r567: getting ready for 3.0.4 -- still holding for one more bug fix

52 files changed, 363 insertions, 392 deletions

diff --git a/packaging/Fedora/samba.spec.tmpl b/packaging/Fedora/samba.spec.tmpl
index ae6f95c9005..7f3b03d6cf0 100644
--- a/packaging/Fedora/samba.spec.tmpl
+++ b/packaging/Fedora/samba.spec.tmpl
@@ -146,7 +146,7 @@ cd ..
 
 # Install other stuff
 install -m644 %{SOURCE10} $RPM_BUILD_ROOT%{_sysconfdir}/samba/smb.conf
-install -m644 %{SOURCE8} $RPM_BUILD_ROOT/etc/samba/smbusers
+install -m644 %{SOURCE9} $RPM_BUILD_ROOT/etc/samba/smbusers
 install -m755 %{SOURCE8} $RPM_BUILD_ROOT%{_bindir}
 install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/pam.d/samba
 install -m644 %{SOURCE1} $RPM_BUILD_ROOT/etc/logrotate.d/samba
@@ -183,8 +183,8 @@ install -m 755 source/nsswitch/libnss_wins.so $RPM_BUILD_ROOT/%{_lib}/libnss_win
 # make install puts libsmbclient.so in the wrong place on x86_64
 rm -f $RPM_BUILD_ROOT/usr/lib || true
 mkdir -p $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_includedir}
-install -m 644 source/bin/libsmbclient.so $RPM_BUILD_ROOT%{_libdir}/libsmbclient.so
-install -m 644 source/bin/libsmbclient.a $RPM_BUILD_ROOT%{_libdir}/libsmbclient.a
+install -m 755 source/bin/libsmbclient.so $RPM_BUILD_ROOT%{_libdir}/libsmbclient.so
+install -m 755 source/bin/libsmbclient.a $RPM_BUILD_ROOT%{_libdir}/libsmbclient.a
 install -m 644 source/include/libsmbclient.h $RPM_BUILD_ROOT%{_includedir}
 
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/xinetd.d
diff --git a/source/include/debug.h b/source/include/debug.h
index 55f07d8a18e..52e06b9360b 100644
--- a/source/include/debug.h
+++ b/source/include/debug.h
@@ -93,6 +93,7 @@ extern int DEBUGLEVEL;
 #define DBGC_VFS		12
 #define DBGC_IDMAP		13
 #define DBGC_QUOTA		14
+#define DBGC_ACLS		15
 
 /* So you can define DBGC_CLASS before including debug.h */
 #ifndef DBGC_CLASS
diff --git a/source/include/fake_file.h b/source/include/fake_file.h
index 3fe60072e9e..cfcd16f6830 100644
--- a/source/include/fake_file.h
+++ b/source/include/fake_file.h
@@ -26,7 +26,11 @@ enum FAKE_FILE_TYPE {
 	FAKE_FILE_TYPE_QUOTA	
 };
 
+/*
+we now get the unix name --metze
 #define FAKE_FILE_NAME_QUOTA	"\\$Extend\\$Quota:$Q:$INDEX_ALLOCATION"
+*/
+#define FAKE_FILE_NAME_QUOTA	"$Extend/$Quota:$Q:$INDEX_ALLOCATION"
 
 typedef struct _FAKE_FILE_HANDLE {
 	enum FAKE_FILE_TYPE type;
diff --git a/source/include/rpc_samr.h b/source/include/rpc_samr.h
index 111e62c3553..089941de3aa 100644
--- a/source/include/rpc_samr.h
+++ b/source/include/rpc_samr.h
@@ -1740,9 +1740,8 @@ typedef struct r_samr_get_dom_pwinfo
 	 * turned out to 12.  3 uint32's + NT_STATUS == 16 bytes.  Tested
 	 * using NT and 2k.  --jerry
 	 */
-	uint32 unk_0;
+	uint16 unk_0;
 	uint32 unk_1;
-	uint32 unk_2;
 	NTSTATUS status;
 
 } SAMR_R_GET_DOM_PWINFO;
diff --git a/source/include/smb_macros.h b/source/include/smb_macros.h
index c3bdba30b15..e847714443a 100644
--- a/source/include/smb_macros.h
+++ b/source/include/smb_macros.h
@@ -171,9 +171,10 @@
 /* these are the datagram types */
 #define DGRAM_DIRECT_UNIQUE 0x10
 
-#define ERROR_DOS(class,code) error_packet(outbuf,NT_STATUS_OK,class,code,__LINE__,__FILE__)
-#define ERROR_NT(status) error_packet(outbuf,status,0,0,__LINE__,__FILE__)
-#define ERROR_BOTH(status,class,code) error_packet(outbuf,status,class,code,__LINE__,__FILE__)
+#define ERROR_DOS(class,code) error_packet(outbuf,NT_STATUS_OK,class,code,False,__LINE__,__FILE__)
+#define ERROR_FORCE_DOS(class,code) error_packet(outbuf,NT_STATUS_OK,class,code,True,__LINE__,__FILE__)
+#define ERROR_NT(status) error_packet(outbuf,status,0,0,False,__LINE__,__FILE__)
+#define ERROR_BOTH(status,class,code) error_packet(outbuf,status,class,code,False,__LINE__,__FILE__)
 
 /* this is how errors are generated */
 #define UNIXERROR(defclass,deferror) unix_error_packet(outbuf,defclass,deferror,__LINE__,__FILE__)
diff --git a/source/include/vfs.h b/source/include/vfs.h
index 8caf64fd99d..db766b985d9 100644
--- a/source/include/vfs.h
+++ b/source/include/vfs.h
@@ -41,6 +41,9 @@
  * This next constant specifies the version number of the VFS interface
  * this smbd will load. Increment this if *ANY* changes are made to the
  * vfs_ops below. JRA.
+ *
+ * If you change anything here, please also update modules/vfs_full_audit.c.
+ * VL.
  */
 
 /* Changed to version 2 for CIFS UNIX extensions (mknod and link added). JRA. */
diff --git a/source/lib/afs.c b/source/lib/afs.c
index ce972ec27b7..0830a3a0e7f 100644
--- a/source/lib/afs.c
+++ b/source/lib/afs.c
@@ -29,12 +29,6 @@
 #include <asm/unistd.h>
 #include <openssl/des.h>
 
-_syscall5(int, afs_syscall, int, subcall,
-	  char *, path,
-	  int, cmd,
-	  char *, cmarg,
-	  int, follow);
-
 struct ClearToken {
 	uint32 AuthHandle;
 	char HandShakeKey[8];
@@ -74,186 +68,6 @@ static char *afs_encode_token(const char *cell, const DATA_BLOB ticket,
 	return result;
 }
 
-static BOOL afs_decode_token(const char *string, char **cell,
-			     DATA_BLOB *ticket, struct ClearToken *ct)
-{
-	DATA_BLOB blob;
-	struct ClearToken result_ct;
-
-	char *s = strdup(string);
-
-	char *t;
-
-	if ((t = strtok(s, "\n")) == NULL) {
-		DEBUG(10, ("strtok failed\n"));
-		return False;
-	}
-
-	*cell = strdup(t);
-
-	if ((t = strtok(NULL, "\n")) == NULL) {
-		DEBUG(10, ("strtok failed\n"));
-		return False;
-	}
-
-	if (sscanf(t, "%u", &result_ct.AuthHandle) != 1) {
-		DEBUG(10, ("sscanf AuthHandle failed\n"));
-		return False;
-	}
-		
-	if ((t = strtok(NULL, "\n")) == NULL) {
-		DEBUG(10, ("strtok failed\n"));
-		return False;
-	}
-
-	blob = base64_decode_data_blob(t);
-
-	if ( (blob.data == NULL) ||
-	     (blob.length != sizeof(result_ct.HandShakeKey) )) {
-		DEBUG(10, ("invalid key: %x/%d\n", (uint32)blob.data,
-			   blob.length));
-		return False;
-	}
-
-	memcpy(result_ct.HandShakeKey, blob.data, blob.length);
-
-	data_blob_free(&blob);
-
-	if ((t = strtok(NULL, "\n")) == NULL) {
-		DEBUG(10, ("strtok failed\n"));
-		return False;
-	}
-
-	if (sscanf(t, "%u", &result_ct.ViceId) != 1) {
-		DEBUG(10, ("sscanf ViceId failed\n"));
-		return False;
-	}
-		
-	if ((t = strtok(NULL, "\n")) == NULL) {
-		DEBUG(10, ("strtok failed\n"));
-		return False;
-	}
-
-	if (sscanf(t, "%u", &result_ct.BeginTimestamp) != 1) {
-		DEBUG(10, ("sscanf BeginTimestamp failed\n"));
-		return False;
-	}
-		
-	if ((t = strtok(NULL, "\n")) == NULL) {
-		DEBUG(10, ("strtok failed\n"));
-		return False;
-	}
-
-	if (sscanf(t, "%u", &result_ct.EndTimestamp) != 1) {
-		DEBUG(10, ("sscanf EndTimestamp failed\n"));
-		return False;
-	}
-		
-	if ((t = strtok(NULL, "\n")) == NULL) {
-		DEBUG(10, ("strtok failed\n"));
-		return False;
-	}
-
-	blob = base64_decode_data_blob(t);
-
-	if (blob.data == NULL) {
-		DEBUG(10, ("Could not get ticket\n"));
-		return False;
-	}
-
-	*ticket = blob;
-	*ct = result_ct;
-
-	return True;
-}
-
-/*
-  Put an AFS token into the Kernel so that it can authenticate against
-  the AFS server. This assumes correct local uid settings.
-
-  This is currently highly Linux and OpenAFS-specific. The correct API
-  call for this would be ktc_SetToken. But to do that we would have to
-  import a REALLY big bunch of libraries which I would currently like
-  to avoid. 
-*/
-
-static BOOL afs_settoken(const char *cell,
-			 const struct ClearToken *ctok,
-			 DATA_BLOB ticket)
-{
-	int ret;
-	struct {
-		char *in, *out;
-		uint16 in_size, out_size;
-	} iob;
-
-	char buf[1024];
-	char *p = buf;
-	int tmp;
-
-	memcpy(p, &ticket.length, sizeof(uint32));
-	p += sizeof(uint32);
-	memcpy(p, ticket.data, ticket.length);
-	p += ticket.length;
-
-	tmp = sizeof(struct ClearToken);
-	memcpy(p, &tmp, sizeof(uint32));
-	p += sizeof(uint32);
-	memcpy(p, ctok, tmp);
-	p += tmp;
-
-	tmp = 0;
-
-	memcpy(p, &tmp, sizeof(uint32));
-	p += sizeof(uint32);
-
-	tmp = strlen(cell);
-	if (tmp >= MAXKTCREALMLEN) {
-		DEBUG(1, ("Realm too long\n"));
-		return False;
-	}
-
-	strncpy(p, cell, tmp);
-	p += tmp;
-	*p = 0;
-	p +=1;
-
-	iob.in = buf;
-	iob.in_size = PTR_DIFF(p,buf);
-	iob.out = buf;
-	iob.out_size = sizeof(buf);
-
-#if 0
-	file_save("/tmp/ioctlbuf", iob.in, iob.in_size);
-#endif
-
-	ret = afs_syscall(AFSCALL_PIOCTL, 0, VIOCSETTOK, (char *)&iob, 0);
-
-	DEBUG(10, ("afs VIOCSETTOK returned %d\n", ret));
-	return (ret == 0);
-}
-
-BOOL afs_settoken_str(const char *token_string)
-{
-	DATA_BLOB ticket;
-	struct ClearToken ct;
-	BOOL result;
-	char *cell;
-
-	if (!afs_decode_token(token_string, &cell, &ticket, &ct))
-		return False;
-
-	if (geteuid() != 0)
-		ct.ViceId = getuid();
-
-	result = afs_settoken(cell, &ct, ticket);
-
-	SAFE_FREE(cell);
-	data_blob_free(&ticket);
-
-	return result;
-	}
-
 /* Create a ClearToken and an encrypted ticket. ClearToken has not yet the
  * ViceId set, this should be set by the caller. */
 
