r17094: merge fixes for 3.0.23a

20 files changed, 776 insertions, 937 deletions

diff --git a/packaging/Debian/debian-sarge/changelog b/packaging/Debian/debian-sarge/changelog
index 9164a73ba4d..bd66900a7f2 100644
--- a/packaging/Debian/debian-sarge/changelog
+++ b/packaging/Debian/debian-sarge/changelog
@@ -1,3 +1,15 @@
+samba (3.0.23-1) stable; urgency=low
+
+  * samba 3.0.23 Samba Team Release
+
+ -- Simo Sorce <idra@samba.org>  Sat, 15 Jul 2006 10:01:30 -0400
+
+samba (3.0.22-1) stable; urgency=high
+
+  * samba 3.0.22 Samba Team Release
+
+ -- Simo Sorce <idra@samba.org>  Fri, 07 Apr 2006 15:45:30 -0400
+
 samba (3.0.21b-1) stable; urgency=high
 
   * samba 3.0.21b Samba Team Release
diff --git a/packaging/Debian/debian-sarge/patches/fhs.patch b/packaging/Debian/debian-sarge/patches/fhs.patch
index 957ce7fae9d..e152ec873e9 100644
--- a/packaging/Debian/debian-sarge/patches/fhs.patch
+++ b/packaging/Debian/debian-sarge/patches/fhs.patch
@@ -28,11 +28,11 @@ diff -uNr samba-3.0.10.orig/source/Makefile.in samba-3.0.10/source/Makefile.in
  	@$(SHELL) $(srcdir)/script/installscripts.sh $(INSTALLPERMS) $(DESTDIR)$(BINDIR) $(SCRIPTS)
  
  installdat: installdirs
--	@$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR)$(LIBDIR) $(srcdir)
-+	@$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR)$(CODEPAGEDIR) $(srcdir)
+-	@$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR) $(LIBDIR) $(srcdir)
++	@$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR) $(CODEPAGEDIR) $(srcdir)
  
  installmsg: installdirs
- 	@$(SHELL) $(srcdir)/script/installmsg.sh $(DESTDIR)$(LIBDIR) $(srcdir)
+ 	@$(SHELL) $(srcdir)/script/installmsg.sh $(DESTDIR) $(LIBDIR) $(srcdir)
 diff -uNr samba-3.0.10.orig/source/configure.in samba-3.0.10/source/configure.in
 --- samba-3.0.10.orig/source/configure.in	2004-12-17 03:50:08.000000000 -0800
 +++ samba-3.0.10/source/configure.in	2004-12-17 03:55:29.000000000 -0800
@@ -57,9 +57,9 @@ diff -uNr samba-3.0.10.orig/source/configure.in samba-3.0.10/source/configure.in
    esac])
  
 @@ -201,6 +205,9 @@
- AC_SUBST(swatdir)
- AC_SUBST(bindir)
  AC_SUBST(sbindir)
+ AC_SUBST(rootsbindir)
+ AC_SUBST(pammodulesdir)
 +AC_SUBST(codepagedir)
 +AC_SUBST(statedir)
 +AC_SUBST(cachedir)
@@ -85,8 +85,8 @@ diff -uNr samba-3.0.10.orig/source/dynconfig.c samba-3.0.10/source/dynconfig.c
   * @sa lib_path() to get the path to a file inside the LIBDIR.
 @@ -70,3 +77,27 @@
  
- const pstring dyn_SMB_PASSWD_FILE = SMB_PASSWD_FILE;
- const pstring dyn_PRIVATE_DIR = PRIVATE_DIR;
+ pstring dyn_SMB_PASSWD_FILE = SMB_PASSWD_FILE;
+ pstring dyn_PRIVATE_DIR = PRIVATE_DIR;
 +
 +
 +/* In non-FHS mode, these should be configurable using 'lock dir =';
@@ -114,10 +114,11 @@ diff -uNr samba-3.0.10.orig/source/dynconfig.c samba-3.0.10/source/dynconfig.c
 diff -uNr samba-3.0.10.orig/source/groupdb/mapping.c samba-3.0.10/source/groupdb/mapping.c
 --- samba-3.0.10.orig/source/groupdb/mapping.c	2004-12-17 03:50:08.000000000 -0800
 +++ samba-3.0.10/source/groupdb/mapping.c	2004-12-17 03:55:29.000000000 -0800
-@@ -140,7 +140,7 @@
+@@ -140,8 +140,8 @@
  	
  	if (tdb)
  		return True;
+ 		
 -	tdb = tdb_open_log(lock_path("group_mapping.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
 +	tdb = tdb_open_log(state_path("group_mapping.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
  	if (!tdb) {
@@ -131,11 +132,11 @@ diff -uNr samba-3.0.10.orig/source/include/dynconfig.h samba-3.0.10/source/inclu
  extern pstring dyn_LOGFILEBASE, dyn_LMHOSTSFILE;
  extern pstring dyn_LIBDIR;
 +extern pstring dyn_CODEPAGEDIR;
- extern const fstring dyn_SHLIBEXT;
- extern const pstring dyn_LOCKDIR; 
- extern const pstring dyn_PIDDIR;
- extern const pstring dyn_SMB_PASSWD_FILE;
- extern const pstring dyn_PRIVATE_DIR;
+ extern fstring dyn_SHLIBEXT;
+ extern pstring dyn_LOCKDIR;
+ extern pstring dyn_PIDDIR;
+ extern pstring dyn_SMB_PASSWD_FILE;
+ extern pstring dyn_PRIVATE_DIR;
 +
 +char *dyn_STATEDIR(void);
 +char *dyn_CACHEDIR(void);
@@ -231,17 +232,20 @@ diff -uNr samba-3.0.10.orig/source/lib/util.c samba-3.0.10/source/lib/util.c
 diff -uNr samba-3.0.10.orig/source/lib/util_unistr.c samba-3.0.10/source/lib/util_unistr.c
 --- samba-3.0.10.orig/source/lib/util_unistr.c	2004-12-17 03:50:08.000000000 -0800
 +++ samba-3.0.10/source/lib/util_unistr.c	2004-12-17 03:55:29.000000000 -0800
-@@ -54,8 +54,8 @@
- 	if (initialised) return;
+@@ -54,11 +54,11 @@
+ 	}
  	initialised = 1;
  
 -	upcase_table = map_file(lib_path("upcase.dat"), 0x20000);
--	lowcase_table = map_file(lib_path("lowcase.dat"), 0x20000);
 +	upcase_table = map_file(data_path("upcase.dat"), 0x20000);
+ 	upcase_table_use_unmap = ( upcase_table != NULL );
+ 
+-	lowcase_table = map_file(lib_path("lowcase.dat"), 0x20000);
 +	lowcase_table = map_file(data_path("lowcase.dat"), 0x20000);
+ 	lowcase_table_use_unmap = ( lowcase_table != NULL );
  
- 	/* we would like Samba to limp along even if these tables are
- 	   not available */
+ #ifdef HAVE_SETLOCALE
+ 	/* Get the name of the current locale.  */
 @@ -161,7 +161,7 @@
  		return;
  	}
@@ -305,18 +309,18 @@ diff -uNr samba-3.0.10.orig/source/nmbd/nmbd_winsserver.c samba-3.0.10/source/nm
  	all_string_sub(fname,"//", "/", 0);
  	slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid());
  
-diff -uNr samba-3.0.10.orig/source/nsswitch/winbindd_cache.c samba-3.0.10/source/nsswitch/winbindd_cache.c
---- samba-3.0.10.orig/source/nsswitch/winbindd_cache.c	2004-12-17 03:50:09.000000000 -0800
-+++ samba-3.0.10/source/nsswitch/winbindd_cache.c	2004-12-17 03:55:30.000000000 -0800
+diff -uNr samba-3.0.23.orig/source/nsswitch/winbindd_cache.c samba-3.0.23/source/nsswitch/winbindd_cache.c
+--- samba-3.0.23.orig/source/nsswitch/winbindd_cache.c	2006-07-15 09:50:09.000000000 -0400
++++ samba-3.0.23/source/nsswitch/winbindd_cache.c	2006-07-15 09:55:30.000000000 -0400
 @@ -57,7 +57,7 @@
- 	if (opt_nocache)
- 		return;
+ 		return True;
  
--	wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), 5000, 
-+	wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"), 5000, 
- 				   TDB_CLEAR_IF_FIRST, O_RDWR|O_CREAT, 0600);
+ 	/* when working offline we must not clear the cache on restart */
+-	wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"),
++	wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
+ 				WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE, 
+ 				TDB_DEFAULT /*TDB_CLEAR_IF_FIRST*/, O_RDWR|O_CREAT, 0600);
  
- 	if (!wcache->tdb) {
 diff -uNr samba-3.0.10.orig/source/nsswitch/winbindd_util.c samba-3.0.10/source/nsswitch/winbindd_util.c
 --- samba-3.0.10.orig/source/nsswitch/winbindd_util.c	2004-12-17 03:50:09.000000000 -0800
 +++ samba-3.0.10/source/nsswitch/winbindd_util.c	2004-12-17 03:55:30.000000000 -0800
@@ -356,21 +360,18 @@ diff -uNr samba-3.0.10.orig/source/param/loadparm.c samba-3.0.10/source/param/lo
  	{"pid directory", P_STRING, P_GLOBAL, &Globals.szPidDir, NULL, NULL, FLAG_ADVANCED}, 
  #ifdef WITH_UTMP
  	{"utmp directory", P_STRING, P_GLOBAL, &Globals.szUtmpDir, NULL, NULL, FLAG_ADVANCED}, 
-diff -uNr samba-3.0.10.orig/source/passdb/pdb_tdb.c samba-3.0.10/source/passdb/pdb_tdb.c
---- samba-3.0.10.orig/source/passdb/pdb_tdb.c	2004-12-17 03:50:09.000000000 -0800
-+++ samba-3.0.10/source/passdb/pdb_tdb.c	2004-12-17 03:55:30.000000000 -0800
-@@ -734,10 +734,7 @@
- 	if (location) {
- 		tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, location);
- 	} else {
--		pstring tdbfile;
--		get_private_directory(tdbfile);
--		pstrcat(tdbfile, "/");
--		pstrcat(tdbfile, PASSDB_FILE_NAME);
-+		char *tdbfile = state_path(PASSDB_FILE_NAME);
- 		tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, tdbfile);
+diff -uNr samba-3.0.23.orig/source/passdb/pdb_tdb.c samba-3.0.23/source/passdb/pdb_tdb.c
+--- samba-3.0.23.orig/source/passdb/pdb_tdb.c	2006-07-15 09:50:09.000000000 -0400
++++ samba-3.0.23/source/passdb/pdb_tdb.c	2006-07-15 09:55:30.000000000 -0400
+@@ -1598,7 +1598,7 @@
+ 	/* save the path for later */
+ 			   
+ 	if ( !location ) {
+-		pstr_sprintf( tdbfile, "%s/%s", lp_private_dir(), PASSDB_FILE_NAME );
++		pstr_sprintf( tdbfile, "%s", state_path(PASSDB_FILE_NAME) );
+ 		pfile = tdbfile;
  	}
- 
+ 	pstrcpy( tdbsam_filename, pfile );
 diff -uNr samba-3.0.10.orig/source/passdb/secrets.c samba-3.0.10/source/passdb/secrets.c
 --- samba-3.0.10.orig/source/passdb/secrets.c	2004-12-17 03:50:09.000000000 -0800
 +++ samba-3.0.10/source/passdb/secrets.c	2004-12-17 03:55:30.000000000 -0800
@@ -481,13 +482,13 @@ diff -uNr samba-3.0.21.orig/source/registry/reg_db.c samba-3.0.21/source/registr
  	}
  
