Changeset 988 for vendor/current/source3/smbd/trans2.c

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

File:

• vendor/current/source3/smbd/trans2.c (modified) (309 diffs)

vendor/current/source3/smbd/trans2.c

@@ -33 +33 @@
 #include "../librpc/gen_ndr/xattr.h"
 #include "../librpc/gen_ndr/ndr_security.h"
+#include "../librpc/gen_ndr/open_files.h"
 #include "libcli/security/security.h"
 #include "trans2.h"
@@ -38 +39 @@
 #include "smbprofile.h"
 #include "rpc_server/srv_pipe_hnd.h"
-#include "libsmb/libsmb.h"
+#include "printing.h"
+#include "lib/util_ea.h"
+#include "lib/readdir_attr.h"
 
 #define DIR_ENTRY_SAFETY_MARGIN 4096
@@ -51 +54 @@
                                 files_struct *fsp,
                                 const SMB_STRUCT_STAT *psbuf);
+
+/****************************************************************************
+ Check if an open file handle or pathname is a symlink.
+****************************************************************************/
+
+static NTSTATUS refuse_symlink(connection_struct *conn,
+                        const files_struct *fsp,
+                        const char *name)
+{
+        SMB_STRUCT_STAT sbuf;
+        const SMB_STRUCT_STAT *pst = NULL;
+
+        if (fsp) {
+                pst = &fsp->fsp_name->st;
+        } else {
+                int ret = vfs_stat_smb_basename(conn,
+                                name,
+                                &sbuf);
+                if (ret == -1) {
+                        return map_nt_error_from_unix(errno);
+                }
+                pst = &sbuf;
+        }
+        if (S_ISLNK(pst->st_ex_mode)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+        return NT_STATUS_OK;
+}
+
+NTSTATUS check_access_fsp(const struct files_struct *fsp,
+                          uint32_t access_mask)
+{
+        if (!(fsp->access_mask & access_mask)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+        return NT_STATUS_OK;
+}
+
+/********************************************************************
+ The canonical "check access" based on object handle or path function.
+********************************************************************/
+
+NTSTATUS check_access(connection_struct *conn,
+                                files_struct *fsp,
+                                const struct smb_filename *smb_fname,
+                                uint32_t access_mask)
+{
+        NTSTATUS status;
+
+        if (fsp) {
+                status = check_access_fsp(fsp, access_mask);
+        } else {
+                status = smbd_check_access_rights(conn, smb_fname,
+                                                  false, access_mask);
+        }
+
+        return status;
+}
 
 /********************************************************************
@@ -94 +155 @@
 ****************************************************************************/
 
-static bool samba_private_attr_name(const char *unix_ea_name)
+bool samba_private_attr_name(const char *unix_ea_name)
 {
         static const char * const prohibited_ea_names[] = {
@@ -110 +171 @@
                         return true;
         }
-        if (StrnCaseCmp(unix_ea_name, SAMBA_XATTR_DOSSTREAM_PREFIX,
+        if (strncasecmp_m(unix_ea_name, SAMBA_XATTR_DOSSTREAM_PREFIX,
                         strlen(SAMBA_XATTR_DOSSTREAM_PREFIX)) == 0) {
                 return true;
@@ -132 +193 @@
  again:
 
-        val = TALLOC_REALLOC_ARRAY(mem_ctx, val, char, attr_size);
+        val = talloc_realloc(mem_ctx, val, char, attr_size);
         if (!val) {
                 return NT_STATUS_NO_MEMORY;
@@ -153 +214 @@
 
         DEBUG(10,("get_ea_value: EA %s is of length %u\n", ea_name, (unsigned int)sizeret));
-        dump_data(10, (uint8 *)val, sizeret);
+        dump_data(10, (uint8_t *)val, sizeret);
 
         pea->flags = 0;
@@ -182 +243 @@
         size_t num_names;
         ssize_t sizeret = -1;
+        NTSTATUS status;
+
+        if (pnames) {
+                *pnames = NULL;
+        }
+        *pnum_names = 0;
 
         if (!lp_ea_support(SNUM(conn))) {
-                if (pnames) {
-                        *pnames = NULL;
-                }
-                *pnum_names = 0;
+                return NT_STATUS_OK;
+        }
+
+        status = refuse_symlink(conn, fsp, fname);
+        if (!NT_STATUS_IS_OK(status)) {
+                /*
+                 * Just return no EA's on a symlink.
+                 */
                 return NT_STATUS_OK;
         }
@@ -195 +266 @@
          */
 
-        names = TALLOC_ARRAY(mem_ctx, char *, 1);
+        names = talloc_array(mem_ctx, char *, 1);
         if (names == NULL) {
                 DEBUG(0, ("talloc failed\n"));
@@ -203 +274 @@
         while (ea_namelist_size <= 65536) {
 
-                ea_namelist = TALLOC_REALLOC_ARRAY(
+                ea_namelist = talloc_realloc(
                         names, ea_namelist, char, ea_namelist_size);
                 if (ea_namelist == NULL) {
@@ -232 +303 @@
         }
 
-        DEBUG(10, ("get_ea_list_from_file: ea_namelist size = %u\n",
-                   (unsigned int)sizeret));
+        DEBUG(10, ("%s: ea_namelist size = %u\n",
+                   __func__, (unsigned int)sizeret));
 
         if (sizeret == 0) {
                 TALLOC_FREE(names);
-                if (pnames) {
-                        *pnames = NULL;
-                }
-                *pnum_names = 0;
                 return NT_STATUS_OK;
         }
@@ -262 +329 @@
         }
 
-        tmp = TALLOC_REALLOC_ARRAY(mem_ctx, names, char *, num_names);
+        tmp = talloc_realloc(mem_ctx, names, char *, num_names);
         if (tmp == NULL) {
                 DEBUG(0, ("talloc failed\n"));
@@ -289 +356 @@
 ****************************************************************************/
 
