17 files changed, 545 insertions, 72 deletions

diff --git a/lib/ldb-samba/ldif_handlers.c b/lib/ldb-samba/ldif_handlers.c
index c7385f654a8..93cce292281 100644
--- a/lib/ldb-samba/ldif_handlers.c
+++ b/lib/ldb-samba/ldif_handlers.c
@@ -483,8 +483,13 @@ static int ldif_canonicalise_objectCategory(struct ldb_context *ldb, void *mem_c
 		const char *lDAPDisplayName = talloc_strndup(tmp_ctx, (char *)in->data, in->length);
 		sclass = dsdb_class_by_lDAPDisplayName(schema, lDAPDisplayName);
 		if (sclass) {
-			struct ldb_dn *dn = ldb_dn_new(mem_ctx, ldb,  
+			struct ldb_dn *dn = ldb_dn_new(tmp_ctx, ldb,
 						       sclass->defaultObjectCategory);
+			if (dn == NULL) {
+				talloc_free(tmp_ctx);
+				return LDB_ERR_OPERATIONS_ERROR;
+			}
+
 			*out = data_blob_string_const(ldb_dn_alloc_casefold(mem_ctx, dn));
 			talloc_free(tmp_ctx);
 
diff --git a/lib/ldb/ABI/ldb-1.1.17.sigs b/lib/ldb/ABI/ldb-1.1.17.sigs
new file mode 100644
index 00000000000..eac5194550e
--- /dev/null
+++ b/lib/ldb/ABI/ldb-1.1.17.sigs
@@ -0,0 +1,262 @@
+ldb_add: int (struct ldb_context *, const struct ldb_message *)
+ldb_any_comparison: int (struct ldb_context *, void *, ldb_attr_handler_t, const struct ldb_val *, const struct ldb_val *)
+ldb_asprintf_errstring: void (struct ldb_context *, const char *, ...)
+ldb_attr_casefold: char *(TALLOC_CTX *, const char *)
+ldb_attr_dn: int (const char *)
+ldb_attr_in_list: int (const char * const *, const char *)
+ldb_attr_list_copy: const char **(TALLOC_CTX *, const char * const *)
+ldb_attr_list_copy_add: const char **(TALLOC_CTX *, const char * const *, const char *)
+ldb_base64_decode: int (char *)
+ldb_base64_encode: char *(TALLOC_CTX *, const char *, int)
+ldb_binary_decode: struct ldb_val (TALLOC_CTX *, const char *)
+ldb_binary_encode: char *(TALLOC_CTX *, struct ldb_val)
+ldb_binary_encode_string: char *(TALLOC_CTX *, const char *)
+ldb_build_add_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
+ldb_build_del_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
+ldb_build_extended_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, const char *, void *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
+ldb_build_mod_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
+ldb_build_rename_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, struct ldb_dn *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
+ldb_build_search_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, enum ldb_scope, const char *, const char * const *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
+ldb_build_search_req_ex: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, enum ldb_scope, struct ldb_parse_tree *, const char * const *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
+ldb_casefold: char *(struct ldb_context *, TALLOC_CTX *, const char *, size_t)
+ldb_casefold_default: char *(void *, TALLOC_CTX *, const char *, size_t)
+ldb_check_critical_controls: int (struct ldb_control **)
+ldb_comparison_binary: int (struct ldb_context *, void *, const struct ldb_val *, const struct ldb_val *)
+ldb_comparison_fold: int (struct ldb_context *, void *, const struct ldb_val *, const struct ldb_val *)
+ldb_connect: int (struct ldb_context *, const char *, unsigned int, const char **)
+ldb_control_to_string: char *(TALLOC_CTX *, const struct ldb_control *)
+ldb_controls_except_specified: struct ldb_control **(struct ldb_control **, TALLOC_CTX *, struct ldb_control *)
+ldb_debug: void (struct ldb_context *, enum ldb_debug_level, const char *, ...)
+ldb_debug_add: void (struct ldb_context *, const char *, ...)
+ldb_debug_end: void (struct ldb_context *, enum ldb_debug_level)
+ldb_debug_set: void (struct ldb_context *, enum ldb_debug_level, const char *, ...)
+ldb_delete: int (struct ldb_context *, struct ldb_dn *)
+ldb_dn_add_base: bool (struct ldb_dn *, struct ldb_dn *)
+ldb_dn_add_base_fmt: bool (struct ldb_dn *, const char *, ...)
+ldb_dn_add_child: bool (struct ldb_dn *, struct ldb_dn *)
+ldb_dn_add_child_fmt: bool (struct ldb_dn *, const char *, ...)
+ldb_dn_alloc_casefold: char *(TALLOC_CTX *, struct ldb_dn *)
+ldb_dn_alloc_linearized: char *(TALLOC_CTX *, struct ldb_dn *)
+ldb_dn_canonical_ex_string: char *(TALLOC_CTX *, struct ldb_dn *)
+ldb_dn_canonical_string: char *(TALLOC_CTX *, struct ldb_dn *)
+ldb_dn_check_local: bool (struct ldb_module *, struct ldb_dn *)
+ldb_dn_check_special: bool (struct ldb_dn *, const char *)
+ldb_dn_compare: int (struct ldb_dn *, struct ldb_dn *)
+ldb_dn_compare_base: int (struct ldb_dn *, struct ldb_dn *)
+ldb_dn_copy: struct ldb_dn *(TALLOC_CTX *, struct ldb_dn *)
+ldb_dn_escape_value: char *(TALLOC_CTX *, struct ldb_val)
+ldb_dn_extended_add_syntax: int (struct ldb_context *, unsigned int, const struct ldb_dn_extended_syntax *)
+ldb_dn_extended_filter: void (struct ldb_dn *, const char * const *)
+ldb_dn_extended_syntax_by_name: const struct ldb_dn_extended_syntax *(struct ldb_context *, const char *)
+ldb_dn_from_ldb_val: struct ldb_dn *(TALLOC_CTX *, struct ldb_context *, const struct ldb_val *)
+ldb_dn_get_casefold: const char *(struct ldb_dn *)
+ldb_dn_get_comp_num: int (struct ldb_dn *)
+ldb_dn_get_component_name: const char *(struct ldb_dn *, unsigned int)
+ldb_dn_get_component_val: const struct ldb_val *(struct ldb_dn *, unsigned int)
+ldb_dn_get_extended_comp_num: int (struct ldb_dn *)
+ldb_dn_get_extended_component: const struct ldb_val *(struct ldb_dn *, const char *)
+ldb_dn_get_extended_linearized: char *(TALLOC_CTX *, struct ldb_dn *, int)
+ldb_dn_get_linearized: const char *(struct ldb_dn *)
+ldb_dn_get_parent: struct ldb_dn *(TALLOC_CTX *, struct ldb_dn *)
+ldb_dn_get_rdn_name: const char *(struct ldb_dn *)
+ldb_dn_get_rdn_val: const struct ldb_val *(struct ldb_dn *)
+ldb_dn_has_extended: bool (struct ldb_dn *)
+ldb_dn_is_null: bool (struct ldb_dn *)
+ldb_dn_is_special: bool (struct ldb_dn *)
+ldb_dn_is_valid: bool (struct ldb_dn *)
+ldb_dn_map_local: struct ldb_dn *(struct ldb_module *, void *, struct ldb_dn *)
+ldb_dn_map_rebase_remote: struct ldb_dn *(struct ldb_module *, void *, struct ldb_dn *)
+ldb_dn_map_remote: struct ldb_dn *(struct ldb_module *, void *, struct ldb_dn *)
+ldb_dn_minimise: bool (struct ldb_dn *)
+ldb_dn_new: struct ldb_dn *(TALLOC_CTX *, struct ldb_context *, const char *)
+ldb_dn_new_fmt: struct ldb_dn *(TALLOC_CTX *, struct ldb_context *, const char *, ...)
+ldb_dn_remove_base_components: bool (struct ldb_dn *, unsigned int)
+ldb_dn_remove_child_components: bool (struct ldb_dn *, unsigned int)
+ldb_dn_remove_extended_components: void (struct ldb_dn *)
+ldb_dn_replace_components: bool (struct ldb_dn *, struct ldb_dn *)
+ldb_dn_set_component: int (struct ldb_dn *, int, const char *, const struct ldb_val)
+ldb_dn_set_extended_component: int (struct ldb_dn *, const char *, const struct ldb_val *)
+ldb_dn_update_components: int (struct ldb_dn *, const struct ldb_dn *)
+ldb_dn_validate: bool (struct ldb_dn *)
+ldb_dump_results: void (struct ldb_context *, struct ldb_result *, FILE *)
+ldb_error_at: int (struct ldb_context *, int, const char *, const char *, int)
+ldb_errstring: const char *(struct ldb_context *)
+ldb_extended: int (struct ldb_context *, const char *, void *, struct ldb_result **)
+ldb_extended_default_callback: int (struct ldb_request *, struct ldb_reply *)
