samba: fix some security problems

This fixes the following security problems:
* CVE-2015-7560
* CVE-2015-5370
* CVE-2016-2110
* CVE-2016-2111
* CVE-2016-2112
* CVE-2016-2115
* CVE-2016-2118

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

SVN-Revision: 49175

21 files changed, 20105 insertions, 46 deletions

diff --git a/package/network/services/samba36/patches/010-patch-cve-2015-5252.patch b/package/network/services/samba36/patches/010-patch-cve-2015-5252.patch
index 8922a6e..3640907 100644
--- a/package/network/services/samba36/patches/010-patch-cve-2015-5252.patch
+++ b/package/network/services/samba36/patches/010-patch-cve-2015-5252.patch
@@ -14,11 +14,9 @@ Reviewed-by: Volker Lendecke <vl@samba.org>
  source3/smbd/vfs.c | 7 +++++--
  1 file changed, 5 insertions(+), 2 deletions(-)
 
-diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c
-index 6c56964..bd93b7f 100644
 --- a/source3/smbd/vfs.c
 +++ b/source3/smbd/vfs.c
-@@ -982,6 +982,7 @@ NTSTATUS check_reduced_name(connection_struct *conn, const char *fname)
+@@ -982,6 +982,7 @@ NTSTATUS check_reduced_name(connection_s
  	if (!allow_widelinks || !allow_symlinks) {
  		const char *conn_rootdir;
  		size_t rootdir_len;
@@ -26,7 +24,7 @@ index 6c56964..bd93b7f 100644
  
  		conn_rootdir = SMB_VFS_CONNECTPATH(conn, fname);
  		if (conn_rootdir == NULL) {
-@@ -992,8 +993,10 @@ NTSTATUS check_reduced_name(connection_struct *conn, const char *fname)
+@@ -992,8 +993,10 @@ NTSTATUS check_reduced_name(connection_s
  		}
  
  		rootdir_len = strlen(conn_rootdir);
@@ -39,5 +37,3 @@ index 6c56964..bd93b7f 100644
  			DEBUG(2, ("check_reduced_name: Bad access "
  				"attempt: %s is a symlink outside the "
  				"share path\n", fname));
--- 
-2.5.0
diff --git a/package/network/services/samba36/patches/011-patch-cve-2015-5296.patch b/package/network/services/samba36/patches/011-patch-cve-2015-5296.patch
index eaafd1c..a309cf1 100644
--- a/package/network/services/samba36/patches/011-patch-cve-2015-5296.patch
+++ b/package/network/services/samba36/patches/011-patch-cve-2015-5296.patch
@@ -12,11 +12,9 @@ Reviewed-by: Jeremy Allison <jra@samba.org>
  source3/libsmb/clidfs.c | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)
 
-diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c
-index 23e1471..f153b6b 100644
 --- a/source3/libsmb/clidfs.c
 +++ b/source3/libsmb/clidfs.c
-@@ -98,6 +98,11 @@ static struct cli_state *do_connect(TALLOC_CTX *ctx,
+@@ -98,6 +98,11 @@ static struct cli_state *do_connect(TALL
  	const char *username;
  	const char *password;
  	NTSTATUS status;
@@ -28,7 +26,7 @@ index 23e1471..f153b6b 100644
  
  	/* make a copy so we don't modify the global string 'service' */
  	servicename = talloc_strdup(ctx,share);
-@@ -132,7 +137,7 @@ static struct cli_state *do_connect(TALLOC_CTX *ctx,
+@@ -132,7 +137,7 @@ static struct cli_state *do_connect(TALL
  	zero_sockaddr(&ss);
  
  	/* have to open a new connection */
@@ -37,26 +35,6 @@ index 23e1471..f153b6b 100644
  	if (c == NULL) {
  		d_printf("Connection to %s failed\n", server_n);
  		return NULL;
--- 
-2.5.0
-
-
-From 060adb0abdeda51b8b622c6020b5dea0c8dde1cf Mon Sep 17 00:00:00 2001
-From: Stefan Metzmacher <metze@samba.org>
-Date: Wed, 30 Sep 2015 21:17:02 +0200
-Subject: [PATCH 2/2] CVE-2015-5296: s3:libsmb: force signing when requiring
- encryption in SMBC_server_internal()
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=11536
-
-Signed-off-by: Stefan Metzmacher <metze@samba.org>
-Reviewed-by: Jeremy Allison <jra@samba.org>
----
- source3/libsmb/libsmb_server.c | 13 +++++++++++--
- 1 file changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c
-index 45be660..167f2c9 100644
 --- a/source3/libsmb/libsmb_server.c
 +++ b/source3/libsmb/libsmb_server.c
 @@ -258,6 +258,7 @@ SMBC_server_internal(TALLOC_CTX *ctx,
@@ -108,5 +86,3 @@ index 45be660..167f2c9 100644
                  if (! NT_STATUS_IS_OK(nt_status)) {
                          DEBUG(1,("cli_full_connection failed! (%s)\n",
                                   nt_errstr(nt_status)));
--- 
-2.5.0
diff --git a/package/network/services/samba36/patches/012-patch-cve-2015-5299.patch b/package/network/services/samba36/patches/012-patch-cve-2015-5299.patch
index 19cbb19..7a569c7 100644
--- a/package/network/services/samba36/patches/012-patch-cve-2015-5299.patch
+++ b/package/network/services/samba36/patches/012-patch-cve-2015-5299.patch
@@ -14,8 +14,6 @@ Reviewed-by: David Disseldorp <ddiss@samba.org>
  source3/modules/vfs_shadow_copy2.c | 47 ++++++++++++++++++++++++++++++++++++++
  1 file changed, 47 insertions(+)
 
-diff --git a/source3/modules/vfs_shadow_copy2.c b/source3/modules/vfs_shadow_copy2.c
-index fedfb53..16c1ed7 100644
 --- a/source3/modules/vfs_shadow_copy2.c
 +++ b/source3/modules/vfs_shadow_copy2.c
 @@ -21,6 +21,8 @@
@@ -27,7 +25,7 @@ index fedfb53..16c1ed7 100644
  #include "system/filesys.h"
  #include "ntioctl.h"
  
-@@ -764,6 +766,43 @@ static int shadow_copy2_mkdir(vfs_handle_struct *handle,  const char *fname, mod
+@@ -764,6 +766,43 @@ static int shadow_copy2_mkdir(vfs_handle
          SHADOW2_NEXT(MKDIR, (handle, name, mode), int, -1);
  }
  
@@ -71,7 +69,7 @@ index fedfb53..16c1ed7 100644
  static int shadow_copy2_rmdir(vfs_handle_struct *handle,  const char *fname)
  {
          SHADOW2_NEXT(RMDIR, (handle, name), int, -1);
-@@ -877,6 +916,7 @@ static int shadow_copy2_get_shadow_copy2_data(vfs_handle_struct *handle,
+@@ -877,6 +916,7 @@ static int shadow_copy2_get_shadow_copy2
  	SMB_STRUCT_DIRENT *d;
  	TALLOC_CTX *tmp_ctx = talloc_new(handle->data);
  	char *snapshot;
@@ -79,7 +77,7 @@ index fedfb53..16c1ed7 100644
  
  	snapdir = shadow_copy2_find_snapdir(tmp_ctx, handle);
  	if (snapdir == NULL) {
-@@ -886,6 +926,13 @@ static int shadow_copy2_get_shadow_copy2_data(vfs_handle_struct *handle,
+@@ -886,6 +926,13 @@ static int shadow_copy2_get_shadow_copy2
  		talloc_free(tmp_ctx);
  		return -1;
  	}
@@ -93,5 +91,3 @@ index fedfb53..16c1ed7 100644
  
  	p = SMB_VFS_NEXT_OPENDIR(handle, snapdir, NULL, 0);
  
