Changeset 988 for vendor/current/source3/smbd/reply.c

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

File:

• vendor/current/source3/smbd/reply.c (modified) (288 diffs)

vendor/current/source3/smbd/reply.c

@@ -33 +33 @@
 #include "rpc_client/rpc_client.h"
 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
+#include "../librpc/gen_ndr/open_files.h"
 #include "rpc_client/cli_spoolss.h"
 #include "rpc_client/init_spoolss.h"
@@ -40 +41 @@
 #include "auth.h"
 #include "smbprofile.h"
+#include "../lib/tsocket/tsocket.h"
+#include "lib/tevent_wait.h"
+#include "libcli/smb/smb_signing.h"
+#include "lib/util/sys_rw_data.h"
 
 /****************************************************************************
@@ -249 +254 @@
 /****************************************************************************
  Pull a string and check the path allowing a wilcard - provide for error return.
+ Passes in posix flag.
 ****************************************************************************/
 
-size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
+static size_t srvstr_get_path_wcard_internal(TALLOC_CTX *ctx,
                         const char *base_ptr,
-                        uint16 smb_flags2,
+                        uint16_t smb_flags2,
                         char **pp_dest,
                         const char *src,
                         size_t src_len,
                         int flags,
+                        bool posix_pathnames,
                         NTSTATUS *err,
                         bool *contains_wcard)
@@ -284 +291 @@
         }
 
-        if (lp_posix_pathnames()) {
+        if (posix_pathnames) {
                 *err = check_path_syntax_posix(*pp_dest);
         } else {
@@ -294 +301 @@
 
 /****************************************************************************
+ Pull a string and check the path allowing a wilcard - provide for error return.
+****************************************************************************/
+
+size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
+                        const char *base_ptr,
+                        uint16_t smb_flags2,
+                        char **pp_dest,
+                        const char *src,
+                        size_t src_len,
+                        int flags,
+                        NTSTATUS *err,
+                        bool *contains_wcard)
+{
+        return srvstr_get_path_wcard_internal(ctx,
+                        base_ptr,
+                        smb_flags2,
+                        pp_dest,
+                        src,
+                        src_len,
+                        flags,
+                        false,
+                        err,
+                        contains_wcard);
+}
+
+/****************************************************************************
+ Pull a string and check the path allowing a wilcard - provide for error return.
+ posix_pathnames version.
+****************************************************************************/
+
+size_t srvstr_get_path_wcard_posix(TALLOC_CTX *ctx,
+                        const char *base_ptr,
+                        uint16_t smb_flags2,
+                        char **pp_dest,
+                        const char *src,
+                        size_t src_len,
+                        int flags,
+                        NTSTATUS *err,
+                        bool *contains_wcard)
+{
+        return srvstr_get_path_wcard_internal(ctx,
+                        base_ptr,
+                        smb_flags2,
+                        pp_dest,
+                        src,
+                        src_len,
+                        flags,
+                        true,
+                        err,
+                        contains_wcard);
+}
+
+/****************************************************************************
  Pull a string and check the path - provide for error return.
 ****************************************************************************/
@@ -299 +359 @@
 size_t srvstr_get_path(TALLOC_CTX *ctx,
                         const char *base_ptr,
-                        uint16 smb_flags2,
+                        uint16_t smb_flags2,
                         char **pp_dest,
                         const char *src,
@@ -307 +367 @@
 {
         bool ignore;
-        return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
-                                     src_len, flags, err, &ignore);
-}
+        return srvstr_get_path_wcard_internal(ctx,
+                        base_ptr,
+                        smb_flags2,
+                        pp_dest,
+                        src,
+                        src_len,
+                        flags,
+                        false,
+                        err,
+                        &ignore);
+}
+
+/****************************************************************************
+ Pull a string and check the path - provide for error return.
+ posix_pathnames version.
+****************************************************************************/
+
+size_t srvstr_get_path_posix(TALLOC_CTX *ctx,
+                        const char *base_ptr,
+                        uint16_t smb_flags2,
+                        char **pp_dest,
+                        const char *src,
+                        size_t src_len,
+                        int flags,
+                        NTSTATUS *err)
+{
+        bool ignore;
+        return srvstr_get_path_wcard_internal(ctx,
+                        base_ptr,
+                        smb_flags2,
+                        pp_dest,
+                        src,
+                        src_len,
+                        flags,
+                        true,
+                        err,
+                        &ignore);
+}
+
 
 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
@@ -315 +411 @@
                                  NTSTATUS *err, bool *contains_wcard)
 {
-        return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
-                                     pp_dest, src, smbreq_bufrem(req, src),
-                                     flags, err, contains_wcard);
+        ssize_t bufrem = smbreq_bufrem(req, src);
+
+        if (bufrem < 0) {
+                *err = NT_STATUS_INVALID_PARAMETER;
+                return 0;
+        }
+
+        if (req->posix_pathnames) {
+                return srvstr_get_path_wcard_internal(mem_ctx,
+                                (const char *)req->inbuf,
+                                req->flags2,
+                                pp_dest,
+                                src,
+                                bufrem,
+                                flags,
+                                true,
+                                err,
+                                contains_wcard);
+        } else {
+                return srvstr_get_path_wcard_internal(mem_ctx,
+                                (const char *)req->inbuf,
+                                req->flags2,
+                                pp_dest,
+                                src,
+                                bufrem,
+                                flags,
+                                false,
+                                err,
+                                contains_wcard);
+        }
 }
 
@@ -327 +450 @@
         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
                                          flags, err, &ignore);
+}
+
+/**
+ * pull a string from the smb_buf part of a packet. In this case the
+ * string can either be null terminated or it can be terminated by the
+ * end of the smbbuf area
+ */
+size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
+                              char **dest, const uint8_t *src, int flags)
+{
+        ssize_t bufrem = smbreq_bufrem(req, src);
+
+        if (bufrem < 0) {
+                return 0;
+        }
+
+        return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
+                                  bufrem, flags);
 }
 
@@ -400 +541 @@
 }
 
-static bool netbios_session_retarget(struct smbd_server_connection *sconn,
+static bool netbios_session_retarget(struct smbXsrv_connection *xconn,
                                      const char *name, int name_type)
 {
@@ -409 +550 @@
         char *p;
         int retarget_type = 0x20;
-        int retarget_port = 139;
+        int retarget_port = NBT_SMB_PORT;
         struct sockaddr_storage retarget_addr;
         struct sockaddr_in *in_addr;
@@ -415 +556 @@
         uint8_t outbuf[10];
 
-        if (get_socket_port(sconn->sock) != 139) {
+        if (get_socket_port(xconn->transport.sock) != NBT_SMB_PORT) {
                 return false;
         }
@@ -480 +621 @@
         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 
-        if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
+        if (!srv_send_smb(xconn, (char *)outbuf, false, 0, false,
                           NULL)) {
-                exit_server_cleanly("netbios_session_regarget: srv_send_smb "
+                exit_server_cleanly("netbios_session_retarget: srv_send_smb "
                                     "failed.");
         }
@@ -492 +633 @@
 }
 
+static void reply_called_name_not_present(char *outbuf)
+{
+        smb_setlen(outbuf, 1);
+        SCVAL(outbuf, 0, 0x83);
+        SCVAL(outbuf, 4, 0x82);
+}
+
 /****************************************************************************
  Reply to a (netbios-level) special message. 
 ****************************************************************************/
 
-void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
-{
+void reply_special(struct smbXsrv_connection *xconn, char *inbuf, size_t inbuf_size)
+{
+        struct smbd_server_connection *sconn = xconn->client->sconn;
         int msg_type = CVAL(inbuf,0);
         int msg_flags = CVAL(inbuf,1);
@@ -512 +661 @@
 
         switch (msg_type) {
-        case 0x81: /* session request */
+        case NBSSrequest: /* session request */
         {
                 /* inbuf_size is guarenteed to be at least 4. */
@@ -521 +670 @@
                 *name1 = *name2 = 0;
 
-                if (sconn->nbt.got_session) {
+                if (xconn->transport.nbt.got_session) {
                         exit_server_cleanly("multiple session request not permitted");
                 }
 
-                SCVAL(outbuf,0,0x82);
+                SCVAL(outbuf,0,NBSSpositive);
                 SCVAL(outbuf,3,0);
 
@@ -532 +681 @@
                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
                         DEBUG(0,("Invalid name length in session request\n"));
+                        reply_called_name_not_present(outbuf);
                         break;
                 }
@@ -537 +687 @@
                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
                         DEBUG(0,("Invalid name length in session request\n"));
+                        reply_called_name_not_present(outbuf);
                         break;
                 }
@@ -547 +698 @@
                 if (name_type1 == -1 || name_type2 == -1) {
                         DEBUG(0,("Invalid name type in session request\n"));
+                        reply_called_name_not_present(outbuf);
                         break;
                 }
@@ -553 +705 @@
                          name1, name_type1, name2, name_type2));
 
-                if (netbios_session_retarget(sconn, name1, name_type1)) {
+                if (netbios_session_retarget(xconn, name1, name_type1)) {
                         exit_server_cleanly("retargeted client");
                 }
@@ -563 +715 @@
                 if (strequal(name1, "*SMBSERVER     ")
                     || strequal(name1, "*SMBSERV       "))  {
-                        fstrcpy(name1, sconn->client_id.addr);
+                        char *raddr;
+
+                        raddr = tsocket_address_inet_addr_string(sconn->remote_address,
+                                                                 talloc_tos());
+                        if (raddr == NULL) {
+                                exit_server_cleanly("could not allocate raddr");
+                        }
+
+                        fstrcpy(name1, raddr);
                 }
 
                 set_local_machine_name(name1, True);
                 set_remote_machine_name(name2, True);
+
+                if (is_ipaddress(sconn->remote_hostname)) {
+                        char *p = discard_const_p(char, sconn->remote_hostname);
+
+                        talloc_free(p);
+
+                        sconn->remote_hostname = talloc_strdup(sconn,
+                                                get_remote_machine_name());
+                        if (sconn->remote_hostname == NULL) {
+                                exit_server_cleanly("could not copy remote name");
+                        }
+                        xconn->remote_hostname = sconn->remote_hostname;
+                }
 
                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
@@ -576 +749 @@
                         /* We are being asked for a pathworks session --- 
                            no thanks! */
-                        SCVAL(outbuf, 0,0x83);
+                        reply_called_name_not_present(outbuf);
                         break;
                 }
 
-                /* only add the client's machine name to the list
-                   of possibly valid usernames if we are operating
-                   in share mode security */
-                if (lp_security() == SEC_SHARE) {
-                        add_session_user(sconn, get_remote_machine_name());
-                }
-
-                reload_services(sconn->msg_ctx, sconn->sock, True);
+                reload_services(sconn, conn_snum_used, true);
                 reopen_logs();
 
-                sconn->nbt.got_session = true;
+                xconn->transport.nbt.got_session = true;
                 break;
         }
@@ -596 +762 @@
         case 0x89: /* session keepalive request 
                       (some old clients produce this?) */
-                SCVAL(outbuf,0,SMBkeepalive);
+                SCVAL(outbuf,0,NBSSkeepalive);
                 SCVAL(outbuf,3,0);
                 break;
 
-        case 0x82: /* positive session response */
-        case 0x83: /* negative session response */
-        case 0x84: /* retarget session response */
+        case NBSSpositive: /* positive session response */
+        case NBSSnegative: /* negative session response */
+        case NBSSretarget: /* retarget session response */
                 DEBUG(0,("Unexpected session response\n"));
                 break;
 
-        case SMBkeepalive: /* session keepalive */
+        case NBSSkeepalive: /* session keepalive */
         default:
                 return;
@@ -614 +780 @@
                     msg_type, msg_flags));
 
-        srv_send_smb(sconn, outbuf, false, 0, false, NULL);
+        srv_send_smb(xconn, outbuf, false, 0, false, NULL);
+
+        if (CVAL(outbuf, 0) != 0x82) {
+                exit_server_cleanly("invalid netbios session");
+        }
         return;
 }
@@ -632 +802 @@
         int pwlen=0;
         NTSTATUS nt_status;
-        const char *p;
-        DATA_BLOB password_blob;
+        const uint8_t *p;
+        const char *p2;
         TALLOC_CTX *ctx = talloc_tos();
-        struct smbd_server_connection *sconn = req->sconn;
+        struct smbXsrv_connection *xconn = req->xconn;
+        NTTIME now = timeval_to_nttime(&req->request_time);
 
         START_PROFILE(SMBtcon);
@@ -645 +816 @@
         }
 
-        p = (const char *)req->buf + 1;
+        p = req->buf + 1;
         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
         p += 1;
@@ -658 +829 @@
                 return;
         }
-        p = strrchr_m(service_buf,'\\');
-        if (p) {
-                service = p+1;
+        p2 = strrchr_m(service_buf,'\\');
+        if (p2) {
+                service = p2+1;
         } else {
                 service = service_buf;
         }
 
-        password_blob = data_blob(password, pwlen+1);
-
-        conn = make_connection(sconn,service,password_blob,dev,
+        conn = make_connection(req, now, service, dev,
                                req->vuid,&nt_status);
         req->conn = conn;
-
-        data_blob_clear_free(&password_blob);
 
         if (!conn) {
@@ -680 +847 @@
 
         reply_outbuf(req, 2, 0);
-        SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
+        SSVAL(req->outbuf,smb_vwv0,xconn->smb1.negprot.max_recv);
         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
         SSVAL(req->outbuf,smb_tid,conn->cnum);
@@ -700 +867 @@
         connection_struct *conn = req->conn;
         const char *service = NULL;
-        DATA_BLOB password;
         TALLOC_CTX *ctx = talloc_tos();
         /* what the cleint thinks the device is */
@@ -709 +875 @@
         int passlen;
         char *path = NULL;
-        const char *p, *q;
-        uint16 tcon_flags;
-        struct smbd_server_connection *sconn = req->sconn;
+        const uint8_t *p;
+        const char *q;
+        uint16_t tcon_flags;
+        struct smbXsrv_session *session = NULL;
+        NTTIME now = timeval_to_nttime(&req->request_time);
+        bool session_key_updated = false;
+        uint16_t optional_support = 0;
+        struct smbXsrv_connection *xconn = req->xconn;
 
         START_PROFILE(SMBtconX);
@@ -725 +896 @@
 
         /* we might have to close an old one */
-        if ((tcon_flags & 0x1) && conn) {
-                close_cnum(conn,req->vuid);
+        if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
+                struct smbXsrv_tcon *tcon;
+                NTSTATUS status;
+
+                tcon = conn->tcon;
                 req->conn = NULL;
                 conn = NULL;
+
+                /*
+                 * TODO: cancel all outstanding requests on the tcon
+                 */
+                status = smbXsrv_tcon_disconnect(tcon, req->vuid);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0, ("reply_tcon_and_X: "
+                                  "smbXsrv_tcon_disconnect() failed: %s\n",
+                                  nt_errstr(status)));
+                        /*
+                         * If we hit this case, there is something completely
+                         * wrong, so we better disconnect the transport connection.
+                         */
+                        END_PROFILE(SMBtconX);
+                        exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
+                        return;
+                }
+
+                TALLOC_FREE(tcon);
         }
 
