NTSTATUS gpo_fetch_files(TALLOC_CTX *mem_ctx,
                         ADS_STRUCT *ads,
                         const char *cache_dir,
			 const struct GROUP_POLICY_OBJECT *gpo)
{
	NTSTATUS result;
	char *server, *service, *nt_path, *unix_path;
	char *nt_ini_path, *unix_ini_path;
	struct cli_state *cli;


	result = gpo_explode_filesyspath(mem_ctx, cache_dir, gpo->file_sys_path,
					 &server, &service, &nt_path,
					 &unix_path);
	NT_STATUS_NOT_OK_RETURN(result);

	/* for now reuse the existing ds connection */

	result = gpo_connect_server(ads, ads->server.ldap_server, service, &cli);
	NT_STATUS_NOT_OK_RETURN(result);

	result = gpo_prepare_local_store(mem_ctx, cache_dir, unix_path);
	NT_STATUS_NOT_OK_RETURN(result);

	unix_ini_path = talloc_asprintf(mem_ctx, "%s/%s", unix_path, GPT_INI);
	nt_ini_path = talloc_asprintf(mem_ctx, "%s\\%s", nt_path, GPT_INI);
	NT_STATUS_HAVE_NO_MEMORY(unix_ini_path);
	NT_STATUS_HAVE_NO_MEMORY(nt_ini_path);

	result = gpo_copy_file(mem_ctx, cli, nt_ini_path, unix_ini_path);
	NT_STATUS_NOT_OK_RETURN(result);

	result = gpo_sync_directories(mem_ctx, cli, nt_path, unix_path);
	NT_STATUS_NOT_OK_RETURN(result);

	return NT_STATUS_OK;
}

static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
			       struct replUpToDateVectorBlob **pold_utdv)
{
	krb5_error_code ret = 0;
	struct libnet_keytab_context *keytab_ctx;
	struct libnet_keytab_entry *entry;
	struct replUpToDateVectorBlob *old_utdv = NULL;
	char *principal;

	ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
	if (ret) {
		return krb5_to_nt_status(ret);
	}

	keytab_ctx->dns_domain_name = ctx->dns_domain_name;
	keytab_ctx->clean_old_entries = ctx->clean_old_entries;
	ctx->private_data = keytab_ctx;

	principal = talloc_asprintf(mem_ctx, "UTDV/%[email protected]%s",
				    ctx->nc_dn, ctx->dns_domain_name);
	NT_STATUS_HAVE_NO_MEMORY(principal);

	entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
				     mem_ctx);
	if (entry) {
		enum ndr_err_code ndr_err;
		old_utdv = talloc(mem_ctx, struct replUpToDateVectorBlob);

		ndr_err = ndr_pull_struct_blob(&entry->password, old_utdv, old_utdv,
				(ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
			ctx->error_message = talloc_asprintf(ctx,
					"Failed to pull UpToDateVector: %s",
					nt_errstr(status));
			return status;
		}

		if (DEBUGLEVEL >= 10) {
			NDR_PRINT_DEBUG(replUpToDateVectorBlob, old_utdv);
		}
	}

	if (pold_utdv) {
		*pold_utdv = old_utdv;
	}

	return NT_STATUS_OK;
}

NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, struct epm_tower *tower, struct dcerpc_binding **b_out)
{
	NTSTATUS status;
	struct dcerpc_binding *binding;

	binding = talloc(mem_ctx, struct dcerpc_binding);
	NT_STATUS_HAVE_NO_MEMORY(binding);

	ZERO_STRUCT(binding->object);
	binding->options = NULL;
	binding->host = NULL;
	binding->flags = 0;

	binding->transport = dcerpc_transport_by_tower(tower);

	if (binding->transport == (unsigned int)-1) {
		return NT_STATUS_NOT_SUPPORTED;
	}

	if (tower->num_floors < 1) {
		return NT_STATUS_OK;
	}

	/* Set object uuid */
	status = dcerpc_floor_get_lhs_data(&tower->floors[0], &binding->object);
	
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(1, ("Error pulling object uuid and version: %s", nt_errstr(status)));	
		return status;
	}

	/* Ignore floor 1, it contains the NDR version info */
	
	binding->options = NULL;

	/* Set endpoint */
	if (tower->num_floors >= 4) {
		binding->endpoint = dcerpc_floor_get_rhs_data(mem_ctx, &tower->floors[3]);
	} else {
		binding->endpoint = NULL;
	}