--- 
-2.5.0
diff --git a/package/network/services/samba36/patches/015-patch-cve-2015-7560.patch b/package/network/services/samba36/patches/015-patch-cve-2015-7560.patch
new file mode 100644
index 0000000..6ce8e2f
--- /dev/null
+++ b/package/network/services/samba36/patches/015-patch-cve-2015-7560.patch
@@ -0,0 +1,172 @@
+From eb27f9b7bf9c1dc902d9545eecf805831bd4e46c Mon Sep 17 00:00:00 2001
+From: Jeremy Allison <jra@samba.org>
+Date: Tue, 5 Jan 2016 11:18:12 -0800
+Subject: [PATCH 1/8] CVE-2015-7560: s3: smbd: Add refuse_symlink() function
+ that can be used to prevent operations on a symlink.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648
+
+Signed-off-by: Jeremy Allison <jra@samba.org>
+Reviewed-by: Michael Adam <obnox@samba.org>
+---
+ source3/smbd/trans2.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/source3/smbd/trans2.c
++++ b/source3/smbd/trans2.c
+@@ -51,6 +51,34 @@ static char *store_file_unix_basic_info2
+ 				files_struct *fsp,
+ 				const SMB_STRUCT_STAT *psbuf);
+ 
++/****************************************************************************
++ Check if an open file handle or pathname is a symlink.
++****************************************************************************/
++
++static NTSTATUS refuse_symlink(connection_struct *conn,
++			const files_struct *fsp,
++			const char *name)
++{
++	SMB_STRUCT_STAT sbuf;
++	const SMB_STRUCT_STAT *pst = NULL;
++
++	if (fsp) {
++		pst = &fsp->fsp_name->st;
++	} else {
++		int ret = vfs_stat_smb_fname(conn,
++				name,
++				&sbuf);
++		if (ret == -1) {
++			return map_nt_error_from_unix(errno);
++		}
++		pst = &sbuf;
++	}
++	if (S_ISLNK(pst->st_ex_mode)) {
++		return NT_STATUS_ACCESS_DENIED;
++	}
++	return NT_STATUS_OK;
++}
++
+ /********************************************************************
+  Roundup a value to the nearest allocation roundup size boundary.
+  Only do this for Windows clients.
+@@ -181,12 +209,22 @@ NTSTATUS get_ea_names_from_file(TALLOC_C
+ 	char **names, **tmp;
+ 	size_t num_names;
+ 	ssize_t sizeret = -1;
++	NTSTATUS status;
++
++	if (pnames) {
++		*pnames = NULL;
++	}
++	*pnum_names = 0;
+ 
+ 	if (!lp_ea_support(SNUM(conn))) {
+-		if (pnames) {
+-			*pnames = NULL;
+-		}
+-		*pnum_names = 0;
++		return NT_STATUS_OK;
++	}
++
++	status = refuse_symlink(conn, fsp, fname);
++	if (!NT_STATUS_IS_OK(status)) {
++		/*
++		 * Just return no EA's on a symlink.
++		 */
+ 		return NT_STATUS_OK;
+ 	}
+ 
+@@ -236,10 +274,6 @@ NTSTATUS get_ea_names_from_file(TALLOC_C
+ 
+ 	if (sizeret == 0) {
+ 		TALLOC_FREE(names);
+-		if (pnames) {
+-			*pnames = NULL;
+-		}
+-		*pnum_names = 0;
+ 		return NT_STATUS_OK;
+ 	}
+ 
+@@ -550,6 +584,7 @@ NTSTATUS set_ea(connection_struct *conn,
+ 		const struct smb_filename *smb_fname, struct ea_list *ea_list)
+ {
+ 	char *fname = NULL;
++	NTSTATUS status;
+ 
+ 	if (!lp_ea_support(SNUM(conn))) {
+ 		return NT_STATUS_EAS_NOT_SUPPORTED;
+@@ -559,6 +594,12 @@ NTSTATUS set_ea(connection_struct *conn,
+ 		return NT_STATUS_ACCESS_DENIED;
+ 	}
+ 
++	status = refuse_symlink(conn, fsp, smb_fname->base_name);
++	if (!NT_STATUS_IS_OK(status)) {
++		return status;
++	}
++
++
+ 	/* For now setting EAs on streams isn't supported. */
+ 	fname = smb_fname->base_name;
+ 
+@@ -4931,6 +4972,13 @@ NTSTATUS smbd_do_qfilepathinfo(connectio
+ 				uint16 num_file_acls = 0;
+ 				uint16 num_def_acls = 0;
+ 
++				status = refuse_symlink(conn,
++						fsp,
++						smb_fname->base_name);
++				if (!NT_STATUS_IS_OK(status)) {
++					return status;
++				}
++
+ 				if (fsp && fsp->fh->fd != -1) {
+ 					file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
+ 				} else {
+@@ -6452,6 +6500,7 @@ static NTSTATUS smb_set_posix_acl(connec
+ 	uint16 num_def_acls;
+ 	bool valid_file_acls = True;
+ 	bool valid_def_acls = True;
++	NTSTATUS status;
+ 
+ 	if (total_data < SMB_POSIX_ACL_HEADER_SIZE) {
+ 		return NT_STATUS_INVALID_PARAMETER;
+@@ -6479,6 +6528,11 @@ static NTSTATUS smb_set_posix_acl(connec
+ 		return NT_STATUS_INVALID_PARAMETER;
+ 	}
+ 
++	status = refuse_symlink(conn, fsp, smb_fname->base_name);
++	if (!NT_STATUS_IS_OK(status)) {
++		return status;
++	}
++
+ 	DEBUG(10,("smb_set_posix_acl: file %s num_file_acls = %u, num_def_acls = %u\n",
+ 		smb_fname ? smb_fname_str_dbg(smb_fname) : fsp_str_dbg(fsp),
+ 		(unsigned int)num_file_acls,
+--- a/source3/smbd/nttrans.c
++++ b/source3/smbd/nttrans.c
+@@ -877,6 +877,12 @@ NTSTATUS set_sd(files_struct *fsp, struc
+ 		return NT_STATUS_OK;
+ 	}
+ 
++	if (S_ISLNK(fsp->fsp_name->st.st_ex_mode)) {
++		DEBUG(10, ("ACL set on symlink %s denied.\n",
++			fsp_str_dbg(fsp)));
++		return NT_STATUS_ACCESS_DENIED;
++	}
++
+ 	if (psd->owner_sid == NULL) {
+ 		security_info_sent &= ~SECINFO_OWNER;
+ 	}
+@@ -1925,6 +1931,12 @@ NTSTATUS smbd_do_query_security_desc(con
+ 		return NT_STATUS_ACCESS_DENIED;
+ 	}
+ 
++	if (S_ISLNK(fsp->fsp_name->st.st_ex_mode)) {
++		DEBUG(10, ("ACL get on symlink %s denied.\n",
++			fsp_str_dbg(fsp)));
++		return NT_STATUS_ACCESS_DENIED;
++	}
++
+ 	if (security_info_wanted & (SECINFO_DACL|SECINFO_OWNER|
+ 			SECINFO_GROUP|SECINFO_SACL)) {
+ 		/* Don't return SECINFO_LABEL if anything else was
diff --git a/package/network/services/samba36/patches/020-CVE-preparation-v3-6.patch b/package/network/services/samba36/patches/020-CVE-preparation-v3-6.patch
new file mode 100644
index 0000000..ae822f4
--- /dev/null
+++ b/package/network/services/samba36/patches/020-CVE-preparation-v3-6.patch
@@ -0,0 +1,6824 @@
+From 39a3fa39967faaf216be8e108ca57d07de1aa95a Mon Sep 17 00:00:00 2001
+From: Vadim Zhukov <persgray@gmail.com>
+Date: Sat, 25 May 2013 15:19:24 +0100
+Subject: [PATCH 01/41] pidl: Recent Perl warns about "defined(@var)"
+ constructs.
+
+Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
+
+Autobuild-User(master): Jelmer Vernooij <jelmer@samba.org>
+Autobuild-Date(master): Sat May 25 18:10:53 CEST 2013 on sn-devel-104
+
+(cherry picked from commit 92254d09e0ee5a7d9d0cd91fe1803f54e64d9a5f)
+---
+ pidl/lib/Parse/Pidl/ODL.pm | 2 +-
+ pidl/pidl                  | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/pidl/lib/Parse/Pidl/ODL.pm
++++ b/pidl/lib/Parse/Pidl/ODL.pm
+@@ -70,7 +70,7 @@ sub ODL2IDL
+ 					next;
+ 				}
+ 				my $podl = Parse::Pidl::IDL::parse_file($idl_path, $opt_incdirs);
+-				if (defined(@$podl)) {
++				if (defined($podl)) {
+ 					require Parse::Pidl::Typelist;
+ 					my $basename = basename($idl_path, ".idl");
+ 
+--- a/pidl/pidl
++++ b/pidl/pidl
+@@ -605,7 +605,7 @@ sub process_file($)
+ 		require Parse::Pidl::IDL;
+ 
+ 		$pidl = Parse::Pidl::IDL::parse_file($idl_file, \@opt_incdirs);
+-		defined @$pidl || die "Failed to parse $idl_file";
++		defined $pidl || die "Failed to parse $idl_file";
+ 	}
+ 
+ 	require Parse::Pidl::Typelist;
+--- a/source4/heimdal/cf/make-proto.pl
++++ b/source4/heimdal/cf/make-proto.pl
+@@ -1,8 +1,8 @@
+ # Make prototypes from .c files
+ # $Id$
+ 
+-##use Getopt::Std;
+-require 'getopts.pl';
++use Getopt::Std;
++#require 'getopts.pl';
+ 
+ my $comment = 0;
+ my $if_0 = 0;
+@@ -12,7 +12,7 @@ my $debug = 0;
+ my $oproto = 1;
+ my $private_func_re = "^_";
+ 
+-Getopts('x:m:o:p:dqE:R:P:') || die "foo";
++getopts('x:m:o:p:dqE:R:P:') || die "foo";
+ 
+ if($opt_d) {
+     $debug = 1;
+--- a/source3/Makefile-smbtorture4
++++ b/source3/Makefile-smbtorture4
+@@ -6,7 +6,7 @@ SAMBA4_BINARIES="smbtorture,ndrdump"
+ samba4-configure:
+ 	@(cd .. && \
+ 		CFLAGS='' $(WAF) reconfigure || \
+-		CFLAGS='' $(WAF) configure --enable-socket-wrapper --enable-nss-wrapper --enable-uid-wrapper --nonshared-binary=$(SAMBA4_BINARIES) --enable-auto-reconfigure )
++		CFLAGS='' $(WAF) configure --enable-socket-wrapper --enable-nss-wrapper --enable-uid-wrapper --nonshared-binary=$(SAMBA4_BINARIES) --enable-auto-reconfigure --bundled-libraries=ALL --disable-gnutls )
+ 
+ .PHONY: samba4-configure
+ 
+--- a/source4/lib/ldb/wscript
++++ b/source4/lib/ldb/wscript
+@@ -135,9 +135,7 @@ def build(bld):
+                           pc_files=ldb_pc_files,
+                           vnum=VERSION,
+                           private_library=private_library,
+-                          manpages='man/ldb.3',
+-                          abi_directory = 'ABI',
+-                          abi_match = abi_match)
++                          manpages='man/ldb.3')
+ 
+         # generate a include/ldb_version.h
+         t = bld.SAMBA_GENERATOR('ldb_version.h',
+--- a/source3/selftest/skip
++++ b/source3/selftest/skip
+@@ -22,3 +22,8 @@ samba3.*raw.ioctl
+ samba3.*raw.qfileinfo
+ samba3.*raw.qfsinfo
+ samba3.*raw.sfileinfo.base
++# skip, don't work for badlock backports
++samba3.posix_s3.raw.eas
++samba3.posix_s3.raw.rename
++samba3.posix_s3.raw.search
++samba3.posix_s3.raw.streams
+--- a/librpc/ndr/ndr_ntlmssp.c
++++ b/librpc/ndr/ndr_ntlmssp.c
+@@ -176,4 +176,20 @@ _PUBLIC_ void ndr_print_ntlmssp_Version(
+ 	}
+ }
+ 
++_PUBLIC_ struct AV_PAIR *ndr_ntlmssp_find_av(const struct AV_PAIR_LIST *av_list,
++					     enum ntlmssp_AvId AvId)
++{
++	struct AV_PAIR *res = NULL;
++	uint32_t i = 0;
+ 
++	for (i = 0; i < av_list->count; i++) {
++		if (av_list->pair[i].AvId != AvId) {
++			continue;
++		}
++
++		res = discard_const_p(struct AV_PAIR, &av_list->pair[i]);
++		break;
++	}
++
++	return res;
++}
+--- a/librpc/ndr/ndr_ntlmssp.h
++++ b/librpc/ndr/ndr_ntlmssp.h
+@@ -31,3 +31,5 @@ _PUBLIC_ void ndr_print_ntlmssp_lm_respo
+ 					    bool ntlmv2);
+ _PUBLIC_ void ndr_print_ntlmssp_Version(struct ndr_print *ndr, const char *name, const union ntlmssp_Version *r);
+ 
++_PUBLIC_ struct AV_PAIR *ndr_ntlmssp_find_av(const struct AV_PAIR_LIST *av_list,
++					     enum ntlmssp_AvId AvId);
+--- /dev/null
++++ b/librpc/ABI/ndr-0.0.2.sigs
+@@ -0,0 +1,247 @@
++GUID_all_zero: bool (const struct GUID *)
++GUID_compare: int (const struct GUID *, const struct GUID *)
++GUID_equal: bool (const struct GUID *, const struct GUID *)
++GUID_from_data_blob: NTSTATUS (const DATA_BLOB *, struct GUID *)
++GUID_from_ndr_blob: NTSTATUS (const DATA_BLOB *, struct GUID *)
++GUID_from_string: NTSTATUS (const char *, struct GUID *)
++GUID_hexstring: char *(TALLOC_CTX *, const struct GUID *)
++GUID_random: struct GUID (void)
++GUID_string: char *(TALLOC_CTX *, const struct GUID *)
++GUID_string2: char *(TALLOC_CTX *, const struct GUID *)
++GUID_to_ndr_blob: NTSTATUS (const struct GUID *, TALLOC_CTX *, DATA_BLOB *)
++GUID_zero: struct GUID (void)
++ndr_align_size: size_t (uint32_t, size_t)
++ndr_charset_length: uint32_t (const void *, charset_t)
++ndr_check_array_length: enum ndr_err_code (struct ndr_pull *, void *, uint32_t)
++ndr_check_array_size: enum ndr_err_code (struct ndr_pull *, void *, uint32_t)
++ndr_check_padding: void (struct ndr_pull *, size_t)
++ndr_check_pipe_chunk_trailer: enum ndr_err_code (struct ndr_pull *, int, uint32_t)
++ndr_check_string_terminator: enum ndr_err_code (struct ndr_pull *, uint32_t, uint32_t)
++ndr_get_array_length: uint32_t (struct ndr_pull *, const void *)
++ndr_get_array_size: uint32_t (struct ndr_pull *, const void *)
++ndr_map_error2errno: int (enum ndr_err_code)
++ndr_map_error2ntstatus: NTSTATUS (enum ndr_err_code)
++ndr_map_error2string: const char *(enum ndr_err_code)
++ndr_policy_handle_empty: bool (const struct policy_handle *)
++ndr_policy_handle_equal: bool (const struct policy_handle *, const struct policy_handle *)
++ndr_print_DATA_BLOB: void (struct ndr_print *, const char *, DATA_BLOB)
++ndr_print_GUID: void (struct ndr_print *, const char *, const struct GUID *)
++ndr_print_KRB5_EDATA_NTSTATUS: void (struct ndr_print *, const char *, const struct KRB5_EDATA_NTSTATUS *)
++ndr_print_NTSTATUS: void (struct ndr_print *, const char *, NTSTATUS)
++ndr_print_NTTIME: void (struct ndr_print *, const char *, NTTIME)
++ndr_print_NTTIME_1sec: void (struct ndr_print *, const char *, NTTIME)
++ndr_print_NTTIME_hyper: void (struct ndr_print *, const char *, NTTIME)
++ndr_print_WERROR: void (struct ndr_print *, const char *, WERROR)
++ndr_print_array_uint8: void (struct ndr_print *, const char *, const uint8_t *, uint32_t)
++ndr_print_bad_level: void (struct ndr_print *, const char *, uint16_t)
++ndr_print_bitmap_flag: void (struct ndr_print *, size_t, const char *, uint32_t, uint32_t)
++ndr_print_bool: void (struct ndr_print *, const char *, const bool)
++ndr_print_debug: void (ndr_print_fn_t, const char *, void *)
++ndr_print_debug_helper: void (struct ndr_print *, const char *, ...)
++ndr_print_debugc: void (int, ndr_print_fn_t, const char *, void *)
++ndr_print_debugc_helper: void (struct ndr_print *, const char *, ...)
++ndr_print_dlong: void (struct ndr_print *, const char *, int64_t)
++ndr_print_double: void (struct ndr_print *, const char *, double)
++ndr_print_enum: void (struct ndr_print *, const char *, const char *, const char *, uint32_t)
++ndr_print_function_debug: void (ndr_print_function_t, const char *, int, void *)
++ndr_print_function_string: char *(TALLOC_CTX *, ndr_print_function_t, const char *, int, void *)
++ndr_print_get_switch_value: uint32_t (struct ndr_print *, const void *)
++ndr_print_gid_t: void (struct ndr_print *, const char *, gid_t)
++ndr_print_hyper: void (struct ndr_print *, const char *, uint64_t)
++ndr_print_int16: void (struct ndr_print *, const char *, int16_t)
++ndr_print_int32: void (struct ndr_print *, const char *, int32_t)
++ndr_print_int3264: void (struct ndr_print *, const char *, int32_t)
++ndr_print_int8: void (struct ndr_print *, const char *, int8_t)
++ndr_print_ipv4address: void (struct ndr_print *, const char *, const char *)
++ndr_print_ipv6address: void (struct ndr_print *, const char *, const char *)
++ndr_print_ndr_syntax_id: void (struct ndr_print *, const char *, const struct ndr_syntax_id *)
++ndr_print_netr_SamDatabaseID: void (struct ndr_print *, const char *, enum netr_SamDatabaseID)
++ndr_print_netr_SchannelType: void (struct ndr_print *, const char *, enum netr_SchannelType)
++ndr_print_null: void (struct ndr_print *)
++ndr_print_pointer: void (struct ndr_print *, const char *, void *)
++ndr_print_policy_handle: void (struct ndr_print *, const char *, const struct policy_handle *)
++ndr_print_printf_helper: void (struct ndr_print *, const char *, ...)
++ndr_print_ptr: void (struct ndr_print *, const char *, const void *)
++ndr_print_set_switch_value: enum ndr_err_code (struct ndr_print *, const void *, uint32_t)
++ndr_print_sockaddr_storage: void (struct ndr_print *, const char *, const struct sockaddr_storage *)
++ndr_print_string: void (struct ndr_print *, const char *, const char *)
++ndr_print_string_array: void (struct ndr_print *, const char *, const char **)
++ndr_print_string_helper: void (struct ndr_print *, const char *, ...)
++ndr_print_struct: void (struct ndr_print *, const char *, const char *)
++ndr_print_struct_string: char *(TALLOC_CTX *, ndr_print_fn_t, const char *, void *)
++ndr_print_svcctl_ServerType: void (struct ndr_print *, const char *, uint32_t)
++ndr_print_time_t: void (struct ndr_print *, const char *, time_t)
++ndr_print_timespec: void (struct ndr_print *, const char *, const struct timespec *)
++ndr_print_timeval: void (struct ndr_print *, const char *, const struct timeval *)
++ndr_print_udlong: void (struct ndr_print *, const char *, uint64_t)
++ndr_print_udlongr: void (struct ndr_print *, const char *, uint64_t)
++ndr_print_uid_t: void (struct ndr_print *, const char *, uid_t)
++ndr_print_uint16: void (struct ndr_print *, const char *, uint16_t)
++ndr_print_uint32: void (struct ndr_print *, const char *, uint32_t)
++ndr_print_uint3264: void (struct ndr_print *, const char *, uint32_t)
++ndr_print_uint8: void (struct ndr_print *, const char *, uint8_t)
++ndr_print_union: void (struct ndr_print *, const char *, int, const char *)
++ndr_print_union_debug: void (ndr_print_fn_t, const char *, uint32_t, void *)
++ndr_print_union_string: char *(TALLOC_CTX *, ndr_print_fn_t, const char *, uint32_t, void *)
++ndr_print_winreg_Data: void (struct ndr_print *, const char *, const union winreg_Data *)
++ndr_print_winreg_Type: void (struct ndr_print *, const char *, enum winreg_Type)
++ndr_pull_DATA_BLOB: enum ndr_err_code (struct ndr_pull *, int, DATA_BLOB *)
++ndr_pull_GUID: enum ndr_err_code (struct ndr_pull *, int, struct GUID *)
++ndr_pull_KRB5_EDATA_NTSTATUS: enum ndr_err_code (struct ndr_pull *, int, struct KRB5_EDATA_NTSTATUS *)
++ndr_pull_NTSTATUS: enum ndr_err_code (struct ndr_pull *, int, NTSTATUS *)
++ndr_pull_NTTIME: enum ndr_err_code (struct ndr_pull *, int, NTTIME *)
++ndr_pull_NTTIME_1sec: enum ndr_err_code (struct ndr_pull *, int, NTTIME *)
++ndr_pull_NTTIME_hyper: enum ndr_err_code (struct ndr_pull *, int, NTTIME *)
++ndr_pull_WERROR: enum ndr_err_code (struct ndr_pull *, int, WERROR *)
++ndr_pull_advance: enum ndr_err_code (struct ndr_pull *, uint32_t)
++ndr_pull_align: enum ndr_err_code (struct ndr_pull *, size_t)
++ndr_pull_array_length: enum ndr_err_code (struct ndr_pull *, const void *)
++ndr_pull_array_size: enum ndr_err_code (struct ndr_pull *, const void *)
++ndr_pull_array_uint8: enum ndr_err_code (struct ndr_pull *, int, uint8_t *, uint32_t)
++ndr_pull_bytes: enum ndr_err_code (struct ndr_pull *, uint8_t *, uint32_t)
++ndr_pull_charset: enum ndr_err_code (struct ndr_pull *, int, const char **, uint32_t, uint8_t, charset_t)
++ndr_pull_charset_to_null: enum ndr_err_code (struct ndr_pull *, int, const char **, uint32_t, uint8_t, charset_t)
++ndr_pull_dlong: enum ndr_err_code (struct ndr_pull *, int, int64_t *)
++ndr_pull_double: enum ndr_err_code (struct ndr_pull *, int, double *)
++ndr_pull_enum_uint16: enum ndr_err_code (struct ndr_pull *, int, uint16_t *)
++ndr_pull_enum_uint1632: enum ndr_err_code (struct ndr_pull *, int, uint16_t *)
++ndr_pull_enum_uint32: enum ndr_err_code (struct ndr_pull *, int, uint32_t *)
++ndr_pull_enum_uint8: enum ndr_err_code (struct ndr_pull *, int, uint8_t *)
++ndr_pull_error: enum ndr_err_code (struct ndr_pull *, enum ndr_err_code, const char *, ...)
++ndr_pull_generic_ptr: enum ndr_err_code (struct ndr_pull *, uint32_t *)
++ndr_pull_get_relative_base_offset: uint32_t (struct ndr_pull *)
++ndr_pull_get_switch_value: uint32_t (struct ndr_pull *, const void *)
++ndr_pull_gid_t: enum ndr_err_code (struct ndr_pull *, int, gid_t *)
++ndr_pull_hyper: enum ndr_err_code (struct ndr_pull *, int, uint64_t *)
++ndr_pull_init_blob: struct ndr_pull *(const DATA_BLOB *, TALLOC_CTX *)
++ndr_pull_int16: enum ndr_err_code (struct ndr_pull *, int, int16_t *)
++ndr_pull_int32: enum ndr_err_code (struct ndr_pull *, int, int32_t *)
++ndr_pull_int8: enum ndr_err_code (struct ndr_pull *, int, int8_t *)
++ndr_pull_ipv4address: enum ndr_err_code (struct ndr_pull *, int, const char **)
++ndr_pull_ipv6address: enum ndr_err_code (struct ndr_pull *, int, const char **)
++ndr_pull_ndr_syntax_id: enum ndr_err_code (struct ndr_pull *, int, struct ndr_syntax_id *)
++ndr_pull_netr_SamDatabaseID: enum ndr_err_code (struct ndr_pull *, int, enum netr_SamDatabaseID *)
++ndr_pull_netr_SchannelType: enum ndr_err_code (struct ndr_pull *, int, enum netr_SchannelType *)
++ndr_pull_pointer: enum ndr_err_code (struct ndr_pull *, int, void **)
++ndr_pull_policy_handle: enum ndr_err_code (struct ndr_pull *, int, struct policy_handle *)
++ndr_pull_ref_ptr: enum ndr_err_code (struct ndr_pull *, uint32_t *)
++ndr_pull_relative_ptr1: enum ndr_err_code (struct ndr_pull *, const void *, uint32_t)
++ndr_pull_relative_ptr2: enum ndr_err_code (struct ndr_pull *, const void *)
++ndr_pull_relative_ptr_short: enum ndr_err_code (struct ndr_pull *, uint16_t *)
++ndr_pull_restore_relative_base_offset: void (struct ndr_pull *, uint32_t)
++ndr_pull_set_switch_value: enum ndr_err_code (struct ndr_pull *, const void *, uint32_t)
++ndr_pull_setup_relative_base_offset1: enum ndr_err_code (struct ndr_pull *, const void *, uint32_t)
++ndr_pull_setup_relative_base_offset2: enum ndr_err_code (struct ndr_pull *, const void *)
++ndr_pull_string: enum ndr_err_code (struct ndr_pull *, int, const char **)
++ndr_pull_string_array: enum ndr_err_code (struct ndr_pull *, int, const char ***)
++ndr_pull_struct_blob: enum ndr_err_code (const DATA_BLOB *, TALLOC_CTX *, void *, ndr_pull_flags_fn_t)
++ndr_pull_struct_blob_all: enum ndr_err_code (const DATA_BLOB *, TALLOC_CTX *, void *, ndr_pull_flags_fn_t)
++ndr_pull_subcontext_end: enum ndr_err_code (struct ndr_pull *, struct ndr_pull *, size_t, ssize_t)
++ndr_pull_subcontext_start: enum ndr_err_code (struct ndr_pull *, struct ndr_pull **, size_t, ssize_t)
++ndr_pull_svcctl_ServerType: enum ndr_err_code (struct ndr_pull *, int, uint32_t *)
++ndr_pull_time_t: enum ndr_err_code (struct ndr_pull *, int, time_t *)
++ndr_pull_timespec: enum ndr_err_code (struct ndr_pull *, int, struct timespec *)
++ndr_pull_timeval: enum ndr_err_code (struct ndr_pull *, int, struct timeval *)
++ndr_pull_trailer_align: enum ndr_err_code (struct ndr_pull *, size_t)
++ndr_pull_udlong: enum ndr_err_code (struct ndr_pull *, int, uint64_t *)
++ndr_pull_udlongr: enum ndr_err_code (struct ndr_pull *, int, uint64_t *)
++ndr_pull_uid_t: enum ndr_err_code (struct ndr_pull *, int, uid_t *)
++ndr_pull_uint16: enum ndr_err_code (struct ndr_pull *, int, uint16_t *)
++ndr_pull_uint1632: enum ndr_err_code (struct ndr_pull *, int, uint16_t *)
++ndr_pull_uint32: enum ndr_err_code (struct ndr_pull *, int, uint32_t *)
++ndr_pull_uint3264: enum ndr_err_code (struct ndr_pull *, int, uint32_t *)
++ndr_pull_uint8: enum ndr_err_code (struct ndr_pull *, int, uint8_t *)
++ndr_pull_union_align: enum ndr_err_code (struct ndr_pull *, size_t)
++ndr_pull_union_blob: enum ndr_err_code (const DATA_BLOB *, TALLOC_CTX *, void *, uint32_t, ndr_pull_flags_fn_t)
++ndr_pull_union_blob_all: enum ndr_err_code (const DATA_BLOB *, TALLOC_CTX *, void *, uint32_t, ndr_pull_flags_fn_t)
++ndr_pull_winreg_Data: enum ndr_err_code (struct ndr_pull *, int, union winreg_Data *)
++ndr_pull_winreg_Type: enum ndr_err_code (struct ndr_pull *, int, enum winreg_Type *)
++ndr_push_DATA_BLOB: enum ndr_err_code (struct ndr_push *, int, DATA_BLOB)
++ndr_push_GUID: enum ndr_err_code (struct ndr_push *, int, const struct GUID *)
++ndr_push_KRB5_EDATA_NTSTATUS: enum ndr_err_code (struct ndr_push *, int, const struct KRB5_EDATA_NTSTATUS *)
++ndr_push_NTSTATUS: enum ndr_err_code (struct ndr_push *, int, NTSTATUS)
++ndr_push_NTTIME: enum ndr_err_code (struct ndr_push *, int, NTTIME)
++ndr_push_NTTIME_1sec: enum ndr_err_code (struct ndr_push *, int, NTTIME)
++ndr_push_NTTIME_hyper: enum ndr_err_code (struct ndr_push *, int, NTTIME)
++ndr_push_WERROR: enum ndr_err_code (struct ndr_push *, int, WERROR)
++ndr_push_align: enum ndr_err_code (struct ndr_push *, size_t)
++ndr_push_array_uint8: enum ndr_err_code (struct ndr_push *, int, const uint8_t *, uint32_t)
++ndr_push_blob: DATA_BLOB (struct ndr_push *)
++ndr_push_bytes: enum ndr_err_code (struct ndr_push *, const uint8_t *, uint32_t)
++ndr_push_charset: enum ndr_err_code (struct ndr_push *, int, const char *, uint32_t, uint8_t, charset_t)
++ndr_push_dlong: enum ndr_err_code (struct ndr_push *, int, int64_t)
++ndr_push_double: enum ndr_err_code (struct ndr_push *, int, double)
++ndr_push_enum_uint16: enum ndr_err_code (struct ndr_push *, int, uint16_t)
++ndr_push_enum_uint1632: enum ndr_err_code (struct ndr_push *, int, uint16_t)
++ndr_push_enum_uint32: enum ndr_err_code (struct ndr_push *, int, uint32_t)
++ndr_push_enum_uint8: enum ndr_err_code (struct ndr_push *, int, uint8_t)
++ndr_push_error: enum ndr_err_code (struct ndr_push *, enum ndr_err_code, const char *, ...)
++ndr_push_expand: enum ndr_err_code (struct ndr_push *, uint32_t)
++ndr_push_full_ptr: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_get_relative_base_offset: uint32_t (struct ndr_push *)
++ndr_push_get_switch_value: uint32_t (struct ndr_push *, const void *)
++ndr_push_gid_t: enum ndr_err_code (struct ndr_push *, int, gid_t)
++ndr_push_hyper: enum ndr_err_code (struct ndr_push *, int, uint64_t)
++ndr_push_init_ctx: struct ndr_push *(TALLOC_CTX *)
++ndr_push_int16: enum ndr_err_code (struct ndr_push *, int, int16_t)
++ndr_push_int32: enum ndr_err_code (struct ndr_push *, int, int32_t)
++ndr_push_int8: enum ndr_err_code (struct ndr_push *, int, int8_t)
++ndr_push_ipv4address: enum ndr_err_code (struct ndr_push *, int, const char *)
++ndr_push_ipv6address: enum ndr_err_code (struct ndr_push *, int, const char *)
++ndr_push_ndr_syntax_id: enum ndr_err_code (struct ndr_push *, int, const struct ndr_syntax_id *)
++ndr_push_netr_SamDatabaseID: enum ndr_err_code (struct ndr_push *, int, enum netr_SamDatabaseID)
++ndr_push_netr_SchannelType: enum ndr_err_code (struct ndr_push *, int, enum netr_SchannelType)
++ndr_push_pipe_chunk_trailer: enum ndr_err_code (struct ndr_push *, int, uint32_t)
++ndr_push_pointer: enum ndr_err_code (struct ndr_push *, int, void *)
++ndr_push_policy_handle: enum ndr_err_code (struct ndr_push *, int, const struct policy_handle *)
++ndr_push_ref_ptr: enum ndr_err_code (struct ndr_push *)
++ndr_push_relative_ptr1: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_relative_ptr2_end: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_relative_ptr2_start: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_restore_relative_base_offset: void (struct ndr_push *, uint32_t)
++ndr_push_set_switch_value: enum ndr_err_code (struct ndr_push *, const void *, uint32_t)
++ndr_push_setup_relative_base_offset1: enum ndr_err_code (struct ndr_push *, const void *, uint32_t)
++ndr_push_setup_relative_base_offset2: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_short_relative_ptr1: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_short_relative_ptr2: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_string: enum ndr_err_code (struct ndr_push *, int, const char *)
++ndr_push_string_array: enum ndr_err_code (struct ndr_push *, int, const char **)
++ndr_push_struct_blob: enum ndr_err_code (DATA_BLOB *, TALLOC_CTX *, const void *, ndr_push_flags_fn_t)
++ndr_push_subcontext_end: enum ndr_err_code (struct ndr_push *, struct ndr_push *, size_t, ssize_t)
++ndr_push_subcontext_start: enum ndr_err_code (struct ndr_push *, struct ndr_push **, size_t, ssize_t)
++ndr_push_svcctl_ServerType: enum ndr_err_code (struct ndr_push *, int, uint32_t)
++ndr_push_time_t: enum ndr_err_code (struct ndr_push *, int, time_t)
++ndr_push_timespec: enum ndr_err_code (struct ndr_push *, int, const struct timespec *)
++ndr_push_timeval: enum ndr_err_code (struct ndr_push *, int, const struct timeval *)
++ndr_push_trailer_align: enum ndr_err_code (struct ndr_push *, size_t)
++ndr_push_udlong: enum ndr_err_code (struct ndr_push *, int, uint64_t)
++ndr_push_udlongr: enum ndr_err_code (struct ndr_push *, int, uint64_t)
++ndr_push_uid_t: enum ndr_err_code (struct ndr_push *, int, uid_t)
++ndr_push_uint16: enum ndr_err_code (struct ndr_push *, int, uint16_t)
++ndr_push_uint1632: enum ndr_err_code (struct ndr_push *, int, uint16_t)
++ndr_push_uint32: enum ndr_err_code (struct ndr_push *, int, uint32_t)
++ndr_push_uint3264: enum ndr_err_code (struct ndr_push *, int, uint32_t)
++ndr_push_uint8: enum ndr_err_code (struct ndr_push *, int, uint8_t)
++ndr_push_union_align: enum ndr_err_code (struct ndr_push *, size_t)
++ndr_push_union_blob: enum ndr_err_code (DATA_BLOB *, TALLOC_CTX *, void *, uint32_t, ndr_push_flags_fn_t)
++ndr_push_unique_ptr: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_winreg_Data: enum ndr_err_code (struct ndr_push *, int, const union winreg_Data *)
++ndr_push_winreg_Type: enum ndr_err_code (struct ndr_push *, int, enum winreg_Type)
++ndr_push_zero: enum ndr_err_code (struct ndr_push *, uint32_t)
++ndr_set_flags: void (uint32_t *, uint32_t)
++ndr_size_DATA_BLOB: uint32_t (int, const DATA_BLOB *, int)
++ndr_size_GUID: size_t (const struct GUID *, int)
++ndr_size_string: uint32_t (int, const char * const *, int)
++ndr_size_string_array: size_t (const char **, uint32_t, int)
++ndr_size_struct: size_t (const void *, int, ndr_push_flags_fn_t)
++ndr_size_union: size_t (const void *, int, uint32_t, ndr_push_flags_fn_t)
++ndr_string_array_size: size_t (struct ndr_push *, const char *)
++ndr_string_length: uint32_t (const void *, uint32_t)
++ndr_syntax_id_equal: bool (const struct ndr_syntax_id *, const struct ndr_syntax_id *)
++ndr_syntax_id_null: uuid = {time_low = 0, time_mid = 0, time_hi_and_version = 0, clock_seq = "\000", node = "\000\000\000\000\000"}, if_version = 0
++ndr_token_peek: uint32_t (struct ndr_token_list **, const void *)
++ndr_token_retrieve: enum ndr_err_code (struct ndr_token_list **, const void *, uint32_t *)
++ndr_token_retrieve_cmp_fn: enum ndr_err_code (struct ndr_token_list **, const void *, uint32_t *, comparison_fn_t, bool)
++ndr_token_store: enum ndr_err_code (TALLOC_CTX *, struct ndr_token_list **, const void *, uint32_t)
++ndr_transfer_syntax_ndr: uuid = {time_low = 2324192516, time_mid = 7403, time_hi_and_version = 4553, clock_seq = "\237\350", node = "\b\000+\020H`"}, if_version = 2
++ndr_transfer_syntax_ndr64: uuid = {time_low = 1903232307, time_mid = 48826, time_hi_and_version = 18743, clock_seq = "\203\031", node = "\265\333\357\234\314\066"}, if_version = 1
+--- a/librpc/ndr/libndr.h
++++ b/librpc/ndr/libndr.h
+@@ -124,6 +124,20 @@ struct ndr_print {
+ #define LIBNDR_FLAG_STR_UTF8		(1<<12)
+ #define LIBNDR_STRING_FLAGS		(0x7FFC)
+ 
++/*
++ * don't debug NDR_ERR_BUFSIZE failures,
++ * as the available buffer might be incomplete.
++ *
++ * return NDR_ERR_INCOMPLETE_BUFFER instead.
++ */
++#define LIBNDR_FLAG_INCOMPLETE_BUFFER (1<<16)
++
++/*
++ * This lets ndr_pull_subcontext_end() return
++ * NDR_ERR_UNREAD_BYTES.
++ */
++#define LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES (1<<17)
++
+ /* set if relative pointers should *not* be marshalled in reverse order */
+ #define LIBNDR_FLAG_NO_RELATIVE_REVERSE	(1<<18)
+ 
+@@ -163,6 +177,7 @@ struct ndr_print {
+ 
+ /* useful macro for debugging */
+ #define NDR_PRINT_DEBUG(type, p) ndr_print_debug((ndr_print_fn_t)ndr_print_ ##type, #p, p)
++#define NDR_PRINT_DEBUGC(dbgc_class, type, p) ndr_print_debugc(dbgc_class, (ndr_print_fn_t)ndr_print_ ##type, #p, p)
+ #define NDR_PRINT_UNION_DEBUG(type, level, p) ndr_print_union_debug((ndr_print_fn_t)ndr_print_ ##type, #p, level, p)
+ #define NDR_PRINT_FUNCTION_DEBUG(type, flags, p) ndr_print_function_debug((ndr_print_function_t)ndr_print_ ##type, #type, flags, p)
+ #define NDR_PRINT_BOTH_DEBUG(type, p) NDR_PRINT_FUNCTION_DEBUG(type, NDR_BOTH, p)
+@@ -199,7 +214,9 @@ enum ndr_err_code {
+ 	NDR_ERR_IPV6ADDRESS,
+ 	NDR_ERR_INVALID_POINTER,
+ 	NDR_ERR_UNREAD_BYTES,
+-	NDR_ERR_NDR64
++	NDR_ERR_NDR64,
++	NDR_ERR_FLAGS,
++	NDR_ERR_INCOMPLETE_BUFFER
+ };
+ 
+ #define NDR_ERR_CODE_IS_SUCCESS(x) (x == NDR_ERR_SUCCESS)
+@@ -217,20 +234,52 @@ enum ndr_compression_alg {
+ 
+ /*
+   flags passed to control parse flow
++  These are deliberately in a different range to the NDR_IN/NDR_OUT
++  flags to catch mixups
+ */
+-#define NDR_SCALARS 1
+-#define NDR_BUFFERS 2
++#define NDR_SCALARS    0x100
++#define NDR_BUFFERS    0x200
+ 
+ /*
+-  flags passed to ndr_print_*()
++  flags passed to ndr_print_*() and ndr pull/push for functions
++  These are deliberately in a different range to the NDR_SCALARS/NDR_BUFFERS
++  flags to catch mixups
+ */
+-#define NDR_IN 1
+-#define NDR_OUT 2
+-#define NDR_BOTH 3
+-#define NDR_SET_VALUES 4
++#define NDR_IN         0x10
++#define NDR_OUT        0x20
++#define NDR_BOTH       0x30
++#define NDR_SET_VALUES 0x40
++
++
++#define NDR_PULL_CHECK_FLAGS(ndr, ndr_flags) do { \
++	if ((ndr_flags) & ~(NDR_SCALARS|NDR_BUFFERS)) { \
++		return ndr_pull_error(ndr, NDR_ERR_FLAGS, "Invalid pull struct ndr_flags 0x%x", ndr_flags); \
++	} \
++} while (0)
++
++#define NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags) do { \
++	if ((ndr_flags) & ~(NDR_SCALARS|NDR_BUFFERS)) \
++		return ndr_push_error(ndr, NDR_ERR_FLAGS, "Invalid push struct ndr_flags 0x%x", ndr_flags); \
++} while (0)
++
++#define NDR_PULL_CHECK_FN_FLAGS(ndr, flags) do { \
++	if ((flags) & ~(NDR_BOTH|NDR_SET_VALUES)) { \
++		return ndr_pull_error(ndr, NDR_ERR_FLAGS, "Invalid fn pull flags 0x%x", flags); \
++	} \
++} while (0)
++
++#define NDR_PUSH_CHECK_FN_FLAGS(ndr, flags) do { \
++	if ((flags) & ~(NDR_BOTH|NDR_SET_VALUES)) \
++		return ndr_push_error(ndr, NDR_ERR_FLAGS, "Invalid fn push flags 0x%x", flags); \
++} while (0)
+ 
+ #define NDR_PULL_NEED_BYTES(ndr, n) do { \
+ 	if (unlikely((n) > ndr->data_size || ndr->offset + (n) > ndr->data_size)) { \
++		if (ndr->flags & LIBNDR_FLAG_INCOMPLETE_BUFFER) { \
++			uint32_t _available = ndr->data_size - ndr->offset; \
++			uint32_t _missing = n - _available; \
++			ndr->relative_highest_offset = _missing; \
++		} \
+ 		return ndr_pull_error(ndr, NDR_ERR_BUFSIZE, "Pull bytes %u (%s)", (unsigned)n, __location__); \
+ 	} \
+ } while(0)
+@@ -247,6 +296,10 @@ enum ndr_compression_alg {
+ 		ndr->offset = (ndr->offset + (n-1)) & ~(n-1); \
+ 	} \
+ 	if (unlikely(ndr->offset > ndr->data_size)) {			\
++		if (ndr->flags & LIBNDR_FLAG_INCOMPLETE_BUFFER) { \
++			uint32_t _missing = ndr->offset - ndr->data_size; \
++			ndr->relative_highest_offset = _missing; \
++		} \
+ 		return ndr_pull_error(ndr, NDR_ERR_BUFSIZE, "Pull align %u", (unsigned)n); \
+ 	} \
+ } while(0)
+@@ -402,6 +455,8 @@ void ndr_print_dom_sid0(struct ndr_print
+ size_t ndr_size_dom_sid0(const struct dom_sid *sid, int flags);
+ void ndr_print_GUID(struct ndr_print *ndr, const char *name, const struct GUID *guid);
+ bool ndr_syntax_id_equal(const struct ndr_syntax_id *i1, const struct ndr_syntax_id *i2); 
++char *ndr_syntax_id_to_string(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *id);
++bool ndr_syntax_id_from_string(const char *s, struct ndr_syntax_id *id);
+ enum ndr_err_code ndr_push_struct_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, const void *p, ndr_push_flags_fn_t fn);
+ enum ndr_err_code ndr_push_union_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, void *p, uint32_t level, ndr_push_flags_fn_t fn);
+ size_t ndr_size_struct(const void *p, int flags, ndr_push_flags_fn_t push);
+@@ -424,14 +479,18 @@ enum ndr_err_code ndr_pull_relative_ptr2
+ enum ndr_err_code ndr_pull_relative_ptr_short(struct ndr_pull *ndr, uint16_t *v);
+ size_t ndr_align_size(uint32_t offset, size_t n);
+ struct ndr_pull *ndr_pull_init_blob(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx);
++enum ndr_err_code ndr_pull_append(struct ndr_pull *ndr, DATA_BLOB *blob);
++enum ndr_err_code ndr_pull_pop(struct ndr_pull *ndr);
+ enum ndr_err_code ndr_pull_advance(struct ndr_pull *ndr, uint32_t size);
+ struct ndr_push *ndr_push_init_ctx(TALLOC_CTX *mem_ctx);
+ DATA_BLOB ndr_push_blob(struct ndr_push *ndr);
+ enum ndr_err_code ndr_push_expand(struct ndr_push *ndr, uint32_t extra_size);
+ void ndr_print_debug_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
++void ndr_print_debugc_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
+ void ndr_print_printf_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
+ void ndr_print_string_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
+ void ndr_print_debug(ndr_print_fn_t fn, const char *name, void *ptr);
++void ndr_print_debugc(int dbgc_class, ndr_print_fn_t fn, const char *name, void *ptr);
+ void ndr_print_union_debug(ndr_print_fn_t fn, const char *name, uint32_t level, void *ptr);
+ void ndr_print_function_debug(ndr_print_function_t fn, const char *name, int flags, void *ptr);
+ char *ndr_print_struct_string(TALLOC_CTX *mem_ctx, ndr_print_fn_t fn, const char *name, void *ptr);
+--- a/librpc/ndr/ndr.c
++++ b/librpc/ndr/ndr.c
+@@ -77,6 +77,111 @@ _PUBLIC_ struct ndr_pull *ndr_pull_init_
+ 	return ndr;
+ }
+ 
++_PUBLIC_ enum ndr_err_code ndr_pull_append(struct ndr_pull *ndr, DATA_BLOB *blob)
++{
++	enum ndr_err_code ndr_err;
++	DATA_BLOB b;
++	uint32_t append = 0;
++	bool ok;
++
++	if (blob->length == 0) {
++		return NDR_ERR_SUCCESS;
++	}
++
++	ndr_err = ndr_token_retrieve(&ndr->array_size_list, ndr, &append);
++	if (ndr_err == NDR_ERR_TOKEN) {
++		append = 0;
++		ndr_err = NDR_ERR_SUCCESS;
++	}
++	NDR_CHECK(ndr_err);
++
++	if (ndr->data_size == 0) {
++		ndr->data = NULL;
++		append = UINT32_MAX;
++	}
++
++	if (append == UINT32_MAX) {
++		/*
++		 * append == UINT32_MAX means that
++		 * ndr->data is either NULL or a valid
++		 * talloc child of ndr, which means
++		 * we can use data_blob_append() without
++		 * data_blob_talloc() of the existing callers data
++		 */
++		b = data_blob_const(ndr->data, ndr->data_size);
++	} else {
++		b = data_blob_talloc(ndr, ndr->data, ndr->data_size);
++		if (b.data == NULL) {
++			return ndr_pull_error(ndr, NDR_ERR_ALLOC, "%s", __location__);
++		}
++	}
++
++	ok = data_blob_append(ndr, &b, blob->data, blob->length);
++	if (!ok) {
++		return ndr_pull_error(ndr, NDR_ERR_ALLOC, "%s", __location__);
++	}
++
++	ndr->data = b.data;
++	ndr->data_size = b.length;
++
++	return ndr_token_store(ndr, &ndr->array_size_list, ndr, UINT32_MAX);
++}
++
++_PUBLIC_ enum ndr_err_code ndr_pull_pop(struct ndr_pull *ndr)
++{
++	uint32_t skip = 0;
++	uint32_t append = 0;
++
++	if (ndr->relative_base_offset != 0) {
++		return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
++				      "%s", __location__);
++	}
++	if (ndr->relative_highest_offset != 0) {
++		return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
++				      "%s", __location__);
++	}
++	if (ndr->relative_list != NULL) {
++		return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
++				      "%s", __location__);
++	}
++	if (ndr->relative_base_list != NULL) {
++		return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
++				      "%s", __location__);
++	}
++
++	/*
++	 * we need to keep up to 7 bytes
++	 * in order to get the aligment right.
++	 */
++	skip = ndr->offset & 0xFFFFFFF8;
++
++	if (skip == 0) {
++		return NDR_ERR_SUCCESS;
++	}
++
++	ndr->offset -= skip;
++	ndr->data_size -= skip;
++
++	append = ndr_token_peek(&ndr->array_size_list, ndr);
++	if (append != UINT32_MAX) {
++		/*
++		 * here we assume, that ndr->data is not a
++		 * talloc child of ndr.
++		 */
++		ndr->data += skip;
++		return NDR_ERR_SUCCESS;
++	}
++
++	memmove(ndr->data, ndr->data + skip, ndr->data_size);
++
++	ndr->data = talloc_realloc(ndr, ndr->data, uint8_t, ndr->data_size);
++	if (ndr->data_size != 0 && ndr->data == NULL) {
++		return ndr_pull_error(ndr, NDR_ERR_ALLOC, "%s", __location__);
++	}
++
++	return NDR_ERR_SUCCESS;
++}
++
+ /*
+   advance by 'size' bytes
+ */
+@@ -167,6 +272,38 @@ _PUBLIC_ enum ndr_err_code ndr_push_expa
+ 	return NDR_ERR_SUCCESS;
+ }
+ 
++_PUBLIC_ void ndr_print_debugc_helper(struct ndr_print *ndr, const char *format, ...)
++{
++	va_list ap;
++	char *s = NULL;
++	uint32_t i;
++	int ret;
++	int dbgc_class;
++
++	va_start(ap, format);
++	ret = vasprintf(&s, format, ap);
++	va_end(ap);
++
++	if (ret == -1) {
++		return;
++	}
++
++	dbgc_class = *(int *)ndr->private_data;
++
++	if (ndr->no_newline) {
++		DEBUGADDC(dbgc_class, 1,("%s", s));
++		free(s);
++		return;
++	}
++
++	for (i=0;i<ndr->depth;i++) {
++		DEBUGADDC(dbgc_class, 1,("    "));
++	}
++
++	DEBUGADDC(dbgc_class, 1,("%s\n", s));
++	free(s);
++}
++
+ _PUBLIC_ void ndr_print_debug_helper(struct ndr_print *ndr, const char *format, ...) 
+ {
+ 	va_list ap;
+@@ -238,6 +375,25 @@ _PUBLIC_ void ndr_print_string_helper(st
+ }
+ 
+ /*
++  a useful helper function for printing idl structures via DEBUGC()
++*/
++_PUBLIC_ void ndr_print_debugc(int dbgc_class, ndr_print_fn_t fn, const char *name, void *ptr)
++{
++	struct ndr_print *ndr;
++
++	DEBUGC(dbgc_class, 1,(" "));
++
++	ndr = talloc_zero(NULL, struct ndr_print);
++	if (!ndr) return;
++	ndr->private_data = &dbgc_class;
++	ndr->print = ndr_print_debugc_helper;
++	ndr->depth = 1;
++	ndr->flags = 0;
++	fn(ndr, name, ptr);
++	talloc_free(ndr);
++}
++
++/*
+   a useful helper function for printing idl structures via DEBUG()
+ */
+ _PUBLIC_ void ndr_print_debug(ndr_print_fn_t fn, const char *name, void *ptr)
+@@ -403,6 +559,15 @@ _PUBLIC_ enum ndr_err_code ndr_pull_erro
+ 	va_list ap;
+ 	int ret;
+ 
++	if (ndr->flags & LIBNDR_FLAG_INCOMPLETE_BUFFER) {
++		switch (ndr_err) {
++		case NDR_ERR_BUFSIZE:
++			return NDR_ERR_INCOMPLETE_BUFFER;
++		default:
++			break;
++		}
++	}
++
+ 	va_start(ap, format);
+ 	ret = vasprintf(&s, format, ap);
+ 	va_end(ap);
+@@ -557,6 +722,23 @@ _PUBLIC_ enum ndr_err_code ndr_pull_subc
+ 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &reserved));
+ 		break;
+ 	}
++	case 0xFFFFFFFF:
++		/*
++		 * a shallow copy like subcontext
++		 * useful for DCERPC pipe chunks.
++		 */
++		subndr = talloc_zero(ndr, struct ndr_pull);
++		NDR_ERR_HAVE_NO_MEMORY(subndr);
++
++		subndr->flags		= ndr->flags;
++		subndr->current_mem_ctx	= ndr->current_mem_ctx;
++		subndr->data		= ndr->data;
++		subndr->offset		= ndr->offset;
++		subndr->data_size	= ndr->data_size;
++
++		*_subndr = subndr;
++		return NDR_ERR_SUCCESS;
++
+ 	default:
+ 		return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext (PULL) header_size %d", 
+ 				      (int)header_size);
+@@ -589,13 +771,35 @@ _PUBLIC_ enum ndr_err_code ndr_pull_subc
+ 				 ssize_t size_is)
+ {
+ 	uint32_t advance;
+-	if (size_is >= 0) {
++	uint32_t highest_ofs;
++
++	if (header_size == 0xFFFFFFFF) {
++		advance = subndr->offset - ndr->offset;
++	} else if (size_is >= 0) {
+ 		advance = size_is;
+ 	} else if (header_size > 0) {
+ 		advance = subndr->data_size;
+ 	} else {
+ 		advance = subndr->offset;
+ 	}
++
++	if (subndr->offset > ndr->relative_highest_offset) {
++		highest_ofs = subndr->offset;
++	} else {
++		highest_ofs = subndr->relative_highest_offset;
++	}
++	if (!(subndr->flags & LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES)) {
++		/*
++		 * avoid an error unless SUBCONTEXT_NO_UNREAD_BYTES is specified
++		 */
++		highest_ofs = advance;
++	}
++	if (highest_ofs < advance) {
++		return ndr_pull_error(subndr, NDR_ERR_UNREAD_BYTES,
++				      "not all bytes consumed ofs[%u] advance[%u]",
++				      highest_ofs, advance);
++	}
++
+ 	NDR_CHECK(ndr_pull_advance(ndr, advance));
+ 	return NDR_ERR_SUCCESS;
+ }
+@@ -1440,6 +1644,7 @@ const static struct {
+ 	{ NDR_ERR_INVALID_POINTER, "Invalid Pointer" },
+ 	{ NDR_ERR_UNREAD_BYTES, "Unread Bytes" },
+ 	{ NDR_ERR_NDR64, "NDR64 assertion error" },
++	{ NDR_ERR_INCOMPLETE_BUFFER, "Incomplete Buffer" },
+ 	{ 0, NULL }
+ };
+ 
+--- a/librpc/idl/idl_types.h
++++ b/librpc/idl/idl_types.h
+@@ -47,3 +47,5 @@
+ 
+ #define NDR_RELATIVE_REVERSE LIBNDR_FLAG_RELATIVE_REVERSE
+ #define NDR_NO_RELATIVE_REVERSE LIBNDR_FLAG_NO_RELATIVE_REVERSE
++
++#define NDR_SUBCONTEXT_NO_UNREAD_BYTES LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES
+--- a/librpc/idl/dcerpc.idl
++++ b/librpc/idl/dcerpc.idl
+@@ -10,6 +10,8 @@
+ */
+ import "misc.idl";
+ 
++cpp_quote("extern const uint8_t DCERPC_SEC_VT_MAGIC[8];")
++
+ interface dcerpc
+ {
+ 	typedef struct {
+@@ -453,14 +455,21 @@ interface dcerpc
+ 	} dcerpc_payload;
+ 
+ 	/* pfc_flags values */
+-	const uint8 DCERPC_PFC_FLAG_FIRST		= 0x01; /* First fragment */
+-	const uint8 DCERPC_PFC_FLAG_LAST		= 0x02; /* Last fragment */
+-	const uint8 DCERPC_PFC_FLAG_PENDING_CANCEL	= 0x04; /* Cancel was pending at sender */
+-	const uint8 DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN	= DCERPC_PFC_FLAG_PENDING_CANCEL; /* depends on the pdu type */
+-	const uint8 DCERPC_PFC_FLAG_CONC_MPX		= 0x10; /* supports concurrent multiplexing of a single connection. */
+-	const uint8 DCERPC_PFC_FLAG_DID_NOT_EXECUTE	= 0x20; /* on a fault it means the server hasn't done anything */
+-	const uint8 DCERPC_PFC_FLAG_MAYBE		= 0x40; /* `maybe' call semantics requested */
+-	const uint8 DCERPC_PFC_FLAG_OBJECT_UUID		= 0x80; /* on valid guid is in the optional object field */
++	typedef [bitmap8bit] bitmap {
++		DCERPC_PFC_FLAG_FIRST		= 0x01, /* First fragment */
++		DCERPC_PFC_FLAG_LAST		= 0x02, /* Last fragment */
++		DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING = 0x04, /* depends on the pdu type */
++		DCERPC_PFC_FLAG_CONC_MPX	= 0x10, /* supports concurrent multiplexing of a single connection. */
++		DCERPC_PFC_FLAG_DID_NOT_EXECUTE	= 0x20, /* on a fault it means the server hasn't done anything */
++		DCERPC_PFC_FLAG_MAYBE		= 0x40, /* `maybe' call semantics requested */
++		DCERPC_PFC_FLAG_OBJECT_UUID	= 0x80 /* on valid guid is in the optional object field */
++	} dcerpc_pfc_flags;
++
++	/* Cancel was pending at sender */
++	const int DCERPC_PFC_FLAG_PENDING_CANCEL =
++		DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING;
++	const ist DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN =
++		DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING;
+ 
+ 	/* these offsets are needed by the signing code */
+ 	const uint8 DCERPC_PFC_OFFSET      =  3;
+@@ -468,6 +477,7 @@ interface dcerpc
+ 	const uint8 DCERPC_FRAG_LEN_OFFSET =  8;
+ 	const uint8 DCERPC_AUTH_LEN_OFFSET = 10;
+ 	const uint8 DCERPC_CALL_ID_OFFSET  = 12;
++	const uint8 DCERPC_NCACN_PAYLOAD_OFFSET = 16;
+ 
+ 	/* little-endian flag */
+ 	const uint8 DCERPC_DREP_LE  = 0x10;
+@@ -476,7 +486,7 @@ interface dcerpc
+ 		uint8 rpc_vers;	        /* RPC version */
+ 		uint8 rpc_vers_minor;   /* Minor version */
+ 		dcerpc_pkt_type ptype;  /* Packet type */
+-		uint8 pfc_flags;        /* Fragmentation flags */
++		dcerpc_pfc_flags pfc_flags; /* Fragmentation flags */
+ 		uint8 drep[4];	        /* NDR data representation */
+ 		uint16 frag_length;     /* Total length of fragment */
+ 		uint16 auth_length;     /* authenticator length */
+@@ -506,4 +516,69 @@ interface dcerpc
+ 		uint8 serial_low;
+ 		[switch_is(ptype)] dcerpc_payload u;
+ 	} ncadg_packet;
++
++	typedef [bitmap16bit] bitmap {
++		DCERPC_SEC_VT_COMMAND_ENUM  = 0x3FFF,
++		DCERPC_SEC_VT_COMMAND_END   = 0x4000,
++		DCERPC_SEC_VT_MUST_PROCESS  = 0x8000
++	} dcerpc_sec_vt_command;
++
++	typedef [enum16bit] enum {
++		DCERPC_SEC_VT_COMMAND_BITMASK1  = 0x0001,
++		DCERPC_SEC_VT_COMMAND_PCONTEXT  = 0x0002,
++		DCERPC_SEC_VT_COMMAND_HEADER2   = 0x0003
++	} dcerpc_sec_vt_command_enum;
++
++	typedef [bitmap32bit] bitmap {
++		DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING = 0x00000001
++	} dcerpc_sec_vt_bitmask1;
++
++	typedef struct {
++		ndr_syntax_id abstract_syntax;
++		ndr_syntax_id transfer_syntax;
++	} dcerpc_sec_vt_pcontext;
++
++	typedef struct {
++		dcerpc_pkt_type ptype;  /* Packet type */
++		[value(0)] uint8 reserved1;
++		[value(0)] uint16 reserved2;
++		uint8 drep[4];          /* NDR data representation */
++		uint32 call_id;         /* Call identifier */
++		uint16 context_id;
++		uint16 opnum;
++	} dcerpc_sec_vt_header2;
++
++	typedef [switch_type(dcerpc_sec_vt_command_enum),nodiscriminant] union {
++	[case(DCERPC_SEC_VT_COMMAND_BITMASK1)] dcerpc_sec_vt_bitmask1 bitmask1;
++	[case(DCERPC_SEC_VT_COMMAND_PCONTEXT)] dcerpc_sec_vt_pcontext pcontext;
++	[case(DCERPC_SEC_VT_COMMAND_HEADER2)] dcerpc_sec_vt_header2 header2;
++	[default,flag(NDR_REMAINING)] DATA_BLOB _unknown;
++	} dcerpc_sec_vt_union;
++
++	typedef struct {
++		dcerpc_sec_vt_command command;
++		[switch_is(command & DCERPC_SEC_VT_COMMAND_ENUM)]
++			[subcontext(2),flag(NDR_SUBCONTEXT_NO_UNREAD_BYTES)]
++			dcerpc_sec_vt_union u;
++	} dcerpc_sec_vt;
++
++	typedef [public,nopush,nopull] struct {
++		uint16 count;
++	} dcerpc_sec_vt_count;
++
++	/*
++	 * We assume that the whole verification trailer fits into
++	 * the last 1024 bytes after the stub data.
++	 *
++	 * There're currently only 3 commands defined and each should
++	 * only be used once.
++	 */
++	const uint16 DCERPC_SEC_VT_MAX_SIZE = 1024;
++
++	typedef [public,flag(NDR_PAHEX)] struct {
++		[flag(NDR_ALIGN4)] DATA_BLOB _pad;
++		[value(DCERPC_SEC_VT_MAGIC)] uint8 magic[8];
++		dcerpc_sec_vt_count count;
++		dcerpc_sec_vt commands[count.count];
++	} dcerpc_sec_verification_trailer;
+ }
+--- /dev/null
++++ b/librpc/ndr/ndr_dcerpc.c
+@@ -0,0 +1,187 @@
++/*
++   Unix SMB/CIFS implementation.
++
++   Manually parsed structures found in the DCERPC protocol
++
++   Copyright (C) Stefan Metzmacher 2014
++   Copyright (C) Gregor Beck 2014
++
++   This program is free software; you can redistribute it and/or modify
++   it under the terms of the GNU General Public License as published by
++   the Free Software Foundation; either version 3 of the License, or
++   (at your option) any later version.
++
++   This program is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++   GNU General Public License for more details.
++
++   You should have received a copy of the GNU General Public License
++   along with this program.  If not, see <http://www.gnu.org/licenses/>.
++*/
++
++#include "includes.h"
++#include "librpc/gen_ndr/ndr_dcerpc.h"
++
++#include "librpc/gen_ndr/ndr_misc.h"
++#include "lib/util/bitmap.h"
++
++const uint8_t DCERPC_SEC_VT_MAGIC[] = {0x8a,0xe3,0x13,0x71,0x02,0xf4,0x36,0x71};
++
++_PUBLIC_ enum ndr_err_code ndr_push_dcerpc_sec_vt_count(struct ndr_push *ndr, int ndr_flags, const struct dcerpc_sec_vt_count *r)
++{
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
++	/* nothing */
++	return NDR_ERR_SUCCESS;
++}
++
++_PUBLIC_ enum ndr_err_code ndr_pull_dcerpc_sec_vt_count(struct ndr_pull *ndr, int ndr_flags, struct dcerpc_sec_vt_count *r)
++{
++	uint32_t _saved_ofs = ndr->offset;
++
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
++
++	if (!(ndr_flags & NDR_SCALARS)) {
++		return NDR_ERR_SUCCESS;
++	}
++
++	r->count = 0;
++
++	while (true) {
++		uint16_t command;
++		uint16_t length;
++
++		NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &command));
++		NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &length));
++		NDR_CHECK(ndr_pull_advance(ndr, length));
++
++		r->count += 1;
++
++		if (command & DCERPC_SEC_VT_COMMAND_END) {
++			break;
++		}
++	}
++
++	ndr->offset = _saved_ofs;
++	return NDR_ERR_SUCCESS;
++}
++
++_PUBLIC_ enum ndr_err_code ndr_pop_dcerpc_sec_verification_trailer(
++	struct ndr_pull *ndr, TALLOC_CTX *mem_ctx,
++	struct dcerpc_sec_verification_trailer **_r)
++{
++	enum ndr_err_code ndr_err;
++	uint32_t ofs;
++	uint32_t min_ofs = 0;
++	struct dcerpc_sec_verification_trailer *r;
++	DATA_BLOB sub_blob = data_blob_null;
++	struct ndr_pull *sub_ndr = NULL;
++	uint32_t remaining;
++
++	*_r = NULL;
++
++	r = talloc_zero(mem_ctx, struct dcerpc_sec_verification_trailer);
++	if (r == NULL) {
++		return NDR_ERR_ALLOC;
++	}
++
++	if (ndr->data_size < sizeof(DCERPC_SEC_VT_MAGIC)) {
++		/*
++		 * we return with r->count = 0
++		 */
++		*_r = r;
++		return NDR_ERR_SUCCESS;
++	}
++
++	ofs = ndr->data_size - sizeof(DCERPC_SEC_VT_MAGIC);
++	/* the magic is 4 byte aligned */
++	ofs &= ~3;
++
++	if (ofs > DCERPC_SEC_VT_MAX_SIZE) {
++		/*
++		 * We just scan the last 1024 bytes.
++		 */
++		min_ofs = ofs - DCERPC_SEC_VT_MAX_SIZE;
++	} else {
++		min_ofs = 0;
++	}
++
++	while (true) {
++		int ret;
++
++		ret = memcmp(&ndr->data[ofs],
++			     DCERPC_SEC_VT_MAGIC,
++			     sizeof(DCERPC_SEC_VT_MAGIC));
++		if (ret == 0) {
++			sub_blob = data_blob_const(&ndr->data[ofs],
++						   ndr->data_size - ofs);
++			break;
++		}
++
++		if (ofs <= min_ofs) {
++			break;
++		}
++
++		ofs -= 4;
++	}
++
++	if (sub_blob.length == 0) {
++		/*
++		 * we return with r->count = 0
++		 */
++		*_r = r;
++		return NDR_ERR_SUCCESS;
++	}
++
++	sub_ndr = ndr_pull_init_blob(&sub_blob, r);
++	if (sub_ndr == NULL) {
++		TALLOC_FREE(r);
++		return NDR_ERR_ALLOC;
++	}
++
++	ndr_err = ndr_pull_dcerpc_sec_verification_trailer(sub_ndr,
++							   NDR_SCALARS | NDR_BUFFERS,
++							   r);
++	if (ndr_err == NDR_ERR_ALLOC) {
++		TALLOC_FREE(r);
++		return NDR_ERR_ALLOC;
++	}
++
++	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
++		goto ignore_error;
++	}
++
++	remaining = sub_ndr->data_size - sub_ndr->offset;
++	if (remaining > 16) {
++		/*
++		 * we expect not more than 16 byte of additional
++		 * padding after the verification trailer.
++		 */
++		goto ignore_error;
++	}
++
++	/*
++	 * We assume that we got a real verification trailer.
++	 *
++	 * We remove it from the available stub data.
++	 */
++	ndr->data_size = ofs;
++
++	TALLOC_FREE(sub_ndr);
++
++	*_r = r;
++	return NDR_ERR_SUCCESS;
++
++ignore_error:
++	TALLOC_FREE(sub_ndr);
++	/*
++	 * just ignore the error, it's likely
++	 * that the magic we found belongs to
++	 * the stub data.
++	 *
++	 * we return with r->count = 0
++	 */
++	ZERO_STRUCTP(r);
++	*_r = r;
++	return NDR_ERR_SUCCESS;
++}
+--- a/librpc/wscript_build
++++ b/librpc/wscript_build
+@@ -274,8 +274,9 @@ bld.SAMBA_SUBSYSTEM('NDR_COMPRESSION',
+ 	)
+ 
+ bld.SAMBA_SUBSYSTEM('NDR_DCERPC',
+-	source='gen_ndr/ndr_dcerpc.c',
++	source='gen_ndr/ndr_dcerpc.c ndr/ndr_dcerpc.c',
+ 	public_deps='ndr',
++	deps='bitmap',
+ 	public_headers='gen_ndr/ndr_dcerpc.h gen_ndr/dcerpc.h',
+ 	header_path= [ ('*gen_ndr*', 'gen_ndr') ],
+ 	)
+--- a/source3/Makefile.in
++++ b/source3/Makefile.in
+@@ -323,7 +323,8 @@ LIBNDR_OBJ = ../librpc/ndr/ndr_basic.o \
+ 	     ../librpc/ndr/uuid.o \
+ 	     librpc/ndr/util.o \
+ 	     librpc/gen_ndr/ndr_server_id.o \
+-	     librpc/gen_ndr/ndr_dcerpc.o
++	     librpc/gen_ndr/ndr_dcerpc.o \
++	     ../librpc/ndr/ndr_dcerpc.o
+ 
+ LIBNDR_GEN_OBJ0 = librpc/gen_ndr/ndr_samr.o \
+ 		  librpc/gen_ndr/ndr_lsa.o
+@@ -454,7 +455,7 @@ LIB_OBJ = $(LIBSAMBAUTIL_OBJ) $(UTIL_OBJ
+ 	  lib/username.o \
+ 	  ../libds/common/flag_mapping.o \
+ 	  lib/access.o lib/smbrun.o \
+-	  lib/bitmap.o lib/dprintf.o $(UTIL_REG_OBJ) \
++	  ../lib/util/bitmap.o lib/dprintf.o $(UTIL_REG_OBJ) \
+ 	  lib/wins_srv.o \
+ 	  lib/util_str.o lib/clobber.o lib/util_sid.o \
+ 	  lib/util_unistr.o ../lib/util/charset/codepoints.o lib/util_file.o \
+@@ -987,7 +988,9 @@ SWAT_OBJ = $(SWAT_OBJ1) $(PARAM_OBJ) $(P
+ 	   $(POPT_LIB_OBJ) $(SMBLDAP_OBJ) $(LIBMSRPC_GEN_OBJ) $(LIBMSRPC_OBJ) \
+            $(PASSCHANGE_OBJ) $(FNAME_UTIL_OBJ) \
+ 	   $(LIBCLI_SAMR_OBJ) \
+-	   rpc_client/init_lsa.o
++	   $(LIBCLI_NETLOGON_OBJ) \
++	   rpc_client/init_lsa.o \
++	   rpc_client/init_netlogon.o
+ 
+ STATUS_OBJ = utils/status.o utils/status_profile.o \
+ 	     $(LOCKING_OBJ) $(PARAM_OBJ) \
+@@ -1003,7 +1006,9 @@ SMBTREE_OBJ = utils/smbtree.o $(PARAM_OB
+ 	     $(PASSDB_OBJ) $(SMBLDAP_OBJ) $(GROUPDB_OBJ) \
+ 	     $(LIBMSRPC_GEN_OBJ) \
+ 	     $(LIBMSRPC_OBJ) \
+-	     $(LIBCLI_SRVSVC_OBJ)
++	     $(LIBCLI_SRVSVC_OBJ) \
++	     $(LIBCLI_NETLOGON_OBJ) \
++	     rpc_client/init_netlogon.o
+ 
+ TESTPARM_OBJ = utils/testparm.o \
+                $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) \
+@@ -1025,7 +1030,9 @@ SMBPASSWD_OBJ = utils/smbpasswd.o $(PASS
+ 		$(POPT_LIB_OBJ) $(SMBLDAP_OBJ) \
+ 		$(LIBMSRPC_GEN_OBJ) $(LIBMSRPC_OBJ) \
+ 		$(LIBCLI_SAMR_OBJ) \
+-		rpc_client/init_lsa.o
++		$(LIBCLI_NETLOGON_OBJ) \
++		rpc_client/init_lsa.o \
++		rpc_client/init_netlogon.o
+ 
+ PDBEDIT_OBJ = utils/pdbedit.o $(PASSWD_UTIL_OBJ) $(PARAM_OBJ) $(PASSDB_OBJ) \
+ 		$(LIBSAMBA_OBJ) $(LIBTSOCKET_OBJ) \
+@@ -1098,7 +1105,9 @@ LIBSMBCLIENT_OBJ1 = $(LIBSMBCLIENT_OBJ0)
+ 		    $(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) \
+ 		    $(PASSDB_OBJ) $(SMBLDAP_OBJ) $(GROUPDB_OBJ) \
+ 		    $(LIBCLI_SRVSVC_OBJ) \
+-		    $(LIBCLI_LSA_OBJ)
++		    $(LIBCLI_LSA_OBJ) \
++		    $(LIBCLI_NETLOGON_OBJ) \
++		    rpc_client/init_netlogon.o
+ 
+ LIBSMBCLIENT_OBJ = $(LIBSMBCLIENT_OBJ1)
+ 
+@@ -1121,7 +1130,9 @@ CLIENT_OBJ = $(CLIENT_OBJ1) $(PARAM_OBJ)
+              $(READLINE_OBJ) $(POPT_LIB_OBJ) \
+              $(PASSDB_OBJ) $(SMBLDAP_OBJ) $(GROUPDB_OBJ) \
+ 	     $(DISPLAY_SEC_OBJ) \
+-	     $(LIBCLI_SRVSVC_OBJ)
++	     $(LIBCLI_SRVSVC_OBJ) \
++	     $(LIBCLI_NETLOGON_OBJ) \
++	     rpc_client/init_netlogon.o
+ 
+ LIBSMBCONF_OBJ = ../lib/smbconf/smbconf.o \
+ 		 ../lib/smbconf/smbconf_util.o \
+@@ -1233,7 +1244,9 @@ SMBTORTURE_OBJ = $(SMBTORTURE_OBJ1) $(PA
+ 	@LIBWBCLIENT_STATIC@ \
+         torture/wbc_async.o \
+         ../nsswitch/wb_reqtrans.o \
+-	$(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) $(LIBCLI_ECHO_OBJ)
++	$(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) $(LIBCLI_ECHO_OBJ) \
++	$(LIBCLI_NETLOGON_OBJ) rpc_client/init_netlogon.o
++
+ 
+ MASKTEST_OBJ = torture/masktest.o $(PARAM_OBJ) $(LIBSMB_OBJ) $(KRBCLIENT_OBJ) \
+                  $(LIB_NONSMBD_OBJ) \
+@@ -1268,14 +1281,18 @@ SMBCACLS_OBJ = utils/smbcacls.o $(PARAM_
+ 		$(KRBCLIENT_OBJ) $(LIB_NONSMBD_OBJ) \
+ 		$(PASSDB_OBJ) $(GROUPDB_OBJ) $(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) \
+ 		$(POPT_LIB_OBJ) $(SMBLDAP_OBJ) \
+-		$(LIBCLI_LSA_OBJ)
++		$(LIBCLI_LSA_OBJ) \
++		$(LIBCLI_NETLOGON_OBJ) \
++		rpc_client/init_netlogon.o
+ 
+ SMBCQUOTAS_OBJ = utils/smbcquotas.o $(LIBSMB_OBJ) $(KRBCLIENT_OBJ) \
+ 		$(PARAM_OBJ) \
+ 		$(LIB_NONSMBD_OBJ) \
+ 		$(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) $(POPT_LIB_OBJ) \
+ 		$(PASSDB_OBJ) $(SMBLDAP_OBJ) $(GROUPDB_OBJ) \
+-		$(LIBCLI_LSA_OBJ)
++		$(LIBCLI_LSA_OBJ) \
++		$(LIBCLI_NETLOGON_OBJ) \
++		rpc_client/init_netlogon.o
+ 
+ EVTLOGADM_OBJ0	= utils/eventlogadm.o
+ 
+--- a/librpc/ndr/ndr_basic.c
++++ b/librpc/ndr/ndr_basic.c
+@@ -61,6 +61,7 @@ _PUBLIC_ void ndr_check_padding(struct n
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_int8(struct ndr_pull *ndr, int ndr_flags, int8_t *v)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PULL_NEED_BYTES(ndr, 1);
+ 	*v = (int8_t)CVAL(ndr->data, ndr->offset);
+ 	ndr->offset += 1;
+@@ -72,6 +73,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_int8
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_uint8(struct ndr_pull *ndr, int ndr_flags, uint8_t *v)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PULL_NEED_BYTES(ndr, 1);
+ 	*v = CVAL(ndr->data, ndr->offset);
+ 	ndr->offset += 1;
+@@ -83,6 +85,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_uint
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_int16(struct ndr_pull *ndr, int ndr_flags, int16_t *v)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PULL_ALIGN(ndr, 2);
+ 	NDR_PULL_NEED_BYTES(ndr, 2);
+ 	*v = (uint16_t)NDR_SVAL(ndr, ndr->offset);
+@@ -95,6 +98,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_int1
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_uint16(struct ndr_pull *ndr, int ndr_flags, uint16_t *v)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PULL_ALIGN(ndr, 2);
+ 	NDR_PULL_NEED_BYTES(ndr, 2);
+ 	*v = NDR_SVAL(ndr, ndr->offset);
+@@ -107,6 +111,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_uint
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_uint1632(struct ndr_pull *ndr, int ndr_flags, uint16_t *v)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	if (unlikely(ndr->flags & LIBNDR_FLAG_NDR64)) {
+ 		uint32_t v32 = 0;
+ 		enum ndr_err_code err = ndr_pull_uint32(ndr, ndr_flags, &v32);
+@@ -125,6 +130,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_uint
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_int32(struct ndr_pull *ndr, int ndr_flags, int32_t *v)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PULL_ALIGN(ndr, 4);
+ 	NDR_PULL_NEED_BYTES(ndr, 4);
+ 	*v = NDR_IVALS(ndr, ndr->offset);
+@@ -137,6 +143,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_int3
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_uint32(struct ndr_pull *ndr, int ndr_flags, uint32_t *v)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PULL_ALIGN(ndr, 4);
+ 	NDR_PULL_NEED_BYTES(ndr, 4);
+ 	*v = NDR_IVAL(ndr, ndr->offset);
+@@ -151,6 +158,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_uint
+ {
+ 	uint64_t v64;
+ 	enum ndr_err_code err;
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	if (likely(!(ndr->flags & LIBNDR_FLAG_NDR64))) {
+ 		return ndr_pull_uint32(ndr, ndr_flags, v);
+ 	}
+@@ -169,6 +177,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_uint
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_double(struct ndr_pull *ndr, int ndr_flags, double *v)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PULL_ALIGN(ndr, 8);
+ 	NDR_PULL_NEED_BYTES(ndr, 8);
+ 	memcpy(v, ndr->data+ndr->offset, 8);
+@@ -217,6 +226,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_ref_
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_udlong(struct ndr_pull *ndr, int ndr_flags, uint64_t *v)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PULL_ALIGN(ndr, 4);
+ 	NDR_PULL_NEED_BYTES(ndr, 8);
+ 	*v = NDR_IVAL(ndr, ndr->offset);
+@@ -230,6 +240,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_udlo
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_udlongr(struct ndr_pull *ndr, int ndr_flags, uint64_t *v)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PULL_ALIGN(ndr, 4);
+ 	NDR_PULL_NEED_BYTES(ndr, 8);
+ 	*v = ((uint64_t)NDR_IVAL(ndr, ndr->offset)) << 32;
+@@ -264,6 +275,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_hype
+ _PUBLIC_ enum ndr_err_code ndr_pull_pointer(struct ndr_pull *ndr, int ndr_flags, void* *v)
+ {
+ 	uintptr_t h;
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PULL_ALIGN(ndr, sizeof(h));
+ 	NDR_PULL_NEED_BYTES(ndr, sizeof(h));
+ 	memcpy(&h, ndr->data+ndr->offset, sizeof(h));
+@@ -278,6 +290,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_poin
+ _PUBLIC_ enum ndr_err_code ndr_pull_NTSTATUS(struct ndr_pull *ndr, int ndr_flags, NTSTATUS *status)
+ {
+ 	uint32_t v;
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v));
+ 	*status = NT_STATUS(v);
+ 	return NDR_ERR_SUCCESS;
+@@ -302,6 +315,7 @@ _PUBLIC_ void ndr_print_NTSTATUS(struct
+ _PUBLIC_ enum ndr_err_code ndr_pull_WERROR(struct ndr_pull *ndr, int ndr_flags, WERROR *status)
+ {
+ 	uint32_t v;
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v));
+ 	*status = W_ERROR(v);
+ 	return NDR_ERR_SUCCESS;
+@@ -414,6 +428,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_byte
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_array_uint8(struct ndr_pull *ndr, int ndr_flags, uint8_t *data, uint32_t n)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	if (!(ndr_flags & NDR_SCALARS)) {
+ 		return NDR_ERR_SUCCESS;
+ 	}
+@@ -425,6 +440,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_arra
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_int8(struct ndr_push *ndr, int ndr_flags, int8_t v)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PUSH_NEED_BYTES(ndr, 1);
+ 	SCVAL(ndr->data, ndr->offset, (uint8_t)v);
+ 	ndr->offset += 1;
+@@ -436,6 +452,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_int8
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_uint8(struct ndr_push *ndr, int ndr_flags, uint8_t v)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PUSH_NEED_BYTES(ndr, 1);
+ 	SCVAL(ndr->data, ndr->offset, v);
+ 	ndr->offset += 1;
+@@ -447,6 +464,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_uint
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_int16(struct ndr_push *ndr, int ndr_flags, int16_t v)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PUSH_ALIGN(ndr, 2);
+ 	NDR_PUSH_NEED_BYTES(ndr, 2);
+ 	NDR_SSVAL(ndr, ndr->offset, (uint16_t)v);
+@@ -459,6 +477,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_int1
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_uint16(struct ndr_push *ndr, int ndr_flags, uint16_t v)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PUSH_ALIGN(ndr, 2);
+ 	NDR_PUSH_NEED_BYTES(ndr, 2);
+ 	NDR_SSVAL(ndr, ndr->offset, v);
+@@ -482,6 +501,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_uint
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_int32(struct ndr_push *ndr, int ndr_flags, int32_t v)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PUSH_ALIGN(ndr, 4);
+ 	NDR_PUSH_NEED_BYTES(ndr, 4);
+ 	NDR_SIVALS(ndr, ndr->offset, v);
+@@ -494,6 +514,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_int3
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_uint32(struct ndr_push *ndr, int ndr_flags, uint32_t v)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PUSH_ALIGN(ndr, 4);
+ 	NDR_PUSH_NEED_BYTES(ndr, 4);
+ 	NDR_SIVAL(ndr, ndr->offset, v);
+@@ -517,6 +538,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_uint
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_udlong(struct ndr_push *ndr, int ndr_flags, uint64_t v)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PUSH_ALIGN(ndr, 4);
+ 	NDR_PUSH_NEED_BYTES(ndr, 8);
+ 	NDR_SIVAL(ndr, ndr->offset, (v & 0xFFFFFFFF));
+@@ -530,6 +552,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_udlo
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_udlongr(struct ndr_push *ndr, int ndr_flags, uint64_t v)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PUSH_ALIGN(ndr, 4);
+ 	NDR_PUSH_NEED_BYTES(ndr, 8);
+ 	NDR_SIVAL(ndr, ndr->offset, (v>>32));
+@@ -563,6 +586,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_hype
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_double(struct ndr_push *ndr, int ndr_flags, double v)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PUSH_ALIGN(ndr, 8);
+ 	NDR_PUSH_NEED_BYTES(ndr, 8);
+ 	memcpy(ndr->data+ndr->offset, &v, 8);
+@@ -576,6 +600,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_doub
+ _PUBLIC_ enum ndr_err_code ndr_push_pointer(struct ndr_push *ndr, int ndr_flags, void* v)
+ {
+ 	uintptr_t h = (intptr_t)v;
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_PUSH_ALIGN(ndr, sizeof(h));
+ 	NDR_PUSH_NEED_BYTES(ndr, sizeof(h));
+ 	memcpy(ndr->data+ndr->offset, &h, sizeof(h));
+@@ -686,6 +711,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_zero
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_array_uint8(struct ndr_push *ndr, int ndr_flags, const uint8_t *data, uint32_t n)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	if (!(ndr_flags & NDR_SCALARS)) {
+ 		return NDR_ERR_SUCCESS;
+ 	}
+@@ -738,6 +764,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_ref_
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_NTTIME(struct ndr_push *ndr, int ndr_flags, NTTIME t)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_CHECK(ndr_push_udlong(ndr, ndr_flags, t));
+ 	return NDR_ERR_SUCCESS;
+ }
+@@ -747,6 +774,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_NTTI
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_NTTIME(struct ndr_pull *ndr, int ndr_flags, NTTIME *t)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_CHECK(ndr_pull_udlong(ndr, ndr_flags, t));
+ 	return NDR_ERR_SUCCESS;
+ }
+@@ -756,6 +784,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_NTTI
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_NTTIME_1sec(struct ndr_push *ndr, int ndr_flags, NTTIME t)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	t /= 10000000;
+ 	NDR_CHECK(ndr_push_hyper(ndr, ndr_flags, t));
+ 	return NDR_ERR_SUCCESS;
+@@ -766,6 +795,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_NTTI
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_NTTIME_1sec(struct ndr_pull *ndr, int ndr_flags, NTTIME *t)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_CHECK(ndr_pull_hyper(ndr, ndr_flags, t));
+ 	(*t) *= 10000000;
+ 	return NDR_ERR_SUCCESS;
+@@ -776,6 +806,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_NTTI
+ */
+ _PUBLIC_ enum ndr_err_code ndr_pull_NTTIME_hyper(struct ndr_pull *ndr, int ndr_flags, NTTIME *t)
+ {
++	NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_CHECK(ndr_pull_hyper(ndr, ndr_flags, t));
+ 	return NDR_ERR_SUCCESS;
+ }
+@@ -785,6 +816,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_NTTI
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_NTTIME_hyper(struct ndr_push *ndr, int ndr_flags, NTTIME t)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	NDR_CHECK(ndr_push_hyper(ndr, ndr_flags, t));
+ 	return NDR_ERR_SUCCESS;
+ }
+@@ -814,6 +846,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_time
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_uid_t(struct ndr_push *ndr, int ndr_flags, uid_t u)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	return ndr_push_hyper(ndr, NDR_SCALARS, (uint64_t)u);
+ }
+ 
+@@ -839,6 +872,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_uid_
+ */
+ _PUBLIC_ enum ndr_err_code ndr_push_gid_t(struct ndr_push *ndr, int ndr_flags, gid_t g)
+ {
++	NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
+ 	return ndr_push_hyper(ndr, NDR_SCALARS, (uint64_t)g);
+ }
+ 
+--- a/source3/lib/bitmap.c
++++ /dev/null
+@@ -1,136 +0,0 @@
+-/*
+-   Unix SMB/CIFS implementation.
+-   simple bitmap functions
+-   Copyright (C) Andrew Tridgell 1992-1998
+-
+-   This program is free software; you can redistribute it and/or modify
+-   it under the terms of the GNU General Public License as published by
+-   the Free Software Foundation; either version 3 of the License, or
+-   (at your option) any later version.
+-
+-   This program is distributed in the hope that it will be useful,
+-   but WITHOUT ANY WARRANTY; without even the implied warranty of
+-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+-   GNU General Public License for more details.
+-
+-   You should have received a copy of the GNU General Public License
+-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-*/
+-
+-#include "includes.h"
+-
+-/* these functions provide a simple way to allocate integers from a
+-   pool without repetition */
+-
+-/****************************************************************************
+-talloc a bitmap
+-****************************************************************************/
+-struct bitmap *bitmap_talloc(TALLOC_CTX *mem_ctx, int n)
+-{
+-	struct bitmap *bm;
+-
+-	bm = TALLOC_P(mem_ctx, struct bitmap);
+-
+-	if (!bm) return NULL;
+-
+-	bm->n = n;
+-	bm->b = TALLOC_ZERO_ARRAY(bm, uint32, (n+31)/32);
+-	if (!bm->b) {
+-		TALLOC_FREE(bm);
+-		return NULL;
+-	}
+-	return bm;
+-}
+-
+-/****************************************************************************
+-copy as much of the source bitmap as will fit in the destination bitmap.
+-****************************************************************************/
+-
+-int bitmap_copy(struct bitmap * const dst, const struct bitmap * const src)
+-{
+-        int count = MIN(dst->n, src->n);
+-
+-        SMB_ASSERT(dst->b != src->b);
+-	memcpy(dst->b, src->b, sizeof(uint32)*((count+31)/32));
+-
+-        return count;
+-}
+-
+-/****************************************************************************
+-set a bit in a bitmap
+-****************************************************************************/
+-bool bitmap_set(struct bitmap *bm, unsigned i)
+-{
+-	if (i >= bm->n) {
+-		DEBUG(0,("Setting invalid bitmap entry %d (of %d)\n",
+-		      i, bm->n));
+-		return False;
+-	}
+-	bm->b[i/32] |= (1<<(i%32));
+-	return True;
+-}
+-
+-/****************************************************************************
+-clear a bit in a bitmap
+-****************************************************************************/
+-bool bitmap_clear(struct bitmap *bm, unsigned i)
+-{
+-	if (i >= bm->n) {
+-		DEBUG(0,("clearing invalid bitmap entry %d (of %d)\n",
+-		      i, bm->n));
+-		return False;
+-	}
+-	bm->b[i/32] &= ~(1<<(i%32));
+-	return True;
+-}
+-
+-/****************************************************************************
+-query a bit in a bitmap
+-****************************************************************************/
+-bool bitmap_query(struct bitmap *bm, unsigned i)
+-{
+-	if (i >= bm->n) return False;
+-	if (bm->b[i/32] & (1<<(i%32))) {
+-		return True;
+-	}
+-	return False;
+-}
+-
+-/****************************************************************************
+-find a zero bit in a bitmap starting at the specified offset, with
+-wraparound
+-****************************************************************************/
+-int bitmap_find(struct bitmap *bm, unsigned ofs)
+-{
+-	unsigned int i, j;
+-
+-	if (ofs > bm->n) ofs = 0;
+-
+-	i = ofs;
+-	while (i < bm->n) {
+-		if (~(bm->b[i/32])) {
+-			j = i;
+-			do {
+-				if (!bitmap_query(bm, j)) return j;
+-				j++;
+-			} while (j & 31 && j < bm->n);
+-		}
+-		i += 32;
+-		i &= ~31;
+-	}
+-
+-	i = 0;
+-	while (i < ofs) {
+-		if (~(bm->b[i/32])) {
+-			j = i;
+-			do {
+-				if (!bitmap_query(bm, j)) return j;
+-				j++;
+-			} while (j & 31 && j < bm->n);
+-		}
+-		i += 32;
+-		i &= ~31;
+-	}
+-
+-	return -1;
+-}
+--- /dev/null
++++ b/lib/util/bitmap.c
+@@ -0,0 +1,137 @@
++/*
++   Unix SMB/CIFS implementation.
++   simple bitmap functions
++   Copyright (C) Andrew Tridgell 1992-1998
++
++   This program is free software; you can redistribute it and/or modify
++   it under the terms of the GNU General Public License as published by
++   the Free Software Foundation; either version 3 of the License, or
++   (at your option) any later version.
++
++   This program is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++   GNU General Public License for more details.
++
++   You should have received a copy of the GNU General Public License
++   along with this program.  If not, see <http://www.gnu.org/licenses/>.
++*/
++
++#include "includes.h"
++#include "lib/util/bitmap.h"
++
++/* these functions provide a simple way to allocate integers from a
++   pool without repetition */
++
++/****************************************************************************
++talloc a bitmap
++****************************************************************************/
++struct bitmap *bitmap_talloc(TALLOC_CTX *mem_ctx, int n)
++{
++	struct bitmap *bm;
++
++	bm = talloc_zero(mem_ctx, struct bitmap);
++
++	if (!bm) return NULL;
++
++	bm->n = n;
++	bm->b = talloc_zero_array(bm, uint32_t, (n+31)/32);
++	if (!bm->b) {
++		TALLOC_FREE(bm);
++		return NULL;
++	}
++	return bm;
++}
++
++/****************************************************************************
++copy as much of the source bitmap as will fit in the destination bitmap.
++****************************************************************************/
++
++int bitmap_copy(struct bitmap * const dst, const struct bitmap * const src)
++{
++        int count = MIN(dst->n, src->n);
++
++        SMB_ASSERT(dst->b != src->b);
++	memcpy(dst->b, src->b, sizeof(uint32_t)*((count+31)/32));
++
++        return count;
++}
++
++/****************************************************************************
++set a bit in a bitmap
++****************************************************************************/
++bool bitmap_set(struct bitmap *bm, unsigned i)
++{
++	if (i >= bm->n) {
++		DEBUG(0,("Setting invalid bitmap entry %d (of %d)\n",
++		      i, bm->n));
++		return false;
++	}
++	bm->b[i/32] |= (1<<(i%32));
++	return true;
++}
++
++/****************************************************************************
++clear a bit in a bitmap
++****************************************************************************/
++bool bitmap_clear(struct bitmap *bm, unsigned i)
++{
++	if (i >= bm->n) {
++		DEBUG(0,("clearing invalid bitmap entry %d (of %d)\n",
++		      i, bm->n));
++		return false;
++	}
++	bm->b[i/32] &= ~(1<<(i%32));
++	return true;
++}
++
++/****************************************************************************
++query a bit in a bitmap
++****************************************************************************/
++bool bitmap_query(struct bitmap *bm, unsigned i)
++{
++	if (i >= bm->n) return false;
++	if (bm->b[i/32] & (1<<(i%32))) {
++		return true;
++	}
++	return false;
++}
++
++/****************************************************************************
++find a zero bit in a bitmap starting at the specified offset, with
++wraparound
++****************************************************************************/
++int bitmap_find(struct bitmap *bm, unsigned ofs)
++{
++	unsigned int i, j;
++
++	if (ofs > bm->n) ofs = 0;
++
++	i = ofs;
++	while (i < bm->n) {
++		if (~(bm->b[i/32])) {
++			j = i;
++			do {
++				if (!bitmap_query(bm, j)) return j;
++				j++;
++			} while (j & 31 && j < bm->n);
++		}
++		i += 32;
++		i &= ~31;
++	}
++
++	i = 0;
++	while (i < ofs) {
++		if (~(bm->b[i/32])) {
++			j = i;
++			do {
++				if (!bitmap_query(bm, j)) return j;
++				j++;
++			} while (j & 31 && j < bm->n);
++		}
++		i += 32;
++		i &= ~31;
++	}
++
++	return -1;
++}
+--- /dev/null
++++ b/lib/util/bitmap.h
+@@ -0,0 +1,32 @@
++/*
++   Unix SMB/CIFS implementation.
++   simple bitmap functions
++   Copyright (C) Andrew Tridgell 1992-1998
++
++   This program is free software; you can redistribute it and/or modify
++   it under the terms of the GNU General Public License as published by
++   the Free Software Foundation; either version 3 of the License, or
++   (at your option) any later version.
++
++   This program is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++   GNU General Public License for more details.
++
++   You should have received a copy of the GNU General Public License
++   along with this program.  If not, see <http://www.gnu.org/licenses/>.
++*/
++
++/* The following definitions come from lib/bitmap.c  */
++
++struct bitmap {
++	uint32_t *b;
++	unsigned int n;
++};
++
++struct bitmap *bitmap_talloc(TALLOC_CTX *mem_ctx, int n);
++int bitmap_copy(struct bitmap * const dst, const struct bitmap * const src);
++bool bitmap_set(struct bitmap *bm, unsigned i);
++bool bitmap_clear(struct bitmap *bm, unsigned i);
++bool bitmap_query(struct bitmap *bm, unsigned i);
++int bitmap_find(struct bitmap *bm, unsigned ofs);
+--- a/lib/util/wscript_build
++++ b/lib/util/wscript_build
+@@ -99,5 +99,11 @@ bld.SAMBA_LIBRARY('tdb-wrap',
+                   public_headers='tdb_wrap.h',
+                   private_library=True,
+                   local_include=False
+-                  )
++                 )
++
++bld.SAMBA_LIBRARY('bitmap',
++		  source='bitmap.c',
++		  deps='talloc samba-util',
++                  local_include=False,
++		  private_library=True)
+ 
+--- a/source3/include/proto.h
++++ b/source3/include/proto.h
+@@ -61,15 +61,6 @@ const char *audit_description_str(uint32
+ bool get_audit_category_from_param(const char *param, uint32 *audit_category);
+ const char *audit_policy_str(TALLOC_CTX *mem_ctx, uint32 policy);
+ 
+-/* The following definitions come from lib/bitmap.c  */
+-
+-struct bitmap *bitmap_talloc(TALLOC_CTX *mem_ctx, int n);
+-int bitmap_copy(struct bitmap * const dst, const struct bitmap * const src);
+-bool bitmap_set(struct bitmap *bm, unsigned i);
+-bool bitmap_clear(struct bitmap *bm, unsigned i);
+-bool bitmap_query(struct bitmap *bm, unsigned i);
+-int bitmap_find(struct bitmap *bm, unsigned ofs);
+-
+ /* The following definitions come from lib/charcnv.c  */
+ 
+ char lp_failed_convert_char(void);
+--- a/source3/include/smb.h
++++ b/source3/include/smb.h
+@@ -712,7 +712,6 @@ struct connections_data {
+ 	uint32 unused_compatitibility_field;
+ };
+ 
+-
+ /* the following are used by loadparm for option lists */
+ typedef enum {
+ 	P_BOOL,P_BOOLREV,P_CHAR,P_INTEGER,P_OCTAL,P_LIST,
+@@ -759,11 +758,6 @@ struct parm_struct {
+ #define FLAG_META	0x8000 /* A meta directive - not a real parameter */
+ #define FLAG_CMDLINE	0x10000 /* option has been overridden */
+ 
+-struct bitmap {
+-	uint32 *b;
+-	unsigned int n;
+-};
+-
+ /* offsets into message for common items */
+ #define smb_com 8
+ #define smb_rcls 9
+--- a/source3/modules/vfs_acl_common.c
++++ b/source3/modules/vfs_acl_common.c
+@@ -23,6 +23,7 @@
+ #include "system/filesys.h"
+ #include "../libcli/security/security.h"
+ #include "../librpc/gen_ndr/ndr_security.h"
++#include "../lib/util/bitmap.h"
+ 
+ static NTSTATUS create_acl_blob(const struct security_descriptor *psd,
+ 			DATA_BLOB *pblob,
+--- a/source3/modules/vfs_full_audit.c
++++ b/source3/modules/vfs_full_audit.c
+@@ -64,6 +64,7 @@
+ #include "../librpc/gen_ndr/ndr_netlogon.h"
+ #include "auth.h"
+ #include "ntioctl.h"
++#include "lib/util/bitmap.h"
+ 
+ static int vfs_full_audit_debug_level = DBGC_VFS;
+ 
+--- a/source3/param/loadparm.c
++++ b/source3/param/loadparm.c
+@@ -64,6 +64,7 @@
+ #include "smb_signing.h"
+ #include "dbwrap.h"
+ #include "smbldap.h"
++#include "../lib/util/bitmap.h"
+ 
+ #ifdef HAVE_SYS_SYSCTL_H
+ #include <sys/sysctl.h>
+--- a/source3/passdb/pdb_get_set.c
++++ b/source3/passdb/pdb_get_set.c
+@@ -25,6 +25,7 @@
+ #include "passdb.h"
+ #include "../libcli/auth/libcli_auth.h"
+ #include "../libcli/security/security.h"
++#include "../lib/util/bitmap.h"
+ 
+ #undef DBGC_CLASS
+ #define DBGC_CLASS DBGC_PASSDB
+--- a/source3/smbd/conn.c
++++ b/source3/smbd/conn.c
+@@ -23,6 +23,7 @@
+ #include "smbd/smbd.h"
+ #include "smbd/globals.h"
+ #include "rpc_server/rpc_ncacn_np.h"
++#include "lib/util/bitmap.h"
+ 
+ /* The connections bitmap is expanded in increments of BITMAP_BLOCK_SZ. The
+  * maximum size of the bitmap is the largest positive integer, but you will hit
+--- a/source3/smbd/dir.c
++++ b/source3/smbd/dir.c
+@@ -23,6 +23,7 @@
+ #include "smbd/smbd.h"
+ #include "smbd/globals.h"
+ #include "libcli/security/security.h"
++#include "lib/util/bitmap.h"
+ 
+ /*
+    This module implements directory related functions for Samba.
+--- a/source3/smbd/files.c
++++ b/source3/smbd/files.c
+@@ -22,6 +22,7 @@
+ #include "smbd/globals.h"
+ #include "libcli/security/security.h"
+ #include "util_tdb.h"
++#include "lib/util/bitmap.h"
+ 
+ #define VALID_FNUM(fnum)   (((fnum) >= 0) && ((fnum) < real_max_open_files))
+ 
+--- a/source3/smbd/smb2_server.c
++++ b/source3/smbd/smb2_server.c
+@@ -26,6 +26,7 @@
+ #include "../lib/tsocket/tsocket.h"
+ #include "../lib/util/tevent_ntstatus.h"
+ #include "smbprofile.h"
++#include "../lib/util/bitmap.h"
+ 
+ #define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)
+ 
+--- a/source3/rpc_client/cli_pipe.c
++++ b/source3/rpc_client/cli_pipe.c
+@@ -28,6 +28,7 @@
+ #include "../libcli/auth/ntlmssp.h"
+ #include "ntlmssp_wrap.h"
+ #include "librpc/gen_ndr/ndr_dcerpc.h"
++#include "librpc/gen_ndr/ndr_netlogon_c.h"
+ #include "librpc/rpc/dcerpc.h"
+ #include "librpc/crypto/gse.h"
+ #include "librpc/crypto/spnego.h"
+@@ -399,6 +400,7 @@ static NTSTATUS cli_pipe_validate_curren
+ 						struct ncacn_packet *pkt,
+ 						DATA_BLOB *pdu,
+ 						uint8_t expected_pkt_type,
++						uint32_t call_id,
+ 						DATA_BLOB *rdata,
+ 						DATA_BLOB *reply_pdu)
+ {
+@@ -497,7 +499,7 @@ static NTSTATUS cli_pipe_validate_curren
+ 			  "from %s!\n",
+ 			  (unsigned int)pkt->ptype,
+ 			  rpccli_pipe_txt(talloc_tos(), cli)));
+-		return NT_STATUS_INVALID_INFO_CLASS;
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
+ 	}
+ 
+ 	if (pkt->ptype != expected_pkt_type) {
+@@ -505,7 +507,15 @@ static NTSTATUS cli_pipe_validate_curren
+ 			  "RPC packet type - %u, not %u\n",
+ 			  rpccli_pipe_txt(talloc_tos(), cli),
+ 			  pkt->ptype, expected_pkt_type));
+-		return NT_STATUS_INVALID_INFO_CLASS;
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++
++	if (pkt->call_id != call_id) {
++		DEBUG(3, (__location__ ": Connection to %s got an unexpected "
++			  "RPC call_id - %u, not %u\n",
++			  rpccli_pipe_txt(talloc_tos(), cli),
++			  pkt->call_id, call_id));
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
+ 	}
+ 
+ 	/* Do this just before return - we don't want to modify any rpc header
+@@ -898,6 +908,7 @@ static void rpc_api_pipe_got_pdu(struct
+ 						state->cli, state->pkt,
+ 						&state->incoming_frag,
+ 						state->expected_pkt_type,
++						state->call_id,
+ 						&rdata,
+ 						&state->reply_pdu);
+ 
+@@ -1269,12 +1280,17 @@ struct rpc_api_pipe_req_state {
+ 	uint32_t call_id;
+ 	DATA_BLOB *req_data;
+ 	uint32_t req_data_sent;
++	DATA_BLOB req_trailer;
++	uint32_t req_trailer_sent;
++	bool verify_bitmask1;
++	bool verify_pcontext;
+ 	DATA_BLOB rpc_out;
+ 	DATA_BLOB reply_pdu;
+ };
+ 
+ static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
+ static void rpc_api_pipe_req_done(struct tevent_req *subreq);
++static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state);
+ static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
+ 				  bool *is_last_frag);
+ 
+@@ -1310,6 +1326,11 @@ struct tevent_req *rpc_api_pipe_req_send
