Changeset 77 for trunk/samba/source/smbd/nttrans.c

Timestamp:

Sep 30, 2007, 3:42:50 AM (18 years ago)

Author:

Paul Smedley

Message:

Update trunk to 3.2.0pre1

File:

• trunk/samba/source/smbd/nttrans.c (modified) (173 diffs)

trunk/samba/source/smbd/nttrans.c

@@ -2 +2 @@
    Unix SMB/CIFS implementation.
    SMB NT transaction handling
-   Copyright (C) Jeremy Allison                 1994-1998
+   Copyright (C) Jeremy Allison                 1994-2007
    Copyright (C) Stefan (metze) Metzmacher      2003
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
 
@@ -16 +16 @@
 
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
@@ -51 +50 @@
 {
         if (ptr==NULL) {
-                smb_panic("nttrans_realloc() called with NULL ptr\n");
-        }
-                
+                smb_panic("nttrans_realloc() called with NULL ptr");
+        }
+
         *ptr = (char *)SMB_REALLOC(*ptr, size);
         if(*ptr == NULL) {
@@ -69 +68 @@
 ****************************************************************************/
 
-int send_nt_replies(char *outbuf, int bufsize, NTSTATUS nt_error,
-                    char *params, int paramsize, char *pdata, int datasize)
+void send_nt_replies(struct smb_request *req, NTSTATUS nt_error,
+                     char *params, int paramsize,
+                     char *pdata, int datasize)
 {
         int data_to_send = datasize;
@@ -82 +82 @@
 
         /*
-         * Initially set the wcnt area to be 18 - this is true for all
-         * transNT replies.
-         */
-
-        set_message(outbuf,18,0,True);
-
-        if (NT_STATUS_V(nt_error)) {
-                ERROR_NT(nt_error);
-        }
-
-        /* 
          * If there genuinely are no parameters or data to send just send
          * the empty packet.
@@ -98 +87 @@
 
         if(params_to_send == 0 && data_to_send == 0) {
-                show_msg(outbuf);
-                if (!send_smb(smbd_server_fd(),outbuf)) {
-                        exit_server_cleanly("send_nt_replies: send_smb failed.");
-                }
-                return 0;
+                reply_outbuf(req, 18, 0);
+                show_msg((char *)req->outbuf);
+                return;
         }
 
@@ -115 +102 @@
         }
 
-        /* 
+        /*
          * Space is bufsize minus Netbios over TCP header minus SMB header.
          * The alignment_offset is to align the param bytes on a four byte
-         * boundary (2 bytes for data len, one byte pad). 
+         * boundary (2 bytes for data len, one byte pad).
          * NT needs this to work correctly.
          */
 
-        useable_space = bufsize - ((smb_buf(outbuf)+
-                                alignment_offset+data_alignment_offset) -
-                                outbuf);
+        useable_space = max_send - (smb_size
+                                    + 2 * 18 /* wct */
+                                    + alignment_offset
+                                    + data_alignment_offset);
 
         /*
@@ -144 +132 @@
                                         alignment_offset + data_alignment_offset;
 
-                /* 
+                /*
                  * We can never send more than useable_space.
                  */
@@ -150 +138 @@
                 total_sent_thistime = MIN(total_sent_thistime, useable_space);
 
-                set_message(outbuf, 18, total_sent_thistime, True);
+                reply_outbuf(req, 18, total_sent_thistime);
 
                 /*
@@ -156 +144 @@
                  */
 
-                SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
-                SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
-
-                /* 
+                SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
+                SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
+
+                /*
                  * Calculate how many parameters and data we can fit into
                  * this packet. Parameters get precedence.
@@ -168 +156 @@
                 data_sent_thistime = MIN(data_sent_thistime,data_to_send);
 
-                SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
+                SIVAL(req->outbuf, smb_ntr_ParameterCount,
+                      params_sent_thistime);
 
                 if(params_sent_thistime == 0) {
-                        SIVAL(outbuf,smb_ntr_ParameterOffset,0);
-                        SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
+                        SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
+                        SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
                 } else {
                         /*
@@ -181 +170 @@
                          */
 
-                        SIVAL(outbuf,smb_ntr_ParameterOffset,
-                                ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
-                        /* 
+                        SIVAL(req->outbuf,smb_ntr_ParameterOffset,
+                              ((smb_buf(req->outbuf)+alignment_offset)
+                               - smb_base(req->outbuf)));
+                        /*
                          * Absolute displacement of param bytes sent in this packet.
                          */
 
-                        SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
+                        SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
+                              pp - params);
                 }
 
@@ -194 +185 @@
                  */
 
-                SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
+                SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
 
                 if(data_sent_thistime == 0) {
-                        SIVAL(outbuf,smb_ntr_DataOffset,0);
-                        SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
+                        SIVAL(req->outbuf,smb_ntr_DataOffset,0);
+                        SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
                 } else {
                         /*
@@ -205 +196 @@
                          */
 
-                        SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
-                                smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
-                                SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
-                }
-
-                /* 
+                        SIVAL(req->outbuf, smb_ntr_DataOffset,
+                              ((smb_buf(req->outbuf)+alignment_offset) -
+                               smb_base(req->outbuf))
+                              + params_sent_thistime + data_alignment_offset);
+                        SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
+                }
+
+                /*
                  * Copy the param bytes into the packet.
                  */
 
                 if(params_sent_thistime) {
-                        memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
+                        if (alignment_offset != 0) {
+                                memset(smb_buf(req->outbuf), 0,
+                                       alignment_offset);
+                        }
+                        memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
+                               params_sent_thistime);
                 }
 
@@ -223 +221 @@
 
                 if(data_sent_thistime) {
-                        memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
-                                data_alignment_offset,pd,data_sent_thistime);
-                }
-    
+                        if (data_alignment_offset != 0) {
+                                memset((smb_buf(req->outbuf)+alignment_offset+
+                                        params_sent_thistime), 0,
+                                       data_alignment_offset);
+                        }
+                        memcpy(smb_buf(req->outbuf)+alignment_offset
+                               +params_sent_thistime+data_alignment_offset,
+                               pd,data_sent_thistime);
+                }
+
                 DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
                         params_sent_thistime, data_sent_thistime, useable_space));
                 DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
                         params_to_send, data_to_send, paramsize, datasize));
-    
+
+                if (NT_STATUS_V(nt_error)) {
+                        error_packet_set((char *)req->outbuf,
+                                         0, 0, nt_error,
+                                         __LINE__,__FILE__);
+                }
+
                 /* Send the packet */
-                show_msg(outbuf);
-                if (!send_smb(smbd_server_fd(),outbuf)) {
+                show_msg((char *)req->outbuf);
+                if (!send_smb(smbd_server_fd(),(char *)req->outbuf)) {
                         exit_server_cleanly("send_nt_replies: send_smb failed.");
                 }
-    
+
+                TALLOC_FREE(req->outbuf);
+
                 pp += params_sent_thistime;
                 pd += data_sent_thistime;
-    
+
                 params_to_send -= params_sent_thistime;
                 data_to_send -= data_sent_thistime;
@@ -251 +263 @@
                         DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
                                 params_to_send, data_to_send));
-                        return -1;
-                }
-        } 
-
-        return 0;
+                        return;
+                }
+        }
 }
 
@@ -270 +280 @@
 }
 
+struct case_semantics_state {
+        connection_struct *conn;
+        BOOL case_sensitive;
+        BOOL case_preserve;
+        BOOL short_case_preserve;
+};
+
 /****************************************************************************
- Save case statics.
+ Restore case semantics.
 ****************************************************************************/
-
-static BOOL saved_case_sensitive;
-static BOOL saved_case_preserve;
-static BOOL saved_short_case_preserve;
+static int restore_case_semantics(struct case_semantics_state *state)
+{
+        state->conn->case_sensitive = state->case_sensitive;
+        state->conn->case_preserve = state->case_preserve;
+        state->conn->short_case_preserve = state->short_case_preserve;
+        return 0;
+}
 
 /****************************************************************************
  Save case semantics.
 ****************************************************************************/
-
-static uint32 set_posix_case_semantics(connection_struct *conn, uint32 file_attributes)
+static struct case_semantics_state *set_posix_case_semantics(TALLOC_CTX *mem_ctx,
+                                                             connection_struct *conn)
 {
-        if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
-                return file_attributes;
-        }
-
-        saved_case_sensitive = conn->case_sensitive;
-        saved_case_preserve = conn->case_preserve;
-        saved_short_case_preserve = conn->short_case_preserve;
+        struct case_semantics_state *result;
+
+        if (!(result = talloc(mem_ctx, struct case_semantics_state))) {
+                DEBUG(0, ("talloc failed\n"));
+                return NULL;
+        }
+
+        result->conn = conn;
+        result->case_sensitive = conn->case_sensitive;
+        result->case_preserve = conn->case_preserve;
+        result->short_case_preserve = conn->short_case_preserve;
 
         /* Set to POSIX. */
@@ -297 +321 @@
         conn->short_case_preserve = True;
 
-        return (file_attributes & ~FILE_FLAG_POSIX_SEMANTICS);
+        talloc_set_destructor(result, restore_case_semantics);
+
+        return result;
 }
 
 /****************************************************************************
- Restore case semantics.
+ Reply to an NT create and X call on a pipe
 ****************************************************************************/
 
-static void restore_case_semantics(connection_struct *conn, uint32 file_attributes)
-{
-        if(!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
-                return;
-        }
-
-        conn->case_sensitive = saved_case_sensitive;
-        conn->case_preserve = saved_case_preserve;
-        conn->short_case_preserve = saved_short_case_preserve;
-}
-
-/****************************************************************************
- Reply to an NT create and X call on a pipe.
-****************************************************************************/
-
-static int nt_open_pipe(char *fname, connection_struct *conn,
-                        char *inbuf, char *outbuf, int *ppnum)
+static void nt_open_pipe(char *fname, connection_struct *conn,
+                         struct smb_request *req, int *ppnum)
 {
         smb_np_struct *p = NULL;
-        uint16 vuid = SVAL(inbuf, smb_uid);
         int i;
- 
+
         DEBUG(4,("nt_open_pipe: Opening pipe %s.\n", fname));
-    
+
         /* See if it is one we want to handle. */
 
         if (lp_disable_spoolss() && strequal(fname, "\\spoolss")) {
-                return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
+                reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
+                                ERRDOS, ERRbadpipe);
+                return;
         }
 
@@ -339 +351 @@
                 }
         }
-    
+
         if ( known_nt_pipes[i] == NULL ) {
-                return(ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpipe));
-        }
-    
+                reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
+                                ERRDOS, ERRbadpipe);
+                return;
+        }
+
         /* Strip \\ off the name. */
         fname++;
-    
+
         DEBUG(3,("nt_open_pipe: Known pipe %s opening.\n", fname));
 
-        p = open_rpc_pipe_p(fname, conn, vuid);
+        p = open_rpc_pipe_p(fname, conn, req->vuid);
         if (!p) {
-                return(ERROR_DOS(ERRSRV,ERRnofids));
-        }
-
-        /* Add pipe to db */
-        
+                reply_doserror(req, ERRSRV, ERRnofids);
+                return;
+        }
+
+        /* TODO: Add pipe to db */
+
         if ( !store_pipe_opendb( p ) ) {
                 DEBUG(3,("nt_open_pipe: failed to store %s pipe open.\n", fname));
         }
-        
+
         *ppnum = p->pnum;
-        return 0;
+        return;
 }
 
@@ -368 +383 @@
 ****************************************************************************/
 
-static int do_ntcreate_pipe_open(connection_struct *conn,
-                         char *inbuf,char *outbuf,int length,int bufsize)
+static void do_ntcreate_pipe_open(connection_struct *conn,
+                                  struct smb_request *req)
 {
-        pstring fname;
-        int ret;
+        char *fname = NULL;
         int pnum = -1;
         char *p = NULL;
-        uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
-
-        srvstr_pull_buf(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE);
-
-        if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
-                return ret;
+        uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
+        TALLOC_CTX *ctx = talloc_tos();
+
+        srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
+                        smb_buf(req->inbuf), STR_TERMINATE);
+
+        if (!fname) {
+                reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
+                                ERRDOS, ERRbadpipe);
+                return;
+        }
+        nt_open_pipe(fname, conn, req, &pnum);
+
+        if (req->outbuf) {
+                /* error reply */
+                return;
         }
 
         /*
          * Deal with pipe return.
-         */  
+         */
 
         if (flags & EXTENDED_RESPONSE_REQUIRED) {
@@ -393 +417 @@
                  * what happens on the wire....
                  */
-                set_message(outbuf,50,0,True);
-                SCVAL(outbuf,smb_wct,42);
+                reply_outbuf(req, 50, 0);
+                SCVAL(req->outbuf,smb_wct,42);
         } else {
-                set_message(outbuf,34,0,True);
-        }
-
-        p = outbuf + smb_vwv2;
+                reply_outbuf(req, 34, 0);
+        }
+
+        p = (char *)req->outbuf + smb_vwv2;
         p++;
         SSVAL(p,0,pnum);
@@ -417 +441 @@
                 p += 25;
                 SIVAL(p,0,FILE_GENERIC_ALL);
-                /* 
+                /*
                  * For pipes W2K3 seems to return
                  * 0x12019B next.
@@ -427 +451 @@
         DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
 
-        return chain_reply(inbuf,outbuf,length,bufsize);
+        chain_reply(req);
 }
 
@@ -434 +458 @@
 ****************************************************************************/
 