	/* Set network address */
	if (tower->num_floors >= 5) {
		binding->host = dcerpc_floor_get_rhs_data(mem_ctx, &tower->floors[4]);
	}
	*b_out = binding;
	return NT_STATUS_OK;
}

NTSTATUS gpo_get_sysvol_gpt_version(TALLOC_CTX *mem_ctx,
				    const char *unix_path,
				    uint32_t *sysvol_version,
				    char **display_name)
{
	NTSTATUS status;
	uint32_t version = 0;
	char *local_path = NULL;
	char *name = NULL;

	if (!unix_path) {
		return NT_STATUS_OK;
	}

	local_path = talloc_asprintf(mem_ctx, "%s/%s", unix_path, GPT_INI);
	NT_STATUS_HAVE_NO_MEMORY(local_path);

	status = parse_gpt_ini(mem_ctx, local_path, &version, &name);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10,("gpo_get_sysvol_gpt_version: "
			"failed to parse ini [%s]: %s\n",
			local_path, nt_errstr(status)));
		return status;
	}

	if (sysvol_version) {
		*sysvol_version = version;
	}

	if (name && *display_name) {
		*display_name = talloc_strdup(mem_ctx, name);
		NT_STATUS_HAVE_NO_MEMORY(*display_name);
	}

	return NT_STATUS_OK;
}

/**
 create a temporary directory under the output dir
*/
_PUBLIC_ NTSTATUS torture_temp_dir(struct torture_context *tctx,
                                   const char *prefix, char **tempdir)
{
    SMB_ASSERT(tctx->outputdir != NULL);

    *tempdir = talloc_asprintf(tctx, "%s/%s.XXXXXX", tctx->outputdir,
                               prefix);
    NT_STATUS_HAVE_NO_MEMORY(*tempdir);

    if (mkdtemp(*tempdir) == NULL) {
        return map_nt_error_from_unix_common(errno);
    }

    return NT_STATUS_OK;
}

/*
 * init the sessions structures
 */
NTSTATUS smbsrv_init_sessions(struct smbsrv_connection *smb_conn, uint64_t limit)
{
    /*
     * the idr_* functions take 'int' as limit,
     * and only work with a max limit 0x00FFFFFF
     */
    limit &= 0x00FFFFFF;

    smb_conn->sessions.idtree_vuid	= idr_init(smb_conn);
    NT_STATUS_HAVE_NO_MEMORY(smb_conn->sessions.idtree_vuid);
    smb_conn->sessions.idtree_limit	= limit;
    smb_conn->sessions.list		= NULL;

    return NT_STATUS_OK;
}

NTSTATUS libnet_dssync_init_context(TALLOC_CTX *mem_ctx,
				    struct dssync_context **ctx_p)
{
	struct dssync_context *ctx;

	ctx = talloc_zero(mem_ctx, struct dssync_context);
	NT_STATUS_HAVE_NO_MEMORY(ctx);

	talloc_set_destructor(ctx, libnet_dssync_free_context);
	ctx->clean_old_entries = false;

	*ctx_p = ctx;

	return NT_STATUS_OK;
}

NTSTATUS wbsrv_samba3_pull_request(struct wbsrv_samba3_call *call)
{
	if (call->in.length < sizeof(*call->request)) {
		DEBUG(0,("wbsrv_samba3_pull_request: invalid blob length %lu should be %lu\n"
			 " make sure you use the correct winbind client tools!\n",
			 (long)call->in.length, (long)sizeof(*call->request)));
		return NT_STATUS_INVALID_PARAMETER;
	}

	call->request = talloc_zero(call, struct winbindd_request);
	NT_STATUS_HAVE_NO_MEMORY(call->request);

	/* the packet layout is the same as the in memory layout of the request, so just copy it */
	memcpy(call->request, call->in.data, sizeof(*call->request));

	if (call->in.length != sizeof(*call->request) + call->request->extra_len) {
		DEBUG(0,(__location__ " : invalid extra_len %u should be %u\n",
			 call->request->extra_len, (unsigned)(call->in.length - sizeof(*call->request))));
		return NT_STATUS_INVALID_PARAMETER;
	}