@@ -391,6 +205,7 @@ BOOL afs_login(connection_struct *conn)
 	pstring afs_username;
 	char *cell;
 	BOOL result;
+	char *ticket_str;
 
 	struct ClearToken ct;
 
@@ -421,45 +236,11 @@ BOOL afs_login(connection_struct *conn)
 	/* For which Unix-UID do we want to set the token? */
 	ct.ViceId = getuid();
 
-	{
-		char *str, *new_cell;
-		DATA_BLOB test_ticket;
-		struct ClearToken test_ct;
-
-		hex_encode(ct.HandShakeKey, sizeof(ct.HandShakeKey), &str);
-		DEBUG(10, ("Key: %s\n", str));
-		free(str);
-
-		str = afs_encode_token(cell, ticket, &ct);
+	ticket_str = afs_encode_token(cell, ticket, &ct);
 
-		if (!afs_decode_token(str, &new_cell, &test_ticket,
-				      &test_ct)) {
-			DEBUG(0, ("Could not decode token"));
-			goto decode_failed;
-		}
+	result = afs_settoken_str(ticket_str);
 
-		if (strcmp(cell, new_cell) != 0) {
-			DEBUG(0, ("cell changed\n"));
-		}
-
-		if ((ticket.length != test_ticket.length) ||
-		    (memcmp(ticket.data, test_ticket.data,
-			    ticket.length) != 0)) {
-			DEBUG(0, ("Ticket changed\n"));
-		}
-
-		if (memcmp(&ct, &test_ct, sizeof(ct)) != 0) {
-			DEBUG(0, ("ClearToken changed\n"));
-		}
-
-		data_blob_free(&test_ticket);
-
-	decode_failed:
-		SAFE_FREE(str);
-		SAFE_FREE(new_cell);
-	}
-
-	result = afs_settoken(cell, &ct, ticket);
+	SAFE_FREE(ticket_str);
 
 	data_blob_free(&ticket);
 
@@ -473,11 +254,6 @@ BOOL afs_login(connection_struct *conn)
 	return True;
 }
 
-BOOL afs_settoken_str(const char *token_string)
-{
-	return False;
-}
-
 char *afs_createtoken_str(const char *username, const char *cell)
 {
 	return False;
diff --git a/source/lib/debug.c b/source/lib/debug.c
index 1a926053bb0..b0d8ff35230 100644
--- a/source/lib/debug.c
+++ b/source/lib/debug.c
@@ -163,6 +163,7 @@ static const char *default_classname_table[] = {
 	"vfs",		     /* DBGC_VFS	  */
 	"idmap",	     /* DBGC_IDMAP	  */
 	"quota",	     /* DBGC_QUOTA	  */
+	"acls",		     /* DBGC_QUOTA	  */
 	NULL
 };
 
@@ -208,8 +209,8 @@ static char *debug_list_class_names_and_levels(void)
 		dim += l;
 	}
 
-	/* create single string list */
-	b = buf = malloc(dim);
+	/* create single string list - add space for newline */
+	b = buf = malloc(dim+1);
 	if (!buf) {
 		err = True;
 		goto done;
@@ -219,7 +220,8 @@ static char *debug_list_class_names_and_levels(void)
 		strncpy(b, list[i], l);
 		b = b + l;
 	}
-	b[-1] = '\0';
+	b[-1] = '\n'; /* replace last space with newline */
+	b[0] = '\0';  /* null terminate string */
 
 done:
 	/* free strings list */
diff --git a/source/lib/system_smbd.c b/source/lib/system_smbd.c
index 7edc7ca98f9..55c2338ebd6 100644
--- a/source/lib/system_smbd.c
+++ b/source/lib/system_smbd.c
@@ -88,6 +88,10 @@ static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, in
 			groups[0] = gid;
 			*grpcnt = ret + 1;
 		}
+		
+		/* remove any duplicates gids in the list */
+
+		remove_duplicate_gids( grpcnt, groups );
 	}
 
 	restore_re_gid();
@@ -100,11 +104,6 @@ static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, in
 		return -1;
 	}
 	
-	/* this will remove any duplicates gids in the list and 
-	   update the group counter */
-	   
-	remove_duplicate_gids( grpcnt, groups );
-
 	free(gids_saved);
 	return ret;
 }
diff --git a/source/lib/util_sock.c b/source/lib/util_sock.c
index 845aaa4b13a..b6bfdca5cf9 100644
--- a/source/lib/util_sock.c
+++ b/source/lib/util_sock.c
@@ -33,7 +33,7 @@ static char *get_socket_addr(int fd)
 {
 	struct sockaddr sa;
 	struct sockaddr_in *sockin = (struct sockaddr_in *) (&sa);
-	int     length = sizeof(sa);
+	socklen_t length = sizeof(sa);
 	static fstring addr_buf;
 
 	fstrcpy(addr_buf,"0.0.0.0");
@@ -58,7 +58,8 @@ static char *get_socket_addr(int fd)
 
 BOOL is_a_socket(int fd)
 {
-	int v,l;
+	int v;
+	socklen_t l;
 	l = sizeof(int);
 	return(getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&v, &l) == 0);
 }
@@ -115,7 +116,8 @@ static const smb_socket_option socket_options[] = {
 
 static void print_socket_options(int s)
 {
-	int value, vlen = 4;
+	int value;
+	socklen_t vlen = 4;
 	const smb_socket_option *p = &socket_options[0];
 
 	/* wrapped in if statement to prevent streams leak in SCO Openserver 5.0 */
@@ -741,6 +743,7 @@ int open_socket_out(int type, struct in_addr *addr, int port ,int timeout)
 	if (ret < 0 && (errno == EINPROGRESS || errno == EALREADY ||
 			errno == EAGAIN) && (connect_loop < timeout) ) {
 		smb_msleep(connect_loop);
+		timeout -= connect_loop;
 		connect_loop += increment;
 		if (increment < 250) {
 			/* After 8 rounds we end up at a max of 255 msec */
@@ -837,7 +840,7 @@ char *client_socket_addr(void)
 struct in_addr *client_inaddr(struct sockaddr *sa)
 {
 	struct sockaddr_in *sockin = (struct sockaddr_in *) (sa);
-	int     length = sizeof(*sa);
+	socklen_t  length = sizeof(*sa);
 	
 	if (getpeername(client_fd, sa, &length) < 0) {
 		DEBUG(0,("getpeername failed. Error was %s\n", strerror(errno) ));
@@ -962,7 +965,7 @@ char *get_peer_addr(int fd)
 {
 	struct sockaddr sa;
 	struct sockaddr_in *sockin = (struct sockaddr_in *) (&sa);
-	int     length = sizeof(sa);
+	socklen_t length = sizeof(sa);
 	static fstring addr_buf;
 
 	fstrcpy(addr_buf,"0.0.0.0");
diff --git a/source/lib/util_uuid.c b/source/lib/util_uuid.c
index 4c35236c902..dc9bc920230 100644
--- a/source/lib/util_uuid.c
+++ b/source/lib/util_uuid.c
@@ -45,7 +45,7 @@ void smb_uuid_unpack(const UUID_FLAT in, struct uuid *uu)
 	memcpy(uu->node, in.info+10, 6);
 }
 
-const struct uuid smb_uuid_unpack_static(const UUID_FLAT in)
+struct uuid smb_uuid_unpack_static(const UUID_FLAT in)
 {
 	static struct uuid uu;
 
diff --git a/source/libads/kerberos.c b/source/libads/kerberos.c
index 70f6f3386c7..e8bf4b08462 100644
--- a/source/libads/kerberos.c
+++ b/source/libads/kerberos.c
@@ -56,9 +56,9 @@ kerb_prompter(krb5_context ctx, void *data,
 */
 int kerberos_kinit_password(const char *principal, const char *password, int time_offset, time_t *expire_time)
 {
-	krb5_context ctx;
+	krb5_context ctx = NULL;
 	krb5_error_code code = 0;
-	krb5_ccache cc;
+	krb5_ccache cc = NULL;
 	krb5_principal me;
 	krb5_creds my_creds;
 
@@ -142,8 +142,8 @@ int ads_kinit_password(ADS_STRUCT *ads)
 int ads_kdestroy(const char *cc_name)
 {
 	krb5_error_code code;
-	krb5_context ctx;
-	krb5_ccache cc;
+	krb5_context ctx = NULL;
+	krb5_ccache cc = NULL;
 
 	if ((code = krb5_init_context (&ctx))) {
 		DEBUG(3, ("ads_kdestroy: kdb5_init_context rc=%d\n", code));
diff --git a/source/libads/krb5_setpw.c b/source/libads/krb5_setpw.c
index 16d3df83e93..5c859f0e995 100644
--- a/source/libads/krb5_setpw.c
+++ b/source/libads/krb5_setpw.c
@@ -463,12 +463,12 @@ ADS_STATUS ads_krb5_set_password(const char *kdc_host, const char *princ,
 