-int reply_ntcreate_and_X_quota(connection_struct *conn,
-                                char *inbuf,
-                                char *outbuf,
-                                int length,
-                                int bufsize,
-                                enum FAKE_FILE_TYPE fake_file_type,
-                                const char *fname)
+static void reply_ntcreate_and_X_quota(connection_struct *conn,
+                                       struct smb_request *req,
+                                       enum FAKE_FILE_TYPE fake_file_type,
+                                       const char *fname)
 {
-        int result;
         char *p;
-        uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess);
+        uint32 desired_access = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
         files_struct *fsp;
         NTSTATUS status;
@@ -452 +472 @@
 
         if (!NT_STATUS_IS_OK(status)) {
-                return ERROR_NT(status);
-        }
-
-        set_message(outbuf,34,0,True);
-        
-        p = outbuf + smb_vwv2;
-        
+                reply_nterror(req, status);
+                return;
+        }
+
+        reply_outbuf(req, 34, 0);
+
+        p = (char *)req->outbuf + smb_vwv2;
+
         /* SCVAL(p,0,NO_OPLOCK_RETURN); */
         p++;
@@ -465 +486 @@
         DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
 
-        result = chain_reply(inbuf,outbuf,length,bufsize);
-        return result;
+        chain_reply(req);
 }
 
@@ -473 +493 @@
 ****************************************************************************/
 
-int reply_ntcreate_and_X(connection_struct *conn,
-                         char *inbuf,char *outbuf,int length,int bufsize)
-{  
-        int result;
-        pstring fname;
-        uint32 flags = IVAL(inbuf,smb_ntcreate_Flags);
-        uint32 access_mask = IVAL(inbuf,smb_ntcreate_DesiredAccess);
-        uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes);
-        uint32 new_file_attributes;
-        uint32 share_access = IVAL(inbuf,smb_ntcreate_ShareAccess);
-        uint32 create_disposition = IVAL(inbuf,smb_ntcreate_CreateDisposition);
-        uint32 create_options = IVAL(inbuf,smb_ntcreate_CreateOptions);
-        uint16 root_dir_fid = (uint16)IVAL(inbuf,smb_ntcreate_RootDirectoryFid);
+void reply_ntcreate_and_X(connection_struct *conn,
+                          struct smb_request *req)
+{
+        char *fname = NULL;
+        uint32 flags;
+        uint32 access_mask;
+        uint32 file_attributes;
+        uint32 share_access;
+        uint32 create_disposition;
+        uint32 create_options;
+        uint16 root_dir_fid;
+        SMB_BIG_UINT allocation_size;
         /* Breakout the oplock request bits so we can set the
            reply bits separately. */
@@ -500 +519 @@
         BOOL extended_oplock_granted = False;
         NTSTATUS status;
+        struct case_semantics_state *case_state = NULL;
+        TALLOC_CTX *ctx = talloc_tos();
 
         START_PROFILE(SMBntcreateX);
+
+        if (req->wct < 24) {
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                return;
+        }
+
+        flags = IVAL(req->inbuf,smb_ntcreate_Flags);
+        access_mask = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
+        file_attributes = IVAL(req->inbuf,smb_ntcreate_FileAttributes);
+        share_access = IVAL(req->inbuf,smb_ntcreate_ShareAccess);
+        create_disposition = IVAL(req->inbuf,smb_ntcreate_CreateDisposition);
+        create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
+        root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
+
+        allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,smb_ntcreate_AllocationSize);
+#ifdef LARGE_SMB_OFF_T
+        allocation_size |= (((SMB_BIG_UINT)IVAL(req->inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
+#endif
 
         DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
@@ -521 +560 @@
         if (IS_IPC(conn)) {
                 if (lp_nt_pipe_support()) {
+                        do_ntcreate_pipe_open(conn, req);
                         END_PROFILE(SMBntcreateX);
-                        return do_ntcreate_pipe_open(conn,inbuf,outbuf,length,bufsize);
+                        return;
                 } else {
+                        reply_doserror(req, ERRDOS, ERRnoaccess);
                         END_PROFILE(SMBntcreateX);
-                        return(ERROR_DOS(ERRDOS,ERRnoaccess));
+                        return;
                 }
         }
 
         if (create_options & FILE_OPEN_BY_FILE_ID) {
+                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
                 END_PROFILE(SMBntcreateX);
-                return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
+                return;
         }
 
@@ -542 +584 @@
                  * This filename is relative to a directory fid.
                  */
-                pstring rel_fname;
-                files_struct *dir_fsp = file_fsp(inbuf,smb_ntcreate_RootDirectoryFid);
-                size_t dir_name_len;
+                char *rel_fname = NULL;
+                files_struct *dir_fsp = file_fsp(
+                        SVAL(req->inbuf, smb_ntcreate_RootDirectoryFid));
 
                 if(!dir_fsp) {
+                        reply_doserror(req, ERRDOS, ERRbadfid);
                         END_PROFILE(SMBntcreateX);
-                        return ERROR_DOS(ERRDOS,ERRbadfid);
+                        return;
                 }
 
                 if(!dir_fsp->is_directory) {
 
-                        srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
+                        srvstr_get_path(ctx, (char *)req->inbuf,
+                                        req->flags2, &fname,
+                                        smb_buf(req->inbuf), 0,
+                                        STR_TERMINATE, &status);
                         if (!NT_STATUS_IS_OK(status)) {
+                                reply_nterror(req, status);
                                 END_PROFILE(SMBntcreateX);
-                                return ERROR_NT(status);
+                                return;
                         }
 
@@ -564 +611 @@
 
                         if( is_ntfs_stream_name(fname)) {
+                                reply_nterror(
+                                        req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
                                 END_PROFILE(SMBntcreateX);
-                                return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+                                return;
                         }
 
@@ -575 +624 @@
                         */
 
+                        reply_doserror(req, ERRDOS, ERRbadfid);
                         END_PROFILE(SMBntcreateX);
-                        return(ERROR_DOS(ERRDOS,ERRbadfid));
-                }
-
-                /*
-                 * Copy in the base directory name.
-                 */
-
-                pstrcpy( fname, dir_fsp->fsp_name );
-                dir_name_len = strlen(fname);
-
-                /*
-                 * Ensure it ends in a '\'.
-                 */
-
-                if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
-                        pstrcat(fname, "/");
-                        dir_name_len++;
-                }
-
-                srvstr_get_path(inbuf, rel_fname, smb_buf(inbuf), sizeof(rel_fname), 0, STR_TERMINATE, &status);
+                        return;
+                }
+
+                if (ISDOT(dir_fsp->fsp_name)) {
+                        /*
+                         * We're at the toplevel dir, the final file name
+                         * must not contain ./, as this is filtered out
+                         * normally by srvstr_get_path and unix_convert
+                         * explicitly rejects paths containing ./.
+                         */
+                        fname = talloc_strdup(ctx,"");
+                        if (!fname) {
+                                reply_nterror(req, NT_STATUS_NO_MEMORY);
+                                END_PROFILE(SMBntcreateX);
+                                return;
+                        }
+                } else {
+                        size_t dir_name_len = strlen(dir_fsp->fsp_name);
+
+                        /*
+                         * Copy in the base directory name.
+                         */
+
+                        fname = TALLOC_ARRAY(ctx, char, dir_name_len+2);
+                        if (!fname) {
+                                reply_nterror(
+                                        req, NT_STATUS_NO_MEMORY);
+                                END_PROFILE(SMBntcreateX);
+                                return;
+                        }
+                        memcpy(fname, dir_fsp->fsp_name, dir_name_len+1);
+
+                        /*
+                         * Ensure it ends in a '/'.
+                         * We used TALLOC_SIZE +2 to add space for the '/'.
+                         */
+
+                        if(dir_name_len &&
+                                        (fname[dir_name_len-1] != '\\') &&
+                                        (fname[dir_name_len-1] != '/')) {
+                                fname[dir_name_len] = '/';
+                                fname[dir_name_len+1] = '\0';
+                        }
+                }
+
+                srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &rel_fname,
+                                smb_buf(req->inbuf), 0,
+                                STR_TERMINATE, &status);
                 if (!NT_STATUS_IS_OK(status)) {
+                        reply_nterror(req, status);
                         END_PROFILE(SMBntcreateX);
-                        return ERROR_NT(status);
-                }
-                pstrcat(fname, rel_fname);
+                        return;
+                }
+                fname = talloc_asprintf(ctx, "%s%s",
+                                        fname,
+                                        rel_fname);
+                if (!fname) {
+                        reply_nterror(
+                                req, NT_STATUS_NO_MEMORY);
+                        END_PROFILE(SMBntcreateX);
+                        return;
+                }
         } else {
-                srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
+                srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
+                                smb_buf(req->inbuf), 0,
+                                STR_TERMINATE, &status);
                 if (!NT_STATUS_IS_OK(status)) {
+                        reply_nterror(req, status);
                         END_PROFILE(SMBntcreateX);
-                        return ERROR_NT(status);
+                        return;
                 }
 
@@ -624 +714 @@
                                  * xp also tries a QUERY_FILE_INFO on the file and then close it
                                  */
-                                result = reply_ntcreate_and_X_quota(conn, inbuf, outbuf, length, bufsize,
-                                                                fake_file_type, fname);
-                                END_PROFILE(SMBntcreateX);
-                                return result;
+                                reply_ntcreate_and_X_quota(conn, req,
+                                                          fake_file_type, fname);
                         } else {
-                                END_PROFILE(SMBntcreateX);
-                                return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+                                reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
                         }
-                }
-        }
-        
-        /*
-         * Now contruct the smb_open_mode value from the filename, 
+                        END_PROFILE(SMBntcreateX);
+                        return;
+                }
+        }
+
+        /*
+         * Now contruct the smb_open_mode value from the filename,
          * desired access and the share access.
          */
-        status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
+        status = resolve_dfspath(ctx, conn,
+                                req->flags2 & FLAGS2_DFS_PATHNAMES,
+                                fname,
+                                &fname);
         if (!NT_STATUS_IS_OK(status)) {
+                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
+                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
+                                        ERRSRV, ERRbadpath);
+                }
+                else {
+                        reply_nterror(req, status);
+                }
                 END_PROFILE(SMBntcreateX);
-                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-                        return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
-                }
-                return ERROR_NT(status);
+                return;
         }
 
@@ -656 +752 @@
          * Ordinary file or directory.
          */
-                
+
         /*
          * Check if POSIX semantics are wanted.
          */
-                
-        new_file_attributes = set_posix_case_semantics(conn, file_attributes);
-                
-        status = unix_convert(conn, fname, False, NULL, &sbuf);
+
+        if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
+                case_state = set_posix_case_semantics(NULL, conn);
+                file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
+        }
+
+        status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
         if (!NT_STATUS_IS_OK(status)) {
-                restore_case_semantics(conn, file_attributes);
+                TALLOC_FREE(case_state);
+                reply_nterror(req, status);
                 END_PROFILE(SMBntcreateX);
-                return ERROR_NT(status);
+                return;
         }
         /* All file access must go through check_name() */
         status = check_name(conn, fname);
         if (!NT_STATUS_IS_OK(status)) {
-                restore_case_semantics(conn, file_attributes);
+                TALLOC_FREE(case_state);
+                reply_nterror(req, status);
                 END_PROFILE(SMBntcreateX);
-                return ERROR_NT(status);
+                return;
         }
 
@@ -691 +792 @@
                 if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) ||
                                 !can_delete_file_in_directory(conn, fname)) {
-                        restore_case_semantics(conn, file_attributes);
+                        TALLOC_FREE(case_state);
+                        reply_nterror(req, NT_STATUS_ACCESS_DENIED);
                         END_PROFILE(SMBntcreateX);
-                        return ERROR_NT(NT_STATUS_ACCESS_DENIED);
-                }
-        }
+                        return;
+                }
+        }
+
+#if 0
+        /* We need to support SeSecurityPrivilege for this. */
+        if ((access_mask & SEC_RIGHT_SYSTEM_SECURITY) &&
+                        !user_has_privileges(current_user.nt_user_token,
+                                &se_security)) {
+                TALLOC_FREE(case_state);
+                END_PROFILE(SMBntcreateX);
+                return ERROR_NT(NT_STATUS_PRIVILEGE_NOT_HELD);
+        }
+#endif
 
         /*
@@ -705 +818 @@
                 /* Can't open a temp directory. IFS kit test. */
                 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
+                        TALLOC_FREE(case_state);
+                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                         END_PROFILE(SMBntcreateX);
-                        return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                        return;
                 }
 
                 oplock_request = 0;
-                status = open_directory(conn, fname, &sbuf,
+                status = open_directory(conn, req, fname, &sbuf,
                                         access_mask,
                                         share_access,
                                         create_disposition,
                                         create_options,
-                                        new_file_attributes,
+                                        file_attributes,
                                         &info, &fsp);
+
         } else {
 
@@ -736 +852 @@
                  * our client. JRA.  */
 
-                status = open_file_ntcreate(conn,fname,&sbuf,
+                status = open_file_ntcreate(conn, req, fname, &sbuf,
                                         access_mask,
                                         share_access,
                                         create_disposition,
                                         create_options,
-                                        new_file_attributes,
+                                        file_attributes,
                                         oplock_request,
                                         &info, &fsp);
 