@@ -737 +930 @@
         }
 
-        if (sconn->smb1.negprot.encrypted_passwords) {
-                password = data_blob_talloc(talloc_tos(), req->buf, passlen);
-                if (lp_security() == SEC_SHARE) {
-                        /*
-                         * Security = share always has a pad byte
-                         * after the password.
-                         */
-                        p = (const char *)req->buf + passlen + 1;
-                } else {
-                        p = (const char *)req->buf + passlen;
-                }
+        if (xconn->smb1.negprot.encrypted_passwords) {
+                p = req->buf + passlen;
         } else {
-                password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
-                /* Ensure correct termination */
-                password.data[passlen]=0;
-                p = (const char *)req->buf + passlen + 1;
+                p = req->buf + passlen + 1;
         }
 
@@ -758 +939 @@
 
         if (path == NULL) {
-                data_blob_clear_free(&password);
                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                 END_PROFILE(SMBtconX);
@@ -771 +951 @@
                 q = strchr_m(path+2,'\\');
                 if (!q) {
-                        data_blob_clear_free(&password);
                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
                         END_PROFILE(SMBtconX);
@@ -786 +965 @@
 
         if (client_devicetype == NULL) {
-                data_blob_clear_free(&password);
                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                 END_PROFILE(SMBtconX);
@@ -794 +972 @@
         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 
-        conn = make_connection(sconn, service, password, client_devicetype,
+        nt_status = smb1srv_session_lookup(xconn,
+                                           req->vuid, now, &session);
+        if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
+                reply_force_doserror(req, ERRSRV, ERRbaduid);
+                END_PROFILE(SMBtconX);
+                return;
+        }
+        if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
+                reply_nterror(req, nt_status);
+                END_PROFILE(SMBtconX);
+                return;
+        }
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                reply_nterror(req, NT_STATUS_INVALID_HANDLE);
+                END_PROFILE(SMBtconX);
+                return;
+        }
+
+        if (session->global->auth_session_info == NULL) {
+                reply_nterror(req, NT_STATUS_INVALID_HANDLE);
+                END_PROFILE(SMBtconX);
+                return;
+        }
+
+        /*
+         * If there is no application key defined yet
+         * we create one.
+         *
+         * This means we setup the application key on the
+         * first tcon that happens via the given session.
+         *
+         * Once the application key is defined, it does not
+         * change any more.
+         */
+        if (session->global->application_key.length == 0 &&
+            session->global->signing_key.length > 0)
+        {
+                struct smbXsrv_session *x = session;
+                struct auth_session_info *session_info =
+                        session->global->auth_session_info;
+                uint8_t session_key[16];
+
+                ZERO_STRUCT(session_key);
+                memcpy(session_key, x->global->signing_key.data,
+                       MIN(x->global->signing_key.length, sizeof(session_key)));
+
+                /*
+                 * The application key is truncated/padded to 16 bytes
+                 */
+                x->global->application_key = data_blob_talloc(x->global,
+                                                             session_key,
+                                                             sizeof(session_key));
+                ZERO_STRUCT(session_key);
+                if (x->global->application_key.data == NULL) {
+                        reply_nterror(req, NT_STATUS_NO_MEMORY);
+                        END_PROFILE(SMBtconX);
+                        return;
+                }
+
+                if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
+                        smb_key_derivation(x->global->application_key.data,
+                                           x->global->application_key.length,
+                                           x->global->application_key.data);
+                        optional_support |= SMB_EXTENDED_SIGNATURES;
+                }
+
+                /*
+                 * Place the application key into the session_info
+                 */
+                data_blob_clear_free(&session_info->session_key);
+                session_info->session_key = data_blob_dup_talloc(session_info,
+                                                x->global->application_key);
+                if (session_info->session_key.data == NULL) {
+                        data_blob_clear_free(&x->global->application_key);
+                        reply_nterror(req, NT_STATUS_NO_MEMORY);
+                        END_PROFILE(SMBtconX);
+                        return;
+                }
+                session_key_updated = true;
+        }
+
+        conn = make_connection(req, now, service, client_devicetype,
                                req->vuid, &nt_status);
         req->conn =conn;
 
-        data_blob_clear_free(&password);
-
         if (!conn) {
+                if (session_key_updated) {
+                        struct smbXsrv_session *x = session;
+                        struct auth_session_info *session_info =
+                                session->global->auth_session_info;
+                        data_blob_clear_free(&x->global->application_key);
+                        data_blob_clear_free(&session_info->session_key);
+                }
                 reply_nterror(req, nt_status);
                 END_PROFILE(SMBtconX);
@@ -827 +1091 @@
                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
                         /* Return permissions. */
-                        uint32 perm1 = 0;
-                        uint32 perm2 = 0;
+                        uint32_t perm1 = 0;
+                        uint32_t perm2 = 0;
 
                         reply_outbuf(req, 7, 0);
@@ -856 +1120 @@
                 /* what does setting this bit do? It is set by NT4 and
                    may affect the ability to autorun mounted cdroms */
-                SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
-                      (lp_csc_policy(SNUM(conn)) << 2));
+                optional_support |= SMB_SUPPORT_SEARCH_BITS;
+                optional_support |=
+                        (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
 
                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
                         DEBUG(2,("Serving %s as a Dfs root\n",
-                                 lp_servicename(SNUM(conn)) ));
-                        SSVAL(req->outbuf, smb_vwv2,
-                              SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
-                }
-        }
-
+                                 lp_servicename(ctx, SNUM(conn)) ));
+                        optional_support |= SMB_SHARE_IN_DFS;
+                }
+
+                SSVAL(req->outbuf, smb_vwv2, optional_support);
+        }
+
+        SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+        SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
 
         DEBUG(3,("tconX service=%s \n",
@@ -872 +1140 @@
 
         /* set the incoming and outgoing tid to the just created one */
-        SSVAL(req->inbuf,smb_tid,conn->cnum);
+        SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
         SSVAL(req->outbuf,smb_tid,conn->cnum);
 
@@ -878 +1146 @@
 
         req->tid = conn->cnum;
-        chain_reply(req);
-        return;
 }
 
@@ -886 +1152 @@
 ****************************************************************************/
 
-void reply_unknown_new(struct smb_request *req, uint8 type)
+void reply_unknown_new(struct smb_request *req, uint8_t type)
 {
         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
@@ -902 +1168 @@
 {
         connection_struct *conn = req->conn;
-        uint16 device;
-        uint16 function;
-        uint32 ioctl_code;
+        uint16_t device;
+        uint16_t function;
+        uint32_t ioctl_code;
         int replysize;
         char *p;
@@ -943 +1209 @@
                 case IOCTL_QUERY_JOB_INFO:                  
                 {
+                        NTSTATUS status;
+                        size_t len = 0;
                         files_struct *fsp = file_fsp(
                                 req, SVAL(req->vwv+0, 0));
@@ -951 +1219 @@
                         }
                         /* Job number */
-                        if (fsp->print_file) {
-                                SSVAL(p, 0, fsp->print_file->rap_jobid);
-                        } else {
-                                SSVAL(p, 0, 0);
+                        SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
+
+                        status = srvstr_push((char *)req->outbuf, req->flags2, p+2,
+                                    lp_netbios_name(), 15,
+                                    STR_TERMINATE|STR_ASCII, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                reply_nterror(req, status);
+                                END_PROFILE(SMBioctl);
+                                return;
                         }
-                        srvstr_push((char *)req->outbuf, req->flags2, p+2,
-                                    global_myname(), 15,
-                                    STR_TERMINATE|STR_ASCII);
                         if (conn) {
-                                srvstr_push((char *)req->outbuf, req->flags2,
-                                            p+18, lp_servicename(SNUM(conn)),
-                                            13, STR_TERMINATE|STR_ASCII);
+                                status = srvstr_push((char *)req->outbuf, req->flags2,
+                                            p+18,
+                                            lp_servicename(talloc_tos(),
+                                                           SNUM(conn)),
+                                            13, STR_TERMINATE|STR_ASCII, &len);
+                                if (!NT_STATUS_IS_OK(status)) {
+                                        reply_nterror(req, status);
+                                        END_PROFILE(SMBioctl);
+                                        return;
+                                }
                         } else {
                                 memset(p+18, 0, 13);
@@ -1000 +1277 @@
         char *name = NULL;
         NTSTATUS status;
+        uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -1020 +1298 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 name,
-                                0,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname);
@@ -1088 +1366 @@
         char *fname = NULL;
         int mode=0;
-        SMB_OFF_T size=0;
+        off_t size=0;
         time_t mtime=0;
         const char *p;
@@ -1114 +1392 @@
                 mtime = 0;
         } else {
+                uint32_t ucf_flags = (req->posix_pathnames ?
+                                UCF_POSIX_PATHNAMES : 0);
                 status = filename_convert(ctx,
                                 conn,
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                0,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname);
@@ -1168 +1448 @@
                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
         }
-        SIVAL(req->outbuf,smb_vwv3,(uint32)size);
+        SIVAL(req->outbuf,smb_vwv3,(uint32_t)size);
 
         if (get_Protocol() >= PROTOCOL_NT1) {
@@ -1199 +1479 @@
         const char *p;
         NTSTATUS status;
+        uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -1221 +1502 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                0,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname);
@@ -1247 +1528 @@
         mtime = srv_make_unix_date3(req->vwv+1);
 
-        ft.mtime = convert_time_t_to_timespec(mtime);
-        status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
-        if (!NT_STATUS_IS_OK(status)) {
-                reply_nterror(req, status);
-                goto out;
-        }
-
         if (mode != FILE_ATTRIBUTE_NORMAL) {
                 if (VALID_STAT_OF_DIR(smb_fname->st))
@@ -1260 +1534 @@
                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
 
+                status = check_access(conn, NULL, smb_fname,
+                                        FILE_WRITE_ATTRIBUTES);
+                if (!NT_STATUS_IS_OK(status)) {
+                        reply_nterror(req, status);
+                        goto out;
+                }
+
                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
                                      false) != 0) {
@@ -1265 +1546 @@
                         goto out;
                 }
+        }
+
+        ft.mtime = convert_time_t_to_timespec(mtime);
+        status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
+        if (!NT_STATUS_IS_OK(status)) {
+                reply_nterror(req, status);
+                goto out;
         }
 
@@ -1284 +1572 @@
 {
         connection_struct *conn = req->conn;
+        uint64_t ret;
         uint64_t dfree,dsize,bsize;
         START_PROFILE(SMBdskattr);
 
-        if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
+        ret = get_dfree_info(conn, ".", &bsize, &dfree, &dsize);
+        if (ret == (uint64_t)-1) {
                 reply_nterror(req, map_nt_error_from_unix(errno));
                 END_PROFILE(SMBdskattr);
                 return;
+        }
+
+        /*
+         * Force max to fit in 16 bit fields.
+         */
+        while (dfree > WORDMAX || dsize > WORDMAX || bsize < 512) {
+                dfree /= 2;
+                dsize /= 2;
+                bsize *= 2;
+                if (bsize > (WORDMAX*512)) {
+                        bsize = (WORDMAX*512);
+                        if (dsize > WORDMAX)
+                                dsize = WORDMAX;
+                        if (dfree >  WORDMAX)
+                                dfree = WORDMAX;
+                        break;
+                }
         }
 
@@ -1362 +1669 @@
 
 /****************************************************************************
+ Make a dir struct.
+****************************************************************************/
+
+static bool make_dir_struct(TALLOC_CTX *ctx,
+                            char *buf,
+                            const char *mask,
+                            const char *fname,
+                            off_t size,
+                            uint32_t mode,
+                            time_t date,
+                            bool uc)
+{
+        char *p;
+        char *mask2 = talloc_strdup(ctx, mask);
+
+        if (!mask2) {
+                return False;
+        }
+
+        if ((mode & FILE_ATTRIBUTE_DIRECTORY) != 0) {
+                size = 0;
+        }
+
+        memset(buf+1,' ',11);
+        if ((p = strchr_m(mask2,'.')) != NULL) {
+                *p = 0;
+                push_ascii(buf+1,mask2,8, 0);
+                push_ascii(buf+9,p+1,3, 0);
+                *p = '.';
+        } else {
+                push_ascii(buf+1,mask2,11, 0);
+        }
+
+        memset(buf+21,'\0',DIR_STRUCT_SIZE-21);
+        SCVAL(buf,21,mode);
+        srv_put_dos_date(buf,22,date);
+        SSVAL(buf,26,size & 0xFFFF);
+        SSVAL(buf,28,(size >> 16)&0xFFFF);
+        /* We only uppercase if FLAGS2_LONG_PATH_COMPONENTS is zero in the input buf.
+           Strange, but verified on W2K3. Needed for OS/2. JRA. */
+        push_ascii(buf+30,fname,12, uc ? STR_UPPER : 0);
+        DEBUG(8,("put name [%s] from [%s] into dir struct\n",buf+30, fname));
+        return True;
+}
+
+/****************************************************************************
  Reply to a search.
  Can be called from SMBsearch, SMBffirst or SMBfunique.
@@ -1370 +1723 @@
         connection_struct *conn = req->conn;
         char *path = NULL;
-        const char *mask = NULL;
+        char *mask = NULL;
         char *directory = NULL;
         struct smb_filename *smb_fname = NULL;
         char *fname = NULL;
-        SMB_OFF_T size;
-        uint32 mode;
+        off_t size;
+        uint32_t mode;
         struct timespec date;
-        uint32 dirtype;
+        uint32_t dirtype;
         unsigned int numentries = 0;
         unsigned int maxentries = 0;
@@ -1393 +1746 @@
         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
         struct dptr_struct *dirptr = NULL;
+        struct smbXsrv_connection *xconn = req->xconn;
         struct smbd_server_connection *sconn = req->sconn;
 
@@ -1402 +1756 @@
         }
 
-        if (lp_posix_pathnames()) {
+        if (req->posix_pathnames) {
                 reply_unknown_new(req, req->cmd);
                 goto out;
@@ -1430 +1784 @@
 
         if (status_len == 0) {
+                uint32_t ucf_flags = UCF_ALWAYS_ALLOW_WCARD_LCOMP |
+                        (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
                 nt_status = filename_convert(ctx, conn,
                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
                                              path,
-                                             UCF_ALWAYS_ALLOW_WCARD_LCOMP,
+                                             ucf_flags,
                                              &mask_contains_wcard,
                                              &smb_fname);
@@ -1450 +1806 @@
                 p = strrchr_m(directory,'/');
                 if ((p != NULL) && (*directory != '/')) {
-                        mask = p + 1;
+                        mask = talloc_strdup(ctx, p + 1);
                         directory = talloc_strndup(ctx, directory,
                                                    PTR_DIFF(p, directory));
                 } else {
-                        mask = directory;
+                        mask = talloc_strdup(ctx, directory);
                         directory = talloc_strdup(ctx,".");
                 }
@@ -1467 +1823 @@
 
                 nt_status = dptr_create(conn,
+                                        NULL, /* req */
                                         NULL, /* fsp */
                                         directory,
@@ -1502 +1859 @@
                 }
 