 	ADS_STATUS aret;
 	krb5_error_code ret;
-	krb5_context context;
+	krb5_context context = NULL;
 	krb5_principal principal;
 	char *princ_name;
 	char *realm;
 	krb5_creds creds, *credsp;
-	krb5_ccache ccache;
+	krb5_ccache ccache = NULL;
 
 	ret = krb5_init_context(&context);
 	if (ret) {
@@ -578,7 +578,7 @@ static ADS_STATUS ads_krb5_chg_password(const char *kdc_host,
 {
     ADS_STATUS aret;
     krb5_error_code ret;
-    krb5_context context;
+    krb5_context context = NULL;
     krb5_principal princ;
     krb5_get_init_creds_opt opts;
     krb5_creds creds;
diff --git a/source/libads/ldap.c b/source/libads/ldap.c
index 20a36dfdf5c..e156857e96f 100644
--- a/source/libads/ldap.c
+++ b/source/libads/ldap.c
@@ -1984,15 +1984,17 @@ ADS_STATUS ads_server_info(ADS_STRUCT *ads)
 
 	value = ads_pull_string(ads, ctx, res, "ldapServiceName");
 	if (!value) {
+		ads_msgfree(ads, res);
 		return ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
 	}
 
 	timestr = ads_pull_string(ads, ctx, res, "currentTime");
 	if (!timestr) {
+		ads_msgfree(ads, res);
 		return ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
 	}
 
-	ldap_msgfree(res);
+	ads_msgfree(ads, res);
 
 	p = strchr(value, ':');
 	if (!p) {
@@ -2054,6 +2056,7 @@ ADS_STATUS ads_domain_sid(ADS_STRUCT *ads, DOM_SID *sid)
 			   attrs, &res);
 	if (!ADS_ERR_OK(rc)) return rc;
 	if (!ads_pull_sid(ads, res, "objectSid", sid)) {
+		ads_msgfree(ads, res);
 		return ADS_ERROR_SYSTEM(ENOENT);
 	}
 	ads_msgfree(ads, res);
diff --git a/source/libads/sasl.c b/source/libads/sasl.c
index 1ab71c6ee51..18cbb465887 100644
--- a/source/libads/sasl.c
+++ b/source/libads/sasl.c
@@ -29,12 +29,12 @@
 static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
 {
 	const char *mechs[] = {OID_NTLMSSP, NULL};
-	DATA_BLOB msg1;
+	DATA_BLOB msg1 = data_blob(NULL, 0);
 	DATA_BLOB blob, chal1, chal2, auth;
 	uint8 challenge[8];
 	uint8 nthash[24], lmhash[24], sess_key[16];
 	uint32 neg_flags;
-	struct berval cred, *scred;
+	struct berval cred, *scred = NULL;
 	ADS_STATUS status;
 	int rc;
 
@@ -70,6 +70,7 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
 	}
 
 	blob = data_blob(scred->bv_val, scred->bv_len);
+	ber_bvfree(scred);
 
 	/* the server gives us back two challenges */
 	if (!spnego_parse_challenge(blob, &chal1, &chal2)) {
@@ -105,15 +106,29 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
 
 	data_blob_free(&blob);
 
+	/* Remember to free the msg1 blob. The contents of this
+	   have been copied into cred and need freeing before reassignment. */
+	data_blob_free(&msg1);
+
 	/* now send the auth packet and we should be done */
 	cred.bv_val = (char *)auth.data;
 	cred.bv_len = auth.length;
 
 	rc = ldap_sasl_bind_s(ads->ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL, &scred);
 
+	ber_bvfree(scred);
+	data_blob_free(&auth);
+	
 	return ADS_ERROR(rc);
 
 failed:
+
+	/* Remember to free the msg1 blob. The contents of this
+	   have been copied into cred and need freeing. */
+	data_blob_free(&msg1);
+
+	if(scred)
+		ber_bvfree(scred);
 	return status;
 }
 
@@ -122,9 +137,9 @@ failed:
 */
 static ADS_STATUS ads_sasl_spnego_krb5_bind(ADS_STRUCT *ads, const char *principal)
 {
-	DATA_BLOB blob;
-	struct berval cred, *scred;
-	DATA_BLOB session_key;
+	DATA_BLOB blob = data_blob(NULL, 0);
+	struct berval cred, *scred = NULL;
+	DATA_BLOB session_key = data_blob(NULL, 0);
 	int rc;
 
 	rc = spnego_gen_negTokenTarg(principal, ads->auth.time_offset, &blob, &session_key);
@@ -141,6 +156,8 @@ static ADS_STATUS ads_sasl_spnego_krb5_bind(ADS_STRUCT *ads, const char *princip
 
 	data_blob_free(&blob);
 	data_blob_free(&session_key);
+	if(scred)
+		ber_bvfree(scred);
 
 	return ADS_ERROR(rc);
 }
@@ -154,7 +171,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
 	int rc, i;
 	ADS_STATUS status;
 	DATA_BLOB blob;
-	char *principal;
+	char *principal = NULL;
 	char *OIDs[ASN1_MAX_OIDS];
 	BOOL got_kerberos_mechanism = False;
 
@@ -197,8 +214,10 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
 	if (!(ads->auth.flags & ADS_AUTH_DISABLE_KERBEROS) &&
 	    got_kerberos_mechanism) {
 		status = ads_sasl_spnego_krb5_bind(ads, principal);
-		if (ADS_ERR_OK(status))
+		if (ADS_ERR_OK(status)) {
+			SAFE_FREE(principal);
 			return status;
+		}
 
 		status = ADS_ERROR_KRB5(ads_kinit_password(ads)); 
 
@@ -209,11 +228,14 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
 		/* only fallback to NTLMSSP if allowed */
 		if (ADS_ERR_OK(status) || 
 		    !(ads->auth.flags & ADS_AUTH_ALLOW_NTLMSSP)) {
+			SAFE_FREE(principal);
 			return status;
 		}
 	}
 #endif
 
+	SAFE_FREE(principal);
+
 	/* lets do NTLMSSP ... this has the big advantage that we don't need
 	   to sync clocks, and we don't rely on special versions of the krb5 
 	   library for HMAC_MD4 encryption */
@@ -242,7 +264,7 @@ static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads)
 	gss_buffer_desc output_token, input_token;
 	uint32 ret_flags, conf_state;
 	struct berval cred;
-	struct berval *scred;
+	struct berval *scred = NULL;
 	int i=0;
 	int gss_rc, rc;
 	uint8 *p;
@@ -251,7 +273,7 @@ static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads)
 	unsigned sec_layer;
 	ADS_STATUS status;
 	krb5_principal principal;
-	krb5_context ctx;
+	krb5_context ctx = NULL;
 	krb5_enctype enc_types[] = {
 #ifdef ENCTYPE_ARCFOUR_HMAC
 			ENCTYPE_ARCFOUR_HMAC,
@@ -385,6 +407,8 @@ static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads)
 	gss_release_buffer(&minor_status, &input_token);
 
 failed:
+	if(scred)
+		ber_bvfree(scred);
 	return status;
 }
 #endif
diff --git a/source/libsmb/cliconnect.c b/source/libsmb/cliconnect.c
index 06c9b5ea91a..afbd2079eac 100644
--- a/source/libsmb/cliconnect.c
+++ b/source/libsmb/cliconnect.c
@@ -421,9 +421,7 @@ static BOOL cli_session_setup_nt1(struct cli_state *cli, const char *user,
 end:	
 	data_blob_free(&lm_response);
 	data_blob_free(&nt_response);
-
-	if (!ret)
-		data_blob_free(&session_key);
+	data_blob_free(&session_key);
 	return ret;
 }
 
@@ -558,6 +556,7 @@ static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli, const char *
 	cli_set_session_key(cli, session_key_krb5);
 
 	data_blob_free(&negTokenTarg);
+	data_blob_free(&session_key_krb5);
 
 	if (cli_is_error(cli)) {
 		if (NT_STATUS_IS_OK(cli_nt_error(cli))) {
@@ -580,9 +579,9 @@ static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli, const char *use
 	NTSTATUS nt_status;
 	int turn = 1;
 	DATA_BLOB msg1;
-	DATA_BLOB blob;
+	DATA_BLOB blob = data_blob(NULL, 0);
 	DATA_BLOB blob_in = data_blob(NULL, 0);
-	DATA_BLOB blob_out;
+	DATA_BLOB blob_out = data_blob(NULL, 0);
 
 	cli_temp_set_signing(cli);
 
@@ -744,6 +743,8 @@ ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
 	 * and do not store results */
 
 	if (got_kerberos_mechanism && cli->use_kerberos) {
+		ADS_STATUS rc;
+
 		if (pass && *pass) {
 			int ret;
 			
@@ -751,16 +752,19 @@ ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
 			ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
 			
 			if (ret){
+				SAFE_FREE(principal);
 				DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
 				return ADS_ERROR_KRB5(ret);
 			}
 		}
 		
-		return cli_session_setup_kerberos(cli, principal, domain);
+		rc = cli_session_setup_kerberos(cli, principal, domain);
+		SAFE_FREE(principal);
+		return rc;
 	}
 #endif
 
-	free(principal);
+	SAFE_FREE(principal);
 
 ntlmssp:
 
diff --git a/source/libsmb/clientgen.c b/source/libsmb/clientgen.c
index 6edc83c9d79..b75d6be0a60 100644
--- a/source/libsmb/clientgen.c
+++ b/source/libsmb/clientgen.c
@@ -367,6 +367,9 @@ void cli_nt_netlogon_netsec_session_close(struct cli_state *cli)
 
 void cli_close_connection(struct cli_state *cli)
 {
+	cli_nt_session_close(cli);
+	cli_nt_netlogon_netsec_session_close(cli);
+
 	/*
 	 * tell our peer to free his resources.  Wihtout this, when an
 	 * application attempts to do a graceful shutdown and calls
@@ -382,9 +385,6 @@ void cli_close_connection(struct cli_state *cli)
 	if ( (cli->cnum != (uint16)-1) && (cli->smb_rw_error != DO_NOT_DO_TDIS ) )
 		cli_tdis(cli);
         