+ 		goto post_status;
+ 	}
+ 
++	status = prepare_verification_trailer(state);
++	if (!NT_STATUS_IS_OK(status)) {
++		goto post_status;
++	}
++
+ 	status = prepare_next_frag(state, &is_last_frag);
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		goto post_status;
+@@ -1344,25 +1365,161 @@ struct tevent_req *rpc_api_pipe_req_send
+ 	return NULL;
+ }
+ 
++static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state)
++{
++	struct pipe_auth_data *a = state->cli->auth;
++	struct dcerpc_sec_verification_trailer *t;
++	struct dcerpc_sec_vt *c = NULL;
++	struct ndr_push *ndr = NULL;
++	enum ndr_err_code ndr_err;
++	size_t align = 0;
++	size_t pad = 0;
++
++	if (a == NULL) {
++		return NT_STATUS_OK;
++	}
++
++	if (a->auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) {
++		return NT_STATUS_OK;
++	}
++
++	t = talloc_zero(state, struct dcerpc_sec_verification_trailer);
++	if (t == NULL) {
++		return NT_STATUS_NO_MEMORY;
++	}
++
++	if (!a->verified_bitmask1) {
++		t->commands = talloc_realloc(t, t->commands,
++					     struct dcerpc_sec_vt,
++					     t->count.count + 1);
++		if (t->commands == NULL) {
++			return NT_STATUS_NO_MEMORY;
++		}
++		c = &t->commands[t->count.count++];
++		ZERO_STRUCTP(c);
++
++		c->command = DCERPC_SEC_VT_COMMAND_BITMASK1;
++		state->verify_bitmask1 = true;
++	}
++
++	if (!state->cli->verified_pcontext) {
++		t->commands = talloc_realloc(t, t->commands,
++					     struct dcerpc_sec_vt,
++					     t->count.count + 1);
++		if (t->commands == NULL) {
++			return NT_STATUS_NO_MEMORY;
++		}
++		c = &t->commands[t->count.count++];
++		ZERO_STRUCTP(c);
++
++		c->command = DCERPC_SEC_VT_COMMAND_PCONTEXT;
++		c->u.pcontext.abstract_syntax = state->cli->abstract_syntax;
++		c->u.pcontext.transfer_syntax = state->cli->transfer_syntax;
++
++		state->verify_pcontext = true;
++	}
++
++	if (true) { /* We do not support header signing */
++		t->commands = talloc_realloc(t, t->commands,
++					     struct dcerpc_sec_vt,
++					     t->count.count + 1);
++		if (t->commands == NULL) {
++			return NT_STATUS_NO_MEMORY;
++		}
++		c = &t->commands[t->count.count++];
++		ZERO_STRUCTP(c);
++
++		c->command = DCERPC_SEC_VT_COMMAND_HEADER2;
++		c->u.header2.ptype = DCERPC_PKT_REQUEST;
++		c->u.header2.drep[0] = DCERPC_DREP_LE;
++		c->u.header2.drep[1] = 0;
++		c->u.header2.drep[2] = 0;
++		c->u.header2.drep[3] = 0;
++		c->u.header2.call_id = state->call_id;
++		c->u.header2.context_id = 0;
++		c->u.header2.opnum = state->op_num;
++	}
++
++	if (t->count.count == 0) {
++		TALLOC_FREE(t);
++		return NT_STATUS_OK;
++	}
++
++	c = &t->commands[t->count.count - 1];
++	c->command |= DCERPC_SEC_VT_COMMAND_END;
++
++	if (DEBUGLEVEL >= 10) {
++		NDR_PRINT_DEBUG(dcerpc_sec_verification_trailer, t);
++	}
++
++	ndr = ndr_push_init_ctx(state);
++	if (ndr == NULL) {
++		return NT_STATUS_NO_MEMORY;
++	}
++
++	ndr_err = ndr_push_dcerpc_sec_verification_trailer(ndr,
++						NDR_SCALARS | NDR_BUFFERS,
++						t);
++	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
++		return ndr_map_error2ntstatus(ndr_err);
++	}
++	state->req_trailer = ndr_push_blob(ndr);
++
++	align = state->req_data->length & 0x3;
++	if (align > 0) {
++		pad = 4 - align;
++	}
++	if (pad > 0) {
++		bool ok;
++		uint8_t *p;
++		const uint8_t zeros[4] = { 0, };
++
++		ok = data_blob_append(ndr, &state->req_trailer, zeros, pad);
++		if (!ok) {
++			return NT_STATUS_NO_MEMORY;
++		}
++
++		/* move the padding to the start */
++		p = state->req_trailer.data;
++		memmove(p + pad, p, state->req_trailer.length - pad);
++		memset(p, 0, pad);
++	}
++
++	return NT_STATUS_OK;
++}
++
+ static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
+ 				  bool *is_last_frag)
+ {
+-	size_t data_sent_thistime;
+ 	size_t auth_len;
+ 	size_t frag_len;
+ 	uint8_t flags = 0;
+ 	size_t pad_len;
+ 	size_t data_left;
++	size_t data_thistime;
++	size_t trailer_left;
++	size_t trailer_thistime = 0;
++	size_t total_left;
++	size_t total_thistime;
+ 	NTSTATUS status;
++	bool ok;
+ 	union dcerpc_payload u;
+ 
+ 	data_left = state->req_data->length - state->req_data_sent;
++	trailer_left = state->req_trailer.length - state->req_trailer_sent;
++	total_left = data_left + trailer_left;
++	if ((total_left < data_left) || (total_left < trailer_left)) {
++		/*
++		 * overflow
++		 */
++		return NT_STATUS_INVALID_PARAMETER_MIX;
++	}
+ 
+ 	status = dcerpc_guess_sizes(state->cli->auth,
+-				    DCERPC_REQUEST_LENGTH, data_left,
++				    DCERPC_REQUEST_LENGTH, total_left,
+ 				    state->cli->max_xmit_frag,
+ 				    CLIENT_NDR_PADDING_SIZE,
+-				    &data_sent_thistime,
++				    &total_thistime,
+ 				    &frag_len, &auth_len, &pad_len);
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		return status;
+@@ -1372,15 +1529,20 @@ static NTSTATUS prepare_next_frag(struct
+ 		flags = DCERPC_PFC_FLAG_FIRST;
+ 	}
+ 
+-	if (data_sent_thistime == data_left) {
++	if (total_thistime == total_left) {
+ 		flags |= DCERPC_PFC_FLAG_LAST;
+ 	}
+ 
++	data_thistime = MIN(total_thistime, data_left);
++	if (data_thistime < total_thistime) {
++		trailer_thistime = total_thistime - data_thistime;
++	}
++
+ 	data_blob_free(&state->rpc_out);
+ 
+ 	ZERO_STRUCT(u.request);
+ 
+-	u.request.alloc_hint	= state->req_data->length;
++	u.request.alloc_hint	= total_left;
+ 	u.request.context_id	= 0;
+ 	u.request.opnum		= state->op_num;
+ 
+@@ -1400,11 +1562,26 @@ static NTSTATUS prepare_next_frag(struct
+ 	 * at this stage */
+ 	dcerpc_set_frag_length(&state->rpc_out, frag_len);
+ 
+-	/* Copy in the data. */
+-	if (!data_blob_append(NULL, &state->rpc_out,
++	if (data_thistime > 0) {
++		/* Copy in the data. */
++		ok = data_blob_append(NULL, &state->rpc_out,
+ 				state->req_data->data + state->req_data_sent,
+-				data_sent_thistime)) {
+-		return NT_STATUS_NO_MEMORY;
++				data_thistime);
++		if (!ok) {
++			return NT_STATUS_NO_MEMORY;
++		}
++		state->req_data_sent += data_thistime;
++	}
++
++	if (trailer_thistime > 0) {
++		/* Copy in the verification trailer. */
++		ok = data_blob_append(NULL, &state->rpc_out,
++				state->req_trailer.data + state->req_trailer_sent,
++				trailer_thistime);
++		if (!ok) {
++			return NT_STATUS_NO_MEMORY;
++		}
++		state->req_trailer_sent += trailer_thistime;
+ 	}
+ 
+ 	switch (state->cli->auth->auth_level) {
+@@ -1424,7 +1601,6 @@ static NTSTATUS prepare_next_frag(struct
+ 		return NT_STATUS_INVALID_PARAMETER;
+ 	}
+ 
+-	state->req_data_sent += data_sent_thistime;
+ 	*is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
+ 
+ 	return status;
+@@ -1488,6 +1664,20 @@ static void rpc_api_pipe_req_done(struct
+ 		tevent_req_nterror(req, status);
+ 		return;
+ 	}
++
++	if (state->cli->auth == NULL) {
++		tevent_req_done(req);
++		return;
++	}
++
++	if (state->verify_bitmask1) {
++		state->cli->auth->verified_bitmask1 = true;
++	}
++
++	if (state->verify_pcontext) {
++		state->cli->verified_pcontext = true;
++	}
++
+ 	tevent_req_done(req);
+ }
+ 
+@@ -1647,9 +1837,15 @@ struct rpc_pipe_bind_state {
+ 	DATA_BLOB rpc_out;
+ 	bool auth3;
+ 	uint32_t rpc_call_id;
++	struct netr_Authenticator auth;
++	struct netr_Authenticator return_auth;
++	struct netlogon_creds_CredentialState *creds;
++	union netr_Capabilities capabilities;
++	struct netr_LogonGetCapabilities r;
+ };
+ 
+ static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
++static void rpc_pipe_bind_step_two_trigger(struct tevent_req *req);
+ static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
+ 				   struct rpc_pipe_bind_state *state,
+ 				   DATA_BLOB *credentials);
+@@ -1753,11 +1949,14 @@ static void rpc_pipe_bind_step_one_done(
+ 
+ 	case DCERPC_AUTH_TYPE_NONE:
+ 	case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
+-	case DCERPC_AUTH_TYPE_SCHANNEL:
+ 		/* Bind complete. */
+ 		tevent_req_done(req);
+ 		return;
+ 
++	case DCERPC_AUTH_TYPE_SCHANNEL:
++		rpc_pipe_bind_step_two_trigger(req);
++		return;
++
+ 	case DCERPC_AUTH_TYPE_NTLMSSP:
+ 	case DCERPC_AUTH_TYPE_SPNEGO:
+ 	case DCERPC_AUTH_TYPE_KRB5:
+@@ -1869,6 +2068,153 @@ err_out:
+ 	tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+ }
+ 
++static void rpc_pipe_bind_step_two_done(struct tevent_req *subreq);
++
++static void rpc_pipe_bind_step_two_trigger(struct tevent_req *req)
++{
++	struct rpc_pipe_bind_state *state =
++		tevent_req_data(req,
++				struct rpc_pipe_bind_state);
++	struct dcerpc_binding_handle *b = state->cli->binding_handle;
++	struct schannel_state *schannel_auth =
++		talloc_get_type_abort(state->cli->auth->auth_ctx,
++				      struct schannel_state);
++	struct tevent_req *subreq;
++
++	if (schannel_auth == NULL ||
++	    !ndr_syntax_id_equal(&state->cli->abstract_syntax,
++				 &ndr_table_netlogon.syntax_id)) {
++		tevent_req_done(req);
++		return;
++	}
++
++	ZERO_STRUCT(state->return_auth);
++
++	state->creds = netlogon_creds_copy(state, schannel_auth->creds);
++	if (state->creds == NULL) {
++		tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
++		return;
++	}
++
++	netlogon_creds_client_authenticator(state->creds, &state->auth);
++
++	state->r.in.server_name = state->cli->srv_name_slash;
++	state->r.in.computer_name = state->creds->computer_name;
++	state->r.in.credential = &state->auth;
++	state->r.in.query_level = 1;
++	state->r.in.return_authenticator = &state->return_auth;
++
++	state->r.out.capabilities = &state->capabilities;
++	state->r.out.return_authenticator = &state->return_auth;
++
++	subreq = dcerpc_netr_LogonGetCapabilities_r_send(talloc_tos(),
++							 state->ev,
++							 b,
++							 &state->r);
++	if (subreq == NULL) {
++		tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
++		return;
++	}
++
++	tevent_req_set_callback(subreq, rpc_pipe_bind_step_two_done, req);
++	return;
++}
++
++static void rpc_pipe_bind_step_two_done(struct tevent_req *subreq)
++{
++	struct tevent_req *req =
++		tevent_req_callback_data(subreq,
++					 struct tevent_req);
++	struct rpc_pipe_bind_state *state =
++		tevent_req_data(req,
++				struct rpc_pipe_bind_state);
++	struct schannel_state *schannel_auth =
++		talloc_get_type_abort(state->cli->auth->auth_ctx,
++				      struct schannel_state);
++	NTSTATUS status;
++
++	status = dcerpc_netr_LogonGetCapabilities_r_recv(subreq, talloc_tos());
++	TALLOC_FREE(subreq);
++	if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
++		if (state->cli->dc->negotiate_flags &
++		    NETLOGON_NEG_SUPPORTS_AES) {
++			DEBUG(5, ("AES is not supported and the error was %s\n",
++				  nt_errstr(status)));
++			tevent_req_nterror(req,
++					   NT_STATUS_INVALID_NETWORK_RESPONSE);
++			return;
++		}
++
++		/* This is probably NT */
++		DEBUG(5, ("We are checking against an NT - %s\n",
++			  nt_errstr(status)));
++		tevent_req_done(req);
++		return;
++	} else if (!NT_STATUS_IS_OK(status)) {
++		DEBUG(0, ("dcerpc_netr_LogonGetCapabilities_r_recv failed with %s\n",
++			  nt_errstr(status)));
++		tevent_req_nterror(req, status);
++		return;
++	}
++
++	if (NT_STATUS_EQUAL(state->r.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
++		if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
++			/* This means AES isn't supported. */
++			DEBUG(5, ("AES is not supported and the error was %s\n",
++				  nt_errstr(state->r.out.result)));
++			tevent_req_nterror(req,
++					   NT_STATUS_INVALID_NETWORK_RESPONSE);
++			return;
++		}
++
++		/* This is probably an old Samba version */
++		DEBUG(5, ("We are checking against an old Samba version - %s\n",
++			  nt_errstr(state->r.out.result)));
++		tevent_req_done(req);
++		return;
++	}
++
++	/* We need to check the credential state here, cause win2k3 and earlier
++	 * returns NT_STATUS_NOT_IMPLEMENTED */
++	if (!netlogon_creds_client_check(state->creds,
++					 &state->r.out.return_authenticator->cred)) {
++		/*
++		 * Server replied with bad credential. Fail.
++		 */
++		DEBUG(0,("rpc_pipe_bind_step_two_done: server %s "
++			 "replied with bad credential\n",
++			 state->cli->desthost));
++		tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
++		return;
++	}
++
++	TALLOC_FREE(schannel_auth->creds);
++	schannel_auth->creds = talloc_steal(state->cli, state->creds);
++
++	if (!NT_STATUS_IS_OK(state->r.out.result)) {
++		DEBUG(0, ("dcerpc_netr_LogonGetCapabilities_r_recv failed with %s\n",
++			  nt_errstr(state->r.out.result)));
++		tevent_req_nterror(req, state->r.out.result);
++		return;
++	}
++
++	if (state->creds->negotiate_flags !=
++	    state->r.out.capabilities->server_capabilities) {
++		DEBUG(0, ("The client capabilities don't match the server "
++			  "capabilities: local[0x%08X] remote[0x%08X]\n",
++			  state->creds->negotiate_flags,
++			  state->capabilities.server_capabilities));
++		tevent_req_nterror(req,
++				   NT_STATUS_INVALID_NETWORK_RESPONSE);
++		return;
++	}
++
++	/* TODO: Add downgrade dectection. */
++
++	tevent_req_done(req);
++	return;
++}
++
+ static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
+ 				   struct rpc_pipe_bind_state *state,
+ 				   DATA_BLOB *auth_token)
+--- a/source3/librpc/rpc/dcerpc.h
++++ b/source3/librpc/rpc/dcerpc.h
+@@ -39,6 +39,7 @@ struct NL_AUTH_MESSAGE;
+ struct pipe_auth_data {
+ 	enum dcerpc_AuthType auth_type;
+ 	enum dcerpc_AuthLevel auth_level;
++	bool verified_bitmask1;
+ 
+ 	void *auth_ctx;
+ 
+--- a/source3/rpc_client/rpc_client.h
++++ b/source3/rpc_client/rpc_client.h
+@@ -39,6 +39,7 @@ struct rpc_pipe_client {
+ 
+ 	struct ndr_syntax_id abstract_syntax;
+ 	struct ndr_syntax_id transfer_syntax;
++	bool verified_pcontext;
+ 
+ 	char *desthost;
+ 	char *srv_name_slash;
+--- /dev/null
++++ b/librpc/ndr/ndr_dcerpc.h
+@@ -0,0 +1,25 @@
++/*
++   Unix SMB/CIFS implementation.
++
++   Manually parsed structures found in the DCERPC protocol
++
++   Copyright (C) Stefan Metzmacher 2014
++   Copyright (C) Gregor Beck 2014
++
++   This program is free software; you can redistribute it and/or modify
++   it under the terms of the GNU General Public License as published by
++   the Free Software Foundation; either version 3 of the License, or
++   (at your option) any later version.
++
++   This program is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++   GNU General Public License for more details.
++
++   You should have received a copy of the GNU General Public License
++   along with this program.  If not, see <http://www.gnu.org/licenses/>.
++*/
++
++enum ndr_err_code ndr_pop_dcerpc_sec_verification_trailer(
++	struct ndr_pull *ndr, TALLOC_CTX *mem_ctx,
++	struct dcerpc_sec_verification_trailer **_r);
+--- /dev/null
++++ b/librpc/ABI/ndr-0.0.3.sigs
+@@ -0,0 +1,251 @@
++GUID_all_zero: bool (const struct GUID *)
++GUID_compare: int (const struct GUID *, const struct GUID *)
++GUID_equal: bool (const struct GUID *, const struct GUID *)
++GUID_from_data_blob: NTSTATUS (const DATA_BLOB *, struct GUID *)
++GUID_from_ndr_blob: NTSTATUS (const DATA_BLOB *, struct GUID *)
++GUID_from_string: NTSTATUS (const char *, struct GUID *)
++GUID_hexstring: char *(TALLOC_CTX *, const struct GUID *)
++GUID_random: struct GUID (void)
++GUID_string: char *(TALLOC_CTX *, const struct GUID *)
++GUID_string2: char *(TALLOC_CTX *, const struct GUID *)
++GUID_to_ndr_blob: NTSTATUS (const struct GUID *, TALLOC_CTX *, DATA_BLOB *)
++GUID_zero: struct GUID (void)
++ndr_align_size: size_t (uint32_t, size_t)
++ndr_charset_length: uint32_t (const void *, charset_t)
++ndr_check_array_length: enum ndr_err_code (struct ndr_pull *, void *, uint32_t)
++ndr_check_array_size: enum ndr_err_code (struct ndr_pull *, void *, uint32_t)
++ndr_check_padding: void (struct ndr_pull *, size_t)
++ndr_check_pipe_chunk_trailer: enum ndr_err_code (struct ndr_pull *, int, uint32_t)
++ndr_check_string_terminator: enum ndr_err_code (struct ndr_pull *, uint32_t, uint32_t)
++ndr_get_array_length: uint32_t (struct ndr_pull *, const void *)
++ndr_get_array_size: uint32_t (struct ndr_pull *, const void *)
++ndr_map_error2errno: int (enum ndr_err_code)
++ndr_map_error2ntstatus: NTSTATUS (enum ndr_err_code)
++ndr_map_error2string: const char *(enum ndr_err_code)
++ndr_policy_handle_empty: bool (const struct policy_handle *)
++ndr_policy_handle_equal: bool (const struct policy_handle *, const struct policy_handle *)
++ndr_print_DATA_BLOB: void (struct ndr_print *, const char *, DATA_BLOB)
++ndr_print_GUID: void (struct ndr_print *, const char *, const struct GUID *)
++ndr_print_KRB5_EDATA_NTSTATUS: void (struct ndr_print *, const char *, const struct KRB5_EDATA_NTSTATUS *)
++ndr_print_NTSTATUS: void (struct ndr_print *, const char *, NTSTATUS)
++ndr_print_NTTIME: void (struct ndr_print *, const char *, NTTIME)
++ndr_print_NTTIME_1sec: void (struct ndr_print *, const char *, NTTIME)
++ndr_print_NTTIME_hyper: void (struct ndr_print *, const char *, NTTIME)
++ndr_print_WERROR: void (struct ndr_print *, const char *, WERROR)
++ndr_print_array_uint8: void (struct ndr_print *, const char *, const uint8_t *, uint32_t)
++ndr_print_bad_level: void (struct ndr_print *, const char *, uint16_t)
++ndr_print_bitmap_flag: void (struct ndr_print *, size_t, const char *, uint32_t, uint32_t)
++ndr_print_bool: void (struct ndr_print *, const char *, const bool)
++ndr_print_debug: void (ndr_print_fn_t, const char *, void *)
++ndr_print_debug_helper: void (struct ndr_print *, const char *, ...)
++ndr_print_debugc: void (int, ndr_print_fn_t, const char *, void *)
++ndr_print_debugc_helper: void (struct ndr_print *, const char *, ...)
++ndr_print_dlong: void (struct ndr_print *, const char *, int64_t)
++ndr_print_double: void (struct ndr_print *, const char *, double)
++ndr_print_enum: void (struct ndr_print *, const char *, const char *, const char *, uint32_t)
++ndr_print_function_debug: void (ndr_print_function_t, const char *, int, void *)
++ndr_print_function_string: char *(TALLOC_CTX *, ndr_print_function_t, const char *, int, void *)
++ndr_print_get_switch_value: uint32_t (struct ndr_print *, const void *)
++ndr_print_gid_t: void (struct ndr_print *, const char *, gid_t)
++ndr_print_hyper: void (struct ndr_print *, const char *, uint64_t)
++ndr_print_int16: void (struct ndr_print *, const char *, int16_t)
++ndr_print_int32: void (struct ndr_print *, const char *, int32_t)
++ndr_print_int3264: void (struct ndr_print *, const char *, int32_t)
++ndr_print_int8: void (struct ndr_print *, const char *, int8_t)
++ndr_print_ipv4address: void (struct ndr_print *, const char *, const char *)
++ndr_print_ipv6address: void (struct ndr_print *, const char *, const char *)
++ndr_print_ndr_syntax_id: void (struct ndr_print *, const char *, const struct ndr_syntax_id *)
++ndr_print_netr_SamDatabaseID: void (struct ndr_print *, const char *, enum netr_SamDatabaseID)
++ndr_print_netr_SchannelType: void (struct ndr_print *, const char *, enum netr_SchannelType)
++ndr_print_null: void (struct ndr_print *)
++ndr_print_pointer: void (struct ndr_print *, const char *, void *)
++ndr_print_policy_handle: void (struct ndr_print *, const char *, const struct policy_handle *)
++ndr_print_printf_helper: void (struct ndr_print *, const char *, ...)
++ndr_print_ptr: void (struct ndr_print *, const char *, const void *)
++ndr_print_set_switch_value: enum ndr_err_code (struct ndr_print *, const void *, uint32_t)
++ndr_print_sockaddr_storage: void (struct ndr_print *, const char *, const struct sockaddr_storage *)
++ndr_print_string: void (struct ndr_print *, const char *, const char *)
++ndr_print_string_array: void (struct ndr_print *, const char *, const char **)
++ndr_print_string_helper: void (struct ndr_print *, const char *, ...)
++ndr_print_struct: void (struct ndr_print *, const char *, const char *)
++ndr_print_struct_string: char *(TALLOC_CTX *, ndr_print_fn_t, const char *, void *)
++ndr_print_svcctl_ServerType: void (struct ndr_print *, const char *, uint32_t)
++ndr_print_time_t: void (struct ndr_print *, const char *, time_t)
++ndr_print_timespec: void (struct ndr_print *, const char *, const struct timespec *)
++ndr_print_timeval: void (struct ndr_print *, const char *, const struct timeval *)
++ndr_print_udlong: void (struct ndr_print *, const char *, uint64_t)
++ndr_print_udlongr: void (struct ndr_print *, const char *, uint64_t)
++ndr_print_uid_t: void (struct ndr_print *, const char *, uid_t)
++ndr_print_uint16: void (struct ndr_print *, const char *, uint16_t)
++ndr_print_uint32: void (struct ndr_print *, const char *, uint32_t)
++ndr_print_uint3264: void (struct ndr_print *, const char *, uint32_t)
++ndr_print_uint8: void (struct ndr_print *, const char *, uint8_t)
++ndr_print_union: void (struct ndr_print *, const char *, int, const char *)
++ndr_print_union_debug: void (ndr_print_fn_t, const char *, uint32_t, void *)
++ndr_print_union_string: char *(TALLOC_CTX *, ndr_print_fn_t, const char *, uint32_t, void *)
++ndr_print_winreg_Data: void (struct ndr_print *, const char *, const union winreg_Data *)
++ndr_print_winreg_Type: void (struct ndr_print *, const char *, enum winreg_Type)
++ndr_pull_DATA_BLOB: enum ndr_err_code (struct ndr_pull *, int, DATA_BLOB *)
++ndr_pull_GUID: enum ndr_err_code (struct ndr_pull *, int, struct GUID *)
++ndr_pull_KRB5_EDATA_NTSTATUS: enum ndr_err_code (struct ndr_pull *, int, struct KRB5_EDATA_NTSTATUS *)
++ndr_pull_NTSTATUS: enum ndr_err_code (struct ndr_pull *, int, NTSTATUS *)
++ndr_pull_NTTIME: enum ndr_err_code (struct ndr_pull *, int, NTTIME *)
++ndr_pull_NTTIME_1sec: enum ndr_err_code (struct ndr_pull *, int, NTTIME *)
++ndr_pull_NTTIME_hyper: enum ndr_err_code (struct ndr_pull *, int, NTTIME *)
++ndr_pull_WERROR: enum ndr_err_code (struct ndr_pull *, int, WERROR *)
++ndr_pull_advance: enum ndr_err_code (struct ndr_pull *, uint32_t)
++ndr_pull_align: enum ndr_err_code (struct ndr_pull *, size_t)
++ndr_pull_append: enum ndr_err_code (struct ndr_pull *, DATA_BLOB *)
++ndr_pull_array_length: enum ndr_err_code (struct ndr_pull *, const void *)
++ndr_pull_array_size: enum ndr_err_code (struct ndr_pull *, const void *)
++ndr_pull_array_uint8: enum ndr_err_code (struct ndr_pull *, int, uint8_t *, uint32_t)
++ndr_pull_bytes: enum ndr_err_code (struct ndr_pull *, uint8_t *, uint32_t)
++ndr_pull_charset: enum ndr_err_code (struct ndr_pull *, int, const char **, uint32_t, uint8_t, charset_t)
++ndr_pull_charset_to_null: enum ndr_err_code (struct ndr_pull *, int, const char **, uint32_t, uint8_t, charset_t)
++ndr_pull_dlong: enum ndr_err_code (struct ndr_pull *, int, int64_t *)
++ndr_pull_double: enum ndr_err_code (struct ndr_pull *, int, double *)
++ndr_pull_enum_uint16: enum ndr_err_code (struct ndr_pull *, int, uint16_t *)
++ndr_pull_enum_uint1632: enum ndr_err_code (struct ndr_pull *, int, uint16_t *)
++ndr_pull_enum_uint32: enum ndr_err_code (struct ndr_pull *, int, uint32_t *)
++ndr_pull_enum_uint8: enum ndr_err_code (struct ndr_pull *, int, uint8_t *)
++ndr_pull_error: enum ndr_err_code (struct ndr_pull *, enum ndr_err_code, const char *, ...)
++ndr_pull_generic_ptr: enum ndr_err_code (struct ndr_pull *, uint32_t *)
++ndr_pull_get_relative_base_offset: uint32_t (struct ndr_pull *)
++ndr_pull_get_switch_value: uint32_t (struct ndr_pull *, const void *)
++ndr_pull_gid_t: enum ndr_err_code (struct ndr_pull *, int, gid_t *)
++ndr_pull_hyper: enum ndr_err_code (struct ndr_pull *, int, uint64_t *)
++ndr_pull_init_blob: struct ndr_pull *(const DATA_BLOB *, TALLOC_CTX *)
++ndr_pull_int16: enum ndr_err_code (struct ndr_pull *, int, int16_t *)
++ndr_pull_int32: enum ndr_err_code (struct ndr_pull *, int, int32_t *)
++ndr_pull_int8: enum ndr_err_code (struct ndr_pull *, int, int8_t *)
++ndr_pull_ipv4address: enum ndr_err_code (struct ndr_pull *, int, const char **)
++ndr_pull_ipv6address: enum ndr_err_code (struct ndr_pull *, int, const char **)
++ndr_pull_ndr_syntax_id: enum ndr_err_code (struct ndr_pull *, int, struct ndr_syntax_id *)
++ndr_pull_netr_SamDatabaseID: enum ndr_err_code (struct ndr_pull *, int, enum netr_SamDatabaseID *)
++ndr_pull_netr_SchannelType: enum ndr_err_code (struct ndr_pull *, int, enum netr_SchannelType *)
++ndr_pull_pointer: enum ndr_err_code (struct ndr_pull *, int, void **)
++ndr_pull_policy_handle: enum ndr_err_code (struct ndr_pull *, int, struct policy_handle *)
++ndr_pull_pop: enum ndr_err_code (struct ndr_pull *)
++ndr_pull_ref_ptr: enum ndr_err_code (struct ndr_pull *, uint32_t *)
++ndr_pull_relative_ptr1: enum ndr_err_code (struct ndr_pull *, const void *, uint32_t)
++ndr_pull_relative_ptr2: enum ndr_err_code (struct ndr_pull *, const void *)
++ndr_pull_relative_ptr_short: enum ndr_err_code (struct ndr_pull *, uint16_t *)
++ndr_pull_restore_relative_base_offset: void (struct ndr_pull *, uint32_t)
++ndr_pull_set_switch_value: enum ndr_err_code (struct ndr_pull *, const void *, uint32_t)
++ndr_pull_setup_relative_base_offset1: enum ndr_err_code (struct ndr_pull *, const void *, uint32_t)
++ndr_pull_setup_relative_base_offset2: enum ndr_err_code (struct ndr_pull *, const void *)
++ndr_pull_string: enum ndr_err_code (struct ndr_pull *, int, const char **)
++ndr_pull_string_array: enum ndr_err_code (struct ndr_pull *, int, const char ***)
++ndr_pull_struct_blob: enum ndr_err_code (const DATA_BLOB *, TALLOC_CTX *, void *, ndr_pull_flags_fn_t)
++ndr_pull_struct_blob_all: enum ndr_err_code (const DATA_BLOB *, TALLOC_CTX *, void *, ndr_pull_flags_fn_t)
++ndr_pull_subcontext_end: enum ndr_err_code (struct ndr_pull *, struct ndr_pull *, size_t, ssize_t)
++ndr_pull_subcontext_start: enum ndr_err_code (struct ndr_pull *, struct ndr_pull **, size_t, ssize_t)
++ndr_pull_svcctl_ServerType: enum ndr_err_code (struct ndr_pull *, int, uint32_t *)
++ndr_pull_time_t: enum ndr_err_code (struct ndr_pull *, int, time_t *)
++ndr_pull_timespec: enum ndr_err_code (struct ndr_pull *, int, struct timespec *)
++ndr_pull_timeval: enum ndr_err_code (struct ndr_pull *, int, struct timeval *)
++ndr_pull_trailer_align: enum ndr_err_code (struct ndr_pull *, size_t)
++ndr_pull_udlong: enum ndr_err_code (struct ndr_pull *, int, uint64_t *)
++ndr_pull_udlongr: enum ndr_err_code (struct ndr_pull *, int, uint64_t *)
++ndr_pull_uid_t: enum ndr_err_code (struct ndr_pull *, int, uid_t *)
++ndr_pull_uint16: enum ndr_err_code (struct ndr_pull *, int, uint16_t *)
++ndr_pull_uint1632: enum ndr_err_code (struct ndr_pull *, int, uint16_t *)
++ndr_pull_uint32: enum ndr_err_code (struct ndr_pull *, int, uint32_t *)
++ndr_pull_uint3264: enum ndr_err_code (struct ndr_pull *, int, uint32_t *)
++ndr_pull_uint8: enum ndr_err_code (struct ndr_pull *, int, uint8_t *)
++ndr_pull_union_align: enum ndr_err_code (struct ndr_pull *, size_t)
++ndr_pull_union_blob: enum ndr_err_code (const DATA_BLOB *, TALLOC_CTX *, void *, uint32_t, ndr_pull_flags_fn_t)
++ndr_pull_union_blob_all: enum ndr_err_code (const DATA_BLOB *, TALLOC_CTX *, void *, uint32_t, ndr_pull_flags_fn_t)
++ndr_pull_winreg_Data: enum ndr_err_code (struct ndr_pull *, int, union winreg_Data *)
++ndr_pull_winreg_Type: enum ndr_err_code (struct ndr_pull *, int, enum winreg_Type *)
++ndr_push_DATA_BLOB: enum ndr_err_code (struct ndr_push *, int, DATA_BLOB)
++ndr_push_GUID: enum ndr_err_code (struct ndr_push *, int, const struct GUID *)
++ndr_push_KRB5_EDATA_NTSTATUS: enum ndr_err_code (struct ndr_push *, int, const struct KRB5_EDATA_NTSTATUS *)
++ndr_push_NTSTATUS: enum ndr_err_code (struct ndr_push *, int, NTSTATUS)
++ndr_push_NTTIME: enum ndr_err_code (struct ndr_push *, int, NTTIME)
++ndr_push_NTTIME_1sec: enum ndr_err_code (struct ndr_push *, int, NTTIME)
++ndr_push_NTTIME_hyper: enum ndr_err_code (struct ndr_push *, int, NTTIME)
++ndr_push_WERROR: enum ndr_err_code (struct ndr_push *, int, WERROR)
++ndr_push_align: enum ndr_err_code (struct ndr_push *, size_t)
++ndr_push_array_uint8: enum ndr_err_code (struct ndr_push *, int, const uint8_t *, uint32_t)
++ndr_push_blob: DATA_BLOB (struct ndr_push *)
++ndr_push_bytes: enum ndr_err_code (struct ndr_push *, const uint8_t *, uint32_t)
++ndr_push_charset: enum ndr_err_code (struct ndr_push *, int, const char *, uint32_t, uint8_t, charset_t)
++ndr_push_dlong: enum ndr_err_code (struct ndr_push *, int, int64_t)
++ndr_push_double: enum ndr_err_code (struct ndr_push *, int, double)
++ndr_push_enum_uint16: enum ndr_err_code (struct ndr_push *, int, uint16_t)
++ndr_push_enum_uint1632: enum ndr_err_code (struct ndr_push *, int, uint16_t)
++ndr_push_enum_uint32: enum ndr_err_code (struct ndr_push *, int, uint32_t)
++ndr_push_enum_uint8: enum ndr_err_code (struct ndr_push *, int, uint8_t)
++ndr_push_error: enum ndr_err_code (struct ndr_push *, enum ndr_err_code, const char *, ...)
++ndr_push_expand: enum ndr_err_code (struct ndr_push *, uint32_t)
++ndr_push_full_ptr: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_get_relative_base_offset: uint32_t (struct ndr_push *)
++ndr_push_get_switch_value: uint32_t (struct ndr_push *, const void *)
++ndr_push_gid_t: enum ndr_err_code (struct ndr_push *, int, gid_t)
++ndr_push_hyper: enum ndr_err_code (struct ndr_push *, int, uint64_t)
++ndr_push_init_ctx: struct ndr_push *(TALLOC_CTX *)
++ndr_push_int16: enum ndr_err_code (struct ndr_push *, int, int16_t)
++ndr_push_int32: enum ndr_err_code (struct ndr_push *, int, int32_t)
++ndr_push_int8: enum ndr_err_code (struct ndr_push *, int, int8_t)
++ndr_push_ipv4address: enum ndr_err_code (struct ndr_push *, int, const char *)
++ndr_push_ipv6address: enum ndr_err_code (struct ndr_push *, int, const char *)
++ndr_push_ndr_syntax_id: enum ndr_err_code (struct ndr_push *, int, const struct ndr_syntax_id *)
++ndr_push_netr_SamDatabaseID: enum ndr_err_code (struct ndr_push *, int, enum netr_SamDatabaseID)
++ndr_push_netr_SchannelType: enum ndr_err_code (struct ndr_push *, int, enum netr_SchannelType)
++ndr_push_pipe_chunk_trailer: enum ndr_err_code (struct ndr_push *, int, uint32_t)
++ndr_push_pointer: enum ndr_err_code (struct ndr_push *, int, void *)
++ndr_push_policy_handle: enum ndr_err_code (struct ndr_push *, int, const struct policy_handle *)
++ndr_push_ref_ptr: enum ndr_err_code (struct ndr_push *)
++ndr_push_relative_ptr1: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_relative_ptr2_end: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_relative_ptr2_start: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_restore_relative_base_offset: void (struct ndr_push *, uint32_t)
++ndr_push_set_switch_value: enum ndr_err_code (struct ndr_push *, const void *, uint32_t)
++ndr_push_setup_relative_base_offset1: enum ndr_err_code (struct ndr_push *, const void *, uint32_t)
++ndr_push_setup_relative_base_offset2: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_short_relative_ptr1: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_short_relative_ptr2: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_string: enum ndr_err_code (struct ndr_push *, int, const char *)
++ndr_push_string_array: enum ndr_err_code (struct ndr_push *, int, const char **)
++ndr_push_struct_blob: enum ndr_err_code (DATA_BLOB *, TALLOC_CTX *, const void *, ndr_push_flags_fn_t)
++ndr_push_subcontext_end: enum ndr_err_code (struct ndr_push *, struct ndr_push *, size_t, ssize_t)
++ndr_push_subcontext_start: enum ndr_err_code (struct ndr_push *, struct ndr_push **, size_t, ssize_t)
++ndr_push_svcctl_ServerType: enum ndr_err_code (struct ndr_push *, int, uint32_t)
++ndr_push_time_t: enum ndr_err_code (struct ndr_push *, int, time_t)
++ndr_push_timespec: enum ndr_err_code (struct ndr_push *, int, const struct timespec *)
++ndr_push_timeval: enum ndr_err_code (struct ndr_push *, int, const struct timeval *)
++ndr_push_trailer_align: enum ndr_err_code (struct ndr_push *, size_t)
++ndr_push_udlong: enum ndr_err_code (struct ndr_push *, int, uint64_t)
++ndr_push_udlongr: enum ndr_err_code (struct ndr_push *, int, uint64_t)
++ndr_push_uid_t: enum ndr_err_code (struct ndr_push *, int, uid_t)
++ndr_push_uint16: enum ndr_err_code (struct ndr_push *, int, uint16_t)
++ndr_push_uint1632: enum ndr_err_code (struct ndr_push *, int, uint16_t)
++ndr_push_uint32: enum ndr_err_code (struct ndr_push *, int, uint32_t)
++ndr_push_uint3264: enum ndr_err_code (struct ndr_push *, int, uint32_t)
++ndr_push_uint8: enum ndr_err_code (struct ndr_push *, int, uint8_t)
++ndr_push_union_align: enum ndr_err_code (struct ndr_push *, size_t)
++ndr_push_union_blob: enum ndr_err_code (DATA_BLOB *, TALLOC_CTX *, void *, uint32_t, ndr_push_flags_fn_t)
++ndr_push_unique_ptr: enum ndr_err_code (struct ndr_push *, const void *)
++ndr_push_winreg_Data: enum ndr_err_code (struct ndr_push *, int, const union winreg_Data *)
++ndr_push_winreg_Type: enum ndr_err_code (struct ndr_push *, int, enum winreg_Type)
++ndr_push_zero: enum ndr_err_code (struct ndr_push *, uint32_t)
++ndr_set_flags: void (uint32_t *, uint32_t)
++ndr_size_DATA_BLOB: uint32_t (int, const DATA_BLOB *, int)
++ndr_size_GUID: size_t (const struct GUID *, int)
++ndr_size_string: uint32_t (int, const char * const *, int)
++ndr_size_string_array: size_t (const char **, uint32_t, int)
++ndr_size_struct: size_t (const void *, int, ndr_push_flags_fn_t)
++ndr_size_union: size_t (const void *, int, uint32_t, ndr_push_flags_fn_t)
++ndr_string_array_size: size_t (struct ndr_push *, const char *)
++ndr_string_length: uint32_t (const void *, uint32_t)
++ndr_syntax_id_equal: bool (const struct ndr_syntax_id *, const struct ndr_syntax_id *)
++ndr_syntax_id_from_string: bool (const char *, struct ndr_syntax_id *)
++ndr_syntax_id_null: uuid = {time_low = 0, time_mid = 0, time_hi_and_version = 0, clock_seq = "\000", node = "\000\000\000\000\000"}, if_version = 0
++ndr_syntax_id_to_string: char *(TALLOC_CTX *, const struct ndr_syntax_id *)
++ndr_token_peek: uint32_t (struct ndr_token_list **, const void *)
++ndr_token_retrieve: enum ndr_err_code (struct ndr_token_list **, const void *, uint32_t *)
++ndr_token_retrieve_cmp_fn: enum ndr_err_code (struct ndr_token_list **, const void *, uint32_t *, comparison_fn_t, bool)
++ndr_token_store: enum ndr_err_code (TALLOC_CTX *, struct ndr_token_list **, const void *, uint32_t)
++ndr_transfer_syntax_ndr: uuid = {time_low = 2324192516, time_mid = 7403, time_hi_and_version = 4553, clock_seq = "\237\350", node = "\b\000+\020H`"}, if_version = 2
++ndr_transfer_syntax_ndr64: uuid = {time_low = 1903232307, time_mid = 48826, time_hi_and_version = 18743, clock_seq = "\203\031", node = "\265\333\357\234\314\066"}, if_version = 1
+--- a/librpc/ndr/ndr_misc.c
++++ b/librpc/ndr/ndr_misc.c
+@@ -35,3 +35,50 @@ bool ndr_syntax_id_equal(const struct nd
+ 	return GUID_equal(&i1->uuid, &i2->uuid)
+ 		&& (i1->if_version == i2->if_version);
+ }
++
++_PUBLIC_ char *ndr_syntax_id_to_string(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *id)
++{
++	return talloc_asprintf(mem_ctx,
++			       "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x/0x%08x",
++			       id->uuid.time_low, id->uuid.time_mid,
++			       id->uuid.time_hi_and_version,
++			       id->uuid.clock_seq[0],
++			       id->uuid.clock_seq[1],
++			       id->uuid.node[0], id->uuid.node[1],
++			       id->uuid.node[2], id->uuid.node[3],
++			       id->uuid.node[4], id->uuid.node[5],
++			       (unsigned)id->if_version);
++}
++
++_PUBLIC_ bool ndr_syntax_id_from_string(const char *s, struct ndr_syntax_id *id)
++{
++	int ret;
++	size_t i;
++	uint32_t time_low;
++	uint32_t time_mid, time_hi_and_version;
++	uint32_t clock_seq[2];
++	uint32_t node[6];
++	uint32_t if_version;
++
++	ret = sscanf(s,
++		     "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x/0x%08x",
++		     &time_low, &time_mid, &time_hi_and_version,
++		     &clock_seq[0], &clock_seq[1],
++		     &node[0], &node[1], &node[2], &node[3], &node[4], &node[5],
++		     &if_version);
++	if (ret != 12) {
++		return false;
++	}
++
++	id->uuid.time_low = time_low;
++	id->uuid.time_mid = time_mid;
++	id->uuid.time_hi_and_version = time_hi_and_version;
++	id->uuid.clock_seq[0] = clock_seq[0];
++	id->uuid.clock_seq[1] = clock_seq[1];
++	for (i=0; i<6; i++) {
++		id->uuid.node[i] = node[i];
++	}
++	id->if_version = if_version;
++
++	return true;
++}
+--- a/librpc/rpc/dcerpc_util.c
++++ b/librpc/rpc/dcerpc_util.c
+@@ -27,6 +27,7 @@
+ #include "librpc/rpc/dcerpc.h"
+ #include "librpc/gen_ndr/ndr_dcerpc.h"
+ #include "rpc_common.h"
++#include "lib/util/bitmap.h"
+ 
+ /* we need to be able to get/set the fragment length without doing a full
+    decode */
+@@ -341,3 +342,194 @@ NTSTATUS dcerpc_read_ncacn_packet_recv(s
+ 	tevent_req_received(req);
+ 	return NT_STATUS_OK;
+ }
++
++struct dcerpc_sec_vt_header2 dcerpc_sec_vt_header2_from_ncacn_packet(const struct ncacn_packet *pkt)
++{
++	struct dcerpc_sec_vt_header2 ret;
++
++	ZERO_STRUCT(ret);
++	ret.ptype = pkt->ptype;
++	memcpy(&ret.drep, pkt->drep, sizeof(ret.drep));
++	ret.call_id = pkt->call_id;
++
++	switch (pkt->ptype) {
++	case DCERPC_PKT_REQUEST:
++		ret.context_id = pkt->u.request.context_id;
++		ret.opnum      = pkt->u.request.opnum;
++		break;
++
++	case DCERPC_PKT_RESPONSE:
++		ret.context_id = pkt->u.response.context_id;
++		break;
++
++	case DCERPC_PKT_FAULT:
++		ret.context_id = pkt->u.fault.context_id;
++		break;
++
++	default:
++		break;
++	}
++
++	return ret;
++}
++
++bool dcerpc_sec_vt_header2_equal(const struct dcerpc_sec_vt_header2 *v1,
++				 const struct dcerpc_sec_vt_header2 *v2)
++{
++	if (v1->ptype != v2->ptype) {
++		return false;
++	}
++
++	if (memcmp(v1->drep, v2->drep, sizeof(v1->drep)) != 0) {
++		return false;
++	}
++
++	if (v1->call_id != v2->call_id) {
++		return false;
++	}
++
++	if (v1->context_id != v2->context_id) {
++		return false;
++	}
++
++	if (v1->opnum != v2->opnum) {
++		return false;
++	}
++
++	return true;
++}
++
++static bool dcerpc_sec_vt_is_valid(const struct dcerpc_sec_verification_trailer *r)
++{
++	bool ret = false;
++	TALLOC_CTX *frame = talloc_stackframe();
++	struct bitmap *commands_seen;
++	int i;
++
++	if (r->count.count == 0) {
++		ret = true;
++		goto done;
++	}
++
++	if (memcmp(r->magic, DCERPC_SEC_VT_MAGIC, sizeof(r->magic)) != 0) {
++		goto done;
++	}
++
++	commands_seen = bitmap_talloc(frame, DCERPC_SEC_VT_COMMAND_ENUM + 1);
++	if (commands_seen == NULL) {
++		goto done;
++	}
++
++	for (i=0; i < r->count.count; i++) {
++		enum dcerpc_sec_vt_command_enum cmd =
++			r->commands[i].command & DCERPC_SEC_VT_COMMAND_ENUM;
++
++		if (bitmap_query(commands_seen, cmd)) {
++			/* Each command must appear at most once. */
++			goto done;
++		}
++		bitmap_set(commands_seen, cmd);
++
++		switch (cmd) {
++		case DCERPC_SEC_VT_COMMAND_BITMASK1:
++		case DCERPC_SEC_VT_COMMAND_PCONTEXT:
++		case DCERPC_SEC_VT_COMMAND_HEADER2:
++			break;
++		default:
++			if ((r->commands[i].u._unknown.length % 4) != 0) {
++				goto done;
++			}
++			break;
++		}
++	}
++	ret = true;
++done:
++	TALLOC_FREE(frame);
++	return ret;
++}
++
++#define CHECK(msg, ok)						\
++do {								\
++	if (!ok) {						\
++		DEBUG(10, ("SEC_VT check %s failed\n", msg));	\
++		return false;					\
++	}							\
++} while(0)
++
++#define CHECK_SYNTAX(msg, s1, s2)					\
++do {								\
++	if (!ndr_syntax_id_equal(&s1, &s2)) {				\
++		TALLOC_CTX *frame = talloc_stackframe();		\
++		DEBUG(10, ("SEC_VT check %s failed: %s vs. %s\n", msg,	\
++			   ndr_syntax_id_to_string(frame, &s1),		\
++			   ndr_syntax_id_to_string(frame, &s1)));	\
++		TALLOC_FREE(frame);					\
++		return false;						\
++	}								\
++} while(0)
++
++
++bool dcerpc_sec_verification_trailer_check(
++		const struct dcerpc_sec_verification_trailer *vt,
++		const uint32_t *bitmask1,
++		const struct dcerpc_sec_vt_pcontext *pcontext,
++		const struct dcerpc_sec_vt_header2 *header2)
++{
++	size_t i;
++
++	if (!dcerpc_sec_vt_is_valid(vt)) {
++		return false;
++	}
++
++	for (i=0; i < vt->count.count; i++) {
++		struct dcerpc_sec_vt *c = &vt->commands[i];
++
++		switch (c->command & DCERPC_SEC_VT_COMMAND_ENUM) {
++		case DCERPC_SEC_VT_COMMAND_BITMASK1:
++			if (bitmask1 == NULL) {
++				CHECK("Bitmask1 must_process_command",
++				      !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
++				break;
++			}
++
++			if (c->u.bitmask1 & DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING) {
++				CHECK("Bitmask1 client_header_signing",
++				      *bitmask1 & DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING);
++			}
++			break;
++
++		case DCERPC_SEC_VT_COMMAND_PCONTEXT:
++			if (pcontext == NULL) {
++				CHECK("Pcontext must_process_command",
++				      !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
++				break;
++			}
++
++			CHECK_SYNTAX("Pcontect abstract_syntax",
++				     pcontext->abstract_syntax,
++				     c->u.pcontext.abstract_syntax);
++			CHECK_SYNTAX("Pcontext transfer_syntax",
++				     pcontext->transfer_syntax,
++				     c->u.pcontext.transfer_syntax);
++			break;
++
++		case DCERPC_SEC_VT_COMMAND_HEADER2: {
++			if (header2 == NULL) {
++				CHECK("Header2 must_process_command",
++				      !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
++				break;
++			}
++
++			CHECK("Header2", dcerpc_sec_vt_header2_equal(header2, &c->u.header2));
++			break;
++		}
++
++		default:
++			CHECK("Unknown must_process_command",
++			      !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
++			break;
++		}
++	}
++
++	return true;
++}
+--- a/librpc/rpc/rpc_common.h
++++ b/librpc/rpc/rpc_common.h
+@@ -296,4 +296,45 @@ NTSTATUS dcerpc_binding_handle_call(stru
+ 				    TALLOC_CTX *r_mem,
+ 				    void *r_ptr);
+ 
++/**
++ * Extract header information from a ncacn_packet
++ * as a dcerpc_sec_vt_header2 as used by the security verification trailer.
++ *
++ * @param[in] pkt a packet
++ *
++ * @return a dcerpc_sec_vt_header2
++ */
++struct dcerpc_sec_vt_header2 dcerpc_sec_vt_header2_from_ncacn_packet(const struct ncacn_packet *pkt);
++
++
++/**
++ * Test if two dcerpc_sec_vt_header2 structures are equal
++ * without consideration of reserved fields.
++ *
++ * @param v1 a pointer to a dcerpc_sec_vt_header2 structure
++ * @param v2 a pointer to a dcerpc_sec_vt_header2 structure
++ *
++ * @retval true if *v1 equals *v2
++ */
++bool dcerpc_sec_vt_header2_equal(const struct dcerpc_sec_vt_header2 *v1,
++				 const struct dcerpc_sec_vt_header2 *v2);
++
++/**
++ * Check for consistency of the security verification trailer with the PDU header.
++ * See <a href="http://msdn.microsoft.com/en-us/library/cc243559.aspx">MS-RPCE 2.2.2.13</a>.
++ * A check with an empty trailer succeeds.
++ *
++ * @param[in] vt a pointer to the security verification trailer.
++ * @param[in] bitmask1 which flags were negotiated on the connection.
++ * @param[in] pcontext the syntaxes negotiatied for the presentation context.
++ * @param[in] header2 some fields from the PDU header.
++ *
++ * @retval true on success.
++ */
++bool dcerpc_sec_verification_trailer_check(
++		const struct dcerpc_sec_verification_trailer *vt,
++		const uint32_t *bitmask1,
++		const struct dcerpc_sec_vt_pcontext *pcontext,
++		const struct dcerpc_sec_vt_header2 *header2);
++
+ #endif /* __DEFAULT_LIBRPC_RPCCOMMON_H__ */
+--- a/source4/torture/ndr/ndr.c
++++ b/source4/torture/ndr/ndr.c
+@@ -29,40 +29,65 @@ struct ndr_pull_test_data {
+ 	DATA_BLOB data_context;
+ 	size_t struct_size;
+ 	ndr_pull_flags_fn_t pull_fn;
++	ndr_push_flags_fn_t push_fn;
+ 	int ndr_flags;
++	int flags;
+ };
+ 
+-static bool wrap_ndr_pull_test(struct torture_context *tctx,
+-			       struct torture_tcase *tcase,
+-			       struct torture_test *test)
++static bool wrap_ndr_pullpush_test(struct torture_context *tctx,
++				   struct torture_tcase *tcase,
++				   struct torture_test *test)
+ {
+ 	bool (*check_fn) (struct torture_context *ctx, void *data) = test->fn;
+ 	const struct ndr_pull_test_data *data = (const struct ndr_pull_test_data *)test->data;
+-	void *ds = talloc_zero_size(tctx, data->struct_size);
+ 	struct ndr_pull *ndr = ndr_pull_init_blob(&(data->data), tctx);
++	void *ds = talloc_zero_size(ndr, data->struct_size);
++	bool ret;
++	uint32_t highest_ofs;
++
++	ndr->flags |= data->flags;
+ 
+ 	ndr->flags |= LIBNDR_FLAG_REF_ALLOC;
+ 
+ 	torture_assert_ndr_success(tctx, data->pull_fn(ndr, data->ndr_flags, ds),
+ 				   "pulling");
+ 
+-	torture_assert(tctx, ndr->offset == ndr->data_size,
++	if (ndr->offset > ndr->relative_highest_offset) {
++		highest_ofs = ndr->offset;
++	} else {
++		highest_ofs = ndr->relative_highest_offset;
++	}
++
++	torture_assert(tctx, highest_ofs == ndr->data_size,
+ 				   talloc_asprintf(tctx,
+-					   "%d unread bytes", ndr->data_size - ndr->offset));
++					   "%d unread bytes", ndr->data_size - highest_ofs));
+ 
+-	if (check_fn != NULL)
+-		return check_fn(tctx, ds);
+-	else
+-		return true;
++	if (check_fn != NULL) {
++		ret = check_fn(tctx, ds);
++	} else {
++		ret = true;
++	}
++
++	if (data->push_fn != NULL) {
++		DATA_BLOB outblob;
++		torture_assert_ndr_success(tctx, ndr_push_struct_blob(&outblob, ndr, ds, data->push_fn), "pushing");
++		torture_assert_data_blob_equal(tctx, outblob, data->data, "ndr push compare");
++	}
++
++	talloc_free(ndr);
++	return ret;
+ }
+ 
+-_PUBLIC_ struct torture_test *_torture_suite_add_ndr_pull_test(
+-					struct torture_suite *suite,
+-					const char *name, ndr_pull_flags_fn_t pull_fn,
+-					DATA_BLOB db,
+-					size_t struct_size,
+-					int ndr_flags,
+-					bool (*check_fn) (struct torture_context *ctx, void *data))
++_PUBLIC_ struct torture_test *_torture_suite_add_ndr_pullpush_test(
++	struct torture_suite *suite,
++	const char *name,
++	ndr_pull_flags_fn_t pull_fn,
++	ndr_push_flags_fn_t push_fn,
++	DATA_BLOB db,
++	size_t struct_size,
++	int ndr_flags,
++	int flags,
++	bool (*check_fn) (struct torture_context *ctx, void *data))
+ {
+ 	struct torture_test *test;
+ 	struct torture_tcase *tcase;
+@@ -74,12 +99,16 @@ _PUBLIC_ struct torture_test *_torture_s
+ 
+ 	test->name = talloc_strdup(test, name);
+ 	test->description = NULL;
+-	test->run = wrap_ndr_pull_test;
++	test->run = wrap_ndr_pullpush_test;
++
+ 	data = talloc(test, struct ndr_pull_test_data);
+ 	data->data = db;
+ 	data->ndr_flags = ndr_flags;
++	data->flags = flags;
+ 	data->struct_size = struct_size;
+ 	data->pull_fn = pull_fn;
++	data->push_fn = push_fn;
++
+ 	test->data = data;
+ 	test->fn = check_fn;
+ 	test->dangerous = false;
+@@ -89,6 +118,7 @@ _PUBLIC_ struct torture_test *_torture_s
+ 	return test;
+ }
+ 
++
+ static bool wrap_ndr_inout_pull_test(struct torture_context *tctx,
+ 				     struct torture_tcase *tcase,
+ 				     struct torture_test *test)
+@@ -97,6 +127,7 @@ static bool wrap_ndr_inout_pull_test(str
+ 	const struct ndr_pull_test_data *data = (const struct ndr_pull_test_data *)test->data;
+ 	void *ds = talloc_zero_size(tctx, data->struct_size);
+ 	struct ndr_pull *ndr;
++	uint32_t highest_ofs;
+ 
+ 	/* handle NDR_IN context */
+ 
+@@ -109,8 +140,14 @@ static bool wrap_ndr_inout_pull_test(str
+ 		data->pull_fn(ndr, NDR_IN, ds),
+ 		"ndr pull of context failed");
+ 
+-	torture_assert(tctx, ndr->offset == ndr->data_size,
+-		talloc_asprintf(tctx, "%d unread bytes", ndr->data_size - ndr->offset));
++	if (ndr->offset > ndr->relative_highest_offset) {
++		highest_ofs = ndr->offset;
++	} else {
++		highest_ofs = ndr->relative_highest_offset;
++	}
++
++	torture_assert(tctx, highest_ofs == ndr->data_size,
++		talloc_asprintf(tctx, "%d unread bytes", ndr->data_size - highest_ofs));
+ 
+ 	talloc_free(ndr);
+ 
+@@ -125,8 +162,14 @@ static bool wrap_ndr_inout_pull_test(str
+ 		data->pull_fn(ndr, NDR_OUT, ds),
+ 		"ndr pull failed");
+ 
+-	torture_assert(tctx, ndr->offset == ndr->data_size,
+-		talloc_asprintf(tctx, "%d unread bytes", ndr->data_size - ndr->offset));
++	if (ndr->offset > ndr->relative_highest_offset) {
++		highest_ofs = ndr->offset;
++	} else {
++		highest_ofs = ndr->relative_highest_offset;
++	}
++
++	torture_assert(tctx, highest_ofs == ndr->data_size,
++		talloc_asprintf(tctx, "%d unread bytes", ndr->data_size - highest_ofs));
+ 
+ 	talloc_free(ndr);
+ 
+--- a/source4/torture/ndr/ndr.h
++++ b/source4/torture/ndr/ndr.h
+@@ -24,12 +24,15 @@
+ #include "librpc/ndr/libndr.h"
+ #include "libcli/security/security.h"
+ 
+-_PUBLIC_ struct torture_test *_torture_suite_add_ndr_pull_test(
++_PUBLIC_ struct torture_test *_torture_suite_add_ndr_pullpush_test(
+ 					struct torture_suite *suite,
+-					const char *name, ndr_pull_flags_fn_t fn,
++					const char *name,
++					ndr_pull_flags_fn_t pull_fn,
++					ndr_push_flags_fn_t push_fn,
+ 					DATA_BLOB db,
+ 					size_t struct_size,
+ 					int ndr_flags,
++					int flags,
+ 					bool (*check_fn) (struct torture_context *, void *data));
+ 
+ _PUBLIC_ struct torture_test *_torture_suite_add_ndr_pull_inout_test(
+@@ -41,20 +44,32 @@ _PUBLIC_ struct torture_test *_torture_s
+ 					bool (*check_fn) (struct torture_context *ctx, void *data));
+ 
+ #define torture_suite_add_ndr_pull_test(suite,name,data,check_fn) \
+-		_torture_suite_add_ndr_pull_test(suite, #name, \
+-			 (ndr_pull_flags_fn_t)ndr_pull_ ## name, data_blob_talloc(suite, data, sizeof(data)), \
+-			 sizeof(struct name), NDR_SCALARS|NDR_BUFFERS, (bool (*) (struct torture_context *, void *)) check_fn);
++		_torture_suite_add_ndr_pullpush_test(suite, #name, \
++			 (ndr_pull_flags_fn_t)ndr_pull_ ## name, NULL, data_blob_const(data, sizeof(data)), \
++			 sizeof(struct name), NDR_SCALARS|NDR_BUFFERS, 0, (bool (*) (struct torture_context *, void *)) check_fn);
+ 
+ #define torture_suite_add_ndr_pull_fn_test(suite,name,data,flags,check_fn) \
+-		_torture_suite_add_ndr_pull_test(suite, #name "_" #flags, \
+-			 (ndr_pull_flags_fn_t)ndr_pull_ ## name, data_blob_talloc(suite, data, sizeof(data)), \
+-			 sizeof(struct name), flags, (bool (*) (struct torture_context *, void *)) check_fn);
++		_torture_suite_add_ndr_pullpush_test(suite, #name "_" #flags, \
++			 (ndr_pull_flags_fn_t)ndr_pull_ ## name, NULL, data_blob_const(data, sizeof(data)), \
++			 sizeof(struct name), flags, 0, (bool (*) (struct torture_context *, void *)) check_fn);
++
++#define torture_suite_add_ndr_pull_fn_test_flags(suite,name,data,flags,flags2,check_fn) \
++		_torture_suite_add_ndr_pullpush_test(suite, #name "_" #flags "_" #flags2, \
++			 (ndr_pull_flags_fn_t)ndr_pull_ ## name, NULL, data_blob_const(data, sizeof(data)), \
++			 sizeof(struct name), flags, flags2, (bool (*) (struct torture_context *, void *)) check_fn);
++
++#define torture_suite_add_ndr_pullpush_test(suite,name,data_blob,check_fn) \
++		_torture_suite_add_ndr_pullpush_test(suite, #name, \
++			 (ndr_pull_flags_fn_t)ndr_pull_ ## name, \
++			 (ndr_push_flags_fn_t)ndr_push_ ## name, \
++			 data_blob, \
++			 sizeof(struct name), NDR_SCALARS|NDR_BUFFERS, 0, (bool (*) (struct torture_context *, void *)) check_fn);
+ 
+ #define torture_suite_add_ndr_pull_io_test(suite,name,data_in,data_out,check_fn_out) \
+ 		_torture_suite_add_ndr_pull_inout_test(suite, #name "_INOUT", \
+ 			 (ndr_pull_flags_fn_t)ndr_pull_ ## name, \
+-			 data_blob_talloc(suite, data_in, sizeof(data_in)), \
+-			 data_blob_talloc(suite, data_out, sizeof(data_out)), \
++			 data_blob_const(data_in, sizeof(data_in)), \
++			 data_blob_const(data_out, sizeof(data_out)), \
+ 			 sizeof(struct name), \
+ 			 (bool (*) (struct torture_context *, void *)) check_fn_out);
+ 
+--- a/source4/torture/ndr/dfsblob.c
++++ b/source4/torture/ndr/dfsblob.c
+@@ -74,11 +74,11 @@ struct torture_suite *ndr_dfsblob_suite(
+ {
+ 	struct torture_suite *suite = torture_suite_create(ctx, "dfsblob");
+ 
+-	torture_suite_add_ndr_pull_fn_test(suite, dfs_GetDFSReferral_in, dfs_get_ref_in, NDR_IN, NULL);
++	torture_suite_add_ndr_pull_test(suite, dfs_GetDFSReferral_in, dfs_get_ref_in, NULL);
+ 
+-	torture_suite_add_ndr_pull_fn_test(suite, dfs_referral_resp, dfs_get_ref_out2, NDR_BUFFERS|NDR_SCALARS, NULL);
++	torture_suite_add_ndr_pull_test(suite, dfs_referral_resp, dfs_get_ref_out2, NULL);
+ 
+-	torture_suite_add_ndr_pull_fn_test(suite, dfs_referral_resp, dfs_get_ref_out, NDR_BUFFERS|NDR_SCALARS,dfs_referral_out_check);
++	torture_suite_add_ndr_pull_test(suite, dfs_referral_resp, dfs_get_ref_out,dfs_referral_out_check);
+ 
+ 	return suite;
+ }
+--- a/source4/torture/ndr/nbt.c
++++ b/source4/torture/ndr/nbt.c
+@@ -62,9 +62,9 @@ struct torture_suite *ndr_nbt_suite(TALL
+ {
+ 	struct torture_suite *suite = torture_suite_create(ctx, "nbt");
+ 
+-	torture_suite_add_ndr_pull_fn_test(suite, nbt_netlogon_packet, netlogon_logon_request_req_data, NDR_IN, netlogon_logon_request_req_check);
++	torture_suite_add_ndr_pull_test(suite, nbt_netlogon_packet, netlogon_logon_request_req_data, netlogon_logon_request_req_check);
+ 
+-	torture_suite_add_ndr_pull_fn_test(suite, nbt_netlogon_response2, netlogon_logon_request_resp_data, NDR_IN, netlogon_logon_request_resp_check);
++	torture_suite_add_ndr_pull_test(suite, nbt_netlogon_response2, netlogon_logon_request_resp_data, netlogon_logon_request_resp_check);
+ 
+ 	return suite;
+ }
+--- a/source4/torture/ndr/ntlmssp.c
++++ b/source4/torture/ndr/ntlmssp.c
+@@ -111,9 +111,10 @@ struct torture_suite *ndr_ntlmssp_suite(
+ {
+ 	struct torture_suite *suite = torture_suite_create(ctx, "ntlmssp");
+ 
+-	torture_suite_add_ndr_pull_fn_test(suite, NEGOTIATE_MESSAGE, ntlmssp_NEGOTIATE_MESSAGE_data, NDR_IN, ntlmssp_NEGOTIATE_MESSAGE_check);
+-	/* torture_suite_add_ndr_pull_fn_test(suite, CHALLENGE_MESSAGE, ntlmssp_CHALLENGE_MESSAGE_data, NDR_IN, ntlmssp_CHALLENGE_MESSAGE_check);
+-	torture_suite_add_ndr_pull_fn_test(suite, AUTHENTICATE_MESSAGE, ntlmssp_AUTHENTICATE_MESSAGE_data, NDR_IN, ntlmssp_AUTHENTICATE_MESSAGE_check); */
+-
++	torture_suite_add_ndr_pull_test(suite, NEGOTIATE_MESSAGE, ntlmssp_NEGOTIATE_MESSAGE_data, ntlmssp_NEGOTIATE_MESSAGE_check);
++#if 0
++	torture_suite_add_ndr_pull_test(suite, CHALLENGE_MESSAGE, ntlmssp_CHALLENGE_MESSAGE_data, ntlmssp_CHALLENGE_MESSAGE_check);
++	torture_suite_add_ndr_pull_test(suite, AUTHENTICATE_MESSAGE, ntlmssp_AUTHENTICATE_MESSAGE_data, ntlmssp_AUTHENTICATE_MESSAGE_check);
++#endif
+ 	return suite;
+ }
+--- a/source4/torture/ndr/drsblobs.c
++++ b/source4/torture/ndr/drsblobs.c
+@@ -115,6 +115,34 @@ static const uint8_t trust_domain_passwo
+ 	0x38, 0x00, 0x00, 0x00, 0x38, 0x00, 0x00, 0x00
+ };
+ 
++/* these are taken from the trust objects of a w2k8r2 forest, with a
++ * trust relationship between the forest parent and a child domain
++ */
++static const char *trustAuthIncoming =
++"AQAAAAwAAAAcAQAASuQ+RXJdzAECAAAAAAEAAMOWL6UVfVKiJOUsGcT03H"
++"jHxr2ACsMMOV5ynM617Tp7idNC+c4egdqk4S9YEpvR2YvHmdZdymL6F7QKm8OkXazYZF2r/gZ/bI+"
++"jkWbsn4O8qyAc3OUKQRZwBbf+lxBW+vM4O3ZpUjz5BSKCcFQgM+MY91yVU8Nji3HNnvGnDquobFAZ"
++"hxjL+S1l5+QZgkfyfv5mQScGRbU1Lar1xg9G3JznUb7S6pvrBO2nwK8g+KZBfJy5UeULigDH4IWo/"
++"JmtaEGkKE2uiKIjdsEQd/uwnkouW26XzRc0ulfJnPFftGnT9KIcShPf7DLj/tstmQAAceRMFHJTY3"
++"PmxoowoK8HUyBK5D5Fcl3MAQIAAAAAAQAAw5YvpRV9UqIk5SwZxPTceMfGvYAKwww5XnKczrXtOnu"
++"J00L5zh6B2qThL1gSm9HZi8eZ1l3KYvoXtAqbw6RdrNhkXav+Bn9sj6ORZuyfg7yrIBzc5QpBFnAF"
++"t/6XEFb68zg7dmlSPPkFIoJwVCAz4xj3XJVTw2OLcc2e8acOq6hsUBmHGMv5LWXn5BmCR/J+/mZBJ"
++"wZFtTUtqvXGD0bcnOdRvtLqm+sE7afAryD4pkF8nLlR5QuKAMfghaj8ma1oQaQoTa6IoiN2wRB3+7"
++"CeSi5bbpfNFzS6V8mc8V+0adP0ohxKE9/sMuP+2y2ZAABx5EwUclNjc+bGijCgrwdTIA==";
++
++static const char *trustAuthOutgoing =
++"AQAAAAwAAAAcAQAASuQ+RXJdzAECAAAAAAEAAMOWL6UVfVKiJOUsGcT03H"
++"jHxr2ACsMMOV5ynM617Tp7idNC+c4egdqk4S9YEpvR2YvHmdZdymL6F7QKm8OkXazYZF2r/gZ/bI+"
++"jkWbsn4O8qyAc3OUKQRZwBbf+lxBW+vM4O3ZpUjz5BSKCcFQgM+MY91yVU8Nji3HNnvGnDquobFAZ"
++"hxjL+S1l5+QZgkfyfv5mQScGRbU1Lar1xg9G3JznUb7S6pvrBO2nwK8g+KZBfJy5UeULigDH4IWo/"
++"JmtaEGkKE2uiKIjdsEQd/uwnkouW26XzRc0ulfJnPFftGnT9KIcShPf7DLj/tstmQAAceRMFHJTY3"
++"PmxoowoK8HUyBK5D5Fcl3MAQIAAAAAAQAAw5YvpRV9UqIk5SwZxPTceMfGvYAKwww5XnKczrXtOnu"
++"J00L5zh6B2qThL1gSm9HZi8eZ1l3KYvoXtAqbw6RdrNhkXav+Bn9sj6ORZuyfg7yrIBzc5QpBFnAF"
++"t/6XEFb68zg7dmlSPPkFIoJwVCAz4xj3XJVTw2OLcc2e8acOq6hsUBmHGMv5LWXn5BmCR/J+/mZBJ"
++"wZFtTUtqvXGD0bcnOdRvtLqm+sE7afAryD4pkF8nLlR5QuKAMfghaj8ma1oQaQoTa6IoiN2wRB3+7"
++"CeSi5bbpfNFzS6V8mc8V+0adP0ohxKE9/sMuP+2y2ZAABx5EwUclNjc+bGijCgrwdTIA==";
++
++
+ static bool trust_domain_passwords_check_in(struct torture_context *tctx,
+ 					    struct trustDomainPasswords *r)
+ {
+@@ -154,8 +182,20 @@ struct torture_suite *ndr_drsblobs_suite
+ {
+ 	struct torture_suite *suite = torture_suite_create(ctx, "drsblobs");
+ 
+-	torture_suite_add_ndr_pull_fn_test(suite, ForestTrustInfo, forest_trust_info_data_out, NDR_IN, forest_trust_info_check_out);
+-	torture_suite_add_ndr_pull_fn_test(suite, trustDomainPasswords, trust_domain_passwords_in, NDR_IN, trust_domain_passwords_check_in);
++	torture_suite_add_ndr_pull_test(suite, ForestTrustInfo, forest_trust_info_data_out, forest_trust_info_check_out);
++	torture_suite_add_ndr_pull_test(suite, trustDomainPasswords, trust_domain_passwords_in, trust_domain_passwords_check_in);
++
++#if 0
++	torture_suite_add_ndr_pullpush_test(suite,
++					    trustAuthInOutBlob,
++					    base64_decode_data_blob_talloc(suite, trustAuthIncoming),
++					    NULL);
++
++	torture_suite_add_ndr_pullpush_test(suite,
++					    trustAuthInOutBlob,
++					    base64_decode_data_blob_talloc(suite, trustAuthOutgoing),
++					    NULL);
++#endif
+ 
+ 	return suite;
+ }
+--- a/source3/rpcclient/rpcclient.c
++++ b/source3/rpcclient/rpcclient.c
+@@ -1031,6 +1031,10 @@ out_free:
+ 		binding->transport = NCACN_NP;
+ 	}
+ 
++	if (binding->flags & DCERPC_CONNECT) {
++		pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
++		pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
++	}
+ 	if (binding->flags & DCERPC_SIGN) {
+ 		pipe_default_auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
+ 		pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+@@ -1044,12 +1048,6 @@ out_free:
+ 		pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
+ 	}
+ 	if (binding->flags & DCERPC_AUTH_NTLM) {
+-		/* If neither Integrity or Privacy are requested then
+-		 * Use just Connect level */
+-		if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
+-			pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
+-		}
+-
+ 		if (pipe_default_auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
+ 			pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
+ 		} else {
+@@ -1057,18 +1055,19 @@ out_free:
+ 		}
+ 	}
+ 	if (binding->flags & DCERPC_AUTH_KRB5) {
+-		/* If neither Integrity or Privacy are requested then
+-		 * Use just Connect level */
+-		if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
+-			pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
+-		}
+-
+ 		if (pipe_default_auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
+ 			pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_KRB5;
+ 		} else {
+ 			pipe_default_auth_type = DCERPC_AUTH_TYPE_KRB5;
+ 		}
+ 	}
++	if (pipe_default_auth_type != DCERPC_AUTH_TYPE_NONE) {
++		/* If neither Integrity or Privacy are requested then
++		 * Use just Connect level */
++		if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
++			pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
++		}
++	}
+ 
+ 	if (get_cmdline_auth_info_use_kerberos(rpcclient_auth_info)) {
+ 		flags |= CLI_FULL_CONNECTION_USE_KERBEROS |
+--- /dev/null
++++ b/source3/script/tests/test_rpcclient.sh
+@@ -0,0 +1,19 @@
++#!/bin/sh
++
++if [ $# -lt 1 ]; then
++cat <<EOF
++Usage: test_rpcclient.sh ccache binding <rpcclient commands>
++EOF
++exit 1;
++fi
++
++KRB5CCNAME=$1
++shift 1
++export KRB5CCNAME
++ADDARGS="$*"
++
++incdir=`dirname $0`/../../../testprogs/blackbox
++. $incdir/subunit.sh
++testit "rpcclient" $VALGRIND $BINDIR/rpcclient -c 'getusername' $ADDARGS || failed=`expr $failed + 1`
++
++testok $0 $failed
+--- a/source3/selftest/tests.py
++++ b/source3/selftest/tests.py
+@@ -208,7 +208,7 @@ if sub.returncode == 0:
+             plansmbtorturetestsuite(t, "s3dc", '//$SERVER_IP/tmpcase -U$USERNAME%$PASSWORD')
+ 
+     test = 'rpc.lsa.lookupsids'
+-    auth_options = ["", "ntlm", "spnego" ]
++    auth_options = ["", "ntlm", "spnego", "spnego,ntlm" ]
+     signseal_options = ["", ",connect", ",sign", ",seal"]
+     smb_options = ["", ",smb2"]
+     endianness_options = ["", ",bigendian"]
+@@ -219,6 +219,9 @@ if sub.returncode == 0:
+                     binding_string = "ncacn_np:$SERVER_IP[%s%s%s%s]" % (a, s, z, e)
+                     options = binding_string + " -U$USERNAME%$PASSWORD"
+                     plansmbtorturetestsuite(test, "s3dc", options, 'over ncacn_np with [%s%s%s%s] ' % (a, s, z, e))
++                    plantestsuite("samba3.blackbox.rpcclient over ncacn_np with [%s%s%s%s] " % (a, s, z, e), "s3dc:local", [os.path.join(samba3srcdir, "script/tests/test_rpcclient.sh"),
++                                                                 "none", options, configuration])
++
+     for e in endianness_options:
+         for a in auth_options:
+             for s in signseal_options:
+--- a/source4/torture/rpc/rpc.c
++++ b/source4/torture/rpc/rpc.c
+@@ -501,6 +501,7 @@ NTSTATUS torture_rpc_init(void)
+ 	torture_suite_add_suite(suite, torture_rpc_samr_passwords_pwdlastset(suite));
+ 	torture_suite_add_suite(suite, torture_rpc_samr_passwords_badpwdcount(suite));
+ 	torture_suite_add_suite(suite, torture_rpc_samr_passwords_lockout(suite));
++	torture_suite_add_suite(suite, torture_rpc_samr_passwords_validate(suite));
+ 	torture_suite_add_suite(suite, torture_rpc_samr_user_privileges(suite));
+ 	torture_suite_add_suite(suite, torture_rpc_samr_large_dc(suite));
+ 	torture_suite_add_suite(suite, torture_rpc_epmapper(suite));
+--- a/source4/torture/rpc/samr.c
++++ b/source4/torture/rpc/samr.c
+@@ -7938,8 +7938,8 @@ static bool test_Connect(struct dcerpc_b
+ }
+ 
+ 
+-static bool test_samr_ValidatePassword(struct dcerpc_pipe *p,
+-				       struct torture_context *tctx)
++static bool test_samr_ValidatePassword(struct torture_context *tctx,
++				       struct dcerpc_pipe *p)
+ {
+ 	struct samr_ValidatePassword r;
+ 	union samr_ValidatePasswordReq req;
+@@ -7951,6 +7951,10 @@ static bool test_samr_ValidatePassword(s
+ 
+ 	torture_comment(tctx, "Testing samr_ValidatePassword\n");
+ 
++	if (p->conn->transport.transport != NCACN_IP_TCP) {
++		torture_comment(tctx, "samr_ValidatePassword only should succeed over NCACN_IP_TCP!\n");
++	}
++
+ 	ZERO_STRUCT(r);
+ 	r.in.level = NetValidatePasswordReset;
+ 	r.in.req = &req;
+@@ -8074,8 +8078,6 @@ bool torture_rpc_samr_passwords(struct t
+ 
+ 	ret &= test_samr_handle_Close(b, torture, &ctx->handle);
+ 
+-	ret &= test_samr_ValidatePassword(p, torture);
+-
+ 	return ret;
+ }
+ 
+@@ -8370,4 +8372,15 @@ struct torture_suite *torture_rpc_samr_p
+ 	return suite;
+ }
+ 
++struct torture_suite *torture_rpc_samr_passwords_validate(TALLOC_CTX *mem_ctx)
++{
++	struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.validate");
++	struct torture_rpc_tcase *tcase;
++
++	tcase = torture_suite_add_rpc_iface_tcase(suite, "samr",
++						  &ndr_table_samr);
++	torture_rpc_tcase_add_test(tcase, "validate",
++				   test_samr_ValidatePassword);
+ 
++	return suite;
++}
+--- a/source3/rpc_server/srv_pipe.c
++++ b/source3/rpc_server/srv_pipe.c
+@@ -42,6 +42,7 @@
+ #include "auth.h"
+ #include "ntdomain.h"
+ #include "rpc_server/srv_pipe.h"
++#include "../librpc/ndr/ndr_dcerpc.h"
+ 
+ #undef DBGC_CLASS
+ #define DBGC_CLASS DBGC_RPC_SRV
+@@ -202,7 +203,7 @@ bool create_next_pdu(struct pipes_struct
+ 	 * the pipe gets closed. JRA.
+ 	 */
+ 	if (p->fault_state) {
+-		setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
++		setup_fault_pdu(p, NT_STATUS(p->fault_state));
+ 		return true;
+ 	}
+ 
+@@ -336,7 +337,7 @@ static bool check_bind_req(struct pipes_
+ 	struct pipe_rpc_fns *context_fns;
+ 
+ 	DEBUG(3,("check_bind_req for %s\n",
+-		 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
++		 get_pipe_name_from_syntax(talloc_tos(), abstract)));
+ 
+ 	/* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
+ 	if (rpc_srv_pipe_exists_by_id(abstract) &&
+@@ -358,6 +359,7 @@ static bool check_bind_req(struct pipes_
+ 	context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
+ 	context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
+ 	context_fns->context_id = context_id;
++	context_fns->syntax = *abstract;
+ 
+ 	/* add to the list of open contexts */
+ 
+@@ -1541,7 +1543,42 @@ static PIPE_RPC_FNS* find_pipe_fns_by_co
+ }
+ 
+ static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
+-		       const struct api_struct *api_rpc_cmds, int n_cmds);
++		       const struct api_struct *api_rpc_cmds, int n_cmds,
++		       const struct ndr_syntax_id *syntax);
++
++static bool srv_pipe_check_verification_trailer(struct pipes_struct *p,
++						struct ncacn_packet *pkt,
++						struct pipe_rpc_fns *pipe_fns)
++{
++	TALLOC_CTX *frame = talloc_stackframe();
++	struct dcerpc_sec_verification_trailer *vt = NULL;
++	const uint32_t bitmask1 = 0;
++	const struct dcerpc_sec_vt_pcontext pcontext = {
++		.abstract_syntax = pipe_fns->syntax,
++		.transfer_syntax = ndr_transfer_syntax,
++	};
++	const struct dcerpc_sec_vt_header2 header2 =
++	       dcerpc_sec_vt_header2_from_ncacn_packet(pkt);
++	struct ndr_pull *ndr;
++	enum ndr_err_code ndr_err;
++	bool ret = false;
++
++	ndr = ndr_pull_init_blob(&p->in_data.data, frame);
++	if (ndr == NULL) {
++		goto done;
++	}
++
++	ndr_err = ndr_pop_dcerpc_sec_verification_trailer(ndr, frame, &vt);
++	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
++		goto done;
++	}
++
++	ret = dcerpc_sec_verification_trailer_check(vt, &bitmask1,
++						    &pcontext, &header2);
++done:
++	TALLOC_FREE(frame);
++	return ret;
++}
+ 
+ /****************************************************************************
+  Find the correct RPC function to call for this request.
+@@ -1552,46 +1589,53 @@ static bool api_rpcTNP(struct pipes_stru
+ static bool api_pipe_request(struct pipes_struct *p,
+ 				struct ncacn_packet *pkt)
+ {
++	TALLOC_CTX *frame = talloc_stackframe();
+ 	bool ret = False;
+-	bool changed_user = False;
+ 	PIPE_RPC_FNS *pipe_fns;
+ 
+-	if (p->pipe_bound &&
+-	    ((p->auth.auth_type == DCERPC_AUTH_TYPE_NTLMSSP) ||
+-	     (p->auth.auth_type == DCERPC_AUTH_TYPE_KRB5) ||
+-	     (p->auth.auth_type == DCERPC_AUTH_TYPE_SPNEGO))) {
+-		if(!become_authenticated_pipe_user(p->session_info)) {
+-			data_blob_free(&p->out_data.rdata);
+-			return False;
+-		}
+-		changed_user = True;
++	if (!p->pipe_bound) {
++		DEBUG(1, ("Pipe not bound!\n"));
++		data_blob_free(&p->out_data.rdata);
++		TALLOC_FREE(frame);
++		return false;
+ 	}
+ 
+-	DEBUG(5, ("Requested \\PIPE\\%s\n",
+-		  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
+-
+ 	/* get the set of RPC functions for this context */
+ 
+ 	pipe_fns = find_pipe_fns_by_context(p->contexts,
+ 					    pkt->u.request.context_id);
+-
+-	if ( pipe_fns ) {
+-		TALLOC_CTX *frame = talloc_stackframe();
+-		ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
++	if (pipe_fns == NULL) {
++		DEBUG(0, ("No rpc function table associated with context "
++			  "[%d]\n",
++			  pkt->u.request.context_id));
++		data_blob_free(&p->out_data.rdata);
+ 		TALLOC_FREE(frame);
++		return false;
+ 	}
+-	else {
+-		DEBUG(0, ("No rpc function table associated with context "
+-			  "[%d] on pipe [%s]\n",
+-			  pkt->u.request.context_id,
+-			  get_pipe_name_from_syntax(talloc_tos(),
+-						    &p->syntax)));
++
++	DEBUG(5, ("Requested \\PIPE\\%s\n",
++		  get_pipe_name_from_syntax(talloc_tos(), &pipe_fns->syntax)));
++
++	if (!srv_pipe_check_verification_trailer(p, pkt, pipe_fns)) {
++		DEBUG(1, ("srv_pipe_check_verification_trailer: failed\n"));
++		setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
++		data_blob_free(&p->out_data.rdata);
++		TALLOC_FREE(frame);
++		return true;
+ 	}
+ 
+-	if (changed_user) {
+-		unbecome_authenticated_pipe_user();
++	if (!become_authenticated_pipe_user(p->session_info)) {
++		DEBUG(1, ("Failed to become pipe user!\n"));
++		data_blob_free(&p->out_data.rdata);
++		TALLOC_FREE(frame);
++		return false;
+ 	}
+ 
++	ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
++			 &pipe_fns->syntax);
++	unbecome_authenticated_pipe_user();
++
++	TALLOC_FREE(frame);
+ 	return ret;
+ }
+ 
+@@ -1600,20 +1644,21 @@ static bool api_pipe_request(struct pipe
+  ********************************************************************/
+ 
+ static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
+-		       const struct api_struct *api_rpc_cmds, int n_cmds)
++		       const struct api_struct *api_rpc_cmds, int n_cmds,
++		       const struct ndr_syntax_id *syntax)
+ {
+ 	int fn_num;
+ 	uint32_t offset1;
+ 
+ 	/* interpret the command */
+ 	DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
+-		 get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
++		 get_pipe_name_from_syntax(talloc_tos(), syntax),
+ 		 pkt->u.request.opnum));
+ 
+ 	if (DEBUGLEVEL >= 50) {
+ 		fstring name;
+ 		slprintf(name, sizeof(name)-1, "in_%s",
+-			 get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
++			 get_pipe_name_from_syntax(talloc_tos(), syntax));
+ 		dump_pdu_region(name, pkt->u.request.opnum,
+ 				&p->in_data.data, 0,
+ 				p->in_data.data.length);
+@@ -1646,37 +1691,30 @@ static bool api_rpcTNP(struct pipes_stru
+ 	/* do the actual command */
+ 	if(!api_rpc_cmds[fn_num].fn(p)) {
+ 		DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
+-			 get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
++			 get_pipe_name_from_syntax(talloc_tos(), syntax),
+ 			 api_rpc_cmds[fn_num].name));
+ 		data_blob_free(&p->out_data.rdata);
+ 		return False;
+ 	}
+ 
+-	if (p->bad_handle_fault_state) {
+-		DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
+-		p->bad_handle_fault_state = False;
+-		setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
+-		return True;
+-	}
+-
+-	if (p->rng_fault_state) {
+-		DEBUG(4, ("api_rpcTNP: rng fault return\n"));
+-		p->rng_fault_state = False;
+-		setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
+-		return True;
++	if (p->fault_state) {
++		DEBUG(4,("api_rpcTNP: fault(%d) return.\n", p->fault_state));
++		setup_fault_pdu(p, NT_STATUS(p->fault_state));
++		p->fault_state = 0;
++		return true;
+ 	}
+ 
+ 	if (DEBUGLEVEL >= 50) {
+ 		fstring name;
+ 		slprintf(name, sizeof(name)-1, "out_%s",
+-			 get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
++			 get_pipe_name_from_syntax(talloc_tos(), syntax));
+ 		dump_pdu_region(name, pkt->u.request.opnum,
+ 				&p->out_data.rdata, offset1,
+ 				p->out_data.rdata.length);
+ 	}
+ 
+ 	DEBUG(5,("api_rpcTNP: called %s successfully\n",
+-		 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
++		 get_pipe_name_from_syntax(talloc_tos(), syntax)));
+ 
+ 	/* Check for buffer underflow in rpc parsing */
+ 	if ((DEBUGLEVEL >= 10) &&
+@@ -1718,9 +1756,9 @@ void set_incoming_fault(struct pipes_str
+ 	data_blob_free(&p->in_data.data);
+ 	p->in_data.pdu_needed_len = 0;
+ 	p->in_data.pdu.length = 0;
+-	p->fault_state = True;
+-	DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
+-		   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
++	p->fault_state = DCERPC_FAULT_CANT_PERFORM;
++
++	DEBUG(10, ("Setting fault state\n"));
+ }
+ 
+ static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
+--- a/source3/include/ntdomain.h
++++ b/source3/include/ntdomain.h
+@@ -87,6 +87,7 @@ typedef struct pipe_rpc_fns {
+ 	const struct api_struct *cmds;
+ 	int n_cmds;
+ 	uint32 context_id;
++	struct ndr_syntax_id syntax;
+ 
+ } PIPE_RPC_FNS;
+ 
+@@ -134,22 +135,10 @@ struct pipes_struct {
+ 	bool pipe_bound;
+ 
+ 	/*
+-	 * Set to true when we should return fault PDU's for everything.
+-	 */
+-
+-	bool fault_state;
+-
+-	/*
+-	 * Set to true when we should return fault PDU's for a bad handle.
+-	 */
+-
+-	bool bad_handle_fault_state;
+-
+-	/*
+-	 * Set to true when the backend does not support a call.
++	 * Set the DCERPC_FAULT to return.
+ 	 */
+ 
+-	bool rng_fault_state;
++	int fault_state;
+ 
+ 	/*
+ 	 * Set to RPC_BIG_ENDIAN when dealing with big-endian PDU's
+--- a/pidl/lib/Parse/Pidl/Samba3/ServerNDR.pm
++++ b/pidl/lib/Parse/Pidl/Samba3/ServerNDR.pm
+@@ -183,7 +183,7 @@ sub ParseFunction($$)
+ 	);
+ 
+ 	pidl "";
+-	pidl "if (p->rng_fault_state) {";
++	pidl "if (p->fault_state) {";
+ 	pidl "\ttalloc_free(r);";
+ 	pidl "\t/* Return true here, srv_pipe_hnd.c will take care */";
+ 	pidl "\treturn true;";
+--- a/source3/rpc_server/dfs/srv_dfs_nt.c
++++ b/source3/rpc_server/dfs/srv_dfs_nt.c
+@@ -411,125 +411,125 @@ WERROR _dfs_GetInfo(struct pipes_struct
+ WERROR _dfs_SetInfo(struct pipes_struct *p, struct dfs_SetInfo *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_Rename(struct pipes_struct *p, struct dfs_Rename *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_Move(struct pipes_struct *p, struct dfs_Move *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_ManagerGetConfigInfo(struct pipes_struct *p, struct dfs_ManagerGetConfigInfo *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_ManagerSendSiteInfo(struct pipes_struct *p, struct dfs_ManagerSendSiteInfo *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_AddFtRoot(struct pipes_struct *p, struct dfs_AddFtRoot *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_RemoveFtRoot(struct pipes_struct *p, struct dfs_RemoveFtRoot *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_AddStdRoot(struct pipes_struct *p, struct dfs_AddStdRoot *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_RemoveStdRoot(struct pipes_struct *p, struct dfs_RemoveStdRoot *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_ManagerInitialize(struct pipes_struct *p, struct dfs_ManagerInitialize *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_AddStdRootForced(struct pipes_struct *p, struct dfs_AddStdRootForced *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_GetDcAddress(struct pipes_struct *p, struct dfs_GetDcAddress *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_SetDcAddress(struct pipes_struct *p, struct dfs_SetDcAddress *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_FlushFtTable(struct pipes_struct *p, struct dfs_FlushFtTable *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_Add2(struct pipes_struct *p, struct dfs_Add2 *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_Remove2(struct pipes_struct *p, struct dfs_Remove2 *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_EnumEx(struct pipes_struct *p, struct dfs_EnumEx *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _dfs_SetInfo2(struct pipes_struct *p, struct dfs_SetInfo2 *r)
+ {
+ 	/* FIXME: Implement your code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+--- a/source3/rpc_server/dssetup/srv_dssetup_nt.c
++++ b/source3/rpc_server/dssetup/srv_dssetup_nt.c
+@@ -130,7 +130,7 @@ WERROR _dssetup_DsRoleGetPrimaryDomainIn
+ WERROR _dssetup_DsRoleDnsNameToFlatName(struct pipes_struct *p,
+ 					struct dssetup_DsRoleDnsNameToFlatName *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -140,7 +140,7 @@ WERROR _dssetup_DsRoleDnsNameToFlatName(
+ WERROR _dssetup_DsRoleDcAsDc(struct pipes_struct *p,
+ 			     struct dssetup_DsRoleDcAsDc *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -150,7 +150,7 @@ WERROR _dssetup_DsRoleDcAsDc(struct pipe
+ WERROR _dssetup_DsRoleDcAsReplica(struct pipes_struct *p,
+ 				  struct dssetup_DsRoleDcAsReplica *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -160,7 +160,7 @@ WERROR _dssetup_DsRoleDcAsReplica(struct
+ WERROR _dssetup_DsRoleDemoteDc(struct pipes_struct *p,
+ 			       struct dssetup_DsRoleDemoteDc *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -170,7 +170,7 @@ WERROR _dssetup_DsRoleDemoteDc(struct pi
+ WERROR _dssetup_DsRoleGetDcOperationProgress(struct pipes_struct *p,
+ 					     struct dssetup_DsRoleGetDcOperationProgress *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -180,7 +180,7 @@ WERROR _dssetup_DsRoleGetDcOperationProg
+ WERROR _dssetup_DsRoleGetDcOperationResults(struct pipes_struct *p,
+ 					    struct dssetup_DsRoleGetDcOperationResults *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -190,7 +190,7 @@ WERROR _dssetup_DsRoleGetDcOperationResu
+ WERROR _dssetup_DsRoleCancel(struct pipes_struct *p,
+ 			     struct dssetup_DsRoleCancel *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -200,7 +200,7 @@ WERROR _dssetup_DsRoleCancel(struct pipe
+ WERROR _dssetup_DsRoleServerSaveStateForUpgrade(struct pipes_struct *p,
+ 						struct dssetup_DsRoleServerSaveStateForUpgrade *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -210,7 +210,7 @@ WERROR _dssetup_DsRoleServerSaveStateFor
+ WERROR _dssetup_DsRoleUpgradeDownlevelServer(struct pipes_struct *p,
+ 					     struct dssetup_DsRoleUpgradeDownlevelServer *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -220,6 +220,6 @@ WERROR _dssetup_DsRoleUpgradeDownlevelSe
+ WERROR _dssetup_DsRoleAbortDownlevelServerUpgrade(struct pipes_struct *p,
+ 						  struct dssetup_DsRoleAbortDownlevelServerUpgrade *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+--- a/source3/rpc_server/echo/srv_echo_nt.c
++++ b/source3/rpc_server/echo/srv_echo_nt.c
+@@ -87,13 +87,13 @@ void _echo_SourceData(struct pipes_struc
+ 
+ void _echo_TestCall(struct pipes_struct *p, struct echo_TestCall *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return;
+ }
+ 
+ NTSTATUS _echo_TestCall2(struct pipes_struct *p, struct echo_TestCall2 *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_OK;
+ }
+ 
+@@ -105,18 +105,18 @@ uint32 _echo_TestSleep(struct pipes_stru
+ 
+ void _echo_TestEnum(struct pipes_struct *p, struct echo_TestEnum *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return;
+ }
+ 
+ void _echo_TestSurrounding(struct pipes_struct *p, struct echo_TestSurrounding *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return;
+ }
+ 
+ uint16 _echo_TestDoublePointer(struct pipes_struct *p, struct echo_TestDoublePointer *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return 0;
+ }
+--- a/source3/rpc_server/epmapper/srv_epmapper.c
++++ b/source3/rpc_server/epmapper/srv_epmapper.c
+@@ -297,6 +297,7 @@ error_status_t _epm_Insert(struct pipes_
+ 	/* If this is not a priviledged users, return */
+ 	if (p->transport != NCALRPC ||
+ 	    !is_priviledged_pipe(p->session_info)) {
++		p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 		return EPMAPPER_STATUS_CANT_PERFORM_OP;
+ 	}
+ 
+@@ -433,6 +434,7 @@ error_status_t _epm_Delete(struct pipes_
+ 	/* If this is not a priviledged users, return */
+ 	if (p->transport != NCALRPC ||
+ 	    !is_priviledged_pipe(p->session_info)) {
++		p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 		return EPMAPPER_STATUS_CANT_PERFORM_OP;
+ 	}
+ 
+@@ -1096,7 +1098,7 @@ error_status_t _epm_LookupHandleFree(str
+ error_status_t _epm_InqObject(struct pipes_struct *p,
+ 		      struct epm_InqObject *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return EPMAPPER_STATUS_CANT_PERFORM_OP;
+ }
+ 
+@@ -1110,7 +1112,7 @@ error_status_t _epm_InqObject(struct pip
+ error_status_t _epm_MgmtDelete(struct pipes_struct *p,
+ 		       struct epm_MgmtDelete *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return EPMAPPER_STATUS_CANT_PERFORM_OP;
+ }
+ 
+@@ -1121,7 +1123,7 @@ error_status_t _epm_MgmtDelete(struct pi
+ error_status_t _epm_MapAuth(struct pipes_struct *p,
+ 		    struct epm_MapAuth *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return EPMAPPER_STATUS_CANT_PERFORM_OP;
+ }
+ 
+--- a/source3/rpc_server/eventlog/srv_eventlog_nt.c
++++ b/source3/rpc_server/eventlog/srv_eventlog_nt.c
+@@ -695,7 +695,7 @@ NTSTATUS _eventlog_GetNumRecords(struct
+ 
+ NTSTATUS _eventlog_BackupEventLogW(struct pipes_struct *p, struct eventlog_BackupEventLogW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -838,104 +838,104 @@ NTSTATUS _eventlog_ReportEventW(struct p
+ NTSTATUS _eventlog_DeregisterEventSource(struct pipes_struct *p,
+ 					 struct eventlog_DeregisterEventSource *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_ChangeNotify(struct pipes_struct *p,
+ 				struct eventlog_ChangeNotify *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_RegisterEventSourceW(struct pipes_struct *p,
+ 					struct eventlog_RegisterEventSourceW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_OpenBackupEventLogW(struct pipes_struct *p,
+ 				       struct eventlog_OpenBackupEventLogW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_ClearEventLogA(struct pipes_struct *p,
+ 				  struct eventlog_ClearEventLogA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_BackupEventLogA(struct pipes_struct *p,
+ 				   struct eventlog_BackupEventLogA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_OpenEventLogA(struct pipes_struct *p,
+ 				 struct eventlog_OpenEventLogA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_RegisterEventSourceA(struct pipes_struct *p,
+ 					struct eventlog_RegisterEventSourceA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_OpenBackupEventLogA(struct pipes_struct *p,
+ 				       struct eventlog_OpenBackupEventLogA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_ReadEventLogA(struct pipes_struct *p,
+ 				 struct eventlog_ReadEventLogA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_ReportEventA(struct pipes_struct *p,
+ 				struct eventlog_ReportEventA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_RegisterClusterSvc(struct pipes_struct *p,
+ 				      struct eventlog_RegisterClusterSvc *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_DeregisterClusterSvc(struct pipes_struct *p,
+ 					struct eventlog_DeregisterClusterSvc *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_WriteClusterEvents(struct pipes_struct *p,
+ 				      struct eventlog_WriteClusterEvents *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _eventlog_ReportEventAndSourceW(struct pipes_struct *p,
+ 					 struct eventlog_ReportEventAndSourceW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+--- a/source3/rpc_server/lsa/srv_lsa_nt.c
++++ b/source3/rpc_server/lsa/srv_lsa_nt.c
+@@ -817,7 +817,7 @@ NTSTATUS _lsa_QueryInfoPolicy2(struct pi
+ 	struct lsa_QueryInfoPolicy r;
+ 
+ 	if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
+-		p->rng_fault_state = True;
++		p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 		return NT_STATUS_NOT_IMPLEMENTED;
+ 	}
+ 
+@@ -3210,88 +3210,88 @@ NTSTATUS _lsa_Delete(struct pipes_struct
+ 
+ NTSTATUS _lsa_SetSecObj(struct pipes_struct *p, struct lsa_SetSecObj *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_ChangePassword(struct pipes_struct *p,
+ 			     struct lsa_ChangePassword *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_SetInfoPolicy(struct pipes_struct *p, struct lsa_SetInfoPolicy *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_ClearAuditLog(struct pipes_struct *p, struct lsa_ClearAuditLog *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_GetQuotasForAccount(struct pipes_struct *p,
+ 				  struct lsa_GetQuotasForAccount *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_SetQuotasForAccount(struct pipes_struct *p,
+ 				  struct lsa_SetQuotasForAccount *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_SetInformationTrustedDomain(struct pipes_struct *p,
+ 					  struct lsa_SetInformationTrustedDomain *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_QuerySecret(struct pipes_struct *p, struct lsa_QuerySecret *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_SetTrustedDomainInfo(struct pipes_struct *p,
+ 				   struct lsa_SetTrustedDomainInfo *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_StorePrivateData(struct pipes_struct *p,
+ 			       struct lsa_StorePrivateData *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_RetrievePrivateData(struct pipes_struct *p,
+ 				  struct lsa_RetrievePrivateData *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_SetInfoPolicy2(struct pipes_struct *p,
+ 			     struct lsa_SetInfoPolicy2 *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_SetTrustedDomainInfoByName(struct pipes_struct *p,