-                if (!NT_STATUS_IS_OK(status)) {
-                        /* We cheat here. There are two cases we
-                         * care about. One is a directory rename,
-                         * where the NT client will attempt to
-                         * open the source directory for
-                         * DELETE access. Note that when the
-                         * NT client does this it does *not*
-                         * set the directory bit in the
-                         * request packet. This is translated
-                         * into a read/write open
-                         * request. POSIX states that any open
-                         * for write request on a directory
-                         * will generate an EISDIR error, so
-                         * we can catch this here and open a
-                         * pseudo handle that is flagged as a
-                         * directory. The second is an open
-                         * for a permissions read only, which
-                         * we handle in the open_file_stat case. JRA.
+                /* We cheat here. There are two cases we
+                 * care about. One is a directory rename,
+                 * where the NT client will attempt to
+                 * open the source directory for
+                 * DELETE access. Note that when the
+                 * NT client does this it does *not*
+                 * set the directory bit in the
+                 * request packet. This is translated
+                 * into a read/write open
+                 * request. POSIX states that any open
+                 * for write request on a directory
+                 * will generate an EISDIR error, so
+                 * we can catch this here and open a
+                 * pseudo handle that is flagged as a
+                 * directory. The second is an open
+                 * for a permissions read only, which
+                 * we handle in the open_file_stat case. JRA.
+                 */
+
+                if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_IS_A_DIRECTORY)) {
+
+                        /*
+                         * Fail the open if it was explicitly a non-directory
+                         * file.
                          */
 
-                        if (NT_STATUS_EQUAL(status,
-                                            NT_STATUS_FILE_IS_A_DIRECTORY)) {
-
-                                /*
-                                 * Fail the open if it was explicitly a non-directory file.
-                                 */
-
-                                if (create_options & FILE_NON_DIRECTORY_FILE) {
-                                        restore_case_semantics(conn, file_attributes);
-                                        END_PROFILE(SMBntcreateX);
-                                        return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
-                                }
-
-                                oplock_request = 0;
-                                status = open_directory(conn, fname, &sbuf,
-                                                        access_mask,
-                                                        share_access,
-                                                        create_disposition,
-                                                        create_options,
-                                                        new_file_attributes,
-                                                        &info, &fsp);
-
+                        if (create_options & FILE_NON_DIRECTORY_FILE) {
+                                TALLOC_FREE(case_state);
+                                reply_force_nterror(req,
+                                                NT_STATUS_FILE_IS_A_DIRECTORY);
+                                END_PROFILE(SMBntcreateX);
+                                return;
                         }
-                }
-        }
-
-        restore_case_semantics(conn, file_attributes);
-
-        if(!NT_STATUS_IS_OK(status)) {
+
+                        oplock_request = 0;
+                        status = open_directory(conn, req, fname,
+                                                &sbuf,
+                                                access_mask,
+                                                share_access,
+                                                create_disposition,
+                                                create_options,
+                                                file_attributes,
+                                                &info, &fsp);
+                }
+        }
+
+        TALLOC_FREE(case_state);
+
+        if (!NT_STATUS_IS_OK(status)) {
+                if (open_was_deferred(req->mid)) {
+                        /* We have re-scheduled this call. */
+                        END_PROFILE(SMBntcreateX);
+                        return;
+                }
+                reply_openerror(req, status);
                 END_PROFILE(SMBntcreateX);
-
-                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
-                        /* We have re-scheduled this call. */
-                        return -1;
-                }
-
-                return ERROR_OPEN(status);
+                return;
         }
 
@@ -811 +927 @@
         if (!fsp->is_directory && (fattr & aDIR)) {
                 close_file(fsp,ERROR_CLOSE);
+                reply_doserror(req, ERRDOS, ERRnoaccess);
                 END_PROFILE(SMBntcreateX);
-                return ERROR_DOS(ERRDOS,ERRnoaccess);
-        } 
-        
+                return;
+        }
+
         /* Save the requested allocation size. */
         if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
-                SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize);
-#ifdef LARGE_SMB_OFF_T
-                allocation_size |= (((SMB_BIG_UINT)IVAL(inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
-#endif
                 if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
                         fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
                         if (fsp->is_directory) {
                                 close_file(fsp,ERROR_CLOSE);
+                                /* Can't set allocation size on a directory. */
+                                reply_nterror(req, NT_STATUS_ACCESS_DENIED);
                                 END_PROFILE(SMBntcreateX);
-                                /* Can't set allocation size on a directory. */
-                                return ERROR_NT(NT_STATUS_ACCESS_DENIED);
+                                return;
                         }
                         if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
                                 close_file(fsp,ERROR_CLOSE);
+                                reply_nterror(req, NT_STATUS_DISK_FULL);
                                 END_PROFILE(SMBntcreateX);
-                                return ERROR_NT(NT_STATUS_DISK_FULL);
+                                return;
                         }
                 } else {
@@ -839 +954 @@
         }
 
-        /* 
+        /*
          * If the caller set the extended oplock request bit
          * and we granted one (by whatever means) - set the
@@ -859 +974 @@
                  * what happens on the wire....
                  */
-                set_message(outbuf,50,0,True);
-                SCVAL(outbuf,smb_wct,42);
+                reply_outbuf(req, 50, 0);
+                SCVAL(req->outbuf,smb_wct,42);
         } else {
-                set_message(outbuf,34,0,True);
-        }
-
-        p = outbuf + smb_vwv2;
-        
+                reply_outbuf(req, 34, 0);
+        }
+
+        p = (char *)req->outbuf + smb_vwv2;
+
         /*
          * Currently as we don't support level II oplocks we just report
@@ -883 +998 @@
                 SCVAL(p,0,NO_OPLOCK_RETURN);
         }
-        
+
         p++;
         SSVAL(p,0,fsp->fnum);
@@ -938 +1053 @@
         DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
 
-        result = chain_reply(inbuf,outbuf,length,bufsize);
+        chain_reply(req);
         END_PROFILE(SMBntcreateX);
-        return result;
+        return;
 }
 
@@ -947 +1062 @@
 ****************************************************************************/
 
-static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
-                                  uint16 **ppsetup, uint32 setup_count,
-                                  char **ppparams, uint32 parameter_count,
-                                  char **ppdata, uint32 data_count)
+static void do_nt_transact_create_pipe(connection_struct *conn,
+                                       struct smb_request *req,
+                                       uint16 **ppsetup, uint32 setup_count,
+                                       char **ppparams, uint32 parameter_count,
+                                       char **ppdata, uint32 data_count)
 {
-        pstring fname;
+        char *fname = NULL;
         char *params = *ppparams;
-        int ret;
         int pnum = -1;
         char *p = NULL;
@@ -960 +1075 @@
         size_t param_len;
         uint32 flags;
+        TALLOC_CTX *ctx = talloc_tos();
 
         /*
@@ -967 +1083 @@
         if(parameter_count < 54) {
                 DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count));
-                return ERROR_DOS(ERRDOS,ERRnoaccess);
+                reply_doserror(req, ERRDOS, ERRnoaccess);
+                return;
         }
 
         flags = IVAL(params,0);
 
-        srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
+        srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
+                        parameter_count-53, STR_TERMINATE,
+                        &status);
         if (!NT_STATUS_IS_OK(status)) {
-                return ERROR_NT(status);
-        }
-
-        if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) {
-                return ret;
-        }
-        
+                reply_nterror(req, status);
+                return;
+        }
+
+        nt_open_pipe(fname, conn, req, &pnum);
+
+        if (req->outbuf) {
+                /* Error return */
+                return;
+        }
+
         /* Realloc the size of parameters and data we will return */
         if (flags & EXTENDED_RESPONSE_REQUIRED) {
@@ -990 +1113 @@
         params = nttrans_realloc(ppparams, param_len);
         if(params == NULL) {
-                return ERROR_DOS(ERRDOS,ERRnomem);
-        }
-        
+                reply_doserror(req, ERRDOS, ERRnomem);
+                return;
+        }
+
         p = params;
         SCVAL(p,0,NO_OPLOCK_RETURN);
-        
+
         p += 2;
         SSVAL(p,0,pnum);
@@ -1001 +1125 @@
         SIVAL(p,0,FILE_WAS_OPENED);
         p += 8;
-        
+
         p += 32;
         SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
@@ -1010 +1134 @@
         SSVAL(p,2, 0x5FF); /* ? */
         p += 4;
-        
+
         if (flags & EXTENDED_RESPONSE_REQUIRED) {
                 p += 25;
                 SIVAL(p,0,FILE_GENERIC_ALL);
-                /* 
+                /*
                  * For pipes W2K3 seems to return
                  * 0x12019B next.
@@ -1023 +1147 @@
 
         DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
-        
+
         /* Send the required number of replies */
-        send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len, *ppdata, 0);
-        
-        return -1;
+        send_nt_replies(req, NT_STATUS_OK, params, param_len, *ppdata, 0);
+
+        return;
 }
 
@@ -1039 +1163 @@
         SEC_DESC *psd = NULL;
         TALLOC_CTX *mem_ctx;
-        BOOL ret;
-        
+        NTSTATUS status;
+
         if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
                 return NT_STATUS_OK;
@@ -1060 +1184 @@
          * allocated.
          */
-        
+
         prs_give_memory( &pd, data, sd_len, False);
 
@@ -1071 +1195 @@
                 /*
                  * Return access denied for want of a better error message..
-                 */ 
+                 */
                 talloc_destroy(mem_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
-        
+
         if (psd->owner_sid==0) {
                 security_info_sent &= ~OWNER_SECURITY_INFORMATION;
@@ -1088 +1212 @@
                 security_info_sent &= ~DACL_SECURITY_INFORMATION;
         }
-        
-        ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
-        
-        if (!ret) {
-                talloc_destroy(mem_ctx);
-                return NT_STATUS_ACCESS_DENIED;
-        }
-        
+
+        status = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
+
         talloc_destroy(mem_ctx);
-        
-        return NT_STATUS_OK;
+        return status;
 }
 
@@ -1104 +1222 @@
  Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
 ****************************************************************************/
-                                                                                                                             
+
 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
 {
@@ -1128 +1246 @@
                 offset += next_offset;
         }
-                                                                                                                             
+
         return ea_list_head;
 }
@@ -1136 +1254 @@
 ****************************************************************************/
 
-static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
-                                  uint16 **ppsetup, uint32 setup_count,
-                                  char **ppparams, uint32 parameter_count,
-                                  char **ppdata, uint32 data_count, uint32 max_data_count)
+static void call_nt_transact_create(connection_struct *conn,
+                                    struct smb_request *req,
+                                    uint16 **ppsetup, uint32 setup_count,
+                                    char **ppparams, uint32 parameter_count,
+                                    char **ppdata, uint32 data_count,
+                                    uint32 max_data_count)
 {
-        pstring fname;
+        char *fname = NULL;
         char *params = *ppparams;
         char *data = *ppdata;
@@ -1156 +1276 @@
         uint32 access_mask;
         uint32 file_attributes;
-        uint32 new_file_attributes;
         uint32 share_access;
         uint32 create_disposition;
@@ -1167 +1286 @@
         struct timespec m_timespec;
         struct ea_list *ea_list = NULL;
-        TALLOC_CTX *ctx = NULL;
         char *pdata = NULL;
         NTSTATUS status;
         size_t param_len;
+        struct case_semantics_state *case_state = NULL;
+        TALLOC_CTX *ctx = talloc_tos();
 
         DEBUG(5,("call_nt_transact_create\n"));
@@ -1180 +1300 @@
         if (IS_IPC(conn)) {
                 if (lp_nt_pipe_support()) {
-                        return do_nt_transact_create_pipe(conn, inbuf, outbuf, length, 
-                                        bufsize,
-                                        ppsetup, setup_count,
-                                        ppparams, parameter_count,
-                                        ppdata, data_count);
+                        do_nt_transact_create_pipe(
+                                conn, req,
+                                ppsetup, setup_count,
+                                ppparams, parameter_count,
+                                ppdata, data_count);
+                        return;
                 } else {
-                        return ERROR_DOS(ERRDOS,ERRnoaccess);
+                        reply_doserror(req, ERRDOS, ERRnoaccess);
+                        return;
                 }
         }
@@ -1196 +1318 @@
         if(parameter_count < 54) {
                 DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count));
-                return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                return;
         }
 
@@ -1215 +1338 @@
                 DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
                         (unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
-                return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                return;
         }
 
@@ -1222 +1346 @@
                         DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
                                 (unsigned int)ea_len ));
-                        return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
+                        reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
+                        return;
                 }
 
@@ -1228 +1353 @@
                         DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
                                 (unsigned int)ea_len ));
-                        return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                        return;
                 }
         }
 
         if (create_options & FILE_OPEN_BY_FILE_ID) {
-                return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
+                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+                return;
         }
 
@@ -1244 +1371 @@
                  * This filename is relative to a directory fid.
                  */
-                files_struct *dir_fsp = file_fsp(params,4);
-                size_t dir_name_len;
+                char *tmpname = NULL;
+                files_struct *dir_fsp = file_fsp(SVAL(params,4));
 
                 if(!dir_fsp) {
-                        return ERROR_DOS(ERRDOS,ERRbadfid);
+                        reply_doserror(req, ERRDOS, ERRbadfid);
+                        return;
                 }
 
                 if(!dir_fsp->is_directory) {
-                        srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
+                        srvstr_get_path(ctx, params, req->flags2, &fname,
+                                        params+53,
+                                        parameter_count-53, STR_TERMINATE,
+                                        &status);
                         if (!NT_STATUS_IS_OK(status)) {
-                                return ERROR_NT(status);
+                                reply_nterror(req, status);
+                                return;
                         }
 
@@ -1262 +1394 @@
 
                         if( is_ntfs_stream_name(fname)) {
-                                return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+                                reply_nterror(req,
+                                              NT_STATUS_OBJECT_PATH_NOT_FOUND);
+                                return;
                         }
 