  	unbecome_root();
-diff -uNr samba-3.0.10.orig/source/rpc_server/srv_srvsvc_nt.c samba-3.0.10/source/rpc_server/srv_srvsvc_nt.c
---- samba-3.0.10.orig/source/rpc_server/srv_srvsvc_nt.c	2004-12-17 03:50:09.000000000 -0800
-+++ samba-3.0.10/source/rpc_server/srv_srvsvc_nt.c	2004-12-17 03:55:31.000000000 -0800
-@@ -133,10 +133,10 @@
-  
- 	if (share_tdb && local_pid == sys_getpid())
+diff -uNr samba-3.0.23.orig/source/lib/sharesec.c samba-3.0.23/source/lib/sharesec.c
+--- samba-3.0.23.orig/source/lib/sharesec.c	2006-07-15 09:50:09.000000000 -0400
++++ samba-3.0.23/source/lib/sharesec.c	2006-07-15 09:55:31.000000000 -0400
+@@ -47,10 +47,10 @@
  		return True;
+ 	}
+ 
 -	share_tdb = tdb_open_log(lock_path("share_info.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
 +	share_tdb = tdb_open_log(state_path("share_info.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
  	if (!share_tdb) {
@@ -509,21 +510,21 @@ diff -uNr samba-3.0.10.orig/source/sam/idmap_tdb.c samba-3.0.10/source/sam/idmap
  	if (!tdbfile) {
  		DEBUG(0, ("idmap_init: out of memory!\n"));
  		return NT_STATUS_NO_MEMORY;
-diff -uNr samba-3.0.10.orig/source/smbd/lanman.c samba-3.0.10/source/smbd/lanman.c
---- samba-3.0.10.orig/source/smbd/lanman.c	2004-12-17 03:50:10.000000000 -0800
-+++ samba-3.0.10/source/smbd/lanman.c	2004-12-17 03:55:31.000000000 -0800
-@@ -969,9 +969,9 @@
-   BOOL local_list_only;
-   int i;
- 
--  lines = file_lines_load(lock_path(SERVER_LIST), NULL);
-+  lines = file_lines_load(cache_path(SERVER_LIST), NULL);
-   if (!lines) {
--    DEBUG(4,("Can't open %s - %s\n",lock_path(SERVER_LIST),strerror(errno)));
-+    DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
-     return(0);
-   }
- 
+diff -uNr samba-3.0.23.orig/source/smbd/lanman.c samba-3.0.23/source/smbd/lanman.c
+--- samba-3.0.23.orig/source/smbd/lanman.c	2006-07-15 09:50:10.000000000 -0400
++++ samba-3.0.23/source/smbd/lanman.c	2006-07-15 09:55:31.000000000 -0400
+@@ -1052,9 +1052,9 @@
+ 	BOOL local_list_only;
+ 	int i;
+ 
+-	lines = file_lines_load(lock_path(SERVER_LIST), NULL, 0);
++	lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0);
+ 	if (!lines) {
+-		DEBUG(4,("Can't open %s - %s\n",lock_path(SERVER_LIST),strerror(errno)));
++		DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
+ 		return 0;
+ 	}
+
 diff -uNr samba-3.0.10.orig/source/utils/net_idmap.c samba-3.0.10/source/utils/net_idmap.c
 --- samba-3.0.10.orig/source/utils/net_idmap.c	2004-12-17 03:50:10.000000000 -0800
 +++ samba-3.0.10/source/utils/net_idmap.c	2004-12-17 03:55:32.000000000 -0800
@@ -536,27 +537,6 @@ diff -uNr samba-3.0.10.orig/source/utils/net_idmap.c samba-3.0.10/source/utils/n
  	if (!tdbfile) {
  		DEBUG(0, ("idmap_init: out of memory!\n"));
  		return NT_STATUS_NO_MEMORY;
-diff -uNr samba-3.0.10.orig/source/wrepld/process.c samba-3.0.10/source/wrepld/process.c
---- samba-3.0.10.orig/source/wrepld/process.c	2004-12-17 03:50:10.000000000 -0800
-+++ samba-3.0.10/source/wrepld/process.c	2004-12-17 03:55:32.000000000 -0800
-@@ -197,7 +197,7 @@
- {
- 	TDB_CONTEXT *tdb;
- 
--	tdb = tdb_open_log(lock_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600);
-+	tdb = tdb_open_log(state_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600);
- 	if (!tdb) {
- 		DEBUG(2,("get_our_last_id: Can't open wins database file %s. Error was %s\n", WINS_LIST, strerror(errno) ));
- 		return;
-@@ -489,7 +489,7 @@
- 		}
- 
- 
--	tdb = tdb_open_log(lock_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600);
-+	tdb = tdb_open_log(state_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600);
- 	if (!tdb) {
- 		DEBUG(2,("send_entry_request: Can't open wins database file %s. Error was %s\n", WINS_LIST, strerror(errno) ));
- 		return;
 diff -uNr samba-3.0.11.orig/source/printing/nt_printing.c samba-3.0.11/source/printing/nt_printing.c
 --- samba-3.0.11.orig/source/printing/nt_printing.c	2005-03-23 02:51:08.000000000 -0800
 +++ samba-3.0.11/source/printing/nt_printing.c	2005-03-23 02:54:33.000000000 -0800
diff --git a/packaging/Debian/debian-sarge/patches/make-distclean.patch b/packaging/Debian/debian-sarge/patches/make-distclean.patch
index e8595752905..9c9eb6ca67a 100644
--- a/packaging/Debian/debian-sarge/patches/make-distclean.patch
+++ b/packaging/Debian/debian-sarge/patches/make-distclean.patch
@@ -9,14 +9,6 @@ diff -uNr samba-3.0.7.orig/source/Makefile.in samba-3.0.7/source/Makefile.in
  
  # revert to the previously installed version
  revert:
-@@ -1437,6 +1438,7 @@
- 	@rm -f include/proto.h include/build_env.h  include/wrepld_proto.h \
- 		nsswitch/winbindd_proto.h web/swat_proto.h \
- 		client/client_proto.h utils/net_proto.h \
-+	        utils/ntlm_auth_proto.h \
- 		smbd/build_options.c
- 
- MKPROTO_SH = $(srcdir)/script/mkproto.sh
 @@ -1512,6 +1514,7 @@
  
  distclean: realclean
diff --git a/packaging/Debian/debian-sarge/patches/samba.patch b/packaging/Debian/debian-sarge/patches/samba.patch
index f4c8ca8742c..8e77cfb86e5 100644
--- a/packaging/Debian/debian-sarge/patches/samba.patch
+++ b/packaging/Debian/debian-sarge/patches/samba.patch
@@ -39,17 +39,18 @@ diff -uNr samba-3.0.0beta1.orig/source/web/diagnose.c samba-3.0.0beta1/source/we
  	if (!cli_initialise(&cli))
  		return False;
  
---- samba-3.0.1/source/script/installbin.sh.orig	2003-10-10 14:08:36.000000000 -0400
-+++ samba-3.0.1/source/script/installbin.sh	2003-12-17 10:51:45.000000000 -0500
-@@ -24,12 +24,14 @@
-  chmod $INSTALLPERMS $BINDIR/$p2
+--- samba-3.0.23/source/script/installbin.sh.in.orig	2006-07-15 09:08:36.000000000 -0400
++++ samba-3.0.23/source/script/installbin.sh.in	2006-07-15 09:51:45.000000000 -0400
+@@ -21,13 +21,14 @@
+  chmod $INSTALLPERMS $DESTDIR/$BINDIR/$p2
  
   # this is a special case, mount needs this in a specific location
 - if [ $p2 = smbmount ]; then
--   if [ ! -d $DESTDIR/sbin ]; then
--      mkdir $DESTDIR/sbin
--   fi 
--   ln -sf $BINDIR/$p2 $DESTDIR/sbin/mount.smbfs
+-   if [ ! -d $DESTDIR/@rootsbindir@ ]; then
+-      mkdir $DESTDIR/@rootsbindir@
+-   fi
+-   echo "Creating sym link $DESTDIR/@rootsbindir@/mount.smbfs to $BINDIR/$p2 "
+-   ln -sf $BINDIR/$p2 $DESTDIR/@rootsbindir@/mount.smbfs
 - fi
 +# Commented out for the Debian Samba package. We take care of this
 +# important symlink in debian/rules. (peloy@debian.org)
diff --git a/packaging/Debian/debian-sarge/rules b/packaging/Debian/debian-sarge/rules
index eb6e71c90e1..5a0f5e60b43 100755
--- a/packaging/Debian/debian-sarge/rules
+++ b/packaging/Debian/debian-sarge/rules
@@ -76,7 +76,8 @@ ifeq ($(DEB_HOST_GNU_SYSTEM),linux)
   conf_args += \
 		--with-smbmount \
 		--with-acl-support \
-		--with-quotas
+		--with-quotas \
+		--with-cifsmount
   mount_cifs	= yes
   smbfs		= yes
 else
@@ -120,9 +121,6 @@ build-stamp:
 
 	$(MAKE) -C source headers
 	$(MAKE) -C source all nsswitch/libnss_wins.so python_ext
-ifeq ($(mount_cifs),yes)
-	$(MAKE) -C source client/mount.cifs
-endif
 
 	touch build-stamp
 
@@ -138,7 +136,7 @@ clean: unpatch
 
 	# Delete stuff left after a build that is not deleted by 'make clean'
 	rm -f source/bin/wbinfo source/bin/winbindd source/bin/debug2html \
-		source/bin/libsmbclient.a source/client/mount.cifs \
+		source/bin/libsmbclient.a source/bin/mount.cifs \
 		source/include/stamp-h
 
 	sed -e "s/@libacl@/`type-handling any linux-gnu`/g" \
@@ -179,14 +177,11 @@ install: build
 	install -m 0755 debian/mksmbpasswd.awk $(DESTDIR)/usr/sbin/mksmbpasswd
 
 	# Install winbind stuff not installed by 'make install'
-	install -m 0644 source/nsswitch/libnss_winbind.so \
-		$(DESTDIR)/lib/libnss_winbind.so.2
-	install -m 0644 source/bin/pam_winbind.so \
-		$(DESTDIR)/lib/security/
+	install -m 0644 source/bin/pam_winbind.so $(DESTDIR)/lib/security/
+	install -m 0644 source/nsswitch/libnss_winbind.so $(DESTDIR)/lib/libnss_winbind.so.2
 
 	# Install libnss_wins.so, which is not installed by 'make install' either.
-	install -m 0644 source/nsswitch/libnss_wins.so \
-		$(DESTDIR)/lib/libnss_wins.so.2
+	install -m 0644 source/nsswitch/libnss_wins.so  $(DESTDIR)/lib/libnss_wins.so.2
 
 	# pam_smbpass.so isn't being installed by 'make install'.
 	#	We'll move it here to $(DESTDIR)/lib/security/ and then
@@ -208,7 +203,7 @@ endif
 
 ifeq ($(mount_cifs),yes)
 	# Install mount.cifs and its man page
-	install -m 04755 source/client/mount.cifs $(DESTDIR)/sbin/
+	install -m 04755 source/bin/mount.cifs $(DESTDIR)/sbin/
 	install -m 0644 docs/manpages/mount.cifs.8 $(DESTDIR)/usr/share/man/man8/
 endif
 
diff --git a/packaging/Debian/debian-sarge/samba-common.files b/packaging/Debian/debian-sarge/samba-common.files
index f5779fa8270..3cc7ed98612 100644
--- a/packaging/Debian/debian-sarge/samba-common.files
+++ b/packaging/Debian/debian-sarge/samba-common.files
@@ -5,8 +5,10 @@ usr/bin/net
 usr/bin/nmblookup
 usr/bin/smbpasswd
 usr/bin/testparm
+usr/bin/profiles
 usr/share/man/man1/nmblookup.1
 usr/share/man/man1/testparm.1
+usr/share/man/man1/profiles.1
 usr/share/man/man5/lmhosts.5
 usr/share/man/man5/smb.conf.5
 usr/share/man/man7/samba.7
diff --git a/source/VERSION b/source/VERSION
index ed624093d10..e7c64bf70f7 100644
--- a/source/VERSION
+++ b/source/VERSION
@@ -37,7 +37,7 @@ SAMBA_VERSION_RELEASE=23
 # e.g. SAMBA_VERSION_REVISION=a                        #
 #  ->  "2.2.8a"                                        #
 ########################################################
-SAMBA_VERSION_REVISION=
+SAMBA_VERSION_REVISION=a
 
 ########################################################
 # For 'pre' releases the version will be               #
@@ -69,7 +69,7 @@ SAMBA_VERSION_RC_RELEASE=
 # e.g. SAMBA_VERSION_IS_SVN_SNAPSHOT=yes               #
 #  ->  "3.0.0-SVN-build-199"                           #
 ########################################################
-SAMBA_VERSION_IS_SVN_SNAPSHOT=
+SAMBA_VERSION_IS_SVN_SNAPSHOT=yes
 
 ########################################################
 # This can be set by vendors if they want...           #
diff --git a/source/include/rpc_ds.h b/source/include/rpc_ds.h
index 24bf1e948a3..424e6c0494a 100644
--- a/source/include/rpc_ds.h
+++ b/source/include/rpc_ds.h
@@ -49,6 +49,13 @@
 #define DSROLE_BDC			4
 #define DSROLE_PDC			5
 
+/* Settings for the domainFunctionality attribteu in the rootDSE */
+
+#define DS_DOMAIN_FUNCTION_2000		0
+#define DS_DOMAIN_FUCNTION_2003_MIXED	1
+#define DS_DOMAIN_FUNCTION_2003		2
+
+
 
 typedef struct
 {
diff --git a/source/libads/cldap.c b/source/libads/cldap.c
index f67372805f3..2e96270e906 100644
--- a/source/libads/cldap.c
+++ b/source/libads/cldap.c
@@ -191,6 +191,11 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply)
 	char *p;
 
 	blob = data_blob(NULL, 8192);
+	if (blob.data == NULL) {
+		DEBUG(1, ("data_blob failed\n"));
+		errno = ENOMEM;
+		return -1;
+	}
 
 	/* Setup timeout */
 	gotalarm = 0;
@@ -206,6 +211,7 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply)
 
 	if (ret <= 0) {
 		DEBUG(1,("no reply received to cldap netlogon\n"));
+		data_blob_free(&blob);
 		return -1;
 	}
 	blob.length = ret;
@@ -227,6 +233,7 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply)
 	asn1_end_tag(&data);
 
 	if (data.has_error) {
+		data_blob_free(&blob);
 		asn1_free(&data);
 		DEBUG(1,("Failed to parse cldap reply\n"));
 		return -1;
diff --git a/source/libads/dns.c b/source/libads/dns.c
index d2e263a9d1b..321b4355277 100644
--- a/source/libads/dns.c
+++ b/source/libads/dns.c
@@ -39,8 +39,12 @@
 #define MAX_DNS_PACKET_SIZE 0xffff
 
 #ifdef NS_HFIXEDSZ	/* Bind 8/9 interface */
+#if !defined(C_IN)	/* AIX 5.3 already defines C_IN */
 #  define C_IN		ns_c_in
+#endif
+#if !defined(T_A)	/* AIX 5.3 already defines T_A */
 #  define T_A   	ns_t_a
+#endif
 #  define T_SRV 	ns_t_srv
 #else
 #  ifdef HFIXEDSZ
diff --git a/source/libads/kerberos.c b/source/libads/kerberos.c
index 90650e1dce0..af4ba868313 100644
--- a/source/libads/kerberos.c
+++ b/source/libads/kerberos.c
@@ -5,6 +5,7 @@
    Copyright (C) Remus Koos 2001
    Copyright (C) Nalin Dahyabhai <nalin@redhat.com> 2004.
    Copyright (C) Jeremy Allison 2004.
+   Copyright (C) Gerald Carter 2006.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -268,11 +269,85 @@ static char *kerberos_secrets_fetch_salting_principal(const char *service, int e
 }
 