+ldb_filter_from_tree: char *(TALLOC_CTX *, const struct ldb_parse_tree *)
+ldb_get_config_basedn: struct ldb_dn *(struct ldb_context *)
+ldb_get_create_perms: unsigned int (struct ldb_context *)
+ldb_get_default_basedn: struct ldb_dn *(struct ldb_context *)
+ldb_get_event_context: struct tevent_context *(struct ldb_context *)
+ldb_get_flags: unsigned int (struct ldb_context *)
+ldb_get_opaque: void *(struct ldb_context *, const char *)
+ldb_get_root_basedn: struct ldb_dn *(struct ldb_context *)
+ldb_get_schema_basedn: struct ldb_dn *(struct ldb_context *)
+ldb_global_init: int (void)
+ldb_handle_new: struct ldb_handle *(TALLOC_CTX *, struct ldb_context *)
+ldb_handler_copy: int (struct ldb_context *, void *, const struct ldb_val *, struct ldb_val *)
+ldb_handler_fold: int (struct ldb_context *, void *, const struct ldb_val *, struct ldb_val *)
+ldb_init: struct ldb_context *(TALLOC_CTX *, struct tevent_context *)
+ldb_ldif_message_string: char *(struct ldb_context *, TALLOC_CTX *, enum ldb_changetype, const struct ldb_message *)
+ldb_ldif_parse_modrdn: int (struct ldb_context *, const struct ldb_ldif *, TALLOC_CTX *, struct ldb_dn **, struct ldb_dn **, bool *, struct ldb_dn **, struct ldb_dn **)
+ldb_ldif_read: struct ldb_ldif *(struct ldb_context *, int (*)(void *), void *)
+ldb_ldif_read_file: struct ldb_ldif *(struct ldb_context *, FILE *)
+ldb_ldif_read_file_state: struct ldb_ldif *(struct ldb_context *, struct ldif_read_file_state *)
+ldb_ldif_read_free: void (struct ldb_context *, struct ldb_ldif *)
+ldb_ldif_read_string: struct ldb_ldif *(struct ldb_context *, const char **)
+ldb_ldif_write: int (struct ldb_context *, int (*)(void *, const char *, ...), void *, const struct ldb_ldif *)
+ldb_ldif_write_file: int (struct ldb_context *, FILE *, const struct ldb_ldif *)
+ldb_ldif_write_redacted_trace_string: char *(struct ldb_context *, TALLOC_CTX *, const struct ldb_ldif *)
+ldb_ldif_write_string: char *(struct ldb_context *, TALLOC_CTX *, const struct ldb_ldif *)
+ldb_load_modules: int (struct ldb_context *, const char **)
+ldb_map_add: int (struct ldb_module *, struct ldb_request *)
+ldb_map_delete: int (struct ldb_module *, struct ldb_request *)
+ldb_map_init: int (struct ldb_module *, const struct ldb_map_attribute *, const struct ldb_map_objectclass *, const char * const *, const char *, const char *)
+ldb_map_modify: int (struct ldb_module *, struct ldb_request *)
+ldb_map_rename: int (struct ldb_module *, struct ldb_request *)
+ldb_map_search: int (struct ldb_module *, struct ldb_request *)
+ldb_match_msg: int (struct ldb_context *, const struct ldb_message *, const struct ldb_parse_tree *, struct ldb_dn *, enum ldb_scope)
+ldb_match_msg_error: int (struct ldb_context *, const struct ldb_message *, const struct ldb_parse_tree *, struct ldb_dn *, enum ldb_scope, bool *)
+ldb_match_msg_objectclass: int (const struct ldb_message *, const char *)
+ldb_mod_register_control: int (struct ldb_module *, const char *)
+ldb_modify: int (struct ldb_context *, const struct ldb_message *)
+ldb_modify_default_callback: int (struct ldb_request *, struct ldb_reply *)
+ldb_module_call_chain: char *(struct ldb_request *, TALLOC_CTX *)
+ldb_module_connect_backend: int (struct ldb_context *, const char *, const char **, struct ldb_module **)
+ldb_module_done: int (struct ldb_request *, struct ldb_control **, struct ldb_extended *, int)
+ldb_module_flags: uint32_t (struct ldb_context *)
+ldb_module_get_ctx: struct ldb_context *(struct ldb_module *)
+ldb_module_get_name: const char *(struct ldb_module *)
+ldb_module_get_ops: const struct ldb_module_ops *(struct ldb_module *)
+ldb_module_get_private: void *(struct ldb_module *)
+ldb_module_init_chain: int (struct ldb_context *, struct ldb_module *)
+ldb_module_load_list: int (struct ldb_context *, const char **, struct ldb_module *, struct ldb_module **)
+ldb_module_new: struct ldb_module *(TALLOC_CTX *, struct ldb_context *, const char *, const struct ldb_module_ops *)
+ldb_module_next: struct ldb_module *(struct ldb_module *)
+ldb_module_popt_options: struct poptOption **(struct ldb_context *)
+ldb_module_send_entry: int (struct ldb_request *, struct ldb_message *, struct ldb_control **)
+ldb_module_send_referral: int (struct ldb_request *, char *)
+ldb_module_set_next: void (struct ldb_module *, struct ldb_module *)
+ldb_module_set_private: void (struct ldb_module *, void *)
+ldb_modules_hook: int (struct ldb_context *, enum ldb_module_hook_type)
+ldb_modules_list_from_string: const char **(struct ldb_context *, TALLOC_CTX *, const char *)
+ldb_modules_load: int (const char *, const char *)
+ldb_msg_add: int (struct ldb_message *, const struct ldb_message_element *, int)
+ldb_msg_add_empty: int (struct ldb_message *, const char *, int, struct ldb_message_element **)
+ldb_msg_add_fmt: int (struct ldb_message *, const char *, const char *, ...)
+ldb_msg_add_linearized_dn: int (struct ldb_message *, const char *, struct ldb_dn *)
+ldb_msg_add_steal_string: int (struct ldb_message *, const char *, char *)
+ldb_msg_add_steal_value: int (struct ldb_message *, const char *, struct ldb_val *)
+ldb_msg_add_string: int (struct ldb_message *, const char *, const char *)
+ldb_msg_add_value: int (struct ldb_message *, const char *, const struct ldb_val *, struct ldb_message_element **)
+ldb_msg_canonicalize: struct ldb_message *(struct ldb_context *, const struct ldb_message *)
+ldb_msg_check_string_attribute: int (const struct ldb_message *, const char *, const char *)
+ldb_msg_copy: struct ldb_message *(TALLOC_CTX *, const struct ldb_message *)
+ldb_msg_copy_attr: int (struct ldb_message *, const char *, const char *)
+ldb_msg_copy_shallow: struct ldb_message *(TALLOC_CTX *, const struct ldb_message *)
+ldb_msg_diff: struct ldb_message *(struct ldb_context *, struct ldb_message *, struct ldb_message *)
+ldb_msg_difference: int (struct ldb_context *, TALLOC_CTX *, struct ldb_message *, struct ldb_message *, struct ldb_message **)
+ldb_msg_element_compare: int (struct ldb_message_element *, struct ldb_message_element *)
+ldb_msg_element_compare_name: int (struct ldb_message_element *, struct ldb_message_element *)
+ldb_msg_element_equal_ordered: bool (const struct ldb_message_element *, const struct ldb_message_element *)
+ldb_msg_find_attr_as_bool: int (const struct ldb_message *, const char *, int)
+ldb_msg_find_attr_as_dn: struct ldb_dn *(struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, const char *)
+ldb_msg_find_attr_as_double: double (const struct ldb_message *, const char *, double)
+ldb_msg_find_attr_as_int: int (const struct ldb_message *, const char *, int)
+ldb_msg_find_attr_as_int64: int64_t (const struct ldb_message *, const char *, int64_t)
+ldb_msg_find_attr_as_string: const char *(const struct ldb_message *, const char *, const char *)
+ldb_msg_find_attr_as_uint: unsigned int (const struct ldb_message *, const char *, unsigned int)
+ldb_msg_find_attr_as_uint64: uint64_t (const struct ldb_message *, const char *, uint64_t)
+ldb_msg_find_element: struct ldb_message_element *(const struct ldb_message *, const char *)
+ldb_msg_find_ldb_val: const struct ldb_val *(const struct ldb_message *, const char *)
+ldb_msg_find_val: struct ldb_val *(const struct ldb_message_element *, struct ldb_val *)
+ldb_msg_new: struct ldb_message *(TALLOC_CTX *)