+ 					 struct lsa_SetTrustedDomainInfoByName *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -3310,7 +3310,7 @@ NTSTATUS _lsa_EnumTrustedDomainsEx(struc
+ 	 * _lsa_EnumTrustedDomains() afterwards - gd */
+ 
+ 	if (!(pdb_capabilities() & PDB_CAP_TRUSTED_DOMAINS_EX)) {
+-		p->rng_fault_state = True;
++		p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 		return NT_STATUS_NOT_IMPLEMENTED;
+ 	}
+ 
+@@ -3379,107 +3379,107 @@ NTSTATUS _lsa_EnumTrustedDomainsEx(struc
+ NTSTATUS _lsa_QueryDomainInformationPolicy(struct pipes_struct *p,
+ 					   struct lsa_QueryDomainInformationPolicy *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_SetDomainInformationPolicy(struct pipes_struct *p,
+ 					 struct lsa_SetDomainInformationPolicy *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_TestCall(struct pipes_struct *p, struct lsa_TestCall *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_CREDRWRITE(struct pipes_struct *p, struct lsa_CREDRWRITE *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_CREDRREAD(struct pipes_struct *p, struct lsa_CREDRREAD *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_CREDRENUMERATE(struct pipes_struct *p, struct lsa_CREDRENUMERATE *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_CREDRWRITEDOMAINCREDENTIALS(struct pipes_struct *p,
+ 					  struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_CREDRREADDOMAINCREDENTIALS(struct pipes_struct *p,
+ 					 struct lsa_CREDRREADDOMAINCREDENTIALS *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_CREDRDELETE(struct pipes_struct *p, struct lsa_CREDRDELETE *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_CREDRGETTARGETINFO(struct pipes_struct *p,
+ 				 struct lsa_CREDRGETTARGETINFO *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_CREDRPROFILELOADED(struct pipes_struct *p,
+ 				 struct lsa_CREDRPROFILELOADED *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_CREDRGETSESSIONTYPES(struct pipes_struct *p,
+ 				   struct lsa_CREDRGETSESSIONTYPES *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_LSARREGISTERAUDITEVENT(struct pipes_struct *p,
+ 				     struct lsa_LSARREGISTERAUDITEVENT *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_LSARGENAUDITEVENT(struct pipes_struct *p,
+ 				struct lsa_LSARGENAUDITEVENT *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_LSARUNREGISTERAUDITEVENT(struct pipes_struct *p,
+ 				       struct lsa_LSARUNREGISTERAUDITEVENT *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_lsaRQueryForestTrustInformation(struct pipes_struct *p,
+ 					      struct lsa_lsaRQueryForestTrustInformation *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -3992,34 +3992,34 @@ NTSTATUS _lsa_lsaRSetForestTrustInformat
+ NTSTATUS _lsa_CREDRRENAME(struct pipes_struct *p,
+ 			  struct lsa_CREDRRENAME *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_LSAROPENPOLICYSCE(struct pipes_struct *p,
+ 				struct lsa_LSAROPENPOLICYSCE *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(struct pipes_struct *p,
+ 						 struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(struct pipes_struct *p,
+ 						   struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+ NTSTATUS _lsa_LSARADTREPORTSECURITYEVENT(struct pipes_struct *p,
+ 					 struct lsa_LSARADTREPORTSECURITYEVENT *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
++++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
+@@ -1787,7 +1787,7 @@ NTSTATUS _netr_LogonSamLogonEx(struct pi
+ WERROR _netr_LogonUasLogon(struct pipes_struct *p,
+ 			   struct netr_LogonUasLogon *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -1797,7 +1797,7 @@ WERROR _netr_LogonUasLogon(struct pipes_
+ WERROR _netr_LogonUasLogoff(struct pipes_struct *p,
+ 			    struct netr_LogonUasLogoff *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -1807,7 +1807,7 @@ WERROR _netr_LogonUasLogoff(struct pipes
+ NTSTATUS _netr_DatabaseDeltas(struct pipes_struct *p,
+ 			      struct netr_DatabaseDeltas *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -1817,7 +1817,7 @@ NTSTATUS _netr_DatabaseDeltas(struct pip
+ NTSTATUS _netr_DatabaseSync(struct pipes_struct *p,
+ 			    struct netr_DatabaseSync *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -1827,7 +1827,7 @@ NTSTATUS _netr_DatabaseSync(struct pipes
+ NTSTATUS _netr_AccountDeltas(struct pipes_struct *p,
+ 			     struct netr_AccountDeltas *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -1837,7 +1837,7 @@ NTSTATUS _netr_AccountDeltas(struct pipe
+ NTSTATUS _netr_AccountSync(struct pipes_struct *p,
+ 			   struct netr_AccountSync *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -1978,7 +1978,7 @@ WERROR _netr_GetAnyDCName(struct pipes_s
+ NTSTATUS _netr_DatabaseSync2(struct pipes_struct *p,
+ 			     struct netr_DatabaseSync2 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -1988,7 +1988,7 @@ NTSTATUS _netr_DatabaseSync2(struct pipe
+ NTSTATUS _netr_DatabaseRedo(struct pipes_struct *p,
+ 			    struct netr_DatabaseRedo *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -1998,7 +1998,7 @@ NTSTATUS _netr_DatabaseRedo(struct pipes
+ WERROR _netr_DsRGetDCName(struct pipes_struct *p,
+ 			  struct netr_DsRGetDCName *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2017,7 +2017,7 @@ NTSTATUS _netr_LogonGetCapabilities(stru
+ WERROR _netr_NETRLOGONSETSERVICEBITS(struct pipes_struct *p,
+ 				     struct netr_NETRLOGONSETSERVICEBITS *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2027,7 +2027,7 @@ WERROR _netr_NETRLOGONSETSERVICEBITS(str
+ WERROR _netr_LogonGetTrustRid(struct pipes_struct *p,
+ 			      struct netr_LogonGetTrustRid *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2037,7 +2037,7 @@ WERROR _netr_LogonGetTrustRid(struct pip
+ WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(struct pipes_struct *p,
+ 					  struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2047,7 +2047,7 @@ WERROR _netr_NETRLOGONCOMPUTESERVERDIGES
+ WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(struct pipes_struct *p,
+ 					  struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2057,7 +2057,7 @@ WERROR _netr_NETRLOGONCOMPUTECLIENTDIGES
+ WERROR _netr_DsRGetDCNameEx(struct pipes_struct *p,
+ 			    struct netr_DsRGetDCNameEx *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2067,7 +2067,7 @@ WERROR _netr_DsRGetDCNameEx(struct pipes
+ WERROR _netr_DsRGetSiteName(struct pipes_struct *p,
+ 			    struct netr_DsRGetSiteName *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2077,7 +2077,7 @@ WERROR _netr_DsRGetSiteName(struct pipes
+ NTSTATUS _netr_LogonGetDomainInfo(struct pipes_struct *p,
+ 				  struct netr_LogonGetDomainInfo *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -2087,7 +2087,7 @@ NTSTATUS _netr_LogonGetDomainInfo(struct
+ WERROR _netr_ServerPasswordGet(struct pipes_struct *p,
+ 			       struct netr_ServerPasswordGet *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2097,7 +2097,7 @@ WERROR _netr_ServerPasswordGet(struct pi
+ WERROR _netr_NETRLOGONSENDTOSAM(struct pipes_struct *p,
+ 				struct netr_NETRLOGONSENDTOSAM *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2107,7 +2107,7 @@ WERROR _netr_NETRLOGONSENDTOSAM(struct p
+ WERROR _netr_DsRAddressToSitenamesW(struct pipes_struct *p,
+ 				    struct netr_DsRAddressToSitenamesW *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2117,7 +2117,7 @@ WERROR _netr_DsRAddressToSitenamesW(stru
+ WERROR _netr_DsRGetDCNameEx2(struct pipes_struct *p,
+ 			     struct netr_DsRGetDCNameEx2 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2127,7 +2127,7 @@ WERROR _netr_DsRGetDCNameEx2(struct pipe
+ WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(struct pipes_struct *p,
+ 						 struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2137,7 +2137,7 @@ WERROR _netr_NETRLOGONGETTIMESERVICEPARE
+ WERROR _netr_NetrEnumerateTrustedDomainsEx(struct pipes_struct *p,
+ 					   struct netr_NetrEnumerateTrustedDomainsEx *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2147,7 +2147,7 @@ WERROR _netr_NetrEnumerateTrustedDomains
+ WERROR _netr_DsRAddressToSitenamesExW(struct pipes_struct *p,
+ 				      struct netr_DsRAddressToSitenamesExW *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2157,7 +2157,7 @@ WERROR _netr_DsRAddressToSitenamesExW(st
+ WERROR _netr_DsrGetDcSiteCoverageW(struct pipes_struct *p,
+ 				   struct netr_DsrGetDcSiteCoverageW *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2167,7 +2167,7 @@ WERROR _netr_DsrGetDcSiteCoverageW(struc
+ WERROR _netr_DsrEnumerateDomainTrusts(struct pipes_struct *p,
+ 				      struct netr_DsrEnumerateDomainTrusts *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2177,7 +2177,7 @@ WERROR _netr_DsrEnumerateDomainTrusts(st
+ WERROR _netr_DsrDeregisterDNSHostRecords(struct pipes_struct *p,
+ 					 struct netr_DsrDeregisterDNSHostRecords *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2187,7 +2187,7 @@ WERROR _netr_DsrDeregisterDNSHostRecords
+ NTSTATUS _netr_ServerTrustPasswordsGet(struct pipes_struct *p,
+ 				       struct netr_ServerTrustPasswordsGet *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -2197,7 +2197,7 @@ NTSTATUS _netr_ServerTrustPasswordsGet(s
+ WERROR _netr_DsRGetForestTrustInformation(struct pipes_struct *p,
+ 					  struct netr_DsRGetForestTrustInformation *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -2476,7 +2476,7 @@ NTSTATUS _netr_ServerGetTrustInfo(struct
+ NTSTATUS _netr_Unused47(struct pipes_struct *p,
+ 			struct netr_Unused47 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -2486,6 +2486,6 @@ NTSTATUS _netr_Unused47(struct pipes_str
+ NTSTATUS _netr_DsrUpdateReadOnlyServerDnsRecords(struct pipes_struct *p,
+ 						 struct netr_DsrUpdateReadOnlyServerDnsRecords *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+--- a/source3/rpc_server/ntsvcs/srv_ntsvcs_nt.c
++++ b/source3/rpc_server/ntsvcs/srv_ntsvcs_nt.c
+@@ -227,7 +227,7 @@ WERROR _PNP_HwProfFlags(struct pipes_str
+ WERROR _PNP_Disconnect(struct pipes_struct *p,
+ 		       struct PNP_Disconnect *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -237,7 +237,7 @@ WERROR _PNP_Disconnect(struct pipes_stru
+ WERROR _PNP_Connect(struct pipes_struct *p,
+ 		    struct PNP_Connect *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -247,7 +247,7 @@ WERROR _PNP_Connect(struct pipes_struct
+ WERROR _PNP_GetGlobalState(struct pipes_struct *p,
+ 			   struct PNP_GetGlobalState *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -257,7 +257,7 @@ WERROR _PNP_GetGlobalState(struct pipes_
+ WERROR _PNP_InitDetection(struct pipes_struct *p,
+ 			  struct PNP_InitDetection *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -267,7 +267,7 @@ WERROR _PNP_InitDetection(struct pipes_s
+ WERROR _PNP_ReportLogOn(struct pipes_struct *p,
+ 			struct PNP_ReportLogOn *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -277,7 +277,7 @@ WERROR _PNP_ReportLogOn(struct pipes_str
+ WERROR _PNP_GetRootDeviceInstance(struct pipes_struct *p,
+ 				  struct PNP_GetRootDeviceInstance *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -287,7 +287,7 @@ WERROR _PNP_GetRootDeviceInstance(struct
+ WERROR _PNP_GetRelatedDeviceInstance(struct pipes_struct *p,
+ 				     struct PNP_GetRelatedDeviceInstance *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -297,7 +297,7 @@ WERROR _PNP_GetRelatedDeviceInstance(str
+ WERROR _PNP_EnumerateSubKeys(struct pipes_struct *p,
+ 			     struct PNP_EnumerateSubKeys *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -307,7 +307,7 @@ WERROR _PNP_EnumerateSubKeys(struct pipe
+ WERROR _PNP_GetDepth(struct pipes_struct *p,
+ 		     struct PNP_GetDepth *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -317,7 +317,7 @@ WERROR _PNP_GetDepth(struct pipes_struct
+ WERROR _PNP_SetDeviceRegProp(struct pipes_struct *p,
+ 			     struct PNP_SetDeviceRegProp *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -327,7 +327,7 @@ WERROR _PNP_SetDeviceRegProp(struct pipe
+ WERROR _PNP_GetClassInstance(struct pipes_struct *p,
+ 			     struct PNP_GetClassInstance *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -337,7 +337,7 @@ WERROR _PNP_GetClassInstance(struct pipe
+ WERROR _PNP_CreateKey(struct pipes_struct *p,
+ 		      struct PNP_CreateKey *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -347,7 +347,7 @@ WERROR _PNP_CreateKey(struct pipes_struc
+ WERROR _PNP_DeleteRegistryKey(struct pipes_struct *p,
+ 			      struct PNP_DeleteRegistryKey *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -357,7 +357,7 @@ WERROR _PNP_DeleteRegistryKey(struct pip
+ WERROR _PNP_GetClassCount(struct pipes_struct *p,
+ 			  struct PNP_GetClassCount *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -367,7 +367,7 @@ WERROR _PNP_GetClassCount(struct pipes_s
+ WERROR _PNP_GetClassName(struct pipes_struct *p,
+ 			 struct PNP_GetClassName *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -377,7 +377,7 @@ WERROR _PNP_GetClassName(struct pipes_st
+ WERROR _PNP_DeleteClassKey(struct pipes_struct *p,
+ 			   struct PNP_DeleteClassKey *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -387,7 +387,7 @@ WERROR _PNP_DeleteClassKey(struct pipes_
+ WERROR _PNP_GetInterfaceDeviceAlias(struct pipes_struct *p,
+ 				    struct PNP_GetInterfaceDeviceAlias *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -397,7 +397,7 @@ WERROR _PNP_GetInterfaceDeviceAlias(stru
+ WERROR _PNP_GetInterfaceDeviceList(struct pipes_struct *p,
+ 				   struct PNP_GetInterfaceDeviceList *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -407,7 +407,7 @@ WERROR _PNP_GetInterfaceDeviceList(struc
+ WERROR _PNP_GetInterfaceDeviceListSize(struct pipes_struct *p,
+ 				       struct PNP_GetInterfaceDeviceListSize *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -417,7 +417,7 @@ WERROR _PNP_GetInterfaceDeviceListSize(s
+ WERROR _PNP_RegisterDeviceClassAssociation(struct pipes_struct *p,
+ 					   struct PNP_RegisterDeviceClassAssociation *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -427,7 +427,7 @@ WERROR _PNP_RegisterDeviceClassAssociati
+ WERROR _PNP_UnregisterDeviceClassAssociation(struct pipes_struct *p,
+ 					     struct PNP_UnregisterDeviceClassAssociation *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -437,7 +437,7 @@ WERROR _PNP_UnregisterDeviceClassAssocia
+ WERROR _PNP_GetClassRegProp(struct pipes_struct *p,
+ 			    struct PNP_GetClassRegProp *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -447,7 +447,7 @@ WERROR _PNP_GetClassRegProp(struct pipes
+ WERROR _PNP_SetClassRegProp(struct pipes_struct *p,
+ 			    struct PNP_SetClassRegProp *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -457,7 +457,7 @@ WERROR _PNP_SetClassRegProp(struct pipes
+ WERROR _PNP_CreateDevInst(struct pipes_struct *p,
+ 			  struct PNP_CreateDevInst *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -467,7 +467,7 @@ WERROR _PNP_CreateDevInst(struct pipes_s
+ WERROR _PNP_DeviceInstanceAction(struct pipes_struct *p,
+ 				 struct PNP_DeviceInstanceAction *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -477,7 +477,7 @@ WERROR _PNP_DeviceInstanceAction(struct
+ WERROR _PNP_GetDeviceStatus(struct pipes_struct *p,
+ 			    struct PNP_GetDeviceStatus *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -487,7 +487,7 @@ WERROR _PNP_GetDeviceStatus(struct pipes
+ WERROR _PNP_SetDeviceProblem(struct pipes_struct *p,
+ 			     struct PNP_SetDeviceProblem *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -497,7 +497,7 @@ WERROR _PNP_SetDeviceProblem(struct pipe
+ WERROR _PNP_DisableDevInst(struct pipes_struct *p,
+ 			   struct PNP_DisableDevInst *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -507,7 +507,7 @@ WERROR _PNP_DisableDevInst(struct pipes_
+ WERROR _PNP_UninstallDevInst(struct pipes_struct *p,
+ 			     struct PNP_UninstallDevInst *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -517,7 +517,7 @@ WERROR _PNP_UninstallDevInst(struct pipe
+ WERROR _PNP_AddID(struct pipes_struct *p,
+ 		  struct PNP_AddID *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -527,7 +527,7 @@ WERROR _PNP_AddID(struct pipes_struct *p
+ WERROR _PNP_RegisterDriver(struct pipes_struct *p,
+ 			   struct PNP_RegisterDriver *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -537,7 +537,7 @@ WERROR _PNP_RegisterDriver(struct pipes_
+ WERROR _PNP_QueryRemove(struct pipes_struct *p,
+ 			struct PNP_QueryRemove *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -547,7 +547,7 @@ WERROR _PNP_QueryRemove(struct pipes_str
+ WERROR _PNP_RequestDeviceEject(struct pipes_struct *p,
+ 			       struct PNP_RequestDeviceEject *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -557,7 +557,7 @@ WERROR _PNP_RequestDeviceEject(struct pi
+ WERROR _PNP_IsDockStationPresent(struct pipes_struct *p,
+ 				 struct PNP_IsDockStationPresent *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -567,7 +567,7 @@ WERROR _PNP_IsDockStationPresent(struct
+ WERROR _PNP_RequestEjectPC(struct pipes_struct *p,
+ 			   struct PNP_RequestEjectPC *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -577,7 +577,7 @@ WERROR _PNP_RequestEjectPC(struct pipes_
+ WERROR _PNP_AddEmptyLogConf(struct pipes_struct *p,
+ 			    struct PNP_AddEmptyLogConf *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -587,7 +587,7 @@ WERROR _PNP_AddEmptyLogConf(struct pipes
+ WERROR _PNP_FreeLogConf(struct pipes_struct *p,
+ 			struct PNP_FreeLogConf *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -597,7 +597,7 @@ WERROR _PNP_FreeLogConf(struct pipes_str
+ WERROR _PNP_GetFirstLogConf(struct pipes_struct *p,
+ 			    struct PNP_GetFirstLogConf *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -607,7 +607,7 @@ WERROR _PNP_GetFirstLogConf(struct pipes
+ WERROR _PNP_GetNextLogConf(struct pipes_struct *p,
+ 			   struct PNP_GetNextLogConf *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -617,7 +617,7 @@ WERROR _PNP_GetNextLogConf(struct pipes_
+ WERROR _PNP_GetLogConfPriority(struct pipes_struct *p,
+ 			       struct PNP_GetLogConfPriority *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -627,7 +627,7 @@ WERROR _PNP_GetLogConfPriority(struct pi
+ WERROR _PNP_AddResDes(struct pipes_struct *p,
+ 		      struct PNP_AddResDes *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -637,7 +637,7 @@ WERROR _PNP_AddResDes(struct pipes_struc
+ WERROR _PNP_FreeResDes(struct pipes_struct *p,
+ 		       struct PNP_FreeResDes *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -647,7 +647,7 @@ WERROR _PNP_FreeResDes(struct pipes_stru
+ WERROR _PNP_GetNextResDes(struct pipes_struct *p,
+ 			  struct PNP_GetNextResDes *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -657,7 +657,7 @@ WERROR _PNP_GetNextResDes(struct pipes_s
+ WERROR _PNP_GetResDesData(struct pipes_struct *p,
+ 			  struct PNP_GetResDesData *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -667,7 +667,7 @@ WERROR _PNP_GetResDesData(struct pipes_s
+ WERROR _PNP_GetResDesDataSize(struct pipes_struct *p,
+ 			      struct PNP_GetResDesDataSize *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -677,7 +677,7 @@ WERROR _PNP_GetResDesDataSize(struct pip
+ WERROR _PNP_ModifyResDes(struct pipes_struct *p,
+ 			 struct PNP_ModifyResDes *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -687,7 +687,7 @@ WERROR _PNP_ModifyResDes(struct pipes_st
+ WERROR _PNP_DetectResourceLimit(struct pipes_struct *p,
+ 				struct PNP_DetectResourceLimit *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -697,7 +697,7 @@ WERROR _PNP_DetectResourceLimit(struct p
+ WERROR _PNP_QueryResConfList(struct pipes_struct *p,
+ 			     struct PNP_QueryResConfList *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -707,7 +707,7 @@ WERROR _PNP_QueryResConfList(struct pipe
+ WERROR _PNP_SetHwProf(struct pipes_struct *p,
+ 		      struct PNP_SetHwProf *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -717,7 +717,7 @@ WERROR _PNP_SetHwProf(struct pipes_struc
+ WERROR _PNP_QueryArbitratorFreeData(struct pipes_struct *p,
+ 				    struct PNP_QueryArbitratorFreeData *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -727,7 +727,7 @@ WERROR _PNP_QueryArbitratorFreeData(stru
+ WERROR _PNP_QueryArbitratorFreeSize(struct pipes_struct *p,
+ 				    struct PNP_QueryArbitratorFreeSize *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -737,7 +737,7 @@ WERROR _PNP_QueryArbitratorFreeSize(stru
+ WERROR _PNP_RunDetection(struct pipes_struct *p,
+ 			 struct PNP_RunDetection *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -747,7 +747,7 @@ WERROR _PNP_RunDetection(struct pipes_st
+ WERROR _PNP_RegisterNotification(struct pipes_struct *p,
+ 				 struct PNP_RegisterNotification *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -757,7 +757,7 @@ WERROR _PNP_RegisterNotification(struct
+ WERROR _PNP_UnregisterNotification(struct pipes_struct *p,
+ 				   struct PNP_UnregisterNotification *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -767,7 +767,7 @@ WERROR _PNP_UnregisterNotification(struc
+ WERROR _PNP_GetCustomDevProp(struct pipes_struct *p,
+ 			     struct PNP_GetCustomDevProp *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -777,7 +777,7 @@ WERROR _PNP_GetCustomDevProp(struct pipe
+ WERROR _PNP_GetVersionInternal(struct pipes_struct *p,
+ 			       struct PNP_GetVersionInternal *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -787,7 +787,7 @@ WERROR _PNP_GetVersionInternal(struct pi
+ WERROR _PNP_GetBlockedDriverInfo(struct pipes_struct *p,
+ 				 struct PNP_GetBlockedDriverInfo *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -797,6 +797,6 @@ WERROR _PNP_GetBlockedDriverInfo(struct
+ WERROR _PNP_GetServerSideDeviceInstallFlags(struct pipes_struct *p,
+ 					    struct PNP_GetServerSideDeviceInstallFlags *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+--- a/source3/rpc_server/rpc_handles.c
++++ b/source3/rpc_server/rpc_handles.c
+@@ -242,7 +242,7 @@ static struct dcesrv_handle *find_policy
+ 	DEBUG(4,("Policy not found: "));
+ 	dump_data(4, (uint8_t *)hnd, sizeof(*hnd));
+ 
+-	p->bad_handle_fault_state = true;
++	p->fault_state = DCERPC_FAULT_CONTEXT_MISMATCH;
+ 
+ 	return NULL;
+ }
+--- a/source3/rpc_server/rpc_ncacn_np.c
++++ b/source3/rpc_server/rpc_ncacn_np.c
+@@ -216,24 +216,13 @@ static NTSTATUS rpcint_dispatch(struct p
+ 	}
+ 
+ 	if (p->fault_state) {
+-		p->fault_state = false;
+-		data_blob_free(&p->out_data.rdata);
+-		talloc_free_children(p->mem_ctx);
+-		return NT_STATUS_RPC_CALL_FAILED;
+-	}
+-
+-	if (p->bad_handle_fault_state) {
+-		p->bad_handle_fault_state = false;
+-		data_blob_free(&p->out_data.rdata);
+-		talloc_free_children(p->mem_ctx);
+-		return NT_STATUS_RPC_SS_CONTEXT_MISMATCH;
+-	}
++		NTSTATUS status;
+ 
+-	if (p->rng_fault_state) {
+-		p->rng_fault_state = false;
++		status = NT_STATUS(p->fault_state);
++		p->fault_state = 0;
+ 		data_blob_free(&p->out_data.rdata);
+ 		talloc_free_children(p->mem_ctx);
+-		return NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE;
++		return status;
+ 	}
+ 
+ 	*out_data = p->out_data.rdata;
+--- a/source3/rpc_server/samr/srv_samr_nt.c
++++ b/source3/rpc_server/samr/srv_samr_nt.c
+@@ -6682,7 +6682,7 @@ NTSTATUS _samr_ValidatePassword(struct p
+ NTSTATUS _samr_Shutdown(struct pipes_struct *p,
+ 			struct samr_Shutdown *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -6692,7 +6692,7 @@ NTSTATUS _samr_Shutdown(struct pipes_str
+ NTSTATUS _samr_SetMemberAttributesOfGroup(struct pipes_struct *p,
+ 					  struct samr_SetMemberAttributesOfGroup *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -6702,6 +6702,7 @@ NTSTATUS _samr_SetMemberAttributesOfGrou
+ NTSTATUS _samr_TestPrivateFunctionsDomain(struct pipes_struct *p,
+ 					  struct samr_TestPrivateFunctionsDomain *r)
+ {
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -6711,6 +6712,7 @@ NTSTATUS _samr_TestPrivateFunctionsDomai
+ NTSTATUS _samr_TestPrivateFunctionsUser(struct pipes_struct *p,
+ 					struct samr_TestPrivateFunctionsUser *r)
+ {
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -6720,7 +6722,7 @@ NTSTATUS _samr_TestPrivateFunctionsUser(
+ NTSTATUS _samr_AddMultipleMembersToAlias(struct pipes_struct *p,
+ 					 struct samr_AddMultipleMembersToAlias *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -6730,7 +6732,7 @@ NTSTATUS _samr_AddMultipleMembersToAlias
+ NTSTATUS _samr_RemoveMultipleMembersFromAlias(struct pipes_struct *p,
+ 					      struct samr_RemoveMultipleMembersFromAlias *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -6740,7 +6742,7 @@ NTSTATUS _samr_RemoveMultipleMembersFrom
+ NTSTATUS _samr_SetBootKeyInformation(struct pipes_struct *p,
+ 				     struct samr_SetBootKeyInformation *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -6750,7 +6752,7 @@ NTSTATUS _samr_SetBootKeyInformation(str
+ NTSTATUS _samr_GetBootKeyInformation(struct pipes_struct *p,
+ 				     struct samr_GetBootKeyInformation *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ 
+@@ -6760,6 +6762,6 @@ NTSTATUS _samr_GetBootKeyInformation(str
+ NTSTATUS _samr_SetDsrmPassword(struct pipes_struct *p,
+ 			       struct samr_SetDsrmPassword *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return NT_STATUS_NOT_IMPLEMENTED;
+ }
+--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
+@@ -10156,7 +10156,7 @@ WERROR _spoolss_AddPort(struct pipes_str
+ WERROR _spoolss_GetPrinterDriver(struct pipes_struct *p,
+ 				 struct spoolss_GetPrinterDriver *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10167,7 +10167,7 @@ WERROR _spoolss_GetPrinterDriver(struct
+ WERROR _spoolss_ReadPrinter(struct pipes_struct *p,
+ 			    struct spoolss_ReadPrinter *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10178,7 +10178,7 @@ WERROR _spoolss_ReadPrinter(struct pipes
+ WERROR _spoolss_WaitForPrinterChange(struct pipes_struct *p,
+ 				     struct spoolss_WaitForPrinterChange *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10189,7 +10189,7 @@ WERROR _spoolss_WaitForPrinterChange(str
+ WERROR _spoolss_ConfigurePort(struct pipes_struct *p,
+ 			      struct spoolss_ConfigurePort *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10200,7 +10200,7 @@ WERROR _spoolss_ConfigurePort(struct pip
+ WERROR _spoolss_DeletePort(struct pipes_struct *p,
+ 			   struct spoolss_DeletePort *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10211,7 +10211,7 @@ WERROR _spoolss_DeletePort(struct pipes_
+ WERROR _spoolss_CreatePrinterIC(struct pipes_struct *p,
+ 				struct spoolss_CreatePrinterIC *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10222,7 +10222,7 @@ WERROR _spoolss_CreatePrinterIC(struct p
+ WERROR _spoolss_PlayGDIScriptOnPrinterIC(struct pipes_struct *p,
+ 					 struct spoolss_PlayGDIScriptOnPrinterIC *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10233,7 +10233,7 @@ WERROR _spoolss_PlayGDIScriptOnPrinterIC
+ WERROR _spoolss_DeletePrinterIC(struct pipes_struct *p,
+ 				struct spoolss_DeletePrinterIC *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10244,7 +10244,7 @@ WERROR _spoolss_DeletePrinterIC(struct p
+ WERROR _spoolss_AddPrinterConnection(struct pipes_struct *p,
+ 				     struct spoolss_AddPrinterConnection *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10255,7 +10255,7 @@ WERROR _spoolss_AddPrinterConnection(str
+ WERROR _spoolss_DeletePrinterConnection(struct pipes_struct *p,
+ 					struct spoolss_DeletePrinterConnection *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10266,7 +10266,7 @@ WERROR _spoolss_DeletePrinterConnection(
+ WERROR _spoolss_PrinterMessageBox(struct pipes_struct *p,
+ 				  struct spoolss_PrinterMessageBox *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10277,7 +10277,7 @@ WERROR _spoolss_PrinterMessageBox(struct
+ WERROR _spoolss_AddMonitor(struct pipes_struct *p,
+ 			   struct spoolss_AddMonitor *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10288,7 +10288,7 @@ WERROR _spoolss_AddMonitor(struct pipes_
+ WERROR _spoolss_DeleteMonitor(struct pipes_struct *p,
+ 			      struct spoolss_DeleteMonitor *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10299,7 +10299,7 @@ WERROR _spoolss_DeleteMonitor(struct pip
+ WERROR _spoolss_DeletePrintProcessor(struct pipes_struct *p,
+ 				     struct spoolss_DeletePrintProcessor *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10310,7 +10310,7 @@ WERROR _spoolss_DeletePrintProcessor(str
+ WERROR _spoolss_AddPrintProvidor(struct pipes_struct *p,
+ 				 struct spoolss_AddPrintProvidor *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10321,7 +10321,7 @@ WERROR _spoolss_AddPrintProvidor(struct
+ WERROR _spoolss_DeletePrintProvidor(struct pipes_struct *p,
+ 				    struct spoolss_DeletePrintProvidor *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10332,7 +10332,7 @@ WERROR _spoolss_DeletePrintProvidor(stru
+ WERROR _spoolss_FindFirstPrinterChangeNotification(struct pipes_struct *p,
+ 						   struct spoolss_FindFirstPrinterChangeNotification *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10343,7 +10343,7 @@ WERROR _spoolss_FindFirstPrinterChangeNo
+ WERROR _spoolss_FindNextPrinterChangeNotification(struct pipes_struct *p,
+ 						  struct spoolss_FindNextPrinterChangeNotification *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10354,7 +10354,7 @@ WERROR _spoolss_FindNextPrinterChangeNot
+ WERROR _spoolss_RouterFindFirstPrinterChangeNotificationOld(struct pipes_struct *p,
+ 							    struct spoolss_RouterFindFirstPrinterChangeNotificationOld *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10365,7 +10365,7 @@ WERROR _spoolss_RouterFindFirstPrinterCh
+ WERROR _spoolss_ReplyOpenPrinter(struct pipes_struct *p,
+ 				 struct spoolss_ReplyOpenPrinter *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10376,7 +10376,7 @@ WERROR _spoolss_ReplyOpenPrinter(struct
+ WERROR _spoolss_RouterReplyPrinter(struct pipes_struct *p,
+ 				   struct spoolss_RouterReplyPrinter *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10387,7 +10387,7 @@ WERROR _spoolss_RouterReplyPrinter(struc
+ WERROR _spoolss_ReplyClosePrinter(struct pipes_struct *p,
+ 				  struct spoolss_ReplyClosePrinter *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10398,7 +10398,7 @@ WERROR _spoolss_ReplyClosePrinter(struct
+ WERROR _spoolss_AddPortEx(struct pipes_struct *p,
+ 			  struct spoolss_AddPortEx *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10409,7 +10409,7 @@ WERROR _spoolss_AddPortEx(struct pipes_s
+ WERROR _spoolss_RouterFindFirstPrinterChangeNotification(struct pipes_struct *p,
+ 							 struct spoolss_RouterFindFirstPrinterChangeNotification *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10420,7 +10420,7 @@ WERROR _spoolss_RouterFindFirstPrinterCh
+ WERROR _spoolss_SpoolerInit(struct pipes_struct *p,
+ 			    struct spoolss_SpoolerInit *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10431,7 +10431,7 @@ WERROR _spoolss_SpoolerInit(struct pipes
+ WERROR _spoolss_ResetPrinterEx(struct pipes_struct *p,
+ 			       struct spoolss_ResetPrinterEx *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10442,7 +10442,7 @@ WERROR _spoolss_ResetPrinterEx(struct pi
+ WERROR _spoolss_RouterReplyPrinterEx(struct pipes_struct *p,
+ 				     struct spoolss_RouterReplyPrinterEx *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10453,7 +10453,7 @@ WERROR _spoolss_RouterReplyPrinterEx(str
+ WERROR _spoolss_44(struct pipes_struct *p,
+ 		   struct spoolss_44 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10464,7 +10464,7 @@ WERROR _spoolss_44(struct pipes_struct *
+ WERROR _spoolss_SetPort(struct pipes_struct *p,
+ 			struct spoolss_SetPort *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10475,7 +10475,7 @@ WERROR _spoolss_SetPort(struct pipes_str
+ WERROR _spoolss_4a(struct pipes_struct *p,
+ 		   struct spoolss_4a *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10486,7 +10486,7 @@ WERROR _spoolss_4a(struct pipes_struct *
+ WERROR _spoolss_4b(struct pipes_struct *p,
+ 		   struct spoolss_4b *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10497,7 +10497,7 @@ WERROR _spoolss_4b(struct pipes_struct *
+ WERROR _spoolss_4c(struct pipes_struct *p,
+ 		   struct spoolss_4c *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10508,7 +10508,7 @@ WERROR _spoolss_4c(struct pipes_struct *
+ WERROR _spoolss_53(struct pipes_struct *p,
+ 		   struct spoolss_53 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10519,7 +10519,7 @@ WERROR _spoolss_53(struct pipes_struct *
+ WERROR _spoolss_AddPerMachineConnection(struct pipes_struct *p,
+ 					struct spoolss_AddPerMachineConnection *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10530,7 +10530,7 @@ WERROR _spoolss_AddPerMachineConnection(
+ WERROR _spoolss_DeletePerMachineConnection(struct pipes_struct *p,
+ 					   struct spoolss_DeletePerMachineConnection *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10541,7 +10541,7 @@ WERROR _spoolss_DeletePerMachineConnecti
+ WERROR _spoolss_EnumPerMachineConnections(struct pipes_struct *p,
+ 					  struct spoolss_EnumPerMachineConnections *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10552,7 +10552,7 @@ WERROR _spoolss_EnumPerMachineConnection
+ WERROR _spoolss_5a(struct pipes_struct *p,
+ 		   struct spoolss_5a *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10563,7 +10563,7 @@ WERROR _spoolss_5a(struct pipes_struct *
+ WERROR _spoolss_5b(struct pipes_struct *p,
+ 		   struct spoolss_5b *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10574,7 +10574,7 @@ WERROR _spoolss_5b(struct pipes_struct *
+ WERROR _spoolss_5c(struct pipes_struct *p,
+ 		   struct spoolss_5c *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10585,7 +10585,7 @@ WERROR _spoolss_5c(struct pipes_struct *
+ WERROR _spoolss_5d(struct pipes_struct *p,
+ 		   struct spoolss_5d *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10596,7 +10596,7 @@ WERROR _spoolss_5d(struct pipes_struct *
+ WERROR _spoolss_5e(struct pipes_struct *p,
+ 		   struct spoolss_5e *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10607,7 +10607,7 @@ WERROR _spoolss_5e(struct pipes_struct *
+ WERROR _spoolss_5f(struct pipes_struct *p,
+ 		   struct spoolss_5f *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10618,7 +10618,7 @@ WERROR _spoolss_5f(struct pipes_struct *
+ WERROR _spoolss_60(struct pipes_struct *p,
+ 		   struct spoolss_60 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10629,7 +10629,7 @@ WERROR _spoolss_60(struct pipes_struct *
+ WERROR _spoolss_61(struct pipes_struct *p,
+ 		   struct spoolss_61 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10640,7 +10640,7 @@ WERROR _spoolss_61(struct pipes_struct *
+ WERROR _spoolss_62(struct pipes_struct *p,
+ 		   struct spoolss_62 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10651,7 +10651,7 @@ WERROR _spoolss_62(struct pipes_struct *
+ WERROR _spoolss_63(struct pipes_struct *p,
+ 		   struct spoolss_63 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10662,7 +10662,7 @@ WERROR _spoolss_63(struct pipes_struct *
+ WERROR _spoolss_64(struct pipes_struct *p,
+ 		   struct spoolss_64 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10673,7 +10673,7 @@ WERROR _spoolss_64(struct pipes_struct *
+ WERROR _spoolss_65(struct pipes_struct *p,
+ 		   struct spoolss_65 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10684,7 +10684,7 @@ WERROR _spoolss_65(struct pipes_struct *
+ WERROR _spoolss_GetCorePrinterDrivers(struct pipes_struct *p,
+ 				      struct spoolss_GetCorePrinterDrivers *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10695,7 +10695,7 @@ WERROR _spoolss_GetCorePrinterDrivers(st
+ WERROR _spoolss_67(struct pipes_struct *p,
+ 		   struct spoolss_67 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10706,7 +10706,7 @@ WERROR _spoolss_67(struct pipes_struct *
+ WERROR _spoolss_GetPrinterDriverPackagePath(struct pipes_struct *p,
+ 					    struct spoolss_GetPrinterDriverPackagePath *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10717,7 +10717,7 @@ WERROR _spoolss_GetPrinterDriverPackageP
+ WERROR _spoolss_69(struct pipes_struct *p,
+ 		   struct spoolss_69 *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10728,7 +10728,7 @@ WERROR _spoolss_69(struct pipes_struct *
+ WERROR _spoolss_6a(struct pipes_struct *p,
+ 		   struct spoolss_6a *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10739,7 +10739,7 @@ WERROR _spoolss_6a(struct pipes_struct *
+ WERROR _spoolss_6b(struct pipes_struct *p,
+ 		   struct spoolss_6b *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10750,7 +10750,7 @@ WERROR _spoolss_6b(struct pipes_struct *
+ WERROR _spoolss_6c(struct pipes_struct *p,
+ 		   struct spoolss_6c *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -10761,6 +10761,6 @@ WERROR _spoolss_6c(struct pipes_struct *
+ WERROR _spoolss_6d(struct pipes_struct *p,
+ 		   struct spoolss_6d *r)
+ {
+-	p->rng_fault_state = true;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
++++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
+@@ -2548,244 +2548,244 @@ WERROR _srvsvc_NetFileClose(struct pipes
+ WERROR _srvsvc_NetCharDevEnum(struct pipes_struct *p,
+ 			      struct srvsvc_NetCharDevEnum *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetCharDevGetInfo(struct pipes_struct *p,
+ 				 struct srvsvc_NetCharDevGetInfo *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetCharDevControl(struct pipes_struct *p,
+ 				 struct srvsvc_NetCharDevControl *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetCharDevQEnum(struct pipes_struct *p,
+ 			       struct srvsvc_NetCharDevQEnum *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetCharDevQGetInfo(struct pipes_struct *p,
+ 				  struct srvsvc_NetCharDevQGetInfo *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetCharDevQSetInfo(struct pipes_struct *p,
+ 				  struct srvsvc_NetCharDevQSetInfo *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetCharDevQPurge(struct pipes_struct *p,
+ 				struct srvsvc_NetCharDevQPurge *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetCharDevQPurgeSelf(struct pipes_struct *p,
+ 				    struct srvsvc_NetCharDevQPurgeSelf *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetFileGetInfo(struct pipes_struct *p,
+ 			      struct srvsvc_NetFileGetInfo *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetShareCheck(struct pipes_struct *p,
+ 			     struct srvsvc_NetShareCheck *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetServerStatisticsGet(struct pipes_struct *p,
+ 				      struct srvsvc_NetServerStatisticsGet *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetTransportAdd(struct pipes_struct *p,
+ 			       struct srvsvc_NetTransportAdd *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetTransportEnum(struct pipes_struct *p,
+ 				struct srvsvc_NetTransportEnum *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetTransportDel(struct pipes_struct *p,
+ 			       struct srvsvc_NetTransportDel *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetSetServiceBits(struct pipes_struct *p,
+ 				 struct srvsvc_NetSetServiceBits *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetPathType(struct pipes_struct *p,
+ 			   struct srvsvc_NetPathType *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetPathCanonicalize(struct pipes_struct *p,
+ 				   struct srvsvc_NetPathCanonicalize *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetPathCompare(struct pipes_struct *p,
+ 			      struct srvsvc_NetPathCompare *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRPRNAMECANONICALIZE(struct pipes_struct *p,
+ 				      struct srvsvc_NETRPRNAMECANONICALIZE *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetPRNameCompare(struct pipes_struct *p,
+ 				struct srvsvc_NetPRNameCompare *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetShareDelStart(struct pipes_struct *p,
+ 				struct srvsvc_NetShareDelStart *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetShareDelCommit(struct pipes_struct *p,
+ 				 struct srvsvc_NetShareDelCommit *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetServerTransportAddEx(struct pipes_struct *p,
+ 				       struct srvsvc_NetServerTransportAddEx *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NetServerSetServiceBitsEx(struct pipes_struct *p,
+ 					 struct srvsvc_NetServerSetServiceBitsEx *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRDFSGETVERSION(struct pipes_struct *p,
+ 				 struct srvsvc_NETRDFSGETVERSION *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRDFSCREATELOCALPARTITION(struct pipes_struct *p,
+ 					   struct srvsvc_NETRDFSCREATELOCALPARTITION *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRDFSDELETELOCALPARTITION(struct pipes_struct *p,
+ 					   struct srvsvc_NETRDFSDELETELOCALPARTITION *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRDFSSETLOCALVOLUMESTATE(struct pipes_struct *p,
+ 					  struct srvsvc_NETRDFSSETLOCALVOLUMESTATE *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRDFSSETSERVERINFO(struct pipes_struct *p,
+ 				    struct srvsvc_NETRDFSSETSERVERINFO *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRDFSCREATEEXITPOINT(struct pipes_struct *p,
+ 				      struct srvsvc_NETRDFSCREATEEXITPOINT *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRDFSDELETEEXITPOINT(struct pipes_struct *p,
+ 				      struct srvsvc_NETRDFSDELETEEXITPOINT *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRDFSMODIFYPREFIX(struct pipes_struct *p,
+ 				   struct srvsvc_NETRDFSMODIFYPREFIX *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRDFSFIXLOCALVOLUME(struct pipes_struct *p,
+ 				     struct srvsvc_NETRDFSFIXLOCALVOLUME *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRDFSMANAGERREPORTSITEINFO(struct pipes_struct *p,
+ 					    struct srvsvc_NETRDFSMANAGERREPORTSITEINFO *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _srvsvc_NETRSERVERTRANSPORTDELEX(struct pipes_struct *p,
+ 					struct srvsvc_NETRSERVERTRANSPORTDELEX *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+--- a/source3/rpc_server/svcctl/srv_svcctl_nt.c
++++ b/source3/rpc_server/svcctl/srv_svcctl_nt.c
+@@ -1004,195 +1004,195 @@ WERROR _svcctl_SetServiceObjectSecurity(
+ WERROR _svcctl_DeleteService(struct pipes_struct *p,
+ 			     struct svcctl_DeleteService *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_SetServiceStatus(struct pipes_struct *p,
+ 				struct svcctl_SetServiceStatus *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_NotifyBootConfigStatus(struct pipes_struct *p,
+ 				      struct svcctl_NotifyBootConfigStatus *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_SCSetServiceBitsW(struct pipes_struct *p,
+ 				 struct svcctl_SCSetServiceBitsW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_ChangeServiceConfigW(struct pipes_struct *p,
+ 				    struct svcctl_ChangeServiceConfigW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_CreateServiceW(struct pipes_struct *p,
+ 			      struct svcctl_CreateServiceW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_QueryServiceLockStatusW(struct pipes_struct *p,
+ 				       struct svcctl_QueryServiceLockStatusW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_GetServiceKeyNameW(struct pipes_struct *p,
+ 				  struct svcctl_GetServiceKeyNameW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_SCSetServiceBitsA(struct pipes_struct *p,
+ 				 struct svcctl_SCSetServiceBitsA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_ChangeServiceConfigA(struct pipes_struct *p,
+ 				    struct svcctl_ChangeServiceConfigA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_CreateServiceA(struct pipes_struct *p,
+ 			      struct svcctl_CreateServiceA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_EnumDependentServicesA(struct pipes_struct *p,
+ 				      struct svcctl_EnumDependentServicesA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_EnumServicesStatusA(struct pipes_struct *p,
+ 				   struct svcctl_EnumServicesStatusA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_OpenSCManagerA(struct pipes_struct *p,
+ 			      struct svcctl_OpenSCManagerA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_OpenServiceA(struct pipes_struct *p,
+ 			    struct svcctl_OpenServiceA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_QueryServiceConfigA(struct pipes_struct *p,
+ 				   struct svcctl_QueryServiceConfigA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_QueryServiceLockStatusA(struct pipes_struct *p,
+ 				       struct svcctl_QueryServiceLockStatusA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_StartServiceA(struct pipes_struct *p,
+ 			     struct svcctl_StartServiceA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_GetServiceDisplayNameA(struct pipes_struct *p,
+ 				      struct svcctl_GetServiceDisplayNameA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_GetServiceKeyNameA(struct pipes_struct *p,
+ 				  struct svcctl_GetServiceKeyNameA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_GetCurrentGroupeStateW(struct pipes_struct *p,
+ 				      struct svcctl_GetCurrentGroupeStateW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_EnumServiceGroupW(struct pipes_struct *p,
+ 				 struct svcctl_EnumServiceGroupW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_ChangeServiceConfig2A(struct pipes_struct *p,
+ 				     struct svcctl_ChangeServiceConfig2A *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_ChangeServiceConfig2W(struct pipes_struct *p,
+ 				     struct svcctl_ChangeServiceConfig2W *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_QueryServiceConfig2A(struct pipes_struct *p,
+ 				    struct svcctl_QueryServiceConfig2A *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _EnumServicesStatusExA(struct pipes_struct *p,
+ 			      struct EnumServicesStatusExA *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _EnumServicesStatusExW(struct pipes_struct *p,
+ 			      struct EnumServicesStatusExW *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+ WERROR _svcctl_SCSendTSMessage(struct pipes_struct *p,
+ 			       struct svcctl_SCSendTSMessage *r)
+ {
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+--- a/source3/rpc_server/winreg/srv_winreg_nt.c
++++ b/source3/rpc_server/winreg/srv_winreg_nt.c
+@@ -760,7 +760,7 @@ WERROR _winreg_SaveKeyEx(struct pipes_st
+ 	/* fill in your code here if you think this call should
+ 	   do anything */
+ 
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -948,7 +948,7 @@ WERROR _winreg_UnLoadKey(struct pipes_st
+ 	/* fill in your code here if you think this call should
+ 	   do anything */
+ 
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -962,7 +962,7 @@ WERROR _winreg_ReplaceKey(struct pipes_s
+ 	/* fill in your code here if you think this call should
+ 	   do anything */
+ 
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -976,7 +976,7 @@ WERROR _winreg_LoadKey(struct pipes_stru
+ 	/* fill in your code here if you think this call should
+ 	   do anything */
+ 
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -1139,6 +1139,6 @@ WERROR _winreg_DeleteKeyEx(struct pipes_
+ 	/* fill in your code here if you think this call should
+ 	   do anything */
+ 
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+--- a/source3/rpc_server/wkssvc/srv_wkssvc_nt.c
++++ b/source3/rpc_server/wkssvc/srv_wkssvc_nt.c
+@@ -405,7 +405,7 @@ WERROR _wkssvc_NetWkstaSetInfo(struct pi
+ 			       struct wkssvc_NetWkstaSetInfo *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -608,7 +608,7 @@ WERROR _wkssvc_NetrWkstaUserGetInfo(stru
+ 				    struct wkssvc_NetrWkstaUserGetInfo *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -619,7 +619,7 @@ WERROR _wkssvc_NetrWkstaUserSetInfo(stru
+ 				    struct wkssvc_NetrWkstaUserSetInfo *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -630,7 +630,7 @@ WERROR _wkssvc_NetWkstaTransportEnum(str
+ 				     struct wkssvc_NetWkstaTransportEnum *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -641,7 +641,7 @@ WERROR _wkssvc_NetrWkstaTransportAdd(str
+ 				     struct wkssvc_NetrWkstaTransportAdd *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -652,7 +652,7 @@ WERROR _wkssvc_NetrWkstaTransportDel(str
+ 				     struct wkssvc_NetrWkstaTransportDel *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -663,7 +663,7 @@ WERROR _wkssvc_NetrUseAdd(struct pipes_s
+ 			  struct wkssvc_NetrUseAdd *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -674,7 +674,7 @@ WERROR _wkssvc_NetrUseGetInfo(struct pip
+ 			      struct wkssvc_NetrUseGetInfo *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -685,7 +685,7 @@ WERROR _wkssvc_NetrUseDel(struct pipes_s
+ 			  struct wkssvc_NetrUseDel *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -696,7 +696,7 @@ WERROR _wkssvc_NetrUseEnum(struct pipes_
+ 			   struct wkssvc_NetrUseEnum *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -707,7 +707,7 @@ WERROR _wkssvc_NetrMessageBufferSend(str
+ 				     struct wkssvc_NetrMessageBufferSend *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -718,7 +718,7 @@ WERROR _wkssvc_NetrWorkstationStatistics
+ 					    struct wkssvc_NetrWorkstationStatisticsGet *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -729,7 +729,7 @@ WERROR _wkssvc_NetrLogonDomainNameAdd(st
+ 				      struct wkssvc_NetrLogonDomainNameAdd *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -740,7 +740,7 @@ WERROR _wkssvc_NetrLogonDomainNameDel(st
+ 				      struct wkssvc_NetrLogonDomainNameDel *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -751,7 +751,7 @@ WERROR _wkssvc_NetrJoinDomain(struct pip
+ 			      struct wkssvc_NetrJoinDomain *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -762,7 +762,7 @@ WERROR _wkssvc_NetrUnjoinDomain(struct p
+ 				struct wkssvc_NetrUnjoinDomain *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -773,7 +773,7 @@ WERROR _wkssvc_NetrRenameMachineInDomain
+ 					 struct wkssvc_NetrRenameMachineInDomain *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -784,7 +784,7 @@ WERROR _wkssvc_NetrValidateName(struct p
+ 				struct wkssvc_NetrValidateName *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -795,7 +795,7 @@ WERROR _wkssvc_NetrGetJoinInformation(st
+ 				      struct wkssvc_NetrGetJoinInformation *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -806,7 +806,7 @@ WERROR _wkssvc_NetrGetJoinableOus(struct
+ 				  struct wkssvc_NetrGetJoinableOus *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -962,6 +962,7 @@ WERROR _wkssvc_NetrRenameMachineInDomain
+ 					  struct wkssvc_NetrRenameMachineInDomain2 *r)
+ {
+ 	/* for now just return not supported */
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -972,7 +973,7 @@ WERROR _wkssvc_NetrValidateName2(struct
+ 				 struct wkssvc_NetrValidateName2 *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -983,7 +984,7 @@ WERROR _wkssvc_NetrGetJoinableOus2(struc
+ 				   struct wkssvc_NetrGetJoinableOus2 *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -994,7 +995,7 @@ WERROR _wkssvc_NetrAddAlternateComputerN
+ 					    struct wkssvc_NetrAddAlternateComputerName *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -1005,7 +1006,7 @@ WERROR _wkssvc_NetrRemoveAlternateComput
+ 					       struct wkssvc_NetrRemoveAlternateComputerName *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -1016,7 +1017,7 @@ WERROR _wkssvc_NetrSetPrimaryComputernam
+ 					  struct wkssvc_NetrSetPrimaryComputername *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+ 
+@@ -1027,6 +1028,6 @@ WERROR _wkssvc_NetrEnumerateComputerName
+ 					  struct wkssvc_NetrEnumerateComputerNames *r)
+ {
+ 	/* FIXME: Add implementation code here */
+-	p->rng_fault_state = True;
++	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ 	return WERR_NOT_SUPPORTED;
+ }
+--- a/libcli/auth/smbencrypt.c
++++ b/libcli/auth/smbencrypt.c
+@@ -355,11 +355,18 @@ DATA_BLOB NTLMv2_generate_names_blob(TAL
+ 	DATA_BLOB names_blob = data_blob_talloc(mem_ctx, NULL, 0);
+ 
+ 	/* Deliberately ignore return here.. */
+-	(void)msrpc_gen(mem_ctx, &names_blob,
+-		  "aaa",
+-		  MsvAvNbDomainName, domain,
+-		  MsvAvNbComputerName, hostname,
+-		  MsvAvEOL, "");
++	if (hostname != NULL) {
++		(void)msrpc_gen(mem_ctx, &names_blob,
++			  "aaa",
++			  MsvAvNbDomainName, domain,
++			  MsvAvNbComputerName, hostname,
++			  MsvAvEOL, "");
++	} else {
++		(void)msrpc_gen(mem_ctx, &names_blob,
++			  "aa",
++			  MsvAvNbDomainName, domain,
++			  MsvAvEOL, "");
++	}
+ 	return names_blob;
+ }
+ 
diff --git a/package/network/services/samba36/patches/021-CVE-preparation-v3-6-addition.patch b/package/network/services/samba36/patches/021-CVE-preparation-v3-6-addition.patch
new file mode 100644
index 0000000..dedd453
--- /dev/null
+++ b/package/network/services/samba36/patches/021-CVE-preparation-v3-6-addition.patch
@@ -0,0 +1,9515 @@
+--- a/source3/librpc/gen_ndr/srv_atsvc.c
++++ b/source3/librpc/gen_ndr/srv_atsvc.c
+@@ -51,7 +51,7 @@ static bool api_atsvc_JobAdd(struct pipe
+ 
+ 	r->out.result = _atsvc_JobAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -124,7 +124,7 @@ static bool api_atsvc_JobDel(struct pipe
+ 
+ 	r->out.result = _atsvc_JobDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -206,7 +206,7 @@ static bool api_atsvc_JobEnum(struct pip
+ 
+ 	r->out.result = _atsvc_JobEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -286,7 +286,7 @@ static bool api_atsvc_JobGetInfo(struct
+ 
+ 	r->out.result = _atsvc_JobGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_audiosrv.c
++++ b/source3/librpc/gen_ndr/srv_audiosrv.c
+@@ -44,7 +44,7 @@ static bool api_audiosrv_CreatezoneFacto
+ 
+ 	_audiosrv_CreatezoneFactoriesList(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_audiosrv_CreateGfxFactor
+ 
+ 	_audiosrv_CreateGfxFactoriesList(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_audiosrv_CreateGfxList(s
+ 
+ 	_audiosrv_CreateGfxList(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -263,7 +263,7 @@ static bool api_audiosrv_RemoveGfx(struc
+ 
+ 	_audiosrv_RemoveGfx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -336,7 +336,7 @@ static bool api_audiosrv_AddGfx(struct p
+ 
+ 	_audiosrv_AddGfx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -409,7 +409,7 @@ static bool api_audiosrv_ModifyGfx(struc
+ 
+ 	_audiosrv_ModifyGfx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -482,7 +482,7 @@ static bool api_audiosrv_OpenGfx(struct
+ 
+ 	_audiosrv_OpenGfx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -555,7 +555,7 @@ static bool api_audiosrv_Logon(struct pi
+ 
+ 	_audiosrv_Logon(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -628,7 +628,7 @@ static bool api_audiosrv_Logoff(struct p
+ 
+ 	_audiosrv_Logoff(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -701,7 +701,7 @@ static bool api_audiosrv_RegisterSession
+ 
+ 	_audiosrv_RegisterSessionNotificationEvent(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -774,7 +774,7 @@ static bool api_audiosrv_UnregisterSessi
+ 
+ 	_audiosrv_UnregisterSessionNotificationEvent(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -847,7 +847,7 @@ static bool api_audiosrv_SessionConnectS
+ 
+ 	_audiosrv_SessionConnectState(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -920,7 +920,7 @@ static bool api_audiosrv_DriverOpenDrvRe
+ 
+ 	_audiosrv_DriverOpenDrvRegKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -993,7 +993,7 @@ static bool api_audiosrv_AdvisePreferred
+ 
+ 	_audiosrv_AdvisePreferredDeviceChange(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1066,7 +1066,7 @@ static bool api_audiosrv_GetPnpInfo(stru
+ 
+ 	_audiosrv_GetPnpInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_backupkey.c
++++ b/source3/librpc/gen_ndr/srv_backupkey.c
+@@ -57,7 +57,7 @@ static bool api_bkrp_BackupKey(struct pi
+ 
+ 	r->out.result = _bkrp_BackupKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_browser.c
++++ b/source3/librpc/gen_ndr/srv_browser.c
+@@ -44,7 +44,7 @@ static bool api_BrowserrServerEnum(struc
+ 
+ 	_BrowserrServerEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_BrowserrDebugCall(struct
+ 
+ 	_BrowserrDebugCall(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -198,7 +198,7 @@ static bool api_BrowserrQueryOtherDomain
+ 
+ 	r->out.result = _BrowserrQueryOtherDomains(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -271,7 +271,7 @@ static bool api_BrowserrResetNetlogonSta
+ 
+ 	_BrowserrResetNetlogonState(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -344,7 +344,7 @@ static bool api_BrowserrDebugTrace(struc
+ 
+ 	_BrowserrDebugTrace(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -417,7 +417,7 @@ static bool api_BrowserrQueryStatistics(
+ 
+ 	_BrowserrQueryStatistics(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -490,7 +490,7 @@ static bool api_BrowserResetStatistics(s
+ 
+ 	_BrowserResetStatistics(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -563,7 +563,7 @@ static bool api_NetrBrowserStatisticsCle
+ 
+ 	_NetrBrowserStatisticsClear(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -636,7 +636,7 @@ static bool api_NetrBrowserStatisticsGet
+ 
+ 	_NetrBrowserStatisticsGet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -709,7 +709,7 @@ static bool api_BrowserrSetNetlogonState
+ 
+ 	_BrowserrSetNetlogonState(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -782,7 +782,7 @@ static bool api_BrowserrQueryEmulatedDom
+ 
+ 	_BrowserrQueryEmulatedDomains(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -855,7 +855,7 @@ static bool api_BrowserrServerEnumEx(str
+ 
+ 	_BrowserrServerEnumEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_dbgidl.c
++++ b/source3/librpc/gen_ndr/srv_dbgidl.c
+@@ -44,7 +44,7 @@ static bool api_dummy_dbgidl(struct pipe
+ 
+ 	_dummy_dbgidl(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_dcom.c
++++ b/source3/librpc/gen_ndr/srv_dcom.c
+@@ -44,7 +44,7 @@ static bool api_UseProtSeq(struct pipes_
+ 
+ 	_UseProtSeq(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_GetCustomProtseqInfo(str
+ 
+ 	_GetCustomProtseqInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_UpdateResolverBindings(s
+ 
+ 	_UpdateResolverBindings(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -300,7 +300,7 @@ static bool api_QueryInterface(struct pi
+ 
+ 	r->out.result = _QueryInterface(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -380,7 +380,7 @@ static bool api_AddRef(struct pipes_stru
+ 
+ 	r->out.result = _AddRef(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -460,7 +460,7 @@ static bool api_Release(struct pipes_str
+ 
+ 	r->out.result = _Release(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -570,7 +570,7 @@ static bool api_CreateInstance(struct pi
+ 
+ 	r->out.result = _CreateInstance(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -650,7 +650,7 @@ static bool api_RemoteCreateInstance(str
+ 
+ 	r->out.result = _RemoteCreateInstance(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -730,7 +730,7 @@ static bool api_LockServer(struct pipes_
+ 
+ 	r->out.result = _LockServer(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -810,7 +810,7 @@ static bool api_RemoteLockServer(struct
+ 
+ 	r->out.result = _RemoteLockServer(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -921,7 +921,7 @@ static bool api_RemQueryInterface(struct
+ 
+ 	r->out.result = _RemQueryInterface(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1007,7 +1007,7 @@ static bool api_RemAddRef(struct pipes_s
+ 
+ 	r->out.result = _RemAddRef(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1087,7 +1087,7 @@ static bool api_RemRelease(struct pipes_
+ 
+ 	r->out.result = _RemRelease(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1197,7 +1197,7 @@ static bool api_GetClassObject(struct pi
+ 
+ 	_GetClassObject(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1299,7 +1299,7 @@ static bool api_ISCMLocalActivator_Creat
+ 
+ 	r->out.result = _ISCMLocalActivator_CreateInstance(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1394,7 +1394,7 @@ static bool api_IMachineLocalActivator_f
+ 
+ 	r->out.result = _IMachineLocalActivator_foo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1489,7 +1489,7 @@ static bool api_ILocalObjectExporter_Foo
+ 
+ 	r->out.result = _ILocalObjectExporter_Foo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1603,7 +1603,7 @@ static bool api_ISystemActivatorRemoteCr
+ 
+ 	r->out.result = _ISystemActivatorRemoteCreateInstance(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1717,7 +1717,7 @@ static bool api_RemQueryInterface2(struc
+ 
+ 	r->out.result = _RemQueryInterface2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1825,7 +1825,7 @@ static bool api_GetTypeInfoCount(struct
+ 
+ 	r->out.result = _GetTypeInfoCount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1911,7 +1911,7 @@ static bool api_GetTypeInfo(struct pipes
+ 
+ 	r->out.result = _GetTypeInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1997,7 +1997,7 @@ static bool api_GetIDsOfNames(struct pip
+ 
+ 	r->out.result = _GetIDsOfNames(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2096,7 +2096,7 @@ static bool api_Invoke(struct pipes_stru
+ 
+ 	r->out.result = _Invoke(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2201,7 +2201,7 @@ static bool api_MarshalInterface(struct
+ 
+ 	r->out.result = _MarshalInterface(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2281,7 +2281,7 @@ static bool api_UnMarshalInterface(struc
+ 
+ 	r->out.result = _UnMarshalInterface(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2384,7 +2384,7 @@ static bool api_MakeCoffee(struct pipes_
+ 
+ 	r->out.result = _MakeCoffee(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2498,7 +2498,7 @@ static bool api_Read(struct pipes_struct
+ 
+ 	r->out.result = _Read(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2584,7 +2584,7 @@ static bool api_Write(struct pipes_struc
+ 
+ 	r->out.result = _Write(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_dfsblobs.c
++++ b/source3/librpc/gen_ndr/srv_dfsblobs.c
+@@ -51,7 +51,7 @@ static bool api_dfs_GetDFSReferral(struc
+ 
+ 	_dfs_GetDFSReferral(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_dfs.c
++++ b/source3/librpc/gen_ndr/srv_dfs.c
+@@ -51,7 +51,7 @@ static bool api_dfs_GetManagerVersion(st
+ 
+ 	_dfs_GetManagerVersion(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -124,7 +124,7 @@ static bool api_dfs_Add(struct pipes_str
+ 
+ 	r->out.result = _dfs_Add(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -197,7 +197,7 @@ static bool api_dfs_Remove(struct pipes_
+ 
+ 	r->out.result = _dfs_Remove(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -270,7 +270,7 @@ static bool api_dfs_SetInfo(struct pipes
+ 
+ 	r->out.result = _dfs_SetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -350,7 +350,7 @@ static bool api_dfs_GetInfo(struct pipes
+ 
+ 	r->out.result = _dfs_GetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -426,7 +426,7 @@ static bool api_dfs_Enum(struct pipes_st
+ 	r->out.total = r->in.total;
+ 	r->out.result = _dfs_Enum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -499,7 +499,7 @@ static bool api_dfs_Rename(struct pipes_
+ 
+ 	r->out.result = _dfs_Rename(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -572,7 +572,7 @@ static bool api_dfs_Move(struct pipes_st
+ 
+ 	r->out.result = _dfs_Move(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -645,7 +645,7 @@ static bool api_dfs_ManagerGetConfigInfo
+ 
+ 	r->out.result = _dfs_ManagerGetConfigInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -718,7 +718,7 @@ static bool api_dfs_ManagerSendSiteInfo(
+ 
+ 	r->out.result = _dfs_ManagerSendSiteInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -793,7 +793,7 @@ static bool api_dfs_AddFtRoot(struct pip
+ 	r->out.unknown2 = r->in.unknown2;
+ 	r->out.result = _dfs_AddFtRoot(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -868,7 +868,7 @@ static bool api_dfs_RemoveFtRoot(struct
+ 	r->out.unknown = r->in.unknown;
+ 	r->out.result = _dfs_RemoveFtRoot(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -941,7 +941,7 @@ static bool api_dfs_AddStdRoot(struct pi
+ 
+ 	r->out.result = _dfs_AddStdRoot(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1014,7 +1014,7 @@ static bool api_dfs_RemoveStdRoot(struct
+ 
+ 	r->out.result = _dfs_RemoveStdRoot(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1087,7 +1087,7 @@ static bool api_dfs_ManagerInitialize(st
+ 
+ 	r->out.result = _dfs_ManagerInitialize(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1160,7 +1160,7 @@ static bool api_dfs_AddStdRootForced(str
+ 
+ 	r->out.result = _dfs_AddStdRootForced(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1237,7 +1237,7 @@ static bool api_dfs_GetDcAddress(struct
+ 	r->out.ttl = r->in.ttl;
+ 	r->out.result = _dfs_GetDcAddress(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1310,7 +1310,7 @@ static bool api_dfs_SetDcAddress(struct
+ 
+ 	r->out.result = _dfs_SetDcAddress(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1383,7 +1383,7 @@ static bool api_dfs_FlushFtTable(struct
+ 
+ 	r->out.result = _dfs_FlushFtTable(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1456,7 +1456,7 @@ static bool api_dfs_Add2(struct pipes_st
+ 
+ 	r->out.result = _dfs_Add2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1529,7 +1529,7 @@ static bool api_dfs_Remove2(struct pipes
+ 
+ 	r->out.result = _dfs_Remove2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1605,7 +1605,7 @@ static bool api_dfs_EnumEx(struct pipes_
+ 	r->out.total = r->in.total;
+ 	r->out.result = _dfs_EnumEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1678,7 +1678,7 @@ static bool api_dfs_SetInfo2(struct pipe
+ 
+ 	r->out.result = _dfs_SetInfo2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_dns.c
++++ b/source3/librpc/gen_ndr/srv_dns.c
+@@ -44,7 +44,7 @@ static bool api_decode_dns_name_packet(s
+ 
+ 	_decode_dns_name_packet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_dnsp.c
++++ b/source3/librpc/gen_ndr/srv_dnsp.c
+@@ -44,7 +44,7 @@ static bool api_decode_DnssrvRpcRecord(s
+ 
+ 	_decode_DnssrvRpcRecord(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_dnsserver.c
++++ b/source3/librpc/gen_ndr/srv_dnsserver.c
+@@ -44,7 +44,7 @@ static bool api_dnsserver_foo(struct pip
+ 
+ 	_dnsserver_foo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_drsblobs.c
++++ b/source3/librpc/gen_ndr/srv_drsblobs.c
+@@ -44,7 +44,7 @@ static bool api_decode_replPropertyMetaD
+ 
+ 	_decode_replPropertyMetaData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_decode_replUpToDateVecto
+ 
+ 	_decode_replUpToDateVector(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_decode_repsFromTo(struct
+ 
+ 	_decode_repsFromTo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -263,7 +263,7 @@ static bool api_decode_partialAttributeS
+ 
+ 	_decode_partialAttributeSet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -336,7 +336,7 @@ static bool api_decode_prefixMap(struct
+ 
+ 	_decode_prefixMap(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -409,7 +409,7 @@ static bool api_decode_ldapControlDirSyn
+ 
+ 	_decode_ldapControlDirSync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -482,7 +482,7 @@ static bool api_decode_supplementalCrede
+ 
+ 	_decode_supplementalCredentials(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -555,7 +555,7 @@ static bool api_decode_Packages(struct p
+ 
+ 	_decode_Packages(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -628,7 +628,7 @@ static bool api_decode_PrimaryKerberos(s
+ 
+ 	_decode_PrimaryKerberos(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -701,7 +701,7 @@ static bool api_decode_PrimaryCLEARTEXT(
+ 
+ 	_decode_PrimaryCLEARTEXT(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -774,7 +774,7 @@ static bool api_decode_PrimaryWDigest(st
+ 
+ 	_decode_PrimaryWDigest(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -847,7 +847,7 @@ static bool api_decode_trustAuthInOut(st
+ 
+ 	_decode_trustAuthInOut(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -920,7 +920,7 @@ static bool api_decode_trustDomainPasswo
+ 
+ 	_decode_trustDomainPasswords(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -993,7 +993,7 @@ static bool api_decode_ExtendedErrorInfo
+ 
+ 	_decode_ExtendedErrorInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1066,7 +1066,7 @@ static bool api_decode_ForestTrustInfo(s
+ 
+ 	_decode_ForestTrustInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_drsuapi.c
++++ b/source3/librpc/gen_ndr/srv_drsuapi.c
+@@ -52,7 +52,7 @@ static bool api_drsuapi_DsBind(struct pi
+ 
+ 	r->out.result = _drsuapi_DsBind(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -127,7 +127,7 @@ static bool api_drsuapi_DsUnbind(struct
+ 	r->out.bind_handle = r->in.bind_handle;
+ 	r->out.result = _drsuapi_DsUnbind(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -200,7 +200,7 @@ static bool api_drsuapi_DsReplicaSync(st
+ 
+ 	r->out.result = _drsuapi_DsReplicaSync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -286,7 +286,7 @@ static bool api_drsuapi_DsGetNCChanges(s
+ 
+ 	r->out.result = _drsuapi_DsGetNCChanges(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -359,7 +359,7 @@ static bool api_drsuapi_DsReplicaUpdateR
+ 
+ 	r->out.result = _drsuapi_DsReplicaUpdateRefs(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -432,7 +432,7 @@ static bool api_drsuapi_DsReplicaAdd(str
+ 
+ 	r->out.result = _drsuapi_DsReplicaAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -505,7 +505,7 @@ static bool api_drsuapi_DsReplicaDel(str
+ 
+ 	r->out.result = _drsuapi_DsReplicaDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -578,7 +578,7 @@ static bool api_drsuapi_DsReplicaMod(str
+ 
+ 	r->out.result = _drsuapi_DsReplicaMod(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -651,7 +651,7 @@ static bool api_DRSUAPI_VERIFY_NAMES(str
+ 
+ 	r->out.result = _DRSUAPI_VERIFY_NAMES(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -737,7 +737,7 @@ static bool api_drsuapi_DsGetMemberships
+ 
+ 	r->out.result = _drsuapi_DsGetMemberships(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -810,7 +810,7 @@ static bool api_DRSUAPI_INTER_DOMAIN_MOV
+ 
+ 	r->out.result = _DRSUAPI_INTER_DOMAIN_MOVE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -896,7 +896,7 @@ static bool api_drsuapi_DsGetNT4ChangeLo
+ 
+ 	r->out.result = _drsuapi_DsGetNT4ChangeLog(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -982,7 +982,7 @@ static bool api_drsuapi_DsCrackNames(str
+ 
+ 	r->out.result = _drsuapi_DsCrackNames(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1068,7 +1068,7 @@ static bool api_drsuapi_DsWriteAccountSp
+ 
+ 	r->out.result = _drsuapi_DsWriteAccountSpn(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1154,7 +1154,7 @@ static bool api_drsuapi_DsRemoveDSServer
+ 
+ 	r->out.result = _drsuapi_DsRemoveDSServer(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1227,7 +1227,7 @@ static bool api_DRSUAPI_REMOVE_DS_DOMAIN
+ 
+ 	r->out.result = _DRSUAPI_REMOVE_DS_DOMAIN(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1313,7 +1313,7 @@ static bool api_drsuapi_DsGetDomainContr
+ 
+ 	r->out.result = _drsuapi_DsGetDomainControllerInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1399,7 +1399,7 @@ static bool api_drsuapi_DsAddEntry(struc
+ 
+ 	r->out.result = _drsuapi_DsAddEntry(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1472,7 +1472,7 @@ static bool api_drsuapi_DsExecuteKCC(str
+ 
+ 	r->out.result = _drsuapi_DsExecuteKCC(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1558,7 +1558,7 @@ static bool api_drsuapi_DsReplicaGetInfo
+ 
+ 	r->out.result = _drsuapi_DsReplicaGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1631,7 +1631,7 @@ static bool api_DRSUAPI_ADD_SID_HISTORY(
+ 
+ 	r->out.result = _DRSUAPI_ADD_SID_HISTORY(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1717,7 +1717,7 @@ static bool api_drsuapi_DsGetMemberships
+ 
+ 	r->out.result = _drsuapi_DsGetMemberships2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1790,7 +1790,7 @@ static bool api_DRSUAPI_REPLICA_VERIFY_O
+ 
+ 	r->out.result = _DRSUAPI_REPLICA_VERIFY_OBJECTS(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1863,7 +1863,7 @@ static bool api_DRSUAPI_GET_OBJECT_EXIST
+ 
+ 	r->out.result = _DRSUAPI_GET_OBJECT_EXISTENCE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1949,7 +1949,7 @@ static bool api_drsuapi_QuerySitesByCost
+ 
+ 	r->out.result = _drsuapi_QuerySitesByCost(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_dsbackup.c
++++ b/source3/librpc/gen_ndr/srv_dsbackup.c
+@@ -44,7 +44,7 @@ static bool api_HrRBackupPrepare(struct
+ 
+ 	_HrRBackupPrepare(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_HrRBackupEnd(struct pipe
+ 
+ 	_HrRBackupEnd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_HrRBackupGetAttachmentIn
+ 
+ 	_HrRBackupGetAttachmentInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -263,7 +263,7 @@ static bool api_HrRBackupOpenFile(struct
+ 
+ 	_HrRBackupOpenFile(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -336,7 +336,7 @@ static bool api_HrRBackupRead(struct pip
+ 
+ 	_HrRBackupRead(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -409,7 +409,7 @@ static bool api_HrRBackupClose(struct pi
+ 
+ 	_HrRBackupClose(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -482,7 +482,7 @@ static bool api_HrRBackupGetBackupLogs(s
+ 
+ 	_HrRBackupGetBackupLogs(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -555,7 +555,7 @@ static bool api_HrRBackupTruncateLogs(st
+ 
+ 	_HrRBackupTruncateLogs(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -628,7 +628,7 @@ static bool api_HrRBackupPing(struct pip
+ 
+ 	_HrRBackupPing(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -731,7 +731,7 @@ static bool api_HrRIsNTDSOnline(struct p
+ 
+ 	_HrRIsNTDSOnline(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -804,7 +804,7 @@ static bool api_HrRRestorePrepare(struct
+ 
+ 	_HrRRestorePrepare(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -877,7 +877,7 @@ static bool api_HrRRestoreRegister(struc
+ 
+ 	_HrRRestoreRegister(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -950,7 +950,7 @@ static bool api_HrRRestoreRegisterComple
+ 
+ 	_HrRRestoreRegisterComplete(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1023,7 +1023,7 @@ static bool api_HrRRestoreGetDatabaseLoc
+ 
+ 	_HrRRestoreGetDatabaseLocations(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1096,7 +1096,7 @@ static bool api_HrRRestoreEnd(struct pip
+ 
+ 	_HrRRestoreEnd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1169,7 +1169,7 @@ static bool api_HrRRestoreSetCurrentLogN
+ 
+ 	_HrRRestoreSetCurrentLogNumber(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1242,7 +1242,7 @@ static bool api_HrRRestoreCheckLogsForBa
+ 
+ 	_HrRRestoreCheckLogsForBackup(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_dssetup.c
++++ b/source3/librpc/gen_ndr/srv_dssetup.c
+@@ -51,7 +51,7 @@ static bool api_dssetup_DsRoleGetPrimary
+ 
+ 	r->out.result = _dssetup_DsRoleGetPrimaryDomainInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -124,7 +124,7 @@ static bool api_dssetup_DsRoleDnsNameToF
+ 
+ 	r->out.result = _dssetup_DsRoleDnsNameToFlatName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -197,7 +197,7 @@ static bool api_dssetup_DsRoleDcAsDc(str
+ 
+ 	r->out.result = _dssetup_DsRoleDcAsDc(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -270,7 +270,7 @@ static bool api_dssetup_DsRoleDcAsReplic
+ 
+ 	r->out.result = _dssetup_DsRoleDcAsReplica(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -343,7 +343,7 @@ static bool api_dssetup_DsRoleDemoteDc(s
+ 
+ 	r->out.result = _dssetup_DsRoleDemoteDc(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -416,7 +416,7 @@ static bool api_dssetup_DsRoleGetDcOpera
+ 
+ 	r->out.result = _dssetup_DsRoleGetDcOperationProgress(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -489,7 +489,7 @@ static bool api_dssetup_DsRoleGetDcOpera
+ 
+ 	r->out.result = _dssetup_DsRoleGetDcOperationResults(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -562,7 +562,7 @@ static bool api_dssetup_DsRoleCancel(str
+ 
+ 	r->out.result = _dssetup_DsRoleCancel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -635,7 +635,7 @@ static bool api_dssetup_DsRoleServerSave
+ 
+ 	r->out.result = _dssetup_DsRoleServerSaveStateForUpgrade(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -708,7 +708,7 @@ static bool api_dssetup_DsRoleUpgradeDow
+ 
+ 	r->out.result = _dssetup_DsRoleUpgradeDownlevelServer(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -781,7 +781,7 @@ static bool api_dssetup_DsRoleAbortDownl
+ 
+ 	r->out.result = _dssetup_DsRoleAbortDownlevelServerUpgrade(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_echo.c
++++ b/source3/librpc/gen_ndr/srv_echo.c
+@@ -51,7 +51,7 @@ static bool api_echo_AddOne(struct pipes
+ 
+ 	_echo_AddOne(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -131,7 +131,7 @@ static bool api_echo_EchoData(struct pip
+ 
+ 	_echo_EchoData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -204,7 +204,7 @@ static bool api_echo_SinkData(struct pip
+ 
+ 	_echo_SinkData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -284,7 +284,7 @@ static bool api_echo_SourceData(struct p
+ 
+ 	_echo_SourceData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -364,7 +364,7 @@ static bool api_echo_TestCall(struct pip
+ 
+ 	_echo_TestCall(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -444,7 +444,7 @@ static bool api_echo_TestCall2(struct pi
+ 
+ 	r->out.result = _echo_TestCall2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -517,7 +517,7 @@ static bool api_echo_TestSleep(struct pi
+ 
+ 	r->out.result = _echo_TestSleep(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -594,7 +594,7 @@ static bool api_echo_TestEnum(struct pip
+ 	r->out.foo3 = r->in.foo3;
+ 	_echo_TestEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -669,7 +669,7 @@ static bool api_echo_TestSurrounding(str
+ 	r->out.data = r->in.data;
+ 	_echo_TestSurrounding(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -742,7 +742,7 @@ static bool api_echo_TestDoublePointer(s
+ 
+ 	r->out.result = _echo_TestDoublePointer(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_efs.c
++++ b/source3/librpc/gen_ndr/srv_efs.c
+@@ -51,7 +51,7 @@ static bool api_EfsRpcOpenFileRaw(struct
+ 
+ 	r->out.result = _EfsRpcOpenFileRaw(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -124,7 +124,7 @@ static bool api_EfsRpcReadFileRaw(struct
+ 
+ 	r->out.result = _EfsRpcReadFileRaw(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -197,7 +197,7 @@ static bool api_EfsRpcWriteFileRaw(struc
+ 
+ 	r->out.result = _EfsRpcWriteFileRaw(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -272,7 +272,7 @@ static bool api_EfsRpcCloseRaw(struct pi
+ 	r->out.pvContext = r->in.pvContext;
+ 	_EfsRpcCloseRaw(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -345,7 +345,7 @@ static bool api_EfsRpcEncryptFileSrv(str
+ 
+ 	r->out.result = _EfsRpcEncryptFileSrv(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -418,7 +418,7 @@ static bool api_EfsRpcDecryptFileSrv(str
+ 
+ 	r->out.result = _EfsRpcDecryptFileSrv(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -498,7 +498,7 @@ static bool api_EfsRpcQueryUsersOnFile(s
+ 
+ 	r->out.result = _EfsRpcQueryUsersOnFile(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -578,7 +578,7 @@ static bool api_EfsRpcQueryRecoveryAgent
+ 
+ 	r->out.result = _EfsRpcQueryRecoveryAgents(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -651,7 +651,7 @@ static bool api_EfsRpcRemoveUsersFromFil
+ 
+ 	r->out.result = _EfsRpcRemoveUsersFromFile(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -724,7 +724,7 @@ static bool api_EfsRpcAddUsersToFile(str
+ 
+ 	r->out.result = _EfsRpcAddUsersToFile(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -797,7 +797,7 @@ static bool api_EfsRpcSetFileEncryptionK
+ 
+ 	r->out.result = _EfsRpcSetFileEncryptionKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -870,7 +870,7 @@ static bool api_EfsRpcNotSupported(struc
+ 
+ 	r->out.result = _EfsRpcNotSupported(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -943,7 +943,7 @@ static bool api_EfsRpcFileKeyInfo(struct
+ 
+ 	r->out.result = _EfsRpcFileKeyInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1016,7 +1016,7 @@ static bool api_EfsRpcDuplicateEncryptio
+ 
+ 	r->out.result = _EfsRpcDuplicateEncryptionInfoFile(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_epmapper.c
++++ b/source3/librpc/gen_ndr/srv_epmapper.c
+@@ -44,7 +44,7 @@ static bool api_epm_Insert(struct pipes_
+ 
+ 	r->out.result = _epm_Insert(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_epm_Delete(struct pipes_
+ 
+ 	r->out.result = _epm_Delete(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -204,7 +204,7 @@ static bool api_epm_Lookup(struct pipes_
+ 
+ 	r->out.result = _epm_Lookup(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -291,7 +291,7 @@ static bool api_epm_Map(struct pipes_str
+ 
+ 	r->out.result = _epm_Map(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -366,7 +366,7 @@ static bool api_epm_LookupHandleFree(str
+ 	r->out.entry_handle = r->in.entry_handle;
+ 	r->out.result = _epm_LookupHandleFree(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -439,7 +439,7 @@ static bool api_epm_InqObject(struct pip
+ 
+ 	r->out.result = _epm_InqObject(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -512,7 +512,7 @@ static bool api_epm_MgmtDelete(struct pi
+ 
+ 	r->out.result = _epm_MgmtDelete(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -585,7 +585,7 @@ static bool api_epm_MapAuth(struct pipes
+ 
+ 	r->out.result = _epm_MapAuth(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_eventlog6.c
++++ b/source3/librpc/gen_ndr/srv_eventlog6.c
+@@ -75,7 +75,7 @@ static bool api_eventlog6_EvtRpcRegister
+ 
+ 	r->out.result = _eventlog6_EvtRpcRegisterRemoteSubscription(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -179,7 +179,7 @@ static bool api_eventlog6_EvtRpcRemoteSu
+ 
+ 	r->out.result = _eventlog6_EvtRpcRemoteSubscriptionNextAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -283,7 +283,7 @@ static bool api_eventlog6_EvtRpcRemoteSu
+ 
+ 	r->out.result = _eventlog6_EvtRpcRemoteSubscriptionNext(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -356,7 +356,7 @@ static bool api_eventlog6_EvtRpcRemoteSu
+ 
+ 	r->out.result = _eventlog6_EvtRpcRemoteSubscriptionWaitAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -436,7 +436,7 @@ static bool api_eventlog6_EvtRpcRegister
+ 
+ 	r->out.result = _eventlog6_EvtRpcRegisterControllableOperation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -540,7 +540,7 @@ static bool api_eventlog6_EvtRpcRegister
+ 
+ 	r->out.result = _eventlog6_EvtRpcRegisterLogQuery(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -620,7 +620,7 @@ static bool api_eventlog6_EvtRpcClearLog
+ 
+ 	r->out.result = _eventlog6_EvtRpcClearLog(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -700,7 +700,7 @@ static bool api_eventlog6_EvtRpcExportLo
+ 
+ 	r->out.result = _eventlog6_EvtRpcExportLog(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -780,7 +780,7 @@ static bool api_eventlog6_EvtRpcLocalize
+ 
+ 	r->out.result = _eventlog6_EvtRpcLocalizeExportLog(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -878,7 +878,7 @@ static bool api_eventlog6_EvtRpcMessageR
+ 
+ 	r->out.result = _eventlog6_EvtRpcMessageRender(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -976,7 +976,7 @@ static bool api_eventlog6_EvtRpcMessageR
+ 
+ 	r->out.result = _eventlog6_EvtRpcMessageRenderDefault(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1080,7 +1080,7 @@ static bool api_eventlog6_EvtRpcQueryNex
+ 