-static struct ea_list *get_ea_list_from_file(TALLOC_CTX *mem_ctx, connection_struct *conn, files_struct *fsp,
-                                        const char *fname, size_t *pea_total_len)
+static NTSTATUS get_ea_list_from_file_path(TALLOC_CTX *mem_ctx, connection_struct *conn, files_struct *fsp,
+                                      const char *fname, size_t *pea_total_len, struct ea_list **ea_list)
 {
         /* Get a list of all xattrs. Max namesize is 64k. */
@@ -299 +366 @@
 
         *pea_total_len = 0;
-
-        if (!lp_ea_support(SNUM(conn))) {
-                return NULL;
-        }
+        *ea_list = NULL;
 
         status = get_ea_names_from_file(talloc_tos(), conn, fsp, fname,
                                         &names, &num_names);
 
-        if (!NT_STATUS_IS_OK(status) || (num_names == 0)) {
-                return NULL;
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        if (num_names == 0) {
+                *ea_list = NULL;
+                return NT_STATUS_OK;
         }
 
@@ -319 +388 @@
                         continue;
 
-                listp = TALLOC_P(mem_ctx, struct ea_list);
+                /*
+                 * Filter out any underlying POSIX EA names
+                 * that a Windows client can't handle.
+                 */
+                if (!lp_posix_pathnames() &&
+                                is_invalid_windows_ea_name(names[i])) {
+                        continue;
+                }
+
+                listp = talloc(mem_ctx, struct ea_list);
                 if (listp == NULL) {
-                        return NULL;
-                }
-
-                if (!NT_STATUS_IS_OK(get_ea_value(mem_ctx, conn, fsp,
-                                                  fname, names[i],
-                                                  &listp->ea))) {
-                        return NULL;
+                        return NT_STATUS_NO_MEMORY;
+                }
+
+                status = get_ea_value(listp, conn, fsp,
+                                      fname, names[i],
+                                      &listp->ea);
+
+                if (!NT_STATUS_IS_OK(status)) {
+                        TALLOC_FREE(listp);
+                        return status;
                 }
 
@@ -348 +429 @@
                           (unsigned int)listp->ea.value.length));
 
-                DLIST_ADD_END(ea_list_head, listp, struct ea_list *);
+                DLIST_ADD_END(ea_list_head, listp);
 
         }
@@ -360 +441 @@
                    (unsigned int)*pea_total_len));
 
-        return ea_list_head;
+        *ea_list = ea_list_head;
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS get_ea_list_from_file(TALLOC_CTX *mem_ctx, connection_struct *conn, files_struct *fsp,
+                                      const struct smb_filename *smb_fname, size_t *pea_total_len, struct ea_list **ea_list)
+{
+        *pea_total_len = 0;
+        *ea_list = NULL;
+
+        if (!lp_ea_support(SNUM(conn))) {
+                return NT_STATUS_OK;
+        }
+
+        if (is_ntfs_stream_smb_fname(smb_fname)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        return get_ea_list_from_file_path(mem_ctx, conn, fsp, smb_fname->base_name, pea_total_len, ea_list);
 }
 
@@ -400 +499 @@
                 SCVAL(p,1,dos_namelen);
                 SSVAL(p,2,ea_list->ea.value.length);
-                fstrcpy(p+4, dos_ea_name);
+                strlcpy(p+4, dos_ea_name, dos_namelen+1);
                 memcpy( p + 4 + dos_namelen + 1, ea_list->ea.value.data, ea_list->ea.value.length);
 
@@ -422 +521 @@
         uint8_t *p = (uint8_t *)pdata;
         uint8_t *last_start = NULL;
-        bool store_data = (pdata != NULL);
+        bool do_store_data = (pdata != NULL);
 
         *ret_data_size = 0;
@@ -436 +535 @@
                 size_t pad = 0;
 
-                if (last_start && store_data) {
+                if (last_start != NULL && do_store_data) {
                         SIVAL(last_start, 0, PTR_DIFF(p, last_start));
                 }
@@ -457 +556 @@
                 }
 
-                if (this_size > total_data_size) {
-                        return NT_STATUS_INFO_LENGTH_MISMATCH;
-                }
-
-                /* We know we have room. */
-                if (store_data) {
+                if (do_store_data) {
+                        if (this_size > total_data_size) {
+                                return NT_STATUS_INFO_LENGTH_MISMATCH;
+                        }
+
+                        /* We know we have room. */
                         SIVAL(p, 0x00, 0); /* next offset */
                         SCVAL(p, 0x04, ea_list->ea.flags);
                         SCVAL(p, 0x05, dos_namelen);
                         SSVAL(p, 0x06, ea_list->ea.value.length);
-                        fstrcpy((char *)(p+0x08), dos_ea_name);
+                        strlcpy((char *)(p+0x08), dos_ea_name, dos_namelen+1);
                         memcpy(p + 0x08 + dos_namelen + 1, ea_list->ea.value.data, ea_list->ea.value.length);
                         if (pad) {
@@ -474 +573 @@
                                         pad);
                         }
-                }
-
-                total_data_size -= this_size;
+                        total_data_size -= this_size;
+                }
+
                 p += this_size;
         }
@@ -485 +584 @@
 }
 
-static unsigned int estimate_ea_size(connection_struct *conn, files_struct *fsp, const char *fname)
+static unsigned int estimate_ea_size(connection_struct *conn, files_struct *fsp, const struct smb_filename *smb_fname)
 {
         size_t total_ea_len = 0;
+        TALLOC_CTX *mem_ctx;
         struct ea_list *ea_list = NULL;
-        TALLOC_CTX *mem_ctx = NULL;
 
         if (!lp_ea_support(SNUM(conn))) {
                 return 0;
         }
-        mem_ctx = talloc_tos();
-        ea_list = get_ea_list_from_file(mem_ctx, conn, fsp, fname, &total_ea_len);
-        if (ea_list == NULL) {
-                return 0;
-        }
+        mem_ctx = talloc_stackframe();
+
+        /* If this is a stream fsp, then we need to instead find the
+         * estimated ea len from the main file, not the stream
+         * (streams cannot have EAs), but the estimate isn't just 0 in
+         * this case! */
+        if (is_ntfs_stream_smb_fname(smb_fname)) {
+                fsp = NULL;
+        }
+        (void)get_ea_list_from_file_path(mem_ctx, conn, fsp, smb_fname->base_name, &total_ea_len, &ea_list);
         if(conn->sconn->using_smb2) {
                 NTSTATUS status;
@@ -510 +614 @@
                 status = fill_ea_chained_buffer(mem_ctx,
                                                 NULL,
-                                                65535,
+                                                0,
                                                 &ret_data_size,
                                                 conn,
@@ -519 +623 @@
                 total_ea_len = ret_data_size;
         }
-
+        TALLOC_FREE(mem_ctx);
         return total_ea_len;
 }
@@ -531 +635 @@
         size_t total_ea_len;
         TALLOC_CTX *mem_ctx = talloc_tos();
-        struct ea_list *ea_list = get_ea_list_from_file(mem_ctx, conn, fsp, fname, &total_ea_len);
+        struct ea_list *ea_list;
+        NTSTATUS status = get_ea_list_from_file_path(mem_ctx, conn, fsp, fname, &total_ea_len, &ea_list);
+        if (!NT_STATUS_IS_OK(status)) {
+                return;
+        }
 
         for (; ea_list; ea_list = ea_list->next) {
@@ -537 +645 @@
                         DEBUG(10,("canonicalize_ea_name: %s -> %s\n",
                                 &unix_ea_name[5], ea_list->ea.name));
-                        safe_strcpy(&unix_ea_name[5], ea_list->ea.name, sizeof(fstring)-6);
+                        strlcpy(&unix_ea_name[5], ea_list->ea.name, sizeof(fstring)-5);
                         break;
                 }
@@ -550 +658 @@
                 const struct smb_filename *smb_fname, struct ea_list *ea_list)
 {
+        NTSTATUS status;
         char *fname = NULL;
 
@@ -556 +665 @@
         }
 
-        if (fsp && !(fsp->access_mask & FILE_WRITE_EA)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        /* For now setting EAs on streams isn't supported. */
+        status = refuse_symlink(conn, fsp, smb_fname->base_name);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        status = check_access(conn, fsp, smb_fname, FILE_WRITE_EA);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        /* Setting EAs on streams isn't supported. */
+        if (is_ntfs_stream_smb_fname(smb_fname)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        /*
+         * Filter out invalid Windows EA names - before
+         * we set *any* of them.
+         */
+
+        if (ea_list_has_invalid_name(ea_list)) {
+                return STATUS_INVALID_EA_NAME;
+        }
+
         fname = smb_fname->base_name;
 
@@ -636 +764 @@
 
         while (offset + 2 < data_size) {
-                struct ea_list *eal = TALLOC_ZERO_P(ctx, struct ea_list);
+                struct ea_list *eal = talloc_zero(ctx, struct ea_list);
                 unsigned int namelen = CVAL(pdata,offset);
 
@@ -661 +789 @@
 
                 offset += (namelen + 1); /* Go past the name + terminating zero. */
-                DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
+                DLIST_ADD_END(ea_list_head, eal);
                 DEBUG(10,("read_ea_name_list: read ea name %s\n", eal->ea.name));
         }
 
         return ea_list_head;
-}
-
-/****************************************************************************
- Read one EA list entry from the buffer.
-****************************************************************************/
-
-struct ea_list *read_ea_list_entry(TALLOC_CTX *ctx, const char *pdata, size_t data_size, size_t *pbytes_used)
-{
-        struct ea_list *eal = TALLOC_ZERO_P(ctx, struct ea_list);
-        uint16 val_len;
-        unsigned int namelen;
-        size_t converted_size;
-
-        if (!eal) {
-                return NULL;
-        }
-
-        if (data_size < 6) {
-                return NULL;
-        }
-
-        eal->ea.flags = CVAL(pdata,0);
-        namelen = CVAL(pdata,1);
-        val_len = SVAL(pdata,2);
-
-        if (4 + namelen + 1 + val_len > data_size) {
-                return NULL;
-        }
-
-        /* Ensure the name is null terminated. */
-        if (pdata[namelen + 4] != '\0') {
-                return NULL;
-        }
-        if (!pull_ascii_talloc(ctx, &eal->ea.name, pdata + 4, &converted_size)) {
-                DEBUG(0,("read_ea_list_entry: pull_ascii_talloc failed: %s",
-                         strerror(errno)));
-        }
-        if (!eal->ea.name) {
-                return NULL;
-        }
-
-        eal->ea.value = data_blob_talloc(eal, NULL, (size_t)val_len + 1);
-        if (!eal->ea.value.data) {
-                return NULL;
-        }
-
-        memcpy(eal->ea.value.data, pdata + 4 + namelen + 1, val_len);
-
-        /* Ensure we're null terminated just in case we print the value. */
-        eal->ea.value.data[val_len] = '\0';
-        /* But don't count the null. */
-        eal->ea.value.length--;
-
-        if (pbytes_used) {
-                *pbytes_used = 4 + namelen + 1 + val_len;
-        }
-
-        DEBUG(10,("read_ea_list_entry: read ea name %s\n", eal->ea.name));
-        dump_data(10, eal->ea.value.data, eal->ea.value.length);
-
-        return eal;
 }
 
@@ -746 +813 @@
                 }
 
-                DLIST_ADD_END(ea_list_head, eal, struct ea_list *);
+                DLIST_ADD_END(ea_list_head, eal);
                 offset += bytes_used;
         }
@@ -816 +883 @@
 void send_trans2_replies(connection_struct *conn,
                         struct smb_request *req,
+                        NTSTATUS status,
                          const char *params,
                          int paramsize,
@@ -837 +905 @@
         int data_alignment_offset = 0;
         bool overflow = False;
-        struct smbd_server_connection *sconn = req->sconn;
-        int max_send = sconn->smb1.sessions.max_send;
+        struct smbXsrv_connection *xconn = req->xconn;
+        int max_send = xconn->smb1.sessions.max_send;
 
         /* Modify the data_to_send and datasize and set the error if
@@ -856 +924 @@
         if(params_to_send == 0 && data_to_send == 0) {
                 reply_outbuf(req, 10, 0);
+                if (NT_STATUS_V(status)) {
+                        uint8_t eclass;
+                        uint32_t ecode;
+                        ntstatus_to_dos(status, &eclass, &ecode);
+                        error_packet_set((char *)req->outbuf,
+                                        eclass, ecode, status,
+                                        __LINE__,__FILE__);
+                }
                 show_msg((char *)req->outbuf);
-                if (!srv_send_smb(sconn,
+                if (!srv_send_smb(xconn,
                                 (char *)req->outbuf,
                                 true, req->seqnum+1,
@@ -986 +1062 @@
                                          STATUS_BUFFER_OVERFLOW,
                                          __LINE__,__FILE__);
+                } else if (NT_STATUS_V(status)) {
+                        uint8_t eclass;
+                        uint32_t ecode;
+                        ntstatus_to_dos(status, &eclass, &ecode);
+                        error_packet_set((char *)req->outbuf,
+                                        eclass, ecode, status,
+                                        __LINE__,__FILE__);
                 }
 
                 /* Send the packet */
                 show_msg((char *)req->outbuf);
-                if (!srv_send_smb(sconn,
+                if (!srv_send_smb(xconn,
                                 (char *)req->outbuf,
                                 true, req->seqnum+1,
@@ -1030 +1113 @@
         char *pdata = *ppdata;
         int deny_mode;
-        int32 open_attr;
+        int32_t open_attr;
         bool oplock_request;
 #if 0
@@ -1038 +1121 @@
 #endif
         int open_ofun;
-        uint32 open_size;
+        uint32_t open_size;
         char *pname;
         char *fname = NULL;
-        SMB_OFF_T size=0;
+        off_t size=0;
         int fattr=0,mtime=0;
         SMB_INO_T inode = 0;
@@ -1047 +1130 @@
         files_struct *fsp;
         struct ea_list *ea_list = NULL;
-        uint16 flags = 0;
+        uint16_t flags = 0;
         NTSTATUS status;
-        uint32 access_mask;
-        uint32 share_mode;
-        uint32 create_disposition;
-        uint32 create_options = 0;
+        uint32_t access_mask;
+        uint32_t share_mode;
+        uint32_t create_disposition;
+        uint32_t create_options = 0;
         uint32_t private_flags = 0;
+        uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -1087 +1171 @@
         }
 
-        srvstr_get_path(ctx, params, req->flags2, &fname, pname,
-                        total_params - 28, STR_TERMINATE,
+        if (req->posix_pathnames) {
+                srvstr_get_path_posix(ctx,
+                        params,
+                        req->flags2,
+                        &fname,
+                        pname,
+                        total_params - 28,
+                        STR_TERMINATE,
                         &status);
+        } else {
+                srvstr_get_path(ctx,
+                        params,
+                        req->flags2,
+                        &fname,
+                        pname,
+                        total_params - 28,
+                        STR_TERMINATE,
+                        &status);
+        }
         if (!NT_STATUS_IS_OK(status)) {
                 reply_nterror(req, status);
@@ -1103 +1203 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                0,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname);
@@ -1155 +1255 @@
                 if (!lp_ea_support(SNUM(conn))) {
                         reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
+                        goto out;
+                }
+
+                if (ea_list_has_invalid_name(ea_list)) {
+                        int param_len = 30;
+                        *pparams = (char *)SMB_REALLOC(*pparams, param_len);
+                        if(*pparams == NULL ) {
+                                reply_nterror(req, NT_STATUS_NO_MEMORY);
+                                goto out;
+                        }
+                        params = *pparams;
+                        memset(params, '\0', param_len);
+                        send_trans2_replies(conn, req, STATUS_INVALID_EA_NAME,
+                                params, param_len, NULL, 0, max_data_bytes);
                         goto out;
                 }
@@ -1170 +1284 @@
                 open_attr,                              /* file_attributes */
                 oplock_request,                         /* oplock_request */
+                NULL,                                   /* lease */
                 open_size,                              /* allocation_size */
                 private_flags,
@@ -1175 +1290 @@
                 ea_list,                                /* ea_list */
                 &fsp,                                   /* result */
-                &smb_action);                           /* psbuf */
+                &smb_action,                            /* psbuf */
+                NULL, NULL);                            /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
-                if (open_was_deferred(req->mid)) {
+                if (open_was_deferred(req->xconn, req->mid)) {
                         /* We have re-scheduled this call. */
                         goto out;
@@ -1207 +1323 @@
         SSVAL(params,2,fattr);
         srv_put_dos_date2(params,4, mtime);
-        SIVAL(params,8, (uint32)size);
+        SIVAL(params,8, (uint32_t)size);
         SSVAL(params,12,deny_mode);
         SSVAL(params,14,0); /* open_type - file or directory. */
@@ -1224 +1340 @@
         SSVAL(params,24,0); /* Padding. */
         if (flags & 8) {
-                uint32 ea_size = estimate_ea_size(conn, fsp,
-                                                  fsp->fsp_name->base_name);
+                uint32_t ea_size = estimate_ea_size(conn, fsp,
+                                                  smb_fname);
                 SIVAL(params, 26, ea_size);
         } else {
@@ -1232 +1348 @@
 
         /* Send the required number of replies */
-        send_trans2_replies(conn, req, params, 30, *ppdata, 0, max_data_bytes);
+        send_trans2_replies(conn, req, NT_STATUS_OK, params, 30, *ppdata, 0, max_data_bytes);
  out:
         TALLOC_FREE(smb_fname);
@@ -1260 +1376 @@
                 return strcmp(str,mask)==0;
         } else {
-                return StrCaseCmp(str,mask) == 0;
+                return strcasecmp_m(str,mask) == 0;
         }
 }
@@ -1268 +1384 @@
 ****************************************************************************/
 
-static uint32 unix_filetype(mode_t mode)
+static uint32_t unix_filetype(mode_t mode)
 {
         if(S_ISREG(mode))
@@ -1307 +1423 @@
 static NTSTATUS unix_perms_from_wire( connection_struct *conn,
                                 const SMB_STRUCT_STAT *psbuf,
-                                uint32 perms,
+                                uint32_t perms,
                                 enum perm_type ptype,
                                 mode_t *ret_perms)
@@ -1341 +1457 @@
 #endif
 
-        switch (ptype) {
-        case PERM_NEW_FILE:
-                /* Apply mode mask */
+        if (ptype == PERM_NEW_FILE) {
+                /*
+                 * "create mask"/"force create mode" are
+                 * only applied to new files, not existing ones.
+                 */
                 ret &= lp_create_mask(SNUM(conn));
                 /* Add in force bits */
                 ret |= lp_force_create_mode(SNUM(conn));
-                break;
-        case PERM_NEW_DIR:
-                ret &= lp_dir_mask(SNUM(conn));
+        } else if (ptype == PERM_NEW_DIR) {
+                /*
+                 * "directory mask"/"force directory mode" are
+                 * only applied to new directories, not existing ones.
+                 */
+                ret &= lp_directory_mask(SNUM(conn));
                 /* Add in force bits */
-                ret |= lp_force_dir_mode(SNUM(conn));
-                break;
-        case PERM_EXISTING_FILE:
-                /* Apply mode mask */
-                ret &= lp_security_mask(SNUM(conn));
-                /* Add in force bits */
-                ret |= lp_force_security_mode(SNUM(conn));
-                break;
-        case PERM_EXISTING_DIR:
-                /* Apply mode mask */
-                ret &= lp_dir_security_mask(SNUM(conn));
-                /* Add in force bits */
-                ret |= lp_force_dir_security_mode(SNUM(conn));
-                break;
+                ret |= lp_force_directory_mode(SNUM(conn));
         }
 
@@ -1424 +1532 @@
         /* Mangle fname if it's an illegal name. */
         if (mangle_must_mangle(dname, state->conn->params)) {
+                /*
+                 * Slow path - ensure we can push the original name as UCS2. If
+                 * not, then just don't return this name.
+                 */
+                NTSTATUS status;
+                size_t ret_len = 0;
+                size_t len = (strlen(dname) + 2) * 4; /* Allow enough space. */
+                uint8_t *tmp = talloc_array(talloc_tos(),
+                                        uint8_t,
+                                        len);
+
+                status = srvstr_push(NULL,
+                        FLAGS2_UNICODE_STRINGS,
+                        tmp,
+                        dname,
+                        len,
+                        STR_TERMINATE,
+                        &ret_len);
+
+                TALLOC_FREE(tmp);
+
+                if (!NT_STATUS_IS_OK(status)) {
+                        return false;
+                }
+
                 ok = name_to_8_3(dname, mangled_name,
                                  true, state->conn->params);
@@ -1525 +1658 @@
 }
 
-static bool smbd_marshall_dir_entry(TALLOC_CTX *ctx,
+static NTSTATUS smbd_marshall_dir_entry(TALLOC_CTX *ctx,
                                     connection_struct *conn,
                                     uint16_t flags2,
@@ -1541 +1674 @@
                                     char **ppdata,
                                     char *end_data,
-                                    bool *out_of_space,
                                     uint64_t *last_entry_off)
 {
@@ -1549 +1681 @@
         uint64_t allocation_size = 0;
         uint64_t file_index = 0;
-        uint32_t len;
-        struct timespec mdate_ts, adate_ts, cdate_ts, create_date_ts;
+        size_t len = 0;
+        struct timespec mdate_ts = {0};
+        struct timespec adate_ts = {0};
+        struct timespec cdate_ts = {0};
+        struct timespec create_date_ts = {0};
         time_t mdate = (time_t)0, adate = (time_t)0, create_date = (time_t)0;
-        time_t c_date = (time_t)0;
         char *nameptr;
         char *last_entry_ptr;
@@ -1558 +1692 @@
         int off;
         int pad = 0;
-
-        *out_of_space = false;
-
-        ZERO_STRUCT(mdate_ts);
-        ZERO_STRUCT(adate_ts);
-        ZERO_STRUCT(create_date_ts);
-        ZERO_STRUCT(cdate_ts);
+        NTSTATUS status;
+        struct readdir_attr_data *readdir_attr_data = NULL;
 
         if (!(mode & FILE_ATTRIBUTE_DIRECTORY)) {
@@ -1570 +1699 @@
         }
         allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn, NULL, &smb_fname->st);
+
+        status = SMB_VFS_READDIR_ATTR(conn, smb_fname, ctx, &readdir_attr_data);
+        if (!NT_STATUS_IS_OK(status)) {
+                if (!NT_STATUS_EQUAL(NT_STATUS_NOT_SUPPORTED, status)) {
+                        return status;
+                }
+        }
 
         file_index = get_FileIndex(conn, &smb_fname->st);
@@ -1588 +1724 @@
         mdate = convert_timespec_to_time_t(mdate_ts);
         adate = convert_timespec_to_time_t(adate_ts);
-        c_date = convert_timespec_to_time_t(cdate_ts);
 
         /* align the record */
@@ -1598 +1733 @@
 
         if (pad && pad > space_remaining) {
-                *out_of_space = true;
                 DEBUG(9,("smbd_marshall_dir_entry: out of space "
                         "for padding (wanted %u, had %d)\n",
                         (unsigned int)pad,
                         space_remaining ));
-                return false; /* Not finished - just out of space */
+                return STATUS_MORE_ENTRIES; /* Not finished - just out of space */
         }
 
@@ -1633 +1767 @@
                 srv_put_dos_date2(p,4,adate);
                 srv_put_dos_date2(p,8,mdate);
-                SIVAL(p,12,(uint32)file_size);
-                SIVAL(p,16,(uint32)allocation_size);
+                SIVAL(p,12,(uint32_t)file_size);
+                SIVAL(p,16,(uint32_t)allocation_size);
                 SSVAL(p,20,mode);
                 p += 23;
@@ -1641 +1775 @@
                         p += ucs2_align(base_data, p, 0);
                 }
-                len = srvstr_push(base_data, flags2, p,
+                status = srvstr_push(base_data, flags2, p,
                                   fname, PTR_DIFF(end_data, p),
-                                  STR_TERMINATE);
+                                  STR_TERMINATE, &len);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
                 if (flags2 & FLAGS2_UNICODE_STRINGS) {
                         if (len > 2) {
@@ -1669 +1806 @@
                 srv_put_dos_date2(p,4,adate);
                 srv_put_dos_date2(p,8,mdate);
-                SIVAL(p,12,(uint32)file_size);
-                SIVAL(p,16,(uint32)allocation_size);
+                SIVAL(p,12,(uint32_t)file_size);
+                SIVAL(p,16,(uint32_t)allocation_size);
                 SSVAL(p,20,mode);
                 {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
-                                                                smb_fname->base_name);
+                                                                smb_fname);
                         SIVAL(p,22,ea_size); /* Extended attributes */
                 }
                 p += 27;
                 nameptr = p - 1;
-                len = srvstr_push(base_data, flags2,
+                status = srvstr_push(base_data, flags2,
                                   p, fname, PTR_DIFF(end_data, p),
-                                  STR_TERMINATE | STR_NOALIGN);
+                                  STR_TERMINATE | STR_NOALIGN, &len);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
                 if (flags2 & FLAGS2_UNICODE_STRINGS) {
                         if (len > 2) {
@@ -1707 +1847 @@
                 DEBUG(10,("smbd_marshall_dir_entry: SMB_FIND_EA_LIST\n"));
                 if (!name_list) {
-                        return false;
+                        return NT_STATUS_INVALID_PARAMETER;
                 }
                 if (requires_resume_key) {
@@ -1716 +1856 @@
                 srv_put_dos_date2(p,4,adate);
                 srv_put_dos_date2(p,8,mdate);
-                SIVAL(p,12,(uint32)file_size);
-                SIVAL(p,16,(uint32)allocation_size);
+                SIVAL(p,12,(uint32_t)file_size);
+                SIVAL(p,16,(uint32_t)allocation_size);
                 SSVAL(p,20,mode);
                 p += 22; /* p now points to the EA area. */
 
-                file_list = get_ea_list_from_file(ctx, conn, NULL,
-                                                  smb_fname->base_name,
-                                                  &ea_len);
+                status = get_ea_list_from_file(ctx, conn, NULL,
+                                               smb_fname,
+                                               &ea_len, &file_list);
+                if (!NT_STATUS_IS_OK(status)) {
+                        file_list = NULL;
+                }
                 name_list = ea_list_union(name_list, file_list, &ea_len);
 
@@ -1729 +1872 @@
                 /* Max string size is 255 bytes. */
                 if (PTR_DIFF(p + 255 + ea_len,pdata) > space_remaining) {
-                        *out_of_space = true;
                         DEBUG(9,("smbd_marshall_dir_entry: out of space "
                                 "(wanted %u, had %d)\n",
                                 (unsigned int)PTR_DIFF(p + 255 + ea_len,pdata),
                                 space_remaining ));
-                        return False; /* Not finished - just out of space */
+                        return STATUS_MORE_ENTRIES; /* Not finished - just out of space */
                 }
 
@@ -1740 +1882 @@
                 p += fill_ea_buffer(ctx, p, space_remaining, conn, name_list);
                 nameptr = p;
-                len = srvstr_push(base_data, flags2,
+                status = srvstr_push(base_data, flags2,
                                   p + 1, fname, PTR_DIFF(end_data, p+1),
-                                  STR_TERMINATE | STR_NOALIGN);
+                                  STR_TERMINATE | STR_NOALIGN, &len);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
                 if (flags2 & FLAGS2_UNICODE_STRINGS) {
                         if (len > 2) {
@@ -1779 +1924 @@
                 } else {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
-                                                                smb_fname->base_name);
+                                                                smb_fname);
                         SIVAL(p,0,ea_size); /* Extended attributes */
                 }
@@ -1795 +1940 @@
                         }
                         mangled_name[12] = 0;
-                        len = srvstr_push(base_data, flags2,
+                        status = srvstr_push(base_data, flags2,
                                           p+2, mangled_name, 24,
-                                          STR_UPPER|STR_UNICODE);
+                                          STR_UPPER|STR_UNICODE, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         if (len < 24) {
                                 memset(p + 2 + len,'\0',24 - len);
@@ -1806 +1954 @@
                 }
                 p += 2 + 24;
-                len = srvstr_push(base_data, flags2, p,
+                status = srvstr_push(base_data, flags2, p,
                                   fname, PTR_DIFF(end_data, p),
-                                  STR_TERMINATE_ASCII);
+                                  STR_TERMINATE_ASCII, &len);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
                 SIVAL(q,0,len);
                 p += len;
@@ -1842 +1993 @@
                 SOFF_T(p,0,allocation_size); p += 8;
                 SIVAL(p,0,mode); p += 4;
-                len = srvstr_push(base_data, flags2,
+                status = srvstr_push(base_data, flags2,
                                   p + 4, fname, PTR_DIFF(end_data, p+4),
-                                  STR_TERMINATE_ASCII);
+                                  STR_TERMINATE_ASCII, &len);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
                 SIVAL(p,0,len);
                 p += 4 + len;
@@ -1881 +2035 @@
                 {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
-                                                                smb_fname->base_name);
+                                                                smb_fname);
                         SIVAL(p,0,ea_size); /* Extended attributes */
                         p +=4;
                 }
-                len = srvstr_push(base_data, flags2, p,
+                status = srvstr_push(base_data, flags2, p,
                                   fname, PTR_DIFF(end_data, p),
-                                  STR_TERMINATE_ASCII);
+                                  STR_TERMINATE_ASCII, &len);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
                 SIVAL(q, 0, len);
                 p += len;
@@ -1917 +2074 @@
                 /* this must *not* be null terminated or w2k gets in a loop trying to set an
                    acl on a dir (tridge) */
-                len = srvstr_push(base_data, flags2, p,
+                status = srvstr_push(base_data, flags2, p,
                                   fname, PTR_DIFF(end_data, p),
-                                  STR_TERMINATE_ASCII);
+                                  STR_TERMINATE_ASCII, &len);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
                 SIVAL(p, -4, len);
                 p += len;
@@ -1958 +2118 @@
                 } else {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
-                                                                smb_fname->base_name);
+                                                                smb_fname);
                         SIVAL(p,0,ea_size); /* Extended attributes */
                 }
-                p +=4;
+                p += 4;
                 SIVAL(p,0,0); p += 4; /* Unknown - reserved ? */
                 SBVAL(p,0,file_index); p += 8;
-                len = srvstr_push(base_data, flags2, p,
+                status = srvstr_push(base_data, flags2, p,
                                   fname, PTR_DIFF(end_data, p),
-                                  STR_TERMINATE_ASCII);
+                                  STR_TERMINATE_ASCII, &len);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
                 SIVAL(q, 0, len);
                 p += len;
@@ -2004 +2167 @@
                 if (mode & FILE_ATTRIBUTE_REPARSE_POINT) {
                         SIVAL(p, 0, IO_REPARSE_TAG_DFS);
+                } else if (readdir_attr_data &&
+                           readdir_attr_data->type == RDATTR_AAPL) {
+                        /*
+                         * OS X specific SMB2 extension negotiated via
+                         * AAPL create context: return max_access in
+                         * ea_size field.
+                         */
+                        SIVAL(p, 0, readdir_attr_data->attr_data.aapl.max_access);
                 } else {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
-                                                                smb_fname->base_name);
+                                                                smb_fname);
                         SIVAL(p,0,ea_size); /* Extended attributes */
                 }
-                p +=4;
-                /* Clear the short name buffer. This is
-                 * IMPORTANT as not doing so will trigger
-                 * a Win2k client bug. JRA.
-                 */
-                if (!was_8_3 && check_mangled_names) {
+                p += 4;
+
+                if (readdir_attr_data &&
+                    readdir_attr_data->type == RDATTR_AAPL) {
+                        /*
+                         * OS X specific SMB2 extension negotiated via
+                         * AAPL create context: return resource fork
+                         * length and compressed FinderInfo in
+                         * shortname field.
+                         *
+                         * According to documentation short_name_len
+                         * should be 0, but on the wire behaviour
+                         * shows its set to 24 by clients.
+                         */
+                        SSVAL(p, 0, 24);
+
+                        /* Resourefork length */
+                        SBVAL(p, 2, readdir_attr_data->attr_data.aapl.rfork_size);
+
+                        /* Compressed FinderInfo */
+                        memcpy(p + 10, &readdir_attr_data->attr_data.aapl.finder_info, 16);
+                } else if (!was_8_3 && check_mangled_names) {
                         char mangled_name[13]; /* mangled 8.3 name. */
                         if (!name_to_8_3(fname,mangled_name,True,
@@ -2022 +2209 @@
                         }
                         mangled_name[12] = 0;
-                        len = srvstr_push(base_data, flags2,
+                        status = srvstr_push(base_data, flags2,
                                           p+2, mangled_name, 24,
-                                          STR_UPPER|STR_UNICODE);
+                                          STR_UPPER|STR_UNICODE, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         SSVAL(p, 0, len);
                         if (len < 24) {
@@ -2031 +2221 @@
                         SSVAL(p, 0, len);
                 } else {
+                        /* Clear the short name buffer. This is
+                         * IMPORTANT as not doing so will trigger
+                         * a Win2k client bug. JRA.
+                         */
                         memset(p,'\0',26);
                 }
                 p += 26;
-                SSVAL(p,0,0); p += 2; /* Reserved ? */
+
+                /* Reserved ? */
+                if (readdir_attr_data &&
+                    readdir_attr_data->type == RDATTR_AAPL) {
+                        /*
+                         * OS X specific SMB2 extension negotiated via
+                         * AAPL create context: return UNIX mode in
+                         * reserved field.
+                         */
+                        uint16_t aapl_mode = (uint16_t)readdir_attr_data->attr_data.aapl.unix_mode;
+                        SSVAL(p, 0, aapl_mode);
+                } else {
+                        SSVAL(p, 0, 0);
+                }
+                p += 2;
+
                 SBVAL(p,0,file_index); p += 8;
-                len = srvstr_push(base_data, flags2, p,
+                status = srvstr_push(base_data, flags2, p,
                                   fname, PTR_DIFF(end_data, p),
-                                  STR_TERMINATE_ASCII);
+                                  STR_TERMINATE_ASCII, &len);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
                 SIVAL(q,0,len);
                 p += len;
@@ -2074 +2286 @@
                         p = store_file_unix_basic(conn, p,
                                                 NULL, &smb_fname->st);
-                        len = srvstr_push(base_data, flags2, p,
+                        status = srvstr_push(base_data, flags2, p,
                                           fname, PTR_DIFF(end_data, p),
-                                          STR_TERMINATE);
+                                          STR_TERMINATE, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                 } else {
                         DEBUG(10,("smbd_marshall_dir_entry: SMB_FIND_FILE_UNIX_INFO2\n"));
@@ -2083 +2298 @@
                         nameptr = p;
                         p += 4;
-                        len = srvstr_push(base_data, flags2, p, fname,
-                                          PTR_DIFF(end_data, p), 0);
+                        status = srvstr_push(base_data, flags2, p, fname,
+                                          PTR_DIFF(end_data, p), 0, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         SIVAL(nameptr, 0, len);
                 }
@@ -2112 +2330 @@
 
         default:
-                return false;
+                return NT_STATUS_INVALID_LEVEL;
         }
 
         if (PTR_DIFF(p,pdata) > space_remaining) {
-                *out_of_space = true;
                 DEBUG(9,("smbd_marshall_dir_entry: out of space "
                         "(wanted %u, had %d)\n",
                         (unsigned int)PTR_DIFF(p,pdata),
                         space_remaining ));
-                return false; /* Not finished - just out of space */
+                return STATUS_MORE_ENTRIES; /* Not finished - just out of space */
         }
 
@@ -2129 +2346 @@
         *ppdata = p;
 
-        return true;
+        return NT_STATUS_OK;
 }
 
-bool smbd_dirptr_lanman2_entry(TALLOC_CTX *ctx,
+NTSTATUS smbd_dirptr_lanman2_entry(TALLOC_CTX *ctx,
                                connection_struct *conn,
                                struct dptr_struct *dirptr,
-                               uint16 flags2,
+                               uint16_t flags2,
                                const char *path_mask,
-                               uint32 dirtype,
+                               uint32_t dirtype,
                                int info_level,
                                int requires_resume_key,
@@ -2148 +2365 @@
                                char *end_data,
                                int space_remaining,
-                               bool *out_of_space,
                                bool *got_exact_match,
                                int *_last_entry_off,
@@ -2162 +2378 @@
         bool ok;
         uint64_t last_entry_off = 0;
+        NTSTATUS status;
 
         ZERO_STRUCT(state);
         state.conn = conn;
         state.info_level = info_level;
-        state.check_mangled_names = lp_manglednames(conn->params);
+        state.check_mangled_names = lp_mangled_names(conn->params);
         state.has_wild = dptr_has_wild(dirptr);
         state.got_exact_match = false;
 
-        *out_of_space = false;
         *got_exact_match = false;
 
@@ -2198 +2414 @@
                                    &prev_dirpos);
         if (!ok) {
-                return false;
+                return NT_STATUS_END_OF_FILE;
         }
 
         *got_exact_match = state.got_exact_match;
 
-        ok = smbd_marshall_dir_entry(ctx,
+        status = smbd_marshall_dir_entry(ctx,
                                      conn,
                                      flags2,
@@ -2219 +2435 @@
                                      ppdata,
                                      end_data,
-                                     out_of_space,
                                      &last_entry_off);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_ILLEGAL_CHARACTER)) {
+                DEBUG(1,("Conversion error: illegal character: %s\n",
+                         smb_fname_str_dbg(smb_fname)));
+        }
         TALLOC_FREE(fname);
         TALLOC_FREE(smb_fname);
-        if (*out_of_space) {
+        if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
                 dptr_SeekDir(dirptr, prev_dirpos);
-                return false;
-        }
-        if (!ok) {
-                return false;
+                return status;
+        }
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
         }
 
         *_last_entry_off = last_entry_off;
-        return true;
+        return NT_STATUS_OK;
 }
 
-static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
+static NTSTATUS get_lanman2_dir_entry(TALLOC_CTX *ctx,
                                 connection_struct *conn,
                                 struct dptr_struct *dirptr,
-                                uint16 flags2,
+                                uint16_t flags2,
                                 const char *path_mask,
-                                uint32 dirtype,
+                                uint32_t dirtype,
                                 int info_level,
                                 bool requires_resume_key,
@@ -2249 +2468 @@
                                 char *end_data,
                                 int space_remaining,
-                                bool *out_of_space,
                                 bool *got_exact_match,
                                 int *last_entry_off,
@@ -2268 +2486 @@
                                          ppdata, base_data, end_data,
                                          space_remaining,
-                                         out_of_space, got_exact_match,
+                                         got_exact_match,
                                          last_entry_off, name_list);
 }
@@ -2291 +2509 @@
         char *pdata = *ppdata;
         char *data_end;
-        uint32 dirtype;
+        uint32_t dirtype;
         int maxentries;
-        uint16 findfirst_flags;
+        uint16_t findfirst_flags;
         bool close_after_first;
         bool close_if_end;
@@ -2316 +2534 @@
         struct dptr_struct *dirptr = NULL;
         struct smbd_server_connection *sconn = req->sconn;
-        uint32_t ucf_flags = (UCF_SAVE_LCOMP | UCF_ALWAYS_ALLOW_WCARD_LCOMP);
+        uint32_t ucf_flags = UCF_SAVE_LCOMP | UCF_ALWAYS_ALLOW_WCARD_LCOMP |
+                        (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
+        bool backup_priv = false;
+        bool as_root = false;
 
         if (total_params < 13) {
@@ -2329 +2550 @@
         close_if_end = (findfirst_flags & FLAG_TRANS2_FIND_CLOSE_IF_END);
         requires_resume_key = (findfirst_flags & FLAG_TRANS2_FIND_REQUIRE_RESUME);
+        backup_priv = ((findfirst_flags & FLAG_TRANS2_FIND_BACKUP_INTENT) &&
+                                security_token_has_privilege(get_current_nttok(conn),
+                                                SEC_PRIV_BACKUP));
+
         info_level = SVAL(params,6);
 
         DEBUG(3,("call_trans2findfirst: dirtype = %x, maxentries = %d, close_after_first=%d, \
-close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
+close_if_end = %d requires_resume_key = %d backup_priv = %d level = 0x%x, max_data_bytes = %d\n",
                 (unsigned int)dirtype, maxentries, close_after_first, close_if_end, requires_resume_key,
+                (int)backup_priv,
                 info_level, max_data_bytes));
 
@@ -2367 +2593 @@
         }
 
-        srvstr_get_path_wcard(ctx, params, req->flags2, &directory,
-                              params+12, total_params - 12,
-                              STR_TERMINATE, &ntstatus, &mask_contains_wcard);
+        if (req->posix_pathnames) {
+                srvstr_get_path_wcard_posix(ctx,
+                                params,
+                                req->flags2,
+                                &directory,
+                                params+12,
+                                total_params - 12,
+                                STR_TERMINATE,
+                                &ntstatus,
+                                &mask_contains_wcard);
+        } else {
+                srvstr_get_path_wcard(ctx,
+                                params,
+                                req->flags2,
+                                &directory,
+                                params+12,
+                                total_params - 12,
+                                STR_TERMINATE,
+                                &ntstatus,
+                                &mask_contains_wcard);
+        }
         if (!NT_STATUS_IS_OK(ntstatus)) {
                 reply_nterror(req, ntstatus);
@@ -2375 +2619 @@
         }
 
-        ntstatus = filename_convert(ctx, conn,
+        if (backup_priv) {
+                become_root();
+                as_root = true;
+                ntstatus = filename_convert_with_privilege(ctx,
+                                conn,
+                                req,
+                                directory,
+                                ucf_flags,
+