+ldb_msg_normalize: int (struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, struct ldb_message **)
+ldb_msg_remove_attr: void (struct ldb_message *, const char *)
+ldb_msg_remove_element: void (struct ldb_message *, struct ldb_message_element *)
+ldb_msg_rename_attr: int (struct ldb_message *, const char *, const char *)
+ldb_msg_sanity_check: int (struct ldb_context *, const struct ldb_message *)
+ldb_msg_sort_elements: void (struct ldb_message *)
+ldb_next_del_trans: int (struct ldb_module *)
+ldb_next_end_trans: int (struct ldb_module *)
+ldb_next_init: int (struct ldb_module *)
+ldb_next_prepare_commit: int (struct ldb_module *)
+ldb_next_remote_request: int (struct ldb_module *, struct ldb_request *)
+ldb_next_request: int (struct ldb_module *, struct ldb_request *)
+ldb_next_start_trans: int (struct ldb_module *)
+ldb_op_default_callback: int (struct ldb_request *, struct ldb_reply *)
+ldb_options_find: const char *(struct ldb_context *, const char **, const char *)
+ldb_pack_data: int (struct ldb_context *, const struct ldb_message *, struct ldb_val *)
+ldb_parse_control_from_string: struct ldb_control *(struct ldb_context *, TALLOC_CTX *, const char *)
+ldb_parse_control_strings: struct ldb_control **(struct ldb_context *, TALLOC_CTX *, const char **)
+ldb_parse_tree: struct ldb_parse_tree *(TALLOC_CTX *, const char *)
+ldb_parse_tree_attr_replace: void (struct ldb_parse_tree *, const char *, const char *)
+ldb_parse_tree_copy_shallow: struct ldb_parse_tree *(TALLOC_CTX *, const struct ldb_parse_tree *)
+ldb_parse_tree_walk: int (struct ldb_parse_tree *, int (*)(struct ldb_parse_tree *, void *), void *)
+ldb_qsort: void (void * const, size_t, size_t, void *, ldb_qsort_cmp_fn_t)
+ldb_register_backend: int (const char *, ldb_connect_fn, bool)
+ldb_register_hook: int (ldb_hook_fn)
+ldb_register_module: int (const struct ldb_module_ops *)
+ldb_rename: int (struct ldb_context *, struct ldb_dn *, struct ldb_dn *)
+ldb_reply_add_control: int (struct ldb_reply *, const char *, bool, void *)
+ldb_reply_get_control: struct ldb_control *(struct ldb_reply *, const char *)
+ldb_req_get_custom_flags: uint32_t (struct ldb_request *)
+ldb_req_is_untrusted: bool (struct ldb_request *)
+ldb_req_location: const char *(struct ldb_request *)
+ldb_req_mark_trusted: void (struct ldb_request *)
+ldb_req_mark_untrusted: void (struct ldb_request *)
+ldb_req_set_custom_flags: void (struct ldb_request *, uint32_t)
+ldb_req_set_location: void (struct ldb_request *, const char *)
+ldb_request: int (struct ldb_context *, struct ldb_request *)
+ldb_request_add_control: int (struct ldb_request *, const char *, bool, void *)
+ldb_request_done: int (struct ldb_request *, int)
+ldb_request_get_control: struct ldb_control *(struct ldb_request *, const char *)
+ldb_request_get_status: int (struct ldb_request *)
+ldb_request_replace_control: int (struct ldb_request *, const char *, bool, void *)
+ldb_request_set_state: void (struct ldb_request *, int)
+ldb_reset_err_string: void (struct ldb_context *)
+ldb_save_controls: int (struct ldb_control *, struct ldb_request *, struct ldb_control ***)
+ldb_schema_attribute_add: int (struct ldb_context *, const char *, unsigned int, const char *)
+ldb_schema_attribute_add_with_syntax: int (struct ldb_context *, const char *, unsigned int, const struct ldb_schema_syntax *)
+ldb_schema_attribute_by_name: const struct ldb_schema_attribute *(struct ldb_context *, const char *)
+ldb_schema_attribute_remove: void (struct ldb_context *, const char *)
+ldb_schema_attribute_set_override_handler: void (struct ldb_context *, ldb_attribute_handler_override_fn_t, void *)
+ldb_search: int (struct ldb_context *, TALLOC_CTX *, struct ldb_result **, struct ldb_dn *, enum ldb_scope, const char * const *, const char *, ...)
+ldb_search_default_callback: int (struct ldb_request *, struct ldb_reply *)
+ldb_sequence_number: int (struct ldb_context *, enum ldb_sequence_type, uint64_t *)
+ldb_set_create_perms: void (struct ldb_context *, unsigned int)
+ldb_set_debug: int (struct ldb_context *, void (*)(void *, enum ldb_debug_level, const char *, va_list), void *)
+ldb_set_debug_stderr: int (struct ldb_context *)
+ldb_set_default_dns: void (struct ldb_context *)
+ldb_set_errstring: void (struct ldb_context *, const char *)
+ldb_set_event_context: void (struct ldb_context *, struct tevent_context *)
+ldb_set_flags: void (struct ldb_context *, unsigned int)
+ldb_set_modules_dir: void (struct ldb_context *, const char *)
+ldb_set_opaque: int (struct ldb_context *, const char *, void *)
+ldb_set_timeout: int (struct ldb_context *, struct ldb_request *, int)
+ldb_set_timeout_from_prev_req: int (struct ldb_context *, struct ldb_request *, struct ldb_request *)
+ldb_set_utf8_default: void (struct ldb_context *)
+ldb_set_utf8_fns: void (struct ldb_context *, void *, char *(*)(void *, void *, const char *, size_t))
+ldb_setup_wellknown_attributes: int (struct ldb_context *)
+ldb_should_b64_encode: int (struct ldb_context *, const struct ldb_val *)
+ldb_standard_syntax_by_name: const struct ldb_schema_syntax *(struct ldb_context *, const char *)
+ldb_strerror: const char *(int)
+ldb_string_to_time: time_t (const char *)
+ldb_string_utc_to_time: time_t (const char *)
+ldb_timestring: char *(TALLOC_CTX *, time_t)
+ldb_timestring_utc: char *(TALLOC_CTX *, time_t)
+ldb_transaction_cancel: int (struct ldb_context *)
+ldb_transaction_cancel_noerr: int (struct ldb_context *)
+ldb_transaction_commit: int (struct ldb_context *)
+ldb_transaction_prepare_commit: int (struct ldb_context *)
+ldb_transaction_start: int (struct ldb_context *)
+ldb_unpack_data: int (struct ldb_context *, const struct ldb_val *, struct ldb_message *)
+ldb_val_dup: struct ldb_val (TALLOC_CTX *, const struct ldb_val *)
+ldb_val_equal_exact: int (const struct ldb_val *, const struct ldb_val *)
+ldb_val_map_local: struct ldb_val (struct ldb_module *, void *, const struct ldb_map_attribute *, const struct ldb_val *)
+ldb_val_map_remote: struct ldb_val (struct ldb_module *, void *, const struct ldb_map_attribute *, const struct ldb_val *)
+ldb_val_string_cmp: int (const struct ldb_val *, const char *)
+ldb_val_to_time: int (const struct ldb_val *, time_t *)
+ldb_valid_attr_name: int (const char *)
+ldb_vdebug: void (struct ldb_context *, enum ldb_debug_level, const char *, va_list)
+ldb_wait: int (struct ldb_handle *, enum ldb_wait_type)
diff --git a/lib/ldb/ABI/pyldb-util-1.1.17.sigs b/lib/ldb/ABI/pyldb-util-1.1.17.sigs
new file mode 100644
index 00000000000..74d6719d2bc
--- /dev/null
+++ b/lib/ldb/ABI/pyldb-util-1.1.17.sigs
@@ -0,0 +1,2 @@
+pyldb_Dn_FromDn: PyObject *(struct ldb_dn *)
+pyldb_Object_AsDn: bool (TALLOC_CTX *, PyObject *, struct ldb_context *, struct ldb_dn **)
diff --git a/lib/ldb/common/ldb.c b/lib/ldb/common/ldb.c
index 3dc6d872289..c49513cfaa7 100644
--- a/lib/ldb/common/ldb.c
+++ b/lib/ldb/common/ldb.c
@@ -112,6 +112,10 @@ struct ldb_context *ldb_init(TALLOC_CTX *mem_ctx, struct tevent_context *ev_ctx)
 	 * having to provide their own private one explicitly */
 	if (ev_ctx == NULL) {
 		ev_ctx = tevent_context_init(ldb);
+		if (ev_ctx == NULL) {
+			talloc_free(ldb);
+			return NULL;
+		}
 		tevent_set_debug(ev_ctx, ldb_tevent_debug, ldb);
 		tevent_loop_allow_nesting(ev_ctx);
 	}
@@ -253,11 +257,12 @@ int ldb_connect(struct ldb_context *ldb, const char *url,
 		return ret;
 	}
 