-                        return ERROR_DOS(ERRDOS,ERRbadfid);
-                }
-
-                /*
-                 * Copy in the base directory name.
-                 */
-
-                pstrcpy( fname, dir_fsp->fsp_name );
-                dir_name_len = strlen(fname);
-
-                /*
-                 * Ensure it ends in a '\'.
-                 */
-
-                if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
-                        pstrcat(fname, "/");
-                        dir_name_len++;
-                }
-
-                {
-                        pstring tmpname;
-                        srvstr_get_path(inbuf, tmpname, params+53, sizeof(tmpname), parameter_count-53, STR_TERMINATE, &status);
-                        if (!NT_STATUS_IS_OK(status)) {
-                                return ERROR_NT(status);
+                        reply_doserror(req, ERRDOS, ERRbadfid);
+                        return;
+                }
+
+                if (ISDOT(dir_fsp->fsp_name)) {
+                        /*
+                         * We're at the toplevel dir, the final file name
+                         * must not contain ./, as this is filtered out
+                         * normally by srvstr_get_path and unix_convert
+                         * explicitly rejects paths containing ./.
+                         */
+                        fname = talloc_strdup(ctx,"");
+                        if (!fname) {
+                                reply_nterror(req, NT_STATUS_NO_MEMORY);
+                                return;
                         }
-                        pstrcat(fname, tmpname);
+                } else {
+                        size_t dir_name_len = strlen(dir_fsp->fsp_name);
+
+                        /*
+                         * Copy in the base directory name.
+                         */
+
+                        fname = TALLOC_ARRAY(ctx, char, dir_name_len+2);
+                        if (!fname) {
+                                reply_nterror(req, NT_STATUS_NO_MEMORY);
+                                return;
+                        }
+                        memcpy(fname, dir_fsp->fsp_name, dir_name_len+1);
+
+                        /*
+                         * Ensure it ends in a '/'.
+                         * We used TALLOC_SIZE +2 to add space for the '/'.
+                         */
+
+                        if(dir_name_len &&
+                                        (fname[dir_name_len-1] != '\\') &&
+                                        (fname[dir_name_len-1] != '/')) {
+                                fname[dir_name_len] = '/';
+                                fname[dir_name_len+1] = '\0';
+                        }
+                }
+
+                srvstr_get_path(ctx, params, req->flags2, &tmpname,
+                                params+53,
+                                parameter_count-53, STR_TERMINATE,
+                                &status);
+                if (!NT_STATUS_IS_OK(status)) {
+                        reply_nterror(req, status);
+                        return;
+                }
+                fname = talloc_asprintf(ctx, "%s%s",
+                                        fname,
+                                        tmpname);
+                if (!fname) {
+                        reply_nterror(
+                                req, NT_STATUS_NO_MEMORY);
+                        return;
                 }
         } else {
-                srvstr_get_path(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE, &status);
+                srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
+                                parameter_count-53,
+                                STR_TERMINATE, &status);
                 if (!NT_STATUS_IS_OK(status)) {
-                        return ERROR_NT(status);
+                        reply_nterror(req, status);
+                        return;
                 }
 
@@ -1303 +1472 @@
 
                 if( is_ntfs_stream_name(fname)) {
-                        return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+                        reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
+                        return;
                 }
         }
@@ -1315 +1485 @@
          * Ordinary file or directory.
          */
-                
+
         /*
          * Check if POSIX semantics are wanted.
          */
-                
-        new_file_attributes = set_posix_case_semantics(conn, file_attributes);
-    
-        status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, fname);
+
+        if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
+                case_state = set_posix_case_semantics(NULL, conn);
+                file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
+        }
+
+        status = resolve_dfspath(ctx, conn,
+                                req->flags2 & FLAGS2_DFS_PATHNAMES,
+                                fname,
+                                &fname);
         if (!NT_STATUS_IS_OK(status)) {
+                TALLOC_FREE(case_state);
                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-                        return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
-                }
-                return ERROR_NT(status);
-        }
-
-        status = unix_convert(conn, fname, False, NULL, &sbuf);
+                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
+                                        ERRSRV, ERRbadpath);
+                        return;
+                }
+                reply_nterror(req, status);
+                return;
+        }
+
+        status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
         if (!NT_STATUS_IS_OK(status)) {
-                restore_case_semantics(conn, file_attributes);
-                return ERROR_NT(status);
+                TALLOC_FREE(case_state);
+                reply_nterror(req, status);
+                return;
         }
         /* All file access must go through check_name() */
         status = check_name(conn, fname);
         if (!NT_STATUS_IS_OK(status)) {
-                restore_case_semantics(conn, file_attributes);
-                return ERROR_NT(status);
+                TALLOC_FREE(case_state);
+                reply_nterror(req, status);
+                return;
         }
 
@@ -1356 +1538 @@
                 if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) ||
                                 !can_delete_file_in_directory(conn, fname)) {
-                        restore_case_semantics(conn, file_attributes);
-                        return ERROR_NT(NT_STATUS_ACCESS_DENIED);
-                }
-        }
+                        TALLOC_FREE(case_state);
+                        reply_nterror(req, NT_STATUS_ACCESS_DENIED);
+                        return;
+                }
+        }
+
+#if 0
+        /* We need to support SeSecurityPrivilege for this. */
+        if ((access_mask & SEC_RIGHT_SYSTEM_SECURITY) &&
+                        !user_has_privileges(current_user.nt_user_token,
+                                &se_security)) {
+                TALLOC_FREE(case_state);
+                reply_nterror(req, NT_STATUS_PRIVILEGE_NOT_HELD);
+                return;
+        }
+#endif
 
         if (ea_len) {
@@ -1365 +1559 @@
 
                 /* We have already checked that ea_len <= data_count here. */
-                ea_list = read_nttrans_ea_list(tmp_talloc_ctx(), pdata,
+                ea_list = read_nttrans_ea_list(talloc_tos(), pdata,
                                                ea_len);
                 if (!ea_list ) {
-                        restore_case_semantics(conn, file_attributes);
-                        return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                        TALLOC_FREE(case_state);
+                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                        return;
                 }
         }
@@ -1381 +1576 @@
                 /* Can't open a temp directory. IFS kit test. */
                 if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
-                        restore_case_semantics(conn, file_attributes);
-                        return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                        TALLOC_FREE(case_state);
+                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                        return;
                 }
 
@@ -1392 +1588 @@
 
                 oplock_request = 0;
-                status = open_directory(conn, fname, &sbuf,
+                status = open_directory(conn, req, fname, &sbuf,
                                         access_mask,
                                         share_access,
                                         create_disposition,
                                         create_options,
-                                        new_file_attributes,
+                                        file_attributes,
                                         &info, &fsp);
         } else {
@@ -1405 +1601 @@
                  */
 
-                status = open_file_ntcreate(conn,fname,&sbuf,
+                status = open_file_ntcreate(conn,req,fname,&sbuf,
                                         access_mask,
                                         share_access,
                                         create_disposition,
                                         create_options,
-                                        new_file_attributes,
+                                        file_attributes,
                                         oplock_request,
                                         &info, &fsp);
 
-                if (!NT_STATUS_IS_OK(status)) {
-                        if (NT_STATUS_EQUAL(status,
-                                            NT_STATUS_FILE_IS_A_DIRECTORY)) {
-
-                                /*
-                                 * Fail the open if it was explicitly a non-directory file.
-                                 */
-
-                                if (create_options & FILE_NON_DIRECTORY_FILE) {
-                                        restore_case_semantics(conn, file_attributes);
-                                        return ERROR_FORCE_NT(NT_STATUS_FILE_IS_A_DIRECTORY);
-                                }
-
-                                oplock_request = 0;
-                                status = open_directory(conn, fname, &sbuf,
-                                                        access_mask,
-                                                        share_access,
-                                                        create_disposition,
-                                                        create_options,
-                                                        new_file_attributes,
-                                                        &info, &fsp);
+                if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_IS_A_DIRECTORY)) {
+
+                        /*
+                         * Fail the open if it was explicitly a non-directory file.
+                         */
+
+                        if (create_options & FILE_NON_DIRECTORY_FILE) {
+                                TALLOC_FREE(case_state);
+                                reply_force_nterror(
+                                        req,
+                                        NT_STATUS_FILE_IS_A_DIRECTORY);
+                                return;
                         }
-                }
-        }
-
-        restore_case_semantics(conn, file_attributes);
+
+                        oplock_request = 0;
+                        status = open_directory(conn, req, fname,
+                                                &sbuf,
+                                                access_mask,
+                                                share_access,
+                                                create_disposition,
+                                                create_options,
+                                                file_attributes,
+                                                &info, &fsp);
+                }
+        }
+
+        TALLOC_FREE(case_state);
+
         if(!NT_STATUS_IS_OK(status)) {
-
-                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                if (open_was_deferred(req->mid)) {
                         /* We have re-scheduled this call. */
-                        return -1;
-                }
-
-                return ERROR_OPEN(status);
+                        return;
+                }
+                reply_openerror(req, status);
+                return;
         }
 
@@ -1470 +1667 @@
                 status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
                 if (!NT_STATUS_IS_OK(status)) {
-                        talloc_destroy(ctx);
                         close_file(fsp,ERROR_CLOSE);
-                        restore_case_semantics(conn, file_attributes);
-                        return ERROR_NT(status);
+                        TALLOC_FREE(case_state);
+                        reply_nterror(req, status);
+                        return;
                 }
                 fsp->access_mask = saved_access_mask;
         }
-        
+
         if (ea_len && (info == FILE_WAS_CREATED)) {
                 status = set_ea(conn, fsp, fname, ea_list);
                 if (!NT_STATUS_IS_OK(status)) {
                         close_file(fsp,ERROR_CLOSE);
-                        restore_case_semantics(conn, file_attributes);
-                        return ERROR_NT(status);
-                }
-        }
-
-        restore_case_semantics(conn, file_attributes);
+                        TALLOC_FREE(case_state);
+                        reply_nterror(req, status);
+                        return;
+                }
+        }
+
+        TALLOC_FREE(case_state);
 
         file_len = sbuf.st_size;
@@ -1496 +1694 @@
         if (!fsp->is_directory && (fattr & aDIR)) {
                 close_file(fsp,ERROR_CLOSE);
-                return ERROR_DOS(ERRDOS,ERRnoaccess);
-        } 
-        
+                reply_doserror(req, ERRDOS, ERRnoaccess);
+                return;
+        }
+
         /* Save the requested allocation size. */
         if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
@@ -1510 +1709 @@
                                 close_file(fsp,ERROR_CLOSE);
                                 /* Can't set allocation size on a directory. */
-                                return ERROR_NT(NT_STATUS_ACCESS_DENIED);
+                                reply_nterror(req, NT_STATUS_ACCESS_DENIED);
+                                return;
                         }
                         if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
                                 close_file(fsp,ERROR_CLOSE);
-                                return ERROR_NT(NT_STATUS_DISK_FULL);
+                                reply_nterror(req, NT_STATUS_DISK_FULL);
+                                return;
                         }
                 } else {
@@ -1521 +1722 @@
         }
 
-        /* 
+        /*
          * If the caller set the extended oplock request bit
          * and we granted one (by whatever means) - set the
@@ -1544 +1745 @@
         params = nttrans_realloc(ppparams, param_len);
         if(params == NULL) {
-                return ERROR_DOS(ERRDOS,ERRnomem);
+                reply_doserror(req, ERRDOS, ERRnomem);
+                return;
         }
 
@@ -1559 +1761 @@
                 SCVAL(p,0,NO_OPLOCK_RETURN);
         }
-        
+
         p += 2;
         SSVAL(p,0,fsp->fnum);
@@ -1615 +1817 @@
 
         /* Send the required number of replies */
-        send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len, *ppdata, 0);
-
-        return -1;
+        send_nt_replies(req, NT_STATUS_OK, params, param_len, *ppdata, 0);
+
+        return;
 }
 
@@ -1625 +1827 @@
 ****************************************************************************/
 
-int reply_ntcancel(connection_struct *conn,
-                   char *inbuf,char *outbuf,int length,int bufsize)
+void reply_ntcancel(connection_struct *conn, struct smb_request *req)
 {
         /*
          * Go through and cancel any pending change notifies.
          */
-        
-        int mid = SVAL(inbuf,smb_mid);
+
         START_PROFILE(SMBntcancel);
-        remove_pending_change_notify_requests_by_mid(mid);
-        remove_pending_lock_requests_by_mid(mid);
-        srv_cancel_sign_response(mid);
-        
-        DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));
+        remove_pending_change_notify_requests_by_mid(req->mid);
+        remove_pending_lock_requests_by_mid(req->mid);
+        srv_cancel_sign_response(req->mid);
+
+        DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
 
         END_PROFILE(SMBntcancel);
-        return(-1);
+        return;
 }
 
@@ -1648 +1848 @@
 ****************************************************************************/
 
-static NTSTATUS copy_internals(connection_struct *conn, char *oldname, char *newname, uint32 attrs)
+static NTSTATUS copy_internals(TALLOC_CTX *ctx,
+                                connection_struct *conn,
+                                struct smb_request *req,
+                                const char *oldname_in,
+                                const char *newname_in,
+                                uint32 attrs)
 {
         SMB_STRUCT_STAT sbuf1, sbuf2;
-        pstring last_component_oldname;
-        pstring last_component_newname;
+        char *oldname = NULL;
+        char *newname = NULL;
+        char *last_component_oldname = NULL;
+        char *last_component_newname = NULL;
         files_struct *fsp1,*fsp2;
         uint32 fattr;
@@ -1666 +1873 @@
         }
 