-	cli_nt_session_close(cli);
-	cli_nt_netlogon_netsec_session_close(cli);
-
 	SAFE_FREE(cli->outbuf);
 	SAFE_FREE(cli->inbuf);
 
diff --git a/source/libsmb/clierror.c b/source/libsmb/clierror.c
index c27e1955e20..ec0ca53a853 100644
--- a/source/libsmb/clierror.c
+++ b/source/libsmb/clierror.c
@@ -319,6 +319,9 @@ static struct {
 	{NT_STATUS_PORT_UNREACHABLE, EHOSTUNREACH},
 	{NT_STATUS_IO_TIMEOUT, ETIMEDOUT},
 	{NT_STATUS_RETRY, EAGAIN},
+#ifdef ENOTUNIQ
+	{NT_STATUS_DUPLICATE_NAME, ENOTUNIQ},
+#endif
 #ifdef ECOMM
 	{NT_STATUS_NET_WRITE_FAULT, ECOMM},
 #endif
diff --git a/source/libsmb/clikrb5.c b/source/libsmb/clikrb5.c
index 81797a7bfc0..9027f192ef7 100644
--- a/source/libsmb/clikrb5.c
+++ b/source/libsmb/clikrb5.c
@@ -359,8 +359,8 @@ int cli_krb5_get_ticket(const char *principal, time_t time_offset,
 {
 	krb5_error_code retval;
 	krb5_data packet;
-	krb5_ccache ccdef;
-	krb5_context context;
+	krb5_context context = NULL;
+	krb5_ccache ccdef = NULL;
 	krb5_auth_context auth_context = NULL;
 	krb5_enctype enc_types[] = {
 #ifdef ENCTYPE_ARCFOUR_HMAC
@@ -411,8 +411,17 @@ int cli_krb5_get_ticket(const char *principal, time_t time_offset,
 #endif
 
 failed:
-	if ( context )
+
+	if ( context ) {
+#if 0 	/* JERRY -- disabled since it causes heimdal 0.6.1rc3 to die 
+	   SuSE 9.1 Pro */
+		if (ccdef)
+			krb5_cc_close(context, ccdef);
+#endif
+		if (auth_context)
+			krb5_auth_con_free(context, auth_context);
 		krb5_free_context(context);
+	}
 		
 	return retval;
 }
diff --git a/source/libsmb/errormap.c b/source/libsmb/errormap.c
index aeb68b6596c..77c71fce13c 100644
--- a/source/libsmb/errormap.c
+++ b/source/libsmb/errormap.c
@@ -627,7 +627,7 @@ static const struct {
 	{ERRDOS,	ERRnoaccess,	NT_STATUS_ACCESS_DENIED},
 	{ERRDOS,	ERRbadfid,	NT_STATUS_INVALID_HANDLE},
 	{ERRDOS,	ERRnomem,	NT_STATUS_INSUFFICIENT_RESOURCES},
-	{ERRDOS,	ERRbadaccess,	NT_STATUS_INVALID_LOCK_SEQUENCE},
+	{ERRDOS,	ERRbadaccess,	NT_STATUS_ACCESS_DENIED},
 	{ERRDOS,	ERRbaddata,	NT_STATUS_DATA_ERROR},
 	{ERRDOS,	14,	NT_STATUS_SECTION_NOT_EXTENDED},
 	{ERRDOS,	ERRremcd,	NT_STATUS_DIRECTORY_NOT_EMPTY},
diff --git a/source/libsmb/libsmbclient.c b/source/libsmb/libsmbclient.c
index ebbf28a12db..f08d9440f96 100644
--- a/source/libsmb/libsmbclient.c
+++ b/source/libsmb/libsmbclient.c
@@ -1807,7 +1807,7 @@ static SMBCFILE *smbc_opendir_ctx(SMBCCTX *context, const char *fname)
                             server, sizeof(server),
                             share, sizeof(share),
                             path, sizeof(path),
-                            user, sizeof(path),
+                            user, sizeof(user),
                             password, sizeof(password),
                             options, sizeof(options))) {
 	        DEBUG(4, ("no valid path\n"));
@@ -1902,8 +1902,8 @@ static SMBCFILE *smbc_opendir_ctx(SMBCCTX *context, const char *fname)
                      * the first choice and fall back to MSBROWSE if the
                      * wildcard query fails.
                      */
-		    if (!name_status_find("*", 0, 0x1d, server_ip, server) &&
-                        !name_status_find(MSBROWSE, 1, 0x1d, server_ip, server)) {
+		    if (!name_status_find("*", 0, 0x20, server_ip, server) &&
+                        !name_status_find(MSBROWSE, 1, 0x1b, server_ip, server)) {
 			errno = ENOENT;
 			return NULL;
 		    }
@@ -1991,6 +1991,12 @@ static SMBCFILE *smbc_opendir_ctx(SMBCCTX *context, const char *fname)
                         DEBUG(99, ("Found master browser %s\n", inet_ntoa(ip_list[i].ip)));
                         
                         cli = get_ipc_connect_master_ip(&ip_list[i], workgroup, &u_info);
+
+			/* cli == NULL is the master browser refused to talk or 
+			   could not be found */
+			if ( !cli )
+				continue;
+
                         fstrcpy(server, cli->desthost);
                         cli_shutdown(cli);
 
diff --git a/source/libsmb/namequery_dc.c b/source/libsmb/namequery_dc.c
index 31d759e0d2c..0c9f19313cb 100644
--- a/source/libsmb/namequery_dc.c
+++ b/source/libsmb/namequery_dc.c
@@ -49,8 +49,10 @@ static BOOL ads_dc_name(const char *domain, const char *realm, struct in_addr *d
 	ads_connect(ads);
 #endif
 
-	if (!ads->config.realm)
+	if (!ads->config.realm) {
+		ads_destroy(&ads);
 		return False;
+	}
 
 	fstrcpy(srv_name, ads->config.ldap_server_name);
 	strupper_m(srv_name);
diff --git a/source/nsswitch/wb_client.c b/source/nsswitch/wb_client.c
index 5d431392450..a1c71becf03 100644
--- a/source/nsswitch/wb_client.c
+++ b/source/nsswitch/wb_client.c
@@ -270,6 +270,7 @@ static int wb_getgroups(const char *user, gid_t **groups)
 
 	/* Call winbindd */
 
+	ZERO_STRUCT(request);
 	fstrcpy(request.data.username, user);
 
 	ZERO_STRUCT(response);
diff --git a/source/nsswitch/winbindd_cache.c b/source/nsswitch/winbindd_cache.c
index e10fa2255c0..877fa2d995c 100644
--- a/source/nsswitch/winbindd_cache.c
+++ b/source/nsswitch/winbindd_cache.c
@@ -276,6 +276,8 @@ static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 	domain->sequence_number = IVAL(data.dptr, 0);
 	domain->last_seq_check  = IVAL(data.dptr, 4);
 	
+	SAFE_FREE(data.dptr);
+
 	/* have we expired? */
 	
 	time_diff = now - domain->last_seq_check;
diff --git a/source/nsswitch/winbindd_group.c b/source/nsswitch/winbindd_group.c
index 4800ab20cfa..7b4529144e2 100644
--- a/source/nsswitch/winbindd_group.c
+++ b/source/nsswitch/winbindd_group.c
@@ -631,6 +631,9 @@ enum winbindd_result winbindd_getgrent(struct winbindd_cli_state *state)
 	     malloc(num_groups * sizeof(struct winbindd_gr))) == NULL)
 		return WINBINDD_ERROR;
 
+	memset(state->response.extra_data, '\0',
+		num_groups * sizeof(struct winbindd_gr) );
+
 	state->response.data.num_entries = 0;
 
 	group_list = (struct winbindd_gr *)state->response.extra_data;
diff --git a/source/nsswitch/winbindd_pam.c b/source/nsswitch/winbindd_pam.c
index c1840b60533..25f53e7a535 100644
--- a/source/nsswitch/winbindd_pam.c
+++ b/source/nsswitch/winbindd_pam.c
@@ -48,6 +48,7 @@ static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
 		prs_mem_free(&ps);
 		return NT_STATUS_NO_MEMORY;
 	}
+	memset( state->response.extra_data, '\0', size );
 	prs_copy_all_data_out(state->response.extra_data, &ps);
 	state->response.length += size;
 	prs_mem_free(&ps);
diff --git a/source/nsswitch/winbindd_user.c b/source/nsswitch/winbindd_user.c
index 40c398755d1..c691705f9c0 100644
--- a/source/nsswitch/winbindd_user.c
+++ b/source/nsswitch/winbindd_user.c
@@ -94,6 +94,8 @@ static BOOL winbindd_fill_pwent(char *dom_name, char *user_name,
 	safe_strcpy(pw->pw_shell, shell, 
 		    sizeof(pw->pw_shell) - 1);
 	
+	SAFE_FREE(shell);
+
 	/* Password - set to "x" as we can't generate anything useful here.
 	   Authentication can be done using the pam_winbind module. */
 
diff --git a/source/nsswitch/winbindd_wins.c b/source/nsswitch/winbindd_wins.c
index 59d600d1eaa..6b37e5bcf45 100644
--- a/source/nsswitch/winbindd_wins.c
+++ b/source/nsswitch/winbindd_wins.c
@@ -106,6 +106,7 @@ static struct in_addr *lookup_byname_backend(const char *name, int *count)
 		for ( i=0; i<(*count); i++ ) 
 			return_ip[i] = ret[i].ip;
 		
+		free( ret );
 		return return_ip;
 	}
 
diff --git a/source/passdb/passdb.c b/source/passdb/passdb.c
index 7ccb35c3f4b..8313a259bd2 100644
--- a/source/passdb/passdb.c
+++ b/source/passdb/passdb.c
@@ -1177,6 +1177,24 @@ BOOL local_sid_to_uid(uid_t *puid, const DOM_SID *psid, enum SID_NAME_USE *name_
 }
 
 /****************************************************************************
+ Convert a gid to SID - algorithmic.
+****************************************************************************/
+
+DOM_SID *algorithmic_gid_to_sid(DOM_SID *psid, uid_t gid)
+{
+	if ( !lp_enable_rid_algorithm() )
+		return NULL;
+
+	DEBUG(8,("algorithmic_gid_to_sid: falling back to RID algorithm\n"));
+	sid_copy( psid, get_global_sam_sid() );
+	sid_append_rid( psid, pdb_gid_to_group_rid(gid) );
+	DEBUG(10,("algorithmic_gid_to_sid:  gid (%d) -> SID %s.\n",
+		(unsigned int)gid, sid_string_static(psid) ));
+
+	return psid;
+}
+
+/****************************************************************************
  Convert a gid to SID - locally.
 ****************************************************************************/
 
@@ -1199,13 +1217,11 @@ DOM_SID *local_gid_to_sid(DOM_SID *psid, gid_t gid)
 		/* fallback to rid mapping if enabled */
 
 		if ( lp_enable_rid_algorithm() ) {
-			sid_copy(psid, get_global_sam_sid());
-			sid_append_rid(psid, pdb_gid_to_group_rid(gid));
 
 			DEBUG(10,("local_gid_to_sid: Fall back to algorithmic mapping: %u -> %s\n", 
 				(unsigned int)gid, sid_string_static(psid)));
 				
-			return psid;
+			return algorithmic_gid_to_sid(psid, gid);
 		}
 		else
 			return NULL;
@@ -1253,7 +1269,7 @@ BOOL local_sid_to_gid(gid_t *pgid, const DOM_SID *psid, enum SID_NAME_USE *name_
 			}
 
 			if (!sid_peek_rid(psid, &rid)) {
-				DEBUG(10,("local_sid_to_uid: invalid SID!\n"));
+				DEBUG(10,("local_sid_to_gid: invalid SID!\n"));
 					return False;
 			}
 
diff --git a/source/printing/nt_printing.c b/source/printing/nt_printing.c
index 675794c4c27..0670b2543eb 100644
--- a/source/printing/nt_printing.c
+++ b/source/printing/nt_printing.c
@@ -368,6 +368,19 @@ BOOL nt_printing_init(void)
 }
 
