_buffer,
+		[out] uint16 *name_type
+		);
+
+	/*******************************************/
+	/* NetGetJoinableOUs                       */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGetJoinableOUs(
+		[in,unique] string *server_name,
+		[in,ref] string *domain,
+		[in,unique] string *account,
+		[in,unique] string *password,
+		[out] uint32 *ou_count,
+		[out] string ***ous
+		);
+
+	/*******************************************/
+	/* NetRenameMachineInDomain                */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetRenameMachineInDomain(
+		[in] string server_name,
+		[in] string new_machine_name,
+		[in] string account,
+		[in] string password,
+		[in] uint32 rename_options
+		);
+
+	/*******************************************/
+	/* NetProvisionComputerAccount             */
+	/*******************************************/
+
+	typedef [public,bitmap32bit] bitmap {
+		NETSETUP_PROVISION_DOWNLEVEL_PRIV_SUPPORT	= 0x00000001,
+		NETSETUP_PROVISION_REUSE_ACCOUNT		= 0x00000002,
+		NETSETUP_PROVISION_USE_DEFAULT_PASSWORD		= 0x00000004,
+		NETSETUP_PROVISION_SKIP_ACCOUNT_SEARCH		= 0x00000008,
+		NETSETUP_PROVISION_ROOT_CA_CERTS		= 0x00000010
+	} NetProvisionFlags;
+
+	[nopush,nopull] NET_API_STATUS NetProvisionComputerAccount(
+		[in,ref] string *domain,
+		[in,ref] string *machine_name,
+		[in,unique] string *machine_account_ou,
+		[in,unique] string *dcname,
+		[in] NetProvisionFlags options,
+		[in,out,unique] uint8 **provision_bin_data,
+		[in,out,unique] uint32 *provision_bin_data_size,
+		[in,out,unique] string **provision_text_data
+		);
+
+	/*******************************************/
+	/* NetRequestOfflineDomainJoin             */
+	/*******************************************/
+
+	typedef [public,bitmap32bit] bitmap {
+		NETSETUP_PROVISION_ONLINE_CALLER = 0x40000000
+	} NetProvisionJoinFlags;
+
+	[nopush,nopull] NET_API_STATUS NetRequestOfflineDomainJoin(
+		[in,unique] uint8 *provision_bin_data,
+		[in] uint32 provision_bin_data_size,
+		[in] NetProvisionJoinFlags options,
+		[in,unique] string *windows_path
+	);
+
+	/*******************************************/
+	/* NetComposeOfflineDomainJoin             */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetComposeOfflineDomainJoin(
+		[in,ref] string *dns_domain_name,
+		[in,ref] string *netbios_domain_name,
+		[in,ref] domsid *domain_sid,
+		[in,ref] GUID *domain_guid,
+		[in,ref] string *forest_name,
+		[in,ref] string *machine_account_name,
+		[in,ref] string *machine_account_password,
+		[in,unique] string *dc_name,
+		[in,unique] string *dc_address,
+		[in] boolean8 domain_is_ad,
+		[in,out,unique] uint8 **compose_bin_data,
+		[in,out,unique] uint32 *compose_bin_data_size,
+		[in,out,unique] string **compose_text_data
+		);
+
+	/*******************************************/
+	/* NetServerGetInfo                        */
+	/*******************************************/
+
+	[public] typedef struct {
+		uint32 sv100_platform_id;
+		string sv100_name;
+	} SERVER_INFO_100;
+
+	[public] typedef struct {
+		uint32 sv101_platform_id;
+		string sv101_name;
+		uint32 sv101_version_major;
+		uint32 sv101_version_minor;
+		uint32 sv101_type;
+		string sv101_comment;
+	} SERVER_INFO_101;
+
+	[public] typedef struct {
+		uint32 sv102_platform_id;
+		string sv102_name;
+		uint32 sv102_version_major;
+		uint32 sv102_version_minor;
+		uint32 sv102_type;
+		string sv102_comment;
+		uint32 sv102_users;
+		uint32 sv102_disc;
+		boolean8 sv102_hidden;
+		uint32 sv102_announce;
+		uint32 sv102_anndelta;
+		uint32 sv102_licenses;
+		string sv102_userpath;
+	} SERVER_INFO_102;
+
+	[public] typedef struct {
+		uint32 sv402_ulist_mtime;
+		uint32 sv402_glist_mtime;
+		uint32 sv402_alist_mtime;
+		string sv402_alerts;
+		uint32 sv402_security;
+		uint32 sv402_numadmin;
+		uint32 sv402_lanmask;
+		string sv402_guestacct;
+		uint32 sv402_chdevs;
+		uint32 sv402_chdevq;
+		uint32 sv402_chdevjobs;
+		uint32 sv402_connections;
+		uint32 sv402_shares;
+		uint32 sv402_openfiles;
+		uint32 sv402_sessopens;
+		uint32 sv402_sessvcs;
+		uint32 sv402_sessreqs;
+		uint32 sv402_opensearch;
+		uint32 sv402_activelocks;
+		uint32 sv402_numreqbuf;
+		uint32 sv402_sizreqbuf;
+		uint32 sv402_numbigbuf;
+		uint32 sv402_numfiletasks;
+		uint32 sv402_alertsched;
+		uint32 sv402_erroralert;
+		uint32 sv402_logonalert;
+		uint32 sv402_accessalert;
+		uint32 sv402_diskalert;
+		uint32 sv402_netioalert;
+		uint32 sv402_maxauditsz;
+		string sv402_srvheuristics;
+	} SERVER_INFO_402;
+
+	[public] typedef struct {
+		uint32 sv403_ulist_mtime;
+		uint32 sv403_glist_mtime;
+		uint32 sv403_alist_mtime;
+		string sv403_alerts;
+		uint32 sv403_security;
+		uint32 sv403_numadmin;
+		uint32 sv403_lanmask;
+		string sv403_guestacct;
+		uint32 sv403_chdevs;
+		uint32 sv403_chdevq;
+		uint32 sv403_chdevjobs;
+		uint32 sv403_connections;
+		uint32 sv403_shares;
+		uint32 sv403_openfiles;
+		uint32 sv403_sessopens;
+		uint32 sv403_sessvcs;
+		uint32 sv403_sessreqs;
+		uint32 sv403_opensearch;
+		uint32 sv403_activelocks;
+		uint32 sv403_numreqbuf;
+		uint32 sv403_sizreqbuf;
+		uint32 sv403_numbigbuf;
+		uint32 sv403_numfiletasks;
+		uint32 sv403_alertsched;
+		uint32 sv403_erroralert;
+		uint32 sv403_logonalert;
+		uint32 sv403_accessalert;
+		uint32 sv403_diskalert;
+		uint32 sv403_netioalert;
+		uint32 sv403_maxauditsz;
+		string sv403_srvheuristics;
+		uint32 sv403_auditedevents;
+		uint32 sv403_autoprofile;
+		string sv403_autopath;
+	} SERVER_INFO_403;
+
+	[public] typedef struct {
+		uint32 sv502_sessopens;
+		uint32 sv502_sessvcs;
+		uint32 sv502_opensearch;
+		uint32 sv502_sizreqbuf;
+		uint32 sv502_initworkitems;
+		uint32 sv502_maxworkitems;
+		uint32 sv502_rawworkitems;
+		uint32 sv502_irpstacksize;
+		uint32 sv502_maxrawbuflen;
+		uint32 sv502_sessusers;
+		uint32 sv502_sessconns;
+		uint32 sv502_maxpagedmemoryusage;
+		uint32 sv502_maxnonpagedmemoryusage;
+		boolean8 sv502_enablesoftcompat;
+		boolean8 sv502_enableforcedlogoff;
+		boolean8 sv502_timesource;
+		boolean8 sv502_acceptdownlevelapis;
+		boolean8 sv502_lmannounce;
+	} SERVER_INFO_502;
+
+	[public] typedef struct {
+		uint32 sv503_sessopens;
+		uint32 sv503_sessvcs;
+		uint32 sv503_opensearch;
+		uint32 sv503_sizreqbuf;
+		uint32 sv503_initworkitems;
+		uint32 sv503_maxworkitems;
+		uint32 sv503_rawworkitems;
+		uint32 sv503_irpstacksize;
+		uint32 sv503_maxrawbuflen;
+		uint32 sv503_sessusers;
+		uint32 sv503_sessconns;
+		uint32 sv503_maxpagedmemoryusage;
+		uint32 sv503_maxnonpagedmemoryusage;
+		boolean8 sv503_enablesoftcompat;
+		boolean8 sv503_enableforcedlogoff;
+		boolean8 sv503_timesource;
+		boolean8 sv503_acceptdownlevelapis;
+		boolean8 sv503_lmannounce;
+		string sv503_domain;
+		uint32 sv503_maxcopyreadlen;
+		uint32 sv503_maxcopywritelen;
+		uint32 sv503_minkeepsearch;
+		uint32 sv503_maxkeepsearch;
+		uint32 sv503_minkeepcomplsearch;
+		uint32 sv503_maxkeepcomplsearch;
+		uint32 sv503_threadcountadd;
+		uint32 sv503_numblockthreads;
+		uint32 sv503_scavtimeout;
+		uint32 sv503_minrcvqueue;
+		uint32 sv503_minfreeworkitems;
+		uint32 sv503_xactmemsize;
+		uint32 sv503_threadpriority;
+		uint32 sv503_maxmpxct;
+		uint32 sv503_oplockbreakwait;
+		uint32 sv503_oplockbreakresponsewait;
+		boolean8 sv503_enableoplocks;
+		boolean8 sv503_enableoplockforceclose;
+		boolean8 sv503_enablefcbopens;
+		boolean8 sv503_enableraw;
+		boolean8 sv503_enablesharednetdrives;
+		uint32 sv503_minfreeconnections;
+		uint32 sv503_maxfreeconnections;
+	} SERVER_INFO_503;
+
+	[public] typedef struct {
+		uint32 sv599_sessopens;
+		uint32 sv599_sessvcs;
+		uint32 sv599_opensearch;
+		uint32 sv599_sizreqbuf;
+		uint32 sv599_initworkitems;
+		uint32 sv599_maxworkitems;
+		uint32 sv599_rawworkitems;
+		uint32 sv599_irpstacksize;
+		uint32 sv599_maxrawbuflen;
+		uint32 sv599_sessusers;
+		uint32 sv599_sessconns;
+		uint32 sv599_maxpagedmemoryusage;
+		uint32 sv599_maxnonpagedmemoryusage;
+		boolean8 sv599_enablesoftcompat;
+		boolean8 sv599_enableforcedlogoff;
+		boolean8 sv599_timesource;
+		boolean8 sv599_acceptdownlevelapis;
+		boolean8 sv599_lmannounce;
+		string sv599_domain;
+		uint32 sv599_maxcopyreadlen;
+		uint32 sv599_maxcopywritelen;
+		uint32 sv599_minkeepsearch;
+		uint32 sv599_maxkeepsearch;
+		uint32 sv599_minkeepcomplsearch;
+		uint32 sv599_maxkeepcomplsearch;
+		uint32 sv599_threadcountadd;
+		uint32 sv599_numblockthreads;
+		uint32 sv599_scavtimeout;
+		uint32 sv599_minrcvqueue;
+		uint32 sv599_minfreeworkitems;
+		uint32 sv599_xactmemsize;
+		uint32 sv599_threadpriority;
+		uint32 sv599_maxmpxct;
+		uint32 sv599_oplockbreakwait;
+		uint32 sv599_oplockbreakresponsewait;
+		boolean8 sv599_enableoplocks;
+		boolean8 sv599_enableoplockforceclose;
+		boolean8 sv599_enablefcbopens;
+		boolean8 sv599_enableraw;
+		boolean8 sv599_enablesharednetdrives;
+		uint32 sv599_minfreeconnections;
+		uint32 sv599_maxfreeconnections;
+		uint32 sv599_initsesstable;
+		uint32 sv599_initconntable;
+		uint32 sv599_initfiletable;
+		uint32 sv599_initsearchtable;
+		uint32 sv599_alertschedule;
+		uint32 sv599_errorthreshold;
+		uint32 sv599_networkerrorthreshold;
+		uint32 sv599_diskspacethreshold;
+		uint32 sv599_reserved;
+		uint32 sv599_maxlinkdelay;
+		uint32 sv599_minlinkthroughput;
+		uint32 sv599_linkinfovalidtime;
+		uint32 sv599_scavqosinfoupdatetime;
+		uint32 sv599_maxworkitemidletime;
+	} SERVER_INFO_599;
+
+	[public] typedef struct {
+		uint32 sv598_maxrawworkitems;
+		uint32 sv598_maxthreadsperqueue;
+		uint32 sv598_producttype;
+		uint32 sv598_serversize;
+		uint32 sv598_connectionlessautodisc;
+		uint32 sv598_sharingviolationretries;
+		uint32 sv598_sharingviolationdelay;
+		uint32 sv598_maxglobalopensearch;
+		uint32 sv598_removeduplicatesearches;
+		uint32 sv598_lockviolationoffset;
+		uint32 sv598_lockviolationdelay;
+		uint32 sv598_mdlreadswitchover;
+		uint32 sv598_cachedopenlimit;
+		uint32 sv598_otherqueueaffinity;
+		boolean8  sv598_restrictnullsessaccess;
+		boolean8  sv598_enablewfw311directipx;
+		uint32 sv598_queuesamplesecs;
+		uint32 sv598_balancecount;
+		uint32 sv598_preferredaffinity;
+		uint32 sv598_maxfreerfcbs;
+		uint32 sv598_maxfreemfcbs;
+		uint32 sv598_maxfreelfcbs;
+		uint32 sv598_maxfreepagedpoolchunks;
+		uint32 sv598_minpagedpoolchunksize;
+		uint32 sv598_maxpagedpoolchunksize;
+		boolean8 sv598_sendsfrompreferredprocessor;
+		uint32 sv598_cacheddirectorylimit;
+		uint32 sv598_maxcopylength;
+		boolean8 sv598_enablecompression;
+		boolean8 sv598_autosharewks;
+		boolean8 sv598_autoshareserver;
+		boolean8 sv598_enablesecuritysignature;
+		boolean8 sv598_requiresecuritysignature;
+		uint32 sv598_minclientbuffersize;
+		GUID sv598_serverguid;
+		uint32 sv598_ConnectionNoSessionsTimeout;
+		uint32 sv598_IdleThreadTimeOut;
+		boolean8 sv598_enableW9xsecuritysignature;
+		boolean8 sv598_enforcekerberosreauthentication;
+		boolean8 sv598_disabledos;
+		uint32 sv598_lowdiskspaceminimum;
+		boolean8 sv598_disablestrictnamechecking;
+	} SERVER_INFO_598;
+
+	[public] typedef struct {
+		string sv1005_comment;
+	} SERVER_INFO_1005;
+
+	[public] typedef struct {
+		uint32 sv1107_users;
+	} SERVER_INFO_1107;
+
+	[public] typedef struct {
+		int32 sv1010_disc;
+	} SERVER_INFO_1010;
+
+	[public] typedef struct {
+		boolean8  sv1016_hidden;
+	} SERVER_INFO_1016;
+
+	[public] typedef struct {
+		uint32 sv1017_announce;
+	} SERVER_INFO_1017;
+
+	[public] typedef struct {
+		uint32 sv1018_anndelta;
+	} SERVER_INFO_1018;
+
+	[public] typedef struct {
+		uint32 sv1501_sessopens;
+	} SERVER_INFO_1501;
+
+	[public] typedef struct {
+		uint32 sv1502_sessvcs;
+	} SERVER_INFO_1502;
+
+	[public] typedef struct {
+		uint32 sv1503_opensearch;
+	} SERVER_INFO_1503;
+
+	[public] typedef struct {
+		uint32 sv1506_maxworkitems;
+	} SERVER_INFO_1506;
+
+	[public] typedef struct {
+		uint32 sv1509_maxrawbuflen;
+	} SERVER_INFO_1509;
+
+	[public] typedef struct {
+		uint32 sv1510_sessusers;
+	} SERVER_INFO_1510;
+
+	[public] typedef struct {
+		uint32 sv1511_sessconns;
+	} SERVER_INFO_1511;
+
+	[public] typedef struct {
+		uint32 sv1512_maxnonpagedmemoryusage;
+	} SERVER_INFO_1512;
+
+	[public] typedef struct {
+		uint32 sv1513_maxpagedmemoryusage;
+	} SERVER_INFO_1513;
+
+	[public] typedef struct {
+		boolean8 sv1514_enablesoftcompat;
+	} SERVER_INFO_1514;
+
+	[public] typedef struct {
+		boolean8  sv1515_enableforcedlogoff;
+	} SERVER_INFO_1515;
+
+	[public] typedef struct {
+		boolean8  sv1516_timesource;
+	} SERVER_INFO_1516;
+
+	[public] typedef struct {
+		boolean8  sv1518_lmannounce;
+	} SERVER_INFO_1518;
+
+	[public] typedef struct {
+		uint32 sv1520_maxcopyreadlen;
+	} SERVER_INFO_1520;
+
+	[public] typedef struct {
+		uint32 sv1521_maxcopywritelen;
+	} SERVER_INFO_1521;
+
+	[public] typedef struct {
+		uint32 sv1522_minkeepsearch;