-                mask = dptr_wcard(sconn, dptr_num);
+                mask = talloc_strdup(ctx, dptr_wcard(sconn, dptr_num));
                 if (!mask) {
                         goto SearchEmpty;
@@ -1510 +1867 @@
                  * check from the initial saved string.
                  */
-                mask_contains_wcard = ms_has_wild(mask);
+                if (!req->posix_pathnames) {
+                        mask_contains_wcard = ms_has_wild(mask);
+                }
                 dirtype = dptr_attr(sconn, dptr_num);
         }
@@ -1522 +1881 @@
                 char buf[DIR_STRUCT_SIZE];
                 memcpy(buf,status,21);
-                if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
+                if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
                         reply_nterror(req, NT_STATUS_NO_MEMORY);
@@ -1541 +1900 @@
         } else {
                 unsigned int i;
-                maxentries = MIN(
-                        maxentries,
-                        ((BUFFER_SIZE -
-                          ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
-                         /DIR_STRUCT_SIZE));
+                size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
+                size_t available_space = xconn->smb1.sessions.max_send - hdr_size;
+
+                maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
 
                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
-                        directory,lp_dontdescend(SNUM(conn))));
-                if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
+                         directory,lp_dont_descend(ctx, SNUM(conn))));
+                if (in_list(directory, lp_dont_descend(ctx, SNUM(conn)),True)) {
                         check_descend = True;
                 }
@@ -1642 +2000 @@
  out:
         TALLOC_FREE(directory);
+        TALLOC_FREE(mask);
         TALLOC_FREE(smb_fname);
         END_PROFILE(SMBsearch);
@@ -1665 +2024 @@
         START_PROFILE(SMBfclose);
 
-        if (lp_posix_pathnames()) {
+        if (req->posix_pathnames) {
                 reply_unknown_new(req, req->cmd);
                 END_PROFILE(SMBfclose);
@@ -1714 +2073 @@
         struct smb_filename *smb_fname = NULL;
         char *fname = NULL;
-        uint32 fattr=0;
-        SMB_OFF_T size = 0;
+        uint32_t fattr=0;
+        off_t size = 0;
         time_t mtime=0;
         int info;
@@ -1721 +2080 @@
         int oplock_request;
         int deny_mode;
-        uint32 dos_attr;
-        uint32 access_mask;
-        uint32 share_mode;
-        uint32 create_disposition;
-        uint32 create_options = 0;
+        uint32_t dos_attr;
+        uint32_t access_mask;
+        uint32_t share_mode;
+        uint32_t create_disposition;
+        uint32_t create_options = 0;
         uint32_t private_flags = 0;
         NTSTATUS status;
-        bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
+        uint32_t ucf_flags = UCF_PREP_CREATEFILE |
+                        (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -1750 +2110 @@
 
         if (!map_open_params_to_ntcreate(fname, deny_mode,
-                                        OPENX_FILE_EXISTS_OPEN, &access_mask,
-                                        &share_mode, &create_disposition,
-                                        &create_options, &private_flags)) {
+                                         OPENX_FILE_EXISTS_OPEN, &access_mask,
+                                         &share_mode, &create_disposition,
+                                         &create_options, &private_flags)) {
                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
                 goto out;
@@ -1761 +2121 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                (create_disposition == FILE_CREATE)
-                                        ? UCF_CREATING_FILE : 0,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname);
@@ -1787 +2146 @@
                 dos_attr,                               /* file_attributes */
                 oplock_request,                         /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 private_flags,
@@ -1792 +2152 @@
                 NULL,                                   /* ea_list */
                 &fsp,                                   /* result */
-                &info);                                 /* pinfo */
+                &info,                                  /* pinfo */
+                NULL, NULL);                            /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
-                if (open_was_deferred(req->mid)) {
+                if (open_was_deferred(req->xconn, req->mid)) {
                         /* We have re-scheduled this call. */
                         goto out;
@@ -1803 +2164 @@
         }
 
+        /* Ensure we're pointing at the correct stat struct. */
+        TALLOC_FREE(smb_fname);
+        smb_fname = fsp->fsp_name;
+
         size = smb_fname->st.st_ex_size;
         fattr = dos_mode(conn, smb_fname);
-
-        /* Deal with other possible opens having a modified
-           write time. JRA. */
-        if (ask_sharemode) {
-                struct timespec write_time_ts;
-
-                ZERO_STRUCT(write_time_ts);
-                get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
-                if (!null_timespec(write_time_ts)) {
-                        update_stat_ex_mtime(&smb_fname->st, write_time_ts);
-                }
-        }
 
         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
@@ -1837 +2190 @@
                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
         }
-        SIVAL(req->outbuf,smb_vwv4,(uint32)size);
+        SIVAL(req->outbuf,smb_vwv4,(uint32_t)size);
         SSVAL(req->outbuf,smb_vwv6,deny_mode);
 
@@ -1850 +2203 @@
         }
  out:
-        TALLOC_FREE(smb_fname);
         END_PROFILE(SMBopen);
         return;
@@ -1864 +2216 @@
         struct smb_filename *smb_fname = NULL;
         char *fname = NULL;
-        uint16 open_flags;
+        uint16_t open_flags;
         int deny_mode;
-        uint32 smb_attr;
+        uint32_t smb_attr;
         /* Breakout the oplock request bits so we can set the
                 reply bits separately. */
@@ -1874 +2226 @@
 #if 0
         int smb_sattr = SVAL(req->vwv+4, 0);
-        uint32 smb_time = make_unix_date3(req->vwv+6);
+        uint32_t smb_time = make_unix_date3(req->vwv+6);
 #endif
         int smb_ofun;
-        uint32 fattr=0;
+        uint32_t fattr=0;
         int mtime=0;
         int smb_action = 0;
@@ -1884 +2236 @@
         uint64_t allocation_size;
         ssize_t retval = -1;
-        uint32 access_mask;
-        uint32 share_mode;
-        uint32 create_disposition;
-        uint32 create_options = 0;
+        uint32_t access_mask;
+        uint32_t share_mode;
+        uint32_t create_disposition;
+        uint32_t create_options = 0;
         uint32_t private_flags = 0;
+        uint32_t ucf_flags = UCF_PREP_CREATEFILE |
+                        (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -1926 +2280 @@
 
         if (!map_open_params_to_ntcreate(fname, deny_mode,
-                                        smb_ofun,
-                                        &access_mask, &share_mode,
-                                        &create_disposition,
-                                        &create_options,
-                                        &private_flags)) {
+                                         smb_ofun,
+                                         &access_mask, &share_mode,
+                                         &create_disposition,
+                                         &create_options,
+                                         &private_flags)) {
                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
                 goto out;
@@ -1939 +2293 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                (create_disposition == FILE_CREATE)
-                                        ? UCF_CREATING_FILE : 0,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname);
@@ -1965 +2318 @@
                 smb_attr,                               /* file_attributes */
                 oplock_request,                         /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 private_flags,
@@ -1970 +2324 @@
                 NULL,                                   /* ea_list */
                 &fsp,                                   /* result */
-                &smb_action);                           /* pinfo */
+                &smb_action,                            /* pinfo */
+                NULL, NULL);                            /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
-                if (open_was_deferred(req->mid)) {
+                if (open_was_deferred(req->xconn, req->mid)) {
                         /* We have re-scheduled this call. */
                         goto out;
@@ -1990 +2345 @@
                         goto out;
                 }
-                retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
+                retval = vfs_set_filelen(fsp, (off_t)allocation_size);
                 if (retval < 0) {
                         close_file(req, fsp, ERROR_CLOSE);
@@ -2035 +2390 @@
                 reply_outbuf(req, 15, 0);
         }
+
+        SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+        SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
 
         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
@@ -2053 +2411 @@
                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
         }
-        SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
+        SIVAL(req->outbuf,smb_vwv6,(uint32_t)fsp->fsp_name->st.st_ex_size);
         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
         SSVAL(req->outbuf,smb_vwv11,smb_action);
@@ -2061 +2419 @@
         }
 
-        chain_reply(req);
  out:
         TALLOC_FREE(smb_fname);
@@ -2075 +2432 @@
 {
         struct smbd_server_connection *sconn = req->sconn;
-        user_struct *vuser;
+        struct user_struct *vuser;
+        struct smbXsrv_session *session = NULL;
+        NTSTATUS status;
 
         START_PROFILE(SMBulogoffX);
@@ -2082 +2441 @@
 
         if(vuser == NULL) {
-                DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
-                         req->vuid));
-        }
-
-        /* in user level security we are supposed to close any files
-                open by this user */
-        if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
-                file_close_user(sconn, req->vuid);
-        }
-
-        invalidate_vuid(sconn, req->vuid);
+                DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
+                         (unsigned long long)req->vuid));
+
+                req->vuid = UID_FIELD_INVALID;
+                reply_force_doserror(req, ERRSRV, ERRbaduid);
+                END_PROFILE(SMBulogoffX);
+                return;
+        }
+
+        session = vuser->session;
+        vuser = NULL;
+
+        /*
+         * TODO: cancel all outstanding requests on the session
+         */
+        status = smbXsrv_session_logoff(session);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("reply_ulogoff: "
+                          "smbXsrv_session_logoff() failed: %s\n",
+                          nt_errstr(status)));
+                /*
+                 * If we hit this case, there is something completely
+                 * wrong, so we better disconnect the transport connection.
+                 */
+                END_PROFILE(SMBulogoffX);
+                exit_server(__location__ ": smbXsrv_session_logoff failed");
+                return;
+        }
+
+        TALLOC_FREE(session);
 
         reply_outbuf(req, 2, 0);
-
-        DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
+        SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+        SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
+
+        DEBUG(3, ("ulogoffX vuid=%llu\n",
+                  (unsigned long long)req->vuid));
 
         END_PROFILE(SMBulogoffX);
         req->vuid = UID_FIELD_INVALID;
-        chain_reply(req);
 }
 
@@ -2112 +2492 @@
         struct smb_filename *smb_fname = NULL;
         char *fname = NULL;
-        uint32 fattr = 0;
+        uint32_t fattr = 0;
         struct smb_file_time ft;
         files_struct *fsp;
         int oplock_request = 0;
         NTSTATUS status;
-        uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
-        uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
-        uint32 create_disposition;
-        uint32 create_options = 0;
+        uint32_t access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
+        uint32_t share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
+        uint32_t create_disposition;
+        uint32_t create_options = 0;
+        uint32_t ucf_flags = UCF_PREP_CREATEFILE |
+                        (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -2148 +2530 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                UCF_CREATING_FILE,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname);
@@ -2187 +2569 @@
                 fattr,                                  /* file_attributes */
                 oplock_request,                         /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 0,                                      /* private_flags */
@@ -2192 +2575 @@
                 NULL,                                   /* ea_list */
                 &fsp,                                   /* result */
-                NULL);                                  /* pinfo */
+                NULL,                                   /* pinfo */
+                NULL, NULL);                            /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
-                if (open_was_deferred(req->mid)) {
+                if (open_was_deferred(req->xconn, req->mid)) {
                         /* We have re-scheduled this call. */
                         goto out;
@@ -2244 +2628 @@
         char *wire_name = NULL;
         char *fname = NULL;
-        uint32 fattr;
+        uint32_t fattr;
         files_struct *fsp;
         int oplock_request;
@@ -2250 +2634 @@
         NTSTATUS status;
         int i;
+        uint32_t ucf_flags = UCF_PREP_CREATEFILE |
+                        (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -2289 +2675 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                UCF_CREATING_FILE,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname);
@@ -2304 +2690 @@
                 /* Create the file. */
                 status = SMB_VFS_CREATE_FILE(
-                        conn,                                   /* conn */
-                        req,                                    /* req */
-                        0,                                      /* root_dir_fid */
-                        smb_fname,                              /* fname */
+                        conn,                                   /* conn */
+                        req,                                    /* req */
+                        0,                                      /* root_dir_fid */
+                        smb_fname,                              /* fname */
                         FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
-                        FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
-                        FILE_CREATE,                            /* create_disposition*/
-                        0,                                      /* create_options */
-                        fattr,                                  /* file_attributes */
-                        oplock_request,                         /* oplock_request */
-                        0,                                      /* allocation_size */
-                        0,                                      /* private_flags */
-                        NULL,                                   /* sd */
-                        NULL,                                   /* ea_list */
-                        &fsp,                                   /* result */
-                        NULL);                                  /* pinfo */
+                        FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
+                        FILE_CREATE,                            /* create_disposition*/
+                        0,                                      /* create_options */
+                        fattr,                                  /* file_attributes */
+                        oplock_request,                         /* oplock_request */
+                        NULL,                                   /* lease */
+                        0,                                      /* allocation_size */
+                        0,                                      /* private_flags */
+                        NULL,                                   /* sd */
+                        NULL,                                   /* ea_list */
+                        &fsp,                                   /* result */
+                        NULL,                                   /* pinfo */
+                        NULL, NULL);                            /* create context */
 
                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
@@ -2328 +2716 @@
 
                 if (!NT_STATUS_IS_OK(status)) {
-                        if (open_was_deferred(req->mid)) {
+                        if (open_was_deferred(req->xconn, req->mid)) {
                                 /* We have re-scheduled this call. */
                                 goto out;
@@ -2382 +2770 @@
  out:
         TALLOC_FREE(smb_fname);
-        TALLOC_FREE(fname);
         TALLOC_FREE(wire_name);
         END_PROFILE(SMBctemp);
@@ -2393 +2780 @@
 
 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
-                        uint16 dirtype)
+                        uint16_t dirtype)
 {
         if (!CAN_WRITE(conn)) {
@@ -2402 +2789 @@
                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
                 /* Only bother to read the DOS attribute if we might deny the
-                   rename on the grounds of attribute missmatch. */
+                   rename on the grounds of attribute mismatch. */
                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
@@ -2410 +2797 @@
 
         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
-                if (fsp->posix_open) {
+                if (fsp->posix_flags & FSP_POSIX_FLAGS_RENAME) {
                         return NT_STATUS_OK;
                 }
@@ -2417 +2804 @@
                    directory, allow the rename. */
 