	/* there may be extra data */
	if (call->request->extra_len != 0) {
		call->request->extra_data.data = talloc_size(call->request, call->request->extra_len+1);
		NT_STATUS_HAVE_NO_MEMORY(call->request->extra_data.data);
		/* guarantee a nul termination, as many of the uses of
		   this field is for strings */
		memcpy(call->request->extra_data.data, call->in.data + sizeof(*call->request),
		       call->request->extra_len);
		call->request->extra_data.data[call->request->extra_len] = 0;
	} else {
		call->request->extra_data.data = NULL;
	}

	return NT_STATUS_OK;
}

NTSTATUS wbsrv_samba3_setpwent(struct wbsrv_samba3_call *s3call)
{
	struct composite_context *ctx;
	struct wbsrv_service *service = s3call->wbconn->listen_socket->service;

	DEBUG(5, ("wbsrv_samba3_setpwent called\n"));

	ctx = wb_cmd_setpwent_send(s3call, service);
	NT_STATUS_HAVE_NO_MEMORY(ctx);

	ctx->async.fn = setpwent_recv;
	ctx->async.private_data = s3call;
	s3call->flags |= WBSRV_CALL_FLAGS_REPLY_ASYNC;
	return NT_STATUS_OK;
}

NTSTATUS merge_nt_token(TALLOC_CTX *mem_ctx,
			const struct security_token *token_1,
			const struct security_token *token_2,
			struct security_token **token_out)
{
	struct security_token *token = NULL;
	NTSTATUS status;
	int i;

	if (!token_1 || !token_2 || !token_out) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	token = talloc_zero(mem_ctx, struct security_token);
	NT_STATUS_HAVE_NO_MEMORY(token);

	for (i=0; i < token_1->num_sids; i++) {
		status = add_sid_to_array_unique(mem_ctx,
						 &token_1->sids[i],
						 &token->sids,
						 &token->num_sids);
		if (!NT_STATUS_IS_OK(status)) {
			TALLOC_FREE(token);
			return status;
		}
	}

	for (i=0; i < token_2->num_sids; i++) {
		status = add_sid_to_array_unique(mem_ctx,
						 &token_2->sids[i],
						 &token->sids,
						 &token->num_sids);
		if (!NT_STATUS_IS_OK(status)) {
			TALLOC_FREE(token);
			return status;
		}
	}

	token->privilege_mask |= token_1->privilege_mask;
	token->privilege_mask |= token_2->privilege_mask;

	token->rights_mask |= token_1->rights_mask;
	token->rights_mask |= token_2->rights_mask;

	*token_out = token;

	return NT_STATUS_OK;
}

NTSTATUS wbsrv_samba3_list_groups(struct wbsrv_samba3_call *s3call)
{
	struct composite_context *ctx;
	struct wbsrv_service *service = s3call->wbconn->listen_socket->service;

	DEBUG(5, ("wbsrv_samba4_list_groups called\n"));

	ctx = wb_cmd_list_groups_send(s3call, service,
				      s3call->request.domain_name);
	NT_STATUS_HAVE_NO_MEMORY(ctx);

	ctx->async.fn = list_groups_recv;
	ctx->async.private_data = s3call;
	s3call->flags |= WBSRV_CALL_FLAGS_REPLY_ASYNC;
	return NT_STATUS_OK;
}

NTSTATUS gpext_scripts_init(void)
{
	NTSTATUS status;

	ctx = talloc_init("gpext_scripts_init");
	NT_STATUS_HAVE_NO_MEMORY(ctx);

	status = gpext_register_gp_extension(ctx, SMB_GPEXT_INTERFACE_VERSION,
					     GP_EXT_NAME, GP_EXT_GUID_SCRIPTS,
					     &scripts_methods);
	if (!NT_STATUS_IS_OK(status)) {
		TALLOC_FREE(ctx);
	}

	return status;
}

NTSTATUS gp_set_acl (struct gp_context *gp_ctx, const char *dn_str, const struct security_descriptor *sd)
{
	TALLOC_CTX *mem_ctx;
	struct security_descriptor *fs_sd;
	struct gp_object *gpo;
	NTSTATUS status;

	/* Create a forked memory context, as a base for everything here */
	mem_ctx = talloc_new(gp_ctx);
	NT_STATUS_HAVE_NO_MEMORY(mem_ctx);

	/* Set the ACL on LDAP database */
	status = gp_set_ads_acl(gp_ctx, dn_str, sd);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("Failed to set ACL on ADS\n"));
		talloc_free(mem_ctx);
		return status;
	}