+	} SERVER_INFO_1522;
+
+	[public] typedef struct {
+		uint32 sv1523_maxkeepsearch;
+	} SERVER_INFO_1523;
+
+	[public] typedef struct {
+		uint32 sv1524_minkeepcomplsearch;
+	} SERVER_INFO_1524;
+
+	[public] typedef struct {
+		uint32 sv1525_maxkeepcomplsearch;
+	} SERVER_INFO_1525;
+
+	[public] typedef struct {
+		uint32 sv1528_scavtimeout;
+	} SERVER_INFO_1528;
+
+	[public] typedef struct {
+		uint32 sv1529_minrcvqueue;
+	} SERVER_INFO_1529;
+
+	[public] typedef struct {
+		uint32 sv1530_minfreeworkitems;
+	} SERVER_INFO_1530;
+
+	[public] typedef struct {
+		uint32 sv1533_maxmpxct;
+	} SERVER_INFO_1533;
+
+	[public] typedef struct {
+		uint32 sv1534_oplockbreakwait;
+	} SERVER_INFO_1534;
+
+	[public] typedef struct {
+		uint32 sv1535_oplockbreakresponsewait;
+	} SERVER_INFO_1535;
+
+	[public] typedef struct {
+		boolean8 sv1536_enableoplocks;
+	} SERVER_INFO_1536;
+
+	[public] typedef struct {
+		boolean8 sv1537_enableoplockforceclose;
+	} SERVER_INFO_1537;
+
+	[public] typedef struct {
+		boolean8 sv1538_enablefcbopens;
+	} SERVER_INFO_1538;
+
+	[public] typedef struct {
+		boolean8 sv1539_enableraw;
+	} SERVER_INFO_1539;
+
+	[public] typedef struct {
+		boolean8 sv1540_enablesharednetdrives;
+	} SERVER_INFO_1540;
+
+	[public] typedef struct {
+		boolean8 sv1541_minfreeconnections;
+	} SERVER_INFO_1541;
+
+	[public] typedef struct {
+		boolean8 sv1542_maxfreeconnections;
+	} SERVER_INFO_1542;
+
+	[public] typedef struct {
+		uint32 sv1543_initsesstable;
+	} SERVER_INFO_1543;
+
+	[public] typedef struct {
+		uint32 sv1544_initconntable;
+	} SERVER_INFO_1544;
+
+	[public] typedef struct {
+		uint32 sv1545_initfiletable;
+	} SERVER_INFO_1545;
+
+	[public] typedef struct {
+		uint32 sv1546_initsearchtable;
+	} SERVER_INFO_1546;
+
+	[public] typedef struct {
+		uint32 sv1547_alertschedule;
+	} SERVER_INFO_1547;
+
+	[public] typedef struct {
+		uint32 sv1548_errorthreshold;
+	} SERVER_INFO_1548;
+
+	[public] typedef struct {
+		uint32 sv1549_networkerrorthreshold;
+	} SERVER_INFO_1549;
+
+	[public] typedef struct {
+		uint32 sv1550_diskspacethreshold;
+	} SERVER_INFO_1550;
+
+	[public] typedef struct {
+		uint32 sv1552_maxlinkdelay;
+	} SERVER_INFO_1552;
+
+	[public] typedef struct {
+		uint32 sv1553_minlinkthroughput;
+	} SERVER_INFO_1553;
+
+	[public] typedef struct {
+		uint32 sv1554_linkinfovalidtime;
+	} SERVER_INFO_1554;
+
+	[public] typedef struct {
+		uint32 sv1555_scavqosinfoupdatetime;
+	} SERVER_INFO_1555;
+
+	[public] typedef struct {
+		uint32 sv1556_maxworkitemidletime;
+	} SERVER_INFO_1556;
+
+	[public] typedef struct {
+		uint32 sv1557_maxrawworkitems;
+	} SERVER_INFO_1557;
+
+	[public] typedef struct {
+		uint32 sv1560_producttype;
+	} SERVER_INFO_1560;
+
+	[public] typedef struct {
+		uint32 sv1561_serversize;
+	} SERVER_INFO_1561;
+
+	[public] typedef struct {
+		uint32 sv1562_connectionlessautodisc;
+	} SERVER_INFO_1562;
+
+	[public] typedef struct {
+		uint32 sv1563_sharingviolationretries;
+	} SERVER_INFO_1563;
+
+	[public] typedef struct {
+		uint32 sv1564_sharingviolationdelay;
+	} SERVER_INFO_1564;
+
+	[public] typedef struct {
+		uint32 sv1565_maxglobalopensearch;
+	} SERVER_INFO_1565;
+
+	[public] typedef struct {
+		boolean8 sv1566_removeduplicatesearches;
+	} SERVER_INFO_1566;
+
+	[public] typedef struct {
+		uint32 sv1567_lockviolationretries;
+	} SERVER_INFO_1567;
+
+	[public] typedef struct {
+		uint32 sv1568_lockviolationoffset;
+	} SERVER_INFO_1568;
+
+	[public] typedef struct {
+		uint32 sv1569_lockviolationdelay;
+	} SERVER_INFO_1569;
+
+	[public] typedef struct {
+		uint32 sv1570_mdlreadswitchover;
+	} SERVER_INFO_1570;
+
+	[public] typedef struct {
+		uint32 sv1571_cachedopenlimit;
+	} SERVER_INFO_1571;
+
+	[public] typedef struct {
+		uint32 sv1572_criticalthreads;
+	} SERVER_INFO_1572;
+
+	[public] typedef struct {
+		uint32 sv1573_restrictnullsessaccess;
+	} SERVER_INFO_1573;
+
+	[public] typedef struct {
+		uint32 sv1574_enablewfw311directipx;
+	} SERVER_INFO_1574;
+
+	[public] typedef struct {
+		uint32 sv1575_otherqueueaffinity;
+	} SERVER_INFO_1575;
+
+	[public] typedef struct {
+		uint32 sv1576_queuesamplesecs;
+	} SERVER_INFO_1576;
+
+	[public] typedef struct {
+		uint32 sv1577_balancecount;
+	} SERVER_INFO_1577;
+
+	[public] typedef struct {
+		uint32 sv1578_preferredaffinity;
+	} SERVER_INFO_1578;
+
+	[public] typedef struct {
+		uint32 sv1579_maxfreerfcbs;
+	} SERVER_INFO_1579;
+
+	[public] typedef struct {
+		uint32 sv1580_maxfreemfcbs;
+	} SERVER_INFO_1580;
+
+	[public] typedef struct {
+		uint32 sv1581_maxfreemlcbs;
+	} SERVER_INFO_1581;
+
+	[public] typedef struct {
+		uint32 sv1582_maxfreepagedpoolchunks;
+	} SERVER_INFO_1582;
+
+	[public] typedef struct {
+		uint32 sv1583_minpagedpoolchunksize;
+	} SERVER_INFO_1583;
+
+	[public] typedef struct {
+		uint32 sv1584_maxpagedpoolchunksize;
+	} SERVER_INFO_1584;
+
+	[public] typedef struct {
+		boolean8 sv1585_sendsfrompreferredprocessor;
+	} SERVER_INFO_1585;
+
+	[public] typedef struct {
+		uint32 sv1586_maxthreadsperqueue;
+	} SERVER_INFO_1586;
+
+	[public] typedef struct {
+		uint32 sv1587_cacheddirectorylimit;
+	} SERVER_INFO_1587;
+
+	[public] typedef struct {
+		uint32 sv1588_maxcopylength;
+	} SERVER_INFO_1588;
+
+	[public] typedef struct {
+		uint32 sv1590_enablecompression;
+	} SERVER_INFO_1590;
+
+	[public] typedef struct {
+		uint32 sv1591_autosharewks;
+	} SERVER_INFO_1591;
+
+	[public] typedef struct {
+		uint32 sv1592_autosharewks;
+	} SERVER_INFO_1592;
+
+	[public] typedef struct {
+		uint32 sv1593_enablesecuritysignature;
+	} SERVER_INFO_1593;
+
+	[public] typedef struct {
+		uint32 sv1594_requiresecuritysignature;
+	} SERVER_INFO_1594;
+
+	[public] typedef struct {
+		uint32 sv1595_minclientbuffersize;
+	} SERVER_INFO_1595;
+
+	[public] typedef struct {
+		uint32 sv1596_ConnectionNoSessionsTimeout;
+	} SERVER_INFO_1596;
+
+	[public] typedef struct {
+		uint32 sv1597_IdleThreadTimeOut;
+	} SERVER_INFO_1597;
+
+	[public] typedef struct {
+		uint32 sv1598_enableW9xsecuritysignature;
+	} SERVER_INFO_1598;
+
+	[public] typedef struct {
+		boolean8 sv1598_enforcekerberosreauthentication;
+	} SERVER_INFO_1599;
+
+	[public] typedef struct {
+		boolean8 sv1598_disabledos;
+	} SERVER_INFO_1600;
+
+	[public] typedef struct {
+		uint32 sv1598_lowdiskspaceminimum;
+	} SERVER_INFO_1601;
+
+	[public] typedef struct {
+		boolean8 sv_1598_disablestrictnamechecking;
+	} SERVER_INFO_1602;
+
+	[nopush,nopull] NET_API_STATUS NetServerGetInfo(
+		[in,unique] string *server_name,
+		[in] uint32 level,
+		[out] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* NetServerSetInfo                        */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetServerSetInfo(
+		[in,unique] string *server_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[out] uint32 *parm_error
+		);
+
+	/*******************************************/
+	/* NetWkstaGetInfo                         */
+	/*******************************************/
+
+	[public] typedef struct {
+		uint32 wki100_platform_id;
+		string wki100_computername;
+		string wki100_langroup;
+		uint32 wki100_ver_major;
+		uint32 wki100_ver_minor;
+	} WKSTA_INFO_100;
+
+	[public] typedef struct {
+		uint32 wki101_platform_id;
+		string wki101_computername;
+		string wki101_langroup;
+		uint32 wki101_ver_major;
+		uint32 wki101_ver_minor;
+		string wki101_lanroot;
+	} WKSTA_INFO_101;
+
+	[public] typedef struct {
+		uint32 wki102_platform_id;
+		string wki102_computername;
+		string wki102_langroup;
+		uint32 wki102_ver_major;
+		uint32 wki102_ver_minor;
+		string wki102_lanroot;
+		uint32 wki102_logged_on_users;
+	} WKSTA_INFO_102;
+
+	[nopush,nopull] NET_API_STATUS NetWkstaGetInfo(
+		[in,unique] string *server_name,
+		[in] uint32 level,
+		[out] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* NetGetDCName                            */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGetDCName(
+		[in,unique] string *server_name,
+		[in,unique] string *domain_name,
+		[out] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* NetGetAnyDCName                         */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGetAnyDCName(
+		[in,unique] string *server_name,
+		[in,unique] string *domain_name,
+		[out] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* DsGetDcName                             */
+	/*******************************************/
+
+	[public] typedef [bitmap32bit] bitmap {
+		DS_PDC_FLAG			= 0x00000001,
+		DS_GC_FLAG			= 0x00000004,
+		DS_LDAP_FLAG			= 0x00000008,
+		DS_DS_FLAG			= 0x00000010,
+		DS_KDC_FLAG			= 0x00000020,
+		DS_TIMESERV_FLAG		= 0x00000040,
+		DS_CLOSEST_FLAG			= 0x00000080,
+		DS_WRITABLE_FLAG		= 0x00000100,
+		DS_GOOD_TIMESERV_FLAG		= 0x00000200,
+		DS_NDNC_FLAG			= 0x00000400,
+		DS_SELECT_SECRET_DOMAIN_6_FLAG	= 0x00000800,
+		DS_FULL_SECRET_DOMAIN_6_FLAG	= 0x00001000,
+		DS_WS_FLAG			= 0x00002000,
+		DS_DS_8_FLAG			= 0x00004000,
+		DS_DNS_CONTROLLER_FLAG		= 0x20000000,
+		DS_DNS_DOMAIN_FLAG		= 0x40000000,
+		DS_DNS_FOREST_FLAG		= 0x80000000
+	} DOMAIN_CONTROLLER_INFO_FLAGS;
+
+	[public] typedef struct {
+		string domain_controller_name;
+		string domain_controller_address;
+		uint32 domain_controller_address_type;
+		GUID domain_guid;
+		string domain_name;
+		string dns_forest_name;
+		DOMAIN_CONTROLLER_INFO_FLAGS flags;
+		string dc_site_name;
+		string client_site_name;
+	} DOMAIN_CONTROLLER_INFO;
+
+	[nopush,nopull] NET_API_STATUS DsGetDcName(
+		[in,unique] string *server_name,
+		[in,ref] string *domain_name,
+		[in,unique] GUID *domain_guid,
+		[in,unique] string *site_name,
+		[in] uint32 flags,
+		[out,ref] DOMAIN_CONTROLLER_INFO **dc_info
+		);
+
+	/*******************************************/
+	/* NetUserAdd                              */
+	/*******************************************/
+
+	[public] typedef struct {
+		string usri0_name;
+	} USER_INFO_0;
+
+	/* priv */
+	const int USER_PRIV_GUEST	= 0;
+	const int USER_PRIV_USER	= 1;
+	const int USER_PRIV_ADMIN	= 2;
+
+	[public] typedef struct {
+		string usri1_name;
+		string usri1_password;
+		uint32 usri1_password_age;
+		uint32 usri1_priv;
+		string usri1_home_dir;
+		string usri1_comment;
+		uint32 usri1_flags;
+		string usri1_script_path;
+	} USER_INFO_1;
+
+	/* auth_flags in USER_INFO_2 */
+
+	const int AF_OP_PRINT		= 0x1;
+	const int AF_OP_COMM		= 0x2;
+	const int AF_OP_SERVER		= 0x4;
+	const int AF_OP_ACCOUNTS	= 0x8;
+	const int AF_SETTABLE_BITS	= (AF_OP_PRINT | AF_OP_COMM | AF_OP_SERVER | AF_OP_ACCOUNTS);
+
+	const int USER_MAXSTORAGE_UNLIMITED = (uint32_t)-1L;
+
+	[public] typedef struct {
+		string usri2_name;
+		string usri2_password;
+		uint32 usri2_password_age;
+		uint32 usri2_priv;
+		string usri2_home_dir;
+		string usri2_comment;
+		uint32 usri2_flags;
+		string usri2_script_path;
+		uint32 usri2_auth_flags;
+		string usri2_full_name;
+		string usri2_usr_comment;
+		string usri2_parms;
+		string usri2_workstations;
+		uint32 usri2_last_logon;
+		uint32 usri2_last_logoff;
+		uint32 usri2_acct_expires;
+		uint32 usri2_max_storage;
+		uint32 usri2_units_per_week;
+		uint8 *usri2_logon_hours;
+		uint32 usri2_bad_pw_count;
+		uint32 usri2_num_logons;
+		string usri2_logon_server;
+		uint32 usri2_country_code;
+		uint32 usri2_code_page;
+	} USER_INFO_2;
+
+	[public] typedef struct {
+		string usri3_name;
+		uint32 usri3_password_age;
+		uint32 usri3_priv;
+		string usri3_home_dir;
+		string usri3_comment;
+		uint32 usri3_flags;
+		string usri3_script_path;
+		uint32 usri3_auth_flags;
+		string usri3_full_name;
+		string usri3_usr_comment;
+		string usri3_parms;
+		string usri3_workstations;
+		uint32 usri3_last_logon;
+		uint32 usri3_last_logoff;
+		uint32 usri3_acct_expires;
+		uint32 usri3_max_storage;
+		uint32 usri3_units_per_week;
+		uint8 *usri3_logon_hours;
+		uint32 usri3_bad_pw_count;
+		uint32 usri3_num_logons;
+		string usri3_logon_server;
+		uint32 usri3_country_code;
+		uint32 usri3_code_page;
+		uint32 usri3_user_id;
+		uint32 usri3_primary_group_id;
+		string usri3_profile;
+		string usri3_home_dir_drive;
+		uint32 usri3_password_expired;
+	} USER_INFO_3;
+
+	[public] typedef struct {
+		string usri4_name;
+		string usri4_password;
+		uint32 usri4_password_age;
+		uint32 usri4_priv;
+		string usri4_home_dir;
+		string usri4_comment;
+		uint32 usri4_flags;
+		string usri4_script_path;
+		uint32 usri4_auth_flags;
+		string usri4_full_name;
+		string usri4_usr_comment;
+		string usri4_parms;
+		string usri4_workstations;
+		uint32 usri4_last_logon;
+		uint32 usri4_last_logoff;
+		uint32 usri4_acct_expires;
+		uint32 usri4_max_storage;
+		uint32 usri4_units_per_week;
+		uint8 *usri4_logon_hours;
+		uint32 usri4_bad_pw_count;
+		uint32 usri4_num_logons;
+		string usri4_logon_server;
+		uint32 usri4_country_code;
+		uint32 usri4_code_page;
+		domsid *usri4_user_sid;