 /*******************************************************************
+ Function to allow filename parsing "the old way".
+********************************************************************/
+
+static BOOL driver_unix_convert(char *name,connection_struct *conn,
+		char *saved_last_component, BOOL *bad_path, SMB_STRUCT_STAT *pst)
+{
+	unix_format(name);
+	unix_clean_name(name);
+	trim_string(name,"/","/");
+	return unix_convert(name, conn, saved_last_component, bad_path, pst);
+}
+
+/*******************************************************************
  tdb traversal function for counting printers.
 ********************************************************************/
 
@@ -987,7 +1000,7 @@ static int file_version_is_newer(connection_struct *conn, fstring new_file, fstr
 	/* Get file version info (if available) for previous file (if it exists) */
 	pstrcpy(filepath, old_file);
 
-	unix_convert(filepath,conn,NULL,&bad_path,&stat_buf);
+	driver_unix_convert(filepath,conn,NULL,&bad_path,&stat_buf);
 
 	fsp = open_file_shared(conn, filepath, &stat_buf,
 						   SET_OPEN_MODE(DOS_OPEN_RDONLY),
@@ -1016,7 +1029,7 @@ static int file_version_is_newer(connection_struct *conn, fstring new_file, fstr
 
 	/* Get file version info (if available) for new file */
 	pstrcpy(filepath, new_file);
-	unix_convert(filepath,conn,NULL,&bad_path,&stat_buf);
+	driver_unix_convert(filepath,conn,NULL,&bad_path,&stat_buf);
 
 	fsp = open_file_shared(conn, filepath, &stat_buf,
 						   SET_OPEN_MODE(DOS_OPEN_RDONLY),
@@ -1132,7 +1145,7 @@ static uint32 get_correct_cversion(const char *architecture, fstring driverpath_
 	 * deriver the cversion. */
 	slprintf(driverpath, sizeof(driverpath)-1, "%s/%s", architecture, driverpath_in);
 
-	unix_convert(driverpath,conn,NULL,&bad_path,&st);
+	driver_unix_convert(driverpath,conn,NULL,&bad_path,&st);
 
 	fsp = open_file_shared(conn, driverpath, &st,
 						   SET_OPEN_MODE(DOS_OPEN_RDONLY),
@@ -1403,6 +1416,8 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 	pstring inbuf;
 	pstring outbuf;
 	fstring res_type;
+	BOOL bad_path;
+	SMB_STRUCT_STAT st;
 	int ver = 0;
 	int i;
 
@@ -1454,6 +1469,7 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 	 */
 	DEBUG(5,("Creating first directory\n"));
 	slprintf(new_dir, sizeof(new_dir)-1, "%s/%d", architecture, driver->cversion);
+	driver_unix_convert(new_dir, conn, NULL, &bad_path, &st);
 	mkdir_internal(conn, new_dir);
 
 	/* For each driver file, archi\filexxx.yyy, if there is a duplicate file
@@ -1480,6 +1496,7 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 		slprintf(old_name, sizeof(old_name)-1, "%s/%s", new_dir, driver->driverpath);	
 		if (ver != -1 && (ver=file_version_is_newer(conn, new_name, old_name)) > 0) {
 			NTSTATUS status;
+			driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
 			status = rename_internals(conn, new_name, old_name, 0, True);
 			if (!NT_STATUS_IS_OK(status)) {
 				DEBUG(0,("move_driver_to_download_area: Unable to rename [%s] to [%s]\n",
@@ -1488,9 +1505,10 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 				unlink_internals(conn, 0, new_name);
 				ver = -1;
 			}
-		}
-		else
+		} else {
+			driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
 			unlink_internals(conn, 0, new_name);
+		}
 	}
 
 	if (driver->datafile && strlen(driver->datafile)) {
@@ -1499,6 +1517,7 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 			slprintf(old_name, sizeof(old_name)-1, "%s/%s", new_dir, driver->datafile);	
 			if (ver != -1 && (ver=file_version_is_newer(conn, new_name, old_name)) > 0) {
 				NTSTATUS status;
+				driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
 				status = rename_internals(conn, new_name, old_name, 0, True);
 				if (!NT_STATUS_IS_OK(status)) {
 					DEBUG(0,("move_driver_to_download_area: Unable to rename [%s] to [%s]\n",
@@ -1507,9 +1526,10 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 					unlink_internals(conn, 0, new_name);
 					ver = -1;
 				}
-			}
-			else
+			} else {
+				driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
 				unlink_internals(conn, 0, new_name);
+			}
 		}
 	}
 
@@ -1520,6 +1540,7 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 			slprintf(old_name, sizeof(old_name)-1, "%s/%s", new_dir, driver->configfile);	
 			if (ver != -1 && (ver=file_version_is_newer(conn, new_name, old_name)) > 0) {
 				NTSTATUS status;
+				driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
 				status = rename_internals(conn, new_name, old_name, 0, True);
 				if (!NT_STATUS_IS_OK(status)) {
 					DEBUG(0,("move_driver_to_download_area: Unable to rename [%s] to [%s]\n",
@@ -1528,9 +1549,10 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 					unlink_internals(conn, 0, new_name);
 					ver = -1;
 				}
-			}
-			else
+			} else {
+				driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
 				unlink_internals(conn, 0, new_name);
+			}
 		}
 	}
 
@@ -1542,6 +1564,7 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 			slprintf(old_name, sizeof(old_name)-1, "%s/%s", new_dir, driver->helpfile);	
 			if (ver != -1 && (ver=file_version_is_newer(conn, new_name, old_name)) > 0) {
 				NTSTATUS status;
+				driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
 				status = rename_internals(conn, new_name, old_name, 0, True);
 				if (!NT_STATUS_IS_OK(status)) {
 					DEBUG(0,("move_driver_to_download_area: Unable to rename [%s] to [%s]\n",
@@ -1550,9 +1573,10 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 					unlink_internals(conn, 0, new_name);
 					ver = -1;
 				}
-			}
-			else
+			} else {
+				driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
 				unlink_internals(conn, 0, new_name);
+			}
 		}
 	}
 
@@ -1573,6 +1597,7 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 				slprintf(old_name, sizeof(old_name)-1, "%s/%s", new_dir, driver->dependentfiles[i]);	
 				if (ver != -1 && (ver=file_version_is_newer(conn, new_name, old_name)) > 0) {
 					NTSTATUS status;
+					driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
 					status = rename_internals(conn, new_name, old_name, 0, True);
 					if (!NT_STATUS_IS_OK(status)) {
 						DEBUG(0,("move_driver_to_download_area: Unable to rename [%s] to [%s]\n",
@@ -1581,9 +1606,10 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 						unlink_internals(conn, 0, new_name);
 						ver = -1;
 					}
-				}
-				else
+				} else {
+					driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
 					unlink_internals(conn, 0, new_name);
+				}
 			}
 		NextDriver: ;
 		}
@@ -2692,14 +2718,13 @@ static WERROR publish_it(NT_PRINTER_INFO_LEVEL *printer)
 	
 	/* retreive the guid and store it locally */
 	if (ADS_ERR_OK(ads_search_dn(ads, &res, prt_dn, attrs))) {
-		ads_memfree(ads, prt_dn);
 		ads_pull_guid(ads, res, &guid);
 		ads_msgfree(ads, res);
 		store_printer_guid(printer->info_2, guid);
 		win_rc = mod_a_printer(*printer, 2);
 	} 
 
-	safe_free(prt_dn);
+	SAFE_FREE(prt_dn);
 	ads_destroy(&ads);
 
 	return WERR_OK;
@@ -3030,6 +3055,7 @@ static int unpack_values(NT_PRINTER_DATA *printer_data, char *buf, int buflen)
 	
 		/* check to see if there are any more registry values */
 		
+		regval_p = NULL;
 		len += tdb_unpack(buf+len, buflen-len, "p", &regval_p);		
 		if ( !regval_p ) 
 			break;
@@ -4410,6 +4436,8 @@ static BOOL delete_driver_files( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info_3, struct
 	DATA_BLOB null_pw;
 	NTSTATUS nt_status;
 	fstring res_type;
+	BOOL bad_path;
+	SMB_STRUCT_STAT  st;
 
 	if ( !info_3 )
 		return False;
@@ -4445,6 +4473,7 @@ static BOOL delete_driver_files( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info_3, struct
 	
 	if ( *info_3->driverpath ) {
 		if ( (s = strchr( &info_3->driverpath[1], '\\' )) != NULL ) {
+			driver_unix_convert(s, conn, NULL, &bad_path, &st);
 			DEBUG(10,("deleting driverfile [%s]\n", s));
 			unlink_internals(conn, 0, s);
 		}
@@ -4452,6 +4481,7 @@ static BOOL delete_driver_files( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info_3, struct
 		
 	if ( *info_3->configfile ) {
 		if ( (s = strchr( &info_3->configfile[1], '\\' )) != NULL ) {
+			driver_unix_convert(s, conn, NULL, &bad_path, &st);
 			DEBUG(10,("deleting configfile [%s]\n", s));
 			unlink_internals(conn, 0, s);
 		}
@@ -4459,6 +4489,7 @@ static BOOL delete_driver_files( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info_3, struct
 	
 	if ( *info_3->datafile ) {
 		if ( (s = strchr( &info_3->datafile[1], '\\' )) != NULL ) {
+			driver_unix_convert(s, conn, NULL, &bad_path, &st);
 			DEBUG(10,("deleting datafile [%s]\n", s));
 			unlink_internals(conn, 0, s);
 		}
@@ -4466,6 +4497,7 @@ static BOOL delete_driver_files( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info_3, struct
 	
 	if ( *info_3->helpfile ) {
 		if ( (s = strchr( &info_3->helpfile[1], '\\' )) != NULL ) {
+			driver_unix_convert(s, conn, NULL, &bad_path, &st);
 			DEBUG(10,("deleting helpfile [%s]\n", s));
 			unlink_internals(conn, 0, s);
 		}
@@ -4480,6 +4512,7 @@ static BOOL delete_driver_files( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info_3, struct
 			/* bypass the "\print$" portion of the path */
 			
 			if ( (file = strchr( info_3->dependentfiles[i]+1, '\\' )) != NULL ) {
+				driver_unix_convert(file, conn, NULL, &bad_path, &st);
 				DEBUG(10,("deleting dependent file [%s]\n", file));
 				unlink_internals(conn, 0, file );
 			}
@@ -4987,4 +5020,3 @@ BOOL print_time_access_check(int snum)
 
 	return ok;
 }
-
diff --git a/source/printing/printing.c b/source/printing/printing.c
index e4ef1f52d0e..2355dd14506 100644
--- a/source/printing/printing.c
+++ b/source/printing/printing.c
@@ -249,7 +249,7 @@ static TDB_DATA print_key(uint32 jobid)
 	static uint32 j;
 	TDB_DATA ret;
 