-	if (ldb_load_modules(ldb, options) != LDB_SUCCESS) {
+	ret = ldb_load_modules(ldb, options);
+	if (ret != LDB_SUCCESS) {
 		ldb_debug(ldb, LDB_DEBUG_FATAL,
 			  "Unable to load modules for %s: %s",
 			  url, ldb_errstring(ldb));
-		return LDB_ERR_OTHER;
+		return ret;
 	}
 
 	/* set the default base dn */
@@ -366,10 +371,14 @@ int ldb_transaction_start(struct ldb_context *ldb)
 				ldb_strerror(status),
 				status);
 		}
-	}
-	if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { 
-		ldb_debug(module->ldb, LDB_DEBUG_TRACE, "start ldb transaction error: %s", 
-			  ldb_errstring(module->ldb));				
+		if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) {
+			ldb_debug(module->ldb, LDB_DEBUG_TRACE, "start ldb transaction error: %s",
+				  ldb_errstring(module->ldb));
+		}
+	} else {
+		if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) {
+			ldb_debug(module->ldb, LDB_DEBUG_TRACE, "start ldb transaction success");
+		}
 	}
 	return status;
 }
@@ -572,8 +581,8 @@ int ldb_wait(struct ldb_handle *handle, enum ldb_wait_type type)
 	struct tevent_context *ev;
 	int ret;
 
-	if (!handle) {
-		return ldb_error(handle->ldb, LDB_ERR_UNAVAILABLE, NULL);
+	if (handle == NULL) {
+		return LDB_ERR_UNAVAILABLE;
 	}
 
 	if (handle->state == LDB_ASYNC_DONE) {
diff --git a/lib/ldb/common/ldb_dn.c b/lib/ldb/common/ldb_dn.c
index 14596f6c371..6b6f90c13ea 100644
--- a/lib/ldb/common/ldb_dn.c
+++ b/lib/ldb/common/ldb_dn.c
@@ -287,7 +287,7 @@ char *ldb_dn_escape_value(TALLOC_CTX *mem_ctx, struct ldb_val value)
 */
 static bool ldb_dn_explode(struct ldb_dn *dn)
 {
-	char *p, *ex_name, *ex_value, *data, *d, *dt, *t;
+	char *p, *ex_name = NULL, *ex_value = NULL, *data, *d, *dt, *t;
 	bool trim = true;
 	bool in_extended = true;
 	bool in_ex_name = false;
@@ -298,7 +298,7 @@ static bool ldb_dn_explode(struct ldb_dn *dn)
 	bool is_oid = false;
 	bool escape = false;
 	unsigned int x;
-	size_t l;
+	size_t l = 0;
 	int ret;
 	char *parse_dn;
 	bool is_index;
diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c
index 440365688bb..05a8d8aa1dc 100644
--- a/lib/ldb/common/ldb_modules.c
+++ b/lib/ldb/common/ldb_modules.c
@@ -554,8 +554,33 @@ int ldb_next_request(struct ldb_module *module, struct ldb_request *request)
 		return ret;
 	}
 	if (!ldb_errstring(module->ldb)) {
+		const char *op;
+		switch (request->operation) {
+		case LDB_SEARCH:
+			op = "LDB_SEARCH";
+			break;
+		case LDB_ADD:
+			op = "LDB_ADD";
+			break;
+		case LDB_MODIFY:
+			op = "LDB_MODIFY";
+			break;
+		case LDB_DELETE:
+			op = "LDB_DELETE";
+			break;
+		case LDB_RENAME:
+			op = "LDB_RENAME";
+			break;
+		case LDB_EXTENDED:
+			op = "LDB_EXTENDED";
+			break;
+		default:
+			op = "request";
+			break;
+		}
+
 		/* Set a default error string, to place the blame somewhere */
-		ldb_asprintf_errstring(module->ldb, "error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret);
+		ldb_asprintf_errstring(module->ldb, "error in module %s: %s during %s (%d)", module->ops->name, ldb_strerror(ret), op, ret);
 	}
 
 	if (!(request->handle->flags & LDB_HANDLE_FLAG_DONE_CALLED)) {
@@ -876,6 +901,7 @@ static int ldb_modules_load_path(const char *path, const char *version)
 	} *loaded;
 	struct loaded *le;
 	int dlopen_flags;
+	bool deepbind_enabled = (getenv("LDB_MODULES_DISABLE_DEEPBIND") == NULL);
 
 	ret = stat(path, &st);
 	if (ret != 0) {
@@ -909,13 +935,25 @@ static int ldb_modules_load_path(const char *path, const char *version)
 
 	dlopen_flags = RTLD_NOW;
 #ifdef RTLD_DEEPBIND
-	/* use deepbind if possible, to avoid issues with different
-	   system library varients, for example ldb modules may be linked
-	   against Heimdal while the application may use MIT kerberos
-
-	   See the dlopen manpage for details
+	/*
+	 * use deepbind if possible, to avoid issues with different
+	 * system library varients, for example ldb modules may be linked
+	 * against Heimdal while the application may use MIT kerberos.
+	 *
+	 * See the dlopen manpage for details.
+	 *
+	 * One typical user is the bind_dlz module of Samba,
+	 * but symbol versioniong might be enough...
+	 *
+	 * We need a way to disable this in order to allow the
+	 * ldb_*ldap modules to work with a preloaded socket wrapper.
+	 *
+	 * So in future we may remove this completely
+	 * or at least invert the default behavior.
 	*/
-	dlopen_flags |= RTLD_DEEPBIND;
+	if (deepbind_enabled) {
+		dlopen_flags |= RTLD_DEEPBIND;
+	}
 #endif
 