+		uint32 usri4_primary_group_id;
+		string usri4_profile;
+		string usri4_home_dir_drive;
+		uint32 usri4_password_expired;
+	} USER_INFO_4;
+
+	[public] typedef struct {
+		string usri10_name;
+		string usri10_comment;
+		string usri10_usr_comment;
+		string usri10_full_name;
+	} USER_INFO_10;
+
+	[public] typedef struct {
+		string usri11_name;
+		string usri11_comment;
+		string usri11_usr_comment;
+		string usri11_full_name;
+		uint32 usri11_priv;
+		uint32 usri11_auth_flags;
+		uint32 usri11_password_age;
+		string usri11_home_dir;
+		string usri11_parms;
+		uint32 usri11_last_logon;
+		uint32 usri11_last_logoff;
+		uint32 usri11_bad_pw_count;
+		uint32 usri11_num_logons;
+		string usri11_logon_server;
+		uint32 usri11_country_code;
+		string usri11_workstations;
+		uint32 usri11_max_storage;
+		uint32 usri11_units_per_week;
+		uint8 *usri11_logon_hours;
+		uint32 usri11_code_page;
+	} USER_INFO_11;
+
+	[public] typedef struct {
+		string usri20_name;
+		string usri20_full_name;
+		string usri20_comment;
+		uint32 usri20_flags;
+		uint32 usri20_user_id;
+	} USER_INFO_20;
+
+	const int ENCRYPTED_PWLEN = 16;
+
+	[public] typedef struct {
+		uint8 usri21_password[ENCRYPTED_PWLEN];
+	} USER_INFO_21;
+
+	[public] typedef struct {
+		string usri22_name;
+		uint8 usri22_password[ENCRYPTED_PWLEN];
+		uint32 usri22_password_age;
+		uint32 usri22_priv;
+		string usri22_home_dir;
+		string usri22_comment;
+		uint32 usri22_flags;
+		uint32 usri22_script_path;
+		uint32 usri22_auth_flags;
+		string usri22_full_name;
+		string usri22_usr_comment;
+		string usri22_parms;
+		string usri22_workstations;
+		uint32 usri22_last_logon;
+		uint32 usri22_last_logoff;
+		uint32 usri22_acct_expires;
+		uint32 usri22_max_storage;
+		uint32 usri22_units_per_week;
+		uint8 *usri22_logon_hours;
+		uint32 usri22_bad_pw_count;
+		uint32 usri22_num_logons;
+		string usri22_logon_server;
+		uint32 usri22_country_code;
+		uint32 usri22_code_page;
+	} USER_INFO_22;
+
+	[public] typedef struct {
+		string usri23_name;
+		string usri23_full_name;
+		string usri23_comment;
+		uint32 usri23_flags;
+		domsid *usri23_user_sid;
+	} USER_INFO_23;
+
+	[public] typedef struct {
+		string usri1003_password;
+	} USER_INFO_1003;
+
+	[public] typedef struct {
+		uint32 usri1005_priv;
+	} USER_INFO_1005;
+
+	[public] typedef struct {
+		string usri1006_home_dir;
+	} USER_INFO_1006;
+
+	[public] typedef struct {
+		string usri1007_comment;
+	} USER_INFO_1007;
+
+	[public] typedef struct {
+		uint32 usri1008_flags;
+	} USER_INFO_1008;
+
+	[public] typedef struct {
+		string usri1009_script_path;
+	} USER_INFO_1009;
+
+	[public] typedef struct {
+		uint32 usri1010_auth_flags;
+	} USER_INFO_1010;
+
+	[public] typedef struct {
+		string usri1011_full_name;
+	} USER_INFO_1011;
+
+	[public] typedef struct {
+		string usri1012_usr_comment;
+	} USER_INFO_1012;
+
+	[public] typedef struct {
+		string usri1013_parms;
+	} USER_INFO_1013;
+
+	[public] typedef struct {
+		string usri1014_workstations;
+	} USER_INFO_1014;
+
+	[public] typedef struct {
+		uint32 usri1017_acct_expires;
+	} USER_INFO_1017;
+
+	[public] typedef struct {
+		uint32 usri1018_max_storage;
+	} USER_INFO_1018;
+
+	[public] typedef struct {
+		uint32 usri1020_units_per_week;
+		uint8 *usri1020_logon_hours;
+	} USER_INFO_1020;
+
+	[public] typedef struct {
+		string usri1023_logon_server;
+	} USER_INFO_1023;
+
+	[public] typedef struct {
+		uint32 usri1024_country_code;
+	} USER_INFO_1024;
+
+	[public] typedef struct {
+		uint32 usri1025_code_page;
+	} USER_INFO_1025;
+
+	[public] typedef struct {
+		uint32 usri1051_primary_group_id;
+	} USER_INFO_1051;
+
+	[public] typedef struct {
+		string usri1052_profile;
+	} USER_INFO_1052;
+
+	[public] typedef struct {
+		string usri1053_home_dir_drive;
+	} USER_INFO_1053;
+
+	[public] typedef struct {
+		string usriX_name;
+		string usriX_password;
+		uint32 usriX_password_age;
+		uint32 usriX_priv;
+		string usriX_home_dir;
+		string usriX_comment;
+		uint32 usriX_flags;
+		string usriX_script_path;
+		uint32 usriX_auth_flags;
+		string usriX_full_name;
+		string usriX_usr_comment;
+		string usriX_parms;
+		string usriX_workstations;
+		uint32 usriX_last_logon;
+		uint32 usriX_last_logoff;
+		uint32 usriX_acct_expires;
+		uint32 usriX_max_storage;
+		uint32 usriX_units_per_week;
+		uint8 *usriX_logon_hours;
+		uint32 usriX_bad_pw_count;
+		uint32 usriX_num_logons;
+		string usriX_logon_server;
+		uint32 usriX_country_code;
+		uint32 usriX_code_page;
+		string usriX_profile;
+		string usriX_home_dir_drive;
+		uint32 usriX_user_id;
+		uint32 usriX_primary_group_id;
+		uint32 usriX_password_expired;
+	} USER_INFO_X;
+
+	[nopush,nopull] NET_API_STATUS NetUserAdd(
+		[in,unique] string *server_name,
+		[in] uint32 level,
+		[in,ref] uint8 *buffer,
+		[out,ref] uint32 *parm_error
+		);
+
+	/*******************************************/
+	/* NetUserDel                              */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetUserDel(
+		[in,unique] string *server_name,
+		[in,ref] string *user_name
+		);
+
+	/*******************************************/
+	/* NetUserEnum                             */
+	/*******************************************/
+
+	const int FILTER_TEMP_DUPLICATE_ACCOUNT = 0x0001;
+	const int FILTER_NORMAL_ACCOUNT = 0x0002;
+	const int FILTER_INTERDOMAIN_TRUST_ACCOUNT = 0x0008;
+	const int FILTER_WORKSTATION_TRUST_ACCOUNT = 0x0010;
+	const int FILTER_SERVER_TRUST_ACCOUNT = 0x0020;
+
+	[nopush,nopull] NET_API_STATUS NetUserEnum(
+		[in,unique] string *server_name,
+		[in] uint32 level,
+		[in] uint32 filter,
+		[out,ref] uint8 **buffer,
+		[in] uint32 prefmaxlen,
+		[out,ref] uint32 *entries_read,
+		[out,ref] uint32 *total_entries,
+		[in,out,ref] uint32 *resume_handle
+		);
+
+	/*******************************************/
+	/* NetUserChangePassword                   */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetUserChangePassword(
+		[in] string domain_name,
+		[in] string user_name,
+		[in] string old_password,
+		[in] string new_password
+		);
+
+	/*******************************************/
+	/* NetUserGetInfo                          */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetUserGetInfo(
+		[in] string server_name,
+		[in] string user_name,
+		[in] uint32 level,
+		[out] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* NetUserSetInfo                          */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetUserSetInfo(
+		[in] string server_name,
+		[in] string user_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[out] uint32 *parm_err
+		);
+
+	/*******************************************/
+	/* NetUserGetGroups                        */
+	/*******************************************/
+
+	[public] typedef struct {
+		string grui0_name;
+	} GROUP_USERS_INFO_0;
+
+	[public] typedef struct {
+		string grui1_name;
+		uint32 grui1_attributes;
+	} GROUP_USERS_INFO_1;
+
+	[nopush,nopull] NET_API_STATUS NetUserGetGroups(
+		[in] string server_name,
+		[in] string user_name,
+		[in] uint32 level,
+		[out] uint8 **buffer,
+		[in] uint32 prefmaxlen,
+		[out,ref] uint32 *entries_read,
+		[out,ref] uint32 *total_entries
+		);
+
+	/*******************************************/
+	/* NetUserSetGroups                        */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetUserSetGroups(
+		[in] string server_name,
+		[in] string user_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[in] uint32 num_entries
+		);
+
+	/*******************************************/
+	/* NetUserGetLocalGroups                   */
+	/*******************************************/
+
+	const int LG_INCLUDE_INDIRECT = 0x0001;
+
+	typedef struct {
+		string lgrui0_name;
+	} LOCALGROUP_USERS_INFO_0;
+
+	[nopush,nopull] NET_API_STATUS NetUserGetLocalGroups(
+		[in] string server_name,
+		[in] string user_name,
+		[in] uint32 level,
+		[in] uint32 flags,
+		[out] uint8 **buffer,
+		[in] uint32 prefmaxlen,
+		[out,ref] uint32 *entries_read,
+		[out,ref] uint32 *total_entries
+		);
+
+	/*******************************************/
+	/* NetUserModalsGet                        */
+	/*******************************************/
+
+	const int TIMEQ_FOREVER = (uint32_t)-1L;
+
+	typedef struct {
+		uint32 usrmod0_min_passwd_len;
+		uint32 usrmod0_max_passwd_age;
+		uint32 usrmod0_min_passwd_age;
+		uint32 usrmod0_force_logoff;
+		uint32 usrmod0_password_hist_len;
+	} USER_MODALS_INFO_0;
+
+	typedef struct {
+		uint32 usrmod1_role;
+		string usrmod1_primary;
+	} USER_MODALS_INFO_1;
+
+	typedef struct {
+		string usrmod2_domain_name;
+		domsid *usrmod2_domain_id;
+	} USER_MODALS_INFO_2;
+
+	typedef struct {
+		uint32 usrmod3_lockout_duration;
+		uint32 usrmod3_lockout_observation_window;
+		uint32 usrmod3_lockout_threshold;
+	} USER_MODALS_INFO_3;
+
+	typedef struct {
+		uint32 usrmod1001_min_passwd_len;
+	} USER_MODALS_INFO_1001;
+
+	typedef struct {
+		uint32 usrmod1002_max_passwd_age;
+	} USER_MODALS_INFO_1002;
+
+	typedef struct {
+		uint32 usrmod1003_min_passwd_age;
+	} USER_MODALS_INFO_1003;
+
+	typedef struct {
+		uint32 usrmod1004_force_logoff;
+	} USER_MODALS_INFO_1004;
+
+	typedef struct {
+		uint32 usrmod1005_password_hist_len;
+	} USER_MODALS_INFO_1005;
+
+	typedef struct {
+		uint32 usrmod1006_role;
+	} USER_MODALS_INFO_1006;
+
+	typedef struct {
+		string usrmod1007_primary;
+	} USER_MODALS_INFO_1007;
+
+	[nopush,nopull] NET_API_STATUS NetUserModalsGet(
+		[in] string server_name,
+		[in] uint32 level,
+		[out,ref] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* NetUserModalsSet                        */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetUserModalsSet(
+		[in] string server_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[out,ref] uint32 *parm_err
+		);
+
+	/*******************************************/
+	/* NetQueryDisplayInformation              */
+	/*******************************************/
+
+	[public] typedef struct {
+		string usri1_name;
+		string usri1_comment;
+		uint32 usri1_flags;
+		string usri1_full_name;
+		uint32 usri1_user_id;
+		uint32 usri1_next_index;
+	} NET_DISPLAY_USER;
+
+	[public] typedef struct {
+		string usri2_name;
+		string usri2_comment;
+		uint32 usri2_flags;
+		uint32 usri2_user_id;
+		uint32 usri2_next_index;
+	} NET_DISPLAY_MACHINE;
+
+	[public] typedef struct {
+		string grpi3_name;
+		string grpi3_comment;
+		uint32 grpi3_group_id;
+		uint32 grpi3_attributes;
+		uint32 grpi3_next_index;
+	} NET_DISPLAY_GROUP;
+
+	[nopush,nopull] NET_API_STATUS NetQueryDisplayInformation(
+		[in,unique] string *server_name,
+		[in] uint32 level,
+		[in] uint32 idx,
+		[in] uint32 entries_requested,
+		[in] uint32 prefmaxlen,
+		[out,ref] uint32 *entries_read,
+		[out,ref,noprint] void **buffer
+		);
+
+	/*******************************************/
+	/* NetGroupAdd                             */
+	/*******************************************/
+
+	typedef struct {
+		string grpi0_name;
+	} GROUP_INFO_0;
+
+	typedef struct {
+		string grpi1_name;
+		string grpi1_comment;
+	} GROUP_INFO_1;
+
+	typedef struct {
+		string grpi2_name;
+		string grpi2_comment;
+		uint32 grpi2_group_id;
+		uint32 grpi2_attributes;
+	} GROUP_INFO_2;
+
+	typedef struct {
+		string grpi3_name;
+		string grpi3_comment;
+		domsid *grpi3_group_sid;
+		uint32 grpi3_attributes;
+	} GROUP_INFO_3;
+
+	typedef struct {
+		string grpi1002_comment;
+	} GROUP_INFO_1002;
+
+	typedef struct {
+		uint32 grpi1005_attributes;
+	} GROUP_INFO_1005;
+
+	[nopush,nopull] NET_API_STATUS NetGroupAdd(
+		[in] string server_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[out] uint32 *parm_err
+		);
+
+	/*******************************************/
+	/* NetGroupDel                             */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGroupDel(
+		[in] string server_name,
+		[in] string group_name
+		);
+
+	/*******************************************/
+	/* NetGroupEnum                            */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGroupEnum(
+		[in] string server_name,
+		[in] uint32 level,
+		[out,ref] uint8 **buffer,
+		[in] uint32 prefmaxlen,
+		[out,ref] uint32 *entries_read,
+		[out,ref] uint32 *total_entries,
+		[in,out,ref] uint32 *resume_handle
+		);
+
+	/*******************************************/
+	/* NetGroupSetInfo                         */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGroupSetInfo(
+		[in] string server_name,
+		[in] string group_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[out] uint32 *parm_err
+		);
+
+	/*******************************************/
+	/* NetGroupGetInfo                         */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGroupGetInfo(
+		[in] string server_name,
+		[in] string group_name,
+		[in] uint32 level,