+ 	r->out.result = _eventlog6_EvtRpcQueryNext(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1160,7 +1160,7 @@ static bool api_eventlog6_EvtRpcQuerySee
+ 
+ 	r->out.result = _eventlog6_EvtRpcQuerySeek(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1235,7 +1235,7 @@ static bool api_eventlog6_EvtRpcClose(st
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _eventlog6_EvtRpcClose(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1308,7 +1308,7 @@ static bool api_eventlog6_EvtRpcCancel(s
+ 
+ 	r->out.result = _eventlog6_EvtRpcCancel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1381,7 +1381,7 @@ static bool api_eventlog6_EvtRpcAssertCo
+ 
+ 	r->out.result = _eventlog6_EvtRpcAssertConfig(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1454,7 +1454,7 @@ static bool api_eventlog6_EvtRpcRetractC
+ 
+ 	r->out.result = _eventlog6_EvtRpcRetractConfig(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1540,7 +1540,7 @@ static bool api_eventlog6_EvtRpcOpenLogH
+ 
+ 	r->out.result = _eventlog6_EvtRpcOpenLogHandle(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1626,7 +1626,7 @@ static bool api_eventlog6_EvtRpcGetLogFi
+ 
+ 	r->out.result = _eventlog6_EvtRpcGetLogFileInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1712,7 +1712,7 @@ static bool api_eventlog6_EvtRpcGetChann
+ 
+ 	r->out.result = _eventlog6_EvtRpcGetChannelList(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1792,7 +1792,7 @@ static bool api_eventlog6_EvtRpcGetChann
+ 
+ 	r->out.result = _eventlog6_EvtRpcGetChannelConfig(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1872,7 +1872,7 @@ static bool api_eventlog6_EvtRpcPutChann
+ 
+ 	r->out.result = _eventlog6_EvtRpcPutChannelConfig(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1958,7 +1958,7 @@ static bool api_eventlog6_EvtRpcGetPubli
+ 
+ 	r->out.result = _eventlog6_EvtRpcGetPublisherList(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2044,7 +2044,7 @@ static bool api_eventlog6_EvtRpcGetPubli
+ 
+ 	r->out.result = _eventlog6_EvtRpcGetPublisherListForChannel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2130,7 +2130,7 @@ static bool api_eventlog6_EvtRpcGetPubli
+ 
+ 	r->out.result = _eventlog6_EvtRpcGetPublisherMetadata(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2210,7 +2210,7 @@ static bool api_eventlog6_EvtRpcGetPubli
+ 
+ 	r->out.result = _eventlog6_EvtRpcGetPublisherResourceMetadata(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2290,7 +2290,7 @@ static bool api_eventlog6_EvtRpcGetEvent
+ 
+ 	r->out.result = _eventlog6_EvtRpcGetEventMetadataEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2376,7 +2376,7 @@ static bool api_eventlog6_EvtRpcGetNextE
+ 
+ 	r->out.result = _eventlog6_EvtRpcGetNextEventMetadata(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2456,7 +2456,7 @@ static bool api_eventlog6_EvtRpcGetClass
+ 
+ 	r->out.result = _eventlog6_EvtRpcGetClassicLogDisplayName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_eventlog.c
++++ b/source3/librpc/gen_ndr/srv_eventlog.c
+@@ -44,7 +44,7 @@ static bool api_eventlog_ClearEventLogW(
+ 
+ 	r->out.result = _eventlog_ClearEventLogW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_eventlog_BackupEventLogW
+ 
+ 	r->out.result = _eventlog_BackupEventLogW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -192,7 +192,7 @@ static bool api_eventlog_CloseEventLog(s
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _eventlog_CloseEventLog(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -267,7 +267,7 @@ static bool api_eventlog_DeregisterEvent
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _eventlog_DeregisterEventSource(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -347,7 +347,7 @@ static bool api_eventlog_GetNumRecords(s
+ 
+ 	r->out.result = _eventlog_GetNumRecords(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -427,7 +427,7 @@ static bool api_eventlog_GetOldestRecord
+ 
+ 	r->out.result = _eventlog_GetOldestRecord(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -500,7 +500,7 @@ static bool api_eventlog_ChangeNotify(st
+ 
+ 	r->out.result = _eventlog_ChangeNotify(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -580,7 +580,7 @@ static bool api_eventlog_OpenEventLogW(s
+ 
+ 	r->out.result = _eventlog_OpenEventLogW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -660,7 +660,7 @@ static bool api_eventlog_RegisterEventSo
+ 
+ 	r->out.result = _eventlog_RegisterEventSourceW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -740,7 +740,7 @@ static bool api_eventlog_OpenBackupEvent
+ 
+ 	r->out.result = _eventlog_OpenBackupEventLogW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -832,7 +832,7 @@ static bool api_eventlog_ReadEventLogW(s
+ 
+ 	r->out.result = _eventlog_ReadEventLogW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -908,7 +908,7 @@ static bool api_eventlog_ReportEventW(st
+ 	r->out.time_written = r->in.time_written;
+ 	r->out.result = _eventlog_ReportEventW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -981,7 +981,7 @@ static bool api_eventlog_ClearEventLogA(
+ 
+ 	r->out.result = _eventlog_ClearEventLogA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1054,7 +1054,7 @@ static bool api_eventlog_BackupEventLogA
+ 
+ 	r->out.result = _eventlog_BackupEventLogA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1127,7 +1127,7 @@ static bool api_eventlog_OpenEventLogA(s
+ 
+ 	r->out.result = _eventlog_OpenEventLogA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1200,7 +1200,7 @@ static bool api_eventlog_RegisterEventSo
+ 
+ 	r->out.result = _eventlog_RegisterEventSourceA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1273,7 +1273,7 @@ static bool api_eventlog_OpenBackupEvent
+ 
+ 	r->out.result = _eventlog_OpenBackupEventLogA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1346,7 +1346,7 @@ static bool api_eventlog_ReadEventLogA(s
+ 
+ 	r->out.result = _eventlog_ReadEventLogA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1419,7 +1419,7 @@ static bool api_eventlog_ReportEventA(st
+ 
+ 	r->out.result = _eventlog_ReportEventA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1492,7 +1492,7 @@ static bool api_eventlog_RegisterCluster
+ 
+ 	r->out.result = _eventlog_RegisterClusterSvc(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1565,7 +1565,7 @@ static bool api_eventlog_DeregisterClust
+ 
+ 	r->out.result = _eventlog_DeregisterClusterSvc(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1638,7 +1638,7 @@ static bool api_eventlog_WriteClusterEve
+ 
+ 	r->out.result = _eventlog_WriteClusterEvents(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1724,7 +1724,7 @@ static bool api_eventlog_GetLogInformati
+ 
+ 	r->out.result = _eventlog_GetLogInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1797,7 +1797,7 @@ static bool api_eventlog_FlushEventLog(s
+ 
+ 	r->out.result = _eventlog_FlushEventLog(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1873,7 +1873,7 @@ static bool api_eventlog_ReportEventAndS
+ 	r->out.time_written = r->in.time_written;
+ 	r->out.result = _eventlog_ReportEventAndSourceW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_frsapi.c
++++ b/source3/librpc/gen_ndr/srv_frsapi.c
+@@ -44,7 +44,7 @@ static bool api_FRSAPI_VERIFY_PROMOTION(
+ 
+ 	_FRSAPI_VERIFY_PROMOTION(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_FRSAPI_PROMOTION_STATUS(
+ 
+ 	_FRSAPI_PROMOTION_STATUS(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_FRSAPI_START_DEMOTION(st
+ 
+ 	_FRSAPI_START_DEMOTION(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -263,7 +263,7 @@ static bool api_FRSAPI_COMMIT_DEMOTION(s
+ 
+ 	_FRSAPI_COMMIT_DEMOTION(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -336,7 +336,7 @@ static bool api_frsapi_SetDsPollingInter
+ 
+ 	r->out.result = _frsapi_SetDsPollingIntervalW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -428,7 +428,7 @@ static bool api_frsapi_GetDsPollingInter
+ 
+ 	r->out.result = _frsapi_GetDsPollingIntervalW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -501,7 +501,7 @@ static bool api_FRSAPI_VERIFY_PROMOTION_
+ 
+ 	_FRSAPI_VERIFY_PROMOTION_W(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -576,7 +576,7 @@ static bool api_frsapi_InfoW(struct pipe
+ 	r->out.info = r->in.info;
+ 	r->out.result = _frsapi_InfoW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -674,7 +674,7 @@ static bool api_frsapi_IsPathReplicated(
+ 
+ 	r->out.result = _frsapi_IsPathReplicated(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -747,7 +747,7 @@ static bool api_frsapi_WriterCommand(str
+ 
+ 	r->out.result = _frsapi_WriterCommand(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -820,7 +820,7 @@ static bool api_frsapi_ForceReplication(
+ 
+ 	r->out.result = _frsapi_ForceReplication(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_frsrpc.c
++++ b/source3/librpc/gen_ndr/srv_frsrpc.c
+@@ -44,7 +44,7 @@ static bool api_frsrpc_FrsSendCommPkt(st
+ 
+ 	r->out.result = _frsrpc_FrsSendCommPkt(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_frsrpc_FrsVerifyPromotio
+ 
+ 	r->out.result = _frsrpc_FrsVerifyPromotionParent(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -192,7 +192,7 @@ static bool api_frsrpc_FrsStartPromotion
+ 	r->out.parent_guid = r->in.parent_guid;
+ 	r->out.result = _frsrpc_FrsStartPromotionParent(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -265,7 +265,7 @@ static bool api_frsrpc_FrsNOP(struct pip
+ 
+ 	r->out.result = _frsrpc_FrsNOP(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -338,7 +338,7 @@ static bool api_FRSRPC_BACKUP_COMPLETE(s
+ 
+ 	_FRSRPC_BACKUP_COMPLETE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -411,7 +411,7 @@ static bool api_FRSRPC_BACKUP_COMPLETE_5
+ 
+ 	_FRSRPC_BACKUP_COMPLETE_5(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -484,7 +484,7 @@ static bool api_FRSRPC_BACKUP_COMPLETE_6
+ 
+ 	_FRSRPC_BACKUP_COMPLETE_6(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -557,7 +557,7 @@ static bool api_FRSRPC_BACKUP_COMPLETE_7
+ 
+ 	_FRSRPC_BACKUP_COMPLETE_7(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -630,7 +630,7 @@ static bool api_FRSRPC_BACKUP_COMPLETE_8
+ 
+ 	_FRSRPC_BACKUP_COMPLETE_8(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -703,7 +703,7 @@ static bool api_FRSRPC_BACKUP_COMPLETE_9
+ 
+ 	_FRSRPC_BACKUP_COMPLETE_9(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -776,7 +776,7 @@ static bool api_FRSRPC_VERIFY_PROMOTION_
+ 
+ 	_FRSRPC_VERIFY_PROMOTION_PARENT_EX(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_frstrans.c
++++ b/source3/librpc/gen_ndr/srv_frstrans.c
+@@ -44,7 +44,7 @@ static bool api_frstrans_CheckConnectivi
+ 
+ 	r->out.result = _frstrans_CheckConnectivity(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -130,7 +130,7 @@ static bool api_frstrans_EstablishConnec
+ 
+ 	r->out.result = _frstrans_EstablishConnection(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -203,7 +203,7 @@ static bool api_frstrans_EstablishSessio
+ 
+ 	r->out.result = _frstrans_EstablishSession(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -307,7 +307,7 @@ static bool api_frstrans_RequestUpdates(
+ 
+ 	r->out.result = _frstrans_RequestUpdates(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -380,7 +380,7 @@ static bool api_frstrans_RequestVersionV
+ 
+ 	r->out.result = _frstrans_RequestVersionVector(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -460,7 +460,7 @@ static bool api_frstrans_AsyncPoll(struc
+ 
+ 	r->out.result = _frstrans_AsyncPoll(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -533,7 +533,7 @@ static bool api_FRSTRANS_REQUEST_RECORDS
+ 
+ 	_FRSTRANS_REQUEST_RECORDS(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -606,7 +606,7 @@ static bool api_FRSTRANS_UPDATE_CANCEL(s
+ 
+ 	_FRSTRANS_UPDATE_CANCEL(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -679,7 +679,7 @@ static bool api_FRSTRANS_RAW_GET_FILE_DA
+ 
+ 	_FRSTRANS_RAW_GET_FILE_DATA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -752,7 +752,7 @@ static bool api_FRSTRANS_RDC_GET_SIGNATU
+ 
+ 	_FRSTRANS_RDC_GET_SIGNATURES(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -825,7 +825,7 @@ static bool api_FRSTRANS_RDC_PUSH_SOURCE
+ 
+ 	_FRSTRANS_RDC_PUSH_SOURCE_NEEDS(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -898,7 +898,7 @@ static bool api_FRSTRANS_RDC_GET_FILE_DA
+ 
+ 	_FRSTRANS_RDC_GET_FILE_DATA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -971,7 +971,7 @@ static bool api_FRSTRANS_RDC_CLOSE(struc
+ 
+ 	_FRSTRANS_RDC_CLOSE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1077,7 +1077,7 @@ static bool api_frstrans_InitializeFileT
+ 
+ 	r->out.result = _frstrans_InitializeFileTransferAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1150,7 +1150,7 @@ static bool api_FRSTRANS_OPNUM_0E_NOT_US
+ 
+ 	_FRSTRANS_OPNUM_0E_NOT_USED_ON_THE_WIRE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1230,7 +1230,7 @@ static bool api_frstrans_RawGetFileDataA
+ 
+ 	r->out.result = _frstrans_RawGetFileDataAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1310,7 +1310,7 @@ static bool api_frstrans_RdcGetFileDataA
+ 
+ 	r->out.result = _frstrans_RdcGetFileDataAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_initshutdown.c
++++ b/source3/librpc/gen_ndr/srv_initshutdown.c
+@@ -44,7 +44,7 @@ static bool api_initshutdown_Init(struct
+ 
+ 	r->out.result = _initshutdown_Init(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_initshutdown_Abort(struc
+ 
+ 	r->out.result = _initshutdown_Abort(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_initshutdown_InitEx(stru
+ 
+ 	r->out.result = _initshutdown_InitEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_keysvc.c
++++ b/source3/librpc/gen_ndr/srv_keysvc.c
+@@ -44,7 +44,7 @@ static bool api_keysvc_Unknown0(struct p
+ 
+ 	r->out.result = _keysvc_Unknown0(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_krb5pac.c
++++ b/source3/librpc/gen_ndr/srv_krb5pac.c
+@@ -44,7 +44,7 @@ static bool api_decode_pac(struct pipes_
+ 
+ 	_decode_pac(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_decode_pac_raw(struct pi
+ 
+ 	_decode_pac_raw(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_decode_login_info(struct
+ 
+ 	_decode_login_info(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -263,7 +263,7 @@ static bool api_decode_login_info_ctr(st
+ 
+ 	_decode_login_info_ctr(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -336,7 +336,7 @@ static bool api_decode_pac_validate(stru
+ 
+ 	_decode_pac_validate(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_libnetapi.c
++++ b/source3/librpc/gen_ndr/srv_libnetapi.c
+@@ -44,7 +44,7 @@ static bool api_NetJoinDomain(struct pip
+ 
+ 	r->out.result = _NetJoinDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_NetUnjoinDomain(struct p
+ 
+ 	r->out.result = _NetUnjoinDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -203,7 +203,7 @@ static bool api_NetGetJoinInformation(st
+ 
+ 	r->out.result = _NetGetJoinInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -289,7 +289,7 @@ static bool api_NetGetJoinableOUs(struct
+ 
+ 	r->out.result = _NetGetJoinableOUs(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -362,7 +362,7 @@ static bool api_NetRenameMachineInDomain
+ 
+ 	r->out.result = _NetRenameMachineInDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -442,7 +442,7 @@ static bool api_NetServerGetInfo(struct
+ 
+ 	r->out.result = _NetServerGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -522,7 +522,7 @@ static bool api_NetServerSetInfo(struct
+ 
+ 	r->out.result = _NetServerSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -602,7 +602,7 @@ static bool api_NetGetDCName(struct pipe
+ 
+ 	r->out.result = _NetGetDCName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -682,7 +682,7 @@ static bool api_NetGetAnyDCName(struct p
+ 
+ 	r->out.result = _NetGetAnyDCName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -762,7 +762,7 @@ static bool api_DsGetDcName(struct pipes
+ 
+ 	r->out.result = _DsGetDcName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -842,7 +842,7 @@ static bool api_NetUserAdd(struct pipes_
+ 
+ 	r->out.result = _NetUserAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -915,7 +915,7 @@ static bool api_NetUserDel(struct pipes_
+ 
+ 	r->out.result = _NetUserDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1008,7 +1008,7 @@ static bool api_NetUserEnum(struct pipes
+ 
+ 	r->out.result = _NetUserEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1081,7 +1081,7 @@ static bool api_NetUserChangePassword(st
+ 
+ 	r->out.result = _NetUserChangePassword(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1161,7 +1161,7 @@ static bool api_NetUserGetInfo(struct pi
+ 
+ 	r->out.result = _NetUserGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1241,7 +1241,7 @@ static bool api_NetUserSetInfo(struct pi
+ 
+ 	r->out.result = _NetUserSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1333,7 +1333,7 @@ static bool api_NetUserGetGroups(struct
+ 
+ 	r->out.result = _NetUserGetGroups(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1406,7 +1406,7 @@ static bool api_NetUserSetGroups(struct
+ 
+ 	r->out.result = _NetUserSetGroups(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1498,7 +1498,7 @@ static bool api_NetUserGetLocalGroups(st
+ 
+ 	r->out.result = _NetUserGetLocalGroups(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1578,7 +1578,7 @@ static bool api_NetUserModalsGet(struct
+ 
+ 	r->out.result = _NetUserModalsGet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1658,7 +1658,7 @@ static bool api_NetUserModalsSet(struct
+ 
+ 	r->out.result = _NetUserModalsSet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1744,7 +1744,7 @@ static bool api_NetQueryDisplayInformati
+ 
+ 	r->out.result = _NetQueryDisplayInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1824,7 +1824,7 @@ static bool api_NetGroupAdd(struct pipes
+ 
+ 	r->out.result = _NetGroupAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1897,7 +1897,7 @@ static bool api_NetGroupDel(struct pipes
+ 
+ 	r->out.result = _NetGroupDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1990,7 +1990,7 @@ static bool api_NetGroupEnum(struct pipe
+ 
+ 	r->out.result = _NetGroupEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2070,7 +2070,7 @@ static bool api_NetGroupSetInfo(struct p
+ 
+ 	r->out.result = _NetGroupSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2150,7 +2150,7 @@ static bool api_NetGroupGetInfo(struct p
+ 
+ 	r->out.result = _NetGroupGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2223,7 +2223,7 @@ static bool api_NetGroupAddUser(struct p
+ 
+ 	r->out.result = _NetGroupAddUser(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2296,7 +2296,7 @@ static bool api_NetGroupDelUser(struct p
+ 
+ 	r->out.result = _NetGroupDelUser(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2389,7 +2389,7 @@ static bool api_NetGroupGetUsers(struct
+ 
+ 	r->out.result = _NetGroupGetUsers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2462,7 +2462,7 @@ static bool api_NetGroupSetUsers(struct
+ 
+ 	r->out.result = _NetGroupSetUsers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2542,7 +2542,7 @@ static bool api_NetLocalGroupAdd(struct
+ 
+ 	r->out.result = _NetLocalGroupAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2615,7 +2615,7 @@ static bool api_NetLocalGroupDel(struct
+ 
+ 	r->out.result = _NetLocalGroupDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2695,7 +2695,7 @@ static bool api_NetLocalGroupGetInfo(str
+ 
+ 	r->out.result = _NetLocalGroupGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2775,7 +2775,7 @@ static bool api_NetLocalGroupSetInfo(str
+ 
+ 	r->out.result = _NetLocalGroupSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2868,7 +2868,7 @@ static bool api_NetLocalGroupEnum(struct
+ 
+ 	r->out.result = _NetLocalGroupEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2941,7 +2941,7 @@ static bool api_NetLocalGroupAddMembers(
+ 
+ 	r->out.result = _NetLocalGroupAddMembers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3014,7 +3014,7 @@ static bool api_NetLocalGroupDelMembers(
+ 
+ 	r->out.result = _NetLocalGroupDelMembers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3107,7 +3107,7 @@ static bool api_NetLocalGroupGetMembers(
+ 
+ 	r->out.result = _NetLocalGroupGetMembers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3180,7 +3180,7 @@ static bool api_NetLocalGroupSetMembers(
+ 
+ 	r->out.result = _NetLocalGroupSetMembers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3260,7 +3260,7 @@ static bool api_NetRemoteTOD(struct pipe
+ 
+ 	r->out.result = _NetRemoteTOD(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3340,7 +3340,7 @@ static bool api_NetShareAdd(struct pipes
+ 
+ 	r->out.result = _NetShareAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3413,7 +3413,7 @@ static bool api_NetShareDel(struct pipes
+ 
+ 	r->out.result = _NetShareDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3506,7 +3506,7 @@ static bool api_NetShareEnum(struct pipe
+ 
+ 	r->out.result = _NetShareEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3586,7 +3586,7 @@ static bool api_NetShareGetInfo(struct p
+ 
+ 	r->out.result = _NetShareGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3666,7 +3666,7 @@ static bool api_NetShareSetInfo(struct p
+ 
+ 	r->out.result = _NetShareSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3739,7 +3739,7 @@ static bool api_NetFileClose(struct pipe
+ 
+ 	r->out.result = _NetFileClose(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3819,7 +3819,7 @@ static bool api_NetFileGetInfo(struct pi
+ 
+ 	r->out.result = _NetFileGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3912,7 +3912,7 @@ static bool api_NetFileEnum(struct pipes
+ 
+ 	r->out.result = _NetFileEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3985,7 +3985,7 @@ static bool api_NetShutdownInit(struct p
+ 
+ 	r->out.result = _NetShutdownInit(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4058,7 +4058,7 @@ static bool api_NetShutdownAbort(struct
+ 
+ 	r->out.result = _NetShutdownAbort(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4138,7 +4138,7 @@ static bool api_I_NetLogonControl(struct
+ 
+ 	r->out.result = _I_NetLogonControl(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4218,7 +4218,7 @@ static bool api_I_NetLogonControl2(struc
+ 
+ 	r->out.result = _I_NetLogonControl2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_lsa.c
++++ b/source3/librpc/gen_ndr/srv_lsa.c
+@@ -46,7 +46,7 @@ static bool api_lsa_Close(struct pipes_s
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _lsa_Close(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -119,7 +119,7 @@ static bool api_lsa_Delete(struct pipes_
+ 
+ 	r->out.result = _lsa_Delete(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -200,7 +200,7 @@ static bool api_lsa_EnumPrivs(struct pip
+ 
+ 	r->out.result = _lsa_EnumPrivs(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -280,7 +280,7 @@ static bool api_lsa_QuerySecurity(struct
+ 
+ 	r->out.result = _lsa_QuerySecurity(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -353,7 +353,7 @@ static bool api_lsa_SetSecObj(struct pip
+ 
+ 	r->out.result = _lsa_SetSecObj(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -426,7 +426,7 @@ static bool api_lsa_ChangePassword(struc
+ 
+ 	r->out.result = _lsa_ChangePassword(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -506,7 +506,7 @@ static bool api_lsa_OpenPolicy(struct pi
+ 
+ 	r->out.result = _lsa_OpenPolicy(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -586,7 +586,7 @@ static bool api_lsa_QueryInfoPolicy(stru
+ 
+ 	r->out.result = _lsa_QueryInfoPolicy(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -659,7 +659,7 @@ static bool api_lsa_SetInfoPolicy(struct
+ 
+ 	r->out.result = _lsa_SetInfoPolicy(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -732,7 +732,7 @@ static bool api_lsa_ClearAuditLog(struct
+ 
+ 	r->out.result = _lsa_ClearAuditLog(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -812,7 +812,7 @@ static bool api_lsa_CreateAccount(struct
+ 
+ 	r->out.result = _lsa_CreateAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -893,7 +893,7 @@ static bool api_lsa_EnumAccounts(struct
+ 
+ 	r->out.result = _lsa_EnumAccounts(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -973,7 +973,7 @@ static bool api_lsa_CreateTrustedDomain(
+ 
+ 	r->out.result = _lsa_CreateTrustedDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1054,7 +1054,7 @@ static bool api_lsa_EnumTrustDom(struct
+ 
+ 	r->out.result = _lsa_EnumTrustDom(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1136,7 +1136,7 @@ static bool api_lsa_LookupNames(struct p
+ 
+ 	r->out.result = _lsa_LookupNames(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1218,7 +1218,7 @@ static bool api_lsa_LookupSids(struct pi
+ 
+ 	r->out.result = _lsa_LookupSids(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1298,7 +1298,7 @@ static bool api_lsa_CreateSecret(struct
+ 
+ 	r->out.result = _lsa_CreateSecret(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1378,7 +1378,7 @@ static bool api_lsa_OpenAccount(struct p
+ 
+ 	r->out.result = _lsa_OpenAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1458,7 +1458,7 @@ static bool api_lsa_EnumPrivsAccount(str
+ 
+ 	r->out.result = _lsa_EnumPrivsAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1531,7 +1531,7 @@ static bool api_lsa_AddPrivilegesToAccou
+ 
+ 	r->out.result = _lsa_AddPrivilegesToAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1604,7 +1604,7 @@ static bool api_lsa_RemovePrivilegesFrom
+ 
+ 	r->out.result = _lsa_RemovePrivilegesFromAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1677,7 +1677,7 @@ static bool api_lsa_GetQuotasForAccount(
+ 
+ 	r->out.result = _lsa_GetQuotasForAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1750,7 +1750,7 @@ static bool api_lsa_SetQuotasForAccount(
+ 
+ 	r->out.result = _lsa_SetQuotasForAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1830,7 +1830,7 @@ static bool api_lsa_GetSystemAccessAccou
+ 
+ 	r->out.result = _lsa_GetSystemAccessAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1903,7 +1903,7 @@ static bool api_lsa_SetSystemAccessAccou
+ 
+ 	r->out.result = _lsa_SetSystemAccessAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1983,7 +1983,7 @@ static bool api_lsa_OpenTrustedDomain(st
+ 
+ 	r->out.result = _lsa_OpenTrustedDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2063,7 +2063,7 @@ static bool api_lsa_QueryTrustedDomainIn
+ 
+ 	r->out.result = _lsa_QueryTrustedDomainInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2136,7 +2136,7 @@ static bool api_lsa_SetInformationTruste
+ 
+ 	r->out.result = _lsa_SetInformationTrustedDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2216,7 +2216,7 @@ static bool api_lsa_OpenSecret(struct pi
+ 
+ 	r->out.result = _lsa_OpenSecret(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2289,7 +2289,7 @@ static bool api_lsa_SetSecret(struct pip
+ 
+ 	r->out.result = _lsa_SetSecret(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2367,7 +2367,7 @@ static bool api_lsa_QuerySecret(struct p
+ 	r->out.old_mtime = r->in.old_mtime;
+ 	r->out.result = _lsa_QuerySecret(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2447,7 +2447,7 @@ static bool api_lsa_LookupPrivValue(stru
+ 
+ 	r->out.result = _lsa_LookupPrivValue(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2527,7 +2527,7 @@ static bool api_lsa_LookupPrivName(struc
+ 
+ 	r->out.result = _lsa_LookupPrivName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2613,7 +2613,7 @@ static bool api_lsa_LookupPrivDisplayNam
+ 
+ 	r->out.result = _lsa_LookupPrivDisplayName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2688,7 +2688,7 @@ static bool api_lsa_DeleteObject(struct
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _lsa_DeleteObject(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2768,7 +2768,7 @@ static bool api_lsa_EnumAccountsWithUser
+ 
+ 	r->out.result = _lsa_EnumAccountsWithUserRight(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2848,7 +2848,7 @@ static bool api_lsa_EnumAccountRights(st
+ 
+ 	r->out.result = _lsa_EnumAccountRights(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2921,7 +2921,7 @@ static bool api_lsa_AddAccountRights(str
+ 
+ 	r->out.result = _lsa_AddAccountRights(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2994,7 +2994,7 @@ static bool api_lsa_RemoveAccountRights(
+ 
+ 	r->out.result = _lsa_RemoveAccountRights(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3074,7 +3074,7 @@ static bool api_lsa_QueryTrustedDomainIn
+ 
+ 	r->out.result = _lsa_QueryTrustedDomainInfoBySid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3147,7 +3147,7 @@ static bool api_lsa_SetTrustedDomainInfo
+ 
+ 	r->out.result = _lsa_SetTrustedDomainInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3220,7 +3220,7 @@ static bool api_lsa_DeleteTrustedDomain(
+ 
+ 	r->out.result = _lsa_DeleteTrustedDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3293,7 +3293,7 @@ static bool api_lsa_StorePrivateData(str
+ 
+ 	r->out.result = _lsa_StorePrivateData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3368,7 +3368,7 @@ static bool api_lsa_RetrievePrivateData(
+ 	r->out.val = r->in.val;
+ 	r->out.result = _lsa_RetrievePrivateData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3448,7 +3448,7 @@ static bool api_lsa_OpenPolicy2(struct p
+ 
+ 	r->out.result = _lsa_OpenPolicy2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3524,7 +3524,7 @@ static bool api_lsa_GetUserName(struct p
+ 	r->out.authority_name = r->in.authority_name;
+ 	r->out.result = _lsa_GetUserName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3604,7 +3604,7 @@ static bool api_lsa_QueryInfoPolicy2(str
+ 
+ 	r->out.result = _lsa_QueryInfoPolicy2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3677,7 +3677,7 @@ static bool api_lsa_SetInfoPolicy2(struc
+ 
+ 	r->out.result = _lsa_SetInfoPolicy2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3757,7 +3757,7 @@ static bool api_lsa_QueryTrustedDomainIn
+ 
+ 	r->out.result = _lsa_QueryTrustedDomainInfoByName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3830,7 +3830,7 @@ static bool api_lsa_SetTrustedDomainInfo
+ 
+ 	r->out.result = _lsa_SetTrustedDomainInfoByName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3911,7 +3911,7 @@ static bool api_lsa_EnumTrustedDomainsEx
+ 
+ 	r->out.result = _lsa_EnumTrustedDomainsEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3991,7 +3991,7 @@ static bool api_lsa_CreateTrustedDomainE
+ 
+ 	r->out.result = _lsa_CreateTrustedDomainEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4066,7 +4066,7 @@ static bool api_lsa_CloseTrustedDomainEx
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _lsa_CloseTrustedDomainEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4146,7 +4146,7 @@ static bool api_lsa_QueryDomainInformati
+ 
+ 	r->out.result = _lsa_QueryDomainInformationPolicy(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4219,7 +4219,7 @@ static bool api_lsa_SetDomainInformation
+ 
+ 	r->out.result = _lsa_SetDomainInformationPolicy(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4299,7 +4299,7 @@ static bool api_lsa_OpenTrustedDomainByN
+ 
+ 	r->out.result = _lsa_OpenTrustedDomainByName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4372,7 +4372,7 @@ static bool api_lsa_TestCall(struct pipe
+ 
+ 	r->out.result = _lsa_TestCall(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4454,7 +4454,7 @@ static bool api_lsa_LookupSids2(struct p
+ 
+ 	r->out.result = _lsa_LookupSids2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4536,7 +4536,7 @@ static bool api_lsa_LookupNames2(struct
+ 
+ 	r->out.result = _lsa_LookupNames2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4616,7 +4616,7 @@ static bool api_lsa_CreateTrustedDomainE
+ 
+ 	r->out.result = _lsa_CreateTrustedDomainEx2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4689,7 +4689,7 @@ static bool api_lsa_CREDRWRITE(struct pi
+ 
+ 	r->out.result = _lsa_CREDRWRITE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4762,7 +4762,7 @@ static bool api_lsa_CREDRREAD(struct pip
+ 
+ 	r->out.result = _lsa_CREDRREAD(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4835,7 +4835,7 @@ static bool api_lsa_CREDRENUMERATE(struc
+ 
+ 	r->out.result = _lsa_CREDRENUMERATE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4908,7 +4908,7 @@ static bool api_lsa_CREDRWRITEDOMAINCRED
+ 
+ 	r->out.result = _lsa_CREDRWRITEDOMAINCREDENTIALS(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4981,7 +4981,7 @@ static bool api_lsa_CREDRREADDOMAINCREDE
+ 
+ 	r->out.result = _lsa_CREDRREADDOMAINCREDENTIALS(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5054,7 +5054,7 @@ static bool api_lsa_CREDRDELETE(struct p
+ 
+ 	r->out.result = _lsa_CREDRDELETE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5127,7 +5127,7 @@ static bool api_lsa_CREDRGETTARGETINFO(s
+ 
+ 	r->out.result = _lsa_CREDRGETTARGETINFO(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5200,7 +5200,7 @@ static bool api_lsa_CREDRPROFILELOADED(s
+ 
+ 	r->out.result = _lsa_CREDRPROFILELOADED(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5282,7 +5282,7 @@ static bool api_lsa_LookupNames3(struct
+ 
+ 	r->out.result = _lsa_LookupNames3(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5355,7 +5355,7 @@ static bool api_lsa_CREDRGETSESSIONTYPES
+ 
+ 	r->out.result = _lsa_CREDRGETSESSIONTYPES(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5428,7 +5428,7 @@ static bool api_lsa_LSARREGISTERAUDITEVE
+ 
+ 	r->out.result = _lsa_LSARREGISTERAUDITEVENT(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5501,7 +5501,7 @@ static bool api_lsa_LSARGENAUDITEVENT(st
+ 
+ 	r->out.result = _lsa_LSARGENAUDITEVENT(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5574,7 +5574,7 @@ static bool api_lsa_LSARUNREGISTERAUDITE
+ 
+ 	r->out.result = _lsa_LSARUNREGISTERAUDITEVENT(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5654,7 +5654,7 @@ static bool api_lsa_lsaRQueryForestTrust
+ 
+ 	r->out.result = _lsa_lsaRQueryForestTrustInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5734,7 +5734,7 @@ static bool api_lsa_lsaRSetForestTrustIn
+ 
+ 	r->out.result = _lsa_lsaRSetForestTrustInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5807,7 +5807,7 @@ static bool api_lsa_CREDRRENAME(struct p
+ 
+ 	r->out.result = _lsa_CREDRRENAME(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5889,7 +5889,7 @@ static bool api_lsa_LookupSids3(struct p
+ 
+ 	r->out.result = _lsa_LookupSids3(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5971,7 +5971,7 @@ static bool api_lsa_LookupNames4(struct
+ 
+ 	r->out.result = _lsa_LookupNames4(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6044,7 +6044,7 @@ static bool api_lsa_LSAROPENPOLICYSCE(st
+ 
+ 	r->out.result = _lsa_LSAROPENPOLICYSCE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6117,7 +6117,7 @@ static bool api_lsa_LSARADTREGISTERSECUR
+ 
+ 	r->out.result = _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6190,7 +6190,7 @@ static bool api_lsa_LSARADTUNREGISTERSEC
+ 
+ 	r->out.result = _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6263,7 +6263,7 @@ static bool api_lsa_LSARADTREPORTSECURIT
+ 
+ 	r->out.result = _lsa_LSARADTREPORTSECURITYEVENT(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_mgmt.c
++++ b/source3/librpc/gen_ndr/srv_mgmt.c
+@@ -51,7 +51,7 @@ static bool api_mgmt_inq_if_ids(struct p
+ 
+ 	r->out.result = _mgmt_inq_if_ids(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -131,7 +131,7 @@ static bool api_mgmt_inq_stats(struct pi
+ 
+ 	r->out.result = _mgmt_inq_stats(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -211,7 +211,7 @@ static bool api_mgmt_is_server_listening
+ 
+ 	r->out.result = _mgmt_is_server_listening(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -284,7 +284,7 @@ static bool api_mgmt_stop_server_listeni
+ 
+ 	r->out.result = _mgmt_stop_server_listening(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -364,7 +364,7 @@ static bool api_mgmt_inq_princ_name(stru
+ 
+ 	r->out.result = _mgmt_inq_princ_name(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_msgsvc.c
++++ b/source3/librpc/gen_ndr/srv_msgsvc.c
+@@ -44,7 +44,7 @@ static bool api_NetrMessageNameAdd(struc
+ 
+ 	_NetrMessageNameAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_NetrMessageNameEnum(stru
+ 
+ 	_NetrMessageNameEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_NetrMessageNameGetInfo(s
+ 
+ 	_NetrMessageNameGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -263,7 +263,7 @@ static bool api_NetrMessageNameDel(struc
+ 
+ 	_NetrMessageNameDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -361,7 +361,7 @@ static bool api_NetrSendMessage(struct p
+ 
+ 	_NetrSendMessage(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_nbt.c
++++ b/source3/librpc/gen_ndr/srv_nbt.c
+@@ -44,7 +44,7 @@ static bool api_decode_nbt_netlogon_pack
+ 
+ 	_decode_nbt_netlogon_packet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_netlogon.c
++++ b/source3/librpc/gen_ndr/srv_netlogon.c
+@@ -51,7 +51,7 @@ static bool api_netr_LogonUasLogon(struc
+ 
+ 	r->out.result = _netr_LogonUasLogon(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -131,7 +131,7 @@ static bool api_netr_LogonUasLogoff(stru
+ 
+ 	r->out.result = _netr_LogonUasLogoff(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -218,7 +218,7 @@ static bool api_netr_LogonSamLogon(struc
+ 
+ 	r->out.result = _netr_LogonSamLogon(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -293,7 +293,7 @@ static bool api_netr_LogonSamLogoff(stru
+ 	r->out.return_authenticator = r->in.return_authenticator;
+ 	r->out.result = _netr_LogonSamLogoff(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -373,7 +373,7 @@ static bool api_netr_ServerReqChallenge(
+ 
+ 	r->out.result = _netr_ServerReqChallenge(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -453,7 +453,7 @@ static bool api_netr_ServerAuthenticate(
+ 
+ 	r->out.result = _netr_ServerAuthenticate(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -533,7 +533,7 @@ static bool api_netr_ServerPasswordSet(s
+ 
+ 	r->out.result = _netr_ServerPasswordSet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -615,7 +615,7 @@ static bool api_netr_DatabaseDeltas(stru
+ 
+ 	r->out.result = _netr_DatabaseDeltas(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -697,7 +697,7 @@ static bool api_netr_DatabaseSync(struct
+ 
+ 	r->out.result = _netr_DatabaseSync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -796,7 +796,7 @@ static bool api_netr_AccountDeltas(struc
+ 
+ 	r->out.result = _netr_AccountDeltas(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -896,7 +896,7 @@ static bool api_netr_AccountSync(struct
+ 
+ 	r->out.result = _netr_AccountSync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -976,7 +976,7 @@ static bool api_netr_GetDcName(struct pi
+ 
+ 	r->out.result = _netr_GetDcName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1056,7 +1056,7 @@ static bool api_netr_LogonControl(struct
+ 
+ 	r->out.result = _netr_LogonControl(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1136,7 +1136,7 @@ static bool api_netr_GetAnyDCName(struct
+ 
+ 	r->out.result = _netr_GetAnyDCName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1216,7 +1216,7 @@ static bool api_netr_LogonControl2(struc
+ 
+ 	r->out.result = _netr_LogonControl2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1297,7 +1297,7 @@ static bool api_netr_ServerAuthenticate2
+ 
+ 	r->out.result = _netr_ServerAuthenticate2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1379,7 +1379,7 @@ static bool api_netr_DatabaseSync2(struc
+ 
+ 	r->out.result = _netr_DatabaseSync2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1460,7 +1460,7 @@ static bool api_netr_DatabaseRedo(struct
+ 
+ 	r->out.result = _netr_DatabaseRedo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1540,7 +1540,7 @@ static bool api_netr_LogonControl2Ex(str
+ 
+ 	r->out.result = _netr_LogonControl2Ex(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1620,7 +1620,7 @@ static bool api_netr_NetrEnumerateTruste
+ 
+ 	r->out.result = _netr_NetrEnumerateTrustedDomains(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1700,7 +1700,7 @@ static bool api_netr_DsRGetDCName(struct
+ 
+ 	r->out.result = _netr_DsRGetDCName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1781,7 +1781,7 @@ static bool api_netr_LogonGetCapabilitie
+ 
+ 	r->out.result = _netr_LogonGetCapabilities(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1854,7 +1854,7 @@ static bool api_netr_NETRLOGONSETSERVICE
+ 
+ 	r->out.result = _netr_NETRLOGONSETSERVICEBITS(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1934,7 +1934,7 @@ static bool api_netr_LogonGetTrustRid(st
+ 
+ 	r->out.result = _netr_LogonGetTrustRid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2007,7 +2007,7 @@ static bool api_netr_NETRLOGONCOMPUTESER
+ 
+ 	r->out.result = _netr_NETRLOGONCOMPUTESERVERDIGEST(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2080,7 +2080,7 @@ static bool api_netr_NETRLOGONCOMPUTECLI
+ 
+ 	r->out.result = _netr_NETRLOGONCOMPUTECLIENTDIGEST(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2167,7 +2167,7 @@ static bool api_netr_ServerAuthenticate3
+ 
+ 	r->out.result = _netr_ServerAuthenticate3(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2247,7 +2247,7 @@ static bool api_netr_DsRGetDCNameEx(stru
+ 
+ 	r->out.result = _netr_DsRGetDCNameEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2327,7 +2327,7 @@ static bool api_netr_DsRGetSiteName(stru
+ 
+ 	r->out.result = _netr_DsRGetSiteName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2408,7 +2408,7 @@ static bool api_netr_LogonGetDomainInfo(
+ 
+ 	r->out.result = _netr_LogonGetDomainInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2488,7 +2488,7 @@ static bool api_netr_ServerPasswordSet2(
+ 
+ 	r->out.result = _netr_ServerPasswordSet2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2574,7 +2574,7 @@ static bool api_netr_ServerPasswordGet(s
+ 
+ 	r->out.result = _netr_ServerPasswordGet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2647,7 +2647,7 @@ static bool api_netr_NETRLOGONSENDTOSAM(
+ 
+ 	r->out.result = _netr_NETRLOGONSENDTOSAM(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2727,7 +2727,7 @@ static bool api_netr_DsRAddressToSitenam
+ 
+ 	r->out.result = _netr_DsRAddressToSitenamesW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2807,7 +2807,7 @@ static bool api_netr_DsRGetDCNameEx2(str
+ 
+ 	r->out.result = _netr_DsRGetDCNameEx2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2880,7 +2880,7 @@ static bool api_netr_NETRLOGONGETTIMESER
+ 
+ 	r->out.result = _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2960,7 +2960,7 @@ static bool api_netr_NetrEnumerateTruste
+ 
+ 	r->out.result = _netr_NetrEnumerateTrustedDomainsEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3040,7 +3040,7 @@ static bool api_netr_DsRAddressToSitenam
+ 
+ 	r->out.result = _netr_DsRAddressToSitenamesExW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3120,7 +3120,7 @@ static bool api_netr_DsrGetDcSiteCoverag
+ 
+ 	r->out.result = _netr_DsrGetDcSiteCoverageW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3207,7 +3207,7 @@ static bool api_netr_LogonSamLogonEx(str
+ 
+ 	r->out.result = _netr_LogonSamLogonEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3287,7 +3287,7 @@ static bool api_netr_DsrEnumerateDomainT
+ 
+ 	r->out.result = _netr_DsrEnumerateDomainTrusts(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3360,7 +3360,7 @@ static bool api_netr_DsrDeregisterDNSHos
+ 
+ 	r->out.result = _netr_DsrDeregisterDNSHostRecords(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3452,7 +3452,7 @@ static bool api_netr_ServerTrustPassword
+ 
+ 	r->out.result = _netr_ServerTrustPasswordsGet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3532,7 +3532,7 @@ static bool api_netr_DsRGetForestTrustIn
+ 
+ 	r->out.result = _netr_DsRGetForestTrustInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3618,7 +3618,7 @@ static bool api_netr_GetForestTrustInfor
+ 
+ 	r->out.result = _netr_GetForestTrustInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3706,7 +3706,7 @@ static bool api_netr_LogonSamLogonWithFl
+ 
+ 	r->out.result = _netr_LogonSamLogonWithFlags(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3804,7 +3804,7 @@ static bool api_netr_ServerGetTrustInfo(
+ 
+ 	r->out.result = _netr_ServerGetTrustInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3877,7 +3877,7 @@ static bool api_netr_Unused47(struct pip
+ 
+ 	r->out.result = _netr_Unused47(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3958,7 +3958,7 @@ static bool api_netr_DsrUpdateReadOnlySe
+ 
+ 	r->out.result = _netr_DsrUpdateReadOnlyServerDnsRecords(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_ntlmssp.c
++++ b/source3/librpc/gen_ndr/srv_ntlmssp.c
+@@ -44,7 +44,7 @@ static bool api_decode_NEGOTIATE_MESSAGE
+ 
+ 	_decode_NEGOTIATE_MESSAGE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_decode_CHALLENGE_MESSAGE
+ 
+ 	_decode_CHALLENGE_MESSAGE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_decode_AUTHENTICATE_MESS
+ 
+ 	_decode_AUTHENTICATE_MESSAGE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -263,7 +263,7 @@ static bool api_decode_NTLMv2_CLIENT_CHA
+ 
+ 	_decode_NTLMv2_CLIENT_CHALLENGE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -336,7 +336,7 @@ static bool api_decode_NTLMv2_RESPONSE(s
+ 
+ 	_decode_NTLMv2_RESPONSE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_ntprinting.c
++++ b/source3/librpc/gen_ndr/srv_ntprinting.c
+@@ -44,7 +44,7 @@ static bool api_decode_ntprinting_form(s
+ 
+ 	_decode_ntprinting_form(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_decode_ntprinting_driver
+ 
+ 	_decode_ntprinting_driver(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_decode_ntprinting_printe
+ 
+ 	_decode_ntprinting_printer(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_ntsvcs.c
++++ b/source3/librpc/gen_ndr/srv_ntsvcs.c
+@@ -44,7 +44,7 @@ static bool api_PNP_Disconnect(struct pi
+ 
+ 	r->out.result = _PNP_Disconnect(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_PNP_Connect(struct pipes
+ 
+ 	r->out.result = _PNP_Connect(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -197,7 +197,7 @@ static bool api_PNP_GetVersion(struct pi
+ 
+ 	r->out.result = _PNP_GetVersion(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -270,7 +270,7 @@ static bool api_PNP_GetGlobalState(struc
+ 
+ 	r->out.result = _PNP_GetGlobalState(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -343,7 +343,7 @@ static bool api_PNP_InitDetection(struct
+ 
+ 	r->out.result = _PNP_InitDetection(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -416,7 +416,7 @@ static bool api_PNP_ReportLogOn(struct p
+ 
+ 	r->out.result = _PNP_ReportLogOn(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -489,7 +489,7 @@ static bool api_PNP_ValidateDeviceInstan
+ 
+ 	r->out.result = _PNP_ValidateDeviceInstance(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -562,7 +562,7 @@ static bool api_PNP_GetRootDeviceInstanc
+ 
+ 	r->out.result = _PNP_GetRootDeviceInstance(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -635,7 +635,7 @@ static bool api_PNP_GetRelatedDeviceInst
+ 
+ 	r->out.result = _PNP_GetRelatedDeviceInstance(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -708,7 +708,7 @@ static bool api_PNP_EnumerateSubKeys(str
+ 
+ 	r->out.result = _PNP_EnumerateSubKeys(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -789,7 +789,7 @@ static bool api_PNP_GetDeviceList(struct
+ 
+ 	r->out.result = _PNP_GetDeviceList(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -869,7 +869,7 @@ static bool api_PNP_GetDeviceListSize(st
+ 
+ 	r->out.result = _PNP_GetDeviceListSize(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -942,7 +942,7 @@ static bool api_PNP_GetDepth(struct pipe
+ 
+ 	r->out.result = _PNP_GetDepth(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1025,7 +1025,7 @@ static bool api_PNP_GetDeviceRegProp(str
+ 
+ 	r->out.result = _PNP_GetDeviceRegProp(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1098,7 +1098,7 @@ static bool api_PNP_SetDeviceRegProp(str
+ 
+ 	r->out.result = _PNP_SetDeviceRegProp(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1171,7 +1171,7 @@ static bool api_PNP_GetClassInstance(str
+ 
+ 	r->out.result = _PNP_GetClassInstance(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1244,7 +1244,7 @@ static bool api_PNP_CreateKey(struct pip
+ 
+ 	r->out.result = _PNP_CreateKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1317,7 +1317,7 @@ static bool api_PNP_DeleteRegistryKey(st
+ 
+ 	r->out.result = _PNP_DeleteRegistryKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1390,7 +1390,7 @@ static bool api_PNP_GetClassCount(struct
+ 
+ 	r->out.result = _PNP_GetClassCount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1463,7 +1463,7 @@ static bool api_PNP_GetClassName(struct
+ 
+ 	r->out.result = _PNP_GetClassName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1536,7 +1536,7 @@ static bool api_PNP_DeleteClassKey(struc
+ 
+ 	r->out.result = _PNP_DeleteClassKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1609,7 +1609,7 @@ static bool api_PNP_GetInterfaceDeviceAl
+ 
+ 	r->out.result = _PNP_GetInterfaceDeviceAlias(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1682,7 +1682,7 @@ static bool api_PNP_GetInterfaceDeviceLi
+ 
+ 	r->out.result = _PNP_GetInterfaceDeviceList(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1755,7 +1755,7 @@ static bool api_PNP_GetInterfaceDeviceLi
+ 
+ 	r->out.result = _PNP_GetInterfaceDeviceListSize(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1828,7 +1828,7 @@ static bool api_PNP_RegisterDeviceClassA
+ 
+ 	r->out.result = _PNP_RegisterDeviceClassAssociation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1901,7 +1901,7 @@ static bool api_PNP_UnregisterDeviceClas
+ 
+ 	r->out.result = _PNP_UnregisterDeviceClassAssociation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1974,7 +1974,7 @@ static bool api_PNP_GetClassRegProp(stru
+ 
+ 	r->out.result = _PNP_GetClassRegProp(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2047,7 +2047,7 @@ static bool api_PNP_SetClassRegProp(stru
+ 
+ 	r->out.result = _PNP_SetClassRegProp(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2120,7 +2120,7 @@ static bool api_PNP_CreateDevInst(struct
+ 
+ 	r->out.result = _PNP_CreateDevInst(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2193,7 +2193,7 @@ static bool api_PNP_DeviceInstanceAction
+ 
+ 	r->out.result = _PNP_DeviceInstanceAction(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2266,7 +2266,7 @@ static bool api_PNP_GetDeviceStatus(stru
+ 
+ 	r->out.result = _PNP_GetDeviceStatus(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2339,7 +2339,7 @@ static bool api_PNP_SetDeviceProblem(str
+ 
+ 	r->out.result = _PNP_SetDeviceProblem(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2412,7 +2412,7 @@ static bool api_PNP_DisableDevInst(struc
+ 
+ 	r->out.result = _PNP_DisableDevInst(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2485,7 +2485,7 @@ static bool api_PNP_UninstallDevInst(str
+ 
+ 	r->out.result = _PNP_UninstallDevInst(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2558,7 +2558,7 @@ static bool api_PNP_AddID(struct pipes_s
+ 
+ 	r->out.result = _PNP_AddID(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2631,7 +2631,7 @@ static bool api_PNP_RegisterDriver(struc
+ 
+ 	r->out.result = _PNP_RegisterDriver(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2704,7 +2704,7 @@ static bool api_PNP_QueryRemove(struct p
+ 
+ 	r->out.result = _PNP_QueryRemove(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2777,7 +2777,7 @@ static bool api_PNP_RequestDeviceEject(s
+ 
+ 	r->out.result = _PNP_RequestDeviceEject(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2850,7 +2850,7 @@ static bool api_PNP_IsDockStationPresent
+ 
+ 	r->out.result = _PNP_IsDockStationPresent(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2923,7 +2923,7 @@ static bool api_PNP_RequestEjectPC(struc
+ 
+ 	r->out.result = _PNP_RequestEjectPC(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3005,7 +3005,7 @@ static bool api_PNP_HwProfFlags(struct p
+ 
+ 	r->out.result = _PNP_HwProfFlags(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3080,7 +3080,7 @@ static bool api_PNP_GetHwProfInfo(struct
+ 	r->out.info = r->in.info;
+ 	r->out.result = _PNP_GetHwProfInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3153,7 +3153,7 @@ static bool api_PNP_AddEmptyLogConf(stru
+ 
+ 	r->out.result = _PNP_AddEmptyLogConf(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3226,7 +3226,7 @@ static bool api_PNP_FreeLogConf(struct p
+ 
+ 	r->out.result = _PNP_FreeLogConf(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3299,7 +3299,7 @@ static bool api_PNP_GetFirstLogConf(stru
+ 
+ 	r->out.result = _PNP_GetFirstLogConf(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3372,7 +3372,7 @@ static bool api_PNP_GetNextLogConf(struc
+ 
+ 	r->out.result = _PNP_GetNextLogConf(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3445,7 +3445,7 @@ static bool api_PNP_GetLogConfPriority(s
+ 
+ 	r->out.result = _PNP_GetLogConfPriority(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3518,7 +3518,7 @@ static bool api_PNP_AddResDes(struct pip
+ 
+ 	r->out.result = _PNP_AddResDes(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3591,7 +3591,7 @@ static bool api_PNP_FreeResDes(struct pi
+ 
+ 	r->out.result = _PNP_FreeResDes(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3664,7 +3664,7 @@ static bool api_PNP_GetNextResDes(struct
+ 
+ 	r->out.result = _PNP_GetNextResDes(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3737,7 +3737,7 @@ static bool api_PNP_GetResDesData(struct
+ 
+ 	r->out.result = _PNP_GetResDesData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3810,7 +3810,7 @@ static bool api_PNP_GetResDesDataSize(st
+ 
+ 	r->out.result = _PNP_GetResDesDataSize(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3883,7 +3883,7 @@ static bool api_PNP_ModifyResDes(struct
+ 
+ 	r->out.result = _PNP_ModifyResDes(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3956,7 +3956,7 @@ static bool api_PNP_DetectResourceLimit(
+ 
+ 	r->out.result = _PNP_DetectResourceLimit(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4029,7 +4029,7 @@ static bool api_PNP_QueryResConfList(str
+ 
+ 	r->out.result = _PNP_QueryResConfList(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4102,7 +4102,7 @@ static bool api_PNP_SetHwProf(struct pip
+ 
+ 	r->out.result = _PNP_SetHwProf(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4175,7 +4175,7 @@ static bool api_PNP_QueryArbitratorFreeD
+ 
+ 	r->out.result = _PNP_QueryArbitratorFreeData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4248,7 +4248,7 @@ static bool api_PNP_QueryArbitratorFreeS
+ 
+ 	r->out.result = _PNP_QueryArbitratorFreeSize(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4321,7 +4321,7 @@ static bool api_PNP_RunDetection(struct
+ 
+ 	r->out.result = _PNP_RunDetection(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4394,7 +4394,7 @@ static bool api_PNP_RegisterNotification
+ 
+ 	r->out.result = _PNP_RegisterNotification(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4467,7 +4467,7 @@ static bool api_PNP_UnregisterNotificati
+ 
+ 	r->out.result = _PNP_UnregisterNotification(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4540,7 +4540,7 @@ static bool api_PNP_GetCustomDevProp(str
+ 
+ 	r->out.result = _PNP_GetCustomDevProp(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4613,7 +4613,7 @@ static bool api_PNP_GetVersionInternal(s
+ 
+ 	r->out.result = _PNP_GetVersionInternal(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4686,7 +4686,7 @@ static bool api_PNP_GetBlockedDriverInfo
+ 
+ 	r->out.result = _PNP_GetBlockedDriverInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4759,7 +4759,7 @@ static bool api_PNP_GetServerSideDeviceI
+ 
+ 	r->out.result = _PNP_GetServerSideDeviceInstallFlags(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_oxidresolver.c
++++ b/source3/librpc/gen_ndr/srv_oxidresolver.c
+@@ -63,7 +63,7 @@ static bool api_ResolveOxid(struct pipes
+ 
+ 	r->out.result = _ResolveOxid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -136,7 +136,7 @@ static bool api_SimplePing(struct pipes_
+ 
+ 	r->out.result = _SimplePing(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -217,7 +217,7 @@ static bool api_ComplexPing(struct pipes
+ 
+ 	r->out.result = _ComplexPing(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -290,7 +290,7 @@ static bool api_ServerAlive(struct pipes
+ 
+ 	r->out.result = _ServerAlive(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -388,7 +388,7 @@ static bool api_ResolveOxid2(struct pipe
+ 
+ 	r->out.result = _ResolveOxid2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -492,7 +492,7 @@ static bool api_ServerAlive2(struct pipe
+ 
+ 	r->out.result = _ServerAlive2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_policyagent.c
++++ b/source3/librpc/gen_ndr/srv_policyagent.c
+@@ -44,7 +44,7 @@ static bool api_policyagent_Dummy(struct
+ 
+ 	r->out.result = _policyagent_Dummy(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_preg.c
++++ b/source3/librpc/gen_ndr/srv_preg.c
+@@ -44,7 +44,7 @@ static bool api_decode_preg_file(struct
+ 
+ 	_decode_preg_file(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_rap.c
++++ b/source3/librpc/gen_ndr/srv_rap.c
+@@ -51,7 +51,7 @@ static bool api_rap_NetShareEnum(struct
+ 
+ 	_rap_NetShareEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -125,7 +125,7 @@ static bool api_rap_NetShareAdd(struct p
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetShareAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -205,7 +205,7 @@ static bool api_rap_NetServerEnum2(struc
+ 
+ 	_rap_NetServerEnum2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -279,7 +279,7 @@ static bool api_rap_WserverGetInfo(struc
+ 	ZERO_STRUCT(r->out);
+ 	_rap_WserverGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -359,7 +359,7 @@ static bool api_rap_NetPrintQEnum(struct
+ 
+ 	_rap_NetPrintQEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -433,7 +433,7 @@ static bool api_rap_NetPrintQGetInfo(str
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetPrintQGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -507,7 +507,7 @@ static bool api_rap_NetPrintJobPause(str
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetPrintJobPause(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -581,7 +581,7 @@ static bool api_rap_NetPrintJobContinue(
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetPrintJobContinue(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -655,7 +655,7 @@ static bool api_rap_NetPrintJobDelete(st
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetPrintJobDelete(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -729,7 +729,7 @@ static bool api_rap_NetPrintQueuePause(s
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetPrintQueuePause(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -803,7 +803,7 @@ static bool api_rap_NetPrintQueueResume(
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetPrintQueueResume(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -877,7 +877,7 @@ static bool api_rap_NetPrintQueuePurge(s
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetPrintQueuePurge(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -957,7 +957,7 @@ static bool api_rap_NetPrintJobEnum(stru
+ 
+ 	_rap_NetPrintJobEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1031,7 +1031,7 @@ static bool api_rap_NetPrintJobGetInfo(s
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetPrintJobGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1105,7 +1105,7 @@ static bool api_rap_NetPrintJobSetInfo(s
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetPrintJobSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1185,7 +1185,7 @@ static bool api_rap_NetPrintDestEnum(str
+ 
+ 	_rap_NetPrintDestEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1259,7 +1259,7 @@ static bool api_rap_NetPrintDestGetInfo(
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetPrintDestGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1333,7 +1333,7 @@ static bool api_rap_NetUserPasswordSet2(
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetUserPasswordSet2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1407,7 +1407,7 @@ static bool api_rap_NetOEMChangePassword
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetOEMChangePassword(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1481,7 +1481,7 @@ static bool api_rap_NetUserGetInfo(struc
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetUserGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1561,7 +1561,7 @@ static bool api_rap_NetSessionEnum(struc
+ 
+ 	_rap_NetSessionEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1635,7 +1635,7 @@ static bool api_rap_NetSessionGetInfo(st
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetSessionGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1709,7 +1709,7 @@ static bool api_rap_NetUserAdd(struct pi
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetUserAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1783,7 +1783,7 @@ static bool api_rap_NetUserDelete(struct
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetUserDelete(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1857,7 +1857,7 @@ static bool api_rap_NetRemoteTOD(struct
+ 	ZERO_STRUCT(r->out);
+ 	_rap_NetRemoteTOD(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_remact.c
++++ b/source3/librpc/gen_ndr/srv_remact.c
+@@ -99,7 +99,7 @@ static bool api_RemoteActivation(struct
+ 
+ 	r->out.result = _RemoteActivation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_rot.c
++++ b/source3/librpc/gen_ndr/srv_rot.c
+@@ -51,7 +51,7 @@ static bool api_rot_add(struct pipes_str
+ 
+ 	r->out.result = _rot_add(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -124,7 +124,7 @@ static bool api_rot_remove(struct pipes_
+ 
+ 	r->out.result = _rot_remove(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -197,7 +197,7 @@ static bool api_rot_is_listed(struct pip
+ 
+ 	r->out.result = _rot_is_listed(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -277,7 +277,7 @@ static bool api_rot_get_interface_pointe
+ 
+ 	r->out.result = _rot_get_interface_pointer(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -350,7 +350,7 @@ static bool api_rot_set_modification_tim
+ 
+ 	r->out.result = _rot_set_modification_time(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -430,7 +430,7 @@ static bool api_rot_get_modification_tim
+ 
+ 	r->out.result = _rot_get_modification_time(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -510,7 +510,7 @@ static bool api_rot_enum(struct pipes_st
+ 
+ 	r->out.result = _rot_enum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_samr.c
++++ b/source3/librpc/gen_ndr/srv_samr.c
+@@ -51,7 +51,7 @@ static bool api_samr_Connect(struct pipe
+ 
+ 	r->out.result = _samr_Connect(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -126,7 +126,7 @@ static bool api_samr_Close(struct pipes_
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _samr_Close(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -199,7 +199,7 @@ static bool api_samr_SetSecurity(struct
+ 
+ 	r->out.result = _samr_SetSecurity(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -279,7 +279,7 @@ static bool api_samr_QuerySecurity(struc
+ 
+ 	r->out.result = _samr_QuerySecurity(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -352,7 +352,7 @@ static bool api_samr_Shutdown(struct pip
+ 
+ 	r->out.result = _samr_Shutdown(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -432,7 +432,7 @@ static bool api_samr_LookupDomain(struct
+ 
+ 	r->out.result = _samr_LookupDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -519,7 +519,7 @@ static bool api_samr_EnumDomains(struct
+ 
+ 	r->out.result = _samr_EnumDomains(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -599,7 +599,7 @@ static bool api_samr_OpenDomain(struct p
+ 
+ 	r->out.result = _samr_OpenDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -679,7 +679,7 @@ static bool api_samr_QueryDomainInfo(str
+ 
+ 	r->out.result = _samr_QueryDomainInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -752,7 +752,7 @@ static bool api_samr_SetDomainInfo(struc
+ 
+ 	r->out.result = _samr_SetDomainInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -838,7 +838,7 @@ static bool api_samr_CreateDomainGroup(s
+ 
+ 	r->out.result = _samr_CreateDomainGroup(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -925,7 +925,7 @@ static bool api_samr_EnumDomainGroups(st
+ 
+ 	r->out.result = _samr_EnumDomainGroups(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1011,7 +1011,7 @@ static bool api_samr_CreateUser(struct p
+ 
+ 	r->out.result = _samr_CreateUser(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1098,7 +1098,7 @@ static bool api_samr_EnumDomainUsers(str
+ 
+ 	r->out.result = _samr_EnumDomainUsers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1184,7 +1184,7 @@ static bool api_samr_CreateDomAlias(stru
+ 
+ 	r->out.result = _samr_CreateDomAlias(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1271,7 +1271,7 @@ static bool api_samr_EnumDomainAliases(s
+ 
+ 	r->out.result = _samr_EnumDomainAliases(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1351,7 +1351,7 @@ static bool api_samr_GetAliasMembership(
+ 
+ 	r->out.result = _samr_GetAliasMembership(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1437,7 +1437,7 @@ static bool api_samr_LookupNames(struct
+ 
+ 	r->out.result = _samr_LookupNames(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1523,7 +1523,7 @@ static bool api_samr_LookupRids(struct p
+ 
+ 	r->out.result = _samr_LookupRids(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1603,7 +1603,7 @@ static bool api_samr_OpenGroup(struct pi
+ 
+ 	r->out.result = _samr_OpenGroup(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1683,7 +1683,7 @@ static bool api_samr_QueryGroupInfo(stru
+ 
+ 	r->out.result = _samr_QueryGroupInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1756,7 +1756,7 @@ static bool api_samr_SetGroupInfo(struct
+ 
+ 	r->out.result = _samr_SetGroupInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1829,7 +1829,7 @@ static bool api_samr_AddGroupMember(stru
+ 
+ 	r->out.result = _samr_AddGroupMember(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1904,7 +1904,7 @@ static bool api_samr_DeleteDomainGroup(s
+ 	r->out.group_handle = r->in.group_handle;
+ 	r->out.result = _samr_DeleteDomainGroup(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1977,7 +1977,7 @@ static bool api_samr_DeleteGroupMember(s
+ 
+ 	r->out.result = _samr_DeleteGroupMember(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2057,7 +2057,7 @@ static bool api_samr_QueryGroupMember(st
+ 
+ 	r->out.result = _samr_QueryGroupMember(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2130,7 +2130,7 @@ static bool api_samr_SetMemberAttributes
+ 
+ 	r->out.result = _samr_SetMemberAttributesOfGroup(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2210,7 +2210,7 @@ static bool api_samr_OpenAlias(struct pi
+ 
+ 	r->out.result = _samr_OpenAlias(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2290,7 +2290,7 @@ static bool api_samr_QueryAliasInfo(stru
+ 
+ 	r->out.result = _samr_QueryAliasInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2363,7 +2363,7 @@ static bool api_samr_SetAliasInfo(struct
+ 
+ 	r->out.result = _samr_SetAliasInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2438,7 +2438,7 @@ static bool api_samr_DeleteDomAlias(stru
+ 	r->out.alias_handle = r->in.alias_handle;
+ 	r->out.result = _samr_DeleteDomAlias(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2511,7 +2511,7 @@ static bool api_samr_AddAliasMember(stru
+ 
+ 	r->out.result = _samr_AddAliasMember(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2584,7 +2584,7 @@ static bool api_samr_DeleteAliasMember(s
+ 
+ 	r->out.result = _samr_DeleteAliasMember(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2664,7 +2664,7 @@ static bool api_samr_GetMembersInAlias(s
+ 
+ 	r->out.result = _samr_GetMembersInAlias(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2744,7 +2744,7 @@ static bool api_samr_OpenUser(struct pip
+ 
+ 	r->out.result = _samr_OpenUser(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2819,7 +2819,7 @@ static bool api_samr_DeleteUser(struct p
+ 	r->out.user_handle = r->in.user_handle;
+ 	r->out.result = _samr_DeleteUser(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2899,7 +2899,7 @@ static bool api_samr_QueryUserInfo(struc
+ 
+ 	r->out.result = _samr_QueryUserInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2972,7 +2972,7 @@ static bool api_samr_SetUserInfo(struct
+ 
+ 	r->out.result = _samr_SetUserInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3045,7 +3045,7 @@ static bool api_samr_ChangePasswordUser(
+ 
+ 	r->out.result = _samr_ChangePasswordUser(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3125,7 +3125,7 @@ static bool api_samr_GetGroupsForUser(st
+ 
+ 	r->out.result = _samr_GetGroupsForUser(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3217,7 +3217,7 @@ static bool api_samr_QueryDisplayInfo(st
+ 
+ 	r->out.result = _samr_QueryDisplayInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3297,7 +3297,7 @@ static bool api_samr_GetDisplayEnumerati
+ 
+ 	r->out.result = _samr_GetDisplayEnumerationIndex(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3370,7 +3370,7 @@ static bool api_samr_TestPrivateFunction
+ 
+ 	r->out.result = _samr_TestPrivateFunctionsDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3443,7 +3443,7 @@ static bool api_samr_TestPrivateFunction
+ 
+ 	r->out.result = _samr_TestPrivateFunctionsUser(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3523,7 +3523,7 @@ static bool api_samr_GetUserPwInfo(struc
+ 
+ 	r->out.result = _samr_GetUserPwInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3596,7 +3596,7 @@ static bool api_samr_RemoveMemberFromFor
+ 
+ 	r->out.result = _samr_RemoveMemberFromForeignDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3676,7 +3676,7 @@ static bool api_samr_QueryDomainInfo2(st
+ 
+ 	r->out.result = _samr_QueryDomainInfo2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3756,7 +3756,7 @@ static bool api_samr_QueryUserInfo2(stru
+ 
+ 	r->out.result = _samr_QueryUserInfo2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3848,7 +3848,7 @@ static bool api_samr_QueryDisplayInfo2(s
+ 
+ 	r->out.result = _samr_QueryDisplayInfo2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3928,7 +3928,7 @@ static bool api_samr_GetDisplayEnumerati
+ 
+ 	r->out.result = _samr_GetDisplayEnumerationIndex2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4020,7 +4020,7 @@ static bool api_samr_CreateUser2(struct
+ 
+ 	r->out.result = _samr_CreateUser2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4112,7 +4112,7 @@ static bool api_samr_QueryDisplayInfo3(s
+ 
+ 	r->out.result = _samr_QueryDisplayInfo3(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4185,7 +4185,7 @@ static bool api_samr_AddMultipleMembersT
+ 
+ 	r->out.result = _samr_AddMultipleMembersToAlias(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4258,7 +4258,7 @@ static bool api_samr_RemoveMultipleMembe
+ 
+ 	r->out.result = _samr_RemoveMultipleMembersFromAlias(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4331,7 +4331,7 @@ static bool api_samr_OemChangePasswordUs
+ 
+ 	r->out.result = _samr_OemChangePasswordUser2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4404,7 +4404,7 @@ static bool api_samr_ChangePasswordUser2
+ 
+ 	r->out.result = _samr_ChangePasswordUser2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4484,7 +4484,7 @@ static bool api_samr_GetDomPwInfo(struct
+ 
+ 	r->out.result = _samr_GetDomPwInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4564,7 +4564,7 @@ static bool api_samr_Connect2(struct pip
+ 
+ 	r->out.result = _samr_Connect2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4637,7 +4637,7 @@ static bool api_samr_SetUserInfo2(struct
+ 
+ 	r->out.result = _samr_SetUserInfo2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4710,7 +4710,7 @@ static bool api_samr_SetBootKeyInformati
+ 
+ 	r->out.result = _samr_SetBootKeyInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4790,7 +4790,7 @@ static bool api_samr_GetBootKeyInformati
+ 
+ 	r->out.result = _samr_GetBootKeyInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4870,7 +4870,7 @@ static bool api_samr_Connect3(struct pip
+ 
+ 	r->out.result = _samr_Connect3(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4950,7 +4950,7 @@ static bool api_samr_Connect4(struct pip
+ 
+ 	r->out.result = _samr_Connect4(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5036,7 +5036,7 @@ static bool api_samr_ChangePasswordUser3
+ 
+ 	r->out.result = _samr_ChangePasswordUser3(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5128,7 +5128,7 @@ static bool api_samr_Connect5(struct pip
+ 
+ 	r->out.result = _samr_Connect5(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5208,7 +5208,7 @@ static bool api_samr_RidToSid(struct pip
+ 
+ 	r->out.result = _samr_RidToSid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5281,7 +5281,7 @@ static bool api_samr_SetDsrmPassword(str
+ 
+ 	r->out.result = _samr_SetDsrmPassword(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5361,7 +5361,7 @@ static bool api_samr_ValidatePassword(st
+ 
+ 	r->out.result = _samr_ValidatePassword(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_scerpc.c
++++ b/source3/librpc/gen_ndr/srv_scerpc.c
+@@ -44,7 +44,7 @@ static bool api_scerpc_Unknown0(struct p
+ 
+ 	r->out.result = _scerpc_Unknown0(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_spoolss.c
++++ b/source3/librpc/gen_ndr/srv_spoolss.c
+@@ -63,7 +63,7 @@ static bool api_spoolss_EnumPrinters(str
+ 
+ 	r->out.result = _spoolss_EnumPrinters(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -143,7 +143,7 @@ static bool api_spoolss_OpenPrinter(stru
+ 
+ 	r->out.result = _spoolss_OpenPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -216,7 +216,7 @@ static bool api_spoolss_SetJob(struct pi
+ 
+ 	r->out.result = _spoolss_SetJob(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -302,7 +302,7 @@ static bool api_spoolss_GetJob(struct pi
+ 
+ 	r->out.result = _spoolss_GetJob(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -394,7 +394,7 @@ static bool api_spoolss_EnumJobs(struct
+ 
+ 	r->out.result = _spoolss_EnumJobs(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -474,7 +474,7 @@ static bool api_spoolss_AddPrinter(struc
+ 
+ 	r->out.result = _spoolss_AddPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -547,7 +547,7 @@ static bool api_spoolss_DeletePrinter(st
+ 
+ 	r->out.result = _spoolss_DeletePrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -620,7 +620,7 @@ static bool api_spoolss_SetPrinter(struc
+ 
+ 	r->out.result = _spoolss_SetPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -706,7 +706,7 @@ static bool api_spoolss_GetPrinter(struc
+ 
+ 	r->out.result = _spoolss_GetPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -779,7 +779,7 @@ static bool api_spoolss_AddPrinterDriver
+ 
+ 	r->out.result = _spoolss_AddPrinterDriver(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -871,7 +871,7 @@ static bool api_spoolss_EnumPrinterDrive
+ 
+ 	r->out.result = _spoolss_EnumPrinterDrivers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -957,7 +957,7 @@ static bool api_spoolss_GetPrinterDriver
+ 
+ 	r->out.result = _spoolss_GetPrinterDriver(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1043,7 +1043,7 @@ static bool api_spoolss_GetPrinterDriver
+ 
+ 	r->out.result = _spoolss_GetPrinterDriverDirectory(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1116,7 +1116,7 @@ static bool api_spoolss_DeletePrinterDri
+ 
+ 	r->out.result = _spoolss_DeletePrinterDriver(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1189,7 +1189,7 @@ static bool api_spoolss_AddPrintProcesso
+ 
+ 	r->out.result = _spoolss_AddPrintProcessor(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1281,7 +1281,7 @@ static bool api_spoolss_EnumPrintProcess
+ 
+ 	r->out.result = _spoolss_EnumPrintProcessors(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1367,7 +1367,7 @@ static bool api_spoolss_GetPrintProcesso
+ 
+ 	r->out.result = _spoolss_GetPrintProcessorDirectory(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1447,7 +1447,7 @@ static bool api_spoolss_StartDocPrinter(
+ 
+ 	r->out.result = _spoolss_StartDocPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1520,7 +1520,7 @@ static bool api_spoolss_StartPagePrinter
+ 
+ 	r->out.result = _spoolss_StartPagePrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1600,7 +1600,7 @@ static bool api_spoolss_WritePrinter(str
+ 
+ 	r->out.result = _spoolss_WritePrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1673,7 +1673,7 @@ static bool api_spoolss_EndPagePrinter(s
+ 
+ 	r->out.result = _spoolss_EndPagePrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1746,7 +1746,7 @@ static bool api_spoolss_AbortPrinter(str
+ 
+ 	r->out.result = _spoolss_AbortPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1832,7 +1832,7 @@ static bool api_spoolss_ReadPrinter(stru
+ 
+ 	r->out.result = _spoolss_ReadPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1905,7 +1905,7 @@ static bool api_spoolss_EndDocPrinter(st
+ 
+ 	r->out.result = _spoolss_EndDocPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1986,7 +1986,7 @@ static bool api_spoolss_AddJob(struct pi
+ 
+ 	r->out.result = _spoolss_AddJob(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2059,7 +2059,7 @@ static bool api_spoolss_ScheduleJob(stru
+ 
+ 	r->out.result = _spoolss_ScheduleJob(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2151,7 +2151,7 @@ static bool api_spoolss_GetPrinterData(s
+ 
+ 	r->out.result = _spoolss_GetPrinterData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2224,7 +2224,7 @@ static bool api_spoolss_SetPrinterData(s
+ 
+ 	r->out.result = _spoolss_SetPrinterData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2297,7 +2297,7 @@ static bool api_spoolss_WaitForPrinterCh
+ 
+ 	r->out.result = _spoolss_WaitForPrinterChange(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2372,7 +2372,7 @@ static bool api_spoolss_ClosePrinter(str
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _spoolss_ClosePrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2445,7 +2445,7 @@ static bool api_spoolss_AddForm(struct p
+ 
+ 	r->out.result = _spoolss_AddForm(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2518,7 +2518,7 @@ static bool api_spoolss_DeleteForm(struc
+ 
+ 	r->out.result = _spoolss_DeleteForm(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2604,7 +2604,7 @@ static bool api_spoolss_GetForm(struct p
+ 
+ 	r->out.result = _spoolss_GetForm(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2677,7 +2677,7 @@ static bool api_spoolss_SetForm(struct p
+ 
+ 	r->out.result = _spoolss_SetForm(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2769,7 +2769,7 @@ static bool api_spoolss_EnumForms(struct
+ 
+ 	r->out.result = _spoolss_EnumForms(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2861,7 +2861,7 @@ static bool api_spoolss_EnumPorts(struct
+ 
+ 	r->out.result = _spoolss_EnumPorts(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2953,7 +2953,7 @@ static bool api_spoolss_EnumMonitors(str
+ 
+ 	r->out.result = _spoolss_EnumMonitors(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3026,7 +3026,7 @@ static bool api_spoolss_AddPort(struct p
+ 
+ 	r->out.result = _spoolss_AddPort(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3099,7 +3099,7 @@ static bool api_spoolss_ConfigurePort(st
+ 
+ 	r->out.result = _spoolss_ConfigurePort(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3172,7 +3172,7 @@ static bool api_spoolss_DeletePort(struc
+ 
+ 	r->out.result = _spoolss_DeletePort(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3252,7 +3252,7 @@ static bool api_spoolss_CreatePrinterIC(
+ 
+ 	r->out.result = _spoolss_CreatePrinterIC(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3325,7 +3325,7 @@ static bool api_spoolss_PlayGDIScriptOnP
+ 
+ 	r->out.result = _spoolss_PlayGDIScriptOnPrinterIC(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3400,7 +3400,7 @@ static bool api_spoolss_DeletePrinterIC(
+ 	r->out.gdi_handle = r->in.gdi_handle;
+ 	r->out.result = _spoolss_DeletePrinterIC(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3473,7 +3473,7 @@ static bool api_spoolss_AddPrinterConnec
+ 
+ 	r->out.result = _spoolss_AddPrinterConnection(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3546,7 +3546,7 @@ static bool api_spoolss_DeletePrinterCon
+ 
+ 	r->out.result = _spoolss_DeletePrinterConnection(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3619,7 +3619,7 @@ static bool api_spoolss_PrinterMessageBo
+ 
+ 	r->out.result = _spoolss_PrinterMessageBox(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3692,7 +3692,7 @@ static bool api_spoolss_AddMonitor(struc
+ 
+ 	r->out.result = _spoolss_AddMonitor(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3765,7 +3765,7 @@ static bool api_spoolss_DeleteMonitor(st
+ 
+ 	r->out.result = _spoolss_DeleteMonitor(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3838,7 +3838,7 @@ static bool api_spoolss_DeletePrintProce
+ 
+ 	r->out.result = _spoolss_DeletePrintProcessor(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3911,7 +3911,7 @@ static bool api_spoolss_AddPrintProvidor
+ 
+ 	r->out.result = _spoolss_AddPrintProvidor(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3984,7 +3984,7 @@ static bool api_spoolss_DeletePrintProvi
+ 
+ 	r->out.result = _spoolss_DeletePrintProvidor(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4076,7 +4076,7 @@ static bool api_spoolss_EnumPrintProcDat
+ 
+ 	r->out.result = _spoolss_EnumPrintProcDataTypes(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4149,7 +4149,7 @@ static bool api_spoolss_ResetPrinter(str
+ 
+ 	r->out.result = _spoolss_ResetPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4247,7 +4247,7 @@ static bool api_spoolss_GetPrinterDriver
+ 
+ 	r->out.result = _spoolss_GetPrinterDriver2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4320,7 +4320,7 @@ static bool api_spoolss_FindFirstPrinter
+ 
+ 	r->out.result = _spoolss_FindFirstPrinterChangeNotification(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4393,7 +4393,7 @@ static bool api_spoolss_FindNextPrinterC
+ 
+ 	r->out.result = _spoolss_FindNextPrinterChangeNotification(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4466,7 +4466,7 @@ static bool api_spoolss_FindClosePrinter
+ 
+ 	r->out.result = _spoolss_FindClosePrinterNotify(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4539,7 +4539,7 @@ static bool api_spoolss_RouterFindFirstP
+ 
+ 	r->out.result = _spoolss_RouterFindFirstPrinterChangeNotificationOld(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4619,7 +4619,7 @@ static bool api_spoolss_ReplyOpenPrinter
+ 
+ 	r->out.result = _spoolss_ReplyOpenPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4692,7 +4692,7 @@ static bool api_spoolss_RouterReplyPrint
+ 
+ 	r->out.result = _spoolss_RouterReplyPrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4767,7 +4767,7 @@ static bool api_spoolss_ReplyClosePrinte