-	j = jobid;
+	SIVAL(&j, 0, jobid);
 	ret.dptr = (void *)&j;
 	ret.dsize = sizeof(j);
 	return ret;
@@ -358,9 +358,9 @@ static int unixjob_traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA key,
 		return 0;
 
 	if (*sysjob == pjob->sysjob) {
-		uint32 *jobid = (uint32 *)key.dptr;
+		uint32 jobid = IVAL(key.dptr,0);
 
-		sysjob_to_jobid_value = *jobid;
+		sysjob_to_jobid_value = jobid;
 		return 1;
 	}
 
@@ -1905,10 +1905,12 @@ static BOOL allocate_print_jobid(struct tdb_print_db *pdb, int snum, const char
 static BOOL add_to_jobs_changed(struct tdb_print_db *pdb, uint32 jobid)
 {
 	TDB_DATA data, key;
+	uint32 store_jobid;
 
 	key.dptr = "INFO/jobs_changed";
 	key.dsize = strlen(key.dptr);
-	data.dptr = (char *)&jobid;
+	SIVAL(&store_jobid, 0, jobid);
+	data.dptr = (char *)&store_jobid;
 	data.dsize = 4;
 
 	DEBUG(10,("add_to_jobs_changed: Added jobid %u\n", (unsigned int)jobid ));
diff --git a/source/rpc_client/cli_samr.c b/source/rpc_client/cli_samr.c
index bcb4cb41054..86f65056897 100644
--- a/source/rpc_client/cli_samr.c
+++ b/source/rpc_client/cli_samr.c
@@ -2095,7 +2095,7 @@ NTSTATUS cli_samr_query_sec_obj(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 /* Get domain password info */
 
 NTSTATUS cli_samr_get_dom_pwinfo(struct cli_state *cli, TALLOC_CTX *mem_ctx,
-				 uint16 *unk_0, uint16 *unk_1, uint16 *unk_2)
+				 uint16 *unk_0, uint16 *unk_1)
 {
 	prs_struct qbuf, rbuf;
 	SAMR_Q_GET_DOM_PWINFO q;
@@ -2134,8 +2134,6 @@ NTSTATUS cli_samr_get_dom_pwinfo(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 			*unk_0 = r.unk_0;
 		if (unk_1)
 			*unk_1 = r.unk_1;
-		if (unk_2)
-			*unk_2 = r.unk_2;
 	}
 
  done:
diff --git a/source/rpc_parse/parse_samr.c b/source/rpc_parse/parse_samr.c
index 287dc3bd7f2..85eedc7baab 100644
--- a/source/rpc_parse/parse_samr.c
+++ b/source/rpc_parse/parse_samr.c
@@ -6928,11 +6928,11 @@ BOOL samr_io_r_get_dom_pwinfo(const char *desc, SAMR_R_GET_DOM_PWINFO * r_u,
 	 * what they are, but the length is important for the singing
 	*/
 
-	if(!prs_uint32("unk_0", ps, depth, &r_u->unk_0))
+	if(!prs_uint16("unk_0", ps, depth, &r_u->unk_0))
 		return False;
-	if(!prs_uint32("unk_1", ps, depth, &r_u->unk_1))
+	if(!prs_align(ps))
 		return False;
-	if(!prs_uint32("unk_2", ps, depth, &r_u->unk_2))
+	if(!prs_uint32("unk_1", ps, depth, &r_u->unk_1))
 		return False;
 
 	if(!prs_ntstatus("status", ps, depth, &r_u->status))
diff --git a/source/rpc_server/srv_pipe.c b/source/rpc_server/srv_pipe.c
index ad7c544b681..3a4e0852769 100644
--- a/source/rpc_server/srv_pipe.c
+++ b/source/rpc_server/srv_pipe.c
@@ -87,6 +87,7 @@ BOOL create_next_pdu(pipes_struct *p)
 	RPC_HDR_RESP hdr_resp;
 	BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
 	BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
+	uint32 ss_padding_len = 0;
 	uint32 data_len;
 	uint32 data_space_available;
 	uint32 data_len_left;
@@ -109,21 +110,22 @@ BOOL create_next_pdu(pipes_struct *p)
 	p->hdr.pkt_type = RPC_RESPONSE;
 
 	/* Set up rpc header flags. */
-	if (p->out_data.data_sent_length == 0)
+	if (p->out_data.data_sent_length == 0) {
 		p->hdr.flags = RPC_FLG_FIRST;
-	else
+	} else {
 		p->hdr.flags = 0;
+	}
 
 	/*
 	 * Work out how much we can fit in a single PDU.
 	 */
 
 	data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
-	if(p->ntlmssp_auth_validated)
+	if(p->ntlmssp_auth_validated) {
 		data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
-
-	if(p->netsec_auth_validated)
+	} else if(p->netsec_auth_validated) {
 		data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_CHK_LEN);
+	}
 
 	/*
 	 * The amount we send is the minimum of the available
@@ -151,15 +153,30 @@ BOOL create_next_pdu(pipes_struct *p)
 	hdr_resp.alloc_hint = data_len_left;
 
 	/*
+	 * Work out if this PDU will be the last.
+	 */
+
+	if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
+		p->hdr.flags |= RPC_FLG_LAST;
+		if ((auth_seal || auth_verify) && (data_len_left % 8)) {
+			ss_padding_len = 8 - (data_len_left % 8);
+			DEBUG(10,("create_next_pdu: adding sign/seal padding of %u\n",
+				ss_padding_len ));
+		}
+	}
+
+	/*
 	 * Set up the header lengths.
 	 */
 
 	if (p->ntlmssp_auth_validated) {
-		p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
-					RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
+		p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
+			data_len + ss_padding_len +
+			RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 		p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 	} else if (p->netsec_auth_validated) {
-		p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
+		p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
+			data_len + ss_padding_len +
 			RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_CHK_LEN;
 		p->hdr.auth_len = RPC_AUTH_NETSEC_CHK_LEN;
 	} else {
@@ -168,13 +185,6 @@ BOOL create_next_pdu(pipes_struct *p)
 	}
 
 	/*
-	 * Work out if this PDU will be the last.
-	 */
-
-	if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
-		p->hdr.flags |= RPC_FLG_LAST;
-
-	/*
 	 * Init the parse struct to point at the outgoing
 	 * data.
 	 */
@@ -206,12 +216,26 @@ BOOL create_next_pdu(pipes_struct *p)
 		return False;
 	}
 
+	/* Copy the sign/seal padding data. */
+	if (ss_padding_len) {
+		char pad[8];
+		memset(pad, '\0', 8);
+		if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
+			DEBUG(0,("create_next_pdu: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
+			prs_mem_free(&outgoing_pdu);
+			return False;
+		}
+	}
+
 	if (p->ntlmssp_auth_validated) {
+		/*
+		 * NTLMSSP processing. Mutually exclusive with Schannel.
+		 */
 		uint32 crc32 = 0;
 		char *data;
 
 		DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
-			 BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
+			 BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len + ss_padding_len, p->hdr.auth_len));
 
 		/*
 		 * Set data to point to where we copied the data into.
@@ -220,15 +244,16 @@ BOOL create_next_pdu(pipes_struct *p)
 		data = prs_data_p(&outgoing_pdu) + data_pos;
 
 		if (auth_seal) {
-			crc32 = crc32_calc_buffer(data, data_len);
-			NTLMSSPcalc_p(p, (uchar*)data, data_len);
+			crc32 = crc32_calc_buffer(data, data_len + ss_padding_len);
+			NTLMSSPcalc_p(p, (uchar*)data, data_len + ss_padding_len);
 		}
 
 		if (auth_seal || auth_verify) {
 			RPC_HDR_AUTH auth_info;
 
-			init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, auth_info.auth_level,
-					(auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
+			init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE,
+					auth_seal ? RPC_PIPE_AUTH_SEAL_LEVEL : RPC_PIPE_AUTH_SIGN_LEVEL,
+					(auth_verify ? ss_padding_len : 0), (auth_verify ? 1 : 0));
 			if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 				DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 				prs_mem_free(&outgoing_pdu);
@@ -251,9 +276,10 @@ BOOL create_next_pdu(pipes_struct *p)
 			}
 			NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 		}
-	}
-
-	if (p->netsec_auth_validated) {
+	} else if (p->netsec_auth_validated) {
+		/*
+		 * Schannel processing. Mutually exclusive with NTLMSSP.
+		 */
 		int auth_type, auth_level;
 		char *data;
 		RPC_HDR_AUTH auth_info;
@@ -267,7 +293,7 @@ BOOL create_next_pdu(pipes_struct *p)
 
 		get_auth_type_level(p->netsec_auth.auth_flags, &auth_type, &auth_level);
 		init_rpc_hdr_auth(&auth_info, auth_type, auth_level, 
-				  RPC_HDR_AUTH_LEN, 1);
+				  ss_padding_len, 1);
 
 		if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 			DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
@@ -281,7 +307,7 @@ BOOL create_next_pdu(pipes_struct *p)
 		netsec_encode(&p->netsec_auth, 
 			      p->netsec_auth.auth_flags,
 			      SENDER_IS_ACCEPTOR,
-			      &verf, data, data_len);
+			      &verf, data, data_len + ss_padding_len);
 
 		smb_io_rpc_auth_netsec_chk("", &verf, &outgoing_pdu, 0);
 
diff --git a/source/rpc_server/srv_samr_util.c b/source/rpc_server/srv_samr_util.c
index dd92e0d90a3..417a712036a 100644
--- a/source/rpc_server/srv_samr_util.c
+++ b/source/rpc_server/srv_samr_util.c
@@ -52,7 +52,8 @@ void copy_id20_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_20 *from)
 		old_string = pdb_get_munged_dial(to);
 		mung.length = from->hdr_munged_dial.uni_str_len;
 		mung.data = (uint8 *) from->uni_munged_dial.buffer;
-		new_string = base64_encode_data_blob(mung);
+		new_string = (mung.length == 0) ?
+			NULL : base64_encode_data_blob(mung);
 		DEBUG(10,("INFO_20 UNI_MUNGED_DIAL: %s -> %s\n",old_string, new_string));
 		if (STRING_CHANGED_NC(old_string,new_string))
 			pdb_set_munged_dial(to   , new_string, PDB_CHANGED);
@@ -210,7 +211,8 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from)
 		old_string = pdb_get_munged_dial(to);
 		mung.length = from->hdr_munged_dial.uni_str_len;
 		mung.data = (uint8 *) from->uni_munged_dial.buffer;
-		newstr = base64_encode_data_blob(mung);
+		newstr = (mung.length == 0) ?
+			NULL : base64_encode_data_blob(mung);
 		DEBUG(10,("INFO_21 UNI_MUNGED_DIAL: %s -> %s\n",old_string, newstr));
 		if (STRING_CHANGED_NC(old_string,newstr))
 			pdb_set_munged_dial(to   , newstr, PDB_CHANGED);
@@ -439,7 +441,8 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from)
 		old_string = pdb_get_munged_dial(to);
 		mung.length = from->hdr_munged_dial.uni_str_len;
 		mung.data = (uint8 *) from->uni_munged_dial.buffer;
-		newstr = base64_encode_data_blob(mung);
+		newstr = (mung.length == 0) ?
+			NULL : base64_encode_data_blob(mung);
 		DEBUG(10,("INFO_23 UNI_MUNGED_DIAL: %s -> %s\n",old_string, newstr));
 		if (STRING_CHANGED_NC(old_string, newstr))
 			pdb_set_munged_dial(to   , newstr, PDB_CHANGED);
diff --git a/source/rpcclient/cmd_samr.c b/source/rpcclient/cmd_samr.c
index ed06a5a4a07..6ab08e1991b 100644
--- a/source/rpcclient/cmd_samr.c
+++ b/source/rpcclient/cmd_samr.c
@@ -1470,19 +1470,18 @@ static NTSTATUS cmd_samr_get_dom_pwinfo(struct cli_state *cli,
 					int argc, const char **argv) 
 {
 	NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
-	uint16 unk_0, unk_1, unk_2;
+	uint16 unk_0, unk_1;
 