-        status = unix_convert(conn, oldname, False, last_component_oldname, &sbuf1);
+        status = unix_convert(ctx, conn, oldname_in, False, &oldname,
+                        &last_component_oldname, &sbuf1);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -1686 +1894 @@
         }
 
-        status = unix_convert(conn, newname, False, last_component_newname, &sbuf2);
+        status = unix_convert(ctx, conn, newname_in, False, &newname,
+                        &last_component_newname, &sbuf2);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -1707 +1916 @@
 
         /* Ensure this is within the share. */
-        status = reduce_name(conn, oldname);
+        status = check_reduced_name(conn, oldname);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
 
-        DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
-
-        status = open_file_ntcreate(conn,oldname,&sbuf1,
+        DEBUG(10,("copy_internals: doing file copy %s to %s\n",
+                                oldname, newname));
+
+        status = open_file_ntcreate(conn, req, oldname, &sbuf1,
                         FILE_READ_DATA, /* Read-only. */
                         FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
@@ -1727 +1937 @@
         }
 
-        status = open_file_ntcreate(conn,newname,&sbuf2,
+        status = open_file_ntcreate(conn, req, newname, &sbuf2,
                         FILE_WRITE_DATA, /* Read-only. */
                         FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
@@ -1779 +1989 @@
 ****************************************************************************/
 
-int reply_ntrename(connection_struct *conn,
-                   char *inbuf,char *outbuf,int length,int bufsize)
+void reply_ntrename(connection_struct *conn, struct smb_request *req)
 {
-        int outsize = 0;
-        pstring oldname;
-        pstring newname;
+        char *oldname = NULL;
+        char *newname = NULL;
         char *p;
         NTSTATUS status;
         BOOL src_has_wcard = False;
         BOOL dest_has_wcard = False;
-        uint32 attrs = SVAL(inbuf,smb_vwv0);
-        uint16 rename_type = SVAL(inbuf,smb_vwv1);
+        uint32 attrs;
+        uint16 rename_type;
+        TALLOC_CTX *ctx = talloc_tos();
 
         START_PROFILE(SMBntrename);
 
-        p = smb_buf(inbuf) + 1;
-        p += srvstr_get_path_wcard(inbuf, oldname, p, sizeof(oldname), 0, STR_TERMINATE, &status, &src_has_wcard);
+        if (req->wct < 4) {
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                END_PROFILE(SMBntrename);
+                return;
+        }
+
+        attrs = SVAL(req->inbuf,smb_vwv0);
+        rename_type = SVAL(req->inbuf,smb_vwv1);
+
+        p = smb_buf(req->inbuf) + 1;
+        p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
+                                   0, STR_TERMINATE, &status,
+                                   &src_has_wcard);
         if (!NT_STATUS_IS_OK(status)) {
+                reply_nterror(req, status);
                 END_PROFILE(SMBntrename);
-                return ERROR_NT(status);
+                return;
         }
 
         if( is_ntfs_stream_name(oldname)) {
                 /* Can't rename a stream. */
+                reply_nterror(req, NT_STATUS_ACCESS_DENIED);
                 END_PROFILE(SMBntrename);
-                return ERROR_NT(NT_STATUS_ACCESS_DENIED);
+                return;
         }
 
         if (ms_has_wild(oldname)) {
+                reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
                 END_PROFILE(SMBntrename);
-                return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
+                return;
         }
 
         p++;
-        p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &dest_has_wcard);
+        p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
+                                   0, STR_TERMINATE, &status,
+                                   &dest_has_wcard);
         if (!NT_STATUS_IS_OK(status)) {
+                reply_nterror(req, status);
                 END_PROFILE(SMBntrename);
-                return ERROR_NT(status);
-        }
-        
-        status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, oldname);
+                return;
+        }
+
+        status = resolve_dfspath(ctx, conn,
+                                req->flags2 & FLAGS2_DFS_PATHNAMES,
+                                oldname,
+                                &oldname);
         if (!NT_STATUS_IS_OK(status)) {
+                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
+                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
+                                        ERRSRV, ERRbadpath);
+                        END_PROFILE(SMBntrename);
+                        return;
+                }
+                reply_nterror(req, status);
                 END_PROFILE(SMBntrename);
+                return;
+        }
+
+        status = resolve_dfspath(ctx, conn,
+                                req->flags2 & FLAGS2_DFS_PATHNAMES,
+                                newname,
+                                &newname);
+        if (!NT_STATUS_IS_OK(status)) {
                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-                        return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
-                }
-                return ERROR_NT(status);
-        }
-
-        status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, newname);
-        if (!NT_STATUS_IS_OK(status)) {
+                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
+                                        ERRSRV, ERRbadpath);
+                        END_PROFILE(SMBntrename);
+                        return;
+                }
+                reply_nterror(req, status);
                 END_PROFILE(SMBntrename);
-                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-                        return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
-                }
-                return ERROR_NT(status);
+                return;
         }
 
         DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
-        
+
         switch(rename_type) {
                 case RENAME_FLAG_RENAME:
-                        status = rename_internals(conn, oldname, newname, attrs, False, src_has_wcard, dest_has_wcard);
+                        status = rename_internals(ctx, conn, req, oldname,
+                                        newname, attrs, False, src_has_wcard,
+                                        dest_has_wcard);
                         break;
                 case RENAME_FLAG_HARD_LINK:
@@ -1848 +2090 @@
                                 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
                         } else {
-                                status = hardlink_internals(conn, oldname, newname);
+                                status = hardlink_internals(ctx,
+                                                conn,
+                                                oldname,
+                                                newname);
                         }
                         break;
@@ -1856 +2101 @@
                                 status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
                         } else {
-                                status = copy_internals(conn, oldname, newname, attrs);
+                                status = copy_internals(ctx, conn, req, oldname,
+                                                        newname, attrs);
                         }
                         break;
@@ -1868 +2114 @@
 
         if (!NT_STATUS_IS_OK(status)) {
+                if (open_was_deferred(req->mid)) {
+                        /* We have re-scheduled this call. */
+                        END_PROFILE(SMBntrename);
+                        return;
+                }
+
+                reply_nterror(req, status);
                 END_PROFILE(SMBntrename);
-                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
-                        /* We have re-scheduled this call. */
-                        return -1;
-                }
-                return ERROR_NT(status);
-        }
-
-        outsize = set_message(outbuf,0,0,False);
-  
+                return;
+        }
+
+        reply_outbuf(req, 0, 0);
+
         END_PROFILE(SMBntrename);
-        return(outsize);
+        return;
 }
 
 /****************************************************************************
- Reply to a notify change - queue the request and 
+ Reply to a notify change - queue the request and
  don't allow a directory to be opened.
 ****************************************************************************/
 
-static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf,
-                                          char *outbuf, int length,
-                                          int bufsize, 
-                                          uint16 **ppsetup, uint32 setup_count,
-                                          char **ppparams,
-                                          uint32 parameter_count,
-                                          char **ppdata, uint32 data_count,
-                                          uint32 max_data_count,
-                                          uint32 max_param_count)
+static void call_nt_transact_notify_change(connection_struct *conn,
+                                           struct smb_request *req,
+                                           uint16 **ppsetup,
+                                           uint32 setup_count,
+                                           char **ppparams,
+                                           uint32 parameter_count,
+                                           char **ppdata, uint32 data_count,
+                                           uint32 max_data_count,
+                                           uint32 max_param_count)
 {
         uint16 *setup = *ppsetup;
@@ -1904 +2153 @@
 
         if(setup_count < 6) {
-                return ERROR_DOS(ERRDOS,ERRbadfunc);
-        }
-
-        fsp = file_fsp((char *)setup,4);
+                reply_doserror(req, ERRDOS, ERRbadfunc);
+                return;
+        }
+
+        fsp = file_fsp(SVAL(setup,4));
         filter = IVAL(setup, 0);
         recursive = (SVAL(setup, 6) != 0) ? True : False;
@@ -1914 +2164 @@
 
         if(!fsp) {
-                return ERROR_DOS(ERRDOS,ERRbadfid);
+                reply_doserror(req, ERRDOS, ERRbadfid);
+                return;
         }
 
@@ -1921 +2172 @@
 
                 if (!(filter_string = notify_filter_string(NULL, filter))) {
-                        return ERROR_NT(NT_STATUS_NO_MEMORY);
+                        reply_nterror(req,NT_STATUS_NO_MEMORY);
+                        return;
                 }
 
@@ -1932 +2184 @@
 
         if((!fsp->is_directory) || (conn != fsp->conn)) {
-                return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                return;
         }
 
@@ -1942 +2195 @@
                         DEBUG(10, ("change_notify_create returned %s\n",
                                    nt_errstr(status)));
-                        return ERROR_NT(status);
+                        reply_nterror(req, status);
+                        return;
                 }
         }
@@ -1957 +2211 @@
                  */
 
-                change_notify_reply(inbuf, max_param_count, fsp->notify);
+                change_notify_reply(req->inbuf, max_param_count, fsp->notify);
 
                 /*
@@ -1963 +2217 @@
                  * results
                  */
-                return -1;
+                return;
         }
 
@@ -1970 +2224 @@
          */
 
-        status = change_notify_add_request(inbuf, max_param_count, filter,
+        status = change_notify_add_request(req->inbuf, max_param_count, filter,
                         recursive, fsp);
         if (!NT_STATUS_IS_OK(status)) {
-                return ERROR_NT(status);
-        }
-
-        return -1;
+                reply_nterror(req, status);
+        }
+        return;
 }
 
@@ -1983 +2236 @@
 ****************************************************************************/
 
-static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
-                                  uint16 **ppsetup, uint32 setup_count,
-                                  char **ppparams, uint32 parameter_count,
-                                  char **ppdata, uint32 data_count, uint32 max_data_count)
+static void call_nt_transact_rename(connection_struct *conn,
+                                    struct smb_request *req,
+                                    uint16 **ppsetup, uint32 setup_count,
+                                    char **ppparams, uint32 parameter_count,
+                                    char **ppdata, uint32 data_count,
+                                    uint32 max_data_count)
 {
         char *params = *ppparams;
-        pstring new_name;
+        char *new_name = NULL;
         files_struct *fsp = NULL;
         BOOL replace_if_exists = False;
         BOOL dest_has_wcard = False;
         NTSTATUS status;
+        TALLOC_CTX *ctx = talloc_tos();
 
         if(parameter_count < 5) {
-                return ERROR_DOS(ERRDOS,ERRbadfunc);
-        }
-
-        fsp = file_fsp(params, 0);
+                reply_doserror(req, ERRDOS, ERRbadfunc);
+                return;
+        }
+
+        fsp = file_fsp(SVAL(params, 0));
         replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
-        CHECK_FSP(fsp, conn);
-        srvstr_get_path_wcard(inbuf, new_name, params+4, sizeof(new_name), parameter_count - 4,
-                        STR_TERMINATE, &status, &dest_has_wcard);
+        if (!check_fsp(conn, req, fsp, &current_user)) {
+                return;
+        }
+        srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
+                              parameter_count - 4,
+                              STR_TERMINATE, &status, &dest_has_wcard);
         if (!NT_STATUS_IS_OK(status)) {
-                return ERROR_NT(status);
-        }
-
-        status = rename_internals(conn, fsp->fsp_name,
-                                  new_name, 0, replace_if_exists, False, dest_has_wcard);
+                reply_nterror(req, status);
+                return;
+        }
+
+        status = rename_internals(ctx,
+                        conn,
+                        req,
+                        fsp->fsp_name,
+                        new_name,
+                        0,
+                        replace_if_exists,
+                        False,
+                        dest_has_wcard);
 
         if (!NT_STATUS_IS_OK(status)) {
-                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                if (open_was_deferred(req->mid)) {
                         /* We have re-scheduled this call. */
-                        return -1;
-                }
-                return ERROR_NT(status);
+                        return;
+                }
+                reply_nterror(req, status);
+                return;
         }
 
@@ -2022 +2291 @@
          * Rename was successful.
          */
-        send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
-        
-        DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n", 
+        send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+
+        DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
                  fsp->fsp_name, new_name));
-        
-        return -1;
+
+        return;
 }
 
@@ -2051 +2320 @@
 ****************************************************************************/
 
-static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, 
-                                  uint16 **ppsetup, uint32 setup_count,
-                                  char **ppparams, uint32 parameter_count,
-                                  char **ppdata, uint32 data_count, uint32 max_data_count)
+static void call_nt_transact_query_security_desc(connection_struct *conn,
+                                                 struct smb_request *req,
+                                                 uint16 **ppsetup,
+                                                 uint32 setup_count,
+                                                 char **ppparams,
+                                                 uint32 parameter_count,
+                                                 char **ppdata,
+                                                 uint32 data_count,
+                                                 uint32 max_data_count)
 {
         char *params = *ppparams;
@@ -2066 +2340 @@
 
         if(parameter_count < 8) {
-                return ERROR_DOS(ERRDOS,ERRbadfunc);
-        }
-
-        fsp = file_fsp(params,0);
+                reply_doserror(req, ERRDOS, ERRbadfunc);
+                return;
+        }
+
+        fsp = file_fsp(SVAL(params,0));
         if(!fsp) {
-                return ERROR_DOS(ERRDOS,ERRbadfid);
+                reply_doserror(req, ERRDOS, ERRbadfid);
+                return;
         }
 
@@ -2081 +2357 @@
         params = nttrans_realloc(ppparams, 4);
         if(params == NULL) {
-                return ERROR_DOS(ERRDOS,ERRnomem);
+                reply_doserror(req, ERRDOS, ERRnomem);
+                return;
         }
 
         if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
                 DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
-                return ERROR_DOS(ERRDOS,ERRnomem);
+                reply_doserror(req, ERRDOS, ERRnomem);
+                return;
         }
 