 /************************************************************************
- Routine to get the salting principal for this service.  Active
- Directory may use a non-obvious principal name to generate the salt
- when it determines the key to use for encrypting tickets for a service,
- and hopefully we detected that when we joined the domain.
- Caller must free if return is not null.
+ Return the standard DES salt key
+************************************************************************/
+
+char* kerberos_standard_des_salt( void )
+{
+	fstring salt;
+
+	fstr_sprintf( salt, "host/%s.%s@", global_myname(), lp_realm() );
+	strlower_m( salt );
+	fstrcat( salt, lp_realm() );
+
+	return SMB_STRDUP( salt );
+}
+
+/************************************************************************
+************************************************************************/
+
+static char* des_salt_key( void )
+{
+	char *key;
+
+	asprintf(&key, "%s/DES/%s", SECRETS_SALTING_PRINCIPAL, lp_realm());
+
+	return key;
+}
+
+/************************************************************************
+************************************************************************/
+
+BOOL kerberos_secrets_store_des_salt( const char* salt )
+{
+	char* key;
+	BOOL ret;
+
+	if ( (key = des_salt_key()) == NULL ) {
+		DEBUG(0,("kerberos_secrets_store_des_salt: failed to generate key!\n"));
+		return False;
+	}
+
+	if ( !salt ) {
+		DEBUG(8,("kerberos_secrets_store_des_salt: deleting salt\n"));
+		secrets_delete( key );
+		return True;
+	}
+
+	DEBUG(3,("kerberos_secrets_store_des_salt: Storing salt \"%s\"\n", salt));
+
+	ret = secrets_store( key, salt, strlen(salt)+1 );
+
+	SAFE_FREE( key );
+
+	return ret;
+}
+
+/************************************************************************
+************************************************************************/
+
+char* kerberos_secrets_fetch_des_salt( void )
+{
+	char *salt, *key;
+
+	if ( (key = des_salt_key()) == NULL ) {
+		DEBUG(0,("kerberos_secrets_fetch_des_salt: failed to generate key!\n"));
+		return False;
+	}
+
+	salt = (char*)secrets_fetch( key, NULL );
+
+	SAFE_FREE( key );
+
+	return salt;
+}
+
+
+/************************************************************************
+ Routine to get the salting principal for this service.  This is 
+ maintained for backwards compatibilty with releases prior to 3.0.24.
+ Since we store the salting principal string only at join, we may have 
+ to look for the older tdb keys.  Caller must free if return is not null.
  ************************************************************************/
 
 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
@@ -281,23 +356,29 @@ krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
 {
 	char *unparsed_name = NULL, *salt_princ_s = NULL;
 	krb5_principal ret_princ = NULL;
+	
+	/* lookup new key first */
 
-	if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) {
-		return (krb5_principal)NULL;
-	}
+	if ( (salt_princ_s = kerberos_secrets_fetch_des_salt()) == NULL ) {
+	
+		/* look under the old key.  If this fails, just use the standard key */
 
-	if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) {
-		SAFE_FREE(unparsed_name);
-		return (krb5_principal)NULL;
+		if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) {
+			return (krb5_principal)NULL;
+		}
+		if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) {
+			/* fall back to host/machine.realm@REALM */
+			salt_princ_s = kerberos_standard_des_salt();
+		}
 	}
 
 	if (smb_krb5_parse_name(context, salt_princ_s, &ret_princ) != 0) {
-		SAFE_FREE(unparsed_name);
-		SAFE_FREE(salt_princ_s);
-		return (krb5_principal)NULL;
+		ret_princ = NULL;
 	}
+	
 	SAFE_FREE(unparsed_name);
 	SAFE_FREE(salt_princ_s);
+	
 	return ret_princ;
 }
 
@@ -362,465 +443,9 @@ BOOL kerberos_secrets_store_salting_principal(const char *service,
 	return ret;
 }
 
-/************************************************************************
- Routine to get initial credentials as a service ticket for the local machine.
- Returns a buffer initialized with krb5_mk_req_extended.
- ************************************************************************/
-
-static krb5_error_code get_service_ticket(krb5_context ctx,
-					krb5_ccache ccache,
-					const char *service_principal,
-					int enctype,
-					krb5_data *p_outbuf)
-{
-	krb5_creds creds, *new_creds = NULL;
-	char *service_s = NULL;
-	char *machine_account = NULL, *password = NULL;
-	krb5_data in_data;
-	krb5_auth_context auth_context = NULL;
-	krb5_error_code err = 0;
-
-	ZERO_STRUCT(creds);
-
-	asprintf(&machine_account, "%s$@%s", global_myname(), lp_realm());
-	if (machine_account == NULL) {
-		goto out;
-	}
-	password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
-	if (password == NULL) {
-		goto out;
-	}
-	if ((err = kerberos_kinit_password(machine_account, password, 
-					   0, LIBADS_CCACHE_NAME)) != 0) {
-		DEBUG(0,("get_service_ticket: kerberos_kinit_password %s failed: %s\n", 
-			machine_account,
-			error_message(err)));
-		goto out;
-	}
-
-	/* Ok - the above call has gotten a TGT. Now we need to get a service
-	   ticket to ourselves. */
-
-	/* Set up the enctype and client and server principal fields for krb5_get_credentials. */
-	kerberos_set_creds_enctype(&creds, enctype);
-
-	if ((err = krb5_cc_get_principal(ctx, ccache, &creds.client))) {
-		DEBUG(3, ("get_service_ticket: krb5_cc_get_principal failed: %s\n", 
-			error_message(err)));
-		goto out;
-	}
-
-	if (strchr_m(service_principal, '@')) {
-		asprintf(&service_s, "%s", service_principal);
-	} else {
-		asprintf(&service_s, "%s@%s", service_principal, lp_realm());
-	}
-
-	if ((err = smb_krb5_parse_name(ctx, service_s, &creds.server))) {
-		DEBUG(0,("get_service_ticket: smb_krb5_parse_name %s failed: %s\n", 
-			service_s, error_message(err)));
-		goto out;
-	}
-
-	if ((err = krb5_get_credentials(ctx, 0, ccache, &creds, &new_creds))) {
-		DEBUG(5,("get_service_ticket: krb5_get_credentials for %s enctype %d failed: %s\n", 
-			service_s, enctype, error_message(err)));
-		goto out;
-	}
-
-	memset(&in_data, '\0', sizeof(in_data));
-	if ((err = krb5_mk_req_extended(ctx, &auth_context, 0, &in_data,
-			new_creds, p_outbuf)) != 0) {
-		DEBUG(0,("get_service_ticket: krb5_mk_req_extended failed: %s\n", 
-			error_message(err)));
-		goto out;
-	}
-
- out:
-
-	if (auth_context) {
-		krb5_auth_con_free(ctx, auth_context);
-	}
-	if (new_creds) {
-		krb5_free_creds(ctx, new_creds);
-	}
-	if (creds.server) {
-		krb5_free_principal(ctx, creds.server);
-	}
-	if (creds.client) {
-		krb5_free_principal(ctx, creds.client);
-	}
-
-	SAFE_FREE(service_s);
-	SAFE_FREE(password);
-	SAFE_FREE(machine_account);
-	return err;
-}
 