+		[out] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* NetGroupAddUser                         */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGroupAddUser(
+		[in] string server_name,
+		[in] string group_name,
+		[in] string user_name
+		);
+
+	/*******************************************/
+	/* NetGroupDelUser                         */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGroupDelUser(
+		[in] string server_name,
+		[in] string group_name,
+		[in] string user_name
+		);
+
+	/*******************************************/
+	/* NetGroupGetUsers                        */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGroupGetUsers(
+		[in] string server_name,
+		[in] string group_name,
+		[in] uint32 level,
+		[out] uint8 **buffer,
+		[in] uint32 prefmaxlen,
+		[out,ref] uint32 *entries_read,
+		[out,ref] uint32 *total_entries,
+		[in,out,ref] uint32 *resume_handle
+		);
+
+	/*******************************************/
+	/* NetGroupSetUsers                        */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetGroupSetUsers(
+		[in] string server_name,
+		[in] string group_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[in] uint32 num_entries
+		);
+
+	/*******************************************/
+	/* NetLocalGroupAdd                        */
+	/*******************************************/
+
+	typedef struct {
+		string lgrpi0_name;
+	} LOCALGROUP_INFO_0;
+
+	typedef struct {
+		string lgrpi1_name;
+		string lgrpi1_comment;
+	} LOCALGROUP_INFO_1;
+
+	typedef struct {
+		string lgrpi1002_comment;
+	} LOCALGROUP_INFO_1002;
+
+	[nopush,nopull] NET_API_STATUS NetLocalGroupAdd(
+		[in] string server_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[out,ref] uint32 *parm_err
+		);
+
+	/*******************************************/
+	/* NetLocalGroupDel                        */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetLocalGroupDel(
+		[in] string server_name,
+		[in] string group_name
+		);
+
+	/*******************************************/
+	/* NetLocalGroupGetInfo                    */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetLocalGroupGetInfo(
+		[in] string server_name,
+		[in] string group_name,
+		[in] uint32 level,
+		[out,ref] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* NetLocalGroupSetInfo                    */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetLocalGroupSetInfo(
+		[in] string server_name,
+		[in] string group_name,
+		[in] uint32 level,
+		[in,ref] uint8 *buffer,
+		[out,ref] uint32 *parm_err
+		);
+
+	/*******************************************/
+	/* NetLocalGroupEnum                       */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetLocalGroupEnum(
+		[in] string server_name,
+		[in] uint32 level,
+		[out,ref] uint8 **buffer,
+		[in] uint32 prefmaxlen,
+		[out,ref] uint32 *entries_read,
+		[out,ref] uint32 *total_entries,
+		[in,out,ref] uint32 *resume_handle
+		);
+
+	/*******************************************/
+	/* NetLocalGroupAddMembers                 */
+	/*******************************************/
+
+	typedef enum {
+		SidTypeUser		= 1,
+		SidTypeGroup		= 2,
+		SidTypeDomain		= 3,
+		SidTypeAlias		= 4,
+		SidTypeWellKnownGroup	= 5,
+		SidTypeDeletedAccount	= 6,
+		SidTypeInvalid		= 7,
+		SidTypeUnknown		= 8,
+		SidTypeComputer		= 9,
+		SidTypeLabel		= 10
+	} SID_NAME_USE;
+
+	typedef struct {
+		domsid *lgrmi0_sid;
+	} LOCALGROUP_MEMBERS_INFO_0;
+
+	typedef struct {
+		domsid *lgrmi1_sid;
+		SID_NAME_USE lgrmi1_sidusage;
+		string lgrmi1_name;
+	} LOCALGROUP_MEMBERS_INFO_1;
+
+	typedef struct {
+		domsid *lgrmi2_sid;
+		SID_NAME_USE lgrmi2_sidusage;
+		string lgrmi2_domainandname;
+	} LOCALGROUP_MEMBERS_INFO_2;
+
+	typedef struct {
+		string lgrmi3_domainandname;
+	} LOCALGROUP_MEMBERS_INFO_3;
+
+	[nopush,nopull] NET_API_STATUS NetLocalGroupAddMembers(
+		[in] string server_name,
+		[in] string group_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[in] uint32 total_entries
+		);
+
+	/*******************************************/
+	/* NetLocalGroupDelMembers                 */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetLocalGroupDelMembers(
+		[in] string server_name,
+		[in] string group_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[in] uint32 total_entries
+		);
+
+	/*******************************************/
+	/* NetLocalGroupGetMembers                 */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetLocalGroupGetMembers(
+		[in] string server_name,
+		[in] string local_group_name,
+		[in] uint32 level,
+		[out] uint8 **buffer,
+		[in] uint32 prefmaxlen,
+		[out] uint32 *entries_read,
+		[out] uint32 *total_entries,
+		[in,out] uint32 *resume_handle
+		);
+
+	/*******************************************/
+	/* NetLocalGroupSetMembers                 */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetLocalGroupSetMembers(
+		[in] string server_name,
+		[in] string group_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[in] uint32 total_entries
+		);
+
+	/*******************************************/
+	/* NetRemoteTOD                            */
+	/*******************************************/
+
+	typedef struct {
+		uint32 tod_elapsedt;
+		uint32 tod_msecs;
+		uint32 tod_hours;
+		uint32 tod_mins;
+		uint32 tod_secs;
+		uint32 tod_hunds;
+		int32 tod_timezone;
+		uint32 tod_tinterval;
+		uint32 tod_day;
+		uint32 tod_month;
+		uint32 tod_year;
+		uint32 tod_weekday;
+	} TIME_OF_DAY_INFO;
+
+	[nopush,nopull] NET_API_STATUS NetRemoteTOD(
+		[in] string server_name,
+		[out,ref] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* NetShareAdd                             */
+	/*******************************************/
+
+	typedef struct {
+		string shi0_netname;
+	} SHARE_INFO_0;
+
+	typedef struct {
+		string shi1_netname;
+		uint32 shi1_type;
+		string shi1_remark;
+	} SHARE_INFO_1;
+
+	typedef struct {
+		string shi2_netname;
+		uint32 shi2_type;
+		string shi2_remark;
+		uint32 shi2_permissions;
+		uint32 shi2_max_uses;
+		uint32 shi2_current_uses;
+		string shi2_path;
+		string shi2_passwd;
+	} SHARE_INFO_2;
+
+	typedef struct {
+		string shi501_netname;
+		uint32 shi501_type;
+		string shi501_remark;
+		uint32 shi501_flags;
+	} SHARE_INFO_501;
+
+	typedef struct {
+		string shi502_netname;
+		uint32 shi502_type;
+		string shi502_remark;
+		uint32 shi502_permissions;
+		uint32 shi502_max_uses;
+		uint32 shi502_current_uses;
+		string shi502_path;
+		string shi502_passwd;
+		uint32 shi502_reserved;
+		security_descriptor *shi502_security_descriptor;
+	} SHARE_INFO_502;
+
+	typedef struct {
+		string shi1004_remark;
+	} SHARE_INFO_1004;
+
+	const int CSC_MASK = 0x30;
+
+	typedef [public,bitmap32bit] bitmap {
+		SHI1005_FLAGS_DFS				= 0x01,
+		SHI1005_FLAGS_DFS_ROOT				= 0x02,
+		CSC_CACHE_MANUAL_REINT				= 0x00,
+		CSC_CACHE_AUTO_REINT				= 0x10,
+		CSC_CACHE_VDO					= 0x20,
+		CSC_CACHE_NONE					= 0x30,
+		SHI1005_FLAGS_RESTRICT_EXCLUSIVE_OPENS		= 0x0100,
+		SHI1005_FLAGS_FORCE_SHARED_DELETE		= 0x0200,
+		SHI1005_FLAGS_ALLOW_NAMESPACE_CACHING		= 0x0400,
+		SHI1005_FLAGS_ACCESS_BASED_DIRECTORY_ENUM	= 0x0800
+	} SHARE_INFO_1005_FLAGS;
+
+	typedef struct {
+		SHARE_INFO_1005_FLAGS shi1005_flags;
+	} SHARE_INFO_1005;
+
+	typedef struct {
+		uint32 shi1006_max_uses;
+	} SHARE_INFO_1006;
+
+	[nopush,nopull] NET_API_STATUS NetShareAdd(
+		[in] string server_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[out] uint32 *parm_err
+		);
+
+	/*******************************************/
+	/* NetShareDel                             */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetShareDel(
+		[in] string server_name,
+		[in] string net_name,
+		[in] uint32 reserved
+		);
+
+	/*******************************************/
+	/* NetShareEnum                            */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetShareEnum(
+		[in] string server_name,
+		[in] uint32 level,
+		[out] uint8 **buffer,
+		[in] uint32 prefmaxlen,
+		[out] uint32 *entries_read,
+		[out] uint32 *total_entries,
+		[in,out] uint32 *resume_handle
+		);
+
+	/*******************************************/
+	/* NetShareGetInfo                         */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetShareGetInfo(
+		[in] string server_name,
+		[in] string net_name,
+		[in] uint32 level,
+		[out] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* NetShareSetInfo                         */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetShareSetInfo(
+		[in] string server_name,
+		[in] string net_name,
+		[in] uint32 level,
+		[in] uint8 *buffer,
+		[out] uint32 *parm_err
+		);
+
+	/*******************************************/
+	/* NetFileClose                            */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetFileClose(
+		[in] string server_name,
+		[in] uint32 fileid
+		);
+
+	/*******************************************/
+	/* NetFileGetInfo                          */
+	/*******************************************/
+
+	typedef struct {
+		uint32 fi2_id;
+	} FILE_INFO_2;
+
+	typedef struct {
+		uint32 fi3_id;
+		uint32 fi3_permissions;
+		uint32 fi3_num_locks;
+		string fi3_pathname;
+		string fi3_username;
+	} FILE_INFO_3;
+
+	[nopush,nopull] NET_API_STATUS NetFileGetInfo(
+		[in] string server_name,
+		[in] uint32 fileid,
+		[in] uint32 level,
+		[out] uint8 **buffer
+		);
+
+	/*******************************************/
+	/* NetFileEnum                             */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetFileEnum(
+		[in] string server_name,
+		[in] string base_path,
+		[in] string user_name,
+		[in] uint32 level,
+		[out] uint8 **buffer,
+		[in] uint32 prefmaxlen,
+		[out] uint32 *entries_read,
+		[out] uint32 *total_entries,
+		[in,out] uint32 *resume_handle
+		);
+
+	/*******************************************/
+	/* NetShutdownInit                         */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetShutdownInit(
+		[in] string server_name,
+		[in] string message,
+		[in] uint32 timeout,
+		[in] uint8 force_apps,
+		[in] uint8 do_reboot
+	);
+
+	/*******************************************/
+	/* NetShutdownAbort                        */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS NetShutdownAbort(
+		[in] string server_name
+	);
+
+	/*******************************************/
+	/* I_NetLogonControl                       */
+	/*******************************************/
+
+	typedef struct {
+		uint32 netlog1_flags;
+		NET_API_STATUS netlog1_pdc_connection_status;
+	} NETLOGON_INFO_1;
+
+	typedef struct {
+		uint32 netlog2_flags;
+		NET_API_STATUS netlog2_pdc_connection_status;
+		string netlog2_trusted_dc_name;
+		NET_API_STATUS netlog2_tc_connection_status;
+	} NETLOGON_INFO_2;
+
+	typedef struct {
+		uint32 netlog1_flags;
+		uint32 netlog3_logon_attempts;
+		uint32 netlog3_reserved1;
+		uint32 netlog3_reserved2;
+		uint32 netlog3_reserved3;
+		uint32 netlog3_reserved4;
+		uint32 netlog3_reserved5;
+	} NETLOGON_INFO_3;
+
+	typedef struct {
+		string netlog4_trusted_dc_name;
+		string netlog4_trusted_domain_name;
+	} NETLOGON_INFO_4;
+
+	[nopush,nopull] NET_API_STATUS I_NetLogonControl(
+		[in] string server_name,
+		[in] uint32 function_code,
+		[in] uint32 query_level,
+		[out,ref] uint8 **buffer
+	);
+
+	/*******************************************/
+	/* I_NetLogonControl2                      */
+	/*******************************************/
+
+	[nopush,nopull] NET_API_STATUS I_NetLogonControl2(
+		[in] string server_name,
+		[in] uint32 function_code,
+		[in] uint32 query_level,
+		[in,unique] uint8 *data,
+		[out,ref] uint8 **buffer
+	);
+}
diff --git a/source3/librpc/idl/open_files.idl b/source3/librpc/idl/open_files.idl
new file mode 100644
index 0000000..5dea021
--- /dev/null
+++ b/source3/librpc/idl/open_files.idl
@@ -0,0 +1,133 @@
+#include "idl_types.h"
+
+import "server_id.idl";
+import "security.idl";
+import "file_id.idl";
+import "smb2_lease_struct.idl";
+import "misc.idl";
+
+[
+	pointer_default(unique)
+]
+
+interface open_files
+{
+	typedef [enum16bit] enum {
+		SHARE_MODE_ENTRY_OP_TYPE_NONE = 0,
+		SHARE_MODE_ENTRY_OP_TYPE_EXCLUSIVE = 1,
+		SHARE_MODE_ENTRY_OP_TYPE_BATCH_WITHOUT_EXCLUSIVE = 2,
+		SHARE_MODE_ENTRY_OP_TYPE_BATCH = 3,
+		SHARE_MODE_ENTRY_OP_TYPE_LEVEL_II = 4,
+		SHARE_MODE_ENTRY_OP_TYPE_LEASE = 0x100
+	} share_mode_entry_op_type;
+
+	typedef [public] struct {
+		server_id	pid;
+		hyper		op_mid;
+		share_mode_entry_op_type op_type;
+		GUID		client_guid;
+		smb2_lease_key  lease_key;
+		uint32		access_mask;
+		uint32		share_access;
+		uint32		private_options;
+		timeval		time;
+		udlong		share_file_id;
+		uint32		uid;
+		uint16		flags;
+		uint32		name_hash;
+
+		/*
+		 * In-memory flag indicating a non-existing pid. We don't want
+		 * to store this share_mode_entry on disk.