@@ -2101 +2379 @@
         if (sd_size == 0) {
                 talloc_destroy(mem_ctx);
-                return(UNIXERROR(ERRDOS,ERRnoaccess));
+                reply_unixerror(req, ERRDOS, ERRnoaccess);
+                return;
         }
 
@@ -2110 +2389 @@
         if(max_data_count < sd_size) {
 
-                send_nt_replies(outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
+                send_nt_replies(req, NT_STATUS_BUFFER_TOO_SMALL,
                                 params, 4, *ppdata, 0);
                 talloc_destroy(mem_ctx);
-                return -1;
+                return;
         }
 
@@ -2123 +2402 @@
         if(data == NULL) {
                 talloc_destroy(mem_ctx);
-                return ERROR_DOS(ERRDOS,ERRnomem);
+                reply_doserror(req, ERRDOS, ERRnomem);
+                return;
         }
 
@@ -2148 +2428 @@
                 /*
                  * Return access denied for want of a better error message..
-                 */ 
+                 */
                 talloc_destroy(mem_ctx);
-                return(UNIXERROR(ERRDOS,ERRnoaccess));
+                reply_unixerror(req, ERRDOS, ERRnoaccess);
+                return;
         }
 
@@ -2159 +2440 @@
         talloc_destroy(mem_ctx);
 
-        send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, 4, data,
-                        (int)sd_size);
-        return -1;
+        send_nt_replies(req, NT_STATUS_OK, params, 4, data, (int)sd_size);
+        return;
 }
 
@@ -2168 +2448 @@
 ****************************************************************************/
 
-static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
-                                  uint16 **ppsetup, uint32 setup_count,
-                                  char **ppparams, uint32 parameter_count,
-                                  char **ppdata, uint32 data_count, uint32 max_data_count)
+static void call_nt_transact_set_security_desc(connection_struct *conn,
+                                               struct smb_request *req,
+                                               uint16 **ppsetup,
+                                               uint32 setup_count,
+                                               char **ppparams,
+                                               uint32 parameter_count,
+                                               char **ppdata,
+                                               uint32 data_count,
+                                               uint32 max_data_count)
 {
         char *params= *ppparams;
@@ -2180 +2465 @@
 
         if(parameter_count < 8) {
-                return ERROR_DOS(ERRDOS,ERRbadfunc);
-        }
-
-        if((fsp = file_fsp(params,0)) == NULL) {
-                return ERROR_DOS(ERRDOS,ERRbadfid);
+                reply_doserror(req, ERRDOS, ERRbadfunc);
+                return;
+        }
+
+        if((fsp = file_fsp(SVAL(params,0))) == NULL) {
+                reply_doserror(req, ERRDOS, ERRbadfid);
+                return;
         }
 
@@ -2197 +2484 @@
 
         if (data_count == 0) {
-                return ERROR_DOS(ERRDOS, ERRnoaccess);
+                reply_doserror(req, ERRDOS, ERRnoaccess);
+                return;
         }
 
         if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
-                return ERROR_NT(nt_status);
+                reply_nterror(req, nt_status);
+                return;
         }
 
   done:
 
-        send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
-        return -1;
+        send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+        return;
 }
-   
+
 /****************************************************************************
  Reply to NT IOCTL
 ****************************************************************************/
 
-static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, 
-                                  uint16 **ppsetup, uint32 setup_count,
-                                  char **ppparams, uint32 parameter_count,
-                                  char **ppdata, uint32 data_count, uint32 max_data_count)
+static void call_nt_transact_ioctl(connection_struct *conn,
+                                   struct smb_request *req,
+                                   uint16 **ppsetup, uint32 setup_count,
+                                   char **ppparams, uint32 parameter_count,
+                                   char **ppdata, uint32 data_count,
+                                   uint32 max_data_count)
 {
         uint32 function;
@@ -2229 +2520 @@
         if (setup_count != 8) {
                 DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
-                return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
+                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+                return;
         }
 
@@ -2240 +2532 @@
                  function, fidnum, isFSctl, compfilter));
 
-        fsp=file_fsp((char *)*ppsetup, 4);
+        fsp=file_fsp(fidnum);
         /* this check is done in each implemented function case for now
            because I don't want to break anything... --metze
@@ -2252 +2544 @@
 
                 DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
-                send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
-                                0);
-                return -1;
-        
-        case FSCTL_0x000900C0:
-                /* pretend this succeeded - don't know what this really is
-                   but works ok like this --metze
+                send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+                return;
+
+        case FSCTL_CREATE_OR_GET_OBJECT_ID:
+        {
+                unsigned char objid[16];
+
+                /* This should return the object-id on this file.
+                 * I think I'll make this be the inode+dev. JRA.
                  */
 
-                DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum));
-                send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL,
-                                0);
-                return -1;
+                DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
+
+                if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
+                        return;
+                }
+
+                data_count = 64;
+                pdata = nttrans_realloc(ppdata, data_count);
+                if (pdata == NULL) {
+                        reply_nterror(req, NT_STATUS_NO_MEMORY);
+                        return;
+                }
+                push_file_id_16(pdata, &fsp->file_id);
+                memcpy(pdata+16,create_volume_objectid(conn,objid),16);
+                push_file_id_16(pdata+32, &fsp->file_id);
+                send_nt_replies(req, NT_STATUS_OK, NULL, 0,
+                                pdata, data_count);
+                return;
+        }
 
         case FSCTL_GET_REPARSE_POINT:
@@ -2272 +2581 @@
 
                 DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
-                send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
-                                NULL, 0, NULL, 0);
-                return -1;
+                reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
+                return;
 
         case FSCTL_SET_REPARSE_POINT:
@@ -2282 +2590 @@
 
                 DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
-                send_nt_replies(outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT,
-                                NULL, 0, NULL, 0);
-                return -1;
-                        
+                reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
+                return;
+
         case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
         {
@@ -2305 +2612 @@
                 char *cur_pdata;
 
-                FSP_BELONGS_CONN(fsp,conn);
+                if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
+                        return;
+                }
 
                 if (max_data_count < 16) {
                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
                                 max_data_count));
-                        return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                        return;
                 }
 
@@ -2320 +2630 @@
                 if (shadow_mem_ctx == NULL) {
                         DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n"));
-                        return ERROR_NT(NT_STATUS_NO_MEMORY);
+                        reply_nterror(req, NT_STATUS_NO_MEMORY);
+                        return;
                 }
 
@@ -2327 +2638 @@
                         DEBUG(0,("TALLOC_ZERO() failed!\n"));
                         talloc_destroy(shadow_mem_ctx);
-                        return ERROR_NT(NT_STATUS_NO_MEMORY);
-                }
-                
+                        reply_nterror(req, NT_STATUS_NO_MEMORY);
+                        return;
+                }
+
                 shadow_data->mem_ctx = shadow_mem_ctx;
-                
+
                 /*
                  * Call the VFS routine to actually do the work.
@@ -2340 +2652 @@
                                 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n", 
                                         conn->connectpath));
-                                return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
+                                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+                                return;
                         } else {
                                 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n", 
                                         conn->connectpath));
-                                return ERROR_NT(NT_STATUS_UNSUCCESSFUL);                        
+                                reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
+                                return;
                         }
                 }
@@ -2360 +2674 @@
                                 max_data_count,data_count));
                         talloc_destroy(shadow_data->mem_ctx);
-                        return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL);
+                        reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
+                        return;
                 }
 
@@ -2366 +2681 @@
                 if (pdata == NULL) {
                         talloc_destroy(shadow_data->mem_ctx);
-                        return ERROR_NT(NT_STATUS_NO_MEMORY);
-                }               
+                        reply_nterror(req, NT_STATUS_NO_MEMORY);
+                        return;
+                }
 
                 cur_pdata = pdata;
@@ -2388 +2704 @@
                 if (labels && shadow_data->labels) {
                         for (i=0;i<shadow_data->num_volumes;i++) {
-                                srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
+                                srvstr_push(pdata, req->flags2,
+                                            cur_pdata, shadow_data->labels[i],
+                                            2*sizeof(SHADOW_COPY_LABEL),
+                                            STR_UNICODE|STR_TERMINATE);
                                 cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
                                 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
@@ -2396 +2715 @@
                 talloc_destroy(shadow_data->mem_ctx);
 
-                send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
+                send_nt_replies(req, NT_STATUS_OK, NULL, 0,
                                 pdata, data_count);
 
-                return -1;
+                return;
         }
-        
+
         case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
         {
-                /* pretend this succeeded - 
-                 * 
+                /* pretend this succeeded -
+                 *
                  * we have to send back a list with all files owned by this SID
                  *
@@ -2413 +2732 @@
                 uid_t uid;
                 size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
-                
+
                 DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
 
-                FSP_BELONGS_CONN(fsp,conn);
+                if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
+                        return;
+                }
 
                 /* unknown 4 bytes: this is not the length of the sid :-(  */
                 /*unknown = IVAL(pdata,0);*/
-                
+
                 sid_parse(pdata+4,sid_len,&sid);
                 DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
@@ -2429 +2750 @@
                         uid = (-1);
                 }
-                
+
                 /* we can take a look at the find source :-)
                  *
@@ -2442 +2763 @@
                  *
                  * we don't send all files at once
-                 * and at the next we should *not* start from the beginning, 
-                 * so we have to cache the result 
+                 * and at the next we should *not* start from the beginning,
+                 * so we have to cache the result
                  *
                  * --metze
                  */
-                
+
                 /* this works for now... */
-                send_nt_replies(outbuf, bufsize, NT_STATUS_OK, NULL, 0,
-                                NULL, 0);
-                return -1;      
-        }       
+                send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+                return;
+        }
         default:
                 if (!logged_message) {
@@ -2461 +2781 @@
         }
 
-        return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
+        reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
 }
 
@@ -2467 +2787 @@
 #ifdef HAVE_SYS_QUOTAS
 /****************************************************************************
- Reply to get user quota 
+ Reply to get user quota
 ****************************************************************************/
 
-static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, 
-                                  uint16 **ppsetup, uint32 setup_count,
-                                  char **ppparams, uint32 parameter_count,
-                                  char **ppdata, uint32 data_count, uint32 max_data_count)
+static void call_nt_transact_get_user_quota(connection_struct *conn,
+                                            struct smb_request *req,
+                                            uint16 **ppsetup,
+                                            uint32 setup_count,
+                                            char **ppparams,
+                                            uint32 parameter_count,
+                                            char **ppdata,
+                                            uint32 data_count,
+                                            uint32 max_data_count)
 {
         NTSTATUS nt_status = NT_STATUS_OK;
@@ -2497 +2822 @@
                 DEBUG(1,("get_user_quota: access_denied service [%s] user [%s]\n",
                         lp_servicename(SNUM(conn)),conn->user));
-                return ERROR_DOS(ERRDOS,ERRnoaccess);
+                reply_doserror(req, ERRDOS, ERRnoaccess);
+                return;
         }
 
@@ -2506 +2832 @@
         if (parameter_count < 4) {
                 DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count));
-                return ERROR_DOS(ERRDOS,ERRinvalidparam);
-        }
-        
+                reply_doserror(req, ERRDOS, ERRinvalidparam);
+                return;
+        }
+
         /* maybe we can check the quota_fnum */
-        fsp = file_fsp(params,0);
+        fsp = file_fsp(SVAL(params,0));
         if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
                 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
-                return ERROR_NT(NT_STATUS_INVALID_HANDLE);
+                reply_nterror(req, NT_STATUS_INVALID_HANDLE);
+                return;
         }
 
@@ -2522 +2850 @@
 
         level = SVAL(params,2);
-        
-        /* unknown 12 bytes leading in params */ 
-        
+
+        /* unknown 12 bytes leading in params */
+
         switch (level) {
                 case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
                         /* seems that we should continue with the enum here --metze */
 
-                        if (qt_handle->quota_list!=NULL && 
+                        if (qt_handle->quota_list!=NULL &&
                             qt_handle->tmp_list==NULL) {
-                
+
                                 /* free the list */
                                 free_ntquota_list(&(qt_handle->quota_list));
@@ -2539 +2867 @@
                                 params = nttrans_realloc(ppparams, param_len);
                                 if(params == NULL) {
-                                        return ERROR_DOS(ERRDOS,ERRnomem);
+                                        reply_doserror(req, ERRDOS, ERRnomem);
+                                        return;
                                 }
 
@@ -2557 +2886 @@
                         }
 
-                        if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0)
-                                return ERROR_DOS(ERRSRV,ERRerror);
+                        if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) {
+                                reply_doserror(req, ERRSRV, ERRerror);
+                                return;
+                        }
 
                         /* Realloc the size of parameters and data we will return */
@@ -2564 +2895 @@
                         params = nttrans_realloc(ppparams, param_len);
                         if(params == NULL) {
-                                return ERROR_DOS(ERRDOS,ERRnomem);
+                                reply_doserror(req, ERRDOS, ERRnomem);
+                                return;
                         }
 
                         /* we should not trust the value in max_data_count*/
                         max_data_count = MIN(max_data_count,2048);
-                        
+
                         pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
                         if(pdata == NULL) {
-                                return ERROR_DOS(ERRDOS,ERRnomem);
+                                reply_doserror(req, ERRDOS, ERRnomem);
+                                return;
                         }
 
@@ -2579 +2912 @@
                         /* set params Size of returned Quota Data 4 bytes*/
                         /* but set it later when we know it */
-                
+
                         /* for each entry push the data */
 