 /************************************************************************
- Check if the machine password can be used in conjunction with the salting_principal
- to generate a key which will successfully decrypt the AP_REQ already
- gotten as a message to the local machine.
- ************************************************************************/
-
-static BOOL verify_service_password(krb5_context ctx,
-				    int enctype,
-				    const char *salting_principal,
-				    krb5_data *in_data)
-{
-	BOOL ret = False;
-	krb5_principal salting_kprinc = NULL;
-	krb5_ticket *ticket = NULL;
-	krb5_keyblock key;
-	krb5_data passdata;
-	char *salting_s = NULL;
-	char *machine_account = NULL, *password = NULL;
-	krb5_auth_context auth_context = NULL;
-	krb5_error_code err;
-
-	memset(&passdata, '\0', sizeof(passdata));
-	memset(&key, '\0', sizeof(key));
-
-	asprintf(&machine_account, "%s$@%s", global_myname(), lp_realm());
-	if (machine_account == NULL) {
-		goto out;
-	}
-	password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
-	if (password == NULL) {
-		goto out;
-	}
-
-	if (strchr_m(salting_principal, '@')) {
-		asprintf(&salting_s, "%s", salting_principal);
-	} else {
-		asprintf(&salting_s, "%s@%s", salting_principal, lp_realm());
-	}
-
-	if ((err = smb_krb5_parse_name(ctx, salting_s, &salting_kprinc))) {
-		DEBUG(0,("verify_service_password: smb_krb5_parse_name %s failed: %s\n", 
-			salting_s, error_message(err)));
-		goto out;
-	}
-
-	passdata.length = strlen(password);
-	passdata.data = (char*)password;
-	if ((err = create_kerberos_key_from_string_direct(ctx, salting_kprinc, &passdata, &key, enctype))) {
-		DEBUG(0,("verify_service_password: create_kerberos_key_from_string %d failed: %s\n",
-			enctype, error_message(err)));
-		goto out;
-	}
-
-	if ((err = krb5_auth_con_init(ctx, &auth_context)) != 0) {
-		DEBUG(0,("verify_service_password: krb5_auth_con_init failed %s\n", error_message(err)));
-		goto out;
-	}
-
-	if ((err = krb5_auth_con_setuseruserkey(ctx, auth_context, &key)) != 0) {
-		DEBUG(0,("verify_service_password: krb5_auth_con_setuseruserkey failed %s\n", error_message(err)));
-		goto out;
-	}
-
-	if (!(err = krb5_rd_req(ctx, &auth_context, in_data, NULL, NULL, NULL, &ticket))) {
-		DEBUG(10,("verify_service_password: decrypted message with enctype %u salt %s!\n",
-				(unsigned int)enctype, salting_s));
-		ret = True;
-	}
-
- out:
-
-	memset(&passdata, 0, sizeof(passdata));
-	krb5_free_keyblock_contents(ctx, &key);
-	if (ticket != NULL) {
-		krb5_free_ticket(ctx, ticket);
-	}
-	if (salting_kprinc) {
-		krb5_free_principal(ctx, salting_kprinc);
-	}
-	SAFE_FREE(salting_s);
-	SAFE_FREE(password);
-	SAFE_FREE(machine_account);
-	return ret;
-}
-
-/************************************************************************
- *
- * From the current draft of kerberos-clarifications:
- *
- *     It is not possible to reliably generate a user's key given a pass
- *     phrase without contacting the KDC, since it will not be known
- *     whether alternate salt or parameter values are required.
- *
- * And because our server has a password, we have this exact problem.  We
- * make multiple guesses as to which principal name provides the salt which
- * the KDC is using.
- *
- ************************************************************************/
-
-static void kerberos_derive_salting_principal_for_enctype(const char *service_principal,
-							  krb5_context ctx,
-							  krb5_ccache ccache,
-							  krb5_enctype enctype,
-							  krb5_enctype *enctypes)
-{
-	char *salting_principals[3] = {NULL, NULL, NULL}, *second_principal = NULL;
-	krb5_error_code err = 0;
-	krb5_data outbuf;
-	int i, j;
-
-	memset(&outbuf, '\0', sizeof(outbuf));
-
-	/* Check that the service_principal is useful. */
-	if ((service_principal == NULL) || (strlen(service_principal) == 0)) {
-		return;
-	}
-
-	/* Generate our first guess -- the principal as-given. */
-	asprintf(&salting_principals[0], "%s", service_principal);
-	if ((salting_principals[0] == NULL) || (strlen(salting_principals[0]) == 0)) {
-		return;
-	}
-
-	/* Generate our second guess -- the computer's principal, as Win2k3. */
-	asprintf(&second_principal, "host/%s.%s", global_myname(), lp_realm());
-	if (second_principal != NULL) {
-		strlower_m(second_principal);
-		asprintf(&salting_principals[1], "%s@%s", second_principal, lp_realm());
-		SAFE_FREE(second_principal);
-	}
-	if ((salting_principals[1] == NULL) || (strlen(salting_principals[1]) == 0)) {
-		goto out;
-	}
-
-	/* Generate our third guess -- the computer's principal, as Win2k. */
-	asprintf(&second_principal, "HOST/%s", global_myname());
-	if (second_principal != NULL) {
-		strlower_m(second_principal + 5);
-		asprintf(&salting_principals[2], "%s@%s",
-			second_principal, lp_realm());
-		SAFE_FREE(second_principal);
-	}
-	if ((salting_principals[2] == NULL) || (strlen(salting_principals[2]) == 0)) {
-		goto out;
-	}
-
-	/* Get a service ticket for ourselves into our memory ccache. */
-	/* This will commonly fail if there is no principal by that name (and we're trying
-	   many names). So don't print a debug 0 error. */
-
-	if ((err = get_service_ticket(ctx, ccache, service_principal, enctype, &outbuf)) != 0) {
-		DEBUG(3, ("verify_service_password: get_service_ticket failed: %s\n", 
-			error_message(err)));
-		goto out;
-	}
-
-	/* At this point we have a message to ourselves, salted only the KDC knows how. We
-	   have to work out what that salting is. */
-
-	/* Try and find the correct salting principal. */
-	for (i = 0; i < sizeof(salting_principals) / sizeof(salting_principals[i]); i++) {
-		if (verify_service_password(ctx, enctype, salting_principals[i], &outbuf)) {
-			break;
-		}
-	}
-
-	/* If we failed to get a match, return. */
-	if (i >= sizeof(salting_principals) / sizeof(salting_principals[i])) {
-		goto out;
-	}
-
-	/* If we succeeded, store the principal for use for all enctypes which
-	 * share the same cipher and string-to-key function.  Doing this here
-	 * allows servers which just pass a keytab to krb5_rd_req() to work
-	 * correctly. */
-	for (j = 0; enctypes[j] != 0; j++) {
-		if (enctype != enctypes[j]) {
-			/* If this enctype isn't compatible with the one which
-			 * we used, skip it. */
-
-			if (!kerberos_compatible_enctypes(ctx, enctypes[j], enctype))
-				continue;
-		}
-		/* If the principal which gives us the proper salt is the one
-		 * which we would normally guess, don't bother noting anything
-		 * in the secrets tdb. */
-		if (strcmp(service_principal, salting_principals[i]) != 0) {
-			kerberos_secrets_store_salting_principal(service_principal,
-								enctypes[j],
-								salting_principals[i]);
-		}
-	}
-
- out :
-
-	kerberos_free_data_contents(ctx, &outbuf);
-	SAFE_FREE(salting_principals[0]);
-	SAFE_FREE(salting_principals[1]);
-	SAFE_FREE(salting_principals[2]);
-	SAFE_FREE(second_principal);
-}
-
-/************************************************************************
- Go through all the possible enctypes for this principal.
- ************************************************************************/
-
-static void kerberos_derive_salting_principal_direct(krb5_context context,
-					krb5_ccache ccache,
-					krb5_enctype *enctypes,
-					char *service_principal)
-{
-	int i;
-
-	/* Try for each enctype separately, because the rules are
-	 * different for different enctypes. */
-	for (i = 0; enctypes[i] != 0; i++) {
-		/* Delete secrets entry first. */
-		kerberos_secrets_store_salting_principal(service_principal, 0, NULL);
-#ifdef ENCTYPE_ARCFOUR_HMAC
-		if (enctypes[i] == ENCTYPE_ARCFOUR_HMAC) {
-			/* Of course this'll always work, so just save
-			 * ourselves the effort. */
-			continue;
-		}
-#endif
-		/* Try to figure out what's going on with this
-		 * principal. */
-		kerberos_derive_salting_principal_for_enctype(service_principal,
-								context,
-								ccache,
-								enctypes[i],
-								enctypes);
-	}
-}
-
-/************************************************************************
- Wrapper function for the above.
- ************************************************************************/
-
-BOOL kerberos_derive_salting_principal(char *service_principal)
-{
-	krb5_context context = NULL;
-	krb5_enctype *enctypes = NULL;
-	krb5_ccache ccache = NULL;
-	krb5_error_code ret = 0;
-
-	initialize_krb5_error_table();
-	if ((ret = krb5_init_context(&context)) != 0) {
-		DEBUG(1,("kerberos_derive_cifs_salting_principals: krb5_init_context failed. %s\n",
-			error_message(ret)));
-		return False;
-	}
-	if ((ret = get_kerberos_allowed_etypes(context, &enctypes)) != 0) {
-		DEBUG(1,("kerberos_derive_cifs_salting_principals: get_kerberos_allowed_etypes failed. %s\n",
-			error_message(ret)));
-		goto out;
-	}
-
-	if ((ret = krb5_cc_resolve(context, LIBADS_CCACHE_NAME, &ccache)) != 0) {
-		DEBUG(3, ("get_service_ticket: krb5_cc_resolve for %s failed: %s\n", 
-			LIBADS_CCACHE_NAME, error_message(ret)));
-		goto out;
-	}
-
-	kerberos_derive_salting_principal_direct(context, ccache, enctypes, service_principal);
-
-  out: 
-	if (enctypes) {
-		free_kerberos_etypes(context, enctypes);
-	}
-	if (ccache) {
-		krb5_cc_destroy(context, ccache);
-	}
-	if (context) {
-		krb5_free_context(context);
-	}
-
-	return ret ? False : True;
-}
-
-/************************************************************************
- Core function to try and determine what salt is being used for any keytab
- keys.
- ************************************************************************/
-
-BOOL kerberos_derive_cifs_salting_principals(void)
-{
-	fstring my_fqdn;
-	char *service = NULL;
-	krb5_context context = NULL;
-	krb5_enctype *enctypes = NULL;
-	krb5_ccache ccache = NULL;
-	krb5_error_code ret = 0;
-	BOOL retval = False;
-
-	initialize_krb5_error_table();
-	if ((ret = krb5_init_context(&context)) != 0) {
-		DEBUG(1,("kerberos_derive_cifs_salting_principals: krb5_init_context failed. %s\n",
-			error_message(ret)));
-		return False;
-	}
-	if ((ret = get_kerberos_allowed_etypes(context, &enctypes)) != 0) {
-		DEBUG(1,("kerberos_derive_cifs_salting_principals: get_kerberos_allowed_etypes failed. %s\n",
-			error_message(ret)));
-		goto out;
-	}
-
-	if ((ret = krb5_cc_resolve(context, LIBADS_CCACHE_NAME, &ccache)) != 0) {
-		DEBUG(3, ("get_service_ticket: krb5_cc_resolve for %s failed: %s\n", 
-			LIBADS_CCACHE_NAME, error_message(ret)));
-		goto out;
-	}
-
-	if (asprintf(&service, "%s$", global_myname()) != -1) {
-		strlower_m(service);
-		kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
-		SAFE_FREE(service);
-	}
-	if (asprintf(&service, "cifs/%s", global_myname()) != -1) {
-		strlower_m(service);
-		kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
-		SAFE_FREE(service);
-	}
-	if (asprintf(&service, "host/%s", global_myname()) != -1) {
-		strlower_m(service);
-		kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
-		SAFE_FREE(service);
-	}
-	if (asprintf(&service, "cifs/%s.%s", global_myname(), lp_realm()) != -1) {
-		strlower_m(service);
-		kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
-		SAFE_FREE(service);
-	}
-	if (asprintf(&service, "host/%s.%s", global_myname(), lp_realm()) != -1) {
-		strlower_m(service);
-		kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
-		SAFE_FREE(service);
-	}
-	name_to_fqdn(my_fqdn, global_myname());
-	if (asprintf(&service, "cifs/%s", my_fqdn) != -1) {
-		strlower_m(service);
-		kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
-		SAFE_FREE(service);
-	}
-	if (asprintf(&service, "host/%s", my_fqdn) != -1) {
-		strlower_m(service);
-		kerberos_derive_salting_principal_direct(context, ccache, enctypes, service);
-		SAFE_FREE(service);
-	}
-
-	retval = True;
-
-  out: 
-	if (enctypes) {
-		free_kerberos_etypes(context, enctypes);
-	}
-	if (ccache) {
-		krb5_cc_destroy(context, ccache);
-	}
-	if (context) {
-		krb5_free_context(context);
-	}
-	return retval;
-}
+************************************************************************/
 
 int kerberos_kinit_password(const char *principal,
 			    const char *password,
diff --git a/source/libads/kerberos_keytab.c b/source/libads/kerberos_keytab.c
index fc87b687d14..80d11d434b4 100644
--- a/source/libads/kerberos_keytab.c
+++ b/source/libads/kerberos_keytab.c
@@ -9,6 +9,7 @@
    Copyright (C) Rakesh Patel 2004
    Copyright (C) Dan Perry 2004
    Copyright (C) Jeremy Allison 2004
+   Copyright (C) Gerald Carter 2006
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -29,120 +30,35 @@
 
 #ifdef HAVE_KRB5
 
+/* This MAX_NAME_LEN is a constant defined in krb5.h */
+#ifndef MAX_KEYTAB_NAME_LEN
+#define MAX_KEYTAB_NAME_LEN 1100
+#endif
+
+
 /**********************************************************************
- Adds a single service principal, i.e. 'host' to the system keytab
-***********************************************************************/
+**********************************************************************/
 
-int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
+static int smb_krb5_kt_add_entry( krb5_context context, krb5_keytab keytab,
+                                  krb5_kvno kvno, const char *princ_s, 
+				  krb5_enctype *enctypes, krb5_data password )
 {
 	krb5_error_code ret = 0;
-	krb5_context context = NULL;
-	krb5_keytab keytab = NULL;
 	krb5_kt_cursor cursor;
 	krb5_keytab_entry kt_entry;
 	krb5_principal princ = NULL;
-	krb5_data password;
-	krb5_enctype *enctypes = NULL;
-	krb5_kvno kvno;
-
-	char *principal = NULL;
-	char *princ_s = NULL;
-	char *password_s = NULL;
-#ifndef MAX_KEYTAB_NAME_LEN
-#define MAX_KEYTAB_NAME_LEN 1100
-#endif
-	char keytab_name[MAX_KEYTAB_NAME_LEN];          /* This MAX_NAME_LEN is a constant defined in krb5.h */
-	fstring my_fqdn;
 	int i;
 	char *ktprinc = NULL;
 
 	ZERO_STRUCT(kt_entry);
 	ZERO_STRUCT(cursor);
-
-	initialize_krb5_error_table();
-	ret = krb5_init_context(&context);
-	if (ret) {
-		DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret)));
-		return -1;
-	}
-#ifdef HAVE_WRFILE_KEYTAB       /* MIT */
-	keytab_name[0] = 'W';
-	keytab_name[1] = 'R';
-	ret = krb5_kt_default_name(context, (char *) &keytab_name[2], MAX_KEYTAB_NAME_LEN - 4);
-#else                           /* Heimdal */
-	ret = krb5_kt_default_name(context, (char *) &keytab_name[0], MAX_KEYTAB_NAME_LEN - 2);
-#endif
-	if (ret) {
-		DEBUG(1,("ads_keytab_add_entry: krb5_kt_default_name failed (%s)\n", error_message(ret)));
-		goto out;
-	}
-	DEBUG(2,("ads_keytab_add_entry: Using default system keytab: %s\n", (char *) &keytab_name));
-	ret = krb5_kt_resolve(context, (char *) &keytab_name, &keytab);
-	if (ret) {
-		DEBUG(1,("ads_keytab_add_entry: krb5_kt_resolve failed (%s)\n", error_message(ret)));
-		goto out;
-	}
-
-	/* retrieve the password */
-	if (!secrets_init()) {
-		DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n"));
-		ret = -1;
-		goto out;
-	}
-	password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
-	if (!password_s) {
-		DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n"));
-		ret = -1;
-		goto out;
-	}
-	password.data = password_s;
-	password.length = strlen(password_s);
-
-	/* Construct our principal */
-	name_to_fqdn(my_fqdn, global_myname());
-	strlower_m(my_fqdn);
-
-	if (strchr_m(srvPrinc, '@')) {
-		/* It's a fully-named principal. */
-		asprintf(&princ_s, "%s", srvPrinc);
-	} else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
-		/* It's the machine account, as used by smbclient clients. */
-		asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm());
-	} else {
-		/* It's a normal service principal.  Add the SPN now so that we
-		 * can obtain credentials for it and double-check the salt value
-		 * used to generate the service's keys. */
-		asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm());
-		/* Update the directory with the SPN */
-		DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s));
-		if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), srvPrinc))) {
-			DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n"));
-			goto out;
-		}
-	}
-
-	ret = get_kerberos_allowed_etypes(context,&enctypes);
-	if (ret) {
-		DEBUG(1,("ads_keytab_add_entry: get_kerberos_allowed_etypes failed (%s)\n",error_message(ret)));
-		goto out;
-	}
-
-	/* Guess at how the KDC is salting keys for this principal. */
-	kerberos_derive_salting_principal(princ_s);
-
+	
 	ret = smb_krb5_parse_name(context, princ_s, &princ);
 	if (ret) {
 		DEBUG(1,("ads_keytab_add_entry: smb_krb5_parse_name(%s) failed (%s)\n", princ_s, error_message(ret)));
 		goto out;
 	}
 
-	kvno = (krb5_kvno) ads_get_kvno(ads, global_myname());
-	if (kvno == -1) {       /* -1 indicates failure, everything else is OK */
-		DEBUG(1,("ads_keytab_add_entry: ads_get_kvno failed to determine the system's kvno.\n"));
-		ret = -1;
-		goto out;
-	}
-
 	/* Seek and delete old keytab entries */
 	ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 	if (ret != KRB5_KT_END && ret != ENOENT ) {
@@ -275,15 +191,8 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
 		}
 	}
 