+		 */
+		[skip] boolean8	stale;
+	} share_mode_entry;
+
+	typedef [public] struct {
+		uint32		name_hash;
+		security_token *delete_nt_token;
+		security_unix_token *delete_token;
+	} delete_token;
+
+	typedef [public,bitmap16bit] bitmap {
+		SHARE_MODE_SHARE_DELETE		= 0x100,
+		SHARE_MODE_SHARE_WRITE		= 0x080,
+		SHARE_MODE_SHARE_READ		= 0x040,
+		SHARE_MODE_ACCESS_DELETE	= 0x020,
+		SHARE_MODE_ACCESS_WRITE		= 0x010,
+		SHARE_MODE_ACCESS_READ		= 0x008,
+		SHARE_MODE_LEASE_HANDLE		= 0x004,
+		SHARE_MODE_LEASE_WRITE		= 0x002,
+		SHARE_MODE_LEASE_READ		= 0x001
+	} share_mode_flags;
+
+	typedef [public] struct {
+		hyper unique_content_epoch;
+		share_mode_flags flags;
+		[string,charset(UTF8)] char *servicepath;
+		[string,charset(UTF8)] char *base_name;
+		[string,charset(UTF8)] char *stream_name;
+		uint32 num_delete_tokens;
+		[size_is(num_delete_tokens)] delete_token delete_tokens[];
+		NTTIME old_write_time;
+		NTTIME changed_write_time;
+		[skip] boolean8 not_stored;
+		[skip] boolean8 modified;
+		[ignore] file_id id; /* In memory key used to lookup cache. */
+	} share_mode_data;
+
+	/* these are 0x30 (48) characters */
+	const string VFS_DEFAULT_DURABLE_COOKIE_MAGIC =
+		"VFS_DEFAULT_DURABLE_COOKIE_MAGIC                ";
+	const uint32 VFS_DEFAULT_DURABLE_COOKIE_VERSION = 0;
+
+	/* this corresponds to struct stat_ex (SMB_STRUCT_STAT) */
+	typedef struct {
+		hyper		st_ex_dev;
+		hyper		st_ex_ino;
+		hyper		st_ex_mode;
+		hyper		st_ex_nlink;
+		hyper		st_ex_uid;
+		hyper		st_ex_gid;
+		hyper		st_ex_rdev;
+		hyper		st_ex_size;
+		timespec	st_ex_atime;
+		timespec	st_ex_mtime;
+		timespec	st_ex_ctime;
+		timespec	st_ex_btime;
+		hyper		st_ex_blksize;
+		hyper		st_ex_blocks;
+		uint32		st_ex_flags;
+		uint32		st_ex_iflags;
+	} vfs_default_durable_stat;
+
+	typedef [public] struct {
+		[value(VFS_DEFAULT_DURABLE_COOKIE_MAGIC),charset(DOS)] uint8 magic[0x30];
+		[value(VFS_DEFAULT_DURABLE_COOKIE_VERSION)] uint32 version;
+		boolean8 allow_reconnect;
+		file_id id;
+		[string,charset(UTF8)] char *servicepath;
+		[string,charset(UTF8)] char *base_name;
+		hyper initial_allocation_size;
+		hyper position_information;
+		boolean8 update_write_time_triggered;
+		boolean8 update_write_time_on_close;
+		boolean8 write_time_forced;
+		NTTIME close_write_time;
+		vfs_default_durable_stat stat_info;
+	} vfs_default_durable_cookie;
+
+	typedef [public] struct {
+		file_id id;
+		udlong share_file_id;
+		uint8 break_to;
+	} oplock_break_message;
+
+	typedef [public] struct {
+		file_id id;
+		udlong share_file_id;
+		[string,charset(UTF8)] char *servicepath;
+		[string,charset(UTF8)] char *base_name;
+		[string,charset(UTF8)] char *stream_name;
+	} file_rename_message;
+}
diff --git a/source3/librpc/idl/perfcount.idl b/source3/librpc/idl/perfcount.idl
new file mode 100644
index 0000000..e797e01
--- /dev/null
+++ b/source3/librpc/idl/perfcount.idl
@@ -0,0 +1,172 @@
+#include "idl_types.h"
+
+/*
+   IDL structures for perfcount code
+*/
+
+[
+	pointer_default(unique)
+]
+	interface perfcount
+{
+	const int PERF_NO_INSTANCES		= -1;
+	const int PERF_NO_UNIQUE_ID		= -1;
+
+	/* These determine the data size */
+	const int PERF_SIZE_DWORD		= 0x00000000;
+	const int PERF_SIZE_LARGE		= 0x00000100;
+	const int PERF_SIZE_ZERO		= 0x00000200;
+	const int PERF_SIZE_VARIABLE_LEN	= 0x00000300;
+
+	/* These determine the usage of the counter */
+	const int PERF_TYPE_NUMBER		= 0x00000000;
+	const int PERF_TYPE_COUNTER		= 0x00000400;
+	const int PERF_TYPE_TEXT		= 0x00000800;
+	const int PERF_TYPE_ZERO		= 0x00000C00;
+
+	/* If PERF_TYPE_NUMBER was selected, these provide display information */
+	const int PERF_NUMBER_HEX		= 0x00000000;
+	const int PERF_NUMBER_DECIMAL		= 0x00010000;
+	const int PERF_NUMBER_DEC_1000		= 0x00020000;
+
+	/* If PERF_TYPE_COUNTER was selected, these provide display information */
+	const int PERF_COUNTER_VALUE		= 0x00000000;
+	const int PERF_COUNTER_RATE		= 0x00010000;
+	const int PERF_COUNTER_FRACTION		= 0x00020000;
+	const int PERF_COUNTER_BASE		= 0x00030000;
+	const int PERF_COUNTER_ELAPSED		= 0x00040000;
+	const int PERF_COUNTER_QUEUELEN		= 0x00050000;
+	const int PERF_COUNTER_HISTOGRAM	= 0x00060000;
+	const int PERF_COUNTER_PRECISION	= 0x00070000;
+
+	/* If PERF_TYPE_TEXT was selected, these provide display information */
+	const int PERF_TEXT_UNICODE		= 0x00000000;
+	const int PERF_TEXT_ASCII		= 0x00010000;
+
+	/* These provide information for which tick count to use when computing elapsed interval */
+	const int PERF_TIMER_TICK		= 0x00000000;
+	const int PERF_TIMER_100NS		= 0x00100000;
+	const int PERF_OBJECT_TIMER		= 0x00200000;
+
+	/* These affect how the data is manipulated prior to being displayed */
+	const int PERF_DELTA_COUNTER		= 0x00400000;
+	const int PERF_DELTA_BASE		= 0x00800000;
+	const int PERF_INVERSE_COUNTER		= 0x01000000;
+	const int PERF_MULTI_COUNTER		= 0x02000000;
+
+	/* These determine if any text gets added when the value is displayed */
+	const int PERF_DISPLAY_NO_SUFFIX	= 0x00000000;
+	const int PERF_DISPLAY_PER_SEC		= 0x10000000;
+	const int PERF_DISPLAY_PERCENT		= 0x20000000;
+	const int PERF_DISPLAY_SECONDS		= 0x30000000;
+	const int PERF_DISPLAY_NOSHOW		= 0x40000000;
+
+	/* These determine the DetailLevel of the counter */
+	const int PERF_DETAIL_NOVICE		= 100;
+	const int PERF_DETAIL_ADVANCED		= 200;
+	const int PERF_DETAIL_EXPERT		= 300;
+	const int PERF_DETAIL_WIZARD		= 400;
+
+	typedef struct {
+		uint16 year;
+		uint16 month;
+		uint16 dayofweek;
+		uint16 day;
+		uint16 hour;
+		uint16 minute;
+		uint16 second;
+		uint16 milliseconds;
+	} SYSTEMTIME;
+
+	typedef [public] struct {
+		/* sizeof(PERF_COUNTER_DEFINITION) */
+		uint32 ByteLength;
+		uint32 CounterNameTitleIndex;
+		uint32 CounterNameTitlePointer;
+		uint32 CounterHelpTitleIndex;
+		uint32 CounterHelpTitlePointer;
+		uint32 DefaultScale;
+		uint32 DetailLevel;
+		uint32 CounterType;
+		uint32 CounterSize;
+		uint32 CounterOffset;
+	} PERF_COUNTER_DEFINITION;
+
+	typedef [public] struct {
+		/* Total size of the data block, including all data plus this header */
+		uint32 ByteLength;
+		uint8 data[ByteLength];
+	} PERF_COUNTER_BLOCK;
+
+	typedef [public] struct {
+		/* Total size of the instance definition, including the length of the terminated Name string */
+		uint32 ByteLength;
+		uint32 ParentObjectTitleIndex;
+		uint32 ParentObjectTitlePointer;
+		uint32 UniqueID;
+		/* From the start of the PERF_INSTANCE_DEFINITION, the byte offset to the start of the Name string */
+		uint32 NameOffset;
+		uint32 NameLength;
+		/* Unicode string containing the name for the instance */
+		uint8 *data;
+		PERF_COUNTER_BLOCK counter_data;
+	} PERF_INSTANCE_DEFINITION;
+
+	typedef [public] struct {
+		/* Total size of the object block, including all PERF_INSTANCE_DEFINITIONs,
+		   PERF_COUNTER_DEFINITIONs and PERF_COUNTER_BLOCKs in bytes */
+		uint32 TotalByteLength;
+		/* Size of this PERF_OBJECT_TYPE plus all PERF_COUNTER_DEFINITIONs in bytes */
+		uint32 DefinitionLength;
+		/* Size of this PERF_OBJECT_TYPE */
+		uint32 HeaderLength;
+		uint32 ObjectNameTitleIndex;
+		uint32 ObjectNameTitlePointer;
+		uint32 ObjectHelpTitleIndex;
+		uint32 ObjectHelpTitlePointer;
+		uint32 DetailLevel;
+		uint32 NumCounters;
+		uint32 DefaultCounter;
+		uint32 NumInstances;
+		uint32 CodePage;
+		hyper PerfTime;
+		hyper PerfFreq;
+		PERF_COUNTER_DEFINITION counters[NumCounters];
+		PERF_INSTANCE_DEFINITION instances[NumInstances];
+		PERF_COUNTER_BLOCK counter_data;
+	} PERF_OBJECT_TYPE;
+
+	/* PerfCounter Inner Buffer structs */
+	typedef [public] struct {
+		/* hardcoded to read "P.E.R.F" */
+		uint16 Signature[4];
+		uint32 LittleEndian;
+		/* both currently hardcoded to 1 */
+		uint32 Version;
+		uint32 Revision;
+		/* bytes of PERF_OBJECT_TYPE data, does NOT include the PERF_DATA_BLOCK */
+		uint32 TotalByteLength;
+		/* size of PERF_DATA_BLOCK including the uint8 *data */
+		uint32 HeaderLength;
+		/* number of PERF_OBJECT_TYPE structures encoded */
+		uint32 NumObjectTypes;
+		uint32 DefaultObject;
+		SYSTEMTIME SystemTime;
+		/* This will guarantee that we're on a 64-bit boundary before we encode
+		   PerfTime, and having it there will make my offset math much easier. */
+		uint32 Padding;
+		/* Now when I'm marshalling this, I'll need to call prs_align_uint64()
+		   before I start encoding the uint64 structs */
+		/* clock rate * seconds uptime */
+		hyper PerfTime;
+		/* The clock rate of the CPU */
+		hyper PerfFreq;
+		/* used for high-res timers -- for now PerfTime * 10e7 */
+		hyper PerfTime100nSec;
+		uint32 SystemNameLength;
+		uint32 SystemNameOffset;
+		/* The SystemName, in unicode, terminated */
+		uint8* data;
+		PERF_OBJECT_TYPE objects[NumObjectTypes];
+	} PERF_DATA_BLOCK;
+}
diff --git a/source3/librpc/idl/rpc_host.idl b/source3/librpc/idl/rpc_host.idl
new file mode 100644
index 0000000..9eb48d3
--- /dev/null
+++ b/source3/librpc/idl/rpc_host.idl
@@ -0,0 +1,93 @@
+/**
+ * @file rpc_host.idl
+ *
+ * Definitions for communication between samba-dcerpcd and rpc helper
+ * daemons
+ */
+#include "idl_types.h"
+
+import "named_pipe_auth.idl";
+import "dcerpc.idl";
+
+[
+	pointer_default(unique)
+]
+
+interface rpc_host_msg
+{
+	/**
+	 * @brief MSG_RPC_HOST_NEW_CLIENT: samba-dcerpcd->rpcd
+	 *
+	 * samba-dcerpcd to rpcd msg announcing a new client. This
+	 * will carry a file descriptor representing the new
+	 * connection
+	 */
+	typedef [public] struct {
+		/**
+		 * @brief The binding the client wants to connect to
+		 */
+		[string,charset(UTF8)] char *binding;
+
+		/**
+		 * @brief Auth info inherited from SMB
+		 */
+		named_pipe_auth_req_info8 *npa_info8;
+
+		/**
+		 * @brief Raw bind PDU
+		 *
+		 * Already read from the socket by samba-dcerpcd
+		 */
+		DATA_BLOB bind_packet;
+	} rpc_host_client;
+
+	/**
+	 * @brief MSG_RPC_WORKER_STATUS: rpcd->samba-dcerpcd
+	 *
+	 * Once a client has been handed over from samba-dcerpcd to an
+	 * rpcd, samba-dcerpc has no control over this socket
+	 * anymore. So it can't know when the client exits and the
+	 * rpcd helper process has a slot free. Thus whenever a client
+	 * exits, rpcd sends this message up to samba-dcerpc for a
+	 * status update.
+	 */
+	typedef [flag(NDR_NOALIGN),public] struct {
+		/**
+		 * @brief Which rpc service is this message from
+		 *
+		 * samba-dcerpcd will only have the source pid of this
+		 * message. To avoid a walk through all arrays with
+		 * all rpcd helpers, give samba-dcerpcd a hint where
+		 * in its arrays to find the rpcd that sent this
+		 * message.
+		 */
+		uint32 server_index;
+
+		/**
+		 * @brief Which of the processes of a helper prog is this from
+		 *
+		 * @note while this is uint32, we currently only support 16-bit
+		 * values, as we use it in the high 16-bits of the 32-bit
+		 * association group id.
+		 */
+		uint32 worker_index;
+
+
+		/**
+		 * @brief How many association groups this process serves right now
+		 *
+		 * @note while this is uint32, we currently only support 16-bit
+		 * values, as we use the worker_index in the high 16-bits of
+		 * so we only have 16-bit per worker in order to form the 32-bit
+		 * association group id.
+		 */
+		uint32 num_association_groups;
+
+		/**
+		 * @brief How many client connections this process serves right now
+		 *
+		 * @note might be greater or equal to num_association_groups.
+		 */
+		uint32 num_connections;
+	} rpc_worker_status;
+}
diff --git a/source3/librpc/idl/rpcd_witness.idl b/source3/librpc/idl/rpcd_witness.idl
new file mode 100644
index 0000000..80852d2
--- /dev/null
+++ b/source3/librpc/idl/rpcd_witness.idl
@@ -0,0 +1,109 @@
+#include "idl_types.h"
+
+import "misc.idl";
+import "server_id.idl";
+import "security.idl";
+import "witness.idl";
+
+[
+	uuid("d320d080-a007-11ee-9cb4-37fa942d84d2"),
+	version(0.0),
+	pointer_default(unique),
+	helpstring("rpcd_witness structures")
+]
+interface rpcd_witness
+{
+	/*
+	 * This the content of records stored in
+	 * rpcd_witness_registration.tdb.
+	 */
+	typedef [public] struct {
+		witness_version version;
+		[string,charset(UTF8)] char net_name[];
+		[string,charset(UTF8)] char *share_name;
+		[string,charset(UTF8)] char ip_address[];
+		[string,charset(UTF8)] char client_computer_name[];
+		witness_RegisterEx_flags flags;
+		uint32 timeout;
+		policy_handle context_handle;
+		server_id server_id;
+		[charset(UTF8),string] char account_name[];
+		[charset(UTF8),string] char domain_name[];
+		dom_sid account_sid;
+		[charset(UTF8),string] char local_address[];
+		[charset(UTF8),string] char remote_address[];
+		NTTIME registration_time;
+	} rpcd_witness_registration;
+
+	void rpcd_witness_registration_decode(
+		[in] rpcd_witness_registration reg
+		);
+
+	typedef [enum16bit] enum {
+		RPCD_WITNESS_REGISTRATION_UPDATE_CLIENT_MOVE_TO_NODE  = 0x0001,
+		RPCD_WITNESS_REGISTRATION_UPDATE_CLIENT_MOVE_TO_IPV4  = 0x0002,
+		RPCD_WITNESS_REGISTRATION_UPDATE_CLIENT_MOVE_TO_IPV6  = 0x0003,
+		RPCD_WITNESS_REGISTRATION_UPDATE_SHARE_MOVE_TO_NODE   = 0x0004,
+		RPCD_WITNESS_REGISTRATION_UPDATE_SHARE_MOVE_TO_IPV4   = 0x0005,
+		RPCD_WITNESS_REGISTRATION_UPDATE_SHARE_MOVE_TO_IPV6   = 0x0006,
+		RPCD_WITNESS_REGISTRATION_UPDATE_FORCE_UNREGISTER     = 0x0007,
+		RPCD_WITNESS_REGISTRATION_UPDATE_FORCE_RESPONSE       = 0x0008
+	} rpcd_witness_registration_update_type;
+
+	typedef struct {
+		uint32 new_node;
+	} rpcd_witness_registration_update_move_to_node;
+
+	typedef struct {
+		[flag(NDR_BIG_ENDIAN)] ipv4address new_ipv4;
+	} rpcd_witness_registration_update_move_to_ipv4;
+
+	typedef struct {
+		[flag(NDR_BIG_ENDIAN)] ipv6address new_ipv6;
+	} rpcd_witness_registration_update_move_to_ipv6;
+
+	typedef struct {
+		witness_notifyResponse *response;
+		WERROR result;
+	} rpcd_witness_registration_update_force_response;
+
+	typedef [switch_type(rpcd_witness_registration_update_type)] union {
+		[case(RPCD_WITNESS_REGISTRATION_UPDATE_CLIENT_MOVE_TO_NODE)]
+		rpcd_witness_registration_update_move_to_node client_move_to_node;
+
+		[case(RPCD_WITNESS_REGISTRATION_UPDATE_CLIENT_MOVE_TO_IPV4)]
+		rpcd_witness_registration_update_move_to_ipv4 client_move_to_ipv4;
+
+		[case(RPCD_WITNESS_REGISTRATION_UPDATE_CLIENT_MOVE_TO_IPV6)]
+		rpcd_witness_registration_update_move_to_ipv6 client_move_to_ipv6;
+
+		[case(RPCD_WITNESS_REGISTRATION_UPDATE_SHARE_MOVE_TO_NODE)]
+		rpcd_witness_registration_update_move_to_node share_move_to_node;
+
+		[case(RPCD_WITNESS_REGISTRATION_UPDATE_SHARE_MOVE_TO_IPV4)]
+		rpcd_witness_registration_update_move_to_ipv4 share_move_to_ipv4;
+
+		[case(RPCD_WITNESS_REGISTRATION_UPDATE_SHARE_MOVE_TO_IPV6)]
+		rpcd_witness_registration_update_move_to_ipv6 share_move_to_ipv6;
+
+		[case(RPCD_WITNESS_REGISTRATION_UPDATE_FORCE_UNREGISTER)];
+		/* empty */
+
+		[case(RPCD_WITNESS_REGISTRATION_UPDATE_FORCE_RESPONSE)]
+		rpcd_witness_registration_update_force_response force_response;
+	} rpcd_witness_registration_updateU;
+
+	/*
+	 * This is the content of
+	 * MSG_RPCD_WITNESS_REGISTRATION_UPDATE messages
+	 */
+	typedef [public] struct {
+		policy_handle context_handle;
+		rpcd_witness_registration_update_type type;
+		[switch_is(type)] rpcd_witness_registration_updateU update;
+	} rpcd_witness_registration_updateB;
+
+	void rpcd_witness_registration_update_decode(
+		[in] rpcd_witness_registration_updateB update
+		);
+}
diff --git a/source3/librpc/idl/secrets.idl b/source3/librpc/idl/secrets.idl
new file mode 100644
index 0000000..2c06fa6
--- /dev/null
+++ b/source3/librpc/idl/secrets.idl
@@ -0,0 +1,131 @@
+#include "idl_types.h"
+
+import "misc.idl", "samr.idl", "lsa.idl", "netlogon.idl", "security.idl";
+
+/*
+   IDL structures for secrets code
+*/
+
+[
+	pointer_default(unique)
+]
+	interface secrets
+{
+
+	/*
+	 * s3 on-disc storage structure for trusted domains, do not change !