	/* Get the group policy object information, for filesystem location and merged sd */
	status = gp_get_gpo_info(gp_ctx, dn_str, &gpo);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("Failed to set ACL on ADS\n"));
		talloc_free(mem_ctx);
		return status;
	}

	/* Create matching file and DS security descriptors */
	status = gp_create_gpt_security_descriptor(mem_ctx, gpo->security_descriptor, &fs_sd);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("Failed to convert ADS security descriptor to filesystem security descriptor\n"));
		talloc_free(mem_ctx);
		return status;
	}

	/* Set the security descriptor on the filesystem for this GPO */
	status = gp_set_gpt_security_descriptor(gp_ctx, gpo, fs_sd);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(0, ("Failed to set security descriptor (ACL) on the file system\n"));
		talloc_free(mem_ctx);
		return status;
	}

	talloc_free(mem_ctx);
	return NT_STATUS_OK;
}

NTSTATUS merge_nt_token(TALLOC_CTX *mem_ctx,
			const struct nt_user_token *token_1,
			const struct nt_user_token *token_2,
			struct nt_user_token **token_out)
{
	struct nt_user_token *token = NULL;
	NTSTATUS status;
	int i;

	if (!token_1 || !token_2 || !token_out) {
		return NT_STATUS_INVALID_PARAMETER;
	}

	token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token);
	NT_STATUS_HAVE_NO_MEMORY(token);

	for (i=0; i < token_1->num_sids; i++) {
		status = add_sid_to_array_unique(mem_ctx,
						 &token_1->user_sids[i],
						 &token->user_sids,
						 &token->num_sids);
		if (!NT_STATUS_IS_OK(status)) {
			TALLOC_FREE(token);
			return status;
		}
	}

	for (i=0; i < token_2->num_sids; i++) {
		status = add_sid_to_array_unique(mem_ctx,
						 &token_2->user_sids[i],
						 &token->user_sids,
						 &token->num_sids);
		if (!NT_STATUS_IS_OK(status)) {
			TALLOC_FREE(token);
			return status;
		}
	}

	se_priv_add(&token->privileges, &token_1->privileges);
	se_priv_add(&token->privileges, &token_2->privileges);

	*token_out = token;

	return NT_STATUS_OK;
}

static NTSTATUS unbecomeDC_ldap_connect(struct libnet_UnbecomeDC_state *s)
{
	char *url;

	url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name);
	NT_STATUS_HAVE_NO_MEMORY(url);

	s->ldap.ldb = ldb_wrap_connect(s, s->libnet->event_ctx, s->libnet->lp_ctx, url,
				       NULL,
				       s->libnet->cred,
				       0);
	talloc_free(url);
	if (s->ldap.ldb == NULL) {
		return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
	}

	return NT_STATUS_OK;
}

/*
  setup messaging for the top level samba (parent) task
 */
static NTSTATUS setup_parent_messaging(struct tevent_context *event_ctx, 
				       struct loadparm_context *lp_ctx)
{
	struct imessaging_context *msg;
	NTSTATUS status;

	msg = imessaging_init(talloc_autofree_context(),
			      lpcfg_imessaging_path(event_ctx, lp_ctx),
			      cluster_id(0, SAMBA_PARENT_TASKID), event_ctx, false);
	NT_STATUS_HAVE_NO_MEMORY(msg);

	irpc_add_name(msg, "samba");

	status = IRPC_REGISTER(msg, irpc, SAMBA_TERMINATE,
			       samba_terminate, NULL);

	return status;
}

/*
  add an entry to the notify array
*/
static NTSTATUS notify_add_array(struct notify_context *notify, struct notify_entry *e,
				 void *private_data, int depth)
{
	int i;
	struct notify_depth *d;
	struct notify_entry *ee;

	/* possibly expand the depths array */
	if (depth >= notify->array->num_depths) {
		d = talloc_realloc(notify->array, notify->array->depth, 
				   struct notify_depth, depth+1);
		NT_STATUS_HAVE_NO_MEMORY(d);
		for (i=notify->array->num_depths;i<=depth;i++) {
			ZERO_STRUCT(d[i]);
		}
		notify->array->depth = d;
		notify->array->num_depths = depth+1;
	}

/*
  save the notify array
*/
static NTSTATUS notify_save(struct notify_context *notify)
{
	TDB_DATA dbuf;
	DATA_BLOB blob;
	enum ndr_err_code ndr_err;
	int ret;
	TALLOC_CTX *tmp_ctx;