-	krb5_kt_close(context, keytab);
-	keytab = NULL; /* Done with keytab now. No double free. */
 
 out:
-
-	SAFE_FREE(principal);
-	SAFE_FREE(password_s);
-	SAFE_FREE(princ_s);
-
 	{
 		krb5_keytab_entry zero_kt_entry;
 		ZERO_STRUCT(zero_kt_entry);
@@ -294,10 +203,7 @@ out:
 	if (princ) {
 		krb5_free_principal(context, princ);
 	}
-	if (enctypes) {
-		free_kerberos_etypes(context, enctypes);
-	}
-
+	
 	{
 		krb5_kt_cursor zero_csr;
 		ZERO_STRUCT(zero_csr);
@@ -305,6 +211,157 @@ out:
 			krb5_kt_end_seq_get(context, keytab, &cursor);	
 		}
 	}
+	
+	return (int)ret;
+}
+
+
+/**********************************************************************
+ Adds a single service principal, i.e. 'host' to the system keytab
+***********************************************************************/
+
+int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
+{
+	krb5_error_code ret = 0;
+	krb5_context context = NULL;
+	krb5_keytab keytab = NULL;
+	krb5_data password;
+	krb5_kvno kvno;
+        krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 };
+	char *princ_s = NULL, *short_princ_s = NULL;
+	char *password_s = NULL;
+	char *my_fqdn;
+	char keytab_name[MAX_KEYTAB_NAME_LEN];          
+	TALLOC_CTX *ctx = NULL;
+	char *machine_name;
+
+#if defined(ENCTYPE_ARCFOUR_HMAC)
+        enctypes[2] = ENCTYPE_ARCFOUR_HMAC;
+#endif
+
+	initialize_krb5_error_table();
+	ret = krb5_init_context(&context);
+	if (ret) {
+		DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret)));
+		return -1;
+	}
+	
+#ifdef HAVE_WRFILE_KEYTAB       /* MIT */
+	keytab_name[0] = 'W';
+	keytab_name[1] = 'R';
+	ret = krb5_kt_default_name(context, (char *) &keytab_name[2], MAX_KEYTAB_NAME_LEN - 4);
+#else                           /* Heimdal */
+	ret = krb5_kt_default_name(context, (char *) &keytab_name[0], MAX_KEYTAB_NAME_LEN - 2);
+#endif
+	if (ret) {
+		DEBUG(1,("ads_keytab_add_entry: krb5_kt_default_name failed (%s)\n", error_message(ret)));
+		goto out;
+	}
+	DEBUG(2,("ads_keytab_add_entry: Using default system keytab: %s\n", (char *) &keytab_name));
+	ret = krb5_kt_resolve(context, (char *) &keytab_name, &keytab);
+	if (ret) {
+		DEBUG(1,("ads_keytab_add_entry: krb5_kt_resolve failed (%s)\n", error_message(ret)));
+		goto out;
+	}
+
+	/* retrieve the password */
+	if (!secrets_init()) {
+		DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n"));
+		ret = -1;
+		goto out;
+	}
+	password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
+	if (!password_s) {
+		DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n"));
+		ret = -1;
+		goto out;
+	}
+	password.data = password_s;
+	password.length = strlen(password_s);
+
+	/* we need the dNSHostName value here */
+	
+	if ( (ctx = talloc_init("ads_keytab_add_entry")) == NULL ) {
+		DEBUG(0,("ads_keytab_add_entry: talloc() failed!\n"));
+		ret = -1;
+		goto out;
+	}
+	
+	if ( (my_fqdn = ads_get_dnshostname( ads, ctx, global_myname())) == NULL ) {
+		DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's dns name in AD!\n"));
+		ret = -1;
+		goto out;	
+	}
+	
+	if ( (machine_name = ads_get_samaccountname( ads, ctx, global_myname())) == NULL ) {
+		DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's short name in AD!\n"));
+		ret = -1;
+		goto out;	
+	}
+	/*strip the trailing '$' */
+	machine_name[strlen(machine_name)-1] = '\0';
+		
+	/* Construct our principal */
+
+	if (strchr_m(srvPrinc, '@')) {
+		/* It's a fully-named principal. */
+		asprintf(&princ_s, "%s", srvPrinc);
+	} else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
+		/* It's the machine account, as used by smbclient clients. */
+		asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm());
+	} else {
+		/* It's a normal service principal.  Add the SPN now so that we
+		 * can obtain credentials for it and double-check the salt value
+		 * used to generate the service's keys. */
+		 
+		asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm());
+		asprintf(&short_princ_s, "%s/%s@%s", srvPrinc, machine_name, lp_realm());
+		
+		/* According to http://support.microsoft.com/kb/326985/en-us, 
+		   certain principal names are automatically mapped to the host/...
+		   principal in the AD account.  So only create these in the 
+		   keytab, not in AD.  --jerry */
+		   
+		if ( !strequal( srvPrinc, "cifs" ) && !strequal(srvPrinc, "host" ) ) {
+			DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s));
+			
+			if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), my_fqdn, srvPrinc))) {
+				DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n"));
+				goto out;
+			}
+		}
+	}
+
+	kvno = (krb5_kvno) ads_get_kvno(ads, global_myname());
+	if (kvno == -1) {       /* -1 indicates failure, everything else is OK */
+		DEBUG(1,("ads_keytab_add_entry: ads_get_kvno failed to determine the system's kvno.\n"));
+		ret = -1;
+		goto out;
+	}
+	
+	/* add the fqdn principal to the keytab */
+	
+	ret = smb_krb5_kt_add_entry( context, keytab, kvno, princ_s, enctypes, password );
+	if ( ret ) {
+		DEBUG(1,("ads_keytab_add_entry: Failed to add entry to keytab file\n"));
+		goto out;
+	}
+	
+	/* add the short principal name if we have one */
+	
+	if ( short_princ_s ) {
+		ret = smb_krb5_kt_add_entry( context, keytab, kvno, short_princ_s, enctypes, password );
+		if ( ret ) {
+			DEBUG(1,("ads_keytab_add_entry: Failed to add short entry to keytab file\n"));
+			goto out;
+		}
+	}
+
+out:
+	SAFE_FREE( princ_s );
+	SAFE_FREE( short_princ_s );
+	TALLOC_FREE( ctx );
+	
 	if (keytab) {
 		krb5_kt_close(context, keytab);
 	}
@@ -440,94 +497,76 @@ int ads_keytab_create_default(ADS_STRUCT *ads)
 	krb5_kt_cursor cursor;
 	krb5_keytab_entry kt_entry;
 	krb5_kvno kvno;
-	fstring my_fqdn, my_Fqdn, my_name, my_NAME, my_host_realm;
-	char *p_fqdn;
 	int i, found = 0;
+	char *sam_account_name, *upn;
 	char **oldEntries = NULL, *princ_s[26];
+	TALLOC_CTX *ctx = NULL;
+	fstring machine_name;
 
 	memset(princ_s, '\0', sizeof(princ_s));
 
-	ret = ads_keytab_add_entry(ads, "host");
-	if (ret) {
+	fstrcpy( machine_name, global_myname() );
+
+	/* these are the main ones we need */
+	
+	if ( (ret = ads_keytab_add_entry(ads, "host") ) != 0 ) {
 		DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'host'.\n"));
 		return ret;
 	}
-	ret = ads_keytab_add_entry(ads, "cifs");
-	if (ret) {
+
+
+#if 0	/* don't create the CIFS/... keytab entries since no one except smbd 
+	   really needs them and we will fall back to verifying against secrets.tdb */
+	   
+	if ( (ret = ads_keytab_add_entry(ads, "cifs")) != 0 ) {
 		DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'cifs'.\n"));
 		return ret;
 	}
+#endif
 
-	fstrcpy(my_name, global_myname());
-	strlower_m(my_name);
-
-	fstrcpy(my_NAME, global_myname());
-	strupper_m(my_NAME);
-
-	my_fqdn[0] = '\0';
-	name_to_fqdn(my_fqdn, global_myname());
-	strlower_m(my_fqdn);
-
-	p_fqdn = strchr_m(my_fqdn, '.');
-	fstrcpy(my_Fqdn, my_NAME);
-	if (p_fqdn) {
-		fstrcat(my_Fqdn, p_fqdn);
-	}
-
-	fstrcpy(my_host_realm, my_name);
-	fstrcat(my_host_realm, ".");
-	fstrcat(my_host_realm, lp_realm());
-	strlower_m(my_host_realm);
-
-	asprintf(&princ_s[0], "%s$@%s", my_name, lp_realm());
-	asprintf(&princ_s[1], "%s$@%s", my_NAME, lp_realm());
-	asprintf(&princ_s[2], "host/%s@%s", my_name, lp_realm());
-	asprintf(&princ_s[3], "host/%s@%s", my_NAME, lp_realm());
-	asprintf(&princ_s[4], "host/%s@%s", my_fqdn, lp_realm());
-	asprintf(&princ_s[5], "host/%s@%s", my_Fqdn, lp_realm());
-	asprintf(&princ_s[6], "HOST/%s@%s", my_name, lp_realm());
-	asprintf(&princ_s[7], "HOST/%s@%s", my_NAME, lp_realm());
-	asprintf(&princ_s[8], "HOST/%s@%s", my_fqdn, lp_realm());
-	asprintf(&princ_s[9], "HOST/%s@%s", my_Fqdn, lp_realm());
-	asprintf(&princ_s[10], "cifs/%s@%s", my_name, lp_realm());
-	asprintf(&princ_s[11], "cifs/%s@%s", my_NAME, lp_realm());
-	asprintf(&princ_s[12], "cifs/%s@%s", my_fqdn, lp_realm());
-	asprintf(&princ_s[13], "cifs/%s@%s", my_Fqdn, lp_realm());
-	asprintf(&princ_s[14], "CIFS/%s@%s", my_name, lp_realm());
-	asprintf(&princ_s[15], "CIFS/%s@%s", my_NAME, lp_realm());
-	asprintf(&princ_s[16], "CIFS/%s@%s", my_fqdn, lp_realm());
-	asprintf(&princ_s[17], "CIFS/%s@%s", my_Fqdn, lp_realm());
-	asprintf(&princ_s[18], "cifs/%s.%s@%s", my_name, lp_realm(), lp_realm());
-	asprintf(&princ_s[19], "CIFS/%s.%s@%s", my_name, lp_realm(), lp_realm());
-	asprintf(&princ_s[20], "host/%s.%s@%s", my_name, lp_realm(), lp_realm());
-	asprintf(&princ_s[21], "HOST/%s.%s@%s", my_name, lp_realm(), lp_realm());
-
-	/* when dnsdomain == realm, don't add duplicate principal */
-	if (!strequal(my_host_realm, my_fqdn)) {
-		asprintf(&princ_s[22], "cifs/%s@%s", my_host_realm, lp_realm());
-		asprintf(&princ_s[23], "CIFS/%s@%s", my_host_realm, lp_realm());
-		asprintf(&princ_s[24], "host/%s@%s", my_host_realm, lp_realm());
-		asprintf(&princ_s[25], "HOST/%s@%s", my_host_realm, lp_realm());
-	}
-
-	for (i = 0; i < sizeof(princ_s) / sizeof(princ_s[0]); i++) {
-		if (princ_s[i] != NULL) {
-			ret = ads_keytab_add_entry(ads, princ_s[i]);
-			if (ret != 0) {
-				DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding '%s'.\n", princ_s[i]));
-			}
-			SAFE_FREE(princ_s[i]);
+	if ( (ctx = talloc_init("ads_keytab_create_default")) == NULL ) {
+		DEBUG(0,("ads_keytab_create_default: talloc() failed!\n"));
+		return -1;
+	}
+
+	/* now add the userPrincipalName and sAMAccountName entries */
+	
+	if ( (sam_account_name = ads_get_samaccountname( ads, ctx, machine_name)) == NULL ) {
+		DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's name in AD!\n"));
+		TALLOC_FREE( ctx );
+		return -1;	
+	}
+
+	if ( (ret = ads_keytab_add_entry(ads, sam_account_name )) != 0 ) {
+		DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding sAMAccountName (%s)\n",
+			sam_account_name));
+		return ret;
+	}
+	
+	/* remember that not every machine account will have a upn */
+		
+	upn = ads_get_upn( ads, ctx, machine_name);
+	if ( upn ) {
+		if ( (ret = ads_keytab_add_entry(ads, upn)) != 0 ) {
+			DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding UPN (%s)\n",
+				upn));
+			TALLOC_FREE( ctx );
+			return ret;
 		}
 	}
 
-	kvno = (krb5_kvno) ads_get_kvno(ads, global_myname());
+	TALLOC_FREE( ctx );
+
+	/* Now loop through the keytab and update any other existing entries... */
+	
+	kvno = (krb5_kvno) ads_get_kvno(ads, machine_name);
 	if (kvno == -1) {
 		DEBUG(1,("ads_keytab_create_default: ads_get_kvno failed to determine the system's kvno.\n"));
 		return -1;
 	}
-
-	DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to preserve and update.\n"));
-	/* Now loop through the keytab and update any other existing entries... */
+	
+	DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to "
+		"preserve and update.\n"));
 
 	ZERO_STRUCT(kt_entry);
 	ZERO_STRUCT(cursor);
diff --git a/source/libads/kerberos_verify.c b/source/libads/kerberos_verify.c
index 525a9cfa27c..3aa0860809d 100644
--- a/source/libads/kerberos_verify.c
+++ b/source/libads/kerberos_verify.c
@@ -202,9 +202,13 @@ static BOOL ads_secrets_verify_ticket(krb5_context context, krb5_auth_context au
 	BOOL auth_ok = False;
 	char *password_s = NULL;
 	krb5_data password;
-	krb5_enctype *enctypes = NULL;
+	krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 };
 	int i;
 
+#if defined(ENCTYPE_ARCFOUR_HMAC)
+	enctypes[2] = ENCTYPE_ARCFOUR_HMAC;
+#endif
+
 	ZERO_STRUCTP(keyblock);
 
 	if (!secrets_init()) {
@@ -223,12 +227,6 @@ static BOOL ads_secrets_verify_ticket(krb5_context context, krb5_auth_context au
 
 	/* CIFS doesn't use addresses in tickets. This would break NAT. JRA */
 
-	if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) {
-		DEBUG(1,("ads_secrets_verify_ticket: krb5_get_permitted_enctypes failed (%s)\n", 
-			 error_message(ret)));
-		goto out;
-	}
-
 	p_packet->length = ticket->length;
 	p_packet->data = (krb5_pointer)ticket->data;
 