 	if (argc != 1) {
 		printf("Usage: %s\n", argv[0]);
 		return NT_STATUS_OK;
 	}
 
-	result = cli_samr_get_dom_pwinfo(cli, mem_ctx, &unk_0, &unk_1, &unk_2);
+	result = cli_samr_get_dom_pwinfo(cli, mem_ctx, &unk_0, &unk_1) ;
 	
 	if (NT_STATUS_IS_OK(result)) {
 		printf("unk_0 = 0x%08x\n", unk_0);
 		printf("unk_1 = 0x%08x\n", unk_1);
-		printf("unk_2 = 0x%08x\n", unk_2);
 	}
 
 	return result;
diff --git a/source/script/installswat.sh b/source/script/installswat.sh
index 495386e0b7a..67586a89674 100755
--- a/source/script/installswat.sh
+++ b/source/script/installswat.sh
@@ -75,28 +75,41 @@ done
 
 if [ -d $SRCDIR../docs/htmldocs/ ]; then
 
-    for f in $SRCDIR../docs/htmldocs/*.html; do
-	FNAME=$SWATDIR/help/`basename $f`
-	echo $FNAME
-	cp $f $FNAME || echo Cannot install $FNAME. Does $USER have privileges?
-	chmod 0644 $FNAME
-    done
+    for dir in htmldocs/ htmldocs/howto htmldocs/guide htmldocs/devel
+    do 
+    
+      if [ ! -d $SRCDIR../docs/$dir ]; then
+        continue
+      fi
+      
+      INSTALLDIR=$SWATDIR/help/`echo $dir | sed 's/htmldocs\///g'`
+      if [ ! -d $INSTALLDIR ]; then
+        mkdir $INSTALLDIR
+      fi
 
-    if [ -d $SRCDIR../docs/htmldocs/images/ ]; then
-        if [ ! -d $SWATDIR/help/images/ ]; then
-            mkdir $SWATDIR/help/images
-            if [ ! -d $SWATDIR/help/images/ ]; then
-                echo Failed to make directory $SWATDIR/help/images, does $USER have privileges?
-                exit 1
-            fi
-        fi
-        for f in $SRCDIR../docs/htmldocs/images/*.png; do
-            FNAME=$SWATDIR/help/images/`basename $f`
-            echo $FNAME
-            cp $f $FNAME || echo Cannot install $FNAME. Does $USER have privileges?
-            chmod 0644 $FNAME
-        done
-    fi
+      for f in $SRCDIR../docs/$dir/*.html; do
+	  FNAME=$INSTALLDIR/`basename $f`
+	  echo $FNAME
+	  cp $f $FNAME || echo Cannot install $FNAME. Does $USER have privileges?
+	  chmod 0644 $FNAME
+      done
+
+      if [ -d $SRCDIR../docs/$dir/images/ ]; then
+          if [ ! -d $INSTALLDIR/images/ ]; then
+              mkdir $INSTALLDIR/images
+              if [ ! -d $INSTALLDIR/images/ ]; then
+                  echo Failed to make directory $SWATDIR/help/images, does $USER have privileges?
+                  exit 1
+              fi
+          fi
+          for f in $SRCDIR../docs/$dir/images/*.png; do
+              FNAME=$INSTALLDIR/`basename $f`
+              echo $FNAME
+              cp $f $FNAME || echo Cannot install $FNAME. Does $USER have privileges?
+              chmod 0644 $FNAME
+          done
+      fi
+    done
 fi
 
 # Install Using Samba book (but only if it is there)
diff --git a/source/script/mkversion.sh b/source/script/mkversion.sh
index f66e1cc1acc..917a9ed1ae3 100755
--- a/source/script/mkversion.sh
+++ b/source/script/mkversion.sh
@@ -18,8 +18,6 @@ SAMBA_VERSION_MAJOR=`sed -n 's/^SAMBA_VERSION_MAJOR=//p' $SOURCE_DIR$VERSION_FIL
 SAMBA_VERSION_MINOR=`sed -n 's/^SAMBA_VERSION_MINOR=//p' $SOURCE_DIR$VERSION_FILE`
 SAMBA_VERSION_RELEASE=`sed -n 's/^SAMBA_VERSION_RELEASE=//p' $SOURCE_DIR$VERSION_FILE`
 
-SAMBA_VERSION_REVISION=`sed -n 's/^SAMBA_VERSION_REVISION=//p' $SOURCE_DIR$VERSION_FILE`
-
 SAMBA_VERSION_PRE_RELEASE=`sed -n 's/^SAMBA_VERSION_PRE_RELEASE=//p' $SOURCE_DIR$VERSION_FILE`
 
 SAMBA_VERSION_RC_RELEASE=`sed -n 's/^SAMBA_VERSION_RC_RELEASE=//p' $SOURCE_DIR$VERSION_FILE`
@@ -38,10 +36,7 @@ echo "#define SAMBA_VERSION_RELEASE ${SAMBA_VERSION_RELEASE}" >> $OUTPUT_FILE
 SAMBA_VERSION_STRING="${SAMBA_VERSION_MAJOR}.${SAMBA_VERSION_MINOR}.${SAMBA_VERSION_RELEASE}"
 
 
-if test -n "${SAMBA_VERSION_REVISION}";then
-    SAMBA_VERSION_STRING="${SAMBA_VERSION_STRING}${SAMBA_VERSION_REVISION}"
-    echo "#define SAMBA_VERSION_REVISION \"${SAMBA_VERSION_REVISION}\"" >> $OUTPUT_FILE
-elif test -n "${SAMBA_VERSION_PRE_RELEASE}";then
+if test -n "${SAMBA_VERSION_PRE_RELEASE}";then
     SAMBA_VERSION_STRING="${SAMBA_VERSION_STRING}pre${SAMBA_VERSION_PRE_RELEASE}"
     echo "#define SAMBA_VERSION_PRE_RELEASE ${SAMBA_VERSION_PRE_RELEASE}" >> $OUTPUT_FILE
 elif test -n "${SAMBA_VERSION_RC_RELEASE}";then
diff --git a/source/smbd/close.c b/source/smbd/close.c
index 0700aeaa0a6..8b3010c1b2e 100644
--- a/source/smbd/close.c
+++ b/source/smbd/close.c
@@ -233,7 +233,7 @@ with error %s\n", fsp->fsp_name, strerror(errno) ));
 	file_free(fsp);
 
 	if (err == -1 || err1 == -1)
-		return -1;
+		return errno;
 	else
 		return 0;
 }
diff --git a/source/smbd/error.c b/source/smbd/error.c
index 795bf0949cc..9c81d465e7a 100644
--- a/source/smbd/error.c
+++ b/source/smbd/error.c
@@ -42,7 +42,7 @@ int cached_error_packet(char *outbuf,files_struct *fsp,int line,const char *file
 	/* We can now delete the auxiliary struct */
 	free((char *)wbmpx);
 	fsp->wbmpx_ptr = NULL;
-	return error_packet(outbuf,NT_STATUS_OK,eclass,err,line,file);
+	return error_packet(outbuf,NT_STATUS_OK,eclass,err,False,line,file);
 }
 
 /****************************************************************************
@@ -76,7 +76,7 @@ int unix_error_packet(char *outbuf,int def_class,uint32 def_code,
 		}
 	}
 
-	return error_packet(outbuf,ntstatus,eclass,ecode,line,file);
+	return error_packet(outbuf,ntstatus,eclass,ecode,False,line,file);
 }
 
 
@@ -85,7 +85,7 @@ int unix_error_packet(char *outbuf,int def_class,uint32 def_code,
 ****************************************************************************/
 
 int error_packet(char *outbuf,NTSTATUS ntstatus,
-		 uint8 eclass,uint32 ecode,int line, const char *file)
+		 uint8 eclass,uint32 ecode,BOOL force_dos, int line, const char *file)
 {
 	int outsize = set_message(outbuf,0,0,True);
 	extern uint32 global_client_caps;
@@ -106,7 +106,7 @@ int error_packet(char *outbuf,NTSTATUS ntstatus,
 	 * when talking with clients that normally expect nt status codes. JRA.
 	 */
 
-	if ((lp_nt_status_support() || (SVAL(outbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) && (global_client_caps & CAP_STATUS32)) {
+	if ((lp_nt_status_support() || (SVAL(outbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) && (global_client_caps & CAP_STATUS32) && (!force_dos)) {
 		if (NT_STATUS_V(ntstatus) == 0 && eclass)
 			ntstatus = dos_to_ntstatus(eclass, ecode);
 		SIVAL(outbuf,smb_rcls,NT_STATUS_V(ntstatus));
diff --git a/source/smbd/fake_file.c b/source/smbd/fake_file.c
index 5ccb548ba5b..d3660addf11 100644
--- a/source/smbd/fake_file.c
+++ b/source/smbd/fake_file.c
@@ -40,7 +40,7 @@ files_struct *open_fake_file_shared1(enum FAKE_FILE_TYPE fake_file_type, connect
 	}
 
 	/* access check */
-	if (conn->admin_user != True) {
+	if (current_user.uid != 0) {
 		DEBUG(1,("access_denied to service[%s] file[%s] user[%s]\n",
 			lp_servicename(SNUM(conn)),fname,conn->user));
 		errno = EACCES;
diff --git a/source/msdfs/msdfs.c b/source/smbd/msdfs.c
index c66f0477a84..c66f0477a84 100644
--- a/source/msdfs/msdfs.c
+++ b/source/smbd/msdfs.c
diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c
index 6ba74d5d503..e4ddda104e3 100644
--- a/source/smbd/nttrans.c
+++ b/source/smbd/nttrans.c
@@ -643,6 +643,7 @@ create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attrib
 		/*
 		 * This filename is relative to a directory fid.
 		 */
+		pstring rel_fname;
 		files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
 		size_t dir_name_len;
 