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _spoolss_ReplyClosePrinter(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4840,7 +4840,7 @@ static bool api_spoolss_AddPortEx(struct
+ 
+ 	r->out.result = _spoolss_AddPortEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4913,7 +4913,7 @@ static bool api_spoolss_RouterFindFirstP
+ 
+ 	r->out.result = _spoolss_RouterFindFirstPrinterChangeNotification(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4986,7 +4986,7 @@ static bool api_spoolss_SpoolerInit(stru
+ 
+ 	r->out.result = _spoolss_SpoolerInit(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5059,7 +5059,7 @@ static bool api_spoolss_ResetPrinterEx(s
+ 
+ 	r->out.result = _spoolss_ResetPrinterEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5132,7 +5132,7 @@ static bool api_spoolss_RemoteFindFirstP
+ 
+ 	r->out.result = _spoolss_RemoteFindFirstPrinterChangeNotifyEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5212,7 +5212,7 @@ static bool api_spoolss_RouterReplyPrint
+ 
+ 	r->out.result = _spoolss_RouterReplyPrinterEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5292,7 +5292,7 @@ static bool api_spoolss_RouterRefreshPri
+ 
+ 	r->out.result = _spoolss_RouterRefreshPrinterChangeNotify(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5365,7 +5365,7 @@ static bool api_spoolss_44(struct pipes_
+ 
+ 	r->out.result = _spoolss_44(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5445,7 +5445,7 @@ static bool api_spoolss_OpenPrinterEx(st
+ 
+ 	r->out.result = _spoolss_OpenPrinterEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5525,7 +5525,7 @@ static bool api_spoolss_AddPrinterEx(str
+ 
+ 	r->out.result = _spoolss_AddPrinterEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5598,7 +5598,7 @@ static bool api_spoolss_SetPort(struct p
+ 
+ 	r->out.result = _spoolss_SetPort(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5702,7 +5702,7 @@ static bool api_spoolss_EnumPrinterData(
+ 
+ 	r->out.result = _spoolss_EnumPrinterData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5775,7 +5775,7 @@ static bool api_spoolss_DeletePrinterDat
+ 
+ 	r->out.result = _spoolss_DeletePrinterData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5848,7 +5848,7 @@ static bool api_spoolss_4a(struct pipes_
+ 
+ 	r->out.result = _spoolss_4a(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5921,7 +5921,7 @@ static bool api_spoolss_4b(struct pipes_
+ 
+ 	r->out.result = _spoolss_4b(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -5994,7 +5994,7 @@ static bool api_spoolss_4c(struct pipes_
+ 
+ 	r->out.result = _spoolss_4c(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6067,7 +6067,7 @@ static bool api_spoolss_SetPrinterDataEx
+ 
+ 	r->out.result = _spoolss_SetPrinterDataEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6159,7 +6159,7 @@ static bool api_spoolss_GetPrinterDataEx
+ 
+ 	r->out.result = _spoolss_GetPrinterDataEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6251,7 +6251,7 @@ static bool api_spoolss_EnumPrinterDataE
+ 
+ 	r->out.result = _spoolss_EnumPrinterDataEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6343,7 +6343,7 @@ static bool api_spoolss_EnumPrinterKey(s
+ 
+ 	r->out.result = _spoolss_EnumPrinterKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6416,7 +6416,7 @@ static bool api_spoolss_DeletePrinterDat
+ 
+ 	r->out.result = _spoolss_DeletePrinterDataEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6489,7 +6489,7 @@ static bool api_spoolss_DeletePrinterKey
+ 
+ 	r->out.result = _spoolss_DeletePrinterKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6562,7 +6562,7 @@ static bool api_spoolss_53(struct pipes_
+ 
+ 	r->out.result = _spoolss_53(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6635,7 +6635,7 @@ static bool api_spoolss_DeletePrinterDri
+ 
+ 	r->out.result = _spoolss_DeletePrinterDriverEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6708,7 +6708,7 @@ static bool api_spoolss_AddPerMachineCon
+ 
+ 	r->out.result = _spoolss_AddPerMachineConnection(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6781,7 +6781,7 @@ static bool api_spoolss_DeletePerMachine
+ 
+ 	r->out.result = _spoolss_DeletePerMachineConnection(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6854,7 +6854,7 @@ static bool api_spoolss_EnumPerMachineCo
+ 
+ 	r->out.result = _spoolss_EnumPerMachineConnections(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -6941,7 +6941,7 @@ static bool api_spoolss_XcvData(struct p
+ 
+ 	r->out.result = _spoolss_XcvData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7014,7 +7014,7 @@ static bool api_spoolss_AddPrinterDriver
+ 
+ 	r->out.result = _spoolss_AddPrinterDriverEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7087,7 +7087,7 @@ static bool api_spoolss_5a(struct pipes_
+ 
+ 	r->out.result = _spoolss_5a(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7160,7 +7160,7 @@ static bool api_spoolss_5b(struct pipes_
+ 
+ 	r->out.result = _spoolss_5b(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7233,7 +7233,7 @@ static bool api_spoolss_5c(struct pipes_
+ 
+ 	r->out.result = _spoolss_5c(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7306,7 +7306,7 @@ static bool api_spoolss_5d(struct pipes_
+ 
+ 	r->out.result = _spoolss_5d(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7379,7 +7379,7 @@ static bool api_spoolss_5e(struct pipes_
+ 
+ 	r->out.result = _spoolss_5e(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7452,7 +7452,7 @@ static bool api_spoolss_5f(struct pipes_
+ 
+ 	r->out.result = _spoolss_5f(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7525,7 +7525,7 @@ static bool api_spoolss_60(struct pipes_
+ 
+ 	r->out.result = _spoolss_60(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7598,7 +7598,7 @@ static bool api_spoolss_61(struct pipes_
+ 
+ 	r->out.result = _spoolss_61(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7671,7 +7671,7 @@ static bool api_spoolss_62(struct pipes_
+ 
+ 	r->out.result = _spoolss_62(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7744,7 +7744,7 @@ static bool api_spoolss_63(struct pipes_
+ 
+ 	r->out.result = _spoolss_63(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7817,7 +7817,7 @@ static bool api_spoolss_64(struct pipes_
+ 
+ 	r->out.result = _spoolss_64(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7890,7 +7890,7 @@ static bool api_spoolss_65(struct pipes_
+ 
+ 	r->out.result = _spoolss_65(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -7970,7 +7970,7 @@ static bool api_spoolss_GetCorePrinterDr
+ 
+ 	r->out.result = _spoolss_GetCorePrinterDrivers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -8043,7 +8043,7 @@ static bool api_spoolss_67(struct pipes_
+ 
+ 	r->out.result = _spoolss_67(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -8124,7 +8124,7 @@ static bool api_spoolss_GetPrinterDriver
+ 
+ 	r->out.result = _spoolss_GetPrinterDriverPackagePath(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -8197,7 +8197,7 @@ static bool api_spoolss_69(struct pipes_
+ 
+ 	r->out.result = _spoolss_69(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -8270,7 +8270,7 @@ static bool api_spoolss_6a(struct pipes_
+ 
+ 	r->out.result = _spoolss_6a(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -8343,7 +8343,7 @@ static bool api_spoolss_6b(struct pipes_
+ 
+ 	r->out.result = _spoolss_6b(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -8416,7 +8416,7 @@ static bool api_spoolss_6c(struct pipes_
+ 
+ 	r->out.result = _spoolss_6c(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -8489,7 +8489,7 @@ static bool api_spoolss_6d(struct pipes_
+ 
+ 	r->out.result = _spoolss_6d(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_srvsvc.c
++++ b/source3/librpc/gen_ndr/srv_srvsvc.c
+@@ -53,7 +53,7 @@ static bool api_srvsvc_NetCharDevEnum(st
+ 
+ 	r->out.result = _srvsvc_NetCharDevEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -133,7 +133,7 @@ static bool api_srvsvc_NetCharDevGetInfo
+ 
+ 	r->out.result = _srvsvc_NetCharDevGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -206,7 +206,7 @@ static bool api_srvsvc_NetCharDevControl
+ 
+ 	r->out.result = _srvsvc_NetCharDevControl(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -288,7 +288,7 @@ static bool api_srvsvc_NetCharDevQEnum(s
+ 
+ 	r->out.result = _srvsvc_NetCharDevQEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -368,7 +368,7 @@ static bool api_srvsvc_NetCharDevQGetInf
+ 
+ 	r->out.result = _srvsvc_NetCharDevQGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -443,7 +443,7 @@ static bool api_srvsvc_NetCharDevQSetInf
+ 	r->out.parm_error = r->in.parm_error;
+ 	r->out.result = _srvsvc_NetCharDevQSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -516,7 +516,7 @@ static bool api_srvsvc_NetCharDevQPurge(
+ 
+ 	r->out.result = _srvsvc_NetCharDevQPurge(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -589,7 +589,7 @@ static bool api_srvsvc_NetCharDevQPurgeS
+ 
+ 	r->out.result = _srvsvc_NetCharDevQPurgeSelf(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -671,7 +671,7 @@ static bool api_srvsvc_NetConnEnum(struc
+ 
+ 	r->out.result = _srvsvc_NetConnEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -753,7 +753,7 @@ static bool api_srvsvc_NetFileEnum(struc
+ 
+ 	r->out.result = _srvsvc_NetFileEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -833,7 +833,7 @@ static bool api_srvsvc_NetFileGetInfo(st
+ 
+ 	r->out.result = _srvsvc_NetFileGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -906,7 +906,7 @@ static bool api_srvsvc_NetFileClose(stru
+ 
+ 	r->out.result = _srvsvc_NetFileClose(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -988,7 +988,7 @@ static bool api_srvsvc_NetSessEnum(struc
+ 
+ 	r->out.result = _srvsvc_NetSessEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1061,7 +1061,7 @@ static bool api_srvsvc_NetSessDel(struct
+ 
+ 	r->out.result = _srvsvc_NetSessDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1136,7 +1136,7 @@ static bool api_srvsvc_NetShareAdd(struc
+ 	r->out.parm_error = r->in.parm_error;
+ 	r->out.result = _srvsvc_NetShareAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1218,7 +1218,7 @@ static bool api_srvsvc_NetShareEnumAll(s
+ 
+ 	r->out.result = _srvsvc_NetShareEnumAll(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1298,7 +1298,7 @@ static bool api_srvsvc_NetShareGetInfo(s
+ 
+ 	r->out.result = _srvsvc_NetShareGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1373,7 +1373,7 @@ static bool api_srvsvc_NetShareSetInfo(s
+ 	r->out.parm_error = r->in.parm_error;
+ 	r->out.result = _srvsvc_NetShareSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1446,7 +1446,7 @@ static bool api_srvsvc_NetShareDel(struc
+ 
+ 	r->out.result = _srvsvc_NetShareDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1519,7 +1519,7 @@ static bool api_srvsvc_NetShareDelSticky
+ 
+ 	r->out.result = _srvsvc_NetShareDelSticky(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1599,7 +1599,7 @@ static bool api_srvsvc_NetShareCheck(str
+ 
+ 	r->out.result = _srvsvc_NetShareCheck(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1679,7 +1679,7 @@ static bool api_srvsvc_NetSrvGetInfo(str
+ 
+ 	r->out.result = _srvsvc_NetSrvGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1754,7 +1754,7 @@ static bool api_srvsvc_NetSrvSetInfo(str
+ 	r->out.parm_error = r->in.parm_error;
+ 	r->out.result = _srvsvc_NetSrvSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1836,7 +1836,7 @@ static bool api_srvsvc_NetDiskEnum(struc
+ 
+ 	r->out.result = _srvsvc_NetDiskEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1916,7 +1916,7 @@ static bool api_srvsvc_NetServerStatisti
+ 
+ 	r->out.result = _srvsvc_NetServerStatisticsGet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1989,7 +1989,7 @@ static bool api_srvsvc_NetTransportAdd(s
+ 
+ 	r->out.result = _srvsvc_NetTransportAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2071,7 +2071,7 @@ static bool api_srvsvc_NetTransportEnum(
+ 
+ 	r->out.result = _srvsvc_NetTransportEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2144,7 +2144,7 @@ static bool api_srvsvc_NetTransportDel(s
+ 
+ 	r->out.result = _srvsvc_NetTransportDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2224,7 +2224,7 @@ static bool api_srvsvc_NetRemoteTOD(stru
+ 
+ 	r->out.result = _srvsvc_NetRemoteTOD(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2297,7 +2297,7 @@ static bool api_srvsvc_NetSetServiceBits
+ 
+ 	r->out.result = _srvsvc_NetSetServiceBits(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2377,7 +2377,7 @@ static bool api_srvsvc_NetPathType(struc
+ 
+ 	r->out.result = _srvsvc_NetPathType(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2458,7 +2458,7 @@ static bool api_srvsvc_NetPathCanonicali
+ 
+ 	r->out.result = _srvsvc_NetPathCanonicalize(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2531,7 +2531,7 @@ static bool api_srvsvc_NetPathCompare(st
+ 
+ 	r->out.result = _srvsvc_NetPathCompare(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2604,7 +2604,7 @@ static bool api_srvsvc_NetNameValidate(s
+ 
+ 	r->out.result = _srvsvc_NetNameValidate(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2677,7 +2677,7 @@ static bool api_srvsvc_NETRPRNAMECANONIC
+ 
+ 	r->out.result = _srvsvc_NETRPRNAMECANONICALIZE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2750,7 +2750,7 @@ static bool api_srvsvc_NetPRNameCompare(
+ 
+ 	r->out.result = _srvsvc_NetPRNameCompare(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2832,7 +2832,7 @@ static bool api_srvsvc_NetShareEnum(stru
+ 
+ 	r->out.result = _srvsvc_NetShareEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2912,7 +2912,7 @@ static bool api_srvsvc_NetShareDelStart(
+ 
+ 	r->out.result = _srvsvc_NetShareDelStart(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2987,7 +2987,7 @@ static bool api_srvsvc_NetShareDelCommit
+ 	r->out.hnd = r->in.hnd;
+ 	r->out.result = _srvsvc_NetShareDelCommit(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3067,7 +3067,7 @@ static bool api_srvsvc_NetGetFileSecurit
+ 
+ 	r->out.result = _srvsvc_NetGetFileSecurity(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3140,7 +3140,7 @@ static bool api_srvsvc_NetSetFileSecurit
+ 
+ 	r->out.result = _srvsvc_NetSetFileSecurity(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3213,7 +3213,7 @@ static bool api_srvsvc_NetServerTranspor
+ 
+ 	r->out.result = _srvsvc_NetServerTransportAddEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3286,7 +3286,7 @@ static bool api_srvsvc_NetServerSetServi
+ 
+ 	r->out.result = _srvsvc_NetServerSetServiceBitsEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3359,7 +3359,7 @@ static bool api_srvsvc_NETRDFSGETVERSION
+ 
+ 	r->out.result = _srvsvc_NETRDFSGETVERSION(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3432,7 +3432,7 @@ static bool api_srvsvc_NETRDFSCREATELOCA
+ 
+ 	r->out.result = _srvsvc_NETRDFSCREATELOCALPARTITION(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3505,7 +3505,7 @@ static bool api_srvsvc_NETRDFSDELETELOCA
+ 
+ 	r->out.result = _srvsvc_NETRDFSDELETELOCALPARTITION(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3578,7 +3578,7 @@ static bool api_srvsvc_NETRDFSSETLOCALVO
+ 
+ 	r->out.result = _srvsvc_NETRDFSSETLOCALVOLUMESTATE(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3651,7 +3651,7 @@ static bool api_srvsvc_NETRDFSSETSERVERI
+ 
+ 	r->out.result = _srvsvc_NETRDFSSETSERVERINFO(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3724,7 +3724,7 @@ static bool api_srvsvc_NETRDFSCREATEEXIT
+ 
+ 	r->out.result = _srvsvc_NETRDFSCREATEEXITPOINT(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3797,7 +3797,7 @@ static bool api_srvsvc_NETRDFSDELETEEXIT
+ 
+ 	r->out.result = _srvsvc_NETRDFSDELETEEXITPOINT(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3870,7 +3870,7 @@ static bool api_srvsvc_NETRDFSMODIFYPREF
+ 
+ 	r->out.result = _srvsvc_NETRDFSMODIFYPREFIX(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3943,7 +3943,7 @@ static bool api_srvsvc_NETRDFSFIXLOCALVO
+ 
+ 	r->out.result = _srvsvc_NETRDFSFIXLOCALVOLUME(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4016,7 +4016,7 @@ static bool api_srvsvc_NETRDFSMANAGERREP
+ 
+ 	r->out.result = _srvsvc_NETRDFSMANAGERREPORTSITEINFO(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4089,7 +4089,7 @@ static bool api_srvsvc_NETRSERVERTRANSPO
+ 
+ 	r->out.result = _srvsvc_NETRSERVERTRANSPORTDELEX(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_svcctl.c
++++ b/source3/librpc/gen_ndr/srv_svcctl.c
+@@ -46,7 +46,7 @@ static bool api_svcctl_CloseServiceHandl
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _svcctl_CloseServiceHandle(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -126,7 +126,7 @@ static bool api_svcctl_ControlService(st
+ 
+ 	r->out.result = _svcctl_ControlService(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -199,7 +199,7 @@ static bool api_svcctl_DeleteService(str
+ 
+ 	r->out.result = _svcctl_DeleteService(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -279,7 +279,7 @@ static bool api_svcctl_LockServiceDataba
+ 
+ 	r->out.result = _svcctl_LockServiceDatabase(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -365,7 +365,7 @@ static bool api_svcctl_QueryServiceObjec
+ 
+ 	r->out.result = _svcctl_QueryServiceObjectSecurity(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -438,7 +438,7 @@ static bool api_svcctl_SetServiceObjectS
+ 
+ 	r->out.result = _svcctl_SetServiceObjectSecurity(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -518,7 +518,7 @@ static bool api_svcctl_QueryServiceStatu
+ 
+ 	r->out.result = _svcctl_QueryServiceStatus(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -591,7 +591,7 @@ static bool api_svcctl_SetServiceStatus(
+ 
+ 	r->out.result = _svcctl_SetServiceStatus(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -666,7 +666,7 @@ static bool api_svcctl_UnlockServiceData
+ 	r->out.lock = r->in.lock;
+ 	r->out.result = _svcctl_UnlockServiceDatabase(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -739,7 +739,7 @@ static bool api_svcctl_NotifyBootConfigS
+ 
+ 	r->out.result = _svcctl_NotifyBootConfigStatus(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -812,7 +812,7 @@ static bool api_svcctl_SCSetServiceBitsW
+ 
+ 	r->out.result = _svcctl_SCSetServiceBitsW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -892,7 +892,7 @@ static bool api_svcctl_ChangeServiceConf
+ 
+ 	r->out.result = _svcctl_ChangeServiceConfigW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -973,7 +973,7 @@ static bool api_svcctl_CreateServiceW(st
+ 
+ 	r->out.result = _svcctl_CreateServiceW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1065,7 +1065,7 @@ static bool api_svcctl_EnumDependentServ
+ 
+ 	r->out.result = _svcctl_EnumDependentServicesW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1158,7 +1158,7 @@ static bool api_svcctl_EnumServicesStatu
+ 
+ 	r->out.result = _svcctl_EnumServicesStatusW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1238,7 +1238,7 @@ static bool api_svcctl_OpenSCManagerW(st
+ 
+ 	r->out.result = _svcctl_OpenSCManagerW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1318,7 +1318,7 @@ static bool api_svcctl_OpenServiceW(stru
+ 
+ 	r->out.result = _svcctl_OpenServiceW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1404,7 +1404,7 @@ static bool api_svcctl_QueryServiceConfi
+ 
+ 	r->out.result = _svcctl_QueryServiceConfigW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1490,7 +1490,7 @@ static bool api_svcctl_QueryServiceLockS
+ 
+ 	r->out.result = _svcctl_QueryServiceLockStatusW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1563,7 +1563,7 @@ static bool api_svcctl_StartServiceW(str
+ 
+ 	r->out.result = _svcctl_StartServiceW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1644,7 +1644,7 @@ static bool api_svcctl_GetServiceDisplay
+ 
+ 	r->out.result = _svcctl_GetServiceDisplayNameW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1725,7 +1725,7 @@ static bool api_svcctl_GetServiceKeyName
+ 
+ 	r->out.result = _svcctl_GetServiceKeyNameW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1798,7 +1798,7 @@ static bool api_svcctl_SCSetServiceBitsA
+ 
+ 	r->out.result = _svcctl_SCSetServiceBitsA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1878,7 +1878,7 @@ static bool api_svcctl_ChangeServiceConf
+ 
+ 	r->out.result = _svcctl_ChangeServiceConfigA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1958,7 +1958,7 @@ static bool api_svcctl_CreateServiceA(st
+ 
+ 	r->out.result = _svcctl_CreateServiceA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2050,7 +2050,7 @@ static bool api_svcctl_EnumDependentServ
+ 
+ 	r->out.result = _svcctl_EnumDependentServicesA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2143,7 +2143,7 @@ static bool api_svcctl_EnumServicesStatu
+ 
+ 	r->out.result = _svcctl_EnumServicesStatusA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2223,7 +2223,7 @@ static bool api_svcctl_OpenSCManagerA(st
+ 
+ 	r->out.result = _svcctl_OpenSCManagerA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2296,7 +2296,7 @@ static bool api_svcctl_OpenServiceA(stru
+ 
+ 	r->out.result = _svcctl_OpenServiceA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2382,7 +2382,7 @@ static bool api_svcctl_QueryServiceConfi
+ 
+ 	r->out.result = _svcctl_QueryServiceConfigA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2468,7 +2468,7 @@ static bool api_svcctl_QueryServiceLockS
+ 
+ 	r->out.result = _svcctl_QueryServiceLockStatusA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2541,7 +2541,7 @@ static bool api_svcctl_StartServiceA(str
+ 
+ 	r->out.result = _svcctl_StartServiceA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2622,7 +2622,7 @@ static bool api_svcctl_GetServiceDisplay
+ 
+ 	r->out.result = _svcctl_GetServiceDisplayNameA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2703,7 +2703,7 @@ static bool api_svcctl_GetServiceKeyName
+ 
+ 	r->out.result = _svcctl_GetServiceKeyNameA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2776,7 +2776,7 @@ static bool api_svcctl_GetCurrentGroupeS
+ 
+ 	r->out.result = _svcctl_GetCurrentGroupeStateW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2849,7 +2849,7 @@ static bool api_svcctl_EnumServiceGroupW
+ 
+ 	r->out.result = _svcctl_EnumServiceGroupW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2922,7 +2922,7 @@ static bool api_svcctl_ChangeServiceConf
+ 
+ 	r->out.result = _svcctl_ChangeServiceConfig2A(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2995,7 +2995,7 @@ static bool api_svcctl_ChangeServiceConf
+ 
+ 	r->out.result = _svcctl_ChangeServiceConfig2W(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3081,7 +3081,7 @@ static bool api_svcctl_QueryServiceConfi
+ 
+ 	r->out.result = _svcctl_QueryServiceConfig2A(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3167,7 +3167,7 @@ static bool api_svcctl_QueryServiceConfi
+ 
+ 	r->out.result = _svcctl_QueryServiceConfig2W(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3253,7 +3253,7 @@ static bool api_svcctl_QueryServiceStatu
+ 
+ 	r->out.result = _svcctl_QueryServiceStatusEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3352,7 +3352,7 @@ static bool api_EnumServicesStatusExA(st
+ 
+ 	r->out.result = _EnumServicesStatusExA(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3445,7 +3445,7 @@ static bool api_EnumServicesStatusExW(st
+ 
+ 	r->out.result = _EnumServicesStatusExW(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3518,7 +3518,7 @@ static bool api_svcctl_SCSendTSMessage(s
+ 
+ 	r->out.result = _svcctl_SCSendTSMessage(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_trkwks.c
++++ b/source3/librpc/gen_ndr/srv_trkwks.c
+@@ -44,7 +44,7 @@ static bool api_trkwks_Unknown0(struct p
+ 
+ 	r->out.result = _trkwks_Unknown0(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_unixinfo.c
++++ b/source3/librpc/gen_ndr/srv_unixinfo.c
+@@ -51,7 +51,7 @@ static bool api_unixinfo_SidToUid(struct
+ 
+ 	r->out.result = _unixinfo_SidToUid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -131,7 +131,7 @@ static bool api_unixinfo_UidToSid(struct
+ 
+ 	r->out.result = _unixinfo_UidToSid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -211,7 +211,7 @@ static bool api_unixinfo_SidToGid(struct
+ 
+ 	r->out.result = _unixinfo_SidToGid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -291,7 +291,7 @@ static bool api_unixinfo_GidToSid(struct
+ 
+ 	r->out.result = _unixinfo_GidToSid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -372,7 +372,7 @@ static bool api_unixinfo_GetPWUid(struct
+ 
+ 	r->out.result = _unixinfo_GetPWUid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_w32time.c
++++ b/source3/librpc/gen_ndr/srv_w32time.c
+@@ -44,7 +44,7 @@ static bool api_w32time_SyncTime(struct
+ 
+ 	r->out.result = _w32time_SyncTime(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_w32time_GetNetLogonServi
+ 
+ 	r->out.result = _w32time_GetNetLogonServiceBits(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_w32time_QueryProviderSta
+ 
+ 	r->out.result = _w32time_QueryProviderStatus(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_wbint.c
++++ b/source3/librpc/gen_ndr/srv_wbint.c
+@@ -51,7 +51,7 @@ static bool api_wbint_Ping(struct pipes_
+ 
+ 	_wbint_Ping(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -143,7 +143,7 @@ static bool api_wbint_LookupSid(struct p
+ 
+ 	r->out.result = _wbint_LookupSid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -229,7 +229,7 @@ static bool api_wbint_LookupSids(struct
+ 
+ 	r->out.result = _wbint_LookupSids(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -315,7 +315,7 @@ static bool api_wbint_LookupName(struct
+ 
+ 	r->out.result = _wbint_LookupName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -395,7 +395,7 @@ static bool api_wbint_Sid2Uid(struct pip
+ 
+ 	r->out.result = _wbint_Sid2Uid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -475,7 +475,7 @@ static bool api_wbint_Sid2Gid(struct pip
+ 
+ 	r->out.result = _wbint_Sid2Gid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -550,7 +550,7 @@ static bool api_wbint_Sids2UnixIDs(struc
+ 	r->out.ids = r->in.ids;
+ 	r->out.result = _wbint_Sids2UnixIDs(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -630,7 +630,7 @@ static bool api_wbint_Uid2Sid(struct pip
+ 
+ 	r->out.result = _wbint_Uid2Sid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -710,7 +710,7 @@ static bool api_wbint_Gid2Sid(struct pip
+ 
+ 	r->out.result = _wbint_Gid2Sid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -790,7 +790,7 @@ static bool api_wbint_AllocateUid(struct
+ 
+ 	r->out.result = _wbint_AllocateUid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -870,7 +870,7 @@ static bool api_wbint_AllocateGid(struct
+ 
+ 	r->out.result = _wbint_AllocateGid(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -950,7 +950,7 @@ static bool api_wbint_QueryUser(struct p
+ 
+ 	r->out.result = _wbint_QueryUser(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1030,7 +1030,7 @@ static bool api_wbint_LookupUserAliases(
+ 
+ 	r->out.result = _wbint_LookupUserAliases(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1110,7 +1110,7 @@ static bool api_wbint_LookupUserGroups(s
+ 
+ 	r->out.result = _wbint_LookupUserGroups(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1190,7 +1190,7 @@ static bool api_wbint_QuerySequenceNumbe
+ 
+ 	r->out.result = _wbint_QuerySequenceNumber(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1270,7 +1270,7 @@ static bool api_wbint_LookupGroupMembers
+ 
+ 	r->out.result = _wbint_LookupGroupMembers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1350,7 +1350,7 @@ static bool api_wbint_QueryUserList(stru
+ 
+ 	r->out.result = _wbint_QueryUserList(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1430,7 +1430,7 @@ static bool api_wbint_QueryGroupList(str
+ 
+ 	r->out.result = _wbint_QueryGroupList(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1510,7 +1510,7 @@ static bool api_wbint_DsGetDcName(struct
+ 
+ 	r->out.result = _wbint_DsGetDcName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1596,7 +1596,7 @@ static bool api_wbint_LookupRids(struct
+ 
+ 	r->out.result = _wbint_LookupRids(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1669,7 +1669,7 @@ static bool api_wbint_CheckMachineAccoun
+ 
+ 	r->out.result = _wbint_CheckMachineAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1742,7 +1742,7 @@ static bool api_wbint_ChangeMachineAccou
+ 
+ 	r->out.result = _wbint_ChangeMachineAccount(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1815,7 +1815,7 @@ static bool api_wbint_PingDc(struct pipe
+ 
+ 	r->out.result = _wbint_PingDc(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_winreg.c
++++ b/source3/librpc/gen_ndr/srv_winreg.c
+@@ -51,7 +51,7 @@ static bool api_winreg_OpenHKCR(struct p
+ 
+ 	r->out.result = _winreg_OpenHKCR(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -131,7 +131,7 @@ static bool api_winreg_OpenHKCU(struct p
+ 
+ 	r->out.result = _winreg_OpenHKCU(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -211,7 +211,7 @@ static bool api_winreg_OpenHKLM(struct p
+ 
+ 	r->out.result = _winreg_OpenHKLM(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -291,7 +291,7 @@ static bool api_winreg_OpenHKPD(struct p
+ 
+ 	r->out.result = _winreg_OpenHKPD(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -371,7 +371,7 @@ static bool api_winreg_OpenHKU(struct pi
+ 
+ 	r->out.result = _winreg_OpenHKU(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -446,7 +446,7 @@ static bool api_winreg_CloseKey(struct p
+ 	r->out.handle = r->in.handle;
+ 	r->out.result = _winreg_CloseKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -527,7 +527,7 @@ static bool api_winreg_CreateKey(struct
+ 
+ 	r->out.result = _winreg_CreateKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -600,7 +600,7 @@ static bool api_winreg_DeleteKey(struct
+ 
+ 	r->out.result = _winreg_DeleteKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -673,7 +673,7 @@ static bool api_winreg_DeleteValue(struc
+ 
+ 	r->out.result = _winreg_DeleteValue(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -750,7 +750,7 @@ static bool api_winreg_EnumKey(struct pi
+ 	r->out.last_changed_time = r->in.last_changed_time;
+ 	r->out.result = _winreg_EnumKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -829,7 +829,7 @@ static bool api_winreg_EnumValue(struct
+ 	r->out.length = r->in.length;
+ 	r->out.result = _winreg_EnumValue(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -902,7 +902,7 @@ static bool api_winreg_FlushKey(struct p
+ 
+ 	r->out.result = _winreg_FlushKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -977,7 +977,7 @@ static bool api_winreg_GetKeySecurity(st
+ 	r->out.sd = r->in.sd;
+ 	r->out.result = _winreg_GetKeySecurity(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1050,7 +1050,7 @@ static bool api_winreg_LoadKey(struct pi
+ 
+ 	r->out.result = _winreg_LoadKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1123,7 +1123,7 @@ static bool api_winreg_NotifyChangeKeyVa
+ 
+ 	r->out.result = _winreg_NotifyChangeKeyValue(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1203,7 +1203,7 @@ static bool api_winreg_OpenKey(struct pi
+ 
+ 	r->out.result = _winreg_OpenKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1326,7 +1326,7 @@ static bool api_winreg_QueryInfoKey(stru
+ 
+ 	r->out.result = _winreg_QueryInfoKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1404,7 +1404,7 @@ static bool api_winreg_QueryValue(struct
+ 	r->out.data_length = r->in.data_length;
+ 	r->out.result = _winreg_QueryValue(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1477,7 +1477,7 @@ static bool api_winreg_ReplaceKey(struct
+ 
+ 	r->out.result = _winreg_ReplaceKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1550,7 +1550,7 @@ static bool api_winreg_RestoreKey(struct
+ 
+ 	r->out.result = _winreg_RestoreKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1623,7 +1623,7 @@ static bool api_winreg_SaveKey(struct pi
+ 
+ 	r->out.result = _winreg_SaveKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1696,7 +1696,7 @@ static bool api_winreg_SetKeySecurity(st
+ 
+ 	r->out.result = _winreg_SetKeySecurity(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1769,7 +1769,7 @@ static bool api_winreg_SetValue(struct p
+ 
+ 	r->out.result = _winreg_SetValue(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1842,7 +1842,7 @@ static bool api_winreg_UnLoadKey(struct
+ 
+ 	r->out.result = _winreg_UnLoadKey(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1915,7 +1915,7 @@ static bool api_winreg_InitiateSystemShu
+ 
+ 	r->out.result = _winreg_InitiateSystemShutdown(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1988,7 +1988,7 @@ static bool api_winreg_AbortSystemShutdo
+ 
+ 	r->out.result = _winreg_AbortSystemShutdown(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2068,7 +2068,7 @@ static bool api_winreg_GetVersion(struct
+ 
+ 	r->out.result = _winreg_GetVersion(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2148,7 +2148,7 @@ static bool api_winreg_OpenHKCC(struct p
+ 
+ 	r->out.result = _winreg_OpenHKCC(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2228,7 +2228,7 @@ static bool api_winreg_OpenHKDD(struct p
+ 
+ 	r->out.result = _winreg_OpenHKDD(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2310,7 +2310,7 @@ static bool api_winreg_QueryMultipleValu
+ 
+ 	r->out.result = _winreg_QueryMultipleValues(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2383,7 +2383,7 @@ static bool api_winreg_InitiateSystemShu
+ 
+ 	r->out.result = _winreg_InitiateSystemShutdownEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2456,7 +2456,7 @@ static bool api_winreg_SaveKeyEx(struct
+ 
+ 	r->out.result = _winreg_SaveKeyEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2536,7 +2536,7 @@ static bool api_winreg_OpenHKPT(struct p
+ 
+ 	r->out.result = _winreg_OpenHKPT(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2616,7 +2616,7 @@ static bool api_winreg_OpenHKPN(struct p
+ 
+ 	r->out.result = _winreg_OpenHKPN(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2703,7 +2703,7 @@ static bool api_winreg_QueryMultipleValu
+ 
+ 	r->out.result = _winreg_QueryMultipleValues2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2776,7 +2776,7 @@ static bool api_winreg_DeleteKeyEx(struc
+ 
+ 	r->out.result = _winreg_DeleteKeyEx(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_wkssvc.c
++++ b/source3/librpc/gen_ndr/srv_wkssvc.c
+@@ -51,7 +51,7 @@ static bool api_wkssvc_NetWkstaGetInfo(s
+ 
+ 	r->out.result = _wkssvc_NetWkstaGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -126,7 +126,7 @@ static bool api_wkssvc_NetWkstaSetInfo(s
+ 	r->out.parm_error = r->in.parm_error;
+ 	r->out.result = _wkssvc_NetWkstaSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -208,7 +208,7 @@ static bool api_wkssvc_NetWkstaEnumUsers
+ 
+ 	r->out.result = _wkssvc_NetWkstaEnumUsers(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -288,7 +288,7 @@ static bool api_wkssvc_NetrWkstaUserGetI
+ 
+ 	r->out.result = _wkssvc_NetrWkstaUserGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -363,7 +363,7 @@ static bool api_wkssvc_NetrWkstaUserSetI
+ 	r->out.parm_err = r->in.parm_err;
+ 	r->out.result = _wkssvc_NetrWkstaUserSetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -445,7 +445,7 @@ static bool api_wkssvc_NetWkstaTransport
+ 
+ 	r->out.result = _wkssvc_NetWkstaTransportEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -520,7 +520,7 @@ static bool api_wkssvc_NetrWkstaTranspor
+ 	r->out.parm_err = r->in.parm_err;
+ 	r->out.result = _wkssvc_NetrWkstaTransportAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -593,7 +593,7 @@ static bool api_wkssvc_NetrWkstaTranspor
+ 
+ 	r->out.result = _wkssvc_NetrWkstaTransportDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -668,7 +668,7 @@ static bool api_wkssvc_NetrUseAdd(struct
+ 	r->out.parm_err = r->in.parm_err;
+ 	r->out.result = _wkssvc_NetrUseAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -748,7 +748,7 @@ static bool api_wkssvc_NetrUseGetInfo(st
+ 
+ 	r->out.result = _wkssvc_NetrUseGetInfo(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -821,7 +821,7 @@ static bool api_wkssvc_NetrUseDel(struct
+ 
+ 	r->out.result = _wkssvc_NetrUseDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -903,7 +903,7 @@ static bool api_wkssvc_NetrUseEnum(struc
+ 
+ 	r->out.result = _wkssvc_NetrUseEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -976,7 +976,7 @@ static bool api_wkssvc_NetrMessageBuffer
+ 
+ 	r->out.result = _wkssvc_NetrMessageBufferSend(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1056,7 +1056,7 @@ static bool api_wkssvc_NetrWorkstationSt
+ 
+ 	r->out.result = _wkssvc_NetrWorkstationStatisticsGet(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1129,7 +1129,7 @@ static bool api_wkssvc_NetrLogonDomainNa
+ 
+ 	r->out.result = _wkssvc_NetrLogonDomainNameAdd(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1202,7 +1202,7 @@ static bool api_wkssvc_NetrLogonDomainNa
+ 
+ 	r->out.result = _wkssvc_NetrLogonDomainNameDel(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1275,7 +1275,7 @@ static bool api_wkssvc_NetrJoinDomain(st
+ 
+ 	r->out.result = _wkssvc_NetrJoinDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1348,7 +1348,7 @@ static bool api_wkssvc_NetrUnjoinDomain(
+ 
+ 	r->out.result = _wkssvc_NetrUnjoinDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1421,7 +1421,7 @@ static bool api_wkssvc_NetrRenameMachine
+ 
+ 	r->out.result = _wkssvc_NetrRenameMachineInDomain(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1494,7 +1494,7 @@ static bool api_wkssvc_NetrValidateName(
+ 
+ 	r->out.result = _wkssvc_NetrValidateName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1575,7 +1575,7 @@ static bool api_wkssvc_NetrGetJoinInform
+ 
+ 	r->out.result = _wkssvc_NetrGetJoinInformation(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1656,7 +1656,7 @@ static bool api_wkssvc_NetrGetJoinableOu
+ 
+ 	r->out.result = _wkssvc_NetrGetJoinableOus(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1729,7 +1729,7 @@ static bool api_wkssvc_NetrJoinDomain2(s
+ 
+ 	r->out.result = _wkssvc_NetrJoinDomain2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1802,7 +1802,7 @@ static bool api_wkssvc_NetrUnjoinDomain2
+ 
+ 	r->out.result = _wkssvc_NetrUnjoinDomain2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1875,7 +1875,7 @@ static bool api_wkssvc_NetrRenameMachine
+ 
+ 	r->out.result = _wkssvc_NetrRenameMachineInDomain2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1948,7 +1948,7 @@ static bool api_wkssvc_NetrValidateName2
+ 
+ 	r->out.result = _wkssvc_NetrValidateName2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2029,7 +2029,7 @@ static bool api_wkssvc_NetrGetJoinableOu
+ 
+ 	r->out.result = _wkssvc_NetrGetJoinableOus2(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2102,7 +2102,7 @@ static bool api_wkssvc_NetrAddAlternateC
+ 
+ 	r->out.result = _wkssvc_NetrAddAlternateComputerName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2175,7 +2175,7 @@ static bool api_wkssvc_NetrRemoveAlterna
+ 
+ 	r->out.result = _wkssvc_NetrRemoveAlternateComputerName(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2248,7 +2248,7 @@ static bool api_wkssvc_NetrSetPrimaryCom
+ 
+ 	r->out.result = _wkssvc_NetrSetPrimaryComputername(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2328,7 +2328,7 @@ static bool api_wkssvc_NetrEnumerateComp
+ 
+ 	r->out.result = _wkssvc_NetrEnumerateComputerNames(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_wmi.c
++++ b/source3/librpc/gen_ndr/srv_wmi.c
+@@ -51,7 +51,7 @@ static bool api_Delete(struct pipes_stru
+ 
+ 	r->out.result = _Delete(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -155,7 +155,7 @@ static bool api_OpenNamespace(struct pip
+ 
+ 	r->out.result = _OpenNamespace(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -235,7 +235,7 @@ static bool api_CancelAsyncCall(struct p
+ 
+ 	r->out.result = _CancelAsyncCall(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -321,7 +321,7 @@ static bool api_QueryObjectSink(struct p
+ 
+ 	r->out.result = _QueryObjectSink(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -403,7 +403,7 @@ static bool api_GetObject(struct pipes_s
+ 
+ 	r->out.result = _GetObject(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -483,7 +483,7 @@ static bool api_GetObjectAsync(struct pi
+ 
+ 	r->out.result = _GetObjectAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -564,7 +564,7 @@ static bool api_PutClass(struct pipes_st
+ 
+ 	r->out.result = _PutClass(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -644,7 +644,7 @@ static bool api_PutClassAsync(struct pip
+ 
+ 	r->out.result = _PutClassAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -725,7 +725,7 @@ static bool api_DeleteClass(struct pipes
+ 
+ 	r->out.result = _DeleteClass(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -805,7 +805,7 @@ static bool api_DeleteClassAsync(struct
+ 
+ 	r->out.result = _DeleteClassAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -891,7 +891,7 @@ static bool api_CreateClassEnum(struct p
+ 
+ 	r->out.result = _CreateClassEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -971,7 +971,7 @@ static bool api_CreateClassEnumAsync(str
+ 
+ 	r->out.result = _CreateClassEnumAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1052,7 +1052,7 @@ static bool api_PutInstance(struct pipes
+ 
+ 	r->out.result = _PutInstance(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1132,7 +1132,7 @@ static bool api_PutInstanceAsync(struct
+ 
+ 	r->out.result = _PutInstanceAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1213,7 +1213,7 @@ static bool api_DeleteInstance(struct pi
+ 
+ 	r->out.result = _DeleteInstance(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1293,7 +1293,7 @@ static bool api_DeleteInstanceAsync(stru
+ 
+ 	r->out.result = _DeleteInstanceAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1379,7 +1379,7 @@ static bool api_CreateInstanceEnum(struc
+ 
+ 	r->out.result = _CreateInstanceEnum(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1459,7 +1459,7 @@ static bool api_CreateInstanceEnumAsync(
+ 
+ 	r->out.result = _CreateInstanceEnumAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1545,7 +1545,7 @@ static bool api_ExecQuery(struct pipes_s
+ 
+ 	r->out.result = _ExecQuery(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1625,7 +1625,7 @@ static bool api_ExecQueryAsync(struct pi
+ 
+ 	r->out.result = _ExecQueryAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1711,7 +1711,7 @@ static bool api_ExecNotificationQuery(st
+ 
+ 	r->out.result = _ExecNotificationQuery(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1791,7 +1791,7 @@ static bool api_ExecNotificationQueryAsy
+ 
+ 	r->out.result = _ExecNotificationQueryAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1873,7 +1873,7 @@ static bool api_ExecMethod(struct pipes_
+ 
+ 	r->out.result = _ExecMethod(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1953,7 +1953,7 @@ static bool api_ExecMethodAsync(struct p
+ 
+ 	r->out.result = _ExecMethodAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2077,7 +2077,7 @@ static bool api_Reset(struct pipes_struc
+ 
+ 	r->out.result = _Reset(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2169,7 +2169,7 @@ static bool api_IEnumWbemClassObject_Nex
+ 
+ 	r->out.result = _IEnumWbemClassObject_Next(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2249,7 +2249,7 @@ static bool api_NextAsync(struct pipes_s
+ 
+ 	r->out.result = _NextAsync(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2335,7 +2335,7 @@ static bool api_IEnumWbemClassObject_Clo
+ 
+ 	r->out.result = _IEnumWbemClassObject_Clone(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2415,7 +2415,7 @@ static bool api_Skip(struct pipes_struct
+ 
+ 	r->out.result = _Skip(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2527,7 +2527,7 @@ static bool api_Clone(struct pipes_struc
+ 
+ 	r->out.result = _Clone(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2607,7 +2607,7 @@ static bool api_GetNames(struct pipes_st
+ 
+ 	r->out.result = _GetNames(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2687,7 +2687,7 @@ static bool api_BeginEnumeration(struct
+ 
+ 	r->out.result = _BeginEnumeration(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2767,7 +2767,7 @@ static bool api_Next(struct pipes_struct
+ 
+ 	r->out.result = _Next(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2847,7 +2847,7 @@ static bool api_EndEnumeration(struct pi
+ 
+ 	r->out.result = _EndEnumeration(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -2927,7 +2927,7 @@ static bool api_SetValue(struct pipes_st
+ 
+ 	r->out.result = _SetValue(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3007,7 +3007,7 @@ static bool api_GetValue(struct pipes_st
+ 
+ 	r->out.result = _GetValue(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3087,7 +3087,7 @@ static bool api_DeleteValue(struct pipes
+ 
+ 	r->out.result = _DeleteValue(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3167,7 +3167,7 @@ static bool api_DeleteAll(struct pipes_s
+ 
+ 	r->out.result = _DeleteAll(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3283,7 +3283,7 @@ static bool api_EstablishPosition(struct
+ 
+ 	r->out.result = _EstablishPosition(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3369,7 +3369,7 @@ static bool api_RequestChallenge(struct
+ 
+ 	r->out.result = _RequestChallenge(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3455,7 +3455,7 @@ static bool api_WBEMLogin(struct pipes_s
+ 
+ 	r->out.result = _WBEMLogin(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3541,7 +3541,7 @@ static bool api_NTLMLogin(struct pipes_s
+ 
+ 	r->out.result = _NTLMLogin(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3664,7 +3664,7 @@ static bool api_IWbemWCOSmartEnum_Next(s
+ 
+ 	r->out.result = _IWbemWCOSmartEnum_Next(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3772,7 +3772,7 @@ static bool api_Fetch(struct pipes_struc
+ 
+ 	r->out.result = _Fetch(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3858,7 +3858,7 @@ static bool api_Test(struct pipes_struct
+ 
+ 	r->out.result = _Test(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -3967,7 +3967,7 @@ static bool api_GetResultObject(struct p
+ 
+ 	r->out.result = _GetResultObject(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4053,7 +4053,7 @@ static bool api_GetResultString(struct p
+ 
+ 	r->out.result = _GetResultString(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4139,7 +4139,7 @@ static bool api_GetResultServices(struct
+ 
+ 	r->out.result = _GetResultServices(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4225,7 +4225,7 @@ static bool api_GetCallStatus(struct pip
+ 
+ 	r->out.result = _GetCallStatus(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4330,7 +4330,7 @@ static bool api_SetStatus(struct pipes_s
+ 
+ 	r->out.result = _SetStatus(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -4410,7 +4410,7 @@ static bool api_Indicate(struct pipes_st
+ 
+ 	r->out.result = _Indicate(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_wzcsvc.c
++++ b/source3/librpc/gen_ndr/srv_wzcsvc.c
+@@ -44,7 +44,7 @@ static bool api_wzcsvc_EnumInterfaces(st
+ 
+ 	_wzcsvc_EnumInterfaces(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -117,7 +117,7 @@ static bool api_wzcsvc_QueryInterface(st
+ 
+ 	_wzcsvc_QueryInterface(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -190,7 +190,7 @@ static bool api_wzcsvc_SetInterface(stru
+ 
+ 	_wzcsvc_SetInterface(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -263,7 +263,7 @@ static bool api_wzcsvc_RefreshInterface(
+ 
+ 	_wzcsvc_RefreshInterface(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -336,7 +336,7 @@ static bool api_wzcsvc_QueryContext(stru
+ 
+ 	_wzcsvc_QueryContext(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -409,7 +409,7 @@ static bool api_wzcsvc_SetContext(struct
+ 
+ 	_wzcsvc_SetContext(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -482,7 +482,7 @@ static bool api_wzcsvc_EapolUIResponse(s
+ 
+ 	_wzcsvc_EapolUIResponse(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -555,7 +555,7 @@ static bool api_wzcsvc_EapolGetCustomAut
+ 
+ 	_wzcsvc_EapolGetCustomAuthData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -628,7 +628,7 @@ static bool api_wzcsvc_EapolSetCustomAut
+ 
+ 	_wzcsvc_EapolSetCustomAuthData(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -701,7 +701,7 @@ static bool api_wzcsvc_EapolGetInterface
+ 
+ 	_wzcsvc_EapolGetInterfaceParams(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -774,7 +774,7 @@ static bool api_wzcsvc_EapolSetInterface
+ 
+ 	_wzcsvc_EapolSetInterfaceParams(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -847,7 +847,7 @@ static bool api_wzcsvc_EapolReAuthentica
+ 
+ 	_wzcsvc_EapolReAuthenticateInterface(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -920,7 +920,7 @@ static bool api_wzcsvc_EapolQueryInterfa
+ 
+ 	_wzcsvc_EapolQueryInterfaceState(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -993,7 +993,7 @@ static bool api_wzcsvc_OpenWZCDbLogSessi
+ 
+ 	_wzcsvc_OpenWZCDbLogSession(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1066,7 +1066,7 @@ static bool api_wzcsvc_CloseWZCDbLogSess
+ 
+ 	_wzcsvc_CloseWZCDbLogSession(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1139,7 +1139,7 @@ static bool api_wzcsvc_EnumWZCDbLogRecor
+ 
+ 	_wzcsvc_EnumWZCDbLogRecords(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1212,7 +1212,7 @@ static bool api_wzcsvc_FlushWZCdbLog(str
+ 
+ 	_wzcsvc_FlushWZCdbLog(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+@@ -1285,7 +1285,7 @@ static bool api_wzcsvc_GetWZCDbLogRecord
+ 
+ 	_wzcsvc_GetWZCDbLogRecord(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
+--- a/source3/librpc/gen_ndr/srv_xattr.c
++++ b/source3/librpc/gen_ndr/srv_xattr.c
+@@ -44,7 +44,7 @@ static bool api_xattr_parse_DOSATTRIB(st
+ 
+ 	_xattr_parse_DOSATTRIB(p, r);
+ 
+-	if (p->rng_fault_state) {
++	if (p->fault_state) {
+ 		talloc_free(r);
+ 		/* Return true here, srv_pipe_hnd.c will take care */
+ 		return true;
diff --git a/package/network/services/samba36/patches/022-CVE-2015-5370-v3-6.patch b/package/network/services/samba36/patches/022-CVE-2015-5370-v3-6.patch
new file mode 100644
index 0000000..36656ab
--- /dev/null
+++ b/package/network/services/samba36/patches/022-CVE-2015-5370-v3-6.patch
@@ -0,0 +1,1791 @@
+From 8716bb5e03cc4f10e2d4edc704d8defe7e8045f1 Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <metze@samba.org>
+Date: Thu, 16 Jul 2015 22:46:05 +0200
+Subject: [PATCH 01/40] CVE-2015-5370: dcerpc.idl: add
+ DCERPC_{NCACN_PAYLOAD,FRAG}_MAX_SIZE defines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=11344
+
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Reviewed-by: Günther Deschner <gd@samba.org>
+---
+ librpc/idl/dcerpc.idl | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/librpc/idl/dcerpc.idl
++++ b/librpc/idl/dcerpc.idl
+@@ -475,9 +475,11 @@ interface dcerpc
+ 	const uint8 DCERPC_PFC_OFFSET      =  3;
+ 	const uint8 DCERPC_DREP_OFFSET     =  4;
+ 	const uint8 DCERPC_FRAG_LEN_OFFSET =  8;
++	const uint32 DCERPC_FRAG_MAX_SIZE  = 5840;
+ 	const uint8 DCERPC_AUTH_LEN_OFFSET = 10;
+ 	const uint8 DCERPC_CALL_ID_OFFSET  = 12;
+ 	const uint8 DCERPC_NCACN_PAYLOAD_OFFSET = 16;
++	const uint32 DCERPC_NCACN_PAYLOAD_MAX_SIZE = 0x400000; /* 4 MByte */
+ 
+ 	/* little-endian flag */
+ 	const uint8 DCERPC_DREP_LE  = 0x10;
+--- a/librpc/rpc/dcerpc_util.c
++++ b/librpc/rpc/dcerpc_util.c
+@@ -92,31 +92,49 @@ uint8_t dcerpc_get_endian_flag(DATA_BLOB
+ *
+ * @return		- A NTSTATUS error code.
+ */
+-NTSTATUS dcerpc_pull_auth_trailer(struct ncacn_packet *pkt,
++NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
+ 				  TALLOC_CTX *mem_ctx,
+-				  DATA_BLOB *pkt_trailer,
++				  const DATA_BLOB *pkt_trailer,
+ 				  struct dcerpc_auth *auth,
+-				  uint32_t *auth_length,
++				  uint32_t *_auth_length,
+ 				  bool auth_data_only)
+ {
+ 	struct ndr_pull *ndr;
+ 	enum ndr_err_code ndr_err;
+-	uint32_t data_and_pad;
++	uint16_t data_and_pad;
++	uint16_t auth_length;
++	uint32_t tmp_length;
+ 
+-	data_and_pad = pkt_trailer->length
+-			- (DCERPC_AUTH_TRAILER_LENGTH + pkt->auth_length);
++	ZERO_STRUCTP(auth);
++	if (_auth_length != NULL) {
++		*_auth_length = 0;
++	}
++
++	/* Paranoia checks for auth_length. The caller should check this... */
++	if (pkt->auth_length == 0) {
++		return NT_STATUS_INTERNAL_ERROR;
++	}
++
++	/* Paranoia checks for auth_length. The caller should check this... */
++	if (pkt->auth_length > pkt->frag_length) {
++		return NT_STATUS_INTERNAL_ERROR;
++	}
++	tmp_length = DCERPC_NCACN_PAYLOAD_OFFSET;
++	tmp_length += DCERPC_AUTH_TRAILER_LENGTH;
++	tmp_length += pkt->auth_length;
++	if (tmp_length > pkt->frag_length) {
++		return NT_STATUS_INTERNAL_ERROR;
++	}
++	if (pkt_trailer->length > UINT16_MAX) {
++		return NT_STATUS_INTERNAL_ERROR;
++	}
+ 
+-	/* paranoia check for pad size. This would be caught anyway by
+-	   the ndr_pull_advance() a few lines down, but it scared
+-	   Jeremy enough for him to call me, so we might as well check
+-	   it now, just to prevent someone posting a bogus YouTube
+-	   video in the future.
+-	*/
+-	if (data_and_pad > pkt_trailer->length) {
+-		return NT_STATUS_INFO_LENGTH_MISMATCH;
++	auth_length = DCERPC_AUTH_TRAILER_LENGTH + pkt->auth_length;
++	if (pkt_trailer->length < auth_length) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
+ 	}
+ 
+-	*auth_length = pkt_trailer->length - data_and_pad;
++	data_and_pad = pkt_trailer->length - auth_length;
+ 
+ 	ndr = ndr_pull_init_blob(pkt_trailer, mem_ctx);
+ 	if (!ndr) {
+@@ -136,14 +154,28 @@ NTSTATUS dcerpc_pull_auth_trailer(struct
+ 	ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth);
+ 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ 		talloc_free(ndr);
++		ZERO_STRUCTP(auth);
+ 		return ndr_map_error2ntstatus(ndr_err);
+ 	}
+ 
++	if (data_and_pad < auth->auth_pad_length) {
++		DEBUG(1, (__location__ ": ERROR: pad length mismatch. "
++			  "Calculated %u  got %u\n",
++			  (unsigned)data_and_pad,
++			  (unsigned)auth->auth_pad_length));
++		talloc_free(ndr);
++		ZERO_STRUCTP(auth);
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++
+ 	if (auth_data_only && data_and_pad != auth->auth_pad_length) {
+-		DEBUG(1, (__location__ ": WARNING: pad length mismatch. "
++		DEBUG(1, (__location__ ": ERROR: pad length mismatch. "
+ 			  "Calculated %u  got %u\n",
+ 			  (unsigned)data_and_pad,
+ 			  (unsigned)auth->auth_pad_length));
++		talloc_free(ndr);
++		ZERO_STRUCTP(auth);
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
+ 	}
+ 
+ 	DEBUG(6,(__location__ ": auth_pad_length %u\n",
+@@ -152,6 +184,83 @@ NTSTATUS dcerpc_pull_auth_trailer(struct
+ 	talloc_steal(mem_ctx, auth->credentials.data);
+ 	talloc_free(ndr);
+ 
++	if (_auth_length != NULL) {
++		*_auth_length = auth_length;
++	}
++
++	return NT_STATUS_OK;
++}
++
++/**
++* @brief	Verify the fields in ncacn_packet header.
++*
++* @param pkt		- The ncacn_packet strcuture
++* @param ptype		- The expected PDU type
++* @param max_auth_info	- The maximum size of a possible auth trailer
++* @param required_flags	- The required flags for the pdu.
++* @param optional_flags	- The possible optional flags for the pdu.
++*
++* @return		- A NTSTATUS error code.
++*/
++NTSTATUS dcerpc_verify_ncacn_packet_header(const struct ncacn_packet *pkt,
++					   enum dcerpc_pkt_type ptype,
++					   size_t max_auth_info,
++					   uint8_t required_flags,
++					   uint8_t optional_flags)
++{
++	if (pkt->rpc_vers != 5) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++
++	if (pkt->rpc_vers_minor != 0) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++
++	if (pkt->auth_length > pkt->frag_length) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++
++	if (pkt->ptype != ptype) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++
++	if (max_auth_info > UINT16_MAX) {
++		return NT_STATUS_INTERNAL_ERROR;
++	}
++
++	if (pkt->auth_length > 0) {
++		size_t max_auth_length;
++
++		if (max_auth_info <= DCERPC_AUTH_TRAILER_LENGTH) {
++			return NT_STATUS_RPC_PROTOCOL_ERROR;
++		}
++		max_auth_length = max_auth_info - DCERPC_AUTH_TRAILER_LENGTH;
++
++		if (pkt->auth_length > max_auth_length) {
++			return NT_STATUS_RPC_PROTOCOL_ERROR;
++		}
++	}
++
++	if ((pkt->pfc_flags & required_flags) != required_flags) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++	if (pkt->pfc_flags & ~(optional_flags|required_flags)) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++
++	if (pkt->drep[0] & ~DCERPC_DREP_LE) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++	if (pkt->drep[1] != 0) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++	if (pkt->drep[2] != 0) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++	if (pkt->drep[3] != 0) {
++		return NT_STATUS_RPC_PROTOCOL_ERROR;
++	}
++
+ 	return NT_STATUS_OK;
+ }
+ 
+--- a/librpc/rpc/rpc_common.h
++++ b/librpc/rpc/rpc_common.h
+@@ -158,12 +158,17 @@ uint8_t dcerpc_get_endian_flag(DATA_BLOB
+ *
+ * @return		- A NTSTATUS error code.
+ */
+-NTSTATUS dcerpc_pull_auth_trailer(struct ncacn_packet *pkt,
++NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
+ 				  TALLOC_CTX *mem_ctx,
+-				  DATA_BLOB *pkt_trailer,
++				  const DATA_BLOB *pkt_trailer,
+ 				  struct dcerpc_auth *auth,
+ 				  uint32_t *auth_length,
+ 				  bool auth_data_only);
++NTSTATUS dcerpc_verify_ncacn_packet_header(const struct ncacn_packet *pkt,
++					   enum dcerpc_pkt_type ptype,
++					   size_t max_auth_info,
++					   uint8_t required_flags,
++					   uint8_t optional_flags);
+ struct tevent_req *dcerpc_read_ncacn_packet_send(TALLOC_CTX *mem_ctx,
+ 						 struct tevent_context *ev,
+ 						 struct tstream_context *stream);
+--- a/source3/librpc/rpc/dcerpc_helpers.c
++++ b/source3/librpc/rpc/dcerpc_helpers.c
+@@ -210,47 +210,6 @@ NTSTATUS dcerpc_push_dcerpc_auth(TALLOC_
+ }
+ 
+ /**
+-* @brief Decodes a dcerpc_auth blob
+-*
+-* @param mem_ctx	The memory context on which to allocate the packet
+-*			elements
+-* @param blob		The blob of data to decode
+-* @param r		An empty dcerpc_auth structure, must not be NULL
+-*
+-* @return a NTSTATUS error code
+-*/
+-NTSTATUS dcerpc_pull_dcerpc_auth(TALLOC_CTX *mem_ctx,
+-				 const DATA_BLOB *blob,
+-				 struct dcerpc_auth *r,
+-				 bool bigendian)
+-{
+-	enum ndr_err_code ndr_err;
+-	struct ndr_pull *ndr;
+-
+-	ndr = ndr_pull_init_blob(blob, mem_ctx);
+-	if (!ndr) {
+-		return NT_STATUS_NO_MEMORY;
+-	}
+-	if (bigendian) {
+-		ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
+-	}
+-
+-	ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, r);
+-
+-	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+-		talloc_free(ndr);
+-		return ndr_map_error2ntstatus(ndr_err);
+-	}
+-	talloc_free(ndr);
+-
+-	if (DEBUGLEVEL >= 10) {
+-		NDR_PRINT_DEBUG(dcerpc_auth, r);
+-	}
+-
+-	return NT_STATUS_OK;
+-}
+-
+-/**
+ * @brief Calculate how much data we can in a packet, including calculating
+ *	 auth token and pad lengths.
+ *
+@@ -782,7 +741,7 @@ NTSTATUS dcerpc_add_auth_footer(struct p
+ 					 auth->auth_type,
+ 					 auth->auth_level,
+ 					 pad_len,
+-					 1 /* context id. */,
++					 auth->auth_context_id,
+ 					 &auth_blob,
+ 					 &auth_info);
+ 	if (!NT_STATUS_IS_OK(status)) {
+@@ -844,19 +803,18 @@ NTSTATUS dcerpc_add_auth_footer(struct p
+ *
+ * @param auth		The auth data for the connection
+ * @param pkt		The actual ncacn_packet
+-* @param pkt_trailer	The stub_and_verifier part of the packet
++* @param pkt_trailer [in][out]	The stub_and_verifier part of the packet,
++* 			the auth_trailer and padding will be removed.
+ * @param header_size	The header size
+ * @param raw_pkt	The whole raw packet data blob
+-* @param pad_len	[out] The padding length used in the packet
+ *
+ * @return A NTSTATUS error code
+ */
+ NTSTATUS dcerpc_check_auth(struct pipe_auth_data *auth,
+ 			   struct ncacn_packet *pkt,
+ 			   DATA_BLOB *pkt_trailer,
+-			   size_t header_size,
+-			   DATA_BLOB *raw_pkt,
+-			   size_t *pad_len)
++			   uint8_t header_size,
++			   DATA_BLOB *raw_pkt)
+ {
+ 	struct schannel_state *schannel_auth;
+ 	struct auth_ntlmssp_state *ntlmssp_ctx;
+@@ -868,6 +826,14 @@ NTSTATUS dcerpc_check_auth(struct pipe_a
+ 	DATA_BLOB full_pkt;
+ 	DATA_BLOB data;
+ 
++	/*
++	 * These check should be done in the caller.
++	 */
++	SMB_ASSERT(raw_pkt->length == pkt->frag_length);
++	SMB_ASSERT(header_size <= pkt->frag_length);
++	SMB_ASSERT(pkt_trailer->length < pkt->frag_length);
++	SMB_ASSERT((pkt_trailer->length + header_size) <= pkt->frag_length);
++
+ 	switch (auth->auth_level) {
+ 	case DCERPC_AUTH_LEVEL_PRIVACY:
+ 		DEBUG(10, ("Requested Privacy.\n"));
+@@ -881,7 +847,6 @@ NTSTATUS dcerpc_check_auth(struct pipe_a
+ 		if (pkt->auth_length != 0) {
+ 			break;
+ 		}
+-		*pad_len = 0;
+ 		return NT_STATUS_OK;
+ 
+ 	case DCERPC_AUTH_LEVEL_NONE:
+@@ -890,7 +855,6 @@ NTSTATUS dcerpc_check_auth(struct pipe_a
+ 				  "authenticated connection!\n"));
+ 			return NT_STATUS_INVALID_PARAMETER;
+ 		}
+-		*pad_len = 0;
+ 		return NT_STATUS_OK;
+ 
+ 	default:
+@@ -899,16 +863,8 @@ NTSTATUS dcerpc_check_auth(struct pipe_a
+ 		return NT_STATUS_INVALID_PARAMETER;
+ 	}
+ 
+-	/* Paranioa checks for auth_length. */
+-	if (pkt->auth_length > pkt->frag_length) {
+-		return NT_STATUS_INFO_LENGTH_MISMATCH;
+-	}
+-	if (((unsigned int)pkt->auth_length
+-	     + DCERPC_AUTH_TRAILER_LENGTH < (unsigned int)pkt->auth_length) ||
+-	    ((unsigned int)pkt->auth_length
+-	     + DCERPC_AUTH_TRAILER_LENGTH < DCERPC_AUTH_TRAILER_LENGTH)) {
+-		/* Integer wrap attempt. */
+-		return NT_STATUS_INFO_LENGTH_MISMATCH;
++	if (pkt->auth_length == 0) {
++		return NT_STATUS_INVALID_PARAMETER;
+ 	}
+ 
+ 	status = dcerpc_pull_auth_trailer(pkt, pkt, pkt_trailer,
+@@ -917,10 +873,23 @@ NTSTATUS dcerpc_check_auth(struct pipe_a
+ 		return status;
+ 	}
+ 
++	if (auth_info.auth_type != auth->auth_type) {
++		return NT_STATUS_INVALID_PARAMETER;
++	}
++
++	if (auth_info.auth_level != auth->auth_level) {
++		return NT_STATUS_INVALID_PARAMETER;
++	}
++
++	if (auth_info.auth_context_id != auth->auth_context_id) {
++		return NT_STATUS_INVALID_PARAMETER;
++	}
++
++	pkt_trailer->length -= auth_length;
+ 	data = data_blob_const(raw_pkt->data + header_size,
+-				pkt_trailer->length - auth_length);
+-	full_pkt = data_blob_const(raw_pkt->data,
+-				raw_pkt->length - auth_info.credentials.length);
++			       pkt_trailer->length);
++	full_pkt = data_blob_const(raw_pkt->data, raw_pkt->length);
++	full_pkt.length -= auth_info.credentials.length;
+ 
+ 	switch (auth->auth_type) {
+ 	case DCERPC_AUTH_TYPE_NONE:
+@@ -996,10 +965,13 @@ NTSTATUS dcerpc_check_auth(struct pipe_a
+ 	 * pkt_trailer actually has a copy of the raw data, and they
+ 	 * are still both used in later calls */
+ 	if (auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
++		if (pkt_trailer->length != data.length) {
++			return NT_STATUS_INVALID_PARAMETER;
++		}
+ 		memcpy(pkt_trailer->data, data.data, data.length);
+ 	}
+ 
+-	*pad_len = auth_info.auth_pad_length;
++	pkt_trailer->length -= auth_info.auth_pad_length;
+ 	data_blob_free(&auth_info.credentials);
+ 	return NT_STATUS_OK;
+ }
+--- a/source3/rpc_client/cli_pipe.c
++++ b/source3/rpc_client/cli_pipe.c
+@@ -404,9 +404,9 @@ static NTSTATUS cli_pipe_validate_curren
+ 						DATA_BLOB *rdata,
+ 						DATA_BLOB *reply_pdu)
+ {
+-	struct dcerpc_response *r;
++	const struct dcerpc_response *r = NULL;
++	DATA_BLOB tmp_stub = data_blob_null;
+ 	NTSTATUS ret = NT_STATUS_OK;
+-	size_t pad_len = 0;
+ 
+ 	/*
+ 	 * Point the return values at the real data including the RPC
+@@ -414,50 +414,128 @@ static NTSTATUS cli_pipe_validate_curren
+ 	 */
+ 	*rdata = *pdu;
+ 
++	if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
++	    !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
++		/*
++		 * TODO: do we still need this hack which was introduced
++		 * in commit a42afcdcc7ab9aa9ed193ae36d3dbb10843447f0.
++		 *
++		 * I don't even know what AS/U might be...
++		 */
++		DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
++			  "fragment first/last ON.\n"));
++		pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
++	}
++
+ 	/* Ensure we have the correct type. */
+ 	switch (pkt->ptype) {
+-	case DCERPC_PKT_ALTER_RESP:
++	case DCERPC_PKT_BIND_NAK:
++		DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
++			  rpccli_pipe_txt(talloc_tos(), cli)));
++
++		ret = dcerpc_verify_ncacn_packet_header(pkt,
++						DCERPC_PKT_BIND_NAK,
++						0, /* max_auth_info */
++						DCERPC_PFC_FLAG_FIRST |
++						DCERPC_PFC_FLAG_LAST,
++						0); /* optional flags */
++		if (!NT_STATUS_IS_OK(ret)) {
++			DEBUG(1, (__location__ ": Connection to %s got an unexpected "
++				  "RPC packet type - %u, expected %u: %s\n",
++				  rpccli_pipe_txt(talloc_tos(), cli),
++				  pkt->ptype, expected_pkt_type,
++				  nt_errstr(ret)));
++			NDR_PRINT_DEBUG(ncacn_packet, pkt);
++			return ret;
++		}
++
++		/* Use this for now... */
++		return NT_STATUS_NETWORK_ACCESS_DENIED;
++
+ 	case DCERPC_PKT_BIND_ACK:
++		ret = dcerpc_verify_ncacn_packet_header(pkt,
++					expected_pkt_type,
++					pkt->u.bind_ack.auth_info.length,
++					DCERPC_PFC_FLAG_FIRST |
++					DCERPC_PFC_FLAG_LAST,
++					DCERPC_PFC_FLAG_CONC_MPX |
++					DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
++		if (!NT_STATUS_IS_OK(ret)) {
++			DEBUG(1, (__location__ ": Connection to %s got an unexpected "
++				  "RPC packet type - %u, expected %u: %s\n",
++				  rpccli_pipe_txt(talloc_tos(), cli),
++				  pkt->ptype, expected_pkt_type,
++				  nt_errstr(ret)));
++			NDR_PRINT_DEBUG(ncacn_packet, pkt);
++			return ret;
++		}
+ 
+-		/* Client code never receives this kind of packets */
+ 		break;
+ 
++	case DCERPC_PKT_ALTER_RESP:
++		ret = dcerpc_verify_ncacn_packet_header(pkt,
++					expected_pkt_type,
++					pkt->u.alter_resp.auth_info.length,
++					DCERPC_PFC_FLAG_FIRST |
++					DCERPC_PFC_FLAG_LAST,
++					DCERPC_PFC_FLAG_CONC_MPX |
++					DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
++		if (!NT_STATUS_IS_OK(ret)) {
++			DEBUG(1, (__location__ ": Connection to %s got an unexpected "
++				  "RPC packet type - %u, expected %u: %s\n",
++				  rpccli_pipe_txt(talloc_tos(), cli),
++				  pkt->ptype, expected_pkt_type,
++				  nt_errstr(ret)));
++			NDR_PRINT_DEBUG(ncacn_packet, pkt);
++			return ret;
++		}
++
++		break;
+ 
+ 	case DCERPC_PKT_RESPONSE:
+ 
+ 		r = &pkt->u.response;
+ 
++		ret = dcerpc_verify_ncacn_packet_header(pkt,
++						expected_pkt_type,
++						r->stub_and_verifier.length,
++						0, /* required_flags */
++						DCERPC_PFC_FLAG_FIRST |
++						DCERPC_PFC_FLAG_LAST);
++		if (!NT_STATUS_IS_OK(ret)) {
++			DEBUG(1, (__location__ ": Connection to %s got an unexpected "
++				  "RPC packet type - %u, expected %u: %s\n",
++				  rpccli_pipe_txt(talloc_tos(), cli),
++				  pkt->ptype, expected_pkt_type,
++				  nt_errstr(ret)));
++			NDR_PRINT_DEBUG(ncacn_packet, pkt);
++			return ret;
++		}
++
++		tmp_stub.data = r->stub_and_verifier.data;
++		tmp_stub.length = r->stub_and_verifier.length;
++
+ 		/* Here's where we deal with incoming sign/seal. */
+ 		ret = dcerpc_check_auth(cli->auth, pkt,
+-					&r->stub_and_verifier,
++					&tmp_stub,
+ 					DCERPC_RESPONSE_LENGTH,
+-					pdu, &pad_len);
++					pdu);
+ 		if (!NT_STATUS_IS_OK(ret)) {
++			DEBUG(1, (__location__ ": Connection to %s got an unexpected "
++				  "RPC packet type - %u, expected %u: %s\n",
++				  rpccli_pipe_txt(talloc_tos(), cli),
++				  pkt->ptype, expected_pkt_type,
++				  nt_errstr(ret)));
++			NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 			return ret;
+ 		}
+ 
+-		if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
+-			return NT_STATUS_BUFFER_TOO_SMALL;
+-		}
+-
+ 		/* Point the return values at the NDR data. */
+-		rdata->data = r->stub_and_verifier.data;
++		*rdata = tmp_stub;
+ 
+-		if (pkt->auth_length) {
+-			/* We've already done integer wrap tests in
+-			 * dcerpc_check_auth(). */
+-			rdata->length = r->stub_and_verifier.length
+-					 - pad_len
+-					 - DCERPC_AUTH_TRAILER_LENGTH
+-					 - pkt->auth_length;
+-		} else {
+-			rdata->length = r->stub_and_verifier.length;
+-		}
+-
+-		DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
++		DEBUG(10, ("Got pdu len %lu, data_len %lu\n",
+ 			   (long unsigned int)pdu->length,
+-			   (long unsigned int)rdata->length,
+-			   (unsigned int)pad_len));
++			   (long unsigned int)rdata->length));
+ 
+ 		/*
+ 		 * If this is the first reply, and the allocation hint is
+@@ -478,14 +556,24 @@ static NTSTATUS cli_pipe_validate_curren
+ 
+ 		break;
+ 
+-	case DCERPC_PKT_BIND_NAK:
+-		DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
+-			  rpccli_pipe_txt(talloc_tos(), cli)));
+-		/* Use this for now... */
+-		return NT_STATUS_NETWORK_ACCESS_DENIED;
+-
+ 	case DCERPC_PKT_FAULT:
+ 
++		ret = dcerpc_verify_ncacn_packet_header(pkt,
++						DCERPC_PKT_FAULT,
++						0, /* max_auth_info */
++						DCERPC_PFC_FLAG_FIRST |
++						DCERPC_PFC_FLAG_LAST,
++						DCERPC_PFC_FLAG_DID_NOT_EXECUTE);
++		if (!NT_STATUS_IS_OK(ret)) {
++			DEBUG(1, (__location__ ": Connection to %s got an unexpected "
++				  "RPC packet type - %u, expected %u: %s\n",
++				  rpccli_pipe_txt(talloc_tos(), cli),
++				  pkt->ptype, expected_pkt_type,
++				  nt_errstr(ret)));
++			NDR_PRINT_DEBUG(ncacn_packet, pkt);
++			return ret;
++		}
++
+ 		DEBUG(1, (__location__ ": RPC fault code %s received "
+ 			  "from %s!\n",
+ 			  dcerpc_errstr(talloc_tos(),
+@@ -502,13 +590,6 @@ static NTSTATUS cli_pipe_validate_curren
+ 		return NT_STATUS_RPC_PROTOCOL_ERROR;
+ 	}
+ 
+-	if (pkt->ptype != expected_pkt_type) {
+-		DEBUG(3, (__location__ ": Connection to %s got an unexpected "
+-			  "RPC packet type - %u, not %u\n",
+-			  rpccli_pipe_txt(talloc_tos(), cli),
+-			  pkt->ptype, expected_pkt_type));
+-		return NT_STATUS_RPC_PROTOCOL_ERROR;
+-	}
+ 
+ 	if (pkt->call_id != call_id) {
+ 		DEBUG(3, (__location__ ": Connection to %s got an unexpected "
+@@ -518,17 +599,6 @@ static NTSTATUS cli_pipe_validate_curren
+ 		return NT_STATUS_RPC_PROTOCOL_ERROR;
+ 	}
+ 
+-	/* Do this just before return - we don't want to modify any rpc header
+-	   data before now as we may have needed to do cryptographic actions on
+-	   it before. */
+-
+-	if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
+-	    !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
+-		DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
+-			  "fragment first/last ON.\n"));
+-		pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
+-	}
+-
+ 	return NT_STATUS_OK;
+ }
+ 
+@@ -883,6 +953,12 @@ static void rpc_api_pipe_got_pdu(struct
+ 
+ 	state->pkt = talloc(state, struct ncacn_packet);
+ 	if (!state->pkt) {
++		/*
++		 * TODO: do a real async disconnect ...
++		 *
++		 * For now do it sync...
++		 */
++		TALLOC_FREE(state->cli->transport);
+ 		tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
+ 		return;
+ 	}
+@@ -892,18 +968,16 @@ static void rpc_api_pipe_got_pdu(struct
+ 					  state->pkt,
+ 					  !state->endianess);
+ 	if (!NT_STATUS_IS_OK(status)) {
++		/*
++		 * TODO: do a real async disconnect ...
++		 *
++		 * For now do it sync...
++		 */
++		TALLOC_FREE(state->cli->transport);
+ 		tevent_req_nterror(req, status);
+ 		return;
+ 	}
+ 
+-	if (state->incoming_frag.length != state->pkt->frag_length) {
+-		DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
+-			  (unsigned int)state->incoming_frag.length,
+-			  (unsigned int)state->pkt->frag_length));
+-		tevent_req_nterror(req,  NT_STATUS_INVALID_PARAMETER);
+-		return;
+-	}
+-
+ 	status = cli_pipe_validate_current_pdu(state,
+ 						state->cli, state->pkt,
+ 						&state->incoming_frag,
+@@ -917,6 +991,28 @@ static void rpc_api_pipe_got_pdu(struct
+ 		  (unsigned)state->reply_pdu_offset,
+ 		  nt_errstr(status)));
+ 
++	if (state->pkt->ptype != DCERPC_PKT_FAULT && !NT_STATUS_IS_OK(status)) {
++		/*
++		 * TODO: do a real async disconnect ...
++		 *
++		 * For now do it sync...
++		 */
++		TALLOC_FREE(state->cli->transport);
++	} else if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTOCOL_ERROR)) {
++		/*
++		 * TODO: do a real async disconnect ...
++		 *
++		 * For now do it sync...
++		 */
++		TALLOC_FREE(state->cli->transport);
++	} else if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
++		/*
++		 * TODO: do a real async disconnect ...
++		 *
++		 * For now do it sync...
++		 */
++		TALLOC_FREE(state->cli->transport);
++	}
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		tevent_req_nterror(req, status);
+ 		return;
+@@ -941,7 +1037,24 @@ static void rpc_api_pipe_got_pdu(struct
+ 			 "%s\n",
+ 			 state->endianess?"little":"big",
+ 			 state->pkt->drep[0]?"little":"big"));
+-		tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
++		/*
++		 * TODO: do a real async disconnect ...
++		 *
++		 * For now do it sync...
++		 */
++		TALLOC_FREE(state->cli->transport);
++		tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
++		return;
++	}
++
++	if (state->reply_pdu_offset + rdata.length > MAX_RPC_DATA_SIZE) {
++		/*
++		 * TODO: do a real async disconnect ...
++		 *
++		 * For now do it sync...
++		 */
++		TALLOC_FREE(state->cli->transport);
++		tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
+ 		return;
+ 	}
+ 
+@@ -949,6 +1062,12 @@ static void rpc_api_pipe_got_pdu(struct
+ 	if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
+ 		if (!data_blob_realloc(NULL, &state->reply_pdu,
+ 				state->reply_pdu_offset + rdata.length)) {
++			/*
++			 * TODO: do a real async disconnect ...
++			 *
++			 * For now do it sync...
++			 */
++			TALLOC_FREE(state->cli->transport);
+ 			tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
+ 			return;
+ 		}
+@@ -978,6 +1097,14 @@ static void rpc_api_pipe_got_pdu(struct
+ 	subreq = get_complete_frag_send(state, state->ev, state->cli,
+ 					state->call_id,
+ 					&state->incoming_frag);
++	if (subreq == NULL) {
++		/*
++		 * TODO: do a real async disconnect ...
++		 *
++		 * For now do it sync...
++		 */
++		TALLOC_FREE(state->cli->transport);
++	}
+ 	if (tevent_req_nomem(subreq, req)) {
+ 		return;
+ 	}
+@@ -1247,7 +1374,7 @@ static NTSTATUS create_rpc_bind_req(TALL
+ 						auth->auth_type,
+ 						auth->auth_level,
+ 						0, /* auth_pad_length */
+-						1, /* auth_context_id */
++						auth->auth_context_id,
+ 						&auth_token,
+ 						&auth_info);
+ 		if (!NT_STATUS_IS_OK(ret)) {
+@@ -1749,9 +1876,8 @@ static bool check_bind_response(const st
+ 
+ static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
+ 				struct rpc_pipe_client *cli,
+-				uint32 rpc_call_id,
+-				enum dcerpc_AuthType auth_type,
+-				enum dcerpc_AuthLevel auth_level,
++				struct pipe_auth_data *auth,
++				uint32_t rpc_call_id,
+ 				DATA_BLOB *pauth_blob,
+ 				DATA_BLOB *rpc_out)
+ {
+@@ -1761,10 +1887,10 @@ static NTSTATUS create_rpc_bind_auth3(TA
+ 	u.auth3._pad = 0;
+ 
+ 	status = dcerpc_push_dcerpc_auth(mem_ctx,
+-					 auth_type,
+-					 auth_level,
++					 auth->auth_type,
++					 auth->auth_level,
+ 					 0, /* auth_pad_length */
+-					 1, /* auth_context_id */
++					 auth->auth_context_id,
+ 					 pauth_blob,
+ 					 &u.auth3.auth_info);
+ 	if (!NT_STATUS_IS_OK(status)) {
+@@ -1794,9 +1920,8 @@ static NTSTATUS create_rpc_bind_auth3(TA
+  ********************************************************************/
+ 
+ static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
+-					enum dcerpc_AuthType auth_type,
+-					enum dcerpc_AuthLevel auth_level,
+-					uint32 rpc_call_id,
++					struct pipe_auth_data *auth,
++					uint32_t rpc_call_id,
+ 					const struct ndr_syntax_id *abstract,
+ 					const struct ndr_syntax_id *transfer,
+ 					const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
+@@ -1806,10 +1931,10 @@ static NTSTATUS create_rpc_alter_context
+ 	NTSTATUS status;
+ 
+ 	status = dcerpc_push_dcerpc_auth(mem_ctx,
+-					 auth_type,
+-					 auth_level,
++					 auth->auth_type,
++					 auth->auth_level,
+ 					 0, /* auth_pad_length */
+-					 1, /* auth_context_id */
++					 auth->auth_context_id,
+ 					 pauth_blob,
+ 					 &auth_info);
+ 	if (!NT_STATUS_IS_OK(status)) {
+@@ -1957,30 +2082,45 @@ static void rpc_pipe_bind_step_one_done(
+ 		rpc_pipe_bind_step_two_trigger(req);
+ 		return;
+ 
+-	case DCERPC_AUTH_TYPE_NTLMSSP:
+-	case DCERPC_AUTH_TYPE_SPNEGO:
+-	case DCERPC_AUTH_TYPE_KRB5:
+-		/* Paranoid lenght checks */
+-		if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
+-						+ pkt->auth_length) {
+-			tevent_req_nterror(req,
+-					NT_STATUS_INFO_LENGTH_MISMATCH);
++	default:
++		if (pkt->auth_length == 0) {
++			tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
+ 			return;
+ 		}
+ 		/* get auth credentials */
+-		status = dcerpc_pull_dcerpc_auth(talloc_tos(),
+-						 &pkt->u.bind_ack.auth_info,
+-						 &auth, false);
++		status = dcerpc_pull_auth_trailer(pkt, talloc_tos(),
++						  &pkt->u.bind_ack.auth_info,
++						  &auth, NULL, true);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
+ 				  nt_errstr(status)));
+ 			tevent_req_nterror(req, status);
+ 			return;
+ 		}
+-		break;
+ 
+-	default:
+-		goto err_out;
++		if (auth.auth_type != pauth->auth_type) {
++			DEBUG(0, (__location__ " Auth type %u mismatch expected %u.\n",
++				  auth.auth_type, pauth->auth_type));
++			tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
++			return;
++		}
++
++		if (auth.auth_level != pauth->auth_level) {
++			DEBUG(0, (__location__ " Auth level %u mismatch expected %u.\n",
++				  auth.auth_level, pauth->auth_level));
++			tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
++			return;
++		}
++
++		if (auth.auth_context_id != pauth->auth_context_id) {
++			DEBUG(0, (__location__ " Auth context id %u mismatch expected %u.\n",
++				  (unsigned)auth.auth_context_id,
++				  (unsigned)pauth->auth_context_id));
++			tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
++			return;
++		}
++
++		break;
+ 	}
+ 
+ 	/*
+@@ -2226,9 +2366,7 @@ static NTSTATUS rpc_bind_next_send(struc
+ 	/* Now prepare the alter context pdu. */
+ 	data_blob_free(&state->rpc_out);
+ 
+-	status = create_rpc_alter_context(state,
+-					  auth->auth_type,
+-					  auth->auth_level,
++	status = create_rpc_alter_context(state, auth,
+ 					  state->rpc_call_id,
+ 					  &state->cli->abstract_syntax,
+ 					  &state->cli->transfer_syntax,
+@@ -2261,10 +2399,8 @@ static NTSTATUS rpc_bind_finish_send(str
+ 	/* Now prepare the auth3 context pdu. */
+ 	data_blob_free(&state->rpc_out);
+ 
+-	status = create_rpc_bind_auth3(state, state->cli,
++	status = create_rpc_bind_auth3(state, state->cli, auth,
+ 					state->rpc_call_id,
+-					auth->auth_type,
+-					auth->auth_level,
+ 					auth_token,
+ 					&state->rpc_out);
+ 	if (!NT_STATUS_IS_OK(status)) {
+@@ -2498,8 +2634,9 @@ static struct tevent_req *rpccli_bh_disc
+ 	/*
+ 	 * TODO: do a real async disconnect ...
+ 	 *
+-	 * For now the caller needs to free rpc_cli
++	 * For now we do it sync...
+ 	 */
++	TALLOC_FREE(hs->rpc_cli->transport);
+ 	hs->rpc_cli = NULL;
+ 
+ 	tevent_req_done(req);
+@@ -2636,6 +2773,7 @@ NTSTATUS rpccli_ncalrpc_bind_data(TALLOC
+ 
+ 	result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
+ 	result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
++	result->auth_context_id = 1;
+ 
+ 	result->user_name = talloc_strdup(result, "");
+ 	result->domain = talloc_strdup(result, "");
+@@ -2660,6 +2798,7 @@ NTSTATUS rpccli_anon_bind_data(TALLOC_CT
+ 
+ 	result->auth_type = DCERPC_AUTH_TYPE_NONE;
+ 	result->auth_level = DCERPC_AUTH_LEVEL_NONE;
++	result->auth_context_id = 0;
+ 
+ 	result->user_name = talloc_strdup(result, "");
+ 	result->domain = talloc_strdup(result, "");
+@@ -2697,6 +2836,7 @@ static NTSTATUS rpccli_ntlmssp_bind_data
+ 
+ 	result->auth_type = auth_type;
+ 	result->auth_level = auth_level;
++	result->auth_context_id = 1;
+ 
+ 	result->user_name = talloc_strdup(result, username);
+ 	result->domain = talloc_strdup(result, domain);
+@@ -2768,6 +2908,7 @@ NTSTATUS rpccli_schannel_bind_data(TALLO
+ 
+ 	result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
+ 	result->auth_level = auth_level;
++	result->auth_context_id = 1;
+ 
+ 	result->user_name = talloc_strdup(result, "");
+ 	result->domain = talloc_strdup(result, domain);
+@@ -3432,6 +3573,7 @@ NTSTATUS cli_rpc_pipe_open_krb5(struct c
+ 	}
+ 	auth->auth_type = DCERPC_AUTH_TYPE_KRB5;
+ 	auth->auth_level = auth_level;
++	auth->auth_context_id = 1;
+ 
+ 	if (!username) {
+ 		username = "";
+@@ -3502,6 +3644,7 @@ NTSTATUS cli_rpc_pipe_open_spnego_krb5(s
+ 	}
+ 	auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+ 	auth->auth_level = auth_level;
++	auth->auth_context_id = 1;
+ 
+ 	if (!username) {
+ 		username = "";
+@@ -3576,6 +3719,7 @@ NTSTATUS cli_rpc_pipe_open_spnego_ntlmss
+ 	}
+ 	auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+ 	auth->auth_level = auth_level;
++	auth->auth_context_id = 1;
+ 
+ 	if (!username) {
+ 		username = "";
+--- a/source4/rpc_server/dcesrv_auth.c
++++ b/source4/rpc_server/dcesrv_auth.c
+@@ -46,7 +46,7 @@ bool dcesrv_auth_bind(struct dcesrv_call
+ 	NTSTATUS status;
+ 	uint32_t auth_length;
+ 
+-	if (pkt->u.bind.auth_info.length == 0) {
++	if (pkt->auth_length == 0) {
+ 		dce_conn->auth_state.auth_info = NULL;
+ 		return true;
+ 	}
+@@ -108,7 +108,7 @@ NTSTATUS dcesrv_auth_bind_ack(struct dce
+ 	struct dcesrv_connection *dce_conn = call->conn;
+ 	NTSTATUS status;
+ 
+-	if (!call->conn->auth_state.gensec_security) {
++	if (call->pkt.auth_length == 0) {
+ 		return NT_STATUS_OK;
+ 	}
+ 
+@@ -155,10 +155,16 @@ bool dcesrv_auth_auth3(struct dcesrv_cal
+ 	NTSTATUS status;
+ 	uint32_t auth_length;
+ 
+-	/* We can't work without an existing gensec state, and an new blob to feed it */
+-	if (!dce_conn->auth_state.auth_info ||
+-	    !dce_conn->auth_state.gensec_security ||
+-	    pkt->u.auth3.auth_info.length == 0) {
++	if (pkt->auth_length == 0) {
++		return false;
++	}
++
++	if (!dce_conn->auth_state.auth_info) {
++		return false;
++	}
++
++	/* We can't work without an existing gensec state */
++	if (!dce_conn->auth_state.gensec_security) {
+ 		return false;
+ 	}
+ 
+@@ -203,7 +209,7 @@ bool dcesrv_auth_alter(struct dcesrv_cal
+ 	uint32_t auth_length;
+ 
+ 	/* on a pure interface change there is no auth blob */
+-	if (pkt->u.alter.auth_info.length == 0) {
++	if (pkt->auth_length == 0) {
+ 		return true;
+ 	}
+ 
+@@ -238,8 +244,7 @@ NTSTATUS dcesrv_auth_alter_ack(struct dc
+ 
+ 	/* on a pure interface change there is no auth_info structure
+ 	   setup */
+-	if (!call->conn->auth_state.auth_info ||
+-	    dce_conn->auth_state.auth_info->credentials.length == 0) {
++	if (call->pkt.auth_length == 0) {
+ 		return NT_STATUS_OK;
+ 	}
+ 
+@@ -315,6 +320,11 @@ bool dcesrv_auth_request(struct dcesrv_c
+ 		return false;
+ 	}
+ 
++	if (pkt->auth_length == 0) {
++		DEBUG(1,("dcesrv_auth_request: unexpected auth_length of 0\n"));
++		return false;
++	}
++
+ 	status = dcerpc_pull_auth_trailer(pkt, call,
+ 					  &pkt->u.request.stub_and_verifier,
+ 					  &auth, &auth_length, false);
+--- a/source4/librpc/rpc/dcerpc.c
++++ b/source4/librpc/rpc/dcerpc.c
+@@ -701,6 +701,14 @@ static NTSTATUS ncacn_pull_request_auth(
+ 		return NT_STATUS_INVALID_LEVEL;
+ 	}
+ 
++	if (pkt->auth_length == 0) {
++		return NT_STATUS_INVALID_NETWORK_RESPONSE;
++	}
++
++	if (c->security_state.generic_state == NULL) {