+	 */
+
+	typedef [flag(NDR_NOALIGN),public] struct {
+		[value(strlen_m_term(uni_name))] uint32 uni_name_len;
+		[charset(UTF16)] uint16 uni_name[32]; /* unicode domain name */
+		[value(strlen(pass))] uint32 pass_len;
+		astring pass;		/* trust relationship's password */
+		time_t mod_time;
+		dom_sid domain_sid;	/* remote domain's sid */
+	} TRUSTED_DOM_PASS;
+
+	/*
+	 * s3 on-disc storage structure for lsa secrets, do not change !
+	 */
+
+	typedef [public] struct {
+		DATA_BLOB *secret_current;
+		NTTIME secret_current_lastchange;
+		DATA_BLOB *secret_old;
+		NTTIME secret_old_lastchange;
+		security_descriptor *sd;
+	} lsa_secret;
+
+	/*
+	 * This is the on-disc format the workstation trust.
+	 *
+	 * DO NOT CHANGE
+	 * without changing secrets_domain_info_version
+	 * and adding glue code. Discuss on samba-technical
+	 * first!
+	 */
+	typedef struct {
+		uint32 keytype;
+		uint32 iteration_count;
+		[flag(NDR_SECRET)] DATA_BLOB value;
+	} secrets_domain_info1_kerberos_key;
+
+	typedef struct {
+		NTTIME change_time;
+		[string,charset(UTF16)] uint16 change_server[];
+
+		[flag(NDR_SECRET)] DATA_BLOB cleartext_blob;
+		[flag(NDR_SECRET)] samr_Password nt_hash;
+
+		[string,charset(UTF16)] uint16 *salt_data;
+		uint32 default_iteration_count;
+		uint16 num_keys;
+		secrets_domain_info1_kerberos_key keys[num_keys];
+	} secrets_domain_info1_password;
+
+	typedef struct {
+		NTSTATUS local_status;
+		NTSTATUS remote_status;
+		NTTIME change_time;
+		[string,charset(UTF16)] uint16 change_server[];
+		[ref] secrets_domain_info1_password *password;
+	} secrets_domain_info1_change;
+
+	typedef [public] struct {
+		[value(0)] hyper reserved_flags;
+
+		NTTIME join_time;
+
+		[string,charset(UTF16)] uint16 computer_name[];
+		[string,charset(UTF16)] uint16 account_name[];
+		netr_SchannelType secure_channel_type;
+
+		lsa_DnsDomainInfo domain_info;
+		netr_TrustFlags trust_flags;
+		lsa_TrustType trust_type;
+		lsa_TrustAttributes trust_attributes;
+
+		/*
+		 * This is unused currently, it might
+		 * be useful to implement multi-tenancy (joining multiple domains)
+		 * in future.
+		 *
+		 * Or we could use it to do other filtering of domains.
+		 */
+		[value(NULL)] lsa_ForestTrustInformation *reserved_routing;
+
+		kerb_EncTypes supported_enc_types;
+		[string,charset(UTF16)] uint16 *salt_principal;
+
+		NTTIME password_last_change;
+		hyper password_changes;
+		secrets_domain_info1_change *next_change;
+
+		[ref] secrets_domain_info1_password *password;
+		secrets_domain_info1_password *old_password;
+		secrets_domain_info1_password *older_password;
+	} secrets_domain_info1;
+
+	typedef [v1_enum] enum {
+		SECRETS_DOMAIN_INFO_VERSION_1 = 0x00000001
+	} secrets_domain_info_version;
+
+	/*
+	 * If we ever need to change this we need to
+	 * change secrets_domain_info into
+	 * secrets_domain_info_v1
+	 */
+	typedef union {
+		[case(SECRETS_DOMAIN_INFO_VERSION_1)]
+			secrets_domain_info1 *info1;
+		[default];
+	} secrets_domain_infoU;
+
+	typedef [public] struct {
+		secrets_domain_info_version version;
+		[value(0)] uint32 reserved;
+		[switch_is(version)] secrets_domain_infoU info;
+	} secrets_domain_infoB;
+}
+
diff --git a/source3/librpc/idl/smbXsrv.idl b/source3/librpc/idl/smbXsrv.idl
new file mode 100644
index 0000000..4eb43e6
--- /dev/null
+++ b/source3/librpc/idl/smbXsrv.idl
@@ -0,0 +1,549 @@
+#include "idl_types.h"
+
+import "misc.idl";
+import "server_id.idl";
+import "security.idl";
+import "auth.idl";
+
+[
+	uuid("07408340-ae31-11e1-97dc-539f7fddc06f"),
+	version(0.0),
+	pointer_default(unique),
+	helpstring("smbXsrv structures")
+]
+interface smbXsrv
+{
+	/*
+	 * smbXsrv_version* is designed to allow
+	 * rolling code upgrades in future (within a cluster).
+	 *
+	 * This just adds the infrastructure,
+	 * but it does not implement it yet!
+	 *
+	 * Currently it only prevents that
+	 * nodes with a different version numbers
+	 * cannot run at the same time.
+	 *
+	 * Each node checks at startup, if the version
+	 * matches the version of all other nodes.
+	 * And it exits if the version does not match
+	 * to avoid corruption.
+	 *
+	 * While it would be possible to add versioning
+	 * to each of our internal databases it is easier
+	 * use a dedicated database "smbXsrv_version_global.tdb"
+	 * to hold the global version information.
+	 *
+	 * This removes extra complexity from the individual
+	 * databases and allows that we add/remove databases
+	 * or use different indexing keys.
+	 *
+	 */
+	typedef [v1_enum] enum {
+		/*
+		 * NOTE: Version 0 is designed to be unstable and the format
+		 * may change during development.
+		 */
+		SMBXSRV_VERSION_0 = 0x00000000
+	} smbXsrv_version_values;
+
+	const uint32 SMBXSRV_VERSION_CURRENT = SMBXSRV_VERSION_0;
+
+	typedef struct {
+		server_id				server_id;
+		smbXsrv_version_values			min_version;
+		smbXsrv_version_values			max_version;
+		smbXsrv_version_values			current_version;
+	} smbXsrv_version_node0;
+
+	typedef struct {
+		[ignore] db_record 			*db_rec;
+		[range(1, 1024)] uint32			num_nodes;
+		smbXsrv_version_node0			nodes[num_nodes];
+	} smbXsrv_version_global0;
+
+	typedef union {
+		[case(0)] smbXsrv_version_global0	*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_version_globalU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		uint32					seqnum;
+		[switch_is(version)] smbXsrv_version_globalU info;
+	} smbXsrv_version_globalB;
+
+	void smbXsrv_version_global_decode(
+		[in] smbXsrv_version_globalB blob
+		);
+
+	/* client */
+
+	typedef struct {
+		[ignore] db_record 			*db_rec;
+		server_id				server_id;
+		[charset(UTF8),string] char		local_address[];
+		[charset(UTF8),string] char		remote_address[];
+		[charset(UTF8),string] char		remote_name[];
+		NTTIME					initial_connect_time;
+		GUID					client_guid;
+		boolean8				stored;
+	} smbXsrv_client_global0;
+
+	typedef union {
+		[case(0)] smbXsrv_client_global0	*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_client_globalU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		uint32					seqnum;
+		[switch_is(version)] smbXsrv_client_globalU info;
+	} smbXsrv_client_globalB;
+
+	void smbXsrv_client_global_decode(
+		[in] smbXsrv_client_globalB blob
+		);
+
+	typedef [public] struct {
+		[ignore] smbXsrv_client_table		*table;
+		[ignore] struct tevent_context		*raw_ev_ctx;
+		[ignore] struct messaging_context	*msg_ctx;
+
+		[ref] smbXsrv_client_global0		*global;
+
+		/*
+		 * There's just one 'sconn' per client.
+		 * It holds the FSA layer details, which are global
+		 * per client (process).
+		 */
+		[ignore] struct smbd_server_connection	*sconn;
+
+		/*
+		 * this session_table is used for SMB1 and SMB2,
+		 */
+		[ignore] struct smbXsrv_session_table	*session_table;
+		/*
+		 * this tcon_table is only used for SMB1.
+		 */
+		[ignore] struct smbXsrv_tcon_table	*tcon_table;
+		/*
+		 * this open_table is used for SMB1 and SMB2,
+		 * because we have a global sconn->real_max_open_files
+		 * limit.
+		 */
+		[ignore] struct smbXsrv_open_table	*open_table;
+
+		/*
+		 * For now this is only one connection!
+		 * With multi-channel support we'll get more than
+		 * one in future.
+		 */
+		[ignore] struct smbXsrv_connection	*connections;
+		boolean8		server_multi_channel_enabled;
+		hyper			next_channel_id;
+		[ignore] struct tevent_req		*connection_pass_subreq;
+		[ignore] struct tevent_req		*connection_drop_subreq;
+
+		/*
+		 * A List of pending breaks.
+		 */
+		[ignore] struct smbXsrv_pending_break *pending_breaks;
+	} smbXsrv_client;
+
+	typedef union {
+		[case(0)] smbXsrv_client		*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_clientU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		[value(0)] uint32			reserved;
+		[switch_is(version)] smbXsrv_clientU	info;
+	} smbXsrv_clientB;
+
+	void smbXsrv_client_decode(
+		[in] smbXsrv_clientB blob
+		);
+
+	/*
+	 * smbXsrv_connection_pass is used in the MSG_SMBXSRV_CONNECTION_PASS
+	 * message and echo'ed as MSG_SMBXSRV_CONNECTION_PASSED message with
+	 * negotiate_request.length = 0.
+	 */
+	typedef struct {
+		GUID					client_guid;
+		server_id				src_server_id;
+		NTTIME					xconn_connect_time;
+		server_id				dst_server_id;
+		NTTIME					client_connect_time;
+		DATA_BLOB 				negotiate_request;
+	} smbXsrv_connection_pass0;
+
+	typedef union {
+		[case(0)] smbXsrv_connection_pass0	*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_connection_passU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		[value(0)] uint32			reserved;
+		[switch_is(version)] smbXsrv_connection_passU	info;
+	} smbXsrv_connection_passB;
+
+	void smbXsrv_connection_pass_decode(
+		[in] smbXsrv_connection_passB blob
+		);
+
+	/*
+	 * smbXsrv_connection_drop is used in the MSG_SMBXSRV_CONNECTION_DROP
+	 * message as reaction the record is deleted.
+	 */
+	typedef struct {
+		GUID					client_guid;
+		server_id				src_server_id;
+		NTTIME					xconn_connect_time;
+		server_id				dst_server_id;
+		NTTIME					client_connect_time;
+	} smbXsrv_connection_drop0;
+
+	typedef union {
+		[case(0)] smbXsrv_connection_drop0	*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_connection_dropU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		[value(0)] uint32			reserved;
+		[switch_is(version)] smbXsrv_connection_dropU	info;
+	} smbXsrv_connection_dropB;
+
+	void smbXsrv_connection_drop_decode(
+		[in] smbXsrv_connection_dropB blob
+		);
+
+	/* sessions */
+
+	typedef [public,bitmap8bit] bitmap {
+		SMBXSRV_ENCRYPTION_REQUIRED		= 0x01,
+		SMBXSRV_ENCRYPTION_DESIRED		= 0x02,
+		SMBXSRV_PROCESSED_ENCRYPTED_PACKET	= 0x04,
+		SMBXSRV_PROCESSED_UNENCRYPTED_PACKET	= 0x08
+	} smbXsrv_encrpytion_flags;
+
+	typedef [public,bitmap8bit] bitmap {
+		SMBXSRV_SIGNING_REQUIRED		= 0x01,
+		SMBXSRV_PROCESSED_SIGNED_PACKET		= 0x02,
+		SMBXSRV_PROCESSED_UNSIGNED_PACKET	= 0x04
+	} smbXsrv_signing_flags;
+
+	typedef struct {
+		server_id				server_id;
+		hyper					channel_id;
+		NTTIME					creation_time;
+		[charset(UTF8),string] char		local_address[];
+		[charset(UTF8),string] char		remote_address[];
+		[charset(UTF8),string] char		remote_name[];
+		[noprint] DATA_BLOB			signing_key_blob;
+		[ignore] smb2_signing_key		*signing_key;
+		uint32					auth_session_info_seqnum;
+		[ignore] smbXsrv_connection		*connection;
+		uint16					signing_algo;
+		uint16					encryption_cipher;
+	} smbXsrv_channel_global0;
+
+	typedef struct {
+		[ignore] db_record 			*db_rec;
+		uint32					session_global_id;
+		hyper					session_wire_id;
+		NTTIME					creation_time;
+		NTTIME					expiration_time;
+		/*
+		 * auth_session is NULL until the
+		 * session is valid for the first time.
+		 */
+		NTTIME					auth_time;
+		uint32					auth_session_info_seqnum;
+		auth_session_info			*auth_session_info;
+		uint16					connection_dialect;
+		GUID					client_guid;
+		smbXsrv_signing_flags			signing_flags;
+		uint16					signing_algo;
+		smbXsrv_encrpytion_flags		encryption_flags;
+		uint16					encryption_cipher;
+		[noprint] DATA_BLOB			signing_key_blob;
+		[ignore] smb2_signing_key		*signing_key;
+		[noprint] DATA_BLOB			encryption_key_blob;
+		[ignore] smb2_signing_key		*encryption_key;
+		[noprint] DATA_BLOB			decryption_key_blob;
+		[ignore] smb2_signing_key		*decryption_key;
+		[noprint] DATA_BLOB			application_key_blob;
+		[ignore] smb2_signing_key		*application_key;
+		[range(1, 1024)] uint32			num_channels;
+		smbXsrv_channel_global0			channels[num_channels];
+	} smbXsrv_session_global0;
+
+	typedef union {
+		[case(0)] smbXsrv_session_global0	*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_session_globalU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		uint32					seqnum;
+		[switch_is(version)] smbXsrv_session_globalU info;
+	} smbXsrv_session_globalB;
+
+	void smbXsrv_session_global_decode(
+		[in] smbXsrv_session_globalB blob
+		);
+
+	/*
+	 * The main server code should just work with
+	 * 'struct smbXsrv_session' and never use
+	 * smbXsrv_session0, smbXsrv_sessionU
+	 * and smbXsrv_sessionB directly.