-                if (file_find_subpath(fsp)) {
+                if (lp_strict_rename(SNUM(conn))) {
+                        /*
+                         * Strict rename, check open file db.
+                         */
+                        if (have_file_open_below(fsp->conn, fsp->fsp_name)) {
+                                return NT_STATUS_ACCESS_DENIED;
+                        }
+                } else if (file_find_subpath(fsp)) {
+                        /*
+                         * No strict rename, just look in local process.
+                         */
                         return NT_STATUS_ACCESS_DENIED;
                 }
@@ -2437 +2834 @@
                         struct smb_request *req,
                         struct smb_filename *smb_fname,
-                        uint32 dirtype)
-{
-        uint32 fattr;
+                        uint32_t dirtype)
+{
+        uint32_t fattr;
         files_struct *fsp;
-        uint32 dirtype_orig = dirtype;
+        uint32_t dirtype_orig = dirtype;
         NTSTATUS status;
         int ret;
-        bool posix_paths = lp_posix_pathnames();
+        bool posix_paths = (req != NULL && req->posix_pathnames);
 
         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
@@ -2474 +2871 @@
         }
 
-        if (!dir_check_ftype(conn, fattr, dirtype)) {
+        if (!dir_check_ftype(fattr, dirtype)) {
                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
                         return NT_STATUS_FILE_IS_A_DIRECTORY;
@@ -2532 +2929 @@
                                 FILE_ATTRIBUTE_NORMAL,
                  0,                     /* oplock_request */
+                 NULL,                  /* lease */
                  0,                     /* allocation_size */
                  0,                     /* private_flags */
@@ -2537 +2935 @@
                  NULL,                  /* ea_list */
                  &fsp,                  /* result */
-                 NULL);                 /* pinfo */
+                 NULL,                  /* pinfo */
+                 NULL, NULL);           /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -2556 +2955 @@
 
         /* The set is across all open files on this dev/inode pair. */
-        if (!set_delete_on_close(fsp, true,
+        if (!set_delete_on_close(fsp, True,
                                 conn->session_info->security_token,
-                                &conn->session_info->utok)) {
+                                conn->session_info->unix_token)) {
                 close_file(req, fsp, NORMAL_CLOSE);
                 return NT_STATUS_ACCESS_DENIED;
@@ -2572 +2971 @@
 
 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
-                          uint32 dirtype, struct smb_filename *smb_fname,
+                          uint32_t dirtype, struct smb_filename *smb_fname,
                           bool has_wild)
 {
@@ -2655 +3054 @@
                         goto out;
                 }
+                if (dirtype == 0) {
+                        dirtype = FILE_ATTRIBUTE_NORMAL;
+                }
 
                 if (strequal(fname_mask,"????????.???")) {
@@ -2739 +3141 @@
                         status = do_unlink(conn, req, smb_fname, dirtype);
                         if (!NT_STATUS_IS_OK(status)) {
+                                TALLOC_FREE(dir_hnd);
                                 TALLOC_FREE(frame);
                                 TALLOC_FREE(talloced);
-                                continue;
+                                goto out;
                         }
 
@@ -2773 +3176 @@
         char *name = NULL;
         struct smb_filename *smb_fname = NULL;
-        uint32 dirtype;
+        uint32_t dirtype;
         NTSTATUS status;
         bool path_contains_wcard = False;
+        uint32_t ucf_flags = UCF_COND_ALLOW_WCARD_LCOMP |
+                        (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -2798 +3203 @@
                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
                                   name,
-                                  UCF_COND_ALLOW_WCARD_LCOMP,
+                                  ucf_flags,
                                   &path_contains_wcard,
                                   &smb_fname);
@@ -2816 +3221 @@
                                   path_contains_wcard);
         if (!NT_STATUS_IS_OK(status)) {
-                if (open_was_deferred(req->mid)) {
+                if (open_was_deferred(req->xconn, req->mid)) {
                         /* We have re-scheduled this call. */
                         goto out;
@@ -2850 +3255 @@
 ****************************************************************************/
 
-ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
+ssize_t fake_sendfile(struct smbXsrv_connection *xconn, files_struct *fsp,
+                      off_t startpos, size_t nread)
 {
         size_t bufsize;
@@ -2870 +3276 @@
                 size_t cur_read;
 
-                if (tosend > bufsize) {
-                        cur_read = bufsize;
-                } else {
-                        cur_read = tosend;
-                }
+                cur_read = MIN(tosend, bufsize);
                 ret = read_file(fsp,buf,startpos,cur_read);
                 if (ret == -1) {
@@ -2886 +3288 @@
                 }
 
-                if (write_data(fsp->conn->sconn->sock, buf, cur_read)
-                    != cur_read) {
-                        char addr[INET6_ADDRSTRLEN];
+                ret = write_data(xconn->transport.sock, buf, cur_read);
+                if (ret != cur_read) {
+                        int saved_errno = errno;
                         /*
                          * Try and give an error message saying what
@@ -2895 +3297 @@
                         DEBUG(0, ("write_data failed for client %s. "
                                   "Error %s\n",
-                                  get_peer_addr(fsp->conn->sconn->sock, addr,
-                                                sizeof(addr)),
-                                  strerror(errno)));
+                                  smbXsrv_connection_dbg(xconn),
+                                  strerror(saved_errno)));
                         SAFE_FREE(buf);
+                        errno = saved_errno;
                         return -1;
                 }
@@ -2911 +3313 @@
 /****************************************************************************
  Deal with the case of sendfile reading less bytes from the file than
- requested. Fill with zeros (all we can do).
+ requested. Fill with zeros (all we can do). Returns 0 on success
 ****************************************************************************/
 
-void sendfile_short_send(files_struct *fsp,
-                                ssize_t nread,
-                                size_t headersize,
-                                size_t smb_maxcnt)
+ssize_t sendfile_short_send(struct smbXsrv_connection *xconn,
+                            files_struct *fsp,
+                            ssize_t nread,
+                            size_t headersize,
+                            size_t smb_maxcnt)
 {
 #define SHORT_SEND_BUFSIZE 1024
@@ -2924 +3327 @@
                         "header for file %s (%s). Terminating\n",
                         fsp_str_dbg(fsp), strerror(errno)));
-                exit_server_cleanly("sendfile_short_send failed");
+                return -1;
         }
 
@@ -2932 +3335 @@
                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
                 if (!buf) {
-                        exit_server_cleanly("sendfile_short_send: "
-                                "malloc failed");
+                        DEBUG(0,("sendfile_short_send: malloc failed "
+                                "for file %s (%s). Terminating\n",
+                                fsp_str_dbg(fsp), strerror(errno)));
+                        return -1;
                 }
 
@@ -2955 +3360 @@
                          */
                         size_t to_write;
+                        ssize_t ret;
 
                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
-                        if (write_data(fsp->conn->sconn->sock, buf, to_write)
-                            != to_write) {
-                                char addr[INET6_ADDRSTRLEN];
+                        ret = write_data(xconn->transport.sock, buf, to_write);
+                        if (ret != to_write) {
+                                int saved_errno = errno;
                                 /*
                                  * Try and give an error message saying what
@@ -2966 +3372 @@
                                 DEBUG(0, ("write_data failed for client %s. "
                                           "Error %s\n",
-                                          get_peer_addr(
-                                                  fsp->conn->sconn->sock, addr,
-                                                  sizeof(addr)),
-                                          strerror(errno)));
-                                exit_server_cleanly("sendfile_short_send: "
-                                                    "write_data failed");
+                                          smbXsrv_connection_dbg(xconn),
+                                          strerror(saved_errno)));
+                                errno = saved_errno;
+                                return -1;
                         }
                         nread += to_write;
@@ -2977 +3381 @@
                 SAFE_FREE(buf);
         }
+
+        return 0;
 }
 
@@ -2983 +3389 @@
 ****************************************************************************/
 
-static void reply_readbraw_error(struct smbd_server_connection *sconn)
+static void reply_readbraw_error(struct smbXsrv_connection *xconn)
 {
         char header[4];
@@ -2989 +3395 @@
         SIVAL(header,0,0);
 
-        smbd_lock_socket(sconn);
-        if (write_data(sconn->sock,header,4) != 4) {
-                char addr[INET6_ADDRSTRLEN];
+        smbd_lock_socket(xconn);
+        if (write_data(xconn->transport.sock,header,4) != 4) {
+                int saved_errno = errno;
                 /*
                  * Try and give an error message saying what
@@ -2998 +3404 @@
                 DEBUG(0, ("write_data failed for client %s. "
                           "Error %s\n",
-                          get_peer_addr(sconn->sock, addr, sizeof(addr)),
-                          strerror(errno)));
+                          smbXsrv_connection_dbg(xconn),
+                          strerror(saved_errno)));
+                errno = saved_errno;
 
                 fail_readraw();
         }
-        smbd_unlock_socket(sconn);
+        smbd_unlock_socket(xconn);
 }
 
@@ -3013 +3420 @@
                                struct smb_request *req,
                                files_struct *fsp,
-                               SMB_OFF_T startpos,
+                               off_t startpos,
                                size_t nread,
                                ssize_t mincount)
 {
-        struct smbd_server_connection *sconn = req->sconn;
+        struct smbXsrv_connection *xconn = req->xconn;
         char *outbuf = NULL;
         ssize_t ret=0;
@@ -3030 +3437 @@
         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
             (fsp->wcp == NULL) &&
-            lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
+            lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
                 ssize_t sendfile_read = -1;
                 char header[4];
@@ -3038 +3445 @@
                 header_blob = data_blob_const(header, 4);
 
-                sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
+                sendfile_read = SMB_VFS_SENDFILE(xconn->transport.sock, fsp,
                                                  &header_blob, startpos,
                                                  nread);
@@ -3058 +3465 @@
                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
 
-                                if (fake_sendfile(fsp, startpos, nread) == -1) {
+                                if (fake_sendfile(xconn, fsp, startpos, nread) == -1) {
                                         DEBUG(0,("send_file_readbraw: "
                                                  "fake_sendfile failed for "
@@ -3089 +3496 @@
                 /* Deal with possible short send. */
                 if (sendfile_read != 4+nread) {
-                        sendfile_short_send(fsp, sendfile_read, 4, nread);
+                        ret = sendfile_short_send(xconn, fsp,
+                                                  sendfile_read, 4, nread);
+                        if (ret == -1) {
+                                fail_readraw();
+                        }
                 }
                 return;
@@ -3096 +3507 @@
 normal_readbraw:
 
-        outbuf = TALLOC_ARRAY(NULL, char, nread+4);
+        outbuf = talloc_array(NULL, char, nread+4);
         if (!outbuf) {
-                DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
+                DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
                         (unsigned)(nread+4)));
-                reply_readbraw_error(sconn);
+                reply_readbraw_error(xconn);
                 return;
         }
@@ -3116 +3527 @@
 
         _smb_setlen(outbuf,ret);
-        if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
-                char addr[INET6_ADDRSTRLEN];
+        if (write_data(xconn->transport.sock, outbuf, 4+ret) != 4+ret) {
+                int saved_errno = errno;
                 /*
                  * Try and give an error message saying what
                  * client failed.
                  */
-                DEBUG(0, ("write_data failed for client %s. "
-                          "Error %s\n",
-                          get_peer_addr(fsp->conn->sconn->sock, addr,
-                                        sizeof(addr)),
-                          strerror(errno)));
+                DEBUG(0, ("write_data failed for client %s. Error %s\n",
+                          smbXsrv_connection_dbg(xconn),
+                          strerror(saved_errno)));
+                errno = saved_errno;
 
                 fail_readraw();
@@ -3141 +3551 @@
 {
         connection_struct *conn = req->conn;
-        struct smbd_server_connection *sconn = req->sconn;
+        struct smbXsrv_connection *xconn = req->xconn;
         ssize_t maxcount,mincount;
         size_t nread = 0;
-        SMB_OFF_T startpos;
+        off_t startpos;
         files_struct *fsp;
         struct lock_struct lock;
-        SMB_OFF_T size = 0;
+        off_t size = 0;
 
         START_PROFILE(SMBreadbraw);
 
-        if (srv_is_signing_active(sconn) || req->encrypted) {
+        if (srv_is_signing_active(xconn) || req->encrypted) {
                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
                         "raw reads/writes are disallowed.");
@@ -3157 +3567 @@
 
         if (req->wct < 8) {
-                reply_readbraw_error(sconn);
+                reply_readbraw_error(xconn);
                 END_PROFILE(SMBreadbraw);
                 return;
         }
 
-        if (sconn->smb1.echo_handler.trusted_fde) {
+        if (xconn->smb1.echo_handler.trusted_fde) {
                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
                          "'async smb echo handler = yes'\n"));
-                reply_readbraw_error(sconn);
+                reply_readbraw_error(xconn);
                 END_PROFILE(SMBreadbraw);
                 return;
@@ -3193 +3603 @@
                         "- cache prime?\n",
                         (int)SVAL(req->vwv+0, 0)));
-                reply_readbraw_error(sconn);
+                reply_readbraw_error(xconn);
                 END_PROFILE(SMBreadbraw);
                 return;
@@ -3204 +3614 @@
                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
                                 (int)SVAL(req->vwv+0, 0)));
-                reply_readbraw_error(sconn);
+                reply_readbraw_error(xconn);
                 END_PROFILE(SMBreadbraw);
                 return;
         }
 
-        flush_write_cache(fsp, READRAW_FLUSH);
+        flush_write_cache(fsp, SAMBA_READRAW_FLUSH);
 
         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
@@ -3216 +3626 @@
                  * This is a large offset (64 bit) read.
                  */
-#ifdef LARGE_SMB_OFF_T
-
-                startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
-
-#else /* !LARGE_SMB_OFF_T */
-
-                /*
-                 * Ensure we haven't been sent a >32 bit offset.
-                 */
-
-                if(IVAL(req->vwv+8, 0) != 0) {
-                        DEBUG(0,("reply_readbraw: large offset "
-                                "(%x << 32) used and we don't support "
-                                "64 bit offsets.\n",
-                        (unsigned int)IVAL(req->vwv+8, 0) ));
-                        reply_readbraw_error(sconn);
-                        END_PROFILE(SMBreadbraw);
-                        return;
-                }
-
-#endif /* LARGE_SMB_OFF_T */
+
+                startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
 
                 if(startpos < 0) {
@@ -3242 +3633 @@
                                 "readraw offset (%.0f) !\n",
                                 (double)startpos ));
-                        reply_readbraw_error(sconn);
+                        reply_readbraw_error(xconn);
                         END_PROFILE(SMBreadbraw);
                         return;
@@ -3259 +3650 @@
 
         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
-                reply_readbraw_error(sconn);
+                reply_readbraw_error(xconn);
                 END_PROFILE(SMBreadbraw);
                 return;
@@ -3279 +3670 @@
 #endif
 
-        DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
+        DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
                 "min=%lu nread=%lu\n",
-                fsp->fnum, (double)startpos,
+                fsp_fnum_dbg(fsp), (double)startpos,
                 (unsigned long)maxcount,
                 (unsigned long)mincount,
@@ -3308 +3699 @@
         ssize_t nread = -1;
         char *data;
-        SMB_OFF_T startpos;
+        off_t startpos;
         size_t numtoread;
+        size_t maxtoread;
         NTSTATUS status;
         files_struct *fsp;
         struct byte_range_lock *br_lck = NULL;
         char *p = NULL;
-        struct smbd_server_connection *sconn = req->sconn;
+        struct smbXsrv_connection *xconn = req->xconn;
 