@@ -273,8 +271,6 @@ static BOOL ads_secrets_verify_ticket(krb5_context context, krb5_auth_context au
 	}
 
  out:
-
-	free_kerberos_etypes(context, enctypes);
 	SAFE_FREE(password_s);
 
 	return auth_ok;
diff --git a/source/libads/ldap.c b/source/libads/ldap.c
index 719805f86d0..ac736fa4f3f 100644
--- a/source/libads/ldap.c
+++ b/source/libads/ldap.c
@@ -5,6 +5,7 @@
    Copyright (C) Remus Koos 2001
    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
    Copyright (C) Guenther Deschner 2005
+   Copyright (C) Gerald Carter 2006
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -286,15 +287,8 @@ got_connection:
 	DEBUG(3,("Connected to LDAP server %s\n", inet_ntoa(ads->ldap_ip)));
 
 	if (!ads->auth.user_name) {
-		/* have to use the userPrincipalName value here and 
-		   not servicePrincipalName; found by Guenther Deschner @ Sernet.
-
-		   Is this still correct?  The comment does not match
-		   the code.   --jerry 
-		   
-		   Yes it is :) 
-		   - Guenther
-		   */
+		/* Must use the userPrincipalName value here or sAMAccountName
+		   and not servicePrincipalName; found by Guenther Deschner */
 
 		asprintf(&ads->auth.user_name, "%s$", global_myname() );
 	}
@@ -1402,20 +1396,21 @@ ADS_STATUS ads_clear_service_principal_names(ADS_STRUCT *ads, const char *machin
  * (found by hostname) in AD.
  * @param ads An initialized ADS_STRUCT
  * @param machine_name the NetBIOS name of the computer, which is used to identify the computer account.
+ * @param my_fqdn The fully qualified DNS name of the machine
  * @param spn A string of the service principal to add, i.e. 'host'
  * @return 0 upon sucess, or non-zero if a failure occurs
  **/
 
-ADS_STATUS ads_add_service_principal_name(ADS_STRUCT *ads, const char *machine_name, const char *spn)
+ADS_STATUS ads_add_service_principal_name(ADS_STRUCT *ads, const char *machine_name, 
+                                          const char *my_fqdn, const char *spn)
 {
 	ADS_STATUS ret;
 	TALLOC_CTX *ctx;
 	LDAPMessage *res = NULL;
-	char *host_spn, *psp1, *psp2, *psp3;
+	char *psp1, *psp2;
 	ADS_MODLIST mods;
-	fstring my_fqdn;
 	char *dn_string = NULL;
-	const char *servicePrincipalName[4] = {NULL, NULL, NULL, NULL};
+	const char *servicePrincipalName[3] = {NULL, NULL, NULL};
 
 	ret = ads_find_machine_acct(ads, (void **)(void *)&res, machine_name);
 	if (!ADS_ERR_OK(ret) || ads_count_replies(ads, res) != 1) {
@@ -1433,84 +1428,59 @@ ADS_STATUS ads_add_service_principal_name(ADS_STRUCT *ads, const char *machine_n
 		return ADS_ERROR(LDAP_NO_MEMORY);
 	}
 
-	name_to_fqdn(my_fqdn, machine_name);
-	strlower_m(my_fqdn);
-
-	if (!(host_spn = talloc_asprintf(ctx, "HOST/%s", my_fqdn))) {
-		talloc_destroy(ctx);
-		ads_msgfree(ads, res);
-		return ADS_ERROR(LDAP_NO_MEMORY);
-	}
-
-	/* Add the extra principal */
-	psp1 = talloc_asprintf(ctx, "%s/%s", spn, machine_name);
-	if (!psp1) {
+	/* add short name spn */
+	
+	if ( (psp1 = talloc_asprintf(ctx, "%s/%s", spn, machine_name)) == NULL ) {
 		talloc_destroy(ctx);
 		ads_msgfree(ads, res);
 		return ADS_ERROR(LDAP_NO_MEMORY);
 	}
-
 	strupper_m(psp1);
 	strlower_m(&psp1[strlen(spn)]);
-	DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", psp1, machine_name));
 	servicePrincipalName[0] = psp1;
-	psp2 = talloc_asprintf(ctx, "%s/%s.%s", spn, machine_name, ads->config.realm);
-	if (!psp2) {
-		talloc_destroy(ctx);
-		ads_msgfree(ads, res);
-		return ADS_ERROR(LDAP_NO_MEMORY);
-	}
+	
+	DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", 
+		psp1, machine_name));
+
 
+	/* add fully qualified spn */
+	
+	if ( (psp2 = talloc_asprintf(ctx, "%s/%s", spn, my_fqdn)) == NULL ) {
+		ret = ADS_ERROR(LDAP_NO_MEMORY);
+		goto out;
+	}
 	strupper_m(psp2);
 	strlower_m(&psp2[strlen(spn)]);
-	DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", psp2, machine_name));
 	servicePrincipalName[1] = psp2;
 
-	/* Add another principal in case the realm != the DNS domain, so that
-	 * the KDC doesn't send "server principal unknown" errors to clients
-	 * which use the DNS name in determining service principal names. */
-	psp3 = talloc_asprintf(ctx, "%s/%s", spn, my_fqdn);
-	if (!psp3) {
-		talloc_destroy(ctx);
-		ads_msgfree(ads, res);
-		return ADS_ERROR(LDAP_NO_MEMORY);
-	}
+	DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", 
+		psp2, machine_name));
 
-	strupper_m(psp3);
-	strlower_m(&psp3[strlen(spn)]);
-	if (strcmp(psp2, psp3) != 0) {
-		DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n", psp3, machine_name));
-		servicePrincipalName[2] = psp3;
-	}
-
-	if (!(mods = ads_init_mods(ctx))) {
-		talloc_destroy(ctx);
-		ads_msgfree(ads, res);
-		return ADS_ERROR(LDAP_NO_MEMORY);
+	if ( (mods = ads_init_mods(ctx)) == NULL ) {
+		ret = ADS_ERROR(LDAP_NO_MEMORY);
+		goto out;
 	}
+	
 	ret = ads_add_strlist(ctx, &mods, "servicePrincipalName", servicePrincipalName);
 	if (!ADS_ERR_OK(ret)) {
 		DEBUG(1,("ads_add_service_principal_name: Error: Updating Service Principals in LDAP\n"));
-		talloc_destroy(ctx);
-		ads_msgfree(ads, res);
-		return ret;
+		goto out;
 	}
-	dn_string = ads_get_dn(ads, res);
-	if (!dn_string) {
-		talloc_destroy(ctx);
-		ads_msgfree(ads, res);
-		return ADS_ERROR(LDAP_NO_MEMORY);
+	
+	if ( (dn_string = ads_get_dn(ads, res)) == NULL ) {
+		ret = ADS_ERROR(LDAP_NO_MEMORY);
+		goto out;
 	}
+	
 	ret = ads_gen_mod(ads, dn_string, mods);
 	ads_memfree(ads,dn_string);
 	if (!ADS_ERR_OK(ret)) {
 		DEBUG(1,("ads_add_service_principal_name: Error: Updating Service Principals in LDAP\n"));
-		talloc_destroy(ctx);
-		ads_msgfree(ads, res);
-		return ret;
+		goto out;
 	}
 
-	talloc_destroy(ctx);
+ out:
+	TALLOC_FREE( ctx );
 	ads_msgfree(ads, res);
 	return ret;
 }
@@ -2241,13 +2211,9 @@ static time_t ads_parse_time(const char *str)
 	return timegm(&tm);
 }
 
-/**
- * Find the servers name and realm - this can be done before authentication 
- *  The ldapServiceName field on w2k  looks like this:
- *    vnet3.home.samba.org:win2000-vnet3$@VNET3.HOME.SAMBA.ORG
- * @param ads connection to ads server
- * @return status of search
- **/
+/********************************************************************
+********************************************************************/
+
 ADS_STATUS ads_current_time(ADS_STRUCT *ads)
 {
 	const char *attrs[] = {"currentTime", NULL};
@@ -2257,7 +2223,7 @@ ADS_STATUS ads_current_time(ADS_STRUCT *ads)
 	TALLOC_CTX *ctx;
 	ADS_STRUCT *ads_s = ads;
 
-	if (!(ctx = talloc_init("ads_server_info"))) {
+	if (!(ctx = talloc_init("ads_current_time"))) {
 		return ADS_ERROR(LDAP_NO_MEMORY);
 	}
 
@@ -2277,14 +2243,12 @@ ADS_STATUS ads_current_time(ADS_STRUCT *ads)
 
 	status = ads_do_search(ads_s, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res);
 	if (!ADS_ERR_OK(status)) {
-		talloc_destroy(ctx);
 		goto done;
 	}
 
 	timestr = ads_pull_string(ads_s, ctx, res, "currentTime");
 	if (!timestr) {
 		ads_msgfree(ads, res);
-		talloc_destroy(ctx);
 		status = ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
 		goto done;
 	}
@@ -2312,6 +2276,60 @@ done:
 	return status;
 }
 
+/********************************************************************
+********************************************************************/
+
+ADS_STATUS ads_domain_func_level(ADS_STRUCT *ads, uint32 *val)
+{
+	const char *attrs[] = {"domainFunctionality", NULL};
+	ADS_STATUS status;
+	void *res;
+	ADS_STRUCT *ads_s = ads;
+	
+	*val = DS_DOMAIN_FUNCTION_2000;
+
+        /* establish a new ldap tcp session if necessary */
+
+	if ( !ads->ld ) {
+		if ( (ads_s = ads_init( ads->server.realm, ads->server.workgroup, 
+			ads->server.ldap_server )) == NULL )
+		{
+			goto done;
+		}
+		ads_s->auth.flags = ADS_AUTH_ANON_BIND;
+		status = ads_connect( ads_s );
+		if ( !ADS_ERR_OK(status))
+			goto done;
+	}
+
+	/* If the attribute does not exist assume it is a Windows 2000 
+	   functional domain */
+	   
+	status = ads_do_search(ads_s, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res);
+	if (!ADS_ERR_OK(status)) {
+		if ( status.err.rc == LDAP_NO_SUCH_ATTRIBUTE ) {
+			status = ADS_SUCCESS;
+		}
+		goto done;
+	}
+
+	if ( !ads_pull_uint32(ads_s, res, "domainFunctionality", val) ) {
+		DEBUG(5,("ads_domain_func_level: Failed to pull the domainFunctionality attribute.\n"));
+	}
+	DEBUG(3,("ads_domain_func_level: %d\n", *val));
+
+	
+	ads_msgfree(ads, res);
+
+done:
+	/* free any temporary ads connections */
+	if ( ads_s != ads ) {
+		ads_destroy( &ads_s );
+	}
+
+	return status;
+}
+
 /**
  * find the domain sid for our domain
  * @param ads connection to ads server
@@ -2622,4 +2640,100 @@ int ads_pull_sids_from_extendeddn(ADS_STRUCT *ads,
 	return dn_count;
 }
 
+/********************************************************************
+********************************************************************/
+
+char* ads_get_dnshostname( ADS_STRUCT *ads, TALLOC_CTX *ctx, const char *machine_name )
+{
+	LDAPMessage *res = NULL;
+	ADS_STATUS status;
+	int count = 0;
+	char *name = NULL;
+	
+	status = ads_find_machine_acct(ads, (void **)(void *)&res, global_myname());
+	if (!ADS_ERR_OK(status)) {
+		DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n",
+			global_myname()));
+		goto out;
+	}
+		
+	if ( (count = ads_count_replies(ads, res)) != 1 ) {
+		DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count));
+		goto out;
+	}
+		
+	if ( (name = ads_pull_string(ads, ctx, res, "dNSHostName")) == NULL ) {
+		DEBUG(0,("ads_get_dnshostname: No dNSHostName attribute!\n"));
+	}
+
+out:
+	ads_msgfree(ads, res);
+	
+	return name;
+}
+
+/********************************************************************
+********************************************************************/
+
+char* ads_get_upn( ADS_STRUCT *ads, TALLOC_CTX *ctx, const char *machine_name )
+{
+	LDAPMessage *res = NULL;
+	ADS_STATUS status;
+	int count = 0;
+	char *name = NULL;
+	
+	status = ads_find_machine_acct(ads, (void **)(void *)&res, global_myname());
+	if (!ADS_ERR_OK(status)) {
+		DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n",
+			global_myname()));
+		goto out;
+	}
+		
+	if ( (count = ads_count_replies(ads, res)) != 1 ) {
+		DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count));
+		goto out;
+	}
+		
+	if ( (name = ads_pull_string(ads, ctx, res, "userPrincipalName")) == NULL ) {
+		DEBUG(0,("ads_get_dnshostname: No userPrincipalName attribute!\n"));
+	}
+
+out:
+	ads_msgfree(ads, res);
+	
+	return name;
+}
+
+/********************************************************************
+********************************************************************/
+
+char* ads_get_samaccountname( ADS_STRUCT *ads, TALLOC_CTX *ctx, const char *machine_name )
+{
+	LDAPMessage *res = NULL;
+	ADS_STATUS status;
+	int count = 0;
+	char *name = NULL;
+	
+	status = ads_find_machine_acct(ads, (void **)(void *)&res, global_myname());
+	if (!ADS_ERR_OK(status)) {
+		DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n",
+			global_myname()));
+		goto out;
+	}
+		
+	if ( (count = ads_count_replies(ads, res)) != 1 ) {
+		DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count));
+		goto out;
+	}
+		
+	if ( (name = ads_pull_string(ads, ctx, res, "sAMAccountName")) == NULL ) {
+		DEBUG(0,("ads_get_dnshostname: No sAMAccountName attribute!\n"));
+	}
+
+out:
+	ads_msgfree(ads, res);
+	
+	return name;
+}
+
 #endif
diff --git a/source/libads/ldap_schema.c b/source/libads/ldap_schema.c
index 13a8ab0cb0b..b65ff956ac9 100644
--- a/source/libads/ldap_schema.c
+++ b/source/libads/ldap_schema.c
@@ -283,22 +283,27 @@ ADS_STATUS ads_check_posix_schema_mapping(ADS_STRUCT *ads, enum wb_posix_mapping
 