@@ -2596 +2929 @@
                                 /* nextoffset entry 4 bytes */
                                 SIVAL(entry,0,entry_len);
-                
+
                                 /* then the len of the SID 4 bytes */
                                 SIVAL(entry,4,sid_len);
-                                
+
                                 /* unknown data 8 bytes SMB_BIG_UINT */
                                 SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
-                                
+
                                 /* the used disk space 8 bytes SMB_BIG_UINT */
                                 SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
-                                
+
                                 /* the soft quotas 8 bytes SMB_BIG_UINT */
                                 SBIG_UINT(entry,24,tmp_list->quotas->softlim);
-                                
+
                                 /* the hard quotas 8 bytes SMB_BIG_UINT */
                                 SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
-                                
+
                                 /* and now the SID */
                                 sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
                         }
-                        
+
                         qt_handle->tmp_list = tmp_list;
-                        
+
                         /* overwrite the offset of the last entry */
                         SIVAL(entry-entry_len,0,0);
@@ -2628 +2961 @@
 
                 case TRANSACT_GET_USER_QUOTA_FOR_SID:
-                        
-                        /* unknown 4 bytes IVAL(pdata,0) */     
-                        
+
+                        /* unknown 4 bytes IVAL(pdata,0) */
+
                         if (data_count < 8) {
                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
-                                return ERROR_DOS(ERRDOS,ERRunknownlevel);                               
+                                reply_doserror(req, ERRDOS, ERRunknownlevel);
+                                return;
                         }
 
@@ -2639 +2973 @@
                         /* Ensure this is less than 1mb. */
                         if (sid_len > (1024*1024)) {
-                                return ERROR_DOS(ERRDOS,ERRnomem);
+                                reply_doserror(req, ERRDOS, ERRnomem);
+                                return;
                         }
 
                         if (data_count < 8+sid_len) {
                                 DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %lu bytes data\n",data_count,(unsigned long)(8+sid_len)));
-                                return ERROR_DOS(ERRDOS,ERRunknownlevel);                               
+                                reply_doserror(req, ERRDOS, ERRunknownlevel);
+                                return;
                         }
 
@@ -2660 +2996 @@
 
                         sid_parse(pdata+8,sid_len,&sid);
-                
+
                         if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
                                 ZERO_STRUCT(qt);
-                                /* 
-                                 * we have to return zero's in all fields 
+                                /*
+                                 * we have to return zero's in all fields
                                  * instead of returning an error here
                                  * --metze
@@ -2674 +3010 @@
                         params = nttrans_realloc(ppparams, param_len);
                         if(params == NULL) {
-                                return ERROR_DOS(ERRDOS,ERRnomem);
+                                reply_doserror(req, ERRDOS, ERRnomem);
+                                return;
                         }
 
                         pdata = nttrans_realloc(ppdata, data_len);
                         if(pdata == NULL) {
-                                return ERROR_DOS(ERRDOS,ERRnomem);
+                                reply_doserror(req, ERRDOS, ERRnomem);
+                                return;
                         }
 
@@ -2686 +3024 @@
                         /* set params Size of returned Quota Data 4 bytes*/
                         SIVAL(params,0,data_len);
-        
+
                         /* nextoffset entry 4 bytes */
                         SIVAL(entry,0,0);
-        
+
                         /* then the len of the SID 4 bytes */
                         SIVAL(entry,4,sid_len);
-                        
+
                         /* unknown data 8 bytes SMB_BIG_UINT */
                         SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
-                        
+
                         /* the used disk space 8 bytes SMB_BIG_UINT */
                         SBIG_UINT(entry,16,qt.usedspace);
-                        
+
                         /* the soft quotas 8 bytes SMB_BIG_UINT */
                         SBIG_UINT(entry,24,qt.softlim);
-                        
+
                         /* the hard quotas 8 bytes SMB_BIG_UINT */
                         SBIG_UINT(entry,32,qt.hardlim);
-                        
+
                         /* and now the SID */
                         sid_linearize(entry+40, sid_len, &sid);
@@ -2712 +3050 @@
                 default:
                         DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level));
-                        return ERROR_DOS(ERRSRV,ERRerror);
+                        reply_doserror(req, ERRSRV, ERRerror);
+                        return;
                         break;
         }
 
-        send_nt_replies(outbuf, bufsize, nt_status, params, param_len,
+        send_nt_replies(req, nt_status, params, param_len,
                         pdata, data_len);
-
-        return -1;
 }
 
@@ -2726 +3063 @@
 ****************************************************************************/
 
-static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, 
-                                  uint16 **ppsetup, uint32 setup_count,
-                                  char **ppparams, uint32 parameter_count,
-                                  char **ppdata, uint32 data_count, uint32 max_data_count)
+static void call_nt_transact_set_user_quota(connection_struct *conn,
+                                            struct smb_request *req,
+                                            uint16 **ppsetup,
+                                            uint32 setup_count,
+                                            char **ppparams,
+                                            uint32 parameter_count,
+                                            char **ppdata,
+                                            uint32 data_count,
+                                            uint32 max_data_count)
 {
         char *params = *ppparams;
@@ -2745 +3087 @@
                 DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
                         lp_servicename(SNUM(conn)),conn->user));
-                return ERROR_DOS(ERRDOS,ERRnoaccess);
+                reply_doserror(req, ERRDOS, ERRnoaccess);
+                return;
         }
 
@@ -2754 +3097 @@
         if (parameter_count < 2) {
                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
-                return ERROR_DOS(ERRDOS,ERRinvalidparam);
-        }
-        
+                reply_doserror(req, ERRDOS, ERRinvalidparam);
+                return;
+        }
+
         /* maybe we can check the quota_fnum */
-        fsp = file_fsp(params,0);
+        fsp = file_fsp(SVAL(params,0));
         if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
                 DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
-                return ERROR_NT(NT_STATUS_INVALID_HANDLE);
+                reply_nterror(req, NT_STATUS_INVALID_HANDLE);
+                return;
         }
 
         if (data_count < 40) {
                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
-                return ERROR_DOS(ERRDOS,ERRunknownlevel);               
+                reply_doserror(req, ERRDOS, ERRunknownlevel);
+                return;
         }
 
@@ -2779 +3125 @@
         if (data_count < 40+sid_len) {
                 DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
-                return ERROR_DOS(ERRDOS,ERRunknownlevel);               
-        }
-
-        /* unknown 8 bytes in pdata 
+                reply_doserror(req, ERRDOS, ERRunknownlevel);
+                return;
+        }
+
+        /* unknown 8 bytes in pdata
          * maybe its the change time in NTTIME
          */
@@ -2795 +3142 @@
                 (IVAL(pdata,20)!=0xFFFFFFFF))) {
                 /* more than 32 bits? */
-                return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                reply_doserror(req, ERRDOS, ERRunknownlevel);
+                return;
         }
 #endif /* LARGE_SMB_OFF_T */
@@ -2808 +3156 @@
                 (IVAL(pdata,28)!=0xFFFFFFFF))) {
                 /* more than 32 bits? */
-                return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                reply_doserror(req, ERRDOS, ERRunknownlevel);
+                return;
         }
 #endif /* LARGE_SMB_OFF_T */
@@ -2821 +3170 @@
                 (IVAL(pdata,36)!=0xFFFFFFFF))) {
                 /* more than 32 bits? */
-                return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                reply_doserror(req, ERRDOS, ERRunknownlevel);
+                return;
         }
 #endif /* LARGE_SMB_OFF_T */
-        
+
         sid_parse(pdata+40,sid_len,&sid);
         DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
@@ -2831 +3181 @@
 
         if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
-                return ERROR_DOS(ERRSRV,ERRerror);      
-        }
-
-        send_nt_replies(outbuf, bufsize, NT_STATUS_OK, params, param_len,
+                reply_doserror(req, ERRSRV, ERRerror);
+                return;
+        }
+
+        send_nt_replies(req, NT_STATUS_OK, params, param_len,
                         pdata, data_len);
-
-        return -1;
 }
 #endif /* HAVE_SYS_QUOTAS */
 
-static int handle_nttrans(connection_struct *conn,
-                          struct trans_state *state,
-                          char *inbuf, char *outbuf, int size, int bufsize)
+static void handle_nttrans(connection_struct *conn,
+                           struct trans_state *state,
+                           struct smb_request *req)
 {
-        int outsize;
-
         if (Protocol >= PROTOCOL_NT1) {
-                SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | 0x40); /* IS_LONG_NAME */
+                req->flags2 |= 0x40; /* IS_LONG_NAME */
+                SSVAL(req->inbuf,smb_flg2,req->flags2);
         }
 
@@ -2856 +3204 @@
                 {
                         START_PROFILE(NT_transact_create);
-                        outsize = call_nt_transact_create(conn, inbuf, outbuf,
-                                                          size, bufsize, 
-                                                        &state->setup, state->setup_count,
-                                                        &state->param, state->total_param, 
-                                                        &state->data, state->total_data,
-                                                          state->max_data_return);
+                        call_nt_transact_create(
+                                conn, req,
+                                &state->setup, state->setup_count,
+                                &state->param, state->total_param,
+                                &state->data, state->total_data,
+                                state->max_data_return);
                         END_PROFILE(NT_transact_create);
                         break;
@@ -2869 +3217 @@
                 {
                         START_PROFILE(NT_transact_ioctl);
-                        outsize = call_nt_transact_ioctl(conn, inbuf, outbuf,
-                                                         size, bufsize, 
-                                                         &state->setup, state->setup_count,
-                                                         &state->param, state->total_param, 
-                                                         &state->data, state->total_data, state->max_data_return);
+                        call_nt_transact_ioctl(
+                                conn, req,
+                                &state->setup, state->setup_count,
+                                &state->param, state->total_param,
+                                &state->data, state->total_data,
+                                state->max_data_return);
                         END_PROFILE(NT_transact_ioctl);
                         break;
@@ -2881 +3230 @@
                 {
                         START_PROFILE(NT_transact_set_security_desc);
-                        outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf, 
-                                                         size, bufsize, 
-                                                         &state->setup, state->setup_count,
-                                                         &state->param, state->total_param, 
-                                                         &state->data, state->total_data, state->max_data_return);
+                        call_nt_transact_set_security_desc(
+                                conn, req,
+                                &state->setup, state->setup_count,
+                                &state->param, state->total_param,
+                                &state->data, state->total_data,
+                                state->max_data_return);
                         END_PROFILE(NT_transact_set_security_desc);
                         break;
@@ -2893 +3243 @@
                 {
                         START_PROFILE(NT_transact_notify_change);
-                        outsize = call_nt_transact_notify_change(
-                                conn, inbuf, outbuf, size, bufsize, 
+                        call_nt_transact_notify_change(
+                                conn, req,
                                 &state->setup, state->setup_count,
-                                &state->param, state->total_param, 
+                                &state->param, state->total_param,
                                 &state->data, state->total_data,
                                 state->max_data_return,
@@ -2907 +3257 @@
                 {
                         START_PROFILE(NT_transact_rename);
-                        outsize = call_nt_transact_rename(conn, inbuf, outbuf,
-                                                         size, bufsize, 
-                                                         &state->setup, state->setup_count,
-                                                         &state->param, state->total_param, 
-                                                         &state->data, state->total_data, state->max_data_return);
+                        call_nt_transact_rename(
+                                conn, req,
+                                &state->setup, state->setup_count,
+                                &state->param, state->total_param,
+                                &state->data, state->total_data,
+                                state->max_data_return);
                         END_PROFILE(NT_transact_rename);
                         break;
@@ -2919 +3270 @@
                 {
                         START_PROFILE(NT_transact_query_security_desc);
-                        outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf, 
-                                                         size, bufsize, 
-                                                         &state->setup, state->setup_count,
-                                                         &state->param, state->total_param, 
-                                                         &state->data, state->total_data, state->max_data_return);
+                        call_nt_transact_query_security_desc(
+                                conn, req,
+                                &state->setup, state->setup_count,
+                                &state->param, state->total_param,
+                                &state->data, state->total_data,
+                                state->max_data_return);
                         END_PROFILE(NT_transact_query_security_desc);
                         break;
@@ -2932 +3284 @@
                 {
                         START_PROFILE(NT_transact_get_user_quota);
-                        outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf, 
-                                                         size, bufsize, 
-                                                         &state->setup, state->setup_count,
-                                                         &state->param, state->total_param, 
-                                                         &state->data, state->total_data, state->max_data_return);
+                        call_nt_transact_get_user_quota(
+                                conn, req,
+                                &state->setup, state->setup_count,
+                                &state->param, state->total_param,
+                                &state->data, state->total_data,
+                                state->max_data_return);
                         END_PROFILE(NT_transact_get_user_quota);
                         break;
@@ -2944 +3297 @@
                 {
                         START_PROFILE(NT_transact_set_user_quota);
-                        outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf, 
-                                                         size, bufsize, 
-                                                         &state->setup, state->setup_count,
-                                                         &state->param, state->total_param, 
-                                                         &state->data, state->total_data, state->max_data_return);
+                        call_nt_transact_set_user_quota(
+                                conn, req,
+                                &state->setup, state->setup_count,
+                                &state->param, state->total_param,
+                                &state->data, state->total_data,
+                                state->max_data_return);
                         END_PROFILE(NT_transact_set_user_quota);
-                        break;                                  
+                        break;
                 }
 #endif /* HAVE_SYS_QUOTAS */
@@ -2956 +3310 @@
                 default:
                         /* Error in request */
-                        DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n",
-                                 state->call));
-                        return ERROR_DOS(ERRSRV,ERRerror);
-        }
-        return outsize;
+                        DEBUG(0,("handle_nttrans: Unknown request %d in "
+                                 "nttrans call\n", state->call));
+                        reply_doserror(req, ERRSRV, ERRerror);
+                        return;
+        }
+        return;
 }
 