+	 *
+	 * If we need to change the smbXsrv_session,
+	 * we can just rename smbXsrv_session
+	 * to smbXsrv_session0 and add a new
+	 * smbXsrv_session for version 1
+	 * and could implement transparent mapping.
+	 */
+
+	typedef struct {
+		[ignore] smbXsrv_session_auth0		*prev;
+		[max_recursion(20000)] smbXsrv_session_auth0 *next;
+		[ignore] smbXsrv_session		*session;
+		[ignore] smbXsrv_connection		*connection;
+		[ignore] gensec_security		*gensec;
+		[ignore] smbXsrv_preauth		*preauth;
+		uint8					in_flags;
+		uint8					in_security_mode;
+		NTTIME					creation_time;
+		NTTIME					idle_time;
+		hyper					channel_id;
+	} smbXsrv_session_auth0;
+
+	typedef struct {
+		[ignore] smbXsrv_session_table		*table;
+		[ignore] db_record 			*db_rec;
+		[ignore] smbXsrv_client			*client;
+		uint32					local_id;
+		[ref] smbXsrv_session_global0		*global;
+		NTSTATUS				status;
+		NTTIME					idle_time;
+		hyper					nonce_high_random;
+		hyper					nonce_high_max;
+		hyper					nonce_high;
+		hyper					nonce_low;
+		[ignore] smbXsrv_tcon_table		*tcon_table;
+		[ignore] uint32				homes_snum;
+		smbXsrv_session_auth0			*pending_auth;
+	} smbXsrv_session;
+
+	typedef union {
+		[case(0)] smbXsrv_session		*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_sessionU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		[value(0)] uint32			reserved;
+		[switch_is(version)] smbXsrv_sessionU	info;
+	} smbXsrv_sessionB;
+
+	void smbXsrv_session_decode(
+		[in] smbXsrv_sessionB blob
+		);
+
+	/*
+	 * smbXsrv_session_close is use in the MSG_SMBXSRV_SESSION_CLOSE
+	 * message
+	 */
+	typedef struct {
+		uint32					old_session_global_id;
+		hyper					old_session_wire_id;
+		NTTIME					old_creation_time;
+		hyper					new_session_wire_id;
+	} smbXsrv_session_close0;
+
+	typedef union {
+		[case(0)] smbXsrv_session_close0	*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_session_closeU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		[value(0)] uint32			reserved;
+		[switch_is(version)] smbXsrv_session_closeU	info;
+	} smbXsrv_session_closeB;
+
+	void smbXsrv_session_close_decode(
+		[in] smbXsrv_session_closeB blob
+		);
+
+	/* tree connects */
+
+	typedef struct {
+		[ignore] db_record 			*db_rec;
+		uint32					tcon_global_id;
+		uint32					tcon_wire_id;
+		server_id				server_id;
+		NTTIME					creation_time;
+		[charset(UTF8),string] char		share_name[];
+		smbXsrv_encrpytion_flags		encryption_flags;
+		/*
+		 * for SMB1 this is the session that the tcon was opened on
+		 */
+		uint32					session_global_id;
+		smbXsrv_signing_flags                   signing_flags;
+	} smbXsrv_tcon_global0;
+
+	typedef union {
+		[case(0)] smbXsrv_tcon_global0		*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_tcon_globalU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		uint32					seqnum;
+		[switch_is(version)] smbXsrv_tcon_globalU info;
+	} smbXsrv_tcon_globalB;
+
+	void smbXsrv_tcon_global_decode(
+		[in] smbXsrv_tcon_globalB blob
+		);
+
+	/*
+	 * The main server code should just work with
+	 * 'struct smbXsrv_tcon' and never use
+	 * smbXsrv_tcon0, smbXsrv_tconU
+	 * and smbXsrv_tconB directly.
+	 *
+	 * If we need to change the smbXsrv_tcon,
+	 * we can just rename smbXsrv_tcon
+	 * to smbXsrv_tcon0 and add a new
+	 * smbXsrv_tcon for version 1
+	 * and could implement transparent mapping.
+	 */
+	typedef struct {
+		[ignore] smbXsrv_tcon_table		*table;
+		[ignore] db_record 			*db_rec;
+		uint32					local_id;
+		[ref] smbXsrv_tcon_global0		*global;
+		NTSTATUS				status;
+		NTTIME					idle_time;
+		[ignore] connection_struct		*compat;
+	} smbXsrv_tcon;
+
+	typedef union {
+		[case(0)] smbXsrv_tcon			*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_tconU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		[value(0)] uint32			reserved;
+		[switch_is(version)] smbXsrv_tconU	info;
+	} smbXsrv_tconB;
+
+	void smbXsrv_tcon_decode(
+		[in] smbXsrv_tconB blob
+		);
+
+	/* open files */
+
+	typedef [public,bitmap8bit] bitmap {
+		SMBXSRV_OPEN_NEED_REPLAY_CACHE		= 0x01,
+		SMBXSRV_OPEN_HAVE_REPLAY_CACHE		= 0x02
+	} smbXsrv_open_flags;
+
+	typedef struct {
+		server_id				server_id;
+		uint32					open_global_id;
+		hyper					open_persistent_id;
+		hyper					open_volatile_id;
+		dom_sid					open_owner;
+		NTTIME					open_time;
+		GUID					create_guid;
+		GUID					client_guid;
+		GUID					app_instance_id;
+		/*
+		 * TODO: for durable/resilient/persistent handles we need more
+		 *       things here. See [MS-SMB2] 3.3.1.10 Per Open
+		 *
+		 * NOTE: this is still version 0, which is not a stable format!
+		 */
+		NTTIME					disconnect_time;
+		uint32					durable_timeout_msec;
+		boolean8				durable;
+		DATA_BLOB				backend_cookie;
+		uint16					channel_sequence;
+		hyper					channel_generation;
+		[flag(NDR_PAHEX)] uint8			lock_sequence_array[64];
+	} smbXsrv_open_global0;
+
+	typedef union {
+		[case(0)] smbXsrv_open_global0		*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_open_globalU;
+
+	typedef [public] struct {
+
+		smbXsrv_version_values			version;
+		uint32					seqnum;
+		[switch_is(version)] smbXsrv_open_globalU info;
+	} smbXsrv_open_globalB;
+
+	void smbXsrv_open_global_decode(
+		[in] smbXsrv_open_globalB blob
+		);
+
+	/*
+	 * The main server code should just work with
+	 * 'struct smbXsrv_open' and never use
+	 * smbXsrv_open0, smbXsrv_openU
+	 * and smbXsrv_openB directly.
+	 *
+	 * If we need to change the smbXsrv_open,
+	 * we can just rename smbXsrv_open
+	 * to smbXsrv_open0 and add a new
+	 * smbXsrv_open for version 1
+	 * and could implement transparent mapping.
+	 */
+	typedef struct {
+		[ignore] smbXsrv_open_table		*table;
+		uint32					local_id;
+		[ref] smbXsrv_open_global0		*global;
+		NTSTATUS				status;
+		NTTIME					idle_time;
+		[ignore] files_struct			*compat;
+		smbXsrv_open_flags			flags;
+		uint32					create_action;
+		hyper					request_count;
+		hyper					pre_request_count;
+	} smbXsrv_open;
+
+	typedef union {
+		[case(0)] smbXsrv_open			*info0;
+		[default] hyper				*dummy;
+	} smbXsrv_openU;
+
+	typedef [public] struct {
+		smbXsrv_version_values			version;
+		[value(0)] uint32			reserved;
+		[switch_is(version)] smbXsrv_openU	info;
+	} smbXsrv_openB;
+
+	void smbXsrv_open_decode(
+		[in] smbXsrv_openB blob
+		);
+
+	const uint32 SMBXSRV_OPEN_REPLAY_CACHE_FIXED_SIZE = 28;
+	typedef [public] struct {
+		GUID					holder_req_guid;
+		NTTIME					idle_time;
+		uint32					local_id;
+	} smbXsrv_open_replay_cache;
+}
diff --git a/source3/librpc/idl/wscript_build b/source3/librpc/idl/wscript_build
new file mode 100644
index 0000000..f46c498
--- /dev/null
+++ b/source3/librpc/idl/wscript_build
@@ -0,0 +1,41 @@
+#!/usr/bin/env python
+
+import os
+
+topinclude=os.path.join(bld.srcnode.abspath(), 'librpc/idl')
+
+bld.SAMBA_PIDL_LIST('PIDL',
+                    '''open_files.idl
+                       perfcount.idl secrets.idl
+                       smbXsrv.idl
+                       leases_db.idl
+                       rpcd_witness.idl
+                    ''',
+                    options='--includedir=%s --header --ndr-parser --client --python' % topinclude,
+                    output_dir='../gen_ndr')
+
+bld.SAMBA_PIDL_LIST('PIDL',
+                    '''
+                    libnetapi.idl
+                    rpc_host.idl
+                    ''',
+                    options='--includedir=%s --header --ndr-parser' % topinclude,
+                    output_dir='../gen_ndr',
+                    generate_tables=False)
+
+absinclude=os.path.join(bld.srcnode.abspath(), 'bin/default/include')
+
+bld.SAMBA_PIDL_LIST('PIDL',
+                    '''
+                       libnet_join.idl
+                    ''',
+                    options='--includedir=%s --includedir=%s --header --ndr-parser' % (topinclude, absinclude),
+                    output_dir='../gen_ndr',
+                    generate_tables=False)
+
+bld.SAMBA_PIDL_LIST('PIDL',
+                    '''
+                       ads.idl
+                    ''',
+                    options='--includedir=%s --includedir=%s --header --ndr-parser' % (topinclude, absinclude),
+                    output_dir='../gen_ndr')
diff --git a/source3/librpc/ndr/ndr_ads.c b/source3/librpc/ndr/ndr_ads.c
new file mode 100644
index 0000000..6b6e11a
--- /dev/null
+++ b/source3/librpc/ndr/ndr_ads.c
@@ -0,0 +1,32 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   routines for marshalling/unmarshalling ads structures
+
+   Copyright (C) Guenther Deschner 2020
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "librpc/gen_ndr/ndr_ads.h"
+
+enum ndr_err_code ndr_pull_ads_struct(struct ndr_pull *ndr, ndr_flags_type ndr_flags, struct ads_struct *r)
+{
+	return NDR_ERR_SUCCESS;
+}
+enum ndr_err_code ndr_push_ads_struct(struct ndr_push *ndr, ndr_flags_type ndr_flags, const struct ads_struct *r)
+{
+	return NDR_ERR_SUCCESS;
+}
diff --git a/source3/librpc/rpc/dcerpc.h b/source3/librpc/rpc/dcerpc.h
new file mode 100644
index 0000000..4b76c5c
--- /dev/null
+++ b/source3/librpc/rpc/dcerpc.h
@@ -0,0 +1,80 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   DCERPC client side interface structures
+
+   Copyright (C) 2008 Jelmer Vernooij
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/* This is a public header file that is installed as part of Samba. 
+ * If you remove any functions or change their signature, update 
+ * the so version number. */
+
+#ifndef _S3_DCERPC_H__
+#define _S3_DCERPC_H__
+
+#include "librpc/gen_ndr/dcerpc.h"
+#include "../librpc/ndr/libndr.h"
+#include "../librpc/rpc/rpc_common.h"
+
+struct NL_AUTH_MESSAGE;
+struct gensec_security;
+
+/* auth state for all bind types. */
+
+struct pipe_auth_data {
+	enum dcerpc_AuthType auth_type;
+	enum dcerpc_AuthLevel auth_level;
+	uint32_t auth_context_id;
+	bool client_hdr_signing;
+	bool hdr_signing;
+	bool verified_bitmask1;
+
+	struct gensec_security *auth_ctx;
+
+	/* Only the client code uses this for now */
+	DATA_BLOB transport_session_key;
+};
+
+/* The following definitions come from librpc/rpc/dcerpc_helpers.c  */
+NTSTATUS dcerpc_push_ncacn_packet(TALLOC_CTX *mem_ctx,
+				  enum dcerpc_pkt_type ptype,
+				  uint8_t pfc_flags,
+				  uint16_t auth_length,
+				  uint32_t call_id,
+				  union dcerpc_payload *u,
+				  DATA_BLOB *blob);
+NTSTATUS dcerpc_push_dcerpc_auth(TALLOC_CTX *mem_ctx,
+				 enum dcerpc_AuthType auth_type,
+				 enum dcerpc_AuthLevel auth_level,
+				 uint8_t auth_pad_length,
+				 uint32_t auth_context_id,
+				 const DATA_BLOB *credentials,
+				 DATA_BLOB *blob);
+NTSTATUS dcerpc_guess_sizes(struct pipe_auth_data *auth,
+			    size_t header_len, size_t data_left,
+			    size_t max_xmit_frag,
+			    size_t *data_to_send, size_t *frag_len,
+			    size_t *auth_len, size_t *pad_len);
+NTSTATUS dcerpc_add_auth_footer(struct pipe_auth_data *auth,
+				size_t pad_len, DATA_BLOB *rpc_out);
+NTSTATUS dcerpc_check_auth(struct pipe_auth_data *auth,
+			   struct ncacn_packet *pkt,
+			   DATA_BLOB *pkt_trailer,
+			   uint8_t header_size,
+			   DATA_BLOB *raw_pkt);
+
+#endif /* __S3_DCERPC_H__ */
diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c
new file mode 100644
index 0000000..2b99eb7
--- /dev/null
+++ b/source3/librpc/rpc/dcerpc_helpers.c
@@ -0,0 +1,520 @@
+/*
+ *  DCERPC Helper routines
+ *  Günther Deschner <gd@samba.org> 2010.
+ *  Simo Sorce <idra@samba.org> 2010.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#include "includes.h"
+#include "librpc/rpc/dcerpc.h"
+#include "librpc/rpc/dcerpc_util.h"
+#include "librpc/gen_ndr/ndr_dcerpc.h"
+#include "librpc/crypto/gse.h"
+#include "auth/gensec/gensec.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_PARSE
+
+/**
+* @brief NDR Encodes a ncacn_packet
+*
+* @param mem_ctx	The memory context the blob will be allocated on
+* @param ptype		The DCERPC packet type
+* @param pfc_flags	The DCERPC PFC Flags
+* @param auth_length	The length of the trailing auth blob
+* @param call_id	The call ID
+* @param u		The payload of the packet
+* @param blob [out]	The encoded blob if successful
+*
+* @return an NTSTATUS error code
+*/
+NTSTATUS dcerpc_push_ncacn_packet(TALLOC_CTX *mem_ctx,
+				  enum dcerpc_pkt_type ptype,
+				  uint8_t pfc_flags,
+				  uint16_t auth_length,
+				  uint32_t call_id,
+				  union dcerpc_payload *u,
+				  DATA_BLOB *blob)
+{
+	struct ncacn_packet r;
+	enum ndr_err_code ndr_err;
+
+	r.rpc_vers		= 5;
+	r.rpc_vers_minor	= 0;
+	r.ptype			= ptype;
+	r.pfc_flags		= pfc_flags;
+	r.drep[0]		= DCERPC_DREP_LE;
+	r.drep[1]		= 0;
+	r.drep[2]		= 0;
+	r.drep[3]		= 0;
+	r.auth_length		= auth_length;
+	r.call_id		= call_id;
+	r.u			= *u;
+
+	ndr_err = ndr_push_struct_blob(blob, mem_ctx, &r,
+		(ndr_push_flags_fn_t)ndr_push_ncacn_packet);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+
+	dcerpc_set_frag_length(blob, blob->length);
+
+
+	if (DEBUGLEVEL >= 10) {
+		/* set frag len for print function */
+		r.frag_length = blob->length;
+		NDR_PRINT_DEBUG(ncacn_packet, &r);
+	}
+
+	return NT_STATUS_OK;
+}
+
+/**
+* @brief NDR Encodes a dcerpc_auth structure
+*
+* @param mem_ctx	  The memory context the blob will be allocated on
+* @param auth_type	  The DCERPC Authentication Type
+* @param auth_level	  The DCERPC Authentication Level
+* @param auth_pad_length  The padding added to the packet this blob will be
+*			   appended to.