 		if (strequal(ADS_ATTR_RFC2307_UIDNUMBER_OID, oids_out[i]) ||
 		    strequal(ADS_ATTR_SFU_UIDNUMBER_OID, oids_out[i])) {
+			SAFE_FREE(ads->schema.posix_uidnumber_attr);
 			ads->schema.posix_uidnumber_attr = SMB_STRDUP(names_out[i]);
 		}
 		if (strequal(ADS_ATTR_RFC2307_GIDNUMBER_OID, oids_out[i]) ||
 		    strequal(ADS_ATTR_SFU_GIDNUMBER_OID, oids_out[i])) {
+			SAFE_FREE(ads->schema.posix_gidnumber_attr);
 			ads->schema.posix_gidnumber_attr = SMB_STRDUP(names_out[i]);
 		}
 		if (strequal(ADS_ATTR_RFC2307_HOMEDIR_OID, oids_out[i]) ||
 		    strequal(ADS_ATTR_SFU_HOMEDIR_OID, oids_out[i])) {
+			SAFE_FREE(ads->schema.posix_homedir_attr);
 			ads->schema.posix_homedir_attr = SMB_STRDUP(names_out[i]);
 		}
 		if (strequal(ADS_ATTR_RFC2307_SHELL_OID, oids_out[i]) ||
 		    strequal(ADS_ATTR_SFU_SHELL_OID, oids_out[i])) {
+			SAFE_FREE(ads->schema.posix_shell_attr);
 			ads->schema.posix_shell_attr = SMB_STRDUP(names_out[i]);
 		}
 		if (strequal(ADS_ATTR_RFC2307_GECOS_OID, oids_out[i]) ||
 		    strequal(ADS_ATTR_SFU_GECOS_OID, oids_out[i])) {
+			SAFE_FREE(ads->schema.posix_gecos_attr);
 			ads->schema.posix_gecos_attr = SMB_STRDUP(names_out[i]);
 		}
 	}
diff --git a/source/libads/util.c b/source/libads/util.c
index 8e3001ccb04..eb6dccb3afd 100644
--- a/source/libads/util.c
+++ b/source/libads/util.c
@@ -48,14 +48,6 @@ ADS_STATUS ads_change_trust_account_password(ADS_STRUCT *ads, char *host_princip
 		goto failed;
 	}
 
-	/* Determine if the KDC is salting keys for this principal in a
-	 * non-obvious way. */
-	if (!kerberos_derive_salting_principal(host_principal)) {
-		DEBUG(1,("Failed to determine correct salting principal for %s\n", host_principal));
-		ret = ADS_ERROR_SYSTEM(EACCES);
-		goto failed;
-	}
-
 failed:
 	SAFE_FREE(password);
 	return ret;
diff --git a/source/libsmb/clikrb5.c b/source/libsmb/clikrb5.c
index abb3843bacb..f0169eb91e6 100644
--- a/source/libsmb/clikrb5.c
+++ b/source/libsmb/clikrb5.c
@@ -112,7 +112,7 @@ static krb5_error_code smb_krb5_parse_name_norealm_conv(krb5_context context,
 
 #ifndef HAVE_KRB5_SET_REAL_TIME
 /*
- * This function is not in the Heimdal mainline.
+ * Thir function is not in the Heimdal mainline.
  */
  krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
 {
@@ -682,7 +682,7 @@ failed:
 	else
 		err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 	if (err == 0 && skey != NULL) {
-		DEBUG(10, ("Got KRB5 session key of length %d\n",  KRB5_KEY_LENGTH(skey)));
+		DEBUG(10, ("Got KRB5 session key of length %d\n",  (int)KRB5_KEY_LENGTH(skey)));
 		*session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 		dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 
diff --git a/source/locking/brlock.c b/source/locking/brlock.c
index 574552e9e21..267a08d15fa 100644
--- a/source/locking/brlock.c
+++ b/source/locking/brlock.c
@@ -666,6 +666,7 @@ static NTSTATUS brl_lock_posix(struct byte_range_lock *br_lck,
 		return NT_STATUS_NO_MEMORY;
 	}
 	br_lck->num_locks = count;
+	SAFE_FREE(br_lck->lock_data);
 	br_lck->lock_data = (void *)tp;
 	br_lck->modified = True;
 	return NT_STATUS_OK;
@@ -722,7 +723,7 @@ NTSTATUS brl_lock(struct byte_range_lock *br_lck,
  Check if an unlock overlaps a pending lock.
 ****************************************************************************/
 
-static BOOL brl_pending_overlap(struct lock_struct *lock, struct lock_struct *pend_lock)
+static BOOL brl_pending_overlap(const struct lock_struct *lock, const struct lock_struct *pend_lock)
 {
 	if ((lock->start <= pend_lock->start) && (lock->start + lock->size > pend_lock->start))
 		return True;
@@ -738,12 +739,11 @@ static BOOL brl_pending_overlap(struct lock_struct *lock, struct lock_struct *pe
 static BOOL brl_unlock_windows(struct byte_range_lock *br_lck, const struct lock_struct *plock)
 {
 	unsigned int i, j;
-	struct lock_struct *lock = NULL;
 	struct lock_struct *locks = (struct lock_struct *)br_lck->lock_data;
 
 #if ZERO_ZERO
 	for (i = 0; i < br_lck->num_locks; i++) {
-		lock = &locks[i];
+		struct lock_struct *lock = &locks[i];
 
 		if (lock->lock_type == WRITE_LOCK &&
 		    brl_same_context(&lock->context, &plock->context) &&
@@ -766,7 +766,7 @@ static BOOL brl_unlock_windows(struct byte_range_lock *br_lck, const struct lock
 #endif
 
 	for (i = 0; i < br_lck->num_locks; i++) {
-		lock = &locks[i];
+		struct lock_struct *lock = &locks[i];
 
 		/* Only remove our own locks that match in start, size, and flavour. */
 		if (brl_same_context(&lock->context, &plock->context) &&
@@ -798,7 +798,7 @@ static BOOL brl_unlock_windows(struct byte_range_lock *br_lck, const struct lock
 		}
 
 		/* We could send specific lock info here... */
-		if (brl_pending_overlap(lock, pend_lock)) {
+		if (brl_pending_overlap(plock, pend_lock)) {
 			DEBUG(10,("brl_unlock: sending unlock message to pid %s\n",
 				procid_str_static(&pend_lock->context.pid )));
 
@@ -828,7 +828,6 @@ static BOOL brl_unlock_windows(struct byte_range_lock *br_lck, const struct lock
 static BOOL brl_unlock_posix(struct byte_range_lock *br_lck, const struct lock_struct *plock)
 {
 	unsigned int i, j, count;
-	struct lock_struct *lock = NULL;
 	struct lock_struct *tp;
 	struct lock_struct *locks = (struct lock_struct *)br_lck->lock_data;
 	BOOL overlap_found = False;
@@ -857,11 +856,11 @@ static BOOL brl_unlock_posix(struct byte_range_lock *br_lck, const struct lock_s
 
 	count = 0;
 	for (i = 0; i < br_lck->num_locks; i++) {
+		struct lock_struct *lock = &locks[i];
 		struct lock_struct tmp_lock[3];
 		BOOL lock_was_added = False;
 		unsigned int tmp_count;
 
-		lock = &locks[i];
 
 		/* Only remove our own locks - ignore fnum. */
 		if (lock->lock_type == PENDING_LOCK ||
@@ -956,11 +955,11 @@ static BOOL brl_unlock_posix(struct byte_range_lock *br_lck, const struct lock_s
 	}
 
 	br_lck->num_locks = count;
-	br_lck->lock_data = (void *)tp;
+	SAFE_FREE(br_lck->lock_data);
+	locks = br_lck->lock_data = (void *)tp;
 	br_lck->modified = True;
 
 	/* Send unlock messages to any pending waiters that overlap. */
-	locks = tp;
 
 	for (j=0; j < br_lck->num_locks; j++) {
 		struct lock_struct *pend_lock = &locks[j];
@@ -971,7 +970,7 @@ static BOOL brl_unlock_posix(struct byte_range_lock *br_lck, const struct lock_s
 		}
 
 		/* We could send specific lock info here... */
-		if (brl_pending_overlap(lock, pend_lock)) {
+		if (brl_pending_overlap(plock, pend_lock)) {
 			DEBUG(10,("brl_unlock: sending unlock message to pid %s\n",
 				procid_str_static(&pend_lock->context.pid )));
 
diff --git a/source/nsswitch/pam_winbind.c b/source/nsswitch/pam_winbind.c
index 8110a02a685..2264c5b8bd1 100644
--- a/source/nsswitch/pam_winbind.c
+++ b/source/nsswitch/pam_winbind.c
@@ -47,15 +47,17 @@ static int _pam_parse(int argc, const char **argv, dictionary **d)
 {
 	int ctrl = 0;
 	const char *config_file = NULL;
+	int i;
+	const char **v;
 
 	if (d == NULL) {
 		goto config_from_pam;
 	}
 
-	for (; argc-- > 0; ++argv) {
-		if (!strncasecmp(*argv, "config", strlen("config"))) {
+	for (i=argc,v=argv; i-- > 0; ++v) {
+		if (!strncasecmp(*v, "config", strlen("config"))) {
 			ctrl |= WINBIND_CONFIG_FILE;
-			config_file = argv[argc];
+			config_file = v[i];
 			break;
 		}
 	}
@@ -92,31 +94,31 @@ static int _pam_parse(int argc, const char **argv, dictionary **d)
 
 config_from_pam:
 	/* step through arguments */
-	for (; argc-- > 0; ++argv) {
+	for (i=argc,v=argv; i-- > 0; ++v) {
 
 		/* generic options */
-		if (!strcmp(*argv,"debug"))
+		if (!strcmp(*v,"debug"))
 			ctrl |= WINBIND_DEBUG_ARG;
-		else if (!strcasecmp(*argv, "use_authtok"))
+		else if (!strcasecmp(*v, "use_authtok"))
 			ctrl |= WINBIND_USE_AUTHTOK_ARG;
-		else if (!strcasecmp(*argv, "use_first_pass"))
+		else if (!strcasecmp(*v, "use_first_pass"))
 			ctrl |= WINBIND_USE_FIRST_PASS_ARG;
-		else if (!strcasecmp(*argv, "try_first_pass"))
+		else if (!strcasecmp(*v, "try_first_pass"))
 			ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
-		else if (!strcasecmp(*argv, "unknown_ok"))
+		else if (!strcasecmp(*v, "unknown_ok"))
 			ctrl |= WINBIND_UNKNOWN_OK_ARG;
-		else if (!strncasecmp(*argv, "require_membership_of", strlen("require_membership_of")))
+		else if (!strncasecmp(*v, "require_membership_of", strlen("require_membership_of")))
 			ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
-		else if (!strncasecmp(*argv, "require-membership-of", strlen("require-membership-of")))
+		else if (!strncasecmp(*v, "require-membership-of", strlen("require-membership-of")))
 			ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
-		else if (!strcasecmp(*argv, "krb5_auth"))
+		else if (!strcasecmp(*v, "krb5_auth"))
 			ctrl |= WINBIND_KRB5_AUTH;
-		else if (!strncasecmp(*argv, "krb5_ccache_type", strlen("krb5_ccache_type")))
+		else if (!strncasecmp(*v, "krb5_ccache_type", strlen("krb5_ccache_type")))
 			ctrl |= WINBIND_KRB5_CCACHE_TYPE;
-		else if (!strcasecmp(*argv, "cached_login"))
+		else if (!strcasecmp(*v, "cached_login"))
 			ctrl |= WINBIND_CACHED_LOGIN;
 		else {
-			_pam_log(LOG_ERR, "pam_parse: unknown option; %s", *argv);
+			_pam_log(LOG_ERR, "pam_parse: unknown option; %s", *v);
 		}
 
 	}
diff --git a/source/utils/net_ads.c b/source/utils/net_ads.c
index 9d122a466bb..5e84f229aa2 100644
--- a/source/utils/net_ads.c
+++ b/source/utils/net_ads.c
@@ -80,6 +80,17 @@ int net_ads_usage(int argc, const char **argv)
 	return -1;
 }
 
+/* when we do not have sufficient input parameters to contact a remote domain
+ * we always fall back to our own realm - Guenther*/
+
+static const char *assume_own_realm(void)
+{
+	if (!opt_host && strequal(lp_workgroup(), opt_target_workgroup)) {
+		return lp_realm();
+	}
+
+	return NULL;
+}
 
 /*
   do a cldap netlogon query
@@ -161,10 +172,7 @@ static int net_ads_lookup(int argc, const char **argv)
 {
 	ADS_STRUCT *ads;
 	ADS_STATUS status;
-	const char *realm = NULL;
-
-	if ( strequal(lp_workgroup(), opt_target_workgroup ) )
-		realm = lp_realm();
+	const char *realm = assume_own_realm();
 
 	ads = ads_init(realm, opt_target_workgroup, opt_host);
 	if (ads) {
@@ -190,8 +198,9 @@ static int net_ads_lookup(int argc, const char **argv)
 static int net_ads_info(int argc, const char **argv)
 {
 	ADS_STRUCT *ads;
+	const char *realm = assume_own_realm();
 