	/* if possible, remove some depth arrays */
	while (notify->array->num_depths > 0 &&
	       notify->array->depth[notify->array->num_depths-1].num_entries == 0) {
		notify->array->num_depths--;
	}

	/* we might just be able to delete the record */
	if (notify->array->num_depths == 0) {
		ret = tdb_delete_bystring(notify->w->tdb, NOTIFY_KEY);
		if (ret != 0) {
			return NT_STATUS_INTERNAL_DB_CORRUPTION;
		}
		return NT_STATUS_OK;
	}

	tmp_ctx = talloc_new(notify);
	NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);

	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, notify->array,
				       (ndr_push_flags_fn_t)ndr_push_notify_array);
	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
		talloc_free(tmp_ctx);
		return ndr_map_error2ntstatus(ndr_err);
	}

	dbuf.dptr = blob.data;
	dbuf.dsize = blob.length;
		
	ret = tdb_store_bystring(notify->w->tdb, NOTIFY_KEY, dbuf, TDB_REPLACE);
	talloc_free(tmp_ctx);
	if (ret != 0) {
		return NT_STATUS_INTERNAL_DB_CORRUPTION;
	}

	return NT_STATUS_OK;
}

/*
  open a file
*/
static NTSTATUS cvfs_open(struct ntvfs_module_context *ntvfs, 
			  struct ntvfs_request *req, union smb_open *io)
{
	struct cvfs_private *p = ntvfs->private_data;
	struct smbcli_request *c_req;
	struct ntvfs_handle *h;
	struct cvfs_file *f;
	NTSTATUS status;

	SETUP_PID;

	if (io->generic.level != RAW_OPEN_GENERIC &&
	    p->map_generic) {
		return ntvfs_map_open(ntvfs, req, io);
	}

	status = ntvfs_handle_new(ntvfs, req, &h);
	NT_STATUS_NOT_OK_RETURN(status);

	f = talloc_zero(h, struct cvfs_file);
	NT_STATUS_HAVE_NO_MEMORY(f);
	f->h = h;

	if (!(req->async_states->state & NTVFS_ASYNC_STATE_MAY_ASYNC)) {
		union smb_handle *file;

		status = smb_raw_open(p->tree, req, io);
		NT_STATUS_NOT_OK_RETURN(status);

		SMB_OPEN_OUT_FILE(io, file);
		f->fnum = file->fnum;
		file->ntvfs = NULL;
		status = ntvfs_handle_set_backend_data(f->h, p->ntvfs, f);
		NT_STATUS_NOT_OK_RETURN(status);
		file->ntvfs = f->h;
		DLIST_ADD(p->files, f);

		return NT_STATUS_OK;
	}

	c_req = smb_raw_open_send(p->tree, io);

	ASYNC_RECV_TAIL_F(io, async_open, f);
}

/*
  add privilege bits for one sid to a security_token
*/
static NTSTATUS samdb_privilege_setup_sid(struct ldb_context *pdb, TALLOC_CTX *mem_ctx,
					  struct security_token *token,
					  const struct dom_sid *sid)
{
	const char * const attrs[] = { "privilege", NULL };
	struct ldb_message **res = NULL;
	struct ldb_message_element *el;
	unsigned int i;
	int ret;
	char *sidstr;

	sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
	NT_STATUS_HAVE_NO_MEMORY(sidstr);

	ret = gendb_search(pdb, mem_ctx, NULL, &res, attrs, "objectSid=%s", sidstr);
	talloc_free(sidstr);
	if (ret != 1) {
		/* not an error to not match */
		return NT_STATUS_OK;
	}

	el = ldb_msg_find_element(res[0], "privilege");
	if (el == NULL) {
		return NT_STATUS_OK;
	}

	for (i=0;i<el->num_values;i++) {
		const char *priv_str = (const char *)el->values[i].data;
		enum sec_privilege privilege = sec_privilege_id(priv_str);
		if (privilege == SEC_PRIV_INVALID) {
			uint32_t right_bit = sec_right_bit(priv_str);
			security_token_set_right_bit(token, right_bit);
			if (right_bit == 0) {
				DEBUG(1,("Unknown privilege '%s' in samdb\n",
					 priv_str));
			}
			continue;
		}
		security_token_set_privilege(token, privilege);
	}

	return NT_STATUS_OK;
}