++		return NT_STATUS_INTERNAL_ERROR;
++	}
++
+ 	status = dcerpc_pull_auth_trailer(pkt, mem_ctx,
+ 					  &pkt->u.response.stub_and_verifier,
+ 					  &auth, &auth_length, false);
+@@ -1074,7 +1082,7 @@ static void dcerpc_bind_recv_handler(str
+ 	}
+ 
+ 	/* the bind_ack might contain a reply set of credentials */
+-	if (conn->security_state.auth_info && pkt->u.bind_ack.auth_info.length) {
++	if (conn->security_state.auth_info && pkt->auth_length) {
+ 		NTSTATUS status;
+ 		uint32_t auth_length;
+ 		status = dcerpc_pull_auth_trailer(pkt, conn, &pkt->u.bind_ack.auth_info,
+@@ -1847,8 +1855,7 @@ static void dcerpc_alter_recv_handler(st
+ 	}
+ 
+ 	/* the alter_resp might contain a reply set of credentials */
+-	if (recv_pipe->conn->security_state.auth_info &&
+-	    pkt->u.alter_resp.auth_info.length) {
++	if (recv_pipe->conn->security_state.auth_info && pkt->auth_length) {
+ 		struct dcecli_connection *conn = recv_pipe->conn;
+ 		NTSTATUS status;
+ 		uint32_t auth_length;
+--- a/source3/librpc/rpc/dcerpc.h
++++ b/source3/librpc/rpc/dcerpc.h
+@@ -42,6 +42,7 @@ struct pipe_auth_data {
+ 	bool verified_bitmask1;
+ 
+ 	void *auth_ctx;
++	uint32_t auth_context_id;
+ 
+ 	/* Only the client code uses these 3 for now */
+ 	char *domain;
+@@ -71,10 +72,6 @@ NTSTATUS dcerpc_push_dcerpc_auth(TALLOC_
+ 				 uint32_t auth_context_id,
+ 				 const DATA_BLOB *credentials,
+ 				 DATA_BLOB *blob);
+-NTSTATUS dcerpc_pull_dcerpc_auth(TALLOC_CTX *mem_ctx,
+-				 const DATA_BLOB *blob,
+-				 struct dcerpc_auth *r,
+-				 bool bigendian);
+ NTSTATUS dcerpc_guess_sizes(struct pipe_auth_data *auth,
+ 			    size_t header_len, size_t data_left,
+ 			    size_t max_xmit_frag, size_t pad_alignment,
+@@ -85,9 +82,8 @@ NTSTATUS dcerpc_add_auth_footer(struct p
+ NTSTATUS dcerpc_check_auth(struct pipe_auth_data *auth,
+ 			   struct ncacn_packet *pkt,
+ 			   DATA_BLOB *pkt_trailer,
+-			   size_t header_size,
+-			   DATA_BLOB *raw_pkt,
+-			   size_t *pad_len);
++			   uint8_t header_size,
++			   DATA_BLOB *raw_pkt);
+ 
+ /* The following definitions come from librpc/rpc/rpc_common.c  */
+ 
+--- a/source3/rpc_server/srv_pipe.c
++++ b/source3/rpc_server/srv_pipe.c
+@@ -42,6 +42,7 @@
+ #include "auth.h"
+ #include "ntdomain.h"
+ #include "rpc_server/srv_pipe.h"
++#include "../librpc/gen_ndr/ndr_dcerpc.h"
+ #include "../librpc/ndr/ndr_dcerpc.h"
+ 
+ #undef DBGC_CLASS
+@@ -270,10 +271,14 @@ static bool setup_bind_nak(struct pipes_
+ 	p->out_data.data_sent_length = 0;
+ 	p->out_data.current_pdu_sent = 0;
+ 
++	set_incoming_fault(p);
+ 	TALLOC_FREE(p->auth.auth_ctx);
+ 	p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
+ 	p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
+ 	p->pipe_bound = False;
++	p->allow_bind = false;
++	p->allow_alter = false;
++	p->allow_auth3 = false;
+ 
+ 	return True;
+ }
+@@ -339,16 +344,46 @@ static bool check_bind_req(struct pipes_
+ 	DEBUG(3,("check_bind_req for %s\n",
+ 		 get_pipe_name_from_syntax(talloc_tos(), abstract)));
+ 
++	ok = ndr_syntax_id_equal(transfer, &ndr_transfer_syntax);
++	if (!ok) {
++		DEBUG(1,("check_bind_req unknown transfer syntax for "
++			 "%s context_id=%u\n",
++			 get_pipe_name_from_syntax(talloc_tos(), abstract),
++			 (unsigned)context_id));
++		return false;
++	}
++
++	for (context_fns = p->contexts;
++	     context_fns != NULL;
++	     context_fns = context_fns->next)
++	{
++		if (context_fns->context_id != context_id) {
++			continue;
++		}
++
++		ok = ndr_syntax_id_equal(&context_fns->syntax,
++					 abstract);
++		if (ok) {
++			return true;
++		}
++
++		DEBUG(1,("check_bind_req: changing abstract syntax for "
++			 "%s context_id=%u into %s not supported\n",
++			 get_pipe_name_from_syntax(talloc_tos(), &context_fns->syntax),
++			 (unsigned)context_id,
++			 get_pipe_name_from_syntax(talloc_tos(), abstract)));
++		return false;
++	}
++
+ 	/* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
+-	if (rpc_srv_pipe_exists_by_id(abstract) &&
+-	   ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
+-		DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
+-			rpc_srv_get_pipe_cli_name(abstract),
+-			rpc_srv_get_pipe_srv_name(abstract)));
+-	} else {
++	if (!rpc_srv_pipe_exists_by_id(abstract)) {
+ 		return false;
+ 	}
+ 
++	DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
++		  rpc_srv_get_pipe_cli_name(abstract),
++		  rpc_srv_get_pipe_srv_name(abstract)));
++
+ 	context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
+ 	if (context_fns == NULL) {
+ 		DEBUG(0,("check_bind_req: malloc() failed!\n"));
+@@ -447,6 +482,7 @@ static bool pipe_spnego_auth_bind(struct
+ 
+ 	p->auth.auth_ctx = spnego_ctx;
+ 	p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
++	p->auth.auth_context_id = auth_info->auth_context_id;
+ 
+ 	DEBUG(10, ("SPNEGO auth started\n"));
+ 
+@@ -557,6 +593,7 @@ static bool pipe_schannel_auth_bind(stru
+ 	/* We're finished with this bind - no more packets. */
+ 	p->auth.auth_ctx = schannel_auth;
+ 	p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
++	p->auth.auth_context_id = auth_info->auth_context_id;
+ 
+ 	p->pipe_bound = True;
+ 
+@@ -601,6 +638,7 @@ static bool pipe_ntlmssp_auth_bind(struc
+ 
+ 	p->auth.auth_ctx = ntlmssp_state;
+ 	p->auth.auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
++	p->auth.auth_context_id = auth_info->auth_context_id;
+ 
+ 	DEBUG(10, (__location__ ": NTLMSSP auth started\n"));
+ 
+@@ -776,6 +814,11 @@ static NTSTATUS pipe_auth_verify_final(s
+ 	void *mech_ctx;
+ 	NTSTATUS status;
+ 
++	if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
++		p->pipe_bound = true;
++		return NT_STATUS_OK;
++	}
++
+ 	switch (p->auth.auth_type) {
+ 	case DCERPC_AUTH_TYPE_NTLMSSP:
+ 		ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
+@@ -867,16 +910,38 @@ static bool api_pipe_bind_req(struct pip
+ 	DATA_BLOB auth_resp = data_blob_null;
+ 	DATA_BLOB auth_blob = data_blob_null;
+ 
+-	/* No rebinds on a bound pipe - use alter context. */
+-	if (p->pipe_bound) {
+-		DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
+-			 "pipe %s.\n",
+-			 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
++	if (!p->allow_bind) {
++		DEBUG(2,("Pipe not in allow bind state\n"));
+ 		return setup_bind_nak(p, pkt);
+ 	}
++	p->allow_bind = false;
++
++	status = dcerpc_verify_ncacn_packet_header(pkt,
++			DCERPC_PKT_BIND,
++			pkt->u.bind.auth_info.length,
++			0, /* required flags */
++			DCERPC_PFC_FLAG_FIRST |
++			DCERPC_PFC_FLAG_LAST |
++			DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
++			0x08 | /* this is not defined, but should be ignored */
++			DCERPC_PFC_FLAG_CONC_MPX |
++			DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
++			DCERPC_PFC_FLAG_MAYBE |
++			DCERPC_PFC_FLAG_OBJECT_UUID);
++	if (!NT_STATUS_IS_OK(status)) {
++		DEBUG(1, ("api_pipe_bind_req: invalid pdu: %s\n",
++			  nt_errstr(status)));
++		NDR_PRINT_DEBUG(ncacn_packet, pkt);
++		goto err_exit;
++	}
+ 
+ 	if (pkt->u.bind.num_contexts == 0) {
+-		DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
++		DEBUG(1, ("api_pipe_bind_req: no rpc contexts around\n"));
++		goto err_exit;
++	}
++
++	if (pkt->u.bind.ctx_list[0].num_transfer_syntaxes == 0) {
++		DEBUG(1, ("api_pipe_bind_req: no transfer syntaxes around\n"));
+ 		goto err_exit;
+ 	}
+ 
+@@ -960,25 +1025,12 @@ static bool api_pipe_bind_req(struct pip
+ 	 * Check if this is an authenticated bind request.
+ 	 */
+ 	if (pkt->auth_length) {
+-		/* Quick length check. Won't catch a bad auth footer,
+-		 * prevents overrun. */
+-
+-		if (pkt->frag_length < RPC_HEADER_LEN +
+-					DCERPC_AUTH_TRAILER_LENGTH +
+-					pkt->auth_length) {
+-			DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
+-				"too long for fragment %u.\n",
+-				(unsigned int)pkt->auth_length,
+-				(unsigned int)pkt->frag_length));
+-			goto err_exit;
+-		}
+-
+ 		/*
+ 		 * Decode the authentication verifier.
+ 		 */
+-		status = dcerpc_pull_dcerpc_auth(pkt,
+-						 &pkt->u.bind.auth_info,
+-						 &auth_info, p->endian);
++		status = dcerpc_pull_auth_trailer(pkt, pkt,
++						  &pkt->u.bind.auth_info,
++						  &auth_info, NULL, true);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
+ 			goto err_exit;
+@@ -1072,6 +1124,7 @@ static bool api_pipe_bind_req(struct pip
+ 		p->pipe_bound = True;
+ 		/* The session key was initialized from the SMB
+ 		 * session in make_internal_rpc_pipe_p */
++		p->auth.auth_context_id = 0;
+ 	}
+ 
+ 	ZERO_STRUCT(u.bind_ack);
+@@ -1113,15 +1166,15 @@ static bool api_pipe_bind_req(struct pip
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
+ 			  nt_errstr(status)));
++		goto err_exit;
+ 	}
+ 
+ 	if (auth_resp.length) {
+-
+ 		status = dcerpc_push_dcerpc_auth(pkt,
+ 						 auth_type,
+ 						 auth_info.auth_level,
+-						 0,
+-						 1, /* auth_context_id */
++						 0, /* pad_len */
++						 p->auth.auth_context_id,
+ 						 &auth_resp,
+ 						 &auth_blob);
+ 		if (!NT_STATUS_IS_OK(status)) {
+@@ -1152,6 +1205,22 @@ static bool api_pipe_bind_req(struct pip
+ 	p->out_data.current_pdu_sent = 0;
+ 
+ 	TALLOC_FREE(auth_blob.data);
++
++	if (bind_ack_ctx.result == 0) {
++		p->allow_alter = true;
++		p->allow_auth3 = true;
++		if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
++			status = pipe_auth_verify_final(p);
++			if (!NT_STATUS_IS_OK(status)) {
++				DEBUG(0, ("pipe_auth_verify_final failed: %s\n",
++					  nt_errstr(status)));
++				goto err_exit;
++			}
++		}
++	} else {
++		goto err_exit;
++	}
++
+ 	return True;
+ 
+   err_exit:
+@@ -1176,18 +1245,39 @@ bool api_pipe_bind_auth3(struct pipes_st
+ 
+ 	DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
+ 
+-	if (pkt->auth_length == 0) {
+-		DEBUG(0, ("No auth field sent for bind request!\n"));
++	if (!p->allow_auth3) {
++		DEBUG(1, ("Pipe not in allow auth3 state.\n"));
+ 		goto err;
+ 	}
+ 
+-	/* Ensure there's enough data for an authenticated request. */
+-	if (pkt->frag_length < RPC_HEADER_LEN
+-				+ DCERPC_AUTH_TRAILER_LENGTH
+-				+ pkt->auth_length) {
+-			DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
+-				"%u is too large.\n",
+-                        (unsigned int)pkt->auth_length));
++	status = dcerpc_verify_ncacn_packet_header(pkt,
++			DCERPC_PKT_AUTH3,
++			pkt->u.auth3.auth_info.length,
++			0, /* required flags */
++			DCERPC_PFC_FLAG_FIRST |
++			DCERPC_PFC_FLAG_LAST |
++			DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
++			0x08 | /* this is not defined, but should be ignored */
++			DCERPC_PFC_FLAG_CONC_MPX |
++			DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
++			DCERPC_PFC_FLAG_MAYBE |
++			DCERPC_PFC_FLAG_OBJECT_UUID);
++	if (!NT_STATUS_IS_OK(status)) {
++		DEBUG(1, ("api_pipe_bind_auth3: invalid pdu: %s\n",
++			  nt_errstr(status)));
++		NDR_PRINT_DEBUG(ncacn_packet, pkt);
++		goto err;
++	}
++
++	/* We can only finish if the pipe is unbound for now */
++	if (p->pipe_bound) {
++		DEBUG(0, (__location__ ": Pipe already bound, "
++			  "AUTH3 not supported!\n"));
++		goto err;
++	}
++
++	if (pkt->auth_length == 0) {
++		DEBUG(1, ("No auth field sent for auth3 request!\n"));
+ 		goto err;
+ 	}
+ 
+@@ -1195,9 +1285,9 @@ bool api_pipe_bind_auth3(struct pipes_st
+ 	 * Decode the authentication verifier response.
+ 	 */
+ 
+-	status = dcerpc_pull_dcerpc_auth(pkt,
+-					 &pkt->u.auth3.auth_info,
+-					 &auth_info, p->endian);
++	status = dcerpc_pull_auth_trailer(pkt, pkt,
++					  &pkt->u.auth3.auth_info,
++					  &auth_info, NULL, true);
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
+ 		goto err;
+@@ -1215,6 +1305,21 @@ bool api_pipe_bind_auth3(struct pipes_st
+ 		goto err;
+ 	}
+ 
++	if (auth_info.auth_level != p->auth.auth_level) {
++		DEBUG(1, ("Auth level mismatch! Client sent %d, "
++			  "but auth was started as level %d!\n",
++			  auth_info.auth_level, p->auth.auth_level));
++		goto err;
++	}
++
++	if (auth_info.auth_context_id != p->auth.auth_context_id) {
++		DEBUG(0, ("Auth context id mismatch! Client sent %u, "
++			  "but auth was started as level %u!\n",
++			  (unsigned)auth_info.auth_context_id,
++			  (unsigned)p->auth.auth_context_id));
++		goto err;
++	}
++
+ 	switch (auth_info.auth_type) {
+ 	case DCERPC_AUTH_TYPE_NTLMSSP:
+ 		ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
+@@ -1267,6 +1372,10 @@ bool api_pipe_bind_auth3(struct pipes_st
+ 	return true;
+ 
+ err:
++	p->pipe_bound = false;
++	p->allow_bind = false;
++	p->allow_alter = false;
++	p->allow_auth3 = false;
+ 
+ 	TALLOC_FREE(p->auth.auth_ctx);
+ 	return false;
+@@ -1284,7 +1393,7 @@ static bool api_pipe_alter_context(struc
+ 	uint16 assoc_gid;
+ 	NTSTATUS status;
+ 	union dcerpc_payload u;
+-	struct dcerpc_ack_ctx bind_ack_ctx;
++	struct dcerpc_ack_ctx alter_ack_ctx;
+ 	DATA_BLOB auth_resp = data_blob_null;
+ 	DATA_BLOB auth_blob = data_blob_null;
+ 	int pad_len = 0;
+@@ -1294,8 +1403,42 @@ static bool api_pipe_alter_context(struc
+ 
+ 	DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
+ 
+-	if (pkt->u.bind.assoc_group_id != 0) {
+-		assoc_gid = pkt->u.bind.assoc_group_id;
++	if (!p->allow_alter) {
++		DEBUG(1, ("Pipe not in allow alter state.\n"));
++		goto err_exit;
++	}
++
++	status = dcerpc_verify_ncacn_packet_header(pkt,
++			DCERPC_PKT_ALTER,
++			pkt->u.alter.auth_info.length,
++			0, /* required flags */
++			DCERPC_PFC_FLAG_FIRST |
++			DCERPC_PFC_FLAG_LAST |
++			DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
++			0x08 | /* this is not defined, but should be ignored */
++			DCERPC_PFC_FLAG_CONC_MPX |
++			DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
++			DCERPC_PFC_FLAG_MAYBE |
++			DCERPC_PFC_FLAG_OBJECT_UUID);
++	if (!NT_STATUS_IS_OK(status)) {
++		DEBUG(1, ("api_pipe_alter_context: invalid pdu: %s\n",
++			  nt_errstr(status)));
++		NDR_PRINT_DEBUG(ncacn_packet, pkt);
++		goto err_exit;
++	}
++
++	if (pkt->u.alter.num_contexts == 0) {
++		DEBUG(1, ("api_pipe_alter_context: no rpc contexts around\n"));
++		goto err_exit;
++	}
++
++	if (pkt->u.alter.ctx_list[0].num_transfer_syntaxes == 0) {
++		DEBUG(1, ("api_pipe_alter_context: no transfer syntaxes around\n"));
++		goto err_exit;
++	}
++
++	if (pkt->u.alter.assoc_group_id != 0) {
++		assoc_gid = pkt->u.alter.assoc_group_id;
+ 	} else {
+ 		assoc_gid = 0x53f0;
+ 	}
+@@ -1305,59 +1448,45 @@ static bool api_pipe_alter_context(struc
+ 	 */
+ 
+ 	/* If the requested abstract synt uuid doesn't match our client pipe,
+-		reject the bind_ack & set the transfer interface synt to all 0's,
++		reject the alter_ack & set the transfer interface synt to all 0's,
+ 		ver 0 (observed when NT5 attempts to bind to abstract interfaces
+ 		unknown to NT4)
+ 		Needed when adding entries to a DACL from NT5 - SK */
+ 
+ 	if (check_bind_req(p,
+-			&pkt->u.bind.ctx_list[0].abstract_syntax,
+-			&pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
+-			pkt->u.bind.ctx_list[0].context_id)) {
+-
+-		bind_ack_ctx.result = 0;
+-		bind_ack_ctx.reason = 0;
+-		bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
++			&pkt->u.alter.ctx_list[0].abstract_syntax,
++			&pkt->u.alter.ctx_list[0].transfer_syntaxes[0],
++			pkt->u.alter.ctx_list[0].context_id)) {
++
++		alter_ack_ctx.result = 0;
++		alter_ack_ctx.reason = 0;
++		alter_ack_ctx.syntax = pkt->u.alter.ctx_list[0].transfer_syntaxes[0];
+ 	} else {
+-		p->pipe_bound = False;
+ 		/* Rejection reason: abstract syntax not supported */
+-		bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
+-		bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
+-		bind_ack_ctx.syntax = null_ndr_syntax_id;
++		alter_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
++		alter_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
++		alter_ack_ctx.syntax = null_ndr_syntax_id;
+ 	}
+ 
+ 	/*
+ 	 * Check if this is an authenticated alter context request.
+ 	 */
+ 	if (pkt->auth_length) {
+-		/* Quick length check. Won't catch a bad auth footer,
+-		 * prevents overrun. */
+-
+-		if (pkt->frag_length < RPC_HEADER_LEN +
+-					DCERPC_AUTH_TRAILER_LENGTH +
+-					pkt->auth_length) {
+-			DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
+-				"too long for fragment %u.\n",
+-				(unsigned int)pkt->auth_length,
+-				(unsigned int)pkt->frag_length ));
++		/* We can only finish if the pipe is unbound for now */
++		if (p->pipe_bound) {
++			DEBUG(0, (__location__ ": Pipe already bound, "
++				  "Altering Context not yet supported!\n"));
+ 			goto err_exit;
+ 		}
+ 
+-		status = dcerpc_pull_dcerpc_auth(pkt,
+-						 &pkt->u.bind.auth_info,
+-						 &auth_info, p->endian);
++		status = dcerpc_pull_auth_trailer(pkt, pkt,
++						  &pkt->u.alter.auth_info,
++						  &auth_info, NULL, true);
+ 		if (!NT_STATUS_IS_OK(status)) {
+ 			DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
+ 			goto err_exit;
+ 		}
+ 
+-		/* We can only finish if the pipe is unbound for now */
+-		if (p->pipe_bound) {
+-			DEBUG(0, (__location__ ": Pipe already bound, "
+-				  "Altering Context not yet supported!\n"));
+-			goto err_exit;
+-		}
+-
+ 		if (auth_info.auth_type != p->auth.auth_type) {
+ 			DEBUG(0, ("Auth type mismatch! Client sent %d, "
+ 				  "but auth was started as type %d!\n",
+@@ -1365,6 +1494,20 @@ static bool api_pipe_alter_context(struc
+ 			goto err_exit;
+ 		}
+ 
++		if (auth_info.auth_level != p->auth.auth_level) {
++			DEBUG(0, ("Auth level mismatch! Client sent %d, "
++				  "but auth was started as level %d!\n",
++				  auth_info.auth_level, p->auth.auth_level));
++			goto err_exit;
++		}
++
++		if (auth_info.auth_context_id != p->auth.auth_context_id) {
++			DEBUG(0, ("Auth context id mismatch! Client sent %u, "
++				  "but auth was started as level %u!\n",
++				  (unsigned)auth_info.auth_context_id,
++				  (unsigned)p->auth.auth_context_id));
++			goto err_exit;
++		}
+ 
+ 		switch (auth_info.auth_type) {
+ 		case DCERPC_AUTH_TYPE_SPNEGO:
+@@ -1431,7 +1574,7 @@ static bool api_pipe_alter_context(struc
+ 	u.alter_resp.secondary_address_size = 1;
+ 
+ 	u.alter_resp.num_results = 1;
+-	u.alter_resp.ctx_list = &bind_ack_ctx;
++	u.alter_resp.ctx_list = &alter_ack_ctx;
+ 
+ 	/* NOTE: We leave the auth_info empty so we can calculate the padding
+ 	 * later and then append the auth_info --simo */
+@@ -1451,8 +1594,9 @@ static bool api_pipe_alter_context(struc
+ 					  &u,
+ 					  &p->out_data.frag);
+ 	if (!NT_STATUS_IS_OK(status)) {
+-		DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
++		DEBUG(0, ("Failed to marshall alter_resp packet. (%s)\n",
+ 			  nt_errstr(status)));
++		goto err_exit;
+ 	}
+ 
+ 	if (auth_resp.length) {
+@@ -1469,7 +1613,7 @@ static bool api_pipe_alter_context(struc
+ 						 auth_info.auth_type,
+ 						 auth_info.auth_level,
+ 						 pad_len,
+-						 1, /* auth_context_id */
++						 p->auth.auth_context_id,
+ 						 &auth_resp,
+ 						 &auth_blob);
+ 		if (!NT_STATUS_IS_OK(status)) {
+@@ -1618,6 +1762,7 @@ static bool api_pipe_request(struct pipe
+ 
+ 	if (!srv_pipe_check_verification_trailer(p, pkt, pipe_fns)) {
+ 		DEBUG(1, ("srv_pipe_check_verification_trailer: failed\n"));
++		set_incoming_fault(p);
+ 		setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
+ 		data_blob_free(&p->out_data.rdata);
+ 		TALLOC_FREE(frame);
+@@ -1756,7 +1901,11 @@ void set_incoming_fault(struct pipes_str
+ 	data_blob_free(&p->in_data.data);
+ 	p->in_data.pdu_needed_len = 0;
+ 	p->in_data.pdu.length = 0;
+-	p->fault_state = DCERPC_FAULT_CANT_PERFORM;
++	p->fault_state = DCERPC_NCA_S_PROTO_ERROR;
++
++	p->allow_alter = false;
++	p->allow_auth3 = false;
++	p->pipe_bound = false;
+ 
+ 	DEBUG(10, ("Setting fault state\n"));
+ }
+@@ -1767,7 +1916,6 @@ static NTSTATUS dcesrv_auth_request(stru
+ {
+ 	NTSTATUS status;
+ 	size_t hdr_size = DCERPC_REQUEST_LENGTH;
+-	size_t pad_len;
+ 
+ 	DEBUG(10, ("Checking request auth.\n"));
+ 
+@@ -1778,25 +1926,11 @@ static NTSTATUS dcesrv_auth_request(stru
+ 	/* in case of sealing this function will unseal the data in place */
+ 	status = dcerpc_check_auth(auth, pkt,
+ 				   &pkt->u.request.stub_and_verifier,
+-				   hdr_size, raw_pkt,
+-				   &pad_len);
++				   hdr_size, raw_pkt);
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		return status;
+ 	}
+ 
+-
+-	/* remove padding and auth trailer,
+-	 * this way the caller will get just the data */
+-	if (pkt->auth_length) {
+-		size_t trail_len = pad_len
+-					+ DCERPC_AUTH_TRAILER_LENGTH
+-					+ pkt->auth_length;
+-		if (pkt->u.request.stub_and_verifier.length < trail_len) {
+-			return NT_STATUS_INFO_LENGTH_MISMATCH;
+-		}
+-		pkt->u.request.stub_and_verifier.length -= trail_len;
+-	}
+-
+ 	return NT_STATUS_OK;
+ }
+ 
+@@ -1816,6 +1950,29 @@ static bool process_request_pdu(struct p
+ 		return False;
+ 	}
+ 
++	/*
++	 * We don't ignore DCERPC_PFC_FLAG_PENDING_CANCEL.
++	 * TODO: we can reject it with DCERPC_FAULT_NO_CALL_ACTIVE later.
++	 */
++	status = dcerpc_verify_ncacn_packet_header(pkt,
++			DCERPC_PKT_REQUEST,
++			pkt->u.request.stub_and_verifier.length,
++			0, /* required_flags */
++			DCERPC_PFC_FLAG_FIRST |
++			DCERPC_PFC_FLAG_LAST |
++			0x08 | /* this is not defined, but should be ignored */
++			DCERPC_PFC_FLAG_CONC_MPX |
++			DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
++			DCERPC_PFC_FLAG_MAYBE |
++			DCERPC_PFC_FLAG_OBJECT_UUID);
++	if (!NT_STATUS_IS_OK(status)) {
++		DEBUG(1, ("process_request_pdu: invalid pdu: %s\n",
++			  nt_errstr(status)));
++		NDR_PRINT_DEBUG(ncacn_packet, pkt);
++		set_incoming_fault(p);
++		return false;
++	}
++
+ 	/* Store the opnum */
+ 	p->opnum = pkt->u.request.opnum;
+ 
+@@ -2065,7 +2222,7 @@ done:
+ 			 "pipe %s\n", get_pipe_name_from_syntax(talloc_tos(),
+ 								&p->syntax)));
+ 		set_incoming_fault(p);
+-		setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
++		setup_fault_pdu(p, NT_STATUS(DCERPC_NCA_S_PROTO_ERROR));
+ 		TALLOC_FREE(pkt);
+ 	} else {
+ 		/*
+--- a/source3/include/ntdomain.h
++++ b/source3/include/ntdomain.h
+@@ -135,6 +135,13 @@ struct pipes_struct {
+ 	bool pipe_bound;
+ 
+ 	/*
++	 * States we can be in.
++	 */
++	bool allow_alter;
++	bool allow_bind;
++	bool allow_auth3;
++
++	/*
+ 	 * Set the DCERPC_FAULT to return.
+ 	 */
+ 
+--- a/source3/rpc_server/rpc_ncacn_np.c
++++ b/source3/rpc_server/rpc_ncacn_np.c
+@@ -171,6 +171,7 @@ struct pipes_struct *make_internal_rpc_p
+ 
+ 	p->syntax = *syntax;
+ 	p->transport = NCALRPC;
++	p->allow_bind = true;
+ 
+ 	DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
+ 		 get_pipe_name_from_syntax(talloc_tos(), syntax), pipes_open));
+@@ -780,6 +781,7 @@ static NTSTATUS rpc_pipe_open_external(T
+ 	}
+ 	result->auth->auth_type = DCERPC_AUTH_TYPE_NONE;
+ 	result->auth->auth_level = DCERPC_AUTH_LEVEL_NONE;
++	result->auth->auth_context_id = 0;
+ 
+ 	status = rpccli_anon_bind_data(result, &auth);
+ 	if (!NT_STATUS_IS_OK(status)) {
+--- a/source3/rpc_server/rpc_server.c
++++ b/source3/rpc_server/rpc_server.c
+@@ -102,6 +102,7 @@ static int make_server_pipes_struct(TALL
+ 	p->syntax = id;
+ 	p->transport = transport;
+ 	p->ncalrpc_as_system = ncalrpc_as_system;
++	p->allow_bind = true;
+ 
+ 	p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p);
+ 	if (!p->mem_ctx) {
+@@ -663,6 +664,12 @@ static void named_pipe_packet_done(struc
+ 		goto fail;
+ 	}
+ 
++	if (npc->p->fault_state != 0) {
++		DEBUG(2, ("Disconnect after fault\n"));
++		sys_errno = EINVAL;
++		goto fail;
++	}
++
+ 	/* clear out any data that may have been left around */
+ 	npc->count = 0;
+ 	TALLOC_FREE(npc->iov);
+@@ -1391,6 +1398,12 @@ static void dcerpc_ncacn_packet_done(str
+ 		goto fail;
+ 	}
+ 
++	if (ncacn_conn->p->fault_state != 0) {
++		DEBUG(2, ("Disconnect after fault\n"));
++		sys_errno = EINVAL;
++		goto fail;
++	}
++
+ 	/* clear out any data that may have been left around */
+ 	ncacn_conn->count = 0;
+ 	TALLOC_FREE(ncacn_conn->iov);
diff --git a/package/network/services/samba36/patches/023-CVE-2016-2110-v3-6.patch b/package/network/services/samba36/patches/023-CVE-2016-2110-v3-6.patch
new file mode 100644
index 0000000..0da66bf
--- /dev/null
+++ b/package/network/services/samba36/patches/023-CVE-2016-2110-v3-6.patch
@@ -0,0 +1,255 @@
+From 202d69267c8550b850438877fb51c3d2c992949d Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <metze@samba.org>
+Date: Tue, 1 Dec 2015 08:46:45 +0100
+Subject: [PATCH 01/10] CVE-2016-2110: s3:ntlmssp: set and use
+ ntlmssp_state->allow_lm_key
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644
+
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Reviewed-by: Günther Deschner <gd@samba.org>
+---
+ source3/libsmb/ntlmssp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/source3/libsmb/ntlmssp.c
++++ b/source3/libsmb/ntlmssp.c
+@@ -176,17 +176,19 @@ void ntlmssp_want_feature_list(struct nt
+ 	 * also add  NTLMSSP_NEGOTIATE_SEAL here. JRA.
+ 	 */
+ 	if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list, True)) {
+-		ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
++		ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
+ 	}
+ 	if (in_list("NTLMSSP_FEATURE_SIGN", feature_list, True)) {
+-		ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
++		ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
+ 	}
+ 	if(in_list("NTLMSSP_FEATURE_SEAL", feature_list, True)) {
+-		ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
++		ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SEAL;
+ 	}
+ 	if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list, true)) {
+ 		ntlmssp_state->use_ccache = true;
+ 	}
++
++	ntlmssp_state->neg_flags |= ntlmssp_state->required_flags;
+ }
+ 
+ /**
+@@ -199,17 +201,20 @@ void ntlmssp_want_feature(struct ntlmssp
+ {
+ 	/* As per JRA's comment above */
+ 	if (feature & NTLMSSP_FEATURE_SESSION_KEY) {
+-		ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
++		ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
+ 	}
+ 	if (feature & NTLMSSP_FEATURE_SIGN) {
+-		ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
++		ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
+ 	}
+ 	if (feature & NTLMSSP_FEATURE_SEAL) {
+-		ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
++		ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
++		ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SEAL;
+ 	}
+ 	if (feature & NTLMSSP_FEATURE_CCACHE) {
+ 		ntlmssp_state->use_ccache = true;
+ 	}
++
++	ntlmssp_state->neg_flags |= ntlmssp_state->required_flags;
+ }
+ 
+ /**
+@@ -387,7 +392,12 @@ static NTSTATUS ntlmssp_client_initial(s
+ 	}
+ 
+ 	if (ntlmssp_state->use_ntlmv2) {
+-		ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
++		ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_NTLM2;
++		ntlmssp_state->allow_lm_key = false;
++	}
++
++	if (ntlmssp_state->allow_lm_key) {
++		ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_LM_KEY;
+ 	}
+ 
+ 	/* generate the ntlmssp negotiate packet */
+@@ -422,6 +432,86 @@ static NTSTATUS ntlmssp_client_initial(s
+ 	return NT_STATUS_MORE_PROCESSING_REQUIRED;
+ }
+ 
++static NTSTATUS ntlmssp3_handle_neg_flags(struct ntlmssp_state *ntlmssp_state,
++					  uint32_t flags)
++{
++	uint32_t missing_flags = ntlmssp_state->required_flags;
++
++	if (flags & NTLMSSP_NEGOTIATE_UNICODE) {
++		ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_OEM;
++		ntlmssp_state->unicode = true;
++	} else {
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_UNICODE;
++		ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
++		ntlmssp_state->unicode = false;
++	}
++
++	/*
++	 * NTLMSSP_NEGOTIATE_NTLM2 (NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY)
++	 * has priority over NTLMSSP_NEGOTIATE_LM_KEY
++	 */
++	if (!(flags & NTLMSSP_NEGOTIATE_NTLM2)) {
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
++	}
++
++	if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
++	}
++
++	if (!(flags & NTLMSSP_NEGOTIATE_LM_KEY)) {
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
++	}
++
++	if (!(flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
++	}
++
++	if (!(flags & NTLMSSP_NEGOTIATE_128)) {
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_128;
++	}
++
++	if (!(flags & NTLMSSP_NEGOTIATE_56)) {
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_56;
++	}
++
++	if (!(flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_KEY_EXCH;
++	}
++
++	if (!(flags & NTLMSSP_NEGOTIATE_SIGN)) {
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SIGN;
++	}
++
++	if (!(flags & NTLMSSP_NEGOTIATE_SEAL)) {
++		ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SEAL;
++	}
++
++	if ((flags & NTLMSSP_REQUEST_TARGET)) {
++		ntlmssp_state->neg_flags |= NTLMSSP_REQUEST_TARGET;
++	}
++
++	missing_flags &= ~ntlmssp_state->neg_flags;
++	if (missing_flags != 0) {
++		NTSTATUS status = NT_STATUS_RPC_SEC_PKG_ERROR;
++		DEBUG(1, ("%s: Got challenge flags[0x%08x] "
++			  "- possible downgrade detected! "
++			  "missing_flags[0x%08x] - %s\n",
++			  __func__,
++			  (unsigned)flags,
++			  (unsigned)missing_flags,
++			  nt_errstr(status)));
++		debug_ntlmssp_flags(missing_flags);
++		DEBUGADD(4, ("neg_flags[0x%08x]\n",
++			     (unsigned)ntlmssp_state->neg_flags));
++		debug_ntlmssp_flags(ntlmssp_state->neg_flags);
++
++		return status;
++	}
++
++	return NT_STATUS_OK;
++}
++
+ /**
+  * Next state function for the Challenge Packet.  Generate an auth packet.
+  *
+@@ -448,6 +538,26 @@ static NTSTATUS ntlmssp_client_challenge
+ 	DATA_BLOB encrypted_session_key = data_blob_null;
+ 	NTSTATUS nt_status = NT_STATUS_OK;
+ 
++	if (!msrpc_parse(ntlmssp_state, &reply, "CdBd",
++			 "NTLMSSP",
++			 &ntlmssp_command,
++			 &server_domain_blob,
++			 &chal_flags)) {
++		DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
++		dump_data(2, reply.data, reply.length);
++
++		return NT_STATUS_INVALID_PARAMETER;
++	}
++	data_blob_free(&server_domain_blob);
++
++	DEBUG(3, ("Got challenge flags:\n"));
++	debug_ntlmssp_flags(chal_flags);
++
++	nt_status = ntlmssp3_handle_neg_flags(ntlmssp_state, chal_flags);
++	if (!NT_STATUS_IS_OK(nt_status)) {
++		return nt_status;
++	}
++
+ 	if (ntlmssp_state->use_ccache) {
+ 		struct wbcCredentialCacheParams params;
+ 		struct wbcCredentialCacheInfo *info = NULL;
+@@ -498,17 +608,6 @@ static NTSTATUS ntlmssp_client_challenge
+ 
+ noccache:
+ 
+-	if (!msrpc_parse(ntlmssp_state, &reply, "CdBd",
+-			 "NTLMSSP",
+-			 &ntlmssp_command,
+-			 &server_domain_blob,
+-			 &chal_flags)) {
+-		DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
+-		dump_data(2, reply.data, reply.length);
+-
+-		return NT_STATUS_INVALID_PARAMETER;
+-	}
+-
+ 	if (DEBUGLEVEL >= 10) {
+ 		struct CHALLENGE_MESSAGE *challenge = talloc(
+ 			talloc_tos(), struct CHALLENGE_MESSAGE);
+@@ -525,13 +624,6 @@ noccache:
+ 		}
+ 	}
+ 
+-	data_blob_free(&server_domain_blob);
+-
+-	DEBUG(3, ("Got challenge flags:\n"));
+-	debug_ntlmssp_flags(chal_flags);
+-
+-	ntlmssp_handle_neg_flags(ntlmssp_state, chal_flags, lp_client_lanman_auth());
+-
+ 	if (ntlmssp_state->unicode) {
+ 		if (chal_flags & NTLMSSP_NEGOTIATE_TARGET_INFO) {
+ 			chal_parse_string = "CdUdbddB";
+@@ -769,6 +861,7 @@ NTSTATUS ntlmssp_client_start(TALLOC_CTX
+ 	ntlmssp_state->unicode = True;
+ 
+ 	ntlmssp_state->use_ntlmv2 = use_ntlmv2;
++	ntlmssp_state->allow_lm_key = lp_client_lanman_auth();
+ 
+ 	ntlmssp_state->expected_state = NTLMSSP_INITIAL;
+ 
+@@ -780,6 +873,10 @@ NTSTATUS ntlmssp_client_start(TALLOC_CTX
+ 		NTLMSSP_NEGOTIATE_KEY_EXCH |
+ 		NTLMSSP_REQUEST_TARGET;
+ 
++	if (ntlmssp_state->use_ntlmv2) {
++		ntlmssp_state->allow_lm_key = false;
++	}
++
+ 	ntlmssp_state->client.netbios_name = talloc_strdup(ntlmssp_state, netbios_name);
+ 	if (!ntlmssp_state->client.netbios_name) {
+ 		talloc_free(ntlmssp_state);
+--- a/libcli/auth/ntlmssp.h
++++ b/libcli/auth/ntlmssp.h
+@@ -83,6 +83,7 @@ struct ntlmssp_state
+ 	DATA_BLOB nt_resp;
+ 	DATA_BLOB session_key;
+ 
++	uint32_t required_flags;
+ 	uint32_t neg_flags; /* the current state of negotiation with the NTLMSSP partner */
+ 
+ 	/**
diff --git a/package/network/services/samba36/patches/024-CVE-2016-2111-v3-6.patch b/package/network/services/samba36/patches/024-CVE-2016-2111-v3-6.patch
new file mode 100644
index 0000000..7f7f413
--- /dev/null
+++ b/package/network/services/samba36/patches/024-CVE-2016-2111-v3-6.patch
@@ -0,0 +1,681 @@
+From ee105156fa151ebfd34b8febc2928e144b3b7b0e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
+Date: Sat, 26 Sep 2015 01:29:10 +0200
+Subject: [PATCH 01/15] CVE-2016-2111: s3:rpc_server/netlogon: always go
+ through netr_creds_server_step_check()
+
+The ensures we apply the "server schannel = yes" restrictions.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=11749
+
+Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
+
+Signed-off-by: Guenther Deschner <gd@samba.org>
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+---
+ source3/rpc_server/netlogon/srv_netlog_nt.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
++++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
+@@ -1508,6 +1508,7 @@ static NTSTATUS _netr_LogonSamLogon_base
+ 	case NetlogonNetworkTransitiveInformation:
+ 	{
+ 		const char *wksname = nt_workstation;
++		const char *workgroup = lp_workgroup();
+ 
+ 		status = make_auth_context_fixed(talloc_tos(), &auth_context,
+ 						 logon->network->challenge);
+@@ -1532,6 +1533,14 @@ static NTSTATUS _netr_LogonSamLogon_base
+ 						     logon->network->nt.length)) {
+ 			status = NT_STATUS_NO_MEMORY;
+ 		}
++
++		if (NT_STATUS_IS_OK(status)) {
++			status = NTLMv2_RESPONSE_verify_netlogon_creds(
++						user_info->client.account_name,
++						user_info->client.domain_name,
++						user_info->password.response.nt,
++						creds, workgroup);
++		}
+ 		break;
+ 	}
+ 	case NetlogonInteractiveInformation:
+@@ -1636,6 +1645,14 @@ static NTSTATUS _netr_LogonSamLogon_base
+ 						r->out.validation->sam3);
+ 		break;
+ 	case 6:
++		/* Only allow this if the pipe is protected. */
++		if (p->auth.auth_level < DCERPC_AUTH_LEVEL_PRIVACY) {
++			DEBUG(0,("netr_Validation6: client %s not using privacy for netlogon\n",
++				get_remote_machine_name()));
++			status = NT_STATUS_INVALID_PARAMETER;
++			break;
++		}
++
+ 		status = serverinfo_to_SamInfo6(server_info, pipe_session_key, 16,
+ 						r->out.validation->sam6);
+ 		break;
+@@ -2271,11 +2288,13 @@ NTSTATUS _netr_GetForestTrustInformation
+ 
+ 	/* TODO: check server name */
+ 
+-	status = schannel_check_creds_state(p->mem_ctx, lp_private_dir(),
+-					    r->in.computer_name,
+-					    r->in.credential,
+-					    r->out.return_authenticator,
+-					    &creds);
++	become_root();
++	status = netr_creds_server_step_check(p, p->mem_ctx,
++					      r->in.computer_name,
++					      r->in.credential,
++					      r->out.return_authenticator,
++					      &creds);
++	unbecome_root();
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		return status;
+ 	}
+@@ -2371,11 +2390,13 @@ NTSTATUS _netr_ServerGetTrustInfo(struct
+ 
+ 	/* TODO: check server name */
+ 
+-	status = schannel_check_creds_state(p->mem_ctx, lp_private_dir(),
+-					    r->in.computer_name,
+-					    r->in.credential,
+-					    r->out.return_authenticator,
+-					    &creds);
++	become_root();
++	status = netr_creds_server_step_check(p, p->mem_ctx,
++					      r->in.computer_name,
++					      r->in.credential,
++					      r->out.return_authenticator,
++					      &creds);
++	unbecome_root();
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		return status;
+ 	}
+--- a/source4/torture/rpc/samba3rpc.c
++++ b/source4/torture/rpc/samba3rpc.c
+@@ -1122,8 +1122,8 @@ static bool schan(struct torture_context
+ 		generate_random_buffer(chal.data, chal.length);
+ 		names_blob = NTLMv2_generate_names_blob(
+ 			mem_ctx,
+-			cli_credentials_get_workstation(user_creds),
+-			cli_credentials_get_domain(user_creds));
++			cli_credentials_get_workstation(wks_creds),
++			cli_credentials_get_domain(wks_creds));
+ 		status = cli_credentials_get_ntlm_response(
+ 			user_creds, mem_ctx, &flags, chal, names_blob,
+ 			&lm_resp, &nt_resp, NULL, NULL);
+--- a/libcli/auth/proto.h
++++ b/libcli/auth/proto.h
+@@ -139,6 +139,11 @@ bool SMBNTLMv2encrypt(TALLOC_CTX *mem_ct
+ 		      const DATA_BLOB *names_blob,
+ 		      DATA_BLOB *lm_response, DATA_BLOB *nt_response, 
+ 		      DATA_BLOB *lm_session_key, DATA_BLOB *user_session_key) ;
++NTSTATUS NTLMv2_RESPONSE_verify_netlogon_creds(const char *account_name,
++			const char *account_domain,
++			const DATA_BLOB response,
++			const struct netlogon_creds_CredentialState *creds,
++			const char *workgroup);
+ 
+ /***********************************************************
+  encode a password buffer with a unicode password.  The buffer
+--- a/libcli/auth/smbencrypt.c
++++ b/libcli/auth/smbencrypt.c
+@@ -26,7 +26,7 @@
+ #include "../libcli/auth/msrpc_parse.h"
+ #include "../lib/crypto/crypto.h"
+ #include "../libcli/auth/libcli_auth.h"
+-#include "../librpc/gen_ndr/ntlmssp.h"
++#include "../librpc/gen_ndr/ndr_ntlmssp.h"
+ 
+ void SMBencrypt_hash(const uint8_t lm_hash[16], const uint8_t *c8, uint8_t p24[24])
+ {
+@@ -522,6 +522,146 @@ bool SMBNTLMv2encrypt(TALLOC_CTX *mem_ct
+ 				     lm_response, nt_response, lm_session_key, user_session_key);
+ }
+ 
++NTSTATUS NTLMv2_RESPONSE_verify_netlogon_creds(const char *account_name,
++			const char *account_domain,
++			const DATA_BLOB response,
++			const struct netlogon_creds_CredentialState *creds,
++			const char *workgroup)
++{
++	TALLOC_CTX *frame = NULL;
++	/* RespType + HiRespType */
++	static const char *magic = "\x01\x01";
++	int cmp;
++	struct NTLMv2_RESPONSE v2_resp;
++	enum ndr_err_code err;
++	const struct AV_PAIR *av_nb_cn = NULL;
++	const struct AV_PAIR *av_nb_dn = NULL;
++
++	if (response.length < 48) {
++		/*
++		 * NTLMv2_RESPONSE has at least 48 bytes.
++		 */
++		return NT_STATUS_OK;
++	}
++
++	cmp = memcmp(response.data + 16, magic, 2);
++	if (cmp != 0) {
++		/*
++		 * It doesn't look like a valid NTLMv2_RESPONSE
++		 */
++		return NT_STATUS_OK;
++	}
++
++	frame = talloc_stackframe();
++
++	err = ndr_pull_struct_blob(&response, frame, &v2_resp,
++		(ndr_pull_flags_fn_t)ndr_pull_NTLMv2_RESPONSE);
++	if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
++		NTSTATUS status;
++		status = ndr_map_error2ntstatus(err);
++		DEBUG(2,("Failed to parse NTLMv2_RESPONSE "
++			 "length %u - %s - %s\n",
++			 (unsigned)response.length,
++			 ndr_map_error2string(err),
++			 nt_errstr(status)));
++		dump_data(2, response.data, response.length);
++		TALLOC_FREE(frame);
++		return status;
++	}
++
++	if (DEBUGLVL(10)) {
++		NDR_PRINT_DEBUG(NTLMv2_RESPONSE, &v2_resp);
++	}
++
++	/*
++	 * Make sure the netbios computer name in the
++	 * NTLMv2_RESPONSE matches the computer name
++	 * in the secure channel credentials for workstation
++	 * trusts.
++	 *
++	 * And the netbios domain name matches our
++	 * workgroup.
++	 *
++	 * This prevents workstations from requesting
++	 * the session key of NTLMSSP sessions of clients
++	 * to other hosts.
++	 */
++	if (creds->secure_channel_type == SEC_CHAN_WKSTA) {
++		av_nb_cn = ndr_ntlmssp_find_av(&v2_resp.Challenge.AvPairs,
++					       MsvAvNbComputerName);
++		av_nb_dn = ndr_ntlmssp_find_av(&v2_resp.Challenge.AvPairs,
++					       MsvAvNbDomainName);
++	}
++
++	if (av_nb_cn != NULL) {
++		const char *v = NULL;
++		char *a = NULL;
++		size_t len;
++
++		v = av_nb_cn->Value.AvNbComputerName;
++
++		a = talloc_strdup(frame, creds->account_name);
++		if (a == NULL) {
++			TALLOC_FREE(frame);
++			return NT_STATUS_NO_MEMORY;
++		}
++		len = strlen(a);
++		if (len > 0 && a[len - 1] == '$') {
++			a[len - 1] = '\0';
++		}
++
++#ifdef SAMBA4_INTERNAL_HEIMDAL /* smbtorture4 for make test */
++		cmp = strcasecmp_m(a, v);
++#else /* smbd */
++		cmp = StrCaseCmp(a, v);
++#endif
++		if (cmp != 0) {
++			DEBUG(2,("%s: NTLMv2_RESPONSE with "
++				 "NbComputerName[%s] rejected "
++				 "for user[%s\\%s] "
++				 "against SEC_CHAN_WKSTA[%s/%s] "
++				 "in workgroup[%s]\n",
++				 __func__, v,
++				 account_domain,
++				 account_name,
++				 creds->computer_name,
++				 creds->account_name,
++				 workgroup));
++			TALLOC_FREE(frame);
++			return NT_STATUS_LOGON_FAILURE;
++		}
++	}
++	if (av_nb_dn != NULL) {
++		const char *v = NULL;
++
++		v = av_nb_dn->Value.AvNbDomainName;
++
++#ifdef SAMBA4_INTERNAL_HEIMDAL /* smbtorture4 for make test */
++		cmp = strcasecmp_m(workgroup, v);
++#else /* smbd */
++		cmp = StrCaseCmp(workgroup, v);
++#endif
++		if (cmp != 0) {
++			DEBUG(2,("%s: NTLMv2_RESPONSE with "
++				 "NbDomainName[%s] rejected "
++				 "for user[%s\\%s] "
++				 "against SEC_CHAN_WKSTA[%s/%s] "
++				 "in workgroup[%s]\n",
++				 __func__, v,
++				 account_domain,
++				 account_name,
++				 creds->computer_name,
++				 creds->account_name,
++				 workgroup));
++			TALLOC_FREE(frame);
++			return NT_STATUS_LOGON_FAILURE;
++		}
++	}
++
++	TALLOC_FREE(frame);
++	return NT_STATUS_OK;
++}
++
+ /***********************************************************
+  encode a password buffer with a unicode password.  The buffer
+  is filled with random data to make it harder to attack.
+--- a/libcli/auth/wscript_build
++++ b/libcli/auth/wscript_build
+@@ -19,7 +19,7 @@ bld.SAMBA_SUBSYSTEM('MSRPC_PARSE',
+ 
+ bld.SAMBA_SUBSYSTEM('LIBCLI_AUTH',
+ 	source='credentials.c session.c smbencrypt.c smbdes.c',
+-	public_deps='MSRPC_PARSE',
++	public_deps='MSRPC_PARSE NDR_NTLMSSP',
+ 	public_headers='credentials.h:domain_credentials.h'
+ 	)
+ 
+--- a/source3/Makefile.in
++++ b/source3/Makefile.in
+@@ -783,6 +783,7 @@ GROUPDB_OBJ = groupdb/mapping.o groupdb/
+ PROFILE_OBJ = profile/profile.o
+ PROFILES_OBJ = utils/profiles.o \
+ 	       $(LIBSMB_ERR_OBJ) \
++	       $(LIBNDR_NTLMSSP_OBJ) \
+ 	       $(PARAM_OBJ) \
+                $(LIB_OBJ) $(LIB_DUMMY_OBJ) \
+                $(POPT_LIB_OBJ) \
+@@ -995,10 +996,10 @@ SWAT_OBJ = $(SWAT_OBJ1) $(PARAM_OBJ) $(P
+ STATUS_OBJ = utils/status.o utils/status_profile.o \
+ 	     $(LOCKING_OBJ) $(PARAM_OBJ) \
+              $(PROFILE_OBJ) $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) \
+-	     $(LIBSMB_ERR_OBJ) $(FNAME_UTIL_OBJ)
++	     $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) $(FNAME_UTIL_OBJ)
+ 
+ SMBCONTROL_OBJ = utils/smbcontrol.o $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) \
+-	$(LIBSMB_ERR_OBJ) $(POPT_LIB_OBJ) $(PRINTBASE_OBJ)
++	$(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) $(POPT_LIB_OBJ) $(PRINTBASE_OBJ)
+ 
+ SMBTREE_OBJ = utils/smbtree.o $(PARAM_OBJ) \
+              $(PROFILE_OBJ) $(LIB_NONSMBD_OBJ) $(LIBSMB_OBJ) \
+@@ -1012,11 +1013,11 @@ SMBTREE_OBJ = utils/smbtree.o $(PARAM_OB
+ 
+ TESTPARM_OBJ = utils/testparm.o \
+                $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) \
+-	       $(LIBSMB_ERR_OBJ)
++	       $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ)
+ 
+ SMBTA_UTIL_OBJ = utils/smbta-util.o $(PARAM_OBJ) $(POPT_LIB_OBJ) \
+ 	$(LIB_NONSMBD_OBJ) \
+-	$(LIBSMB_ERR_OBJ) $(FNAME_UTIL_OBJ)
++	$(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) $(FNAME_UTIL_OBJ)
+ 
+ TEST_LP_LOAD_OBJ = param/test_lp_load.o \
+ 		   $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) \
+@@ -1146,6 +1147,7 @@ SMBCONFTORT_OBJ = $(SMBCONFTORT_OBJ0) \
+ 		  $(LIB_NONSMBD_OBJ) \
+ 		  $(PARAM_OBJ) \
+ 		  $(LIBSMB_ERR_OBJ) \
++		  $(LIBNDR_NTLMSSP_OBJ) \
+ 		  $(POPT_LIB_OBJ)
+ 
+ PTHREADPOOLTEST_OBJ = lib/pthreadpool/pthreadpool.o \
+@@ -1229,7 +1231,7 @@ CUPS_OBJ = client/smbspool.o $(PARAM_OBJ
+ 	  $(LIBNDR_GEN_OBJ0)
+ 
+ NMBLOOKUP_OBJ = utils/nmblookup.o $(PARAM_OBJ) $(LIBNMB_OBJ) \
+-               $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) $(LIBSMB_ERR_OBJ)
++               $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ)
+ 
+ SMBTORTURE_OBJ1 = torture/torture.o torture/nbio.o torture/scanner.o torture/utable.o \
+ 		torture/denytest.o torture/mangle_test.o \
+@@ -1253,6 +1255,7 @@ MASKTEST_OBJ = torture/masktest.o $(PARA
+ 		 $(LIBNDR_GEN_OBJ0)
+ 
+ MSGTEST_OBJ = torture/msgtest.o $(PARAM_OBJ) $(LIBSMB_ERR_OBJ) \
++		 $(LIBNDR_NTLMSSP_OBJ) \
+                  $(LIB_NONSMBD_OBJ) \
+ 		 $(LIBNDR_GEN_OBJ0)
+ 
+@@ -1269,7 +1272,7 @@ PDBTEST_OBJ = torture/pdbtest.o $(PARAM_
+ 
+ VFSTEST_OBJ = torture/cmd_vfs.o torture/vfstest.o $(SMBD_OBJ_BASE) $(READLINE_OBJ)
+ 
+-SMBICONV_OBJ = $(PARAM_OBJ) torture/smbiconv.o $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) $(LIBSMB_ERR_OBJ)
++SMBICONV_OBJ = $(PARAM_OBJ) torture/smbiconv.o $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ)
+ 
+ LOG2PCAP_OBJ = utils/log2pcaphex.o
+ 
+@@ -1297,17 +1300,17 @@ SMBCQUOTAS_OBJ = utils/smbcquotas.o $(LI
+ EVTLOGADM_OBJ0	= utils/eventlogadm.o
+ 
+ EVTLOGADM_OBJ	= $(EVTLOGADM_OBJ0) $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) \
+-		$(LIBSMB_ERR_OBJ) $(LIB_EVENTLOG_OBJ) \
++		$(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) $(LIB_EVENTLOG_OBJ) \
+ 		librpc/gen_ndr/ndr_eventlog.o \
+ 		librpc/gen_ndr/ndr_lsa.o
+ 
+ SHARESEC_OBJ0 = utils/sharesec.o
+ SHARESEC_OBJ  = $(SHARESEC_OBJ0) $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) \
+-		$(LIBSMB_ERR_OBJ) \
++		$(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) \
+                 $(POPT_LIB_OBJ)
+ 
+ TALLOCTORT_OBJ = @tallocdir@/testsuite.o @tallocdir@/testsuite_main.o \
+-		$(PARAM_OBJ) $(LIB_NONSMBD_OBJ) $(LIBSMB_ERR_OBJ)
++		$(PARAM_OBJ) $(LIB_NONSMBD_OBJ) $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ)
+ 
+ REPLACETORT_OBJ = @libreplacedir@/test/testsuite.o \
+ 		@libreplacedir@/test/getifaddrs.o \
+@@ -1323,7 +1326,7 @@ SMBFILTER_OBJ = utils/smbfilter.o $(PARA
+ 		 $(LIBNDR_GEN_OBJ0)
+ 
+ WINBIND_WINS_NSS_OBJ = ../nsswitch/wins.o $(PARAM_OBJ) \
+-	$(LIB_NONSMBD_OBJ) $(LIBSMB_ERR_OBJ) $(LIBNMB_OBJ)
++	$(LIB_NONSMBD_OBJ) $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) $(LIBNMB_OBJ)
+ 
+ PAM_SMBPASS_OBJ_0 = pam_smbpass/pam_smb_auth.o pam_smbpass/pam_smb_passwd.o \
+ 		pam_smbpass/pam_smb_acct.o pam_smbpass/support.o ../lib/util/asn1.o
+@@ -1531,12 +1534,14 @@ RPC_OPEN_TCP_OBJ = torture/rpc_open_tcp.
+ DBWRAP_TOOL_OBJ = utils/dbwrap_tool.o \
+ 		  $(PARAM_OBJ) \
+ 		  $(LIB_NONSMBD_OBJ) \
+-		  $(LIBSMB_ERR_OBJ)
++		  $(LIBSMB_ERR_OBJ) \
++		  $(LIBNDR_NTLMSSP_OBJ)
+ 
+ DBWRAP_TORTURE_OBJ = utils/dbwrap_torture.o \
+ 		     $(PARAM_OBJ) \
+ 		     $(LIB_NONSMBD_OBJ) \
+ 		     $(LIBSMB_ERR_OBJ) \
++		     $(LIBNDR_NTLMSSP_OBJ) \
+ 		     $(POPT_LIB_OBJ)
+ 
+ SPLIT_TOKENS_OBJ = utils/split_tokens.o \
+--- a/source4/torture/raw/samba3misc.c
++++ b/source4/torture/raw/samba3misc.c
+@@ -340,6 +340,7 @@ bool torture_samba3_badpath(struct tortu
+ 	bool ret = true;
+ 	TALLOC_CTX *mem_ctx;
+ 	bool nt_status_support;
++	bool client_ntlmv2_auth;
+ 
+ 	if (!(mem_ctx = talloc_init("torture_samba3_badpath"))) {
+ 		d_printf("talloc_init failed\n");
+@@ -347,20 +348,17 @@ bool torture_samba3_badpath(struct tortu
+ 	}
+ 
+ 	nt_status_support = lpcfg_nt_status_support(torture->lp_ctx);
++	client_ntlmv2_auth = lpcfg_client_ntlmv2_auth(torture->lp_ctx);
+ 
+-	if (!lpcfg_set_cmdline(torture->lp_ctx, "nt status support", "yes")) {
+-		printf("Could not set 'nt status support = yes'\n");
+-		goto fail;
+-	}
++	torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "nt status support", "yes"), ret, fail, "Could not set 'nt status support = yes'\n");
++	torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "client ntlmv2 auth", "yes"), ret, fail, "Could not set 'client ntlmv2 auth = yes'\n");
+ 
+ 	if (!torture_open_connection(&cli_nt, torture, 0)) {
+ 		goto fail;
+ 	}
+ 
+-	if (!lpcfg_set_cmdline(torture->lp_ctx, "nt status support", "no")) {
+-		printf("Could not set 'nt status support = yes'\n");
+-		goto fail;
+-	}
++	torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "nt status support", "no"), ret, fail, "Could not set 'nt status support = no'\n");
++	torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "client ntlmv2 auth", "no"), ret, fail, "Could not set 'client ntlmv2 auth = no'\n");
+ 
+ 	if (!torture_open_connection(&cli_dos, torture, 1)) {
+ 		goto fail;
+@@ -373,6 +371,12 @@ bool torture_samba3_badpath(struct tortu
+ 	}
+ 
+ 	smbcli_deltree(cli_nt->tree, dirname);
++	torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "nt status support",
++						       nt_status_support ? "yes":"no"),
++			    ret, fail, "Could not set 'nt status support' back to where it was\n");
++	torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "client ntlmv2 auth",
++						       client_ntlmv2_auth ? "yes":"no"),
++			    ret, fail, "Could not set 'client ntlmv2 auth' back to where it was\n");
+ 
+ 	status = smbcli_mkdir(cli_nt->tree, dirname);
+ 	if (!NT_STATUS_IS_OK(status)) {
+--- a/source4/torture/basic/base.c
++++ b/source4/torture/basic/base.c
+@@ -1476,6 +1476,7 @@ static bool torture_chkpath_test(struct
+ static bool torture_samba3_errorpaths(struct torture_context *tctx)
+ {
+ 	bool nt_status_support;
++	bool client_ntlmv2_auth;
+ 	struct smbcli_state *cli_nt = NULL, *cli_dos = NULL;
+ 	bool result = false;
+ 	int fnum;
+@@ -1485,18 +1486,27 @@ static bool torture_samba3_errorpaths(st
+ 	NTSTATUS status;
+ 
+ 	nt_status_support = lpcfg_nt_status_support(tctx->lp_ctx);
++	client_ntlmv2_auth = lpcfg_client_ntlmv2_auth(tctx->lp_ctx);
+ 
+ 	if (!lpcfg_set_cmdline(tctx->lp_ctx, "nt status support", "yes")) {
+ 		torture_comment(tctx, "Could not set 'nt status support = yes'\n");
+ 		goto fail;
+ 	}
++	if (!lpcfg_set_cmdline(tctx->lp_ctx, "client ntlmv2 auth", "yes")) {
++		torture_result(tctx, TORTURE_FAIL, "Could not set 'client ntlmv2 auth = yes'\n");
++		goto fail;
++	}
+ 
+ 	if (!torture_open_connection(&cli_nt, tctx, 0)) {
+ 		goto fail;
+ 	}
+ 
+ 	if (!lpcfg_set_cmdline(tctx->lp_ctx, "nt status support", "no")) {
+-		torture_comment(tctx, "Could not set 'nt status support = yes'\n");
++		torture_result(tctx, TORTURE_FAIL, "Could not set 'nt status support = no'\n");
++		goto fail;
++	}
++	if (!lpcfg_set_cmdline(tctx->lp_ctx, "client ntlmv2 auth", "no")) {
++		torture_result(tctx, TORTURE_FAIL, "Could not set 'client ntlmv2 auth = no'\n");
+ 		goto fail;
+ 	}
+ 
+@@ -1506,7 +1516,12 @@ static bool torture_samba3_errorpaths(st
+ 
+ 	if (!lpcfg_set_cmdline(tctx->lp_ctx, "nt status support",
+ 			    nt_status_support ? "yes":"no")) {
+-		torture_comment(tctx, "Could not reset 'nt status support = yes'");
++		torture_result(tctx, TORTURE_FAIL, "Could not reset 'nt status support'");
++		goto fail;
++	}
++	if (!lpcfg_set_cmdline(tctx->lp_ctx, "client ntlmv2 auth",
++			       client_ntlmv2_auth ? "yes":"no")) {
++		torture_result(tctx, TORTURE_FAIL, "Could not reset 'client ntlmv2 auth'");
+ 		goto fail;
+ 	}
+ 
+--- a/source3/libsmb/cliconnect.c
++++ b/source3/libsmb/cliconnect.c
+@@ -2077,6 +2077,17 @@ NTSTATUS cli_session_setup(struct cli_st
+ 		NTSTATUS status;
+ 
+ 		/* otherwise do a NT1 style session setup */
++		if (lp_client_ntlmv2_auth() && lp_client_use_spnego()) {
++			/*
++			 * Don't send an NTLMv2 response without NTLMSSP
++			 * if we want to use spnego support
++			 */
++			DEBUG(1, ("Server does not support EXTENDED_SECURITY "
++				  " but 'client use spnego = yes"
++				  " and 'client ntlmv2 auth = yes'\n"));
++			return NT_STATUS_ACCESS_DENIED;
++		}
++
+ 		status = cli_session_setup_nt1(cli, user, pass, passlen,
+ 					       ntpass, ntpasslen, workgroup);
+ 		if (!NT_STATUS_IS_OK(status)) {
+--- a/docs-xml/smbdotconf/protocol/clientusespnego.xml
++++ b/docs-xml/smbdotconf/protocol/clientusespnego.xml
+@@ -9,6 +9,11 @@
+     supporting servers (including WindowsXP, Windows2000 and Samba
+     3.0) to agree upon an authentication
+     mechanism.  This enables Kerberos authentication in particular.</para>
++
++    <para>When <smbconfoption name="client NTLMv2 auth"/> is also set to
++    <constant>yes</constant> extended security (SPNEGO) is required
++    in order to use NTLMv2 only within NTLMSSP. This behavior was
++    introduced with the patches for CVE-2016-2111.</para>
+ </description>
+ 
+ <value type="default">yes</value>
+--- a/docs-xml/smbdotconf/security/clientntlmv2auth.xml
++++ b/docs-xml/smbdotconf/security/clientntlmv2auth.xml
+@@ -28,6 +28,11 @@
+     NTLMv2 by default, and some sites (particularly those following
+     'best practice' security polices) only allow NTLMv2 responses, and
+     not the weaker LM or NTLM.</para>
++
++    <para>When <smbconfoption name="client use spnego"/> is also set to
++    <constant>yes</constant> extended security (SPNEGO) is required
++    in order to use NTLMv2 only within NTLMSSP. This behavior was
++    introduced with the patches for CVE-2016-2111.</para>
+ </description>
+ <value type="default">yes</value>
+ </samba:parameter>
+--- /dev/null
++++ b/docs-xml/smbdotconf/security/rawntlmv2auth.xml
+@@ -0,0 +1,19 @@
++<samba:parameter name="raw NTLMv2 auth"
++                 context="G"
++                 type="boolean"
++                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
++<description>
++    <para>This parameter determines whether or not <citerefentry><refentrytitle>smbd</refentrytitle>
++    <manvolnum>8</manvolnum></citerefentry> will allow SMB1 clients without
++    extended security (without SPNEGO) to use NTLMv2 authentication.</para>
++
++    <para>If this option, <command moreinfo="none">lanman auth</command>
++    and <command moreinfo="none">ntlm auth</command> are all disabled,
++    then only clients with SPNEGO support will be permitted.
++    That means NTLMv2 is only supported within NTLMSSP.</para>
++</description>
++
++<related>lanman auth</related>
++<related>ntlm auth</related>
++<value type="default">no</value>
++</samba:parameter>
+--- a/source3/include/proto.h
++++ b/source3/include/proto.h
+@@ -1489,6 +1489,7 @@ bool lp_map_untrusted_to_domain(void);
+ int lp_restrict_anonymous(void);
+ bool lp_lanman_auth(void);
+ bool lp_ntlm_auth(void);
++bool lp_raw_ntlmv2_auth(void);
+ bool lp_client_plaintext_auth(void);
+ bool lp_client_lanman_auth(void);
+ bool lp_client_ntlmv2_auth(void);
+--- a/source3/param/loadparm.c
++++ b/source3/param/loadparm.c
+@@ -336,6 +336,7 @@ struct global {
+ 	bool bAllowTrustedDomains;
+ 	bool bLanmanAuth;
+ 	bool bNTLMAuth;
++	bool bRawNTLMv2Auth;
+ 	bool bUseSpnego;
+ 	bool bClientLanManAuth;
+ 	bool bClientNTLMv2Auth;
+@@ -1383,6 +1384,15 @@ static struct parm_struct parm_table[] =
+ 		.flags		= FLAG_ADVANCED,
+ 	},
+ 	{
++		.label		= "raw NTLMv2 auth",
++		.type		= P_BOOL,
++		.p_class	= P_GLOBAL,
++		.ptr		= &Globals.bRawNTLMv2Auth,
++		.special	= NULL,
++		.enum_list	= NULL,
++		.flags		= FLAG_ADVANCED,
++	},
++	{
+ 		.label		= "client NTLMv2 auth",
+ 		.type		= P_BOOL,
+ 		.p_class	= P_GLOBAL,
+@@ -5337,6 +5347,7 @@ static void init_globals(bool reinit_glo
+ 	Globals.bClientPlaintextAuth = False;	/* Do NOT use a plaintext password even if is requested by the server */
+ 	Globals.bLanmanAuth = False;	/* Do NOT use the LanMan hash, even if it is supplied */
+ 	Globals.bNTLMAuth = True;	/* Do use NTLMv1 if it is supplied by the client (otherwise NTLMv2) */
++	Globals.bRawNTLMv2Auth = false;	/* Allow NTLMv2 without NTLMSSP */
+ 	Globals.bClientNTLMv2Auth = True; /* Client should always use use NTLMv2, as we can't tell that the server supports it, but most modern servers do */
+ 	/* Note, that we will also use NTLM2 session security (which is different), if it is available */
+ 
+@@ -5819,6 +5830,7 @@ FN_GLOBAL_BOOL(lp_map_untrusted_to_domai
+ FN_GLOBAL_INTEGER(lp_restrict_anonymous, &Globals.restrict_anonymous)
+ FN_GLOBAL_BOOL(lp_lanman_auth, &Globals.bLanmanAuth)
+ FN_GLOBAL_BOOL(lp_ntlm_auth, &Globals.bNTLMAuth)
++FN_GLOBAL_BOOL(lp_raw_ntlmv2_auth, &Globals.bRawNTLMv2Auth)
+ FN_GLOBAL_BOOL(lp_client_plaintext_auth, &Globals.bClientPlaintextAuth)
+ FN_GLOBAL_BOOL(lp_client_lanman_auth, &Globals.bClientLanManAuth)
+ FN_GLOBAL_BOOL(lp_client_ntlmv2_auth, &Globals.bClientNTLMv2Auth)
+--- a/source3/auth/auth_util.c
++++ b/source3/auth/auth_util.c
+@@ -30,6 +30,7 @@
+ #include "../lib/util/util_pw.h"
+ #include "lib/winbind_util.h"
+ #include "passdb.h"
++#include "../lib/tsocket/tsocket.h"
+ 
+ #undef DBGC_CLASS
+ #define DBGC_CLASS DBGC_AUTH
+@@ -367,6 +368,19 @@ NTSTATUS make_user_info_for_reply_enc(st
+                                       const char *client_domain, 
+                                       DATA_BLOB lm_resp, DATA_BLOB nt_resp)
+ {
++	bool allow_raw = lp_raw_ntlmv2_auth();
++
++	if (!allow_raw && nt_resp.length >= 48) {
++		/*
++		 * NTLMv2_RESPONSE has at least 48 bytes
++		 * and should only be supported via NTLMSSP.
++		 */
++		DEBUG(2,("Rejecting raw NTLMv2 authentication with "
++			 "user [%s\\%s]\n",
++			 client_domain, smb_name));
++		return NT_STATUS_INVALID_PARAMETER;
++	}
++
+ 	return make_user_info_map(user_info, smb_name, 
+ 				  client_domain, 
+ 				  get_remote_machine_name(), 
+--- a/selftest/target/Samba3.pm
++++ b/selftest/target/Samba3.pm
+@@ -127,6 +127,7 @@ sub setup_dc($$)
+ 	domain master = yes
+ 	domain logons = yes
+ 	lanman auth = yes
++	raw NTLMv2 auth = yes
+ ";
+ 
+ 	my $vars = $self->provision($path,
+@@ -230,6 +231,7 @@ sub setup_secserver($$$)
+ 	my $secserver_options = "
+ 	security = server
+         password server = $s3dcvars->{SERVER_IP}
++	client ntlmv2 auth = no
+ ";
+ 
+ 	my $ret = $self->provision($prefix,
diff --git a/package/network/services/samba36/patches/025-CVE-2016-2112-v3-6.patch b/package/network/services/samba36/patches/025-CVE-2016-2112-v3-6.patch
new file mode 100644
index 0000000..78e0a66
--- /dev/null
+++ b/package/network/services/samba36/patches/025-CVE-2016-2112-v3-6.patch
@@ -0,0 +1,129 @@
+From 126e3e992bed7174d60ee19212db9b717647ab2e Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@cryptomilk.org>
+Date: Wed, 30 Mar 2016 16:55:44 +0200
+Subject: [PATCH 1/3] CVE-2016-2112: s3:ntlmssp: Implement missing
+ ntlmssp_have_feature()
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+---
+ source3/include/proto.h  |  1 +
+ source3/libsmb/ntlmssp.c | 30 ++++++++++++++++++++++++++++++
+ 2 files changed, 31 insertions(+)
+
+--- a/source3/include/proto.h
++++ b/source3/include/proto.h
+@@ -1260,6 +1260,7 @@ NTSTATUS ntlmssp_set_password(struct ntl
+ NTSTATUS ntlmssp_set_domain(struct ntlmssp_state *ntlmssp_state, const char *domain) ;
+ void ntlmssp_want_feature_list(struct ntlmssp_state *ntlmssp_state, char *feature_list);
+ void ntlmssp_want_feature(struct ntlmssp_state *ntlmssp_state, uint32_t feature);
++bool ntlmssp_have_feature(struct ntlmssp_state *ntlmssp_state, uint32_t feature);
+ NTSTATUS ntlmssp_update(struct ntlmssp_state *ntlmssp_state,
+ 			const DATA_BLOB in, DATA_BLOB *out) ;
+ NTSTATUS ntlmssp_server_start(TALLOC_CTX *mem_ctx,
+--- a/source3/libsmb/ntlmssp.c
++++ b/source3/libsmb/ntlmssp.c
+@@ -162,6 +162,36 @@ NTSTATUS ntlmssp_set_domain(struct ntlms
+ 	return NT_STATUS_OK;
+ }
+ 
++bool ntlmssp_have_feature(struct ntlmssp_state *ntlmssp_state,
++			  uint32_t feature)
++{
++	if (feature & NTLMSSP_FEATURE_SIGN) {
++		if (ntlmssp_state->session_key.length == 0) {
++			return false;
++		}
++		if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
++			return true;
++		}
++	}
++
++	if (feature & NTLMSSP_FEATURE_SEAL) {
++		if (ntlmssp_state->session_key.length == 0) {
++			return false;
++		}
++		if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
++			return true;
++		}
++	}
++
++	if (feature & NTLMSSP_FEATURE_SESSION_KEY) {
++		if (ntlmssp_state->session_key.length > 0) {
++			return true;
++		}
++	}
++
++	return false;
++}
++
+ /**
+  * Request features for the NTLMSSP negotiation
+  *
+--- a/source3/libads/sasl.c
++++ b/source3/libads/sasl.c
+@@ -261,6 +261,37 @@ static ADS_STATUS ads_sasl_spnego_ntlmss
+ 	/* we have a reference conter on ntlmssp_state, if we are signing
+ 	   then the state will be kept by the signing engine */
+ 
++	if (ads->ldap.wrap_type >= ADS_SASLWRAP_TYPE_SEAL) {
++		bool ok;
++
++		ok = ntlmssp_have_feature(ntlmssp_state,
++					  NTLMSSP_FEATURE_SEAL);
++		if (!ok) {
++			DEBUG(0,("The ntlmssp feature sealing request, but unavailable\n"));
++			TALLOC_FREE(ntlmssp_state);
++			return ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
++		}
++
++		ok = ntlmssp_have_feature(ntlmssp_state,
++					  NTLMSSP_FEATURE_SIGN);
++		if (!ok) {
++			DEBUG(0,("The ntlmssp feature signing request, but unavailable\n"));
++			TALLOC_FREE(ntlmssp_state);
++			return ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
++		}
++
++	} else if (ads->ldap.wrap_type >= ADS_SASLWRAP_TYPE_SIGN) {
++		bool ok;
++
++		ok = ntlmssp_have_feature(ntlmssp_state,
++					  NTLMSSP_FEATURE_SIGN);
++		if (!ok) {
++			DEBUG(0,("The gensec feature signing request, but unavailable\n"));
++			TALLOC_FREE(ntlmssp_state);
++			return ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
++		}
++	}
++
+ 	if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
+ 		ads->ldap.out.max_unwrapped = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED - NTLMSSP_SIG_SIZE;
+ 		ads->ldap.out.sig_size = NTLMSSP_SIG_SIZE;
+--- a/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml
++++ b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml
+@@ -34,11 +34,9 @@
+ 	</para>
+ 
+ 	<para>
+-	The default value is <emphasis>plain</emphasis> which is not irritable 
+-	to KRB5 clock skew errors. That implies synchronizing the time
+-	with the KDC in the case of using <emphasis>sign</emphasis> or 
+-	<emphasis>seal</emphasis>.
++	The default value is <emphasis>sign</emphasis>. That implies synchronizing the time
++	with the KDC in the case of using <emphasis>Kerberos</emphasis>.
+ 	</para>
+ </description>
+-<value type="default">plain</value>
++<value type="default">sign</value>
+ </samba:parameter>
+--- a/source3/param/loadparm.c
++++ b/source3/param/loadparm.c
+@@ -5392,6 +5392,8 @@ static void init_globals(bool reinit_glo
+ 	Globals.ldap_debug_level = 0;
+ 	Globals.ldap_debug_threshold = 10;
+ 
++	Globals.client_ldap_sasl_wrapping = ADS_AUTH_SASL_SIGN;
++
+ 	/* This is what we tell the afs client. in reality we set the token 
+ 	 * to never expire, though, when this runs out the afs client will 
+ 	 * forget the token. Set to 0 to get NEVERDATE.*/
diff --git a/package/network/services/samba36/patches/026-CVE-2016-2115-v3-6.patch b/package/network/services/samba36/patches/026-CVE-2016-2115-v3-6.patch
new file mode 100644
index 0000000..5618fb4
--- /dev/null
+++ b/package/network/services/samba36/patches/026-CVE-2016-2115-v3-6.patch
@@ -0,0 +1,256 @@
+From 513bd34e4523e49e742487be32a7239111486a12 Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <metze@samba.org>
+Date: Sat, 27 Feb 2016 03:43:58 +0100
+Subject: [PATCH 1/4] CVE-2016-2115: docs-xml: add "client ipc signing" option
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=11756
+
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Reviewed-by: Ralph Boehme <slow@samba.org>
+---
+ docs-xml/smbdotconf/security/clientipcsigning.xml | 23 +++++++++++++++++++++++
+ docs-xml/smbdotconf/security/clientsigning.xml    |  3 +++
+ source3/include/proto.h                           |  1 +
+ source3/param/loadparm.c                          | 12 ++++++++++++
+ 4 files changed, 39 insertions(+)
+ create mode 100644 docs-xml/smbdotconf/security/clientipcsigning.xml
+
+--- /dev/null
++++ b/docs-xml/smbdotconf/security/clientipcsigning.xml
+@@ -0,0 +1,23 @@
++<samba:parameter name="client ipc signing"
++                 context="G"
++                 type="enum"
++                 enumlist="enum_smb_signing_vals"
++                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
++<description>
++    <para>This controls whether the client is allowed or required to use SMB signing for IPC$
++    connections as DCERPC transport inside of winbind. Possible values
++    are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
++    and <emphasis>disabled</emphasis>.
++    </para>
++
++    <para>When set to auto, SMB signing is offered, but not enforced and if set
++    to disabled, SMB signing is not offered either.</para>
++
++    <para>Connections from winbindd to Active Directory Domain Controllers
++    always enforce signing.</para>
++</description>
++
++<related>client signing</related>
++
++<value type="default">mandatory</value>
++</samba:parameter>
+--- a/docs-xml/smbdotconf/security/clientsigning.xml
++++ b/docs-xml/smbdotconf/security/clientsigning.xml
+@@ -12,6 +12,9 @@
+     <para>When set to auto, SMB signing is offered, but not enforced. 
+     When set to mandatory, SMB signing is required and if set 
+ 	to disabled, SMB signing is not offered either.
++
++    <para>IPC$ connections for DCERPC e.g. in winbindd, are handled by the
++    <smbconfoption name="client ipc signing"/> option.</para>
+ </para>
+ </description>
+ 
+--- a/source3/include/proto.h
++++ b/source3/include/proto.h
+@@ -1690,9 +1690,11 @@ int lp_winbind_cache_time(void);
+ int lp_winbind_reconnect_delay(void);
+ int lp_winbind_max_clients(void);
+ const char **lp_winbind_nss_info(void);
++bool lp_winbind_sealed_pipes(void);
+ int lp_algorithmic_rid_base(void);
+ int lp_name_cache_timeout(void);
+ int lp_client_signing(void);
++int lp_client_ipc_signing(void);
+ int lp_server_signing(void);
+ int lp_client_ldap_sasl_wrapping(void);
+ char *lp_parm_talloc_string(int snum, const char *type, const char *option, const char *def);
+--- a/source3/param/loadparm.c
++++ b/source3/param/loadparm.c
+@@ -215,6 +215,7 @@ struct global {
+ 	int  winbind_expand_groups;
+ 	bool bWinbindRefreshTickets;
+ 	bool bWinbindOfflineLogon;
++	bool bWinbindSealedPipes;
+ 	bool bWinbindNormalizeNames;
+ 	bool bWinbindRpcOnly;
+ 	bool bCreateKrb5Conf;
+@@ -366,6 +367,7 @@ struct global {
+ 	int restrict_anonymous;
+ 	int name_cache_timeout;
+ 	int client_signing;
++	int client_ipc_signing;
+ 	int server_signing;
+ 	int client_ldap_sasl_wrapping;
+ 	int iUsershareMaxShares;
+@@ -2319,6 +2321,15 @@ static struct parm_struct parm_table[] =
+ 		.flags		= FLAG_ADVANCED,
+ 	},
+ 	{
++		.label		= "client ipc signing",
++		.type		= P_ENUM,
++		.p_class	= P_GLOBAL,
++		.ptr		= &Globals.client_ipc_signing,
++		.special	= NULL,
++		.enum_list	= enum_smb_signing_vals,
++		.flags		= FLAG_ADVANCED,
++	},
++	{
+ 		.label		= "server signing",
+ 		.type		= P_ENUM,
+ 		.p_class	= P_GLOBAL,
+@@ -4765,6 +4776,15 @@ static struct parm_struct parm_table[] =
+ 		.flags		= FLAG_ADVANCED,
+ 	},
+ 	{
++		.label		= "winbind sealed pipes",
++		.type		= P_BOOL,
++		.p_class	= P_GLOBAL,
++		.ptr		= &Globals.bWinbindSealedPipes,
++		.special	= NULL,
++		.enum_list	= NULL,
++		.flags		= FLAG_ADVANCED,
++	},
++	{
+ 		.label		= "winbind normalize names",
+ 		.type		= P_BOOL,
+ 		.p_class	= P_GLOBAL,
+@@ -5458,6 +5478,7 @@ static void init_globals(bool reinit_glo
+ 	Globals.szWinbindNssInfo = str_list_make_v3(NULL, "template", NULL);
+ 	Globals.bWinbindRefreshTickets = False;
+ 	Globals.bWinbindOfflineLogon = False;
++	Globals.bWinbindSealedPipes = True;
+ 
+ 	Globals.iIdmapCacheTime = 86400 * 7; /* a week by default */
+ 	Globals.iIdmapNegativeCacheTime = 120; /* 2 minutes by default */
+@@ -5470,6 +5491,7 @@ static void init_globals(bool reinit_glo
+ 	Globals.bClientUseSpnego = True;
+ 
+ 	Globals.client_signing = Auto;
++	Globals.client_ipc_signing = Required;
+ 	Globals.server_signing = False;
+ 
+ 	Globals.bDeferSharingViolations = True;
+@@ -5736,6 +5758,7 @@ FN_GLOBAL_BOOL(lp_winbind_nested_groups,
+ FN_GLOBAL_INTEGER(lp_winbind_expand_groups, &Globals.winbind_expand_groups)
+ FN_GLOBAL_BOOL(lp_winbind_refresh_tickets, &Globals.bWinbindRefreshTickets)
+ FN_GLOBAL_BOOL(lp_winbind_offline_logon, &Globals.bWinbindOfflineLogon)
++FN_GLOBAL_BOOL(lp_winbind_sealed_pipes, &Globals.bWinbindSealedPipes)
+ FN_GLOBAL_BOOL(lp_winbind_normalize_names, &Globals.bWinbindNormalizeNames)
+ FN_GLOBAL_BOOL(lp_winbind_rpc_only, &Globals.bWinbindRpcOnly)
+ FN_GLOBAL_BOOL(lp_create_krb5_conf, &Globals.bCreateKrb5Conf)
+@@ -6071,6 +6094,7 @@ FN_GLOBAL_LIST(lp_winbind_nss_info, &Glo
+ FN_GLOBAL_INTEGER(lp_algorithmic_rid_base, &Globals.AlgorithmicRidBase)
+ FN_GLOBAL_INTEGER(lp_name_cache_timeout, &Globals.name_cache_timeout)
+ FN_GLOBAL_INTEGER(lp_client_signing, &Globals.client_signing)
++FN_GLOBAL_INTEGER(lp_client_ipc_signing, &Globals.client_ipc_signing)
+ FN_GLOBAL_INTEGER(lp_server_signing, &Globals.server_signing)
+ FN_GLOBAL_INTEGER(lp_client_ldap_sasl_wrapping, &Globals.client_ldap_sasl_wrapping)
+ 
+@@ -9700,6 +9724,20 @@ static bool lp_load_ex(const char *pszFn
+ 		lp_do_parameter(GLOBAL_SECTION_SNUM, "wins server", "127.0.0.1");
+ 	}
+ 
++	if (!lp_is_in_client()) {
++		switch (lp_client_ipc_signing()) {
++		case Required:
++			lp_set_cmdline("client signing", "mandatory");
++			break;
++		case Auto:
++			lp_set_cmdline("client signing", "auto");
++			break;
++		case False:
++			lp_set_cmdline("client signing", "disabled");
++			break;
++		}
++	}
++
+ 	init_iconv();
+ 
+ 	bAllowIncludeRegistry = true;
+--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
+@@ -2480,7 +2480,7 @@ static bool spoolss_connect_to_client(st
+ 		"", /* username */
+ 		"", /* domain */
+ 		"", /* password */
+-		0, lp_client_signing());
++		0, False);
+ 
+ 	if ( !NT_STATUS_IS_OK( ret ) ) {
+ 		DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n",
+--- /dev/null
++++ b/docs-xml/smbdotconf/winbind/winbindsealedpipes.xml
+@@ -0,0 +1,15 @@
++<samba:parameter name="winbind sealed pipes"
++                 context="G"
++                 type="boolean"
++                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
++<description>
++	<para>This option controls whether any requests from winbindd to domain controllers
++		pipe will be sealed. Disabling sealing can be useful for debugging
++		purposes.</para>
++
++	<para>The behavior can be controlled per netbios domain
++	by using 'winbind sealed pipes:NETBIOSDOMAIN = no' as option.</para>
++</description>
++
++<value type="default">yes</value>
++</samba:parameter>
+--- a/source3/winbindd/winbindd_cm.c
++++ b/source3/winbindd/winbindd_cm.c
+@@ -2384,6 +2384,15 @@ NTSTATUS cm_connect_sam(struct winbindd_
+ 	TALLOC_FREE(conn->samr_pipe);
+ 
+  anonymous:
++	if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
++		status = NT_STATUS_DOWNGRADE_DETECTED;
++		DEBUG(1, ("Unwilling to make SAMR connection to domain %s "
++			  "without connection level security, "
++			  "must set 'winbind sealed pipes = false' "
++			  "to proceed: %s\n",
++			  domain->name, nt_errstr(status)));
++		goto done;
++	}
+ 
+ 	/* Finally fall back to anonymous. */
+ 	status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
+@@ -2610,6 +2619,16 @@ NTSTATUS cm_connect_lsa(struct winbindd_
+ 
+  anonymous:
+ 
++	if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
++		result = NT_STATUS_DOWNGRADE_DETECTED;
++		DEBUG(1, ("Unwilling to make LSA connection to domain %s "
++			  "without connection level security, "
++			  "must set 'winbind sealed pipes = false' "
++			  "to proceed: %s\n",
++			  domain->name, nt_errstr(result)));
++		goto done;
++	}
++
+ 	result = cli_rpc_pipe_open_noauth(conn->cli,
+ 					  &ndr_table_lsarpc.syntax_id,
+ 					  &conn->lsa_pipe);
+@@ -2749,7 +2768,18 @@ NTSTATUS cm_connect_netlogon(struct winb
+ 
+  no_schannel:
+ 	if ((lp_client_schannel() == False) ||
+-			((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
++		((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
++		if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
++			result = NT_STATUS_DOWNGRADE_DETECTED;
++			DEBUG(1, ("Unwilling to make connection to domain %s "
++				  "without connection level security, "
++				  "must set 'winbind sealed pipes = false' "
++				  "to proceed: %s\n",
++				  domain->name, nt_errstr(result)));
++			TALLOC_FREE(netlogon_pipe);
++			invalidate_cm_connection(conn);
++			return result;
++		}
+ 		/*
+ 		 * NetSamLogonEx only works for schannel
+ 		 */
diff --git a/package/network/services/samba36/patches/027-CVE-2016-2118-v3-6.patch b/package/network/services/samba36/patches/027-CVE-2016-2118-v3-6.patch
new file mode 100644
index 0000000..06c1b0b
--- /dev/null
+++ b/package/network/services/samba36/patches/027-CVE-2016-2118-v3-6.patch
@@ -0,0 +1,308 @@
+From d68424b5ef92f5810760f90e9eeb664572a61e4e Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <metze@samba.org>
+Date: Tue, 15 Dec 2015 14:49:36 +0100
+Subject: [PATCH 01/10] CVE-2016-2118: s3: rpcclient: change the default auth
+ level from DCERPC_AUTH_LEVEL_CONNECT to DCERPC_AUTH_LEVEL_INTEGRITY
+
+ncacn_ip_tcp:server should get the same protection as ncacn_np:server
+if authentication and smb signing is used.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=11616
+
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+
+(cherry picked from commit dab41dee8a4fb27dbf3913b0e44a4cc726e3ac98)
+---
+ source3/rpcclient/rpcclient.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/source3/rpcclient/rpcclient.c
++++ b/source3/rpcclient/rpcclient.c
+@@ -1062,10 +1062,9 @@ out_free:
+ 		}
+ 	}
+ 	if (pipe_default_auth_type != DCERPC_AUTH_TYPE_NONE) {
+-		/* If neither Integrity or Privacy are requested then
+-		 * Use just Connect level */
++		/* If nothing is requested then default to integrity */
+ 		if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
+-			pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
++			pipe_default_auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
+ 		}
+ 	}
+ 
+--- a/source4/librpc/rpc/dcerpc_util.c
++++ b/source4/librpc/rpc/dcerpc_util.c
+@@ -593,15 +593,15 @@ struct composite_context *dcerpc_pipe_au
+ 
+ 	/* Perform an authenticated DCE-RPC bind
+ 	 */
+-	if (!(conn->flags & (DCERPC_SIGN|DCERPC_SEAL))) {
++	if (!(conn->flags & (DCERPC_CONNECT|DCERPC_SEAL))) {
+ 		/*
+ 		  we are doing an authenticated connection,
+-		  but not using sign or seal. We must force
+-		  the CONNECT dcerpc auth type as a NONE auth
+-		  type doesn't allow authentication
+-		  information to be passed.
++		  which needs to use [connect], [sign] or [seal].
++		  If nothing is specified, we default to [sign] now.
++		  This give roughly the same protection as
++		  ncacn_np with smb signing.
+ 		*/
+-		conn->flags |= DCERPC_CONNECT;
++		conn->flags |= DCERPC_SIGN;
+ 	}
+ 
+ 	if (s->binding->flags & DCERPC_AUTH_SPNEGO) {
+--- /dev/null
++++ b/docs-xml/smbdotconf/security/allowdcerpcauthlevelconnect.xml
+@@ -0,0 +1,22 @@
++<samba:parameter name="allow dcerpc auth level connect"
++                 context="G"
++                 type="boolean"
++                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
++<description>
++	<para>This option controls whether DCERPC services are allowed to
++	be used with DCERPC_AUTH_LEVEL_CONNECT, which provides authentication,
++	but no per message integrity nor privacy protection.</para>
++
++	<para>The behavior can be controlled per interface name (e.g. lsarpc, netlogon, samr, srvsvc,
++	winreg, wkssvc ...) by using 'allow dcerpc auth level connect:interface = no' as option.</para>
++
++	<para>This option yields precedence to the implentation specific restrictions.
++	E.g. the drsuapi and backupkey protocols require DCERPC_AUTH_LEVEL_PRIVACY.
++	While others like samr and lsarpc have a hardcoded default of <constant>no</constant>.
++	</para>
++</description>
++
++<value type="default">no</value>
++<value type="example">yes</value>
++
++</samba:parameter>
+--- a/source3/include/proto.h
++++ b/source3/include/proto.h
+@@ -1821,6 +1821,7 @@ char* lp_perfcount_module(void);
+ void lp_set_passdb_backend(const char *backend);
+ void widelinks_warning(int snum);
+ char *lp_ncalrpc_dir(void);
++bool lp_allow_dcerpc_auth_level_connect(void);
+ 
+ /* The following definitions come from param/loadparm_server_role.c  */
+ 
+--- a/source3/param/loadparm.c
++++ b/source3/param/loadparm.c
+@@ -355,6 +355,7 @@ struct global {
+ 	bool bUseMmap;
+ 	bool bHostnameLookups;
+ 	bool bUnixExtensions;
++	bool bAllowDcerpcAuthLevelConnect;
+ 	bool bDisableNetbios;
+ 	char * szDedicatedKeytabFile;
+ 	int  iKerberosMethod;
+@@ -2303,6 +2304,15 @@ static struct parm_struct parm_table[] =
+ 		.flags		= FLAG_ADVANCED,
+ 	},
+ 	{
++		.label		= "allow dcerpc auth level connect",
++		.type		= P_BOOL,
++		.p_class	= P_GLOBAL,
++		.ptr		= &Globals.bAllowDcerpcAuthLevelConnect,
++		.special	= NULL,
++		.enum_list	= NULL,
++		.flags		= FLAG_ADVANCED,
++	},
++	{
+ 		.label		= "use spnego",
+ 		.type		= P_BOOL,
+ 		.p_class	= P_GLOBAL,
+@@ -5371,6 +5381,8 @@ static void init_globals(bool reinit_glo
+ 	Globals.bClientNTLMv2Auth = True; /* Client should always use use NTLMv2, as we can't tell that the server supports it, but most modern servers do */
+ 	/* Note, that we will also use NTLM2 session security (which is different), if it is available */
+ 
++	Globals.bAllowDcerpcAuthLevelConnect = false; /* we don't allow this by default */
++
+ 	Globals.map_to_guest = 0;	/* By Default, "Never" */
+ 	Globals.oplock_break_wait_time = 0;	/* By Default, 0 msecs. */
+ 	Globals.enhanced_browsing = true;
+@@ -5745,6 +5757,7 @@ FN_GLOBAL_INTEGER(lp_username_map_cache_
+ 
+ FN_GLOBAL_STRING(lp_check_password_script, &Globals.szCheckPasswordScript)
+ 
++FN_GLOBAL_BOOL(lp_allow_dcerpc_auth_level_connect, &Globals.bAllowDcerpcAuthLevelConnect)
+ FN_GLOBAL_STRING(lp_wins_hook, &Globals.szWINSHook)
+ FN_GLOBAL_CONST_STRING(lp_template_homedir, &Globals.szTemplateHomedir)
+ FN_GLOBAL_CONST_STRING(lp_template_shell, &Globals.szTemplateShell)
+--- a/source3/include/ntdomain.h
++++ b/source3/include/ntdomain.h
+@@ -89,6 +89,10 @@ typedef struct pipe_rpc_fns {
+ 	uint32 context_id;
+ 	struct ndr_syntax_id syntax;
+ 
++	/*
++	 * shall we allow "connect" auth level for this interface ?
++	 */
++	bool allow_connect;
+ } PIPE_RPC_FNS;
+ 
+ /*
+--- a/source3/rpc_server/srv_pipe.c
++++ b/source3/rpc_server/srv_pipe.c
+@@ -44,6 +44,11 @@
+ #include "rpc_server/srv_pipe.h"
+ #include "../librpc/gen_ndr/ndr_dcerpc.h"
+ #include "../librpc/ndr/ndr_dcerpc.h"
++#include "../librpc/gen_ndr/ndr_samr.h"
++#include "../librpc/gen_ndr/ndr_lsa.h"
++#include "../librpc/gen_ndr/ndr_netlogon.h"
++#include "../librpc/gen_ndr/ndr_epmapper.h"
++#include "../librpc/gen_ndr/ndr_echo.h"
+ 
+ #undef DBGC_CLASS
+ #define DBGC_CLASS DBGC_RPC_SRV
+@@ -340,6 +345,8 @@ static bool check_bind_req(struct pipes_
+ 			   uint32 context_id)
+ {
+ 	struct pipe_rpc_fns *context_fns;
++	const char *interface_name = NULL;
++	bool ok;
+ 
+ 	DEBUG(3,("check_bind_req for %s\n",
+ 		 get_pipe_name_from_syntax(talloc_tos(), abstract)));
+@@ -390,12 +397,57 @@ static bool check_bind_req(struct pipes_
+ 		return False;
+ 	}
+ 
++	interface_name = get_pipe_name_from_syntax(talloc_tos(),
++						   abstract);
++
++	SMB_ASSERT(interface_name != NULL);
++
+ 	context_fns->next = context_fns->prev = NULL;
+ 	context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
+ 	context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
+ 	context_fns->context_id = context_id;
+ 	context_fns->syntax = *abstract;
+ 
++	context_fns->allow_connect = lp_allow_dcerpc_auth_level_connect();
++	/*
++	 * for the samr and the lsarpc interfaces we don't allow "connect"
++	 * auth_level by default.
++	 */
++	ok = ndr_syntax_id_equal(abstract, &ndr_table_samr.syntax_id);
++	if (ok) {
++		context_fns->allow_connect = false;
++	}
++	ok = ndr_syntax_id_equal(abstract, &ndr_table_lsarpc.syntax_id);
++	if (ok) {
++		context_fns->allow_connect = false;
++	}
++	ok = ndr_syntax_id_equal(abstract, &ndr_table_netlogon.syntax_id);
++	if (ok) {
++		context_fns->allow_connect = false;
++	}
++	/*
++	 * for the epmapper and echo interfaces we allow "connect"
++	 * auth_level by default.
++	 */
++	ok = ndr_syntax_id_equal(abstract, &ndr_table_epmapper.syntax_id);
++	if (ok) {
++		context_fns->allow_connect = true;
++	}
++	ok = ndr_syntax_id_equal(abstract, &ndr_table_rpcecho.syntax_id);
++	if (ok) {
++		context_fns->allow_connect = true;
++	}
++	/*
++	 * every interface can be modified to allow "connect" auth_level by
++	 * using a parametric option like:
++	 * allow dcerpc auth level connect:<interface>
++	 * e.g.
++	 * allow dcerpc auth level connect:samr = yes
++	 */
++	context_fns->allow_connect = lp_parm_bool(-1,
++		"allow dcerpc auth level connect",
++		interface_name, context_fns->allow_connect);
++
+ 	/* add to the list of open contexts */
+ 
+ 	DLIST_ADD( p->contexts, context_fns );
+@@ -1736,6 +1788,7 @@ static bool api_pipe_request(struct pipe
+ 	TALLOC_CTX *frame = talloc_stackframe();
+ 	bool ret = False;
+ 	PIPE_RPC_FNS *pipe_fns;
++	const char *interface_name = NULL;
+ 
+ 	if (!p->pipe_bound) {
+ 		DEBUG(1, ("Pipe not bound!\n"));
+@@ -1757,8 +1810,36 @@ static bool api_pipe_request(struct pipe
+ 		return false;
+ 	}
+ 
++	interface_name = get_pipe_name_from_syntax(talloc_tos(),
++						   &pipe_fns->syntax);
++
++	SMB_ASSERT(interface_name != NULL);
++
+ 	DEBUG(5, ("Requested \\PIPE\\%s\n",
+-		  get_pipe_name_from_syntax(talloc_tos(), &pipe_fns->syntax)));
++		  interface_name));
++
++	switch (p->auth.auth_level) {
++	case DCERPC_AUTH_LEVEL_NONE:
++	case DCERPC_AUTH_LEVEL_INTEGRITY:
++	case DCERPC_AUTH_LEVEL_PRIVACY:
++		break;
++	default:
++		if (!pipe_fns->allow_connect) {
++			DEBUG(1, ("%s: restrict auth_level_connect access "
++				  "to [%s] with auth[type=0x%x,level=0x%x] "
++				  "on [%s] from [%s]\n",
++				  __func__, interface_name,
++				  p->auth.auth_type,
++				  p->auth.auth_level,
++				  derpc_transport_string_by_transport(p->transport),
++				  p->client_id->name));
++
++			setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
++			TALLOC_FREE(frame);
++			return true;
++		}
++		break;
++	}
+ 
+ 	if (!srv_pipe_check_verification_trailer(p, pkt, pipe_fns)) {
+ 		DEBUG(1, ("srv_pipe_check_verification_trailer: failed\n"));
+--- a/source3/selftest/knownfail
++++ b/source3/selftest/knownfail
+@@ -18,3 +18,5 @@ samba3.posix_s3.nbt.dgram.*netlogon2
+ samba3.*rap.sam.*.useradd # Not provided by Samba 3
+ samba3.*rap.sam.*.userdelete # Not provided by Samba 3
+ samba3.*rap.basic.*.netsessiongetinfo # Not provided by Samba 3
++samba3.blackbox.rpcclient.over.ncacn_np.with.*connect.* # we don't allow auth_level_connect anymore
++samba3.posix_s3.rpc.lsa.lookupsids.*ncacn_ip_tcp.*connect.* # we don't allow auth_level_connect anymore
+--- a/source3/selftest/tests.py
++++ b/source3/selftest/tests.py
+@@ -201,6 +201,8 @@ if sub.returncode == 0:
+             plansmbtorturetestsuite(t, "s3dc", '//$SERVER_IP/tmpguest -U$USERNAME%$PASSWORD')
+         elif t == "raw.samba3posixtimedlock":
+             plansmbtorturetestsuite(t, "s3dc", '//$SERVER_IP/tmpguest -U$USERNAME%$PASSWORD --option=torture:localdir=$SELFTEST_PREFIX/dc/share')
++        elif t == "rpc.samr.passwords.validate":
++            plansmbtorturetestsuite(t, "s3dc", 'ncacn_np:$SERVER_IP[seal] -U$USERNAME%$PASSWORD', 'over ncacn_np ')
+         else:
+             plansmbtorturetestsuite(t, "s3dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
+ 
+--- a/source3/rpc_server/samr/srv_samr_nt.c
++++ b/source3/rpc_server/samr/srv_samr_nt.c
+@@ -6628,6 +6628,11 @@ NTSTATUS _samr_ValidatePassword(struct p
+ 	struct samr_GetDomPwInfo pw;
+ 	struct samr_PwInfo dom_pw_info;
+ 
++	if (p->auth.auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
++		p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
++		return NT_STATUS_ACCESS_DENIED;
++	}
++
+ 	if (r->in.level < 1 || r->in.level > 3) {
+ 		return NT_STATUS_INVALID_INFO_CLASS;
+ 	}
diff --git a/package/network/services/samba36/patches/110-multicall.patch b/package/network/services/samba36/patches/110-multicall.patch
index 22e6a3c..98a03b6 100644
--- a/package/network/services/samba36/patches/110-multicall.patch
+++ b/package/network/services/samba36/patches/110-multicall.patch
@@ -36,7 +36,7 @@
  