-	if ( (ads = ads_init(lp_realm(), opt_target_workgroup, opt_host)) != NULL ) {
+	if ( (ads = ads_init(realm, opt_target_workgroup, opt_host)) != NULL ) {
 		ads->auth.flags |= ADS_AUTH_NO_BIND;
 	}
 
@@ -228,20 +237,25 @@ static void use_in_memory_ccache(void) {
 	setenv(KRB5_ENV_CCNAME, "MEMORY:net_ads", 1);
 }
 
-static ADS_STRUCT *ads_startup(void)
+static ADS_STRUCT *ads_startup(BOOL only_own_domain)
 {
 	ADS_STRUCT *ads;
 	ADS_STATUS status;
 	BOOL need_password = False;
 	BOOL second_time = False;
 	char *cp;
+	const char *realm = NULL;
 	
 	/* lp_realm() should be handled by a command line param, 
 	   However, the join requires that realm be set in smb.conf
 	   and compares our realm with the remote server's so this is
 	   ok until someone needs more flexibility */
-	   
-	ads = ads_init(lp_realm(), opt_target_workgroup, opt_host);
+
+ 	if (only_own_domain) {
+		realm = lp_realm();
+	}
+   
+	ads = ads_init(realm, opt_target_workgroup, opt_host);
 
 	if (!opt_user_name) {
 		opt_user_name = "administrator";
@@ -299,12 +313,12 @@ retry:
   ads_startup() stores the password in opt_password if it needs to so
   that rpc or rap can use it without re-prompting.
 */
-int net_ads_check(void)
+static int net_ads_check_int(const char *realm, const char *workgroup, const char *host)
 {
 	ADS_STRUCT *ads;
 	ADS_STATUS status;
 
-	if ( (ads = ads_init( lp_realm(), lp_workgroup(), NULL )) == NULL ) {
+	if ( (ads = ads_init( realm, workgroup, host )) == NULL ) {
 		return -1;
 	}
 
@@ -319,6 +333,15 @@ int net_ads_check(void)
 	return 0;
 }
 
+int net_ads_check_our_domain(void)
+{
+	return net_ads_check_int(lp_realm(), lp_workgroup(), NULL);
+}
+
+int net_ads_check(void)
+{
+	return net_ads_check_int(NULL, opt_workgroup, opt_host);
+}
 /* 
    determine the netbios workgroup name for a domain
  */
@@ -326,12 +349,9 @@ static int net_ads_workgroup(int argc, const char **argv)
 {
 	ADS_STRUCT *ads;
 	ADS_STATUS status;
-	const char *realm = NULL;
+	const char *realm = assume_own_realm();
 	struct cldap_netlogon_reply reply;
 
-	if ( strequal(lp_workgroup(), opt_target_workgroup ) )
-		realm = lp_realm();
-
 	ads = ads_init(realm, opt_target_workgroup, opt_host);
 	if (ads) {
 		ads->auth.flags |= ADS_AUTH_NO_BIND;
@@ -405,7 +425,7 @@ static int ads_user_add(int argc, const char **argv)
 
 	if (argc < 1) return net_ads_user_usage(argc, argv);
 	
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(False))) {
 		return -1;
 	}
 
@@ -490,7 +510,7 @@ static int ads_user_info(int argc, const char **argv)
 		return -1;
 	}
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(False))) {
 		SAFE_FREE(escaped_user);
 		return -1;
 	}
@@ -506,7 +526,8 @@ static int ads_user_info(int argc, const char **argv)
 		return -1;
 	}
 	
-	grouplist = ldap_get_values(ads->ld, res, "memberOf");
+	grouplist = ldap_get_values((LDAP *)ads->ld,
+				    (LDAPMessage *)res, "memberOf");
 
 	if (grouplist) {
 		int i;
@@ -536,7 +557,7 @@ static int ads_user_delete(int argc, const char **argv)
 		return net_ads_user_usage(argc, argv);
 	}
 	
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(False))) {
 		return -1;
 	}
 
@@ -576,7 +597,7 @@ int net_ads_user(int argc, const char **argv)
 	char *disp_fields[2] = {NULL, NULL};
 	
 	if (argc == 0) {
-		if (!(ads = ads_startup())) {
+		if (!(ads = ads_startup(False))) {
 			return -1;
 		}
 
@@ -591,7 +612,7 @@ int net_ads_user(int argc, const char **argv)
 					  shortattrs, usergrp_display, 
 					  disp_fields);
 		ads_destroy(&ads);
-		return 0;
+		return ADS_ERR_OK(rc) ? 0 : -1;
 	}
 
 	return net_run_function(argc, argv, func, net_ads_user_usage);
@@ -613,7 +634,7 @@ static int ads_group_add(int argc, const char **argv)
 		return net_ads_group_usage(argc, argv);
 	}
 	
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(False))) {
 		return -1;
 	}
 
@@ -662,7 +683,7 @@ static int ads_group_delete(int argc, const char **argv)
 		return net_ads_group_usage(argc, argv);
 	}
 	
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(False))) {
 		return -1;
 	}
 
@@ -701,7 +722,7 @@ int net_ads_group(int argc, const char **argv)
 	char *disp_fields[2] = {NULL, NULL};
 
 	if (argc == 0) {
-		if (!(ads = ads_startup())) {
+		if (!(ads = ads_startup(False))) {
 			return -1;
 		}
 
@@ -716,7 +737,7 @@ int net_ads_group(int argc, const char **argv)
 					  disp_fields);
 
 		ads_destroy(&ads);
-		return 0;
+		return ADS_ERR_OK(rc) ? 0 : -1;
 	}
 	return net_run_function(argc, argv, func, net_ads_group_usage);
 }
@@ -727,7 +748,7 @@ static int net_ads_status(int argc, const char **argv)
 	ADS_STATUS rc;
 	void *res;
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(True))) {
 		return -1;
 	}
 
@@ -776,7 +797,7 @@ static int net_ads_leave(int argc, const char **argv)
 	/* The finds a DC and takes care of getting the 
 	   user creds if necessary */
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(True))) {
 		return -1;
 	}
 
@@ -826,7 +847,7 @@ static int net_ads_join_ok(void)
 
 	net_use_machine_password();
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(True))) {
 		return -1;
 	}
 
@@ -1011,7 +1032,7 @@ static ADS_STATUS net_precreate_machine_acct( ADS_STRUCT *ads, const char *ou )
 	asprintf(&dn, "%s,%s", ou_str, ads->config.bind_path);
 	free(ou_str);
 
-	rc = ads_search_dn(ads, (void**)&res, dn, NULL);
+	rc = ads_search_dn(ads, &res, dn, NULL);
 	ads_msgfree(ads, res);
 
 	if (ADS_ERR_OK(rc)) {
@@ -1029,6 +1050,61 @@ static ADS_STATUS net_precreate_machine_acct( ADS_STRUCT *ads, const char *ou )
 	return rc;
 }
 
+/************************************************************************
+ ************************************************************************/
+
+static BOOL net_derive_salting_principal( TALLOC_CTX *ctx, ADS_STRUCT *ads )
+{
+	uint32 domain_func;
+	ADS_STATUS status;
+	fstring salt;
+	char *std_salt;
+	LDAPMessage *res = NULL;
+	const char *machine_name = global_myname();
+
+	status = ads_domain_func_level( ads, &domain_func );
+	if ( !ADS_ERR_OK(status) ) {
+		DEBUG(2,("Failed to determine domain functional level!\n"));
+		return False;
+	}
+
+	/* go ahead and setup the default salt */
+
+	if ( (std_salt = kerberos_standard_des_salt()) == NULL ) {
+		DEBUG(0,("net_derive_salting_principal: failed to obtain stanard DES salt\n"));
+		return False;
+	}
+
+	fstrcpy( salt, std_salt );
+	SAFE_FREE( std_salt );
+	
+	/* if it's a Windows functional domain, we have to look for the UPN */
+	   
+	if ( domain_func == DS_DOMAIN_FUNCTION_2000 ) {	
+		char *upn;
+		int count;
+		
+		status = ads_find_machine_acct(ads, (void **)(void *)&res, machine_name);
+		if (!ADS_ERR_OK(status)) {
+			return False;
+		}
+		
+		if ( (count = ads_count_replies(ads, res)) != 1 ) {
+			DEBUG(1,("net_set_machine_spn: %d entries returned!\n", count));
+			return False;
+		}
+		
+		upn = ads_pull_string(ads, ctx, res, "userPrincipalName");
+		if ( upn ) {
+			fstrcpy( salt, upn );
+		}
+		
+		ads_msgfree(ads, res);
+	}
+
+	return kerberos_secrets_store_des_salt( salt );
+}
+
 /*******************************************************************
   join a domain using ADS (LDAP mods)
  ********************************************************************/
@@ -1049,7 +1125,7 @@ int net_ads_join(int argc, const char **argv)
 		return -1;
 	}
 
-	if ( (ads = ads_startup()) == NULL ) {
+	if ( (ads = ads_startup(True)) == NULL ) {
 		return -1;
 	}
 
@@ -1139,30 +1215,16 @@ int net_ads_join(int argc, const char **argv)
 		/* don't fail */
 	}
 
-#if defined(HAVE_KRB5) 
-	if (asprintf(&machine_account, "%s$", global_myname()) == -1) {
-		d_fprintf(stderr, "asprintf failed\n");
-		ads_destroy(&ads);
-		return -1;
-	}
-
-	if (!kerberos_derive_salting_principal(machine_account)) {
+	if ( !net_derive_salting_principal( ctx, ads ) ) {
 		DEBUG(1,("Failed to determine salting principal\n"));
 		ads_destroy(&ads);
 		return -1;
 	}
 
-	if (!kerberos_derive_cifs_salting_principals()) {
-		DEBUG(1,("Failed to determine salting principals\n"));
-		ads_destroy(&ads);
-		return -1;
-	}
-	
 	/* Now build the keytab, using the same ADS connection */
 	if (lp_use_kerberos_keytab() && ads_keytab_create_default(ads)) {
 		DEBUG(1,("Error creating host keytab!\n"));
 	}
-#endif
 
 	d_printf("Joined '%s' to realm '%s'\n", global_myname(), ads->config.realm);
 
@@ -1202,7 +1264,7 @@ static int net_ads_printer_search(int argc, const char **argv)
 	ADS_STATUS rc;
 	void *res = NULL;
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(False))) {
 		return -1;
 	}
 
@@ -1235,7 +1297,7 @@ static int net_ads_printer_info(int argc, const char **argv)
 	const char *servername, *printername;
 	void *res = NULL;
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(False))) {
 		return -1;
 	}
 
@@ -1294,7 +1356,7 @@ static int net_ads_printer_publish(int argc, const char **argv)
 	char *prt_dn, *srv_dn, **srv_cn;
 	void *res = NULL;
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(True))) {
 		return -1;
 	}
 
@@ -1340,7 +1402,7 @@ static int net_ads_printer_publish(int argc, const char **argv)
 		return -1;
 	}
 
-	srv_dn = ldap_get_dn(ads->ld, res);
+	srv_dn = ldap_get_dn((LDAP *)ads->ld, (LDAPMessage *)res);
 	srv_cn = ldap_explode_dn(srv_dn, 1);
 
 	asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn[0], printername, srv_dn);
@@ -1377,7 +1439,7 @@ static int net_ads_printer_remove(int argc, const char **argv)
 	char *prt_dn;
 	void *res = NULL;
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(True))) {
 		return -1;
 	}
 
@@ -1473,7 +1535,7 @@ static int net_ads_password(int argc, const char **argv)
 
 	/* use the realm so we can eventually change passwords for users 
 	in realms other than default */
-	if (!(ads = ads_init(realm, opt_workgroup, NULL))) {
+	if (!(ads = ads_init(realm, opt_workgroup, opt_host))) {
 		return -1;
 	}
 
@@ -1524,7 +1586,7 @@ int net_ads_changetrustpw(int argc, const char **argv)
 
 	use_in_memory_ccache();
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(True))) {
 		return -1;
 	}
 
@@ -1589,7 +1651,7 @@ static int net_ads_search(int argc, const char **argv)
 		return net_ads_search_usage(argc, argv);
 	}
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(False))) {
 		return -1;
 	}
 
@@ -1649,7 +1711,7 @@ static int net_ads_dn(int argc, const char **argv)
 		return net_ads_dn_usage(argc, argv);
 	}
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(False))) {
 		return -1;
 	}
 
@@ -1709,7 +1771,7 @@ static int net_ads_sid(int argc, const char **argv)
 		return net_ads_sid_usage(argc, argv);
 	}
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(False))) {
 		return -1;
 	}
 
@@ -1766,7 +1828,7 @@ static int net_ads_keytab_flush(int argc, const char **argv)
 	int ret;
 	ADS_STRUCT *ads;
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(True))) {
 		return -1;
 	}
 	ret = ads_keytab_flush(ads);
@@ -1781,7 +1843,7 @@ static int net_ads_keytab_add(int argc, const char **argv)
 	ADS_STRUCT *ads;
 
 	d_printf("Processing principals to add...\n");
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(True))) {
 		return -1;
 	}
 	for (i = 0; i < argc; i++) {
@@ -1796,7 +1858,7 @@ static int net_ads_keytab_create(int argc, const char **argv)
 	ADS_STRUCT *ads;
 	int ret;
 
-	if (!(ads = ads_startup())) {
+	if (!(ads = ads_startup(True))) {
 		return -1;
 	}
 	ret = ads_keytab_create_default(ads);
@@ -1919,6 +1981,11 @@ int net_ads_check(void)
 	return -1;
 }
 
+int net_ads_check_our_domain(void)
+{
+	return -1;
+}
+
 int net_ads(int argc, const char **argv)
 {
 	return net_ads_usage(argc, argv);