@@ -2967 +3322 @@
 ****************************************************************************/
 
-int reply_nttrans(connection_struct *conn,
-                        char *inbuf,char *outbuf,int size,int bufsize)
+void reply_nttrans(connection_struct *conn, struct smb_request *req)
 {
-        int  outsize = 0;
-        uint32 pscnt = IVAL(inbuf,smb_nt_ParameterCount);
-        uint32 psoff = IVAL(inbuf,smb_nt_ParameterOffset);
-        uint32 dscnt = IVAL(inbuf,smb_nt_DataCount);
-        uint32 dsoff = IVAL(inbuf,smb_nt_DataOffset);
-        
-        uint16 function_code = SVAL( inbuf, smb_nt_Function);
+        uint32 pscnt;
+        uint32 psoff;
+        uint32 dscnt;
+        uint32 dsoff;
+        uint16 function_code;
         NTSTATUS result;
         struct trans_state *state;
+        int size;
 
         START_PROFILE(SMBnttrans);
 
+        if (req->wct < 19) {
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                END_PROFILE(SMBnttrans);
+                return;
+        }
+
+        size = smb_len(req->inbuf) + 4;
+        pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
+        psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
+        dscnt = IVAL(req->inbuf,smb_nt_DataCount);
+        dsoff = IVAL(req->inbuf,smb_nt_DataOffset);
+        function_code = SVAL(req->inbuf, smb_nt_Function);
+
         if (IS_IPC(conn) && (function_code != NT_TRANSACT_CREATE)) {
+                reply_doserror(req, ERRSRV, ERRaccess);
                 END_PROFILE(SMBnttrans);
-                return ERROR_DOS(ERRSRV,ERRaccess);
-        }
-
-        result = allow_new_trans(conn->pending_trans, SVAL(inbuf, smb_mid));
+                return;
+        }
+
+        result = allow_new_trans(conn->pending_trans, req->mid);
         if (!NT_STATUS_IS_OK(result)) {
                 DEBUG(2, ("Got invalid nttrans request: %s\n", nt_errstr(result)));
+                reply_nterror(req, result);
                 END_PROFILE(SMBnttrans);
-                return ERROR_NT(result);
+                return;
         }
 
         if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
+                reply_doserror(req, ERRSRV, ERRaccess);
                 END_PROFILE(SMBnttrans);
-                return ERROR_DOS(ERRSRV,ERRaccess);
+                return;
         }
 
         state->cmd = SMBnttrans;
 
-        state->mid = SVAL(inbuf,smb_mid);
-        state->vuid = SVAL(inbuf,smb_uid);
-        state->total_data = IVAL(inbuf, smb_nt_TotalDataCount);
+        state->mid = req->mid;
+        state->vuid = req->vuid;
+        state->total_data = IVAL(req->inbuf, smb_nt_TotalDataCount);
         state->data = NULL;
-        state->total_param = IVAL(inbuf, smb_nt_TotalParameterCount);
+        state->total_param = IVAL(req->inbuf, smb_nt_TotalParameterCount);
         state->param = NULL;
-        state->max_data_return = IVAL(inbuf,smb_nt_MaxDataCount);       
-        state->max_param_return = IVAL(inbuf,smb_nt_MaxParameterCount);
+        state->max_data_return = IVAL(req->inbuf,smb_nt_MaxDataCount);
+        state->max_param_return = IVAL(req->inbuf,smb_nt_MaxParameterCount);
 
         /* setup count is in *words* */
-        state->setup_count = 2*CVAL(inbuf,smb_nt_SetupCount); 
+        state->setup_count = 2*CVAL(req->inbuf,smb_nt_SetupCount);
         state->setup = NULL;
         state->call = function_code;
 
-        /* 
+        /*
          * All nttrans messages we handle have smb_wct == 19 +
          * state->setup_count.  Ensure this is so as a sanity check.
          */
 
-        if(CVAL(inbuf, smb_wct) != 19 + (state->setup_count/2)) {
+        if(req->wct != 19 + (state->setup_count/2)) {
                 DEBUG(2,("Invalid smb_wct %d in nttrans call (should be %d)\n",
-                        CVAL(inbuf, smb_wct), 19 + (state->setup_count/2)));
+                         req->wct, 19 + (state->setup_count/2)));
                 goto bad_param;
         }
@@ -3029 +3398 @@
         if ((state->total_data > (1024*1024*128)) ||
             (state->total_param > (1024*1024*128))) {
+                reply_doserror(req, ERRDOS, ERRnomem);
                 END_PROFILE(SMBnttrans);
-                return ERROR_DOS(ERRDOS,ERRnomem);
+                return;
         }
 
@@ -3043 +3413 @@
                                  "bytes !\n", (unsigned int)state->total_data));
                         TALLOC_FREE(state);
+                        reply_doserror(req, ERRDOS, ERRnomem);
                         END_PROFILE(SMBnttrans);
-                        return(ERROR_DOS(ERRDOS,ERRnomem));
-                } 
+                        return;
+                }
                 if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
                         goto bad_param;
-                if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) ||
-                    (smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
+                if ((smb_base(req->inbuf)+dsoff+dscnt
+                     > (char *)req->inbuf + size) ||
+                    (smb_base(req->inbuf)+dsoff+dscnt < smb_base(req->inbuf)))
                         goto bad_param;
 
-                memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
+                memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
         }
 
@@ -3063 +3435 @@
                         SAFE_FREE(state->data);
                         TALLOC_FREE(state);
+                        reply_doserror(req, ERRDOS, ERRnomem);
                         END_PROFILE(SMBnttrans);
-                        return(ERROR_DOS(ERRDOS,ERRnomem));
-                } 
+                        return;
+                }
                 if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
                         goto bad_param;
-                if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) ||
-                    (smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
+                if ((smb_base(req->inbuf)+psoff+pscnt
+                     > (char *)req->inbuf + size) ||
+                    (smb_base(req->inbuf)+psoff+pscnt < smb_base(req->inbuf)))
                         goto bad_param;
 
-                memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
+                memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
         }
 
@@ -3087 +3461 @@
                         SAFE_FREE(state->param);
                         TALLOC_FREE(state);
+                        reply_doserror(req, ERRDOS, ERRnomem);
                         END_PROFILE(SMBnttrans);
-                        return ERROR_DOS(ERRDOS,ERRnomem);
+                        return;
                 }
 
@@ -3099 +3474 @@
                 }
 
-                memcpy( state->setup, &inbuf[smb_nt_SetupStart], state->setup_count);
-                dump_data(10, (char *)state->setup, state->setup_count);
+                memcpy( state->setup, &req->inbuf[smb_nt_SetupStart],
+                        state->setup_count);
+                dump_data(10, (uint8 *)state->setup, state->setup_count);
         }
 
         if ((state->received_data == state->total_data) &&
             (state->received_param == state->total_param)) {
-                outsize = handle_nttrans(conn, state, inbuf, outbuf,
-                                         size, bufsize);
+                handle_nttrans(conn, state, req);
                 SAFE_FREE(state->param);
                 SAFE_FREE(state->data);
                 TALLOC_FREE(state);
                 END_PROFILE(SMBnttrans);
-                return outsize;
+                return;
         }
 
@@ -3118 +3493 @@
         /* We need to send an interim response then receive the rest
            of the parameter/data bytes */
-        outsize = set_message(outbuf,0,0,False);
-        show_msg(outbuf);
+        reply_outbuf(req, 0, 0);
+        show_msg((char *)req->outbuf);
         END_PROFILE(SMBnttrans);
-        return outsize;
+        return;
 
   bad_param:
@@ -3129 +3504 @@
         SAFE_FREE(state->param);
         TALLOC_FREE(state);
+        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
         END_PROFILE(SMBnttrans);
-        return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+        return;
 }
-        
+
 /****************************************************************************
  Reply to a SMBnttranss
  ****************************************************************************/
 
-int reply_nttranss(connection_struct *conn,  char *inbuf,char *outbuf,
-                   int size,int bufsize)
+void reply_nttranss(connection_struct *conn, struct smb_request *req)
 {
-        int outsize = 0;
         unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
         struct trans_state *state;
 
+        int size;
+
         START_PROFILE(SMBnttranss);
 
-        show_msg(inbuf);
+        show_msg((char *)req->inbuf);
+
+        if (req->wct < 18) {
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                END_PROFILE(SMBnttranss);
+                return;
+        }
 
         for (state = conn->pending_trans; state != NULL;
              state = state->next) {
-                if (state->mid == SVAL(inbuf,smb_mid)) {
+                if (state->mid == req->mid) {
                         break;
                 }
@@ -3156 +3538 @@
 
         if ((state == NULL) || (state->cmd != SMBnttrans)) {
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                 END_PROFILE(SMBnttranss);
-                return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                return;
         }
 
         /* Revise state->total_param and state->total_data in case they have
            changed downwards */
-        if (IVAL(inbuf, smb_nts_TotalParameterCount) < state->total_param) {
-                state->total_param = IVAL(inbuf, smb_nts_TotalParameterCount);
-        }
-        if (IVAL(inbuf, smb_nts_TotalDataCount) < state->total_data) {
-                state->total_data = IVAL(inbuf, smb_nts_TotalDataCount);
-        }
-
-        pcnt = IVAL(inbuf,smb_nts_ParameterCount);
-        poff = IVAL(inbuf, smb_nts_ParameterOffset);
-        pdisp = IVAL(inbuf, smb_nts_ParameterDisplacement);
-
-        dcnt = IVAL(inbuf, smb_nts_DataCount);
-        ddisp = IVAL(inbuf, smb_nts_DataDisplacement);
-        doff = IVAL(inbuf, smb_nts_DataOffset);
+        if (IVAL(req->inbuf, smb_nts_TotalParameterCount)
+            < state->total_param) {
+                state->total_param = IVAL(req->inbuf,
+                                          smb_nts_TotalParameterCount);
+        }
+        if (IVAL(req->inbuf, smb_nts_TotalDataCount) < state->total_data) {
+                state->total_data = IVAL(req->inbuf, smb_nts_TotalDataCount);
+        }
+
+        size = smb_len(req->inbuf) + 4;
+
+        pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
+        poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
+        pdisp = IVAL(req->inbuf, smb_nts_ParameterDisplacement);
+
+        dcnt = IVAL(req->inbuf, smb_nts_DataCount);
+        ddisp = IVAL(req->inbuf, smb_nts_DataDisplacement);
+        doff = IVAL(req->inbuf, smb_nts_DataOffset);
 
         state->received_param += pcnt;
         state->received_data += dcnt;
-                
+
         if ((state->received_data > state->total_data) ||
             (state->received_param > state->total_param))
@@ -3191 +3578 @@
                 if (pdisp > state->total_param)
                         goto bad_param;
-                if ((smb_base(inbuf) + poff + pcnt > inbuf + size) ||
-                    (smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
+                if ((smb_base(req->inbuf) + poff + pcnt
+                     > (char *)req->inbuf + size) ||
+                    (smb_base(req->inbuf) + poff + pcnt
+                     < smb_base(req->inbuf)))
                         goto bad_param;
                 if (state->param + pdisp < state->param)
                         goto bad_param;
 
-                memcpy(state->param+pdisp,smb_base(inbuf)+poff,
+                memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
                        pcnt);
         }
@@ -3208 +3597 @@
                 if (ddisp > state->total_data)
                         goto bad_param;
-                if ((smb_base(inbuf) + doff + dcnt > inbuf + size) ||
-                    (smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
+                if ((smb_base(req->inbuf) + doff + dcnt
+                     > (char *)req->inbuf + size) ||
+                    (smb_base(req->inbuf) + doff + dcnt
+                     < smb_base(req->inbuf)))
                         goto bad_param;
                 if (state->data + ddisp < state->data)
                         goto bad_param;
 
-                memcpy(state->data+ddisp, smb_base(inbuf)+doff,
-                       dcnt);      
+                memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
+                       dcnt);
         }
 
@@ -3221 +3612 @@
             (state->received_data < state->total_data)) {
                 END_PROFILE(SMBnttranss);
-                return -1;
-        }
-
-        /* construct_reply_common has done us the favor to pre-fill the
-         * command field with SMBnttranss which is wrong :-)
-         */
-        SCVAL(outbuf,smb_com,SMBnttrans);
-
-        outsize = handle_nttrans(conn, state, inbuf, outbuf,
-                                 size, bufsize);
+                return;
+        }
+
+        /*
+         * construct_reply_common will copy smb_com from inbuf to
+         * outbuf. SMBnttranss is wrong here.
+         */
+        SCVAL(req->inbuf,smb_com,SMBnttrans);
+
+        handle_nttrans(conn, state, req);
 
         DLIST_REMOVE(conn->pending_trans, state);
@@ -3236 +3627 @@
         SAFE_FREE(state->param);
         TALLOC_FREE(state);
-
-        if (outsize == 0) {
-                END_PROFILE(SMBnttranss);
-                return(ERROR_DOS(ERRSRV,ERRnosupport));
-        }
-        
         END_PROFILE(SMBnttranss);
-        return(outsize);
+        return;
 
   bad_param:
@@ -3252 +3637 @@
         SAFE_FREE(state->param);
         TALLOC_FREE(state);
+        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
         END_PROFILE(SMBnttranss);
-        return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+        return;
 }