         START_PROFILE(SMBlockread);
@@ -3339 +3731 @@
         numtoread = SVAL(req->vwv+1, 0);
         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
-
-        numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
-
-        reply_outbuf(req, 5, numtoread + 3);
-
-        data = smb_buf(req->outbuf) + 3;
 
         /*
@@ -3351 +3737 @@
          * Thus instead of asking for a read lock here we need to ask
          * for a write lock. JRA.
-         * Note that the requested lock size is unaffected by max_recv.
+         * Note that the requested lock size is unaffected by max_send.
          */
 
@@ -3363 +3749 @@
                         False, /* Non-blocking lock. */
                         &status,
-                        NULL,
                         NULL);
         TALLOC_FREE(br_lck);
@@ -3374 +3759 @@
 
         /*
-         * However the requested READ size IS affected by max_recv. Insanity.... JRA.
+         * However the requested READ size IS affected by max_send. Insanity.... JRA.
          */
-
-        if (numtoread > sconn->smb1.negprot.max_recv) {
-                DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
+        maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
+
+        if (numtoread > maxtoread) {
+                DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
-                        (unsigned int)numtoread,
-                        (unsigned int)sconn->smb1.negprot.max_recv));
-                numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
-        }
+                        (unsigned int)numtoread, (unsigned int)maxtoread,
+                        (unsigned int)xconn->smb1.sessions.max_send));
+                numtoread = maxtoread;
+        }
+
+        reply_outbuf(req, 5, numtoread + 3);
+
+        data = smb_buf(req->outbuf) + 3;
+
         nread = read_file(fsp,data,startpos,numtoread);
 
@@ -3400 +3791 @@
         SSVAL(p,1,nread);
 
-        DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
-                 fsp->fnum, (int)numtoread, (int)nread));
+        DEBUG(3,("lockread %s num=%d nread=%d\n",
+                 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
 
         END_PROFILE(SMBlockread);
@@ -3418 +3809 @@
         connection_struct *conn = req->conn;
         size_t numtoread;
+        size_t maxtoread;
         ssize_t nread = 0;
         char *data;
-        SMB_OFF_T startpos;
-        int outsize = 0;
+        off_t startpos;
         files_struct *fsp;
         struct lock_struct lock;
-        struct smbd_server_connection *sconn = req->sconn;
+        struct smbXsrv_connection *xconn = req->xconn;
 
         START_PROFILE(SMBread);
@@ -3450 +3841 @@
         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
 
-        numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
-
         /*
-         * The requested read size cannot be greater than max_recv. JRA.
+         * The requested read size cannot be greater than max_send. JRA.
          */
-        if (numtoread > sconn->smb1.negprot.max_recv) {
-                DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
+        maxtoread = xconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
+
+        if (numtoread > maxtoread) {
+                DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
-                        (unsigned int)numtoread,
-                        (unsigned int)sconn->smb1.negprot.max_recv));
-                numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
+                        (unsigned int)numtoread, (unsigned int)maxtoread,
+                        (unsigned int)xconn->smb1.sessions.max_send));
+                numtoread = maxtoread;
         }
 
@@ -3492 +3883 @@
         SSVAL(smb_buf(req->outbuf),1,nread);
 
-        DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
-                fsp->fnum, (int)numtoread, (int)nread ) );
+        DEBUG(3, ("read %s num=%d nread=%d\n",
+                  fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
 
 strict_unlock:
@@ -3510 +3901 @@
 {
         int outsize;
-        char *data;
-
-        outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
-        data = smb_buf(outbuf);
+
+        outsize = srv_set_message(outbuf,12,smb_maxcnt + 1 /* padding byte */,
+                                  False);
 
         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
@@ -3521 +3911 @@
         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
         SSVAL(outbuf,smb_vwv6,
-              req_wct_ofs(req)
+              (smb_wct - 4)     /* offset from smb header to wct */
               + 1               /* the wct field */
               + 12 * sizeof(uint16_t) /* vwv */
-              + 2);             /* the buflen field */
+              + 2               /* the buflen field */
+              + 1);             /* padding byte */
         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
+        SCVAL(smb_buf(outbuf), 0, 0); /* padding byte */
         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
-        _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
+        _smb_setlen_large(outbuf,
+                          smb_size + 12*2 + smb_maxcnt - 4 + 1 /* pad */);
         return outsize;
 }
@@ -3537 +3930 @@
 
 static void send_file_readX(connection_struct *conn, struct smb_request *req,
-                            files_struct *fsp, SMB_OFF_T startpos,
+                            files_struct *fsp, off_t startpos,
                             size_t smb_maxcnt)
 {
+        struct smbXsrv_connection *xconn = req->xconn;
         ssize_t nread = -1;
         struct lock_struct lock;
@@ -3560 +3954 @@
 
         if (!req_is_in_chain(req) &&
-            !req->encrypted && (fsp->base_fsp == NULL) &&
+            !req->encrypted &&
+            (fsp->base_fsp == NULL) &&
             (fsp->wcp == NULL) &&
-            lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
-                uint8 headerbuf[smb_size + 12 * 2];
+            lp_use_sendfile(SNUM(conn), xconn->smb1.signing_state) ) {
+                uint8_t headerbuf[smb_size + 12 * 2 + 1 /* padding byte */];
                 DATA_BLOB header;
 
@@ -3592 +3987 @@
                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
 
-                nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
+                nread = SMB_VFS_SENDFILE(xconn->transport.sock, fsp, &header,
                                          startpos, smb_maxcnt);
                 if (nread == -1) {
+                        saved_errno = errno;
+
                         /* Returning ENOSYS means no data at all was sent.
                            Do this as a normal read. */
@@ -3611 +4008 @@
                                 set_use_sendfile(SNUM(conn), False);
                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
-                                nread = fake_sendfile(fsp, startpos,
+                                nread = fake_sendfile(xconn, fsp, startpos,
                                                       smb_maxcnt);
                                 if (nread == -1) {
+                                        saved_errno = errno;
                                         DEBUG(0,("send_file_readX: "
                                                  "fake_sendfile failed for "
-                                                 "file %s (%s).\n",
+                                                 "file %s (%s) for client %s. "
+                                                 "Terminating\n",
                                                  fsp_str_dbg(fsp),
-                                                 strerror(errno)));
+                                                 smbXsrv_connection_dbg(xconn),
+                                                 strerror(saved_errno)));
+                                        errno = saved_errno;
                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
                                 }
-                                DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
-                                        fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+                                DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
+                                          fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
                                 /* No outbuf here means successful sendfile. */
                                 goto strict_unlock;
@@ -3645 +4046 @@
                 }
 
-                DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
-                        fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+                DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
+                          fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
 
                 /* Deal with possible short send. */
                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
-                        sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
+                        ssize_t ret;
+
+                        ret = sendfile_short_send(xconn, fsp, nread,
+                                                  sizeof(headerbuf), smb_maxcnt);
+                        if (ret == -1) {
+                                const char *r;
+                                r = "send_file_readX: sendfile_short_send failed";
+                                DEBUG(0,("%s for file %s (%s).\n",
+                                         r, fsp_str_dbg(fsp), strerror(errno)));
+                                exit_server_cleanly(r);
+                        }
                 }
                 /* No outbuf here means successful sendfile. */
@@ -3661 +4072 @@
 
         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
-                uint8 headerbuf[smb_size + 2*12];
+                uint8_t headerbuf[smb_size + 2*12 + 1 /* padding byte */];
+                ssize_t ret;
+
+                if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
+                    (startpos > fsp->fsp_name->st.st_ex_size) ||
+                    (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
+                        /*
+                         * We already know that we would do a short
+                         * read, so don't try the sendfile() path.
+                         */
+                        goto nosendfile_read;
+                }
 
                 construct_reply_common_req(req, (char *)headerbuf);
@@ -3667 +4089 @@
 
                 /* Send out the header. */
-                if (write_data(req->sconn->sock, (char *)headerbuf,
-                               sizeof(headerbuf)) != sizeof(headerbuf)) {
-
-                        char addr[INET6_ADDRSTRLEN];
+                ret = write_data(xconn->transport.sock, (char *)headerbuf,
+                                 sizeof(headerbuf));
+                if (ret != sizeof(headerbuf)) {
+                        saved_errno = errno;
                         /*
                          * Try and give an error message saying what
                          * client failed.
                          */
-                        DEBUG(0, ("write_data failed for client %s. "
-                                  "Error %s\n",
-                                  get_peer_addr(req->sconn->sock, addr,
-                                                sizeof(addr)),
-                                  strerror(errno)));
-
                         DEBUG(0,("send_file_readX: write_data failed for file "
-                                 "%s (%s). Terminating\n", fsp_str_dbg(fsp),
-                                 strerror(errno)));
+                                 "%s (%s) for client %s. Terminating\n",
+                                 fsp_str_dbg(fsp),
+                                 smbXsrv_connection_dbg(xconn),
+                                 strerror(saved_errno)));
+                        errno = saved_errno;
                         exit_server_cleanly("send_file_readX sendfile failed");
                 }
-                nread = fake_sendfile(fsp, startpos, smb_maxcnt);
+                nread = fake_sendfile(xconn, fsp, startpos, smb_maxcnt);
                 if (nread == -1) {
-                        DEBUG(0,("send_file_readX: fake_sendfile failed for "
-                                 "file %s (%s).\n", fsp_str_dbg(fsp),
-                                 strerror(errno)));
+                        saved_errno = errno;
+                        DEBUG(0,("send_file_readX: fake_sendfile failed for file "
+                                 "%s (%s) for client %s. Terminating\n",
+                                 fsp_str_dbg(fsp),
+                                 smbXsrv_connection_dbg(xconn),
+                                 strerror(saved_errno)));
+                        errno = saved_errno;
                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
                 }
@@ -3698 +4121 @@
 nosendfile_read:
 
-        reply_outbuf(req, 12, smb_maxcnt);
-
-        nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
+        reply_outbuf(req, 12, smb_maxcnt + 1 /* padding byte */);
+        SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+        SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
+
+        nread = read_file(fsp, smb_buf(req->outbuf) + 1 /* padding byte */,
+                          startpos, smb_maxcnt);
         saved_errno = errno;
 
@@ -3712 +4138 @@
         setup_readX_header(req, (char *)req->outbuf, nread);
 
-        DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
-                    fsp->fnum, (int)smb_maxcnt, (int)nread ) );
-
-        chain_reply(req);
+        DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
+                  fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
         return;
 
@@ -3725 +4149 @@
 
 /****************************************************************************
+ Work out how much space we have for a read return.
+****************************************************************************/
+
+static size_t calc_max_read_pdu(const struct smb_request *req)
+{
+        struct smbXsrv_connection *xconn = req->xconn;
+
+        if (xconn->protocol < PROTOCOL_NT1) {
+                return xconn->smb1.sessions.max_send;
+        }
+
+        if (!lp_large_readwrite()) {
+                return xconn->smb1.sessions.max_send;
+        }
+
+        if (req_is_in_chain(req)) {
+                return xconn->smb1.sessions.max_send;
+        }
+
+        if (req->encrypted) {
+                /*
+                 * Don't take encrypted traffic up to the
+                 * limit. There are padding considerations
+                 * that make that tricky.
+                 */
+                return xconn->smb1.sessions.max_send;
+        }
+
+        if (srv_is_signing_active(xconn)) {
+                return 0x1FFFF;
+        }
+
+        if (!lp_unix_extensions()) {
+                return 0x1FFFF;
+        }
+
+        /*
+         * We can do ultra-large POSIX reads.
+         */
+        return 0xFFFFFF;
+}
+
+/****************************************************************************
+ Calculate how big a read can be. Copes with all clients. It's always
+ safe to return a short read - Windows does this.
+****************************************************************************/
+
+static size_t calc_read_size(const struct smb_request *req,
+                             size_t upper_size,
+                             size_t lower_size)
+{
+        struct smbXsrv_connection *xconn = req->xconn;
+        size_t max_pdu = calc_max_read_pdu(req);
+        size_t total_size = 0;
+        size_t hdr_len = MIN_SMB_SIZE + VWV(12);
+        size_t max_len = max_pdu - hdr_len - 1 /* padding byte */;
+
+        /*
+         * Windows explicitly ignores upper size of 0xFFFF.
+         * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
+         * We must do the same as these will never fit even in
+         * an extended size NetBIOS packet.
+         */
+        if (upper_size == 0xFFFF) {
+                upper_size = 0;
+        }
+
+        if (xconn->protocol < PROTOCOL_NT1) {
+                upper_size = 0;
+        }
+
+        total_size = ((upper_size<<16) | lower_size);
+
+        /*
+         * LARGE_READX test shows it's always safe to return
+         * a short read. Windows does so.
+         */
+        return MIN(total_size, max_len);
+}
+
+/****************************************************************************
  Reply to a read and X.
 ****************************************************************************/
@@ -3732 +4237 @@
         connection_struct *conn = req->conn;
         files_struct *fsp;
-        SMB_OFF_T startpos;
+        off_t startpos;
         size_t smb_maxcnt;
+        size_t upper_size;
         bool big_readX = False;
 #if 0
@@ -3768 +4274 @@
         }
 
-        if (global_client_caps & CAP_LARGE_READX) {
-                size_t upper_size = SVAL(req->vwv+7, 0);
-                smb_maxcnt |= (upper_size<<16);
-                if (upper_size > 1) {
-                        /* Can't do this on a chained packet. */
-                        if ((CVAL(req->vwv+0, 0) != 0xFF)) {
-                                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
-                                END_PROFILE(SMBreadX);
-                                return;
-                        }
-                        /* We currently don't do this on signed or sealed data. */
-                        if (srv_is_signing_active(req->sconn) || req->encrypted) {
-                                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
-                                END_PROFILE(SMBreadX);
-                                return;
-                        }
-                        /* Is there room in the reply for this data ? */
-                        if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
-                                reply_nterror(req,
-                                              NT_STATUS_INVALID_PARAMETER);
-                                END_PROFILE(SMBreadX);
-                                return;
-                        }
-                        big_readX = True;
-                }
+        upper_size = SVAL(req->vwv+7, 0);
+        smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
+        if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
+                /*
+                 * This is a heuristic to avoid keeping large
+                 * outgoing buffers around over long-lived aio
+                 * requests.
+                 */
+                big_readX = True;
         }
 
         if (req->wct == 12) {
-#ifdef LARGE_SMB_OFF_T
                 /*
                  * This is a large offset (64 bit) read.
                  */
-                startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
-
-#else /* !LARGE_SMB_OFF_T */
-
-                /*
-                 * Ensure we haven't been sent a >32 bit offset.
-                 */
-
-                if(IVAL(req->vwv+10, 0) != 0) {
-                        DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
-                                 "used and we don't support 64 bit offsets.\n",
-                                 (unsigned int)IVAL(req->vwv+10, 0) ));
-                        END_PROFILE(SMBreadX);
-                        reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-                        return;
-                }
-
-#endif /* LARGE_SMB_OFF_T */
+                startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
 