 	handle = dlopen(path, dlopen_flags);
diff --git a/lib/ldb/ldb_map/ldb_map.c b/lib/ldb/ldb_map/ldb_map.c
index d35e5c604fc..66b00592921 100644
--- a/lib/ldb/ldb_map/ldb_map.c
+++ b/lib/ldb/ldb_map/ldb_map.c
@@ -223,12 +223,18 @@ int ldb_next_remote_request(struct ldb_module *module, struct ldb_request *reque
 
 	case LDB_ADD:
 		msg = ldb_msg_copy_shallow(request, request->op.add.message);
+		if (msg == NULL) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
 		msg->dn = ldb_dn_rebase_remote(msg, data, msg->dn);
 		request->op.add.message = msg;
 		break;
 
 	case LDB_MODIFY:
 		msg = ldb_msg_copy_shallow(request, request->op.mod.message);
+		if (msg == NULL) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
 		msg->dn = ldb_dn_rebase_remote(msg, data, msg->dn);
 		request->op.mod.message = msg;
 		break;
@@ -326,6 +332,7 @@ const struct ldb_map_attribute *map_attr_find_remote(const struct ldb_map_contex
 			break;
 
 		case LDB_MAP_RENAME:
+		case LDB_MAP_RENDROP:
 		case LDB_MAP_CONVERT:
 			if (ldb_attr_cmp(map->u.rename.remote_name, name) == 0) {
 				return map;
@@ -333,7 +340,7 @@ const struct ldb_map_attribute *map_attr_find_remote(const struct ldb_map_contex
 			break;
 
 		case LDB_MAP_GENERATE:
-			for (j = 0; map->u.generate.remote_names && map->u.generate.remote_names[j]; j++) {
+			for (j = 0; map->u.generate.remote_names[j]; j++) {
 				if (ldb_attr_cmp(map->u.generate.remote_names[j], name) == 0) {
 					return map;
 				}
@@ -377,6 +384,7 @@ const char *map_attr_map_local(void *mem_ctx, const struct ldb_map_attribute *ma
 		return talloc_strdup(mem_ctx, attr);
 
 	case LDB_MAP_RENAME:
+	case LDB_MAP_RENDROP:
 	case LDB_MAP_CONVERT:
 		return talloc_strdup(mem_ctx, map->u.rename.remote_name);
 
@@ -518,6 +526,7 @@ struct ldb_dn *ldb_dn_map_local(struct ldb_module *module, void *mem_ctx, struct
 			/* fall through */
 		case LDB_MAP_KEEP:
 		case LDB_MAP_RENAME:
+		case LDB_MAP_RENDROP:
 			name = map_attr_map_local(newdn, map, ldb_dn_get_component_name(dn, i));
 			if (name == NULL) goto failed;
 
@@ -593,6 +602,7 @@ struct ldb_dn *ldb_dn_map_remote(struct ldb_module *module, void *mem_ctx, struc
 			/* fall through */
 		case LDB_MAP_KEEP:
 		case LDB_MAP_RENAME:
+		case LDB_MAP_RENDROP:
 			name = map_attr_map_remote(newdn, map, ldb_dn_get_component_name(dn, i));
 			if (name == NULL) goto failed;
 
@@ -869,9 +879,9 @@ static int map_objectclass_convert_operator(struct ldb_module *module, void *mem
  * ============================== */
 
 /* Build a request to search a record by its DN. */
-struct ldb_request *map_search_base_req(struct map_context *ac, struct ldb_dn *dn, const char * const *attrs, const struct ldb_parse_tree *tree, void *context, ldb_map_callback_t callback)
+struct ldb_request *map_search_base_req(struct map_context *ac, struct ldb_dn *dn, const char * const *attrs, struct ldb_parse_tree *tree, void *context, ldb_map_callback_t callback)
 {
-	const struct ldb_parse_tree *search_tree;
+	struct ldb_parse_tree *search_tree;
 	struct ldb_context *ldb;
 	struct ldb_request *req;
 	int ret;
diff --git a/lib/ldb/ldb_map/ldb_map.h b/lib/ldb/ldb_map/ldb_map.h
index 5db3e02a08a..46ef3cca45a 100644
--- a/lib/ldb/ldb_map/ldb_map.h
+++ b/lib/ldb/ldb_map/ldb_map.h
@@ -63,9 +63,10 @@ struct ldb_map_attribute {
 		LDB_MAP_KEEP,   /* Keep as is. Same name locally and remotely. */
 		LDB_MAP_RENAME, /* Simply rename the attribute. Name changes, data is the same */
 		LDB_MAP_CONVERT, /* Rename + convert data */
-		LDB_MAP_GENERATE /* Use generate function for generating new name/data.
+		LDB_MAP_GENERATE, /* Use generate function for generating new name/data.
 						Used for generating attributes based on 
 						multiple remote attributes. */
+		LDB_MAP_RENDROP /* Rename the attribute. Strip from Add requests. */
 	} type;
 	
 	/* if set, will be called for search expressions that contain this attribute */
diff --git a/lib/ldb/ldb_map/ldb_map_inbound.c b/lib/ldb/ldb_map/ldb_map_inbound.c
index 38dd5ac066d..461e68113ab 100644
--- a/lib/ldb/ldb_map/ldb_map_inbound.c
+++ b/lib/ldb/ldb_map/ldb_map_inbound.c
@@ -65,7 +65,7 @@ static struct ldb_message_element *ldb_msg_el_map_local(struct ldb_module *modul
 
 /* Add a message element either to a local or to a remote message,
  * depending on whether it goes into the local or remote partition. */
-static int ldb_msg_el_partition(struct ldb_module *module, struct ldb_message *local, struct ldb_message *remote, const struct ldb_message *msg, const char *attr_name, /* const char * const names[], */ const struct ldb_message_element *old)
+static int ldb_msg_el_partition(struct ldb_module *module, enum ldb_request_type optype, struct ldb_message *local, struct ldb_message *remote, const struct ldb_message *msg, const char *attr_name, /* const char * const names[], */ const struct ldb_message_element *old)
 {
 	const struct ldb_map_context *data = map_get_context(module);
 	const struct ldb_map_attribute *map = map_attr_find_local(data, attr_name);
@@ -81,6 +81,13 @@ static int ldb_msg_el_partition(struct ldb_module *module, struct ldb_message *l
 	}
 
 	switch (map->type) {
+	case LDB_MAP_RENDROP:
+		if (optype != LDB_ADD) {
+			/* do the same as LDB_MAP_RENAME */
+			el = ldb_msg_el_map_local(module, remote, map, old);
+			break;
+		}
+		/* fall through */
 	case LDB_MAP_IGNORE:
 		goto local;
 
@@ -157,7 +164,7 @@ static bool ldb_msg_check_remote(struct ldb_module *module, const struct ldb_mes
 
 /* Split message elements that stay in the local partition from those
  * that are mapped into the remote partition. */
-static int ldb_msg_partition(struct ldb_module *module, struct ldb_message *local, struct ldb_message *remote, const struct ldb_message *msg)
+static int ldb_msg_partition(struct ldb_module *module, enum ldb_request_type optype, struct ldb_message *local, struct ldb_message *remote, const struct ldb_message *msg)
 {
 	/* const char * const names[]; */
 	struct ldb_context *ldb;
@@ -175,7 +182,7 @@ static int ldb_msg_partition(struct ldb_module *module, struct ldb_message *loca
 			continue;
 		}
 
-		ret = ldb_msg_el_partition(module, local, remote, msg, msg->elements[i].name, &msg->elements[i]);
+		ret = ldb_msg_el_partition(module, optype, local, remote, msg, msg->elements[i].name, &msg->elements[i]);
 		if (ret) {
 			return ret;
 		}
@@ -408,7 +415,7 @@ int ldb_map_add(struct ldb_module *module, struct ldb_request *req)
 	remote_msg->dn = ldb_dn_map_local(ac->module, remote_msg, msg->dn);
 