  BIN_PROGS1 = bin/smbclient@EXEEXT@ bin/net@EXEEXT@ bin/smbspool@EXEEXT@ \
  	bin/testparm@EXEEXT@ bin/smbstatus@EXEEXT@ bin/smbget@EXEEXT@ \
-@@ -1777,6 +1777,42 @@ bin/.dummy:
+@@ -1799,6 +1799,42 @@ bin/.dummy:
  	  dir=bin $(MAKEDIR); fi
  	@: >> $@ || : > $@ # what a fancy emoticon!
  
diff --git a/package/network/services/samba36/patches/111-owrt_smbpasswd.patch b/package/network/services/samba36/patches/111-owrt_smbpasswd.patch
index 79abea5..25fde6d 100644
--- a/package/network/services/samba36/patches/111-owrt_smbpasswd.patch
+++ b/package/network/services/samba36/patches/111-owrt_smbpasswd.patch
@@ -1,6 +1,6 @@
 --- a/source3/Makefile.in
 +++ b/source3/Makefile.in
-@@ -1019,7 +1019,7 @@ TEST_LP_LOAD_OBJ = param/test_lp_load.o
+@@ -1025,7 +1025,7 @@ TEST_LP_LOAD_OBJ = param/test_lp_load.o
  
  PASSWD_UTIL_OBJ = utils/passwd_util.o
  
@@ -9,7 +9,7 @@
  		$(PARAM_OBJ) $(LIBSMB_OBJ) $(PASSDB_OBJ) \
  		$(GROUPDB_OBJ) $(LIB_NONSMBD_OBJ) $(KRBCLIENT_OBJ) \
  		$(POPT_LIB_OBJ) $(SMBLDAP_OBJ) \
-@@ -1791,7 +1791,7 @@ nmbd/nmbd_multicall.o: nmbd/nmbd.c nmbd/
+@@ -1813,7 +1813,7 @@ nmbd/nmbd_multicall.o: nmbd/nmbd.c nmbd/
  		echo "$(COMPILE_CC_PATH)" 1>&2;\
  		$(COMPILE_CC_PATH) >/dev/null 2>&1
  
@@ -18,7 +18,7 @@
  	@echo Compiling $<.c
  	@$(COMPILE_CC_PATH) -Dmain=smbpasswd_main && exit 0;\
  		echo "The following command failed:" 1>&2;\
-@@ -1800,7 +1800,7 @@ utils/smbpasswd_multicall.o: utils/smbpa
+@@ -1822,7 +1822,7 @@ utils/smbpasswd_multicall.o: utils/smbpa
  
  SMBD_MULTI_O = $(patsubst smbd/server.o,smbd/server_multicall.o,$(SMBD_OBJ))
  NMBD_MULTI_O = $(patsubst nmbd/nmbd.o,nmbd/nmbd_multicall.o,$(filter-out $(LIB_DUMMY_OBJ),$(NMBD_OBJ)))
diff --git a/package/network/services/samba36/patches/120-add_missing_ifdef.patch b/package/network/services/samba36/patches/120-add_missing_ifdef.patch
index dbd9adc..3c0ef8a 100644
--- a/package/network/services/samba36/patches/120-add_missing_ifdef.patch
+++ b/package/network/services/samba36/patches/120-add_missing_ifdef.patch
@@ -24,3 +24,18 @@
  	epmapper_commands,
  	shutdown_commands,
   	test_commands,
+--- a/source3/rpc_server/srv_pipe.c
++++ b/source3/rpc_server/srv_pipe.c
+@@ -433,10 +433,12 @@ static bool check_bind_req(struct pipes_
+ 	if (ok) {
+ 		context_fns->allow_connect = true;
+ 	}
++#ifdef DEVELOPER
+ 	ok = ndr_syntax_id_equal(abstract, &ndr_table_rpcecho.syntax_id);
+ 	if (ok) {
+ 		context_fns->allow_connect = true;
+ 	}
++#endif
+ 	/*
+ 	 * every interface can be modified to allow "connect" auth_level by
+ 	 * using a parametric option like:
diff --git a/package/network/services/samba36/patches/210-remove_ad_support.patch b/package/network/services/samba36/patches/210-remove_ad_support.patch
index 6742dc0..a205186 100644
--- a/package/network/services/samba36/patches/210-remove_ad_support.patch
+++ b/package/network/services/samba36/patches/210-remove_ad_support.patch
@@ -71,7 +71,7 @@
  #endif
 --- a/source3/rpc_client/cli_pipe.c
 +++ b/source3/rpc_client/cli_pipe.c
-@@ -2904,12 +2904,14 @@ NTSTATUS cli_rpc_pipe_open_noauth_transp
+@@ -3391,12 +3391,14 @@ NTSTATUS cli_rpc_pipe_open_noauth_transp
  	status = rpc_pipe_bind(result, auth);
  	if (!NT_STATUS_IS_OK(status)) {
  		int lvl = 0;
diff --git a/package/network/services/samba36/patches/250-remove_domain_logon.patch b/package/network/services/samba36/patches/250-remove_domain_logon.patch
index f7582ef..9b434c5 100644
--- a/package/network/services/samba36/patches/250-remove_domain_logon.patch
+++ b/package/network/services/samba36/patches/250-remove_domain_logon.patch
@@ -183,3 +183,31 @@
  
          /*
  	 * Force a log file check.
+--- a/source3/rpc_server/srv_pipe.c
++++ b/source3/rpc_server/srv_pipe.c
+@@ -421,10 +421,12 @@ static bool check_bind_req(struct pipes_
+ 	if (ok) {
+ 		context_fns->allow_connect = false;
+ 	}
++#ifdef NETLOGON_SUPPORT
+ 	ok = ndr_syntax_id_equal(abstract, &ndr_table_netlogon.syntax_id);
+ 	if (ok) {
+ 		context_fns->allow_connect = false;
+ 	}
++#endif
+ 	/*
+ 	 * for the epmapper and echo interfaces we allow "connect"
+ 	 * auth_level by default.
+--- a/source3/rpc_client/cli_pipe.c
++++ b/source3/rpc_client/cli_pipe.c
+@@ -2221,6 +2221,10 @@ static void rpc_pipe_bind_step_two_trigg
+ 				      struct schannel_state);
+ 	struct tevent_req *subreq;
+ 
++#ifndef NETLOGON_SUPPORT
++	tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
++	return;
++#endif
+ 	if (schannel_auth == NULL ||
+ 	    !ndr_syntax_id_equal(&state->cli->abstract_syntax,
+ 				 &ndr_table_netlogon.syntax_id)) {
diff --git a/package/network/services/samba36/patches/260-remove_samr.patch b/package/network/services/samba36/patches/260-remove_samr.patch
index 7e55573..aeca3ed 100644
--- a/package/network/services/samba36/patches/260-remove_samr.patch
+++ b/package/network/services/samba36/patches/260-remove_samr.patch
@@ -142,3 +142,21 @@
  	if (!str1 || !str2 || !UserName || !p) {
  		return False;
  	}
+--- a/source3/rpc_server/srv_pipe.c
++++ b/source3/rpc_server/srv_pipe.c
+@@ -409,6 +409,7 @@ static bool check_bind_req(struct pipes_
+ 	context_fns->syntax = *abstract;
+ 
+ 	context_fns->allow_connect = lp_allow_dcerpc_auth_level_connect();
++#ifdef SAMR_SUPPORT
+ 	/*
+ 	 * for the samr and the lsarpc interfaces we don't allow "connect"
+ 	 * auth_level by default.
+@@ -417,6 +418,7 @@ static bool check_bind_req(struct pipes_
+ 	if (ok) {
+ 		context_fns->allow_connect = false;
+ 	}
++#endif
+ 	ok = ndr_syntax_id_equal(abstract, &ndr_table_lsarpc.syntax_id);
+ 	if (ok) {
+ 		context_fns->allow_connect = false;
diff --git a/package/network/services/samba36/patches/290-remove_lsa.patch b/package/network/services/samba36/patches/290-remove_lsa.patch
index fe37d5d..6dc3575 100644
--- a/package/network/services/samba36/patches/290-remove_lsa.patch
+++ b/package/network/services/samba36/patches/290-remove_lsa.patch
@@ -71,3 +71,18 @@
  }
  
  size_t num_pipe_handles(struct pipes_struct *p)
+--- a/source3/rpc_server/srv_pipe.c
++++ b/source3/rpc_server/srv_pipe.c
+@@ -419,10 +419,12 @@ static bool check_bind_req(struct pipes_
+ 		context_fns->allow_connect = false;
+ 	}
+ #endif
++#ifdef LSA_SUPPORT
+ 	ok = ndr_syntax_id_equal(abstract, &ndr_table_lsarpc.syntax_id);
+ 	if (ok) {
+ 		context_fns->allow_connect = false;
+ 	}
++#endif
+ #ifdef NETLOGON_SUPPORT
+ 	ok = ndr_syntax_id_equal(abstract, &ndr_table_netlogon.syntax_id);
+ 	if (ok) {
diff --git a/package/network/services/samba36/patches/310-remove_error_strings.patch b/package/network/services/samba36/patches/310-remove_error_strings.patch
index 8c7ae2d..ee3460d 100644
--- a/package/network/services/samba36/patches/310-remove_error_strings.patch
+++ b/package/network/services/samba36/patches/310-remove_error_strings.patch
@@ -65,7 +65,7 @@
  }
 --- a/librpc/ndr/libndr.h
 +++ b/librpc/ndr/libndr.h
-@@ -604,4 +604,20 @@ _PUBLIC_ enum ndr_err_code ndr_push_enum
+@@ -663,4 +663,20 @@ _PUBLIC_ enum ndr_err_code ndr_push_enum
  
  _PUBLIC_ void ndr_print_bool(struct ndr_print *ndr, const char *name, const bool b);
  
@@ -251,3 +251,87 @@
  	print "	       return;";
  	print "       }";
  	print "";
+--- a/source3/rpc_client/cli_pipe.c
++++ b/source3/rpc_client/cli_pipe.c
+@@ -445,7 +445,6 @@ static NTSTATUS cli_pipe_validate_curren
+ 				  rpccli_pipe_txt(talloc_tos(), cli),
+ 				  pkt->ptype, expected_pkt_type,
+ 				  nt_errstr(ret)));
+-			NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 			return ret;
+ 		}
+ 
+@@ -466,7 +465,6 @@ static NTSTATUS cli_pipe_validate_curren
+ 				  rpccli_pipe_txt(talloc_tos(), cli),
+ 				  pkt->ptype, expected_pkt_type,
+ 				  nt_errstr(ret)));
+-			NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 			return ret;
+ 		}
+ 
+@@ -486,7 +484,6 @@ static NTSTATUS cli_pipe_validate_curren
+ 				  rpccli_pipe_txt(talloc_tos(), cli),
+ 				  pkt->ptype, expected_pkt_type,
+ 				  nt_errstr(ret)));
+-			NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 			return ret;
+ 		}
+ 
+@@ -508,7 +505,6 @@ static NTSTATUS cli_pipe_validate_curren
+ 				  rpccli_pipe_txt(talloc_tos(), cli),
+ 				  pkt->ptype, expected_pkt_type,
+ 				  nt_errstr(ret)));
+-			NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 			return ret;
+ 		}
+ 
+@@ -526,7 +522,6 @@ static NTSTATUS cli_pipe_validate_curren
+ 				  rpccli_pipe_txt(talloc_tos(), cli),
+ 				  pkt->ptype, expected_pkt_type,
+ 				  nt_errstr(ret)));
+-			NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 			return ret;
+ 		}
+ 
+@@ -570,7 +565,6 @@ static NTSTATUS cli_pipe_validate_curren
+ 				  rpccli_pipe_txt(talloc_tos(), cli),
+ 				  pkt->ptype, expected_pkt_type,
+ 				  nt_errstr(ret)));
+-			NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 			return ret;
+ 		}
+ 
+--- a/source3/rpc_server/srv_pipe.c
++++ b/source3/rpc_server/srv_pipe.c
+@@ -991,7 +991,6 @@ static bool api_pipe_bind_req(struct pip
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		DEBUG(1, ("api_pipe_bind_req: invalid pdu: %s\n",
+ 			  nt_errstr(status)));
+-		NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 		goto err_exit;
+ 	}
+ 
+@@ -1325,7 +1324,6 @@ bool api_pipe_bind_auth3(struct pipes_st
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		DEBUG(1, ("api_pipe_bind_auth3: invalid pdu: %s\n",
+ 			  nt_errstr(status)));
+-		NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 		goto err;
+ 	}
+ 
+@@ -1483,7 +1481,6 @@ static bool api_pipe_alter_context(struc
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		DEBUG(1, ("api_pipe_alter_context: invalid pdu: %s\n",
+ 			  nt_errstr(status)));
+-		NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 		goto err_exit;
+ 	}
+ 
+@@ -2057,7 +2054,6 @@ static bool process_request_pdu(struct p
+ 	if (!NT_STATUS_IS_OK(status)) {
+ 		DEBUG(1, ("process_request_pdu: invalid pdu: %s\n",
+ 			  nt_errstr(status)));
+-		NDR_PRINT_DEBUG(ncacn_packet, pkt);
+ 		set_incoming_fault(p);
+ 		return false;
+ 	}
diff --git a/package/network/services/samba36/patches/330-librpc_default_print.patch b/package/network/services/samba36/patches/330-librpc_default_print.patch
index f9c2e0e..aa4bfe3 100644
--- a/package/network/services/samba36/patches/330-librpc_default_print.patch
+++ b/package/network/services/samba36/patches/330-librpc_default_print.patch
@@ -8844,7 +8844,7 @@
 +done
 --- a/librpc/ndr/libndr.h
 +++ b/librpc/ndr/libndr.h
-@@ -603,6 +603,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_enum
+@@ -662,6 +662,7 @@ _PUBLIC_ enum ndr_err_code ndr_push_enum
  _PUBLIC_ enum ndr_err_code ndr_push_enum_uint1632(struct ndr_push *ndr, int ndr_flags, uint16_t v);
  
  _PUBLIC_ void ndr_print_bool(struct ndr_print *ndr, const char *name, const bool b);