         }
@@ -3840 +4312 @@
         }
 
-        smbd_lock_socket(req->sconn);
+        smbd_lock_socket(req->xconn);
         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
-        smbd_unlock_socket(req->sconn);
+        smbd_unlock_socket(req->xconn);
 
  out:
@@ -3855 +4327 @@
 void error_to_writebrawerr(struct smb_request *req)
 {
-        uint8 *old_outbuf = req->outbuf;
+        uint8_t *old_outbuf = req->outbuf;
 
         reply_outbuf(req, 1, 0);
@@ -3873 +4345 @@
                                 size_t *len)
 {
-        uint8_t msgtype = SMBkeepalive;
-
-        while (msgtype == SMBkeepalive) {
+        uint8_t msgtype = NBSSkeepalive;
+
+        while (msgtype == NBSSkeepalive) {
                 NTSTATUS status;
 
@@ -3907 +4379 @@
 {
         connection_struct *conn = req->conn;
+        struct smbXsrv_connection *xconn = req->xconn;
         char *buf = NULL;
         ssize_t nwritten=0;
@@ -3912 +4385 @@
         size_t numtowrite=0;
         size_t tcount;
-        SMB_OFF_T startpos;
-        char *data=NULL;
+        off_t startpos;
+        const char *data=NULL;
         bool write_through;
         files_struct *fsp;
@@ -3926 +4399 @@
          * we're finished.
          */
-        SCVAL(req->inbuf,smb_com,SMBwritec);
-
-        if (srv_is_signing_active(req->sconn)) {
+        SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
+
+        if (srv_is_signing_active(xconn)) {
                 END_PROFILE(SMBwritebraw);
                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
@@ -3941 +4414 @@
         }
 
-        if (req->sconn->smb1.echo_handler.trusted_fde) {
+        if (xconn->smb1.echo_handler.trusted_fde) {
                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
                          "'async smb echo handler = yes'\n"));
@@ -3972 +4445 @@
 
         if(get_Protocol() <= PROTOCOL_COREPLUS) {
-                numtowrite = SVAL(smb_buf(req->inbuf),-2);
-                data = smb_buf(req->inbuf);
+                numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
+                data = smb_buf_const(req->inbuf);
         } else {
                 numtowrite = SVAL(req->vwv+10, 0);
@@ -4004 +4477 @@
         }
 
-        DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
+        DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
                         "wrote=%d sync=%d\n",
-                fsp->fnum, (double)startpos, (int)numtowrite,
+                fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
                 (int)nwritten, (int)write_through));
 
@@ -4018 +4491 @@
 
         /* Allocate a buffer of 64k + length. */
-        buf = TALLOC_ARRAY(NULL, char, 65540);
+        buf = talloc_array(NULL, char, 65540);
         if (!buf) {
                 reply_nterror(req, NT_STATUS_NO_MEMORY);
@@ -4033 +4506 @@
         SSVALS(buf,smb_vwv0,0xFFFF);
         show_msg(buf);
-        if (!srv_send_smb(req->sconn,
+        if (!srv_send_smb(req->xconn,
                           buf,
                           false, 0, /* no signing */
@@ -4043 +4516 @@
 
         /* Now read the raw data into the buffer and write it */
-        status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
+        status = read_smb_length(xconn->transport.sock, buf, SMB_SECONDARY_WAIT,
                                  &numtowrite);
         if (!NT_STATUS_IS_OK(status)) {
@@ -4067 +4540 @@
                 }
 
-                status = read_data(req->sconn->sock, buf+4, numtowrite);
+                status = read_data_ntstatus(xconn->transport.sock, buf+4,
+                                            numtowrite);
 
                 if (!NT_STATUS_IS_OK(status)) {
-                        char addr[INET6_ADDRSTRLEN];
                         /* Try and give an error message
                          * saying what client failed. */
@@ -4076 +4549 @@
                                   "raw read failed (%s) for client %s. "
                                   "Terminating\n", nt_errstr(status),
-                                  get_peer_addr(req->sconn->sock, addr,
-                                                sizeof(addr))));
+                                  smbXsrv_connection_dbg(xconn)));
                         exit_server_cleanly("secondary writebraw failed");
                 }
@@ -4111 +4583 @@
         }
 
-        DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
+        DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
                 "wrote=%d\n",
-                fsp->fnum, (double)startpos, (int)numtowrite,
+                fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
                 (int)total_written));
 
@@ -4129 +4601 @@
                 /*
                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
-                 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
+                 * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
                  * JRA.
                  */
-                if (!send_keepalive(req->sconn->sock)) {
+                if (!send_keepalive(xconn->transport.sock)) {
                         exit_server_cleanly("reply_writebraw: send of "
                                 "keepalive failed");
@@ -4162 +4634 @@
         ssize_t nwritten = -1;
         size_t numtowrite;
-        SMB_OFF_T startpos;
+        off_t startpos;
         const char *data;
         NTSTATUS status = NT_STATUS_OK;
@@ -4252 +4724 @@
         SSVAL(req->outbuf,smb_vwv0,nwritten);
 
-        DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
-                 fsp->fnum, (int)numtowrite, (int)nwritten));
+        DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
+                  fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
 
 strict_unlock:
@@ -4276 +4748 @@
         size_t numtowrite;
         ssize_t nwritten = -1;
-        SMB_OFF_T startpos;
+        off_t startpos;
         const char *data;
         files_struct *fsp;
@@ -4337 +4809 @@
                  * This is actually an allocate call, and set EOF. JRA.
                  */
-                nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
+                nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
                 if (nwritten < 0) {
                         reply_nterror(req, NT_STATUS_DISK_FULL);
                         goto strict_unlock;
                 }
-                nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
+                nwritten = vfs_set_filelen(fsp, (off_t)startpos);
                 if (nwritten < 0) {
                         reply_nterror(req, NT_STATUS_DISK_FULL);
@@ -4379 +4851 @@
         }
 
-        DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
+        DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
 
 strict_unlock:
@@ -4398 +4870 @@
                                                 1 /* pad byte */)
 
-bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
+bool is_valid_writeX_buffer(struct smbXsrv_connection *xconn,
                             const uint8_t *inbuf)
 {
         size_t numtowrite;
-        connection_struct *conn = NULL;
         unsigned int doff = 0;
         size_t len = smb_len_large(inbuf);
+        uint16_t fnum;
+        struct smbXsrv_open *op = NULL;
+        struct files_struct *fsp = NULL;
+        NTSTATUS status;
 
         if (is_encrypted_packet(inbuf)) {
@@ -4423 +4898 @@
         }
 
-        conn = conn_find(sconn, SVAL(inbuf, smb_tid));
-        if (conn == NULL) {
-                DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
+        fnum = SVAL(inbuf, smb_vwv2);
+        status = smb1srv_open_lookup(xconn,
+                                     fnum,
+                                     0, /* now */
+                                     &op);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10,("is_valid_writeX_buffer: bad fnum\n"));
                 return false;
         }
-        if (IS_IPC(conn)) {
+        fsp = op->compat;
+        if (fsp == NULL) {
+                DEBUG(10,("is_valid_writeX_buffer: bad fsp\n"));
+                return false;
+        }
+        if (fsp->conn == NULL) {
+                DEBUG(10,("is_valid_writeX_buffer: bad fsp->conn\n"));
+                return false;
+        }
+
+        if (IS_IPC(fsp->conn)) {
                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
                 return false;
         }
-        if (IS_PRINT(conn)) {
+        if (IS_PRINT(fsp->conn)) {
                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
                 return false;
@@ -4483 +4972 @@
 {
         connection_struct *conn = req->conn;
+        struct smbXsrv_connection *xconn = req->xconn;
         files_struct *fsp;
         struct lock_struct lock;
-        SMB_OFF_T startpos;
+        off_t startpos;
         size_t numtowrite;
         bool write_through;
@@ -4491 +4981 @@
         unsigned int smb_doff;
         unsigned int smblen;
-        char *data;
+        const char *data;
         NTSTATUS status;
         int saved_errno = 0;
@@ -4499 +4989 @@
         if ((req->wct != 12) && (req->wct != 14)) {
                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                END_PROFILE(SMBwriteX);
-                return;
+                goto out;
         }
 
@@ -4517 +5006 @@
                 if (IS_IPC(conn)) {
                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        END_PROFILE(SMBwriteX);
-                        return;
+                        goto out;
                 }
                 if (numtowrite != req->unread_bytes) {
                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        END_PROFILE(SMBwriteX);
-                        return;
+                        goto out;
                 }
         } else {
@@ -4529 +5016 @@
                                 smb_doff + numtowrite > smblen) {
                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        END_PROFILE(SMBwriteX);
-                        return;
+                        goto out;
                 }
         }
@@ -4538 +5024 @@
                 if (req->unread_bytes) {
                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        END_PROFILE(SMBwriteX);
-                        return;
+                        goto out;
                 }
                 reply_pipe_write_and_X(req);
-                END_PROFILE(SMBwriteX);
-                return;
+                goto out;
         }
 
@@ -4551 +5035 @@
 
         if (!check_fsp(conn, req, fsp)) {
-                END_PROFILE(SMBwriteX);
-                return;
+                goto out;
         }
 
         if (!CHECK_WRITE(fsp)) {
                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-                END_PROFILE(SMBwriteX);
-                return;
+                goto out;
         }
 
@@ -4564 +5046 @@
 
         if(req->wct == 14) {
-#ifdef LARGE_SMB_OFF_T
                 /*
                  * This is a large offset (64 bit) write.
                  */
-                startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
-
-#else /* !LARGE_SMB_OFF_T */
-
-                /*
-                 * Ensure we haven't been sent a >32 bit offset.
-                 */
-
-                if(IVAL(req->vwv+12, 0) != 0) {
-                        DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
-                                 "used and we don't support 64 bit offsets.\n",
-                                 (unsigned int)IVAL(req->vwv+12, 0) ));
-                        reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-                        END_PROFILE(SMBwriteX);
-                        return;
-                }
-
-#endif /* LARGE_SMB_OFF_T */
+                startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
+
         }
 
@@ -4642 +5107 @@
 
         reply_outbuf(req, 6, 0);
+        SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+        SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
         SSVAL(req->outbuf,smb_vwv2,nwritten);
         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
 
-        DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
-                fsp->fnum, (int)numtowrite, (int)nwritten));
+        DEBUG(3,("writeX %s num=%d wrote=%d\n",
+                fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
 
         status = sync_file(conn, fsp, write_through);
@@ -4657 +5124 @@
 
         END_PROFILE(SMBwriteX);
-        chain_reply(req);
         return;
 
 out:
+        if (req->unread_bytes) {
+                /* writeX failed. drain socket. */
+                if (drain_socket(xconn->transport.sock, req->unread_bytes) !=
+                                req->unread_bytes) {
+                        smb_panic("failed to drain pending bytes");
+                }
+                req->unread_bytes = 0;
+        }
+
         END_PROFILE(SMBwriteX);
         return;
@@ -4672 +5147 @@
 {
         connection_struct *conn = req->conn;
-        SMB_OFF_T startpos;
-        SMB_OFF_T res= -1;
+        off_t startpos;
+        off_t res= -1;
         int mode,umode;
         files_struct *fsp;
@@ -4691 +5166 @@
         }
 
-        flush_write_cache(fsp, SEEK_FLUSH);
+        flush_write_cache(fsp, SAMBA_SEEK_FLUSH);
 
         mode = SVAL(req->vwv+1, 0) & 3;
         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
-        startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
+        startpos = (off_t)IVALS(req->vwv+2, 0);
 
         switch (mode) {
@@ -4718 +5193 @@
                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
                         if(errno == EINVAL) {
-                                SMB_OFF_T current_pos = startpos;
+                                off_t current_pos = startpos;
 
                                 if(fsp_stat(fsp) == -1) {
@@ -4745 +5220 @@
         SIVAL(req->outbuf,smb_vwv0,res);
 
-        DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
-                fsp->fnum, (double)startpos, (double)res, mode));
+        DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
+                fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
 
         END_PROFILE(SMBlseek);
@@ -4759 +5234 @@
 {
         connection_struct *conn = req->conn;
-        uint16 fnum;
+        uint16_t fnum;
         files_struct *fsp;
 
@@ -4815 +5290 @@
 }
 
-/****************************************************************************
- Reply to a close - has to deal with closing a directory opened by NT SMB's.
-****************************************************************************/
+struct reply_close_state {
+        files_struct *fsp;
+        struct smb_request *smbreq;
+};
+
+static void do_smb1_close(struct tevent_req *req);
 
 void reply_close(struct smb_request *req)
@@ -4844 +5322 @@
         }
 
-        if(fsp->is_directory) {
-                /*
-                 * Special case - close NT SMB directory handle.
-                 */
-                DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
-                status = close_file(req, fsp, NORMAL_CLOSE);
-        } else {
+        DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
+                  fsp->is_directory ? "directory" : "file",
+                  fsp->fh->fd, fsp_fnum_dbg(fsp),
+                  conn->num_files_open));
+
+        if (!fsp->is_directory) {
                 time_t t;
-                /*
-                 * Close ordinary file.
-                 */
-
-                DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
-                         fsp->fh->fd, fsp->fnum,
-                         conn->num_files_open));
 
                 /*
@@ -4866 +5336 @@
                 t = srv_make_unix_date3(req->vwv+1);
                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
+        }
+
+        if (fsp->num_aio_requests != 0) {
+
+                struct reply_close_state *state;
+
+                DEBUG(10, ("closing with aio %u requests pending\n",
+                           fsp->num_aio_requests));
 
                 /*
-                 * close_file() returns the unix errno if an error
-                 * was detected on close - normally this is due to
-                 * a disk full error. If not then it was probably an I/O error.
+                 * We depend on the aio_extra destructor to take care of this
+                 * close request once fsp->num_aio_request drops to 0.
                  */
 