 	/* Split local from remote message */
-	ldb_msg_partition(module, ac->local_msg, remote_msg, msg);
+	ldb_msg_partition(module, req->operation, ac->local_msg, remote_msg, msg);
 
 	/* Prepare the remote operation */
 	ret = ldb_build_add_req(&ac->remote_req, ldb,
@@ -469,7 +476,7 @@ static int map_add_do_local(struct map_context *ac)
 int ldb_map_modify(struct ldb_module *module, struct ldb_request *req)
 {
 	const struct ldb_message *msg = req->op.mod.message;
-	struct ldb_request *search_req;
+	struct ldb_request *search_req = NULL;
 	struct ldb_message *remote_msg;
 	struct ldb_context *ldb;
 	struct map_context *ac;
@@ -518,7 +525,7 @@ int ldb_map_modify(struct ldb_module *module, struct ldb_request *req)
 	remote_msg->dn = ldb_dn_map_local(ac->module, remote_msg, msg->dn);
 
 	/* Split local from remote message */
-	ldb_msg_partition(module, ac->local_msg, remote_msg, msg);
+	ldb_msg_partition(module, req->operation, ac->local_msg, remote_msg, msg);
 
 	/* Prepare the remote operation */
 	ret = ldb_build_mod_req(&ac->remote_req, ldb,
@@ -692,7 +699,7 @@ static int map_delete_do_local(struct map_context *ac)
 /* Rename a record. */
 int ldb_map_rename(struct ldb_module *module, struct ldb_request *req)
 {
-	struct ldb_request *search_req;
+	struct ldb_request *search_req = NULL;
 	struct ldb_context *ldb;
 	struct map_context *ac;
 	int ret;
diff --git a/lib/ldb/ldb_map/ldb_map_outbound.c b/lib/ldb/ldb_map/ldb_map_outbound.c
index 2c517a625dc..1ee2dfe12de 100644
--- a/lib/ldb/ldb_map/ldb_map_outbound.c
+++ b/lib/ldb/ldb_map/ldb_map_outbound.c
@@ -134,6 +134,7 @@ static const char **map_attrs_collect_remote(struct ldb_module *module, void *me
 			goto named;
 
 		case LDB_MAP_RENAME:
+		case LDB_MAP_RENDROP:
 		case LDB_MAP_CONVERT:
 			name = map->u.rename.remote_name;
 			goto named;
@@ -189,26 +190,30 @@ static int map_attrs_partition(struct ldb_module *module, void *mem_ctx, const c
 static int ldb_msg_replace(struct ldb_message *msg, const struct ldb_message_element *el)
 {
 	struct ldb_message_element *old;
-
+	int j;
 	old = ldb_msg_find_element(msg, el->name);
 
 	/* no local result, add as new element */
 	if (old == NULL) {
 		if (ldb_msg_add_empty(msg, el->name, 0, &old) != 0) {
-			return -1;
+			return LDB_ERR_OPERATIONS_ERROR;
 		}
-		talloc_free(discard_const_p(char, old->name));
+	}
+	else {
+		talloc_free(old->values);
 	}
 
-	/* copy new element */
-	*old = *el;
-
-	/* and make sure we reference the contents */
-	if (!talloc_reference(msg->elements, el->name)) {
-		return -1;
+	old->values = talloc_array(msg->elements, struct ldb_val, el->num_values);
+	old->num_values = el->num_values;
+	if (old->values == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
-	if (!talloc_reference(msg->elements, el->values)) {
-		return -1;
+	/* copy the values into the element */
+	for (j=0;j<el->num_values;j++) {
+		old->values[j] = ldb_val_dup(old->values, &el->values[j]);
+		if (old->values[j].data == NULL && el->values[j].length != 0) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
 	}
 
 	return 0;
@@ -241,7 +246,7 @@ static struct ldb_message_element *ldb_msg_el_map_remote(struct ldb_module *modu
 
 	for (i = 0; data->attribute_maps[i].local_name; i++) {
 		struct ldb_map_attribute *am = &data->attribute_maps[i];
-		if ((am->type == LDB_MAP_RENAME &&
+		if (((am->type == LDB_MAP_RENAME || am->type == LDB_MAP_RENDROP) &&
 			!strcmp(am->u.rename.remote_name, attr_name))
 		    || (am->type == LDB_MAP_CONVERT &&
 			!strcmp(am->u.convert.remote_name, attr_name))) {
@@ -306,6 +311,7 @@ static int ldb_msg_el_merge(struct ldb_module *module, struct ldb_message *local
 		remote_name = attr_name;
 		break;
 	case LDB_MAP_RENAME:
+	case LDB_MAP_RENDROP:
 		remote_name = map->u.rename.remote_name;
 		break;
 	case LDB_MAP_GENERATE:
@@ -327,6 +333,7 @@ static int ldb_msg_el_merge(struct ldb_module *module, struct ldb_message *local
 		/* fall through */
 	case LDB_MAP_KEEP:
 	case LDB_MAP_RENAME:
+	case LDB_MAP_RENDROP:
 		old = ldb_msg_find_element(remote, remote_name);
 		if (old) {
 			el = ldb_msg_el_map_remote(module, local, map, attr_name, old);
@@ -480,7 +487,7 @@ static int map_reply_remote(struct map_context *ac, struct ldb_reply *ares)
 	msg = ldb_msg_new(ares);
 	if (msg == NULL) {
 		map_oom(ac->module);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	/* Merge remote message into new message */
@@ -494,7 +501,7 @@ static int map_reply_remote(struct map_context *ac, struct ldb_reply *ares)
 	dn = ldb_dn_map_rebase_remote(ac->module, msg, ares->message->dn);
 	if (dn == NULL) {
 		talloc_free(msg);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 	msg->dn = dn;
 
@@ -581,7 +588,7 @@ static int map_subtree_select_local_not(struct ldb_module *module, void *mem_ctx
 	*new = talloc_memdup(mem_ctx, tree, sizeof(struct ldb_parse_tree));
 	if (*new == NULL) {
 		map_oom(module);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	/* Generate new subtree */
@@ -613,7 +620,7 @@ static int map_subtree_select_local_list(struct ldb_module *module, void *mem_ct
 	*new = talloc_memdup(mem_ctx, tree, sizeof(struct ldb_parse_tree));
 	if (*new == NULL) {
 		map_oom(module);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	/* Prepare list of subtrees */
@@ -622,7 +629,7 @@ static int map_subtree_select_local_list(struct ldb_module *module, void *mem_ct
 	if ((*new)->u.list.elements == NULL) {
 		map_oom(module);
 		talloc_free(*new);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	/* Generate new list of subtrees */
@@ -662,7 +669,7 @@ static int map_subtree_select_local_simple(struct ldb_module *module, void *mem_
 	*new = talloc_memdup(mem_ctx, tree, sizeof(struct ldb_parse_tree));
 	if (*new == NULL) {
 		map_oom(module);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	return 0;
@@ -705,7 +712,7 @@ static int map_subtree_collect_remote_not(struct ldb_module *module, void *mem_c
 	*new = talloc_memdup(mem_ctx, tree, sizeof(struct ldb_parse_tree));
 	if (*new == NULL) {
 		map_oom(module);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	/* Generate new subtree */
@@ -737,7 +744,7 @@ static int map_subtree_collect_remote_list(struct ldb_module *module, void *mem_
 	*new = talloc_memdup(mem_ctx, tree, sizeof(struct ldb_parse_tree));
 	if (*new == NULL) {
 		map_oom(module);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	/* Prepare list of subtrees */
@@ -746,7 +753,7 @@ static int map_subtree_collect_remote_list(struct ldb_module *module, void *mem_
 	if ((*new)->u.list.elements == NULL) {
 		map_oom(module);
 		talloc_free(*new);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	/* Generate new list of subtrees */
@@ -788,7 +795,7 @@ int map_subtree_collect_remote_simple(struct ldb_module *module, void *mem_ctx,
 	*new = talloc(mem_ctx, struct ldb_parse_tree);
 	if (*new == NULL) {
 		map_oom(module);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 	**new = *tree;
 	