@@ -691,15 +692,16 @@ create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attrib
 		 */
 
 		if(fname[dir_name_len-1] != '\\' && fname[dir_name_len-1] != '/') {
-			pstrcat(fname, "\\");
+			pstrcat(fname, "/");
 			dir_name_len++;
 		}
 
-		srvstr_get_path(inbuf, &fname[dir_name_len], smb_buf(inbuf), sizeof(fname)-dir_name_len, 0, STR_TERMINATE, &status);
+		srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status);
 		if (!NT_STATUS_IS_OK(status)) {
 			END_PROFILE(SMBntcreateX);
 			return ERROR_NT(status);
 		}
+		pstrcat(fname, rel_fname);
 	} else {
 		srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -1207,7 +1209,6 @@ static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *o
 		/*
 		 * This filename is relative to a directory fid.
 		 */
-
 		files_struct *dir_fsp = file_fsp(params,4);
 		size_t dir_name_len;
 
@@ -1242,7 +1243,7 @@ static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *o
 		 */
 
 		if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
-			pstrcat(fname, "\\");
+			pstrcat(fname, "/");
 			dir_name_len++;
 		}
 
@@ -2351,7 +2352,7 @@ static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf,
 	ZERO_STRUCT(qt);
 
 	/* access check */
-	if (conn->admin_user != True) {
+	if (current_user.uid != 0) {
 		DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
 			lp_servicename(SNUM(conn)),conn->user));
 		return ERROR_DOS(ERRDOS,ERRnoaccess);
diff --git a/source/smbd/password.c b/source/smbd/password.c
index d15970cbefe..b2dbde151d0 100644
--- a/source/smbd/password.c
+++ b/source/smbd/password.c
@@ -488,7 +488,13 @@ BOOL authorise_login(int snum, fstring user, DATA_BLOB password,
 	/* now check the list of session users */
 	if (!ok) {
 		char *auser;
-		char *user_list = strdup(session_userlist);
+		char *user_list = NULL;
+
+		if ( session_userlist )
+			user_list = strdup(session_userlist);
+		else
+			user_list = strdup("");
+
 		if (!user_list)
 			return(False);
 		
diff --git a/source/smbd/posix_acls.c b/source/smbd/posix_acls.c
index 25e8fd802bd..158f1a0ede8 100644
--- a/source/smbd/posix_acls.c
+++ b/source/smbd/posix_acls.c
@@ -21,6 +21,9 @@
 
 #include "includes.h"
 
+#undef  DBGC_CLASS
+#define DBGC_CLASS DBGC_ACLS
+
 /****************************************************************************
  Data structures representing the internal ACE format.
 ****************************************************************************/
diff --git a/source/smbd/process.c b/source/smbd/process.c
index 718d1bb67b2..966bb63c1ea 100644
--- a/source/smbd/process.c
+++ b/source/smbd/process.c
@@ -736,7 +736,7 @@ static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize
 			if (flags & AS_GUEST) 
 				flags &= ~AS_USER;
 			else
-				return(ERROR_DOS(ERRSRV,ERRaccess));
+				return(ERROR_FORCE_DOS(ERRSRV,ERRbaduid));
 		}
 
 		/* this code is to work around a bug is MS client 3 without
diff --git a/source/smbd/trans2.c b/source/smbd/trans2.c
index a1d068e38f9..0c6026392c4 100644
--- a/source/smbd/trans2.c
+++ b/source/smbd/trans2.c
@@ -395,9 +395,11 @@ static NTSTATUS set_ea(connection_struct *conn, files_struct *fsp, const char *f
 	}
 
 	if (ret == -1) {
+#ifdef ENOTSUP
 		if (errno == ENOTSUP) {
 			return NT_STATUS_EAS_NOT_SUPPORTED;
 		}
+#endif
 		return map_nt_error_from_unix(errno);
 	}
 
@@ -2010,7 +2012,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
 			fsp.fd = -1;
 			
 			/* access check */
-			if (conn->admin_user != True) {
+			if (current_user.uid != 0) {
 				DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n",
 					lp_servicename(SNUM(conn)),conn->user));
 				return ERROR_DOS(ERRDOS,ERRnoaccess);
@@ -2108,7 +2110,7 @@ static int call_trans2setfsinfo(connection_struct *conn,
 	DEBUG(10,("call_trans2setfsinfo: SET_FS_QUOTA: for service [%s]\n",lp_servicename(SNUM(conn))));
 
 	/* access check */
-	if ((conn->admin_user != True)||!CAN_WRITE(conn)) {
+	if ((current_user.uid != 0)||!CAN_WRITE(conn)) {
 		DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n",
 			lp_servicename(SNUM(conn)),conn->user));
 		return ERROR_DOS(ERRSRV,ERRaccess);
diff --git a/source/smbd/vfs.c b/source/smbd/vfs.c
index 4f3234775a2..533220e7dfb 100644
--- a/source/smbd/vfs.c
+++ b/source/smbd/vfs.c
@@ -820,7 +820,7 @@ static BOOL readlink_check(connection_struct *conn, const char *dir, char *name)
 	}
 
 	if (SMB_VFS_READLINK(conn, name, flink, sizeof(pstring) -1) != -1) {
-		DEBUG(3,("reduce_name: file path name %s is a symlink\nChecking it's path\n", name));
+		DEBUG(3,("readlink_check: file path name %s is a symlink\nChecking it's path\n", name));
 		if (*flink == '/') {
 			pstrcpy(cleanlink, flink);
 		} else {
diff --git a/source/smbwrapper/realcalls.h b/source/smbwrapper/realcalls.h
index 6c230dba056..bad89d598c1 100644
--- a/source/smbwrapper/realcalls.h
+++ b/source/smbwrapper/realcalls.h
@@ -250,14 +250,27 @@
 #define real_rmdir(fn)			(syscall(SYS_rmdir, (fn)))
 #define real_mkdir(fn, mode)		(syscall(SYS_mkdir, (fn), (mode)))
 
+/*
+ * On GNU/Linux distributions which allow to use both 2.4 and 2.6 kernels
+ * there is SYS_utimes syscall defined at compile time in glibc-kernheaders but 
+ * it is available on 2.6 kernels only. Therefore, we can't rely on syscall at 
+ * compile time but have to check that behaviour during program execution. An easy 
+ * workaround is to have replacement for utimes() implemented within our wrapper and 
+ * do not rely on syscall at all. Thus, if REPLACE_UTIME is defined already (by packager), 
+ * skip these syscall shortcuts.
+ */
+#ifndef REPLACE_UTIME
 #ifdef SYS_utime
 #define real_utime(fn, buf)		(syscall(SYS_utime, (fn), (buf)))
 #else
 #define REPLACE_UTIME 1
 #endif
+#endif
 
+#ifndef REPLACE_UTIMES
 #ifdef SYS_utimes
 #define real_utimes(fn, buf)		(syscall(SYS_utimes, (fn), (buf)))
 #else
 #define REPLACE_UTIMES 1
 #endif
+#endif
diff --git a/source/utils/smbcontrol.c b/source/utils/smbcontrol.c
index 8a27684a4d3..2eb661c8b68 100644
--- a/source/utils/smbcontrol.c
+++ b/source/utils/smbcontrol.c
@@ -82,6 +82,14 @@ static void wait_replies(BOOL multiple_replies)
 	} while (timeout - (time(NULL) - start_time) > 0);
 }
 
+/* Message handler callback that displays the PID and a string on stdout */
+
+static void print_pid_string_cb(int msg_type, pid_t pid, void *buf, size_t len)
+{
+	printf("PID %u: %.*s", (unsigned int)pid, (int)len, (const char *)buf);
+	num_replies++;
+}
+
 /* Message handler callback that displays a string on stdout */
 
 static void print_string_cb(int msg_type, pid_t pid, void *buf, size_t len)
@@ -281,7 +289,7 @@ static BOOL do_debuglevel(const pid_t pid, const int argc, const char **argv)
 	if (!send_message(pid, MSG_REQ_DEBUGLEVEL, NULL, 0, False))
 		return False;
 
-	message_register(MSG_DEBUGLEVEL, print_string_cb);
+	message_register(MSG_DEBUGLEVEL, print_pid_string_cb);
 
 	wait_replies(pid == 0);
 
diff --git a/source/web/swat.c b/source/web/swat.c
index e535106f260..ed53d0d7128 100644
--- a/source/web/swat.c
+++ b/source/web/swat.c
@@ -1042,16 +1042,19 @@ static void chg_passwd(void)
 	 */
 
 	local_flags |= (cgi_variable(ADD_USER_FLAG) ? LOCAL_ADD_USER : 0);
+	local_flags |= (cgi_variable(ADD_USER_FLAG) ?  LOCAL_SET_PASSWORD : 0);
+	local_flags |= (cgi_variable(CHG_S_PASSWD_FLAG) ? LOCAL_SET_PASSWORD : 0);
 	local_flags |= (cgi_variable(DELETE_USER_FLAG) ? LOCAL_DELETE_USER : 0);
 	local_flags |= (cgi_variable(ENABLE_USER_FLAG) ? LOCAL_ENABLE_USER : 0);
 	local_flags |= (cgi_variable(DISABLE_USER_FLAG) ? LOCAL_DISABLE_USER : 0);
+	
 
 	rslt = change_password(host,
 			       cgi_variable(SWAT_USER),
 			       cgi_variable(OLD_PSWD), cgi_variable(NEW_PSWD),
 				   local_flags);
 
-	if(local_flags == 0) {
+	if(cgi_variable(CHG_S_PASSWD_FLAG)) {
 		d_printf("<p>");
 		if (rslt == True) {
 			d_printf(_(" The passwd for '%s' has been changed."), cgi_variable(SWAT_USER));
diff --git a/swat/help/welcome.html b/swat/help/welcome.html
index 59429ba47df..91d4d7eb008 100644
--- a/swat/help/welcome.html
+++ b/swat/help/welcome.html
@@ -57,7 +57,9 @@ Please choose a configuration action using one of the above buttons
  <li><b>Books</b>
    <ul>
     <li><a href="/swat/using_samba/toc.html" target="docs">Using Samba, 2ed.</a> - by Jay Ts, Robert Eckstein, and David Collier-Brown
-    <li><a href="/swat/help/Samba-HOWTO-Collection.html">The Samba HOWTO Collection</a>
+    <li><a href="/swat/help/howto/">The Official Samba HOWTO and Reference Guide</a>
+    <li><a href="/swat/help/guide/">Samba 3 by Example</a>
+    <li><a href="/swat/help/devel/">The Samba Developer Guide</a>
    </ul>
 </ul>