-                status = close_file(req, fsp, NORMAL_CLOSE);
-        }  
-
+                fsp->deferred_close = tevent_wait_send(
+                        fsp, fsp->conn->sconn->ev_ctx);
+                if (fsp->deferred_close == NULL) {
+                        status = NT_STATUS_NO_MEMORY;
+                        goto done;
+                }
+
+                state = talloc(fsp, struct reply_close_state);
+                if (state == NULL) {
+                        TALLOC_FREE(fsp->deferred_close);
+                        status = NT_STATUS_NO_MEMORY;
+                        goto done;
+                }
+                state->fsp = fsp;
+                state->smbreq = talloc_move(fsp, &req);
+                tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
+                                        state);
+                END_PROFILE(SMBclose);
+                return;
+        }
+
+        /*
+         * close_file() returns the unix errno if an error was detected on
+         * close - normally this is due to a disk full error. If not then it
+         * was probably an I/O error.
+         */
+
+        status = close_file(req, fsp, NORMAL_CLOSE);
+done:
         if (!NT_STATUS_IS_OK(status)) {
                 reply_nterror(req, status);
@@ -4885 +5388 @@
         END_PROFILE(SMBclose);
         return;
+}
+
+static void do_smb1_close(struct tevent_req *req)
+{
+        struct reply_close_state *state = tevent_req_callback_data(
+                req, struct reply_close_state);
+        struct smb_request *smbreq;
+        NTSTATUS status;
+        int ret;
+
+        ret = tevent_wait_recv(req);
+        TALLOC_FREE(req);
+        if (ret != 0) {
+                DEBUG(10, ("tevent_wait_recv returned %s\n",
+                           strerror(ret)));
+                /*
+                 * Continue anyway, this should never happen
+                 */
+        }
+
+        /*
+         * fsp->smb2_close_request right now is a talloc grandchild of
+         * fsp. When we close_file(fsp), it would go with it. No chance to
+         * reply...
+         */
+        smbreq = talloc_move(talloc_tos(), &state->smbreq);
+
+        status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
+        if (NT_STATUS_IS_OK(status)) {
+                reply_outbuf(smbreq, 0, 0);
+        } else {
+                reply_nterror(smbreq, status);
+        }
+        if (!srv_send_smb(smbreq->xconn,
+                        (char *)smbreq->outbuf,
+                        true,
+                        smbreq->seqnum+1,
+                        IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
+                        NULL)) {
+                exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
+                                    "failed.");
+        }
+        TALLOC_FREE(smbreq);
 }
 
@@ -4897 +5443 @@
         ssize_t nwritten = -1;
         NTSTATUS close_status = NT_STATUS_OK;
-        SMB_OFF_T startpos;
+        off_t startpos;
         const char *data;
         struct timespec mtime;
@@ -4928 +5474 @@
         data = (const char *)req->buf + 1;
 
-        if (!fsp->print_file) {
+        if (fsp->print_file == NULL) {
                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
@@ -4942 +5488 @@
         nwritten = write_file(req,fsp,data,startpos,numtowrite);
 
+        if (fsp->print_file == NULL) {
+                SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+        }
+
         set_close_write_time(fsp, mtime);
 
@@ -4949 +5499 @@
          */
 
+        DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
+                fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
+                (numtowrite) ? conn->num_files_open - 1 : conn->num_files_open));
+
         if (numtowrite) {
                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
                          "file %s\n", fsp_str_dbg(fsp)));
                 close_status = close_file(req, fsp, NORMAL_CLOSE);
-        }
-
-        DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
-                 fsp->fnum, (int)numtowrite, (int)nwritten,
-                 conn->num_files_open));
+                fsp = NULL;
+        }
 
         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
                 reply_nterror(req, NT_STATUS_DISK_FULL);
-                goto strict_unlock;
+                goto out;
         }
 
         if(!NT_STATUS_IS_OK(close_status)) {
                 reply_nterror(req, close_status);
-                goto strict_unlock;
+                goto out;
         }
 
@@ -4973 +5524 @@
         SSVAL(req->outbuf,smb_vwv0,nwritten);
 
-strict_unlock:
-        if (numtowrite && !fsp->print_file) {
-                SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
-        }
+out:
 
         END_PROFILE(SMBwriteclose);
@@ -5015 +5563 @@
         offset = (uint64_t)IVAL(req->vwv+3, 0);
 
-        DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
-                 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
+        DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
+                 fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
 
         br_lck = do_lock(req->sconn->msg_ctx,
@@ -5027 +5575 @@
                         False, /* Non-blocking lock. */
                         &status,
-                        NULL,
                         NULL);
 
@@ -5086 +5633 @@
         }
 
-        DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
-                    fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
+        DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
+                    fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
 
         reply_outbuf(req, 0, 0);
@@ -5105 +5652 @@
 void reply_tdis(struct smb_request *req)
 {
+        NTSTATUS status;
         connection_struct *conn = req->conn;
+        struct smbXsrv_tcon *tcon;
+
         START_PROFILE(SMBtdis);
 
         if (!conn) {
                 DEBUG(4,("Invalid connection in tdis\n"));
-                reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
+                reply_force_doserror(req, ERRSRV, ERRinvnid);
                 END_PROFILE(SMBtdis);
                 return;
         }
 
-        conn->used = False;
-
-        close_cnum(conn,req->vuid);
+        tcon = conn->tcon;
         req->conn = NULL;
+
+        /*
+         * TODO: cancel all outstanding requests on the tcon
+         */
+        status = smbXsrv_tcon_disconnect(tcon, req->vuid);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("reply_tdis: "
+                          "smbXsrv_tcon_disconnect() failed: %s\n",
+                          nt_errstr(status)));
+                /*
+                 * If we hit this case, there is something completely
+                 * wrong, so we better disconnect the transport connection.
+                 */
+                END_PROFILE(SMBtdis);
+                exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
+                return;
+        }
+
+        TALLOC_FREE(tcon);
 
         reply_outbuf(req, 0, 0);
@@ -5175 +5742 @@
 
                 show_msg((char *)req->outbuf);
-                if (!srv_send_smb(req->sconn,
+                if (!srv_send_smb(req->xconn,
                                 (char *)req->outbuf,
                                 true, req->seqnum+1,
@@ -5235 +5802 @@
         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
 
-        DEBUG(3,("openprint fd=%d fnum=%d\n",
-                 fsp->fh->fd, fsp->fnum));
+        DEBUG(3,("openprint fd=%d %s\n",
+                 fsp->fh->fd, fsp_fnum_dbg(fsp)));
 
         END_PROFILE(SMBsplopen);
@@ -5273 +5840 @@
         }
 
-        DEBUG(3,("printclose fd=%d fnum=%d\n",
-                 fsp->fh->fd,fsp->fnum));
+        DEBUG(3,("printclose fd=%d %s\n",
+                 fsp->fh->fd, fsp_fnum_dbg(fsp)));
 
         status = close_file(req, fsp, NORMAL_CLOSE);
@@ -5334 +5901 @@
                 NTSTATUS status;
                 WERROR werr;
-                const char *sharename = lp_servicename(SNUM(conn));
+                const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
                 struct rpc_pipe_client *cli = NULL;
                 struct dcerpc_binding_handle *b = NULL;
@@ -5348 +5915 @@
 
                 status = rpc_pipe_open_interface(conn,
-                                                 &ndr_table_spoolss.syntax_id,
+                                                 &ndr_table_spoolss,
                                                  conn->session_info,
-                                                 &conn->sconn->client_id,
+                                                 conn->sconn->remote_address,
                                                  conn->sconn->msg_ctx,
                                                  &cli);
@@ -5409 +5976 @@
                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
                         int qstatus;
+                        size_t len = 0;
                         uint16_t qrapjobid = pjobid_to_rap(sharename,
                                                         info[i].info2.job_id);
@@ -5423 +5991 @@
                         SIVAL(p, 7, info[i].info2.size);
                         SCVAL(p, 11, 0);
-                        srvstr_push(blob, req->flags2, p+12,
-                                    info[i].info2.notify_name, 16, STR_ASCII);
-
+                        status = srvstr_push(blob, req->flags2, p+12,
+                                    info[i].info2.notify_name, 16, STR_ASCII, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                reply_nterror(req, status);
+                                goto out;
+                        }
                         if (message_push_blob(
                                     &req->outbuf,
@@ -5506 +6077 @@
         data = (const char *)req->buf + 3;
 
-        if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
+        if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
                 reply_nterror(req, map_nt_error_from_unix(errno));
                 END_PROFILE(SMBsplwr);
@@ -5512 +6083 @@
         }
 
-        DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
+        DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
 
         END_PROFILE(SMBsplwr);
@@ -5528 +6099 @@
         char *directory = NULL;
         NTSTATUS status;
+        uint32_t ucf_flags = UCF_PREP_CREATEFILE |
+                        (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -5542 +6115 @@
                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
                                  directory,
-                                 UCF_CREATING_FILE,
+                                 ucf_flags,
                                  NULL,
                                  &smb_dname);
@@ -5598 +6171 @@
         files_struct *fsp = NULL;
         int info = 0;
+        uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         struct smbd_server_connection *sconn = req->sconn;
 
@@ -5612 +6186 @@
                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
                                  directory,
-                                 0,
+                                 ucf_flags,
                                  NULL,
                                  &smb_dname);
@@ -5642 +6216 @@
                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
                 0,                                      /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 0,                                      /* private_flags */
@@ -5647 +6222 @@
                 NULL,                                   /* ea_list */
                 &fsp,                                   /* result */
-                &info);                                 /* pinfo */
+                &info,                                  /* pinfo */
+                NULL, NULL);                            /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
-                if (open_was_deferred(req->mid)) {
+                if (open_was_deferred(req->xconn, req->mid)) {
                         /* We have re-scheduled this call. */
                         goto out;
@@ -5667 +6243 @@
         if (!set_delete_on_close(fsp, true,
                         conn->session_info->security_token,
-                        &conn->session_info->utok)) {
+                        conn->session_info->unix_token)) {
                 close_file(req, fsp, ERROR_CLOSE);
                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
@@ -5823 +6399 @@
 static void rename_open_files(connection_struct *conn,
                               struct share_mode_lock *lck,
+                              struct file_id id,
                               uint32_t orig_name_hash,
                               const struct smb_filename *smb_fname_dst)
@@ -5829 +6406 @@
         bool did_rename = False;
         NTSTATUS status;
-        uint32_t new_name_hash;
-
-        for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
+        uint32_t new_name_hash = 0;
+
+        for(fsp = file_find_di_first(conn->sconn, id); fsp;
             fsp = file_find_di_next(fsp)) {
                 /* fsp_name is a relative path under the fsp. To change this for other
@@ -5843 +6420 @@
                         continue;
                 }
-                DEBUG(10, ("rename_open_files: renaming file fnum %d "
-                           "(file_id %s) from %s -> %s\n", fsp->fnum,
+                DEBUG(10, ("rename_open_files: renaming file %s "
+                           "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
                            smb_fname_str_dbg(smb_fname_dst)));
@@ -5857 +6434 @@
         if (!did_rename) {
                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
-                           "for %s\n", file_id_string_tos(&lck->id),
+                           "for %s\n", file_id_string_tos(&id),
                            smb_fname_str_dbg(smb_fname_dst)));
         }
 
         /* Send messages to all smbd's (not ourself) that the name has changed. */
-        rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
+        rename_share_filename(conn->sconn->msg_ctx, lck, id, conn->connectpath,
                               orig_name_hash, new_name_hash,
                               smb_fname_dst);
@@ -5908 +6485 @@
         char *parent_dir_src = NULL;
         char *parent_dir_dst = NULL;
-        uint32 mask;
+        uint32_t mask;
 
         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
@@ -5995 +6572 @@
                         files_struct *fsp,
                         const struct smb_filename *smb_fname_dst_in,
-                        uint32 attrs,
+                        uint32_t attrs,
                         bool replace_if_exists)
 {
@@ -6016 +6593 @@
         /* Make a copy of the dst smb_fname structs */
 
-        status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
-        if (!NT_STATUS_IS_OK(status)) {
+        smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
+        if (smb_fname_dst == NULL) {
+                status = NT_STATUS_NO_MEMORY;
                 goto out;
         }
@@ -6023 +6601 @@
         /*
          * Check for special case with case preserving and not
-         * case sensitive. If the old last component differs from the original
+         * case sensitive. If the new last component differs from the original
          * last component only by case, then we should allow
          * the rename (user is trying to change the case of the
          * filename).
          */
-        if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
+        if (!conn->case_sensitive && conn->case_preserve &&
             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
@@ -6053 +6631 @@
                  * component of the destination.
                  */
-                status = create_synthetic_smb_fname_split(ctx,
-                    smb_fname_dst->original_lcomp, NULL,
-                    &smb_fname_orig_lcomp);
-                if (!NT_STATUS_IS_OK(status)) {
+                smb_fname_orig_lcomp = synthetic_smb_fname_split(
+                        ctx, smb_fname_dst->original_lcomp, NULL);
+                if (smb_fname_orig_lcomp == NULL) {
+                        status = NT_STATUS_NO_MEMORY;
                         TALLOC_FREE(fname_dst_lcomp_base_mod);
                         goto out;
@@ -6183 +6761 @@
         }
 
-        lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
-                                  NULL);
+        lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
 
         /*
@@ -6194 +6771 @@
 
         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
-                uint32 create_options = fsp->fh->private_options;
+                uint32_t create_options = fsp->fh->private_options;
 
                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
@@ -6220 +6797 @@
                               smb_fname_dst);
 
-                rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
+                rename_open_files(conn, lck, fsp->file_id, fsp->name_hash,
+                                  smb_fname_dst);
 
                 /*
@@ -6273 +6851 @@
                         struct smb_filename *smb_fname_src,
                         struct smb_filename *smb_fname_dst,
-                        uint32 attrs,
+                        uint32_t attrs,
                         bool replace_if_exists,
                         bool src_has_wild,
@@ -6288 +6866 @@
         long offset = 0;
         int create_options = 0;
-        bool posix_pathnames = lp_posix_pathnames();
+        bool posix_pathnames = (req != NULL && req->posix_pathnames);
+        int rc;
 
         /*
@@ -6381 +6960 @@
                 ZERO_STRUCT(smb_fname_src->st);
                 if (posix_pathnames) {
-                        SMB_VFS_LSTAT(conn, smb_fname_src);
+                        rc = SMB_VFS_LSTAT(conn, smb_fname_src);
                 } else {
-                        SMB_VFS_STAT(conn, smb_fname_src);
+                        rc = SMB_VFS_STAT(conn, smb_fname_src);
+                }
+                if (rc == -1) {
+                        status = map_nt_error_from_unix_common(errno);
+                        goto out;
                 }
 