@@ -825,7 +832,7 @@ int map_subtree_collect_remote_simple(struct ldb_module *module, void *mem_ctx,
 		break;
 	default:			/* unknown kind of simple subtree */
 		talloc_free(*new);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	if (attr == NULL) {
@@ -834,7 +841,7 @@ int map_subtree_collect_remote_simple(struct ldb_module *module, void *mem_ctx,
 		return 0;
 	}
 
-	if (map->type == LDB_MAP_RENAME) {
+	if (map->type == LDB_MAP_RENAME || map->type == LDB_MAP_RENDROP) {
 		/* Nothing more to do here, the attribute has been renamed */
 		return 0;
 	}
@@ -848,7 +855,7 @@ int map_subtree_collect_remote_simple(struct ldb_module *module, void *mem_ctx,
 		int i;
 		/* Map value */
 		(*new)->u.substring.chunks = NULL;
-		for (i=0; tree->u.substring.chunks[i]; i++) {
+		for (i=0; tree->u.substring.chunks && tree->u.substring.chunks[i]; i++) {
 			(*new)->u.substring.chunks = talloc_realloc(*new, (*new)->u.substring.chunks, struct ldb_val *, i+2);
 			if (!(*new)->u.substring.chunks) {
 				talloc_free(*new);
@@ -880,7 +887,7 @@ int map_subtree_collect_remote_simple(struct ldb_module *module, void *mem_ctx,
 		break;
 	default:			/* unknown kind of simple subtree */
 		talloc_free(*new);
-		return -1;
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
 	return 0;
@@ -1031,7 +1038,7 @@ done:
 
 oom:
 	map_oom(module);
-	return -1;
+	return LDB_ERR_OPERATIONS_ERROR;
 }
 
 
@@ -1264,8 +1271,7 @@ static int map_remote_search_callback(struct ldb_request *req,
 
 		if (ret != LDB_SUCCESS) {
 			talloc_free(ares);
-			return ldb_module_done(ac->req, NULL, NULL,
-						LDB_ERR_OPERATIONS_ERROR);
+			return ldb_module_done(ac->req, NULL, NULL, ret);
 		}
 		break;
 
diff --git a/lib/ldb/ldb_map/ldb_map_private.h b/lib/ldb/ldb_map/ldb_map_private.h
index 7faaa997088..6e4a9dded58 100644
--- a/lib/ldb/ldb_map/ldb_map_private.h
+++ b/lib/ldb/ldb_map/ldb_map_private.h
@@ -75,7 +75,7 @@ struct ldb_dn *ldb_dn_map_rebase_remote(struct ldb_module *module, void *mem_ctx
 struct ldb_request *map_search_base_req(struct map_context *ac,
 					struct ldb_dn *dn,
 					const char * const *attrs,
-					const struct ldb_parse_tree *tree,
+					struct ldb_parse_tree *tree,
 					void *context,
 					ldb_map_callback_t callback);
 struct ldb_request *map_build_fixup_req(struct map_context *ac,
diff --git a/lib/ldb/ldb_tdb/ldb_tdb.c b/lib/ldb/ldb_tdb/ldb_tdb.c
index 30c58f5ee36..d3c83f5d579 100644
--- a/lib/ldb/ldb_tdb/ldb_tdb.c
+++ b/lib/ldb/ldb_tdb/ldb_tdb.c
@@ -1560,10 +1560,13 @@ static int ltdb_connect(struct ldb_context *ldb, const char *url,
 				   ldb_get_create_perms(ldb), ldb);
 	if (!ltdb->tdb) {
 		ldb_asprintf_errstring(ldb,
-				       "Unable to open tdb '%s'", path);
+				       "Unable to open tdb '%s': %s", path, strerror(errno));
 		ldb_debug(ldb, LDB_DEBUG_ERROR,
-			  "Unable to open tdb '%s'", path);
+			  "Unable to open tdb '%s': %s", path, strerror(errno));
 		talloc_free(ltdb);
+		if (errno == EACCES || errno == EPERM) {
+			return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+		}
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
diff --git a/lib/ldb/modules/rdn_name.c b/lib/ldb/modules/rdn_name.c
index 50b63aee133..f44ea71f660 100644
--- a/lib/ldb/modules/rdn_name.c
+++ b/lib/ldb/modules/rdn_name.c
@@ -371,6 +371,7 @@ static int rdn_name_modify(struct ldb_module *module, struct ldb_request *req)
 {
 	struct ldb_context *ldb;
 	const struct ldb_val *rdn_val_p;
+	struct ldb_message_element *e = NULL;
 
 	ldb = ldb_module_get_ctx(module);
 
@@ -389,10 +390,15 @@ static int rdn_name_modify(struct ldb_module *module, struct ldb_request *req)
 		return LDB_ERR_INVALID_DN_SYNTAX;
 	}
 
-	if (ldb_msg_find_element(req->op.mod.message, "distinguishedName")) {
+	e = ldb_msg_find_element(req->op.mod.message, "distinguishedName");
+	if (e != NULL) {
 		ldb_asprintf_errstring(ldb, "Modify of 'distinguishedName' on %s not permitted, must use 'rename' operation instead",
 				       ldb_dn_get_linearized(req->op.mod.message->dn));
-		return LDB_ERR_CONSTRAINT_VIOLATION;
+		if (e->flags == LDB_FLAG_MOD_REPLACE) {
+			return LDB_ERR_CONSTRAINT_VIOLATION;
+		} else {
+			return LDB_ERR_UNWILLING_TO_PERFORM;
+		}
 	}
 
 	if (ldb_msg_find_element(req->op.mod.message, "name")) {
diff --git a/lib/ldb/modules/sort.c b/lib/ldb/modules/sort.c
index c6fce2d96e0..1b762f7e51b 100644
--- a/lib/ldb/modules/sort.c
+++ b/lib/ldb/modules/sort.c
@@ -252,7 +252,6 @@ static int server_sort_search(struct ldb_module *module, struct ldb_request *req
 	struct ldb_control *control;
 	struct ldb_server_sort_control **sort_ctrls;
 	struct ldb_control **saved_controls;
-	struct ldb_control **controls;
 	struct ldb_request *down_req;
 	struct sort_context *ac;
 	struct ldb_context *ldb;
@@ -286,6 +285,7 @@ static int server_sort_search(struct ldb_module *module, struct ldb_request *req
 		
 	if (sort_ctrls[1] != NULL) {
 		if (control->critical) {
+			struct ldb_control **controls = NULL;
 
 			/* callback immediately */
 			ret = build_response(req, &controls,
diff --git a/lib/ldb/pyldb.c b/lib/ldb/pyldb.c
index 8c9d6b9599b..a45317a6434 100644
--- a/lib/ldb/pyldb.c
+++ b/lib/ldb/pyldb.c
@@ -193,7 +193,7 @@ static void PyErr_SetLdbError(PyObject *error, int ret, struct ldb_context *ldb_
 				      ldb_ctx == NULL?ldb_strerror(ret):ldb_errstring(ldb_ctx)));
 }
 
-static PyObject *PyObject_FromLdbValue(struct ldb_val *val)
+static PyObject *PyObject_FromLdbValue(const struct ldb_val *val)
 {
 	return PyString_FromStringAndSize((const char *)val->data, val->length);
 }
@@ -556,6 +556,103 @@ static PyObject *py_ldb_dn_is_child_of(PyLdbDnObject *self, PyObject *args)
 	return PyBool_FromLong(ldb_dn_compare_base(base, dn) == 0);
 }
 