+* @param auth_context_id  The context id
+* @param credentials	  The authentication credentials blob (signature)
+* @param blob [out]	  The encoded blob if successful
+*
+* @return a NTSTATUS error code
+*/
+NTSTATUS dcerpc_push_dcerpc_auth(TALLOC_CTX *mem_ctx,
+				 enum dcerpc_AuthType auth_type,
+				 enum dcerpc_AuthLevel auth_level,
+				 uint8_t auth_pad_length,
+				 uint32_t auth_context_id,
+				 const DATA_BLOB *credentials,
+				 DATA_BLOB *blob)
+{
+	struct dcerpc_auth r;
+	enum ndr_err_code ndr_err;
+
+	r.auth_type		= auth_type;
+	r.auth_level		= auth_level;
+	r.auth_pad_length	= auth_pad_length;
+	r.auth_reserved		= 0;
+	r.auth_context_id	= auth_context_id;
+	r.credentials		= *credentials;
+
+	ndr_err = ndr_push_struct_blob(blob, mem_ctx, &r,
+		(ndr_push_flags_fn_t)ndr_push_dcerpc_auth);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+
+	if (DEBUGLEVEL >= 10) {
+		NDR_PRINT_DEBUG(dcerpc_auth, &r);
+	}
+
+	return NT_STATUS_OK;
+}
+
+/**
+* @brief Calculate how much data we can in a packet, including calculating
+*	 auth token and pad lengths.
+*
+* @param auth		The pipe_auth_data structure for this pipe.
+* @param header_len	The length of the packet header
+* @param data_left	The data left in the send buffer
+* @param max_xmit_frag	The max fragment size.
+* @param data_to_send	[out] The max data we will send in the pdu
+* @param frag_len	[out] The total length of the fragment
+* @param auth_len	[out] The length of the auth trailer
+* @param pad_len	[out] The padding to be applied
+*
+* @return A NT Error status code.
+*/
+NTSTATUS dcerpc_guess_sizes(struct pipe_auth_data *auth,
+			    size_t header_len, size_t data_left,
+			    size_t max_xmit_frag,
+			    size_t *data_to_send, size_t *frag_len,
+			    size_t *auth_len, size_t *pad_len)
+{
+	size_t max_len;
+	size_t mod_len;
+	struct gensec_security *gensec_security;
+
+	/* no auth token cases first */
+	switch (auth->auth_level) {
+	case DCERPC_AUTH_LEVEL_NONE:
+	case DCERPC_AUTH_LEVEL_CONNECT:
+		max_len = max_xmit_frag - header_len;
+		*data_to_send = MIN(max_len, data_left);
+		*pad_len = 0;
+		*auth_len = 0;
+		*frag_len = header_len + *data_to_send;
+		return NT_STATUS_OK;
+
+	case DCERPC_AUTH_LEVEL_PRIVACY:
+		break;
+
+	case DCERPC_AUTH_LEVEL_INTEGRITY:
+		break;
+
+	case DCERPC_AUTH_LEVEL_PACKET:
+		break;
+
+	default:
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+
+	/* Sign/seal case, calculate auth and pad lengths */
+
+	max_len = max_xmit_frag - header_len - DCERPC_AUTH_TRAILER_LENGTH;
+
+	/* Treat the same for all authenticated rpc requests. */
+	switch (auth->auth_type) {
+	case DCERPC_AUTH_TYPE_SPNEGO:
+	case DCERPC_AUTH_TYPE_NTLMSSP:
+	case DCERPC_AUTH_TYPE_KRB5:
+	case DCERPC_AUTH_TYPE_SCHANNEL:
+		gensec_security = auth->auth_ctx;
+		mod_len = (max_len % DCERPC_AUTH_PAD_ALIGNMENT);
+		*auth_len = gensec_sig_size(gensec_security, max_len - mod_len);
+		if (*auth_len == 0) {
+			return NT_STATUS_INTERNAL_ERROR;
+		}
+		break;
+	default:
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	max_len -= *auth_len;
+	mod_len = (max_len % DCERPC_AUTH_PAD_ALIGNMENT);
+	max_len -= mod_len;
+
+	*data_to_send = MIN(max_len, data_left);
+
+	*pad_len = DCERPC_AUTH_PAD_LENGTH(*data_to_send);
+
+	*frag_len = header_len + *data_to_send + *pad_len
+			+ DCERPC_AUTH_TRAILER_LENGTH + *auth_len;
+
+	return NT_STATUS_OK;
+}
+
+/*******************************************************************
+ Create and add the NTLMSSP sign/seal auth data.
+ ********************************************************************/
+
+static NTSTATUS add_generic_auth_footer(struct gensec_security *gensec_security,
+					enum dcerpc_AuthLevel auth_level,
+					DATA_BLOB *rpc_out)
+{
+	uint16_t data_and_pad_len = rpc_out->length
+					- DCERPC_RESPONSE_LENGTH
+					- DCERPC_AUTH_TRAILER_LENGTH;
+	DATA_BLOB auth_blob;
+	NTSTATUS status;
+
+	if (!gensec_security) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	switch (auth_level) {
+	case DCERPC_AUTH_LEVEL_PRIVACY:
+		/* Data portion is encrypted. */
+		status = gensec_seal_packet(gensec_security,
+					    rpc_out->data,
+					    rpc_out->data
+					    + DCERPC_RESPONSE_LENGTH,
+					    data_and_pad_len,
+					    rpc_out->data,
+					    rpc_out->length,
+					    &auth_blob);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+		break;
+
+	case DCERPC_AUTH_LEVEL_INTEGRITY:
+	case DCERPC_AUTH_LEVEL_PACKET:
+		/* Data is signed. */
+		status = gensec_sign_packet(gensec_security,
+					    rpc_out->data,
+					    rpc_out->data
+					    + DCERPC_RESPONSE_LENGTH,
+					    data_and_pad_len,
+					    rpc_out->data,
+					    rpc_out->length,
+					    &auth_blob);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+		break;
+
+	default:
+		/* Can't happen. */
+		smb_panic("bad auth level");
+		/* Notreached. */
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	/* Finally attach the blob. */
+	if (!data_blob_append(NULL, rpc_out,
+				auth_blob.data, auth_blob.length)) {
+		DEBUG(0, ("Failed to add %u bytes auth blob.\n",
+			  (unsigned int)auth_blob.length));
+		return NT_STATUS_NO_MEMORY;
+	}
+	data_blob_free(&auth_blob);
+
+	return NT_STATUS_OK;
+}
+
+/*******************************************************************
+ Check/unseal the NTLMSSP auth data. (Unseal in place).
+ ********************************************************************/
+
+static NTSTATUS get_generic_auth_footer(struct gensec_security *gensec_security,
+					enum dcerpc_AuthLevel auth_level,
+					DATA_BLOB *data, DATA_BLOB *full_pkt,
+					DATA_BLOB *auth_token)
+{
+	if (gensec_security == NULL) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	switch (auth_level) {
+	case DCERPC_AUTH_LEVEL_PRIVACY:
+		/* Data portion is encrypted. */
+		return gensec_unseal_packet(gensec_security,
+					    data->data,
+					    data->length,
+					    full_pkt->data,
+					    full_pkt->length,
+					    auth_token);
+
+	case DCERPC_AUTH_LEVEL_INTEGRITY:
+	case DCERPC_AUTH_LEVEL_PACKET:
+		/* Data is signed. */
+		return gensec_check_packet(gensec_security,
+					   data->data,
+					   data->length,
+					   full_pkt->data,
+					   full_pkt->length,
+					   auth_token);
+
+	default:
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+}
+
+/**
+* @brief   Append an auth footer according to what is the current mechanism
+*
+* @param auth		The pipe_auth_data associated with the connection
+* @param pad_len	The padding used in the packet
+* @param rpc_out	Packet blob up to and including the auth header
+*
+* @return A NTSTATUS error code.
+*/
+NTSTATUS dcerpc_add_auth_footer(struct pipe_auth_data *auth,
+				size_t pad_len, DATA_BLOB *rpc_out)
+{
+	struct gensec_security *gensec_security;
+	const char pad[DCERPC_AUTH_PAD_ALIGNMENT] = { 0, };
+	DATA_BLOB auth_info;
+	DATA_BLOB auth_blob;
+	NTSTATUS status;
+
+	if (auth->auth_type == DCERPC_AUTH_TYPE_NONE) {
+		return NT_STATUS_OK;
+	}
+
+	if (pad_len) {
+		SMB_ASSERT(pad_len <= ARRAY_SIZE(pad));
+
+		/* Copy the sign/seal padding data. */
+		if (!data_blob_append(NULL, rpc_out, pad, pad_len)) {
+			return NT_STATUS_NO_MEMORY;
+		}
+	}
+
+	/* marshall the dcerpc_auth with an actually empty auth_blob.
+	 * This is needed because the ntmlssp signature includes the
+	 * auth header. We will append the actual blob later. */
+	auth_blob = data_blob_null;
+	status = dcerpc_push_dcerpc_auth(rpc_out->data,
+					 auth->auth_type,
+					 auth->auth_level,
+					 pad_len,
+					 auth->auth_context_id,
+					 &auth_blob,
+					 &auth_info);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	/* append the header */
+	if (!data_blob_append(NULL, rpc_out,
+				auth_info.data, auth_info.length)) {
+		DEBUG(0, ("Failed to add %u bytes auth blob.\n",
+			  (unsigned int)auth_info.length));
+		return NT_STATUS_NO_MEMORY;
+	}
+	data_blob_free(&auth_info);
+
+	/* Generate any auth sign/seal and add the auth footer. */
+	switch (auth->auth_type) {
+	case DCERPC_AUTH_TYPE_NONE:
+		status = NT_STATUS_OK;
+		break;
+	default:
+		gensec_security = auth->auth_ctx;
+		status = add_generic_auth_footer(gensec_security,
+						 auth->auth_level,
+						 rpc_out);
+		break;
+	}
+
+	return status;
+}
+
+/**
+* @brief Check authentication for request/response packets
+*
+* @param auth		The auth data for the connection
+* @param pkt		The actual ncacn_packet
+* @param pkt_trailer [in][out]	The stub_and_verifier part of the packet,
+* 			the auth_trailer and padding will be removed.
+* @param header_size	The header size
+* @param raw_pkt	The whole raw packet data blob
+*
+* @return A NTSTATUS error code
+*/
+NTSTATUS dcerpc_check_auth(struct pipe_auth_data *auth,
+			   struct ncacn_packet *pkt,
+			   DATA_BLOB *pkt_trailer,
+			   uint8_t header_size,
+			   DATA_BLOB *raw_pkt)
+{
+	struct gensec_security *gensec_security;
+	NTSTATUS status;
+	struct dcerpc_auth auth_info;
+	uint32_t auth_length;
+	DATA_BLOB full_pkt;
+	DATA_BLOB data;
+
+	/*
+	 * These check should be done in the caller.
+	 */
+	SMB_ASSERT(raw_pkt->length == pkt->frag_length);
+	SMB_ASSERT(header_size <= pkt->frag_length);
+	SMB_ASSERT(pkt_trailer->length < pkt->frag_length);
+	SMB_ASSERT((pkt_trailer->length + header_size) <= pkt->frag_length);
+
+	switch (auth->auth_level) {
+	case DCERPC_AUTH_LEVEL_PRIVACY:
+		DEBUG(10, ("Requested Privacy.\n"));
+		break;
+
+	case DCERPC_AUTH_LEVEL_INTEGRITY:
+		DEBUG(10, ("Requested Integrity.\n"));
+		break;
+
+	case DCERPC_AUTH_LEVEL_PACKET:
+		DEBUG(10, ("Requested packet.\n"));
+		break;
+
+	case DCERPC_AUTH_LEVEL_CONNECT:
+		if (pkt->auth_length != 0) {
+			break;
+		}
+		return NT_STATUS_OK;
+
+	case DCERPC_AUTH_LEVEL_NONE:
+		if (pkt->auth_length != 0) {
+			DEBUG(3, ("Got non-zero auth len on non "
+				  "authenticated connection!\n"));
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+		return NT_STATUS_OK;
+
+	default:
+		DEBUG(3, ("Unimplemented Auth Level %d\n",
+			  auth->auth_level));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (pkt->auth_length == 0) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	status = dcerpc_pull_auth_trailer(pkt, pkt, pkt_trailer,
+					  &auth_info, &auth_length, false);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	if (auth_info.auth_type != auth->auth_type) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (auth_info.auth_level != auth->auth_level) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (auth_info.auth_context_id != auth->auth_context_id) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	pkt_trailer->length -= auth_length;
+	data = data_blob_const(raw_pkt->data + header_size,
+			       pkt_trailer->length);
+	full_pkt = data_blob_const(raw_pkt->data, raw_pkt->length);
+	full_pkt.length -= auth_info.credentials.length;
+
+	switch (auth->auth_type) {
+	case DCERPC_AUTH_TYPE_NONE:
+		return NT_STATUS_OK;
+
+	default:
+		DEBUG(10, ("GENSEC auth\n"));
+
+		gensec_security = auth->auth_ctx;
+		status = get_generic_auth_footer(gensec_security,
+						 auth->auth_level,
+						 &data, &full_pkt,
+						 &auth_info.credentials);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+		break;
+	}
+
+	/* TODO: remove later
+	 * this is still needed because in the server code the
+	 * pkt_trailer actually has a copy of the raw data, and they
+	 * are still both used in later calls */
+	if (auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
+		if (pkt_trailer->length != data.length) {
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+		memcpy(pkt_trailer->data, data.data, data.length);
+	}
+
+	pkt_trailer->length -= auth_info.auth_pad_length;
+	data_blob_free(&auth_info.credentials);
+	return NT_STATUS_OK;
+}
+
diff --git a/source3/librpc/wscript_build b/source3/librpc/wscript_build
new file mode 100644
index 0000000..d228db7
--- /dev/null
+++ b/source3/librpc/wscript_build
@@ -0,0 +1,53 @@
+#!/usr/bin/env python
+
+bld.SAMBA3_SUBSYSTEM('NDR_LIBNETAPI',
+        cflags="-D SKIP_NDR_TABLE_libnetapi",
+	source='gen_ndr/ndr_libnetapi.c',
+	public_deps='ndr',
+	allow_warnings=True
+	)
+
+bld.SAMBA3_SUBSYSTEM('NDR_LIBNET_JOIN',
+	source='gen_ndr/ndr_libnet_join.c',
+	public_deps='ndr krb5samba NDR_ODJ NDR_ADS'
+	)
+
+bld.SAMBA3_SUBSYSTEM("NDR_RPC_HOST",
+                     source='gen_ndr/ndr_rpc_host.c',
+                     public_deps='ndr')
+
+bld.SAMBA3_SUBSYSTEM('NDR_OPEN_FILES',
+	source='gen_ndr/ndr_open_files.c',
+	public_deps='ndr NDR_SERVER_ID NDR_FILE_ID NDR_SECURITY NDR_SMB2_LEASE_STRUCT'
+	)
+
+bld.SAMBA3_SUBSYSTEM('NDR_SMBXSRV',
+	source='gen_ndr/ndr_smbXsrv.c',
+	public_deps='ndr NDR_SERVER_ID NDR_SECURITY NDR_AUTH'
+	)
+
+bld.SAMBA3_SUBSYSTEM('NDR_LEASES_DB',
+	source='gen_ndr/ndr_leases_db.c',
+	public_deps='ndr NDR_SMB2_LEASE_STRUCT NDR_FILE_ID'
+	)
+
+bld.SAMBA3_SUBSYSTEM('NDR_RPCD_WITNESS',
+	source='gen_ndr/ndr_rpcd_witness.c',
+	public_deps='ndr NDR_SERVER_ID NDR_SECURITY NDR_WITNESS'
+	)
+
+bld.SAMBA3_SUBSYSTEM('NDR_SECRETS',
+	source='gen_ndr/ndr_secrets.c',
+	public_deps='ndr NDR_SAMR NDR_LSA NDR_NETLOGON NDR_SECURITY'
+	)
+
+bld.SAMBA3_SUBSYSTEM('NDR_PERFCOUNT',
+	source='gen_ndr/ndr_perfcount.c',
+	public_deps='ndr'
+	)
+
+bld.SAMBA3_SUBSYSTEM('NDR_ADS',
+	source='gen_ndr/ndr_ads.c ndr/ndr_ads.c',
+	public_deps='ndr NDR_NBT'
+	)
+