@@ -6402 +6985 @@
                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
                         0,                              /* oplock_request */
+                        NULL,                           /* lease */
                         0,                              /* allocation_size */
                         0,                              /* private_flags */
@@ -6407 +6991 @@
                         NULL,                           /* ea_list */
                         &fsp,                           /* result */
-                        NULL);                          /* pinfo */
+                        NULL,                           /* pinfo */
+                        NULL, NULL);                    /* create context */
 
                 if (!NT_STATUS_IS_OK(status)) {
@@ -6548 +7133 @@
                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
                         0,                              /* oplock_request */
+                        NULL,                           /* lease */
                         0,                              /* allocation_size */
                         0,                              /* private_flags */
@@ -6553 +7139 @@
                         NULL,                           /* ea_list */
                         &fsp,                           /* result */
-                        NULL);                          /* pinfo */
+                        NULL,                           /* pinfo */
+                        NULL, NULL);                    /* create context */
 
                 if (!NT_STATUS_IS_OK(status)) {
@@ -6614 +7201 @@
         char *newname = NULL;
         const char *p;
-        uint32 attrs;
+        uint32_t attrs;
         NTSTATUS status;
         bool src_has_wcard = False;
@@ -6621 +7208 @@
         struct smb_filename *smb_fname_src = NULL;
         struct smb_filename *smb_fname_dst = NULL;
-        uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
-        uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
+        uint32_t src_ucf_flags = (req->posix_pathnames ?
+                (UCF_UNIX_NAME_LOOKUP|UCF_POSIX_PATHNAMES) :
+                UCF_COND_ALLOW_WCARD_LCOMP);
+        uint32_t dst_ucf_flags = UCF_SAVE_LCOMP |
+                (req->posix_pathnames ? UCF_POSIX_PATHNAMES :
+                 UCF_COND_ALLOW_WCARD_LCOMP);
         bool stream_rename = false;
 
@@ -6649 +7240 @@
         }
 
-        if (!lp_posix_pathnames()) {
+        if (!req->posix_pathnames) {
                 /* The newname must begin with a ':' if the
                    name contains a ':'. */
@@ -6716 +7307 @@
                                   DELETE_ACCESS);
         if (!NT_STATUS_IS_OK(status)) {
-                if (open_was_deferred(req->mid)) {
+                if (open_was_deferred(req->xconn, req->mid)) {
                         /* We have re-scheduled this call. */
                         goto out;
@@ -6749 +7340 @@
 {
         struct smb_filename *smb_fname_dst_tmp = NULL;
-        SMB_OFF_T ret=-1;
+        off_t ret=-1;
         files_struct *fsp1,*fsp2;
-        uint32 dosattrs;
-        uint32 new_create_disposition;
+        uint32_t dosattrs;
+        uint32_t new_create_disposition;
         NTSTATUS status;
 
 
-        status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
+        smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
+        if (smb_fname_dst_tmp == NULL) {
+                return NT_STATUS_NO_MEMORY;
         }
 
@@ -6817 +7408 @@
                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 0,                                      /* private_flags */
@@ -6822 +7414 @@
                 NULL,                                   /* ea_list */
                 &fsp1,                                  /* result */
-                NULL);                                  /* psbuf */
+                NULL,                                   /* psbuf */
+                NULL, NULL);                            /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -6846 +7439 @@
                 dosattrs,                               /* file_attributes */
                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 0,                                      /* private_flags */
@@ -6851 +7445 @@
                 NULL,                                   /* ea_list */
                 &fsp2,                                  /* result */
-                NULL);                                  /* psbuf */
+                NULL,                                   /* psbuf */
+                NULL, NULL);                            /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -6894 +7489 @@
         }
 
-        if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
+        if (ret != (off_t)smb_fname_src->st.st_ex_size) {
                 status = NT_STATUS_DISK_FULL;
                 goto out;
@@ -6929 +7524 @@
         bool dest_has_wild = False;
         NTSTATUS status;
+        uint32_t ucf_flags_src = UCF_COND_ALLOW_WCARD_LCOMP |
+                (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
+        uint32_t ucf_flags_dst = UCF_COND_ALLOW_WCARD_LCOMP |
+                (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -6968 +7567 @@
                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
                                   fname_src,
-                                  UCF_COND_ALLOW_WCARD_LCOMP,
+                                  ucf_flags_src,
                                   &source_has_wild,
                                   &smb_fname_src);
@@ -6984 +7583 @@
                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
                                   fname_dst,
-                                  UCF_COND_ALLOW_WCARD_LCOMP,
+                                  ucf_flags_dst,
                                   &dest_has_wild,
                                   &smb_fname_dst);
@@ -7283 +7882 @@
                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
         } else {
-
-#if defined(HAVE_LONGLONG)
+                /*
+                 * No BVAL, this is reversed!
+                 */
                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
-#else /* HAVE_LONGLONG */
-
-                /*
-                 * NT4.x seems to be broken in that it sends large file (64 bit)
-                 * lockingX calls even if the CAP_LARGE_FILES was *not*
-                 * negotiated. For boxes without large unsigned ints truncate the
-                 * lock count by dropping the top 32 bits.
-                 */
-
-                if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
-                        DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
-                                (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
-                                (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
-                                SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
-                }
-
-                count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
-#endif /* HAVE_LONGLONG */
         }
 
         return count;
 }
-
-#if !defined(HAVE_LONGLONG)
-/****************************************************************************
- Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
-****************************************************************************/
-
-static uint32 map_lock_offset(uint32 high, uint32 low)
-{
-        unsigned int i;
-        uint32 mask = 0;
-        uint32 highcopy = high;
-
-        /*
-         * Try and find out how many significant bits there are in high.
-         */
-
-        for(i = 0; highcopy; i++)
-                highcopy >>= 1;
-
-        /*
-         * We use 31 bits not 32 here as POSIX
-         * lock offsets may not be negative.
-         */
-
-        mask = (~0) << (31 - i);
-
-        if(low & mask)
-                return 0; /* Fail. */
-
-        high <<= (31 - i);
-
-        return (high|low);
-}
-#endif /* !defined(HAVE_LONGLONG) */
 
 /****************************************************************************
@@ -7349 +7897 @@
 
 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
-                         bool large_file_format, bool *err)
+                         bool large_file_format)
 {
         uint64_t offset = 0;
-
-        *err = False;
 
         if(!large_file_format) {
                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
         } else {
-
-#if defined(HAVE_LONGLONG)
+                /*
+                 * No BVAL, this is reversed!
+                 */
                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
-#else /* HAVE_LONGLONG */
-
-                /*
-                 * NT4.x seems to be broken in that it sends large file (64 bit)
-                 * lockingX calls even if the CAP_LARGE_FILES was *not*
-                 * negotiated. For boxes without large unsigned ints mangle the
-                 * lock offset by mapping the top 32 bits onto the lower 32.
-                 */
-
-                if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
-                        uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
-                        uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
-                        uint32 new_low = 0;
-
-                        if((new_low = map_lock_offset(high, low)) == 0) {
-                                *err = True;
-                                return (uint64_t)-1;
-                        }
-
-                        DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
-                                (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
-                        SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
-                        SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
-                }
-
-                offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
-#endif /* HAVE_LONGLONG */
         }
 
@@ -7398 +7918 @@
                          uint8_t type,
                          int32_t timeout,
-                         uint16_t num_ulocks,
-                         struct smbd_lock_element *ulocks,
                          uint16_t num_locks,
                          struct smbd_lock_element *locks,
@@ -7410 +7928 @@
         *async = false;
 
-        /* Data now points at the beginning of the list
-           of smb_unlkrng structs */
-        for(i = 0; i < (int)num_ulocks; i++) {
-                struct smbd_lock_element *e = &ulocks[i];
-
-                DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
-                          "pid %u, file %s\n",
-                          (double)e->offset,
-                          (double)e->count,
-                          (unsigned int)e->smblctx,
-                          fsp_str_dbg(fsp)));
-
-                if (e->brltype != UNLOCK_LOCK) {
-                        /* this can only happen with SMB2 */
-                        return NT_STATUS_INVALID_PARAMETER;
-                }
-
-                status = do_unlock(req->sconn->msg_ctx,
-                                fsp,
-                                e->smblctx,
-                                e->count,
-                                e->offset,
-                                WINDOWS_LOCK);
-
-                DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
-                    nt_errstr(status)));
-
-                if (!NT_STATUS_IS_OK(status)) {
-                        return status;
-                }
-        }
-
         /* Setup the timeout in seconds. */
 
@@ -7447 +7933 @@
                 timeout = 0;
         }
-
-        /* Data now points at the beginning of the list
-           of smb_lkrng structs */
 
         for(i = 0; i < (int)num_locks; i++) {
@@ -7468 +7951 @@
                                 /*
                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
-                                 * if the lock vector contains one entry. When given mutliple cancel
+                                 * if the lock vector contains one entry. When given multiple cancel
                                  * requests in a single PDU we expect the server to return an
                                  * error. Windows servers seem to accept the request but only
@@ -7513 +7996 @@
                                                 e->count,
                                                 e->offset,
-                                                WINDOWS_LOCK,
-                                                blr);
+                                                WINDOWS_LOCK);
                 } else {
                         bool blocking_lock = timeout ? true : false;
@@ -7530 +8012 @@
                                         blocking_lock,
                                         &status,
-                                        &block_smblctx,
-                                        NULL);
+                                        &block_smblctx);
 
                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
@@ -7621 +8102 @@
         }
 
-        DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
-                  fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
+        DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d\n",
+                  fsp_fnum_dbg(fsp), (unsigned int)type, num_locks));
+
+        return NT_STATUS_OK;
+}
+
+NTSTATUS smbd_do_unlocking(struct smb_request *req,
+                           files_struct *fsp,
+                           uint16_t num_ulocks,
+                           struct smbd_lock_element *ulocks)
+{
+        int i;
+
+        for(i = 0; i < (int)num_ulocks; i++) {
+                struct smbd_lock_element *e = &ulocks[i];
+                NTSTATUS status;
+
+                DEBUG(10,("%s: unlock start=%.0f, len=%.0f for "
+                          "pid %u, file %s\n", __func__,
+                          (double)e->offset,
+                          (double)e->count,
+                          (unsigned int)e->smblctx,
+                          fsp_str_dbg(fsp)));
+
+                if (e->brltype != UNLOCK_LOCK) {
+                        /* this can only happen with SMB2 */
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                status = do_unlock(req->sconn->msg_ctx,
+                                fsp,
+                                e->smblctx,
+                                e->count,
+                                e->offset,
+                                WINDOWS_LOCK);
+
+                DEBUG(10, ("%s: unlock returned %s\n", __func__,
+                           nt_errstr(status)));
+
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+        }
+
+        DEBUG(3, ("%s: %s num_ulocks=%d\n", __func__, fsp_fnum_dbg(fsp),
+                  num_ulocks));
 
         return NT_STATUS_OK;
@@ -7637 +8162 @@
         unsigned char locktype;
         unsigned char oplocklevel;
-        uint16 num_ulocks;
-        uint16 num_locks;
-        int32 lock_timeout;
+        uint16_t num_ulocks;
+        uint16_t num_locks;
+        int32_t lock_timeout;
         int i;
         const uint8_t *data;
         bool large_file_format;
-        bool err;
         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
         struct smbd_lock_element *ulocks;
@@ -7663 +8187 @@
         num_locks = SVAL(req->vwv+7, 0);
         lock_timeout = IVAL(req->vwv+4, 0);
-        large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
+        large_file_format = ((locktype & LOCKING_ANDX_LARGE_FILES) != 0);
 
         if (!check_fsp(conn, req, fsp)) {
@@ -7684 +8208 @@
            we have granted an oplock on.
         */
-        if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
+        if (locktype & LOCKING_ANDX_OPLOCK_RELEASE) {
                 /* Client can insist on breaking to none. */
                 bool break_to_none = (oplocklevel == 0);
@@ -7690 +8214 @@
 
                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
-                         "for fnum = %d\n", (unsigned int)oplocklevel,
-                         fsp->fnum ));
+                         "for %s\n", (unsigned int)oplocklevel,
+                         fsp_fnum_dbg(fsp)));
 
                 /*
@@ -7707 +8231 @@
 
                         DEBUG(5,("reply_lockingX: Error : oplock break from "
-                                 "client for fnum = %d (oplock=%d) and no "
+                                 "client for %s (oplock=%d) and no "
                                  "oplock granted on this file (%s).\n",
-                                 fsp->fnum, fsp->oplock_type,
+                                 fsp_fnum_dbg(fsp), fsp->oplock_type,
                                  fsp_str_dbg(fsp)));
 
@@ -7738 +8262 @@
                 }
 
-                reply_to_oplock_break_requests(fsp);
-
                 /* if this is a pure oplock break request then don't send a
                  * reply */
@@ -7745 +8267 @@
                         /* Sanity check - ensure a pure oplock break is not a
                            chained request. */
-                        if(CVAL(req->vwv+0, 0) != 0xff)
+                        if (CVAL(req->vwv+0, 0) != 0xff) {
                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
                                          "break is a chained %d request !\n",
                                          (unsigned int)CVAL(req->vwv+0, 0)));
+                        }
                         END_PROFILE(SMBlockingX);
                         return;
@@ -7780 +8303 @@
                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
                 ulocks[i].count = get_lock_count(data, i, large_file_format);
-                ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
+                ulocks[i].offset = get_lock_offset(data, i, large_file_format);
                 ulocks[i].brltype = UNLOCK_LOCK;
-
-                /*
-                 * There is no error code marked "stupid client bug".... :-).
-                 */
-                if(err) {
-                        reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-                        END_PROFILE(SMBlockingX);
-                        return;
-                }
         }
 
@@ -7802 +8316 @@
                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
                 locks[i].count = get_lock_count(data, i, large_file_format);
-                locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
+                locks[i].offset = get_lock_offset(data, i, large_file_format);
 
                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
@@ -7817 +8331 @@
                         }
                 }
-
-                /*
-                 * There is no error code marked "stupid client bug".... :-).
-                 */
-                if(err) {
-                        reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-                        END_PROFILE(SMBlockingX);
-                        return;
-                }
+        }
+
+        status = smbd_do_unlocking(req, fsp, num_ulocks, ulocks);
+        if (!NT_STATUS_IS_OK(status)) {
+                END_PROFILE(SMBlockingX);
+                reply_nterror(req, status);
+                return;
         }
 
         status = smbd_do_locking(req, fsp,
                                  locktype, lock_timeout,
-                                 num_ulocks, ulocks,
                                  num_locks, locks,
                                  &async);
@@ -7844 +8355 @@
 
         reply_outbuf(req, 2, 0);
-
-        DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
-                  fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
+        SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+        SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
+
+        DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
+                  fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
 
         END_PROFILE(SMBlockingX);
-        chain_reply(req);
 }
 
@@ -7934 +8446 @@
         }
 
+        if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
+                reply_nterror(req, NT_STATUS_ACCESS_DENIED);
+                goto out;
+        }
+
         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
         if (!NT_STATUS_IS_OK(status)) {
@@ -7940 +8457 @@
         }
 
-        DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
+        DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
                " createtime=%u\n",
-                fsp->fnum,
+                fsp_fnum_dbg(fsp),
                 (unsigned int)ft.atime.tv_sec,
                 (unsigned int)ft.mtime.tv_sec,
@@ -8039 +8556 @@
                 SIVAL(req->outbuf, smb_vwv8, 0);
         } else {
-                uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
-                SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
+                uint32_t allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
+                SIVAL(req->outbuf, smb_vwv6, (uint32_t)fsp->fsp_name->st.st_ex_size);
                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
         }
         SSVAL(req->outbuf,smb_vwv10, mode);
 
-        DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
+        DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
 
         END_PROFILE(SMBgetattrE);