+static PyObject *py_ldb_dn_get_component_name(PyLdbDnObject *self, PyObject *args)
+{
+	struct ldb_dn *dn;
+	const char *name;
+	unsigned int num = 0;
+
+	if (!PyArg_ParseTuple(args, "I", &num))
+		return NULL;
+
+	dn = pyldb_Dn_AsDn((PyObject *)self);
+
+	name = ldb_dn_get_component_name(dn, num);
+	if (name == NULL) {
+		Py_RETURN_NONE;
+	}
+
+	return PyString_FromString(name);
+}
+
+static PyObject *py_ldb_dn_get_component_value(PyLdbDnObject *self, PyObject *args)
+{
+	struct ldb_dn *dn;
+	const struct ldb_val *val;
+	unsigned int num = 0;
+
+	if (!PyArg_ParseTuple(args, "I", &num))
+		return NULL;
+
+	dn = pyldb_Dn_AsDn((PyObject *)self);
+
+	val = ldb_dn_get_component_val(dn, num);
+	if (val == NULL) {
+		Py_RETURN_NONE;
+	}
+
+	return PyObject_FromLdbValue(val);
+}
+
+static PyObject *py_ldb_dn_set_component(PyLdbDnObject *self, PyObject *args)
+{
+	unsigned int num = 0;
+	char *name = NULL;
+	PyObject *value = Py_None;
+	struct ldb_val val = { NULL, };
+	int err;
+
+	if (!PyArg_ParseTuple(args, "IsO", &num, &name, &value))
+		return NULL;
+
+	if (value != Py_None) {
+		if (!PyString_Check(value)) {
+			PyErr_SetString(PyExc_TypeError, "Expected a string argument");
+			return NULL;
+		}
+		val.data = (uint8_t *)PyString_AsString(value);
+		val.length = PyString_Size(value);
+	}
+
+	err = ldb_dn_set_component(self->dn, num, name, val);
+	if (err != LDB_SUCCESS) {
+		PyErr_SetString(PyExc_TypeError, "Failed to set component");
+		return NULL;
+	}
+
+	Py_RETURN_NONE;
+}
+
+static PyObject *py_ldb_dn_get_rdn_name(PyLdbDnObject *self)
+{
+	struct ldb_dn *dn;
+	const char *name;
+
+	dn = pyldb_Dn_AsDn((PyObject *)self);
+
+	name = ldb_dn_get_rdn_name(dn);
+	if (name == NULL) {
+		Py_RETURN_NONE;
+	}
+
+	return PyString_FromString(name);
+}
+
+static PyObject *py_ldb_dn_get_rdn_value(PyLdbDnObject *self)
+{
+	struct ldb_dn *dn;
+	const struct ldb_val *val;
+
+	dn = pyldb_Dn_AsDn((PyObject *)self);
+
+	val = ldb_dn_get_rdn_val(dn);
+	if (val == NULL) {
+		Py_RETURN_NONE;
+	}
+
+	return PyObject_FromLdbValue(val);
+}
+
 static PyMethodDef py_ldb_dn_methods[] = {
 	{ "validate", (PyCFunction)py_ldb_dn_validate, METH_NOARGS, 
 		"S.validate() -> bool\n"
@@ -601,8 +698,23 @@ static PyMethodDef py_ldb_dn_methods[] = {
 		"S.get_extended_component(name) -> string\n\n"
 		"returns a DN extended component as a binary string"},
 	{ "set_extended_component", (PyCFunction)py_ldb_dn_set_extended_component, METH_VARARGS,
-		"S.set_extended_component(name, value) -> string\n\n"
+		"S.set_extended_component(name, value) -> None\n\n"
 		"set a DN extended component as a binary string"},
+	{ "get_component_name", (PyCFunction)py_ldb_dn_get_component_name, METH_VARARGS,
+		"S.get_component_name(num) -> string\n"
+		"get the attribute name of the specified component" },
+	{ "get_component_value", (PyCFunction)py_ldb_dn_get_component_value, METH_VARARGS,
+		"S.get_component_value(num) -> string\n"
+		"get the attribute value of the specified component as a binary string" },
+	{ "set_component", (PyCFunction)py_ldb_dn_set_component, METH_VARARGS,
+		"S.get_component_value(num, name, value) -> None\n"
+		"set the attribute name and value of the specified component" },
+	{ "get_rdn_name", (PyCFunction)py_ldb_dn_get_rdn_name, METH_NOARGS,
+		"S.get_rdn_name() -> string\n"
+		"get the RDN attribute name" },
+	{ "get_rdn_value", (PyCFunction)py_ldb_dn_get_rdn_value, METH_NOARGS,
+		"S.get_rdn_value() -> string\n"
+		"get the RDN attribute value as a binary string" },
 	{ NULL }
 };
 
@@ -1075,6 +1187,10 @@ static struct ldb_message *PyDict_AsMessage(TALLOC_CTX *mem_ctx,
 	PyObject *dn_value = PyDict_GetItemString(py_obj, "dn");
 
 	msg = ldb_msg_new(mem_ctx);
+	if (msg == NULL) {
+		PyErr_NoMemory();
+		return NULL;
+	}
 	msg->elements = talloc_zero_array(msg, struct ldb_message_element, PyDict_Size(py_obj));
 
 	if (dn_value) {
@@ -3088,6 +3204,8 @@ static int py_module_request(struct ldb_module *mod, struct ldb_request *req)
 	py_result = PyObject_CallMethod(py_ldb, discard_const_p(char, "request"),
 					discard_const_p(char, ""));
 
+	Py_XDECREF(py_result);
+
 	return LDB_ERR_OPERATIONS_ERROR;
 }
 
@@ -3099,6 +3217,8 @@ static int py_module_extended(struct ldb_module *mod, struct ldb_request *req)
 	py_result = PyObject_CallMethod(py_ldb, discard_const_p(char, "extended"),
 					discard_const_p(char, ""));
 
+	Py_XDECREF(py_result);
+
 	return LDB_ERR_OPERATIONS_ERROR;
 }
 
diff --git a/lib/ldb/tools/ldbtest.c b/lib/ldb/tools/ldbtest.c
index 4e181af9d55..384624ca553 100644
--- a/lib/ldb/tools/ldbtest.c
+++ b/lib/ldb/tools/ldbtest.c
@@ -324,6 +324,10 @@ static void start_test_index(struct ldb_context **ldb)
 	ldb_delete(*ldb, indexlist);
 
 	msg = ldb_msg_new(NULL);
+	if (msg == NULL) {
+		printf("ldb_msg_new failed\n");
+		exit(LDB_ERR_OPERATIONS_ERROR);
+	}
 
 	msg->dn = indexlist;
 	ldb_msg_add_string(msg, "@IDXATTR", strdup("uid"));
diff --git a/lib/ldb/wscript b/lib/ldb/wscript
index f5647b1a59f..a375675a158 100755
--- a/lib/ldb/wscript
+++ b/lib/ldb/wscript
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 
 APPNAME = 'ldb'
-VERSION = '1.1.16'
+VERSION = '1.1.17'
 
 blddir = 'bin'
 
@@ -10,7 +10,7 @@ import sys, os
 # find the buildtools directory
 srcdir = '.'
 while not os.path.exists(srcdir+'/buildtools') and len(srcdir.split('/')) < 5:
-    srcdir = '../' + srcdir
+    srcdir = srcdir + '/..'
 sys.path.insert(0, srcdir + '/buildtools/wafsamba')
 
 import wafsamba, samba_dist, Options
@@ -257,10 +257,10 @@ def build(bld):
         bld.SAMBA_BINARY('ldbdump', 'tools/ldbdump.c', deps='ldb-cmdline ldb',
                          install=False)
 
-    bld.SAMBA_LIBRARY('ldb-cmdline',
-                      source='tools/ldbutil.c tools/cmdline.c',
-                      deps='ldb dl popt',
-                      private_library=True)
+        bld.SAMBA_LIBRARY('ldb-cmdline',
+                          source='tools/ldbutil.c tools/cmdline.c',
+                          deps='ldb dl popt',
+                          private_library=True)
 
 
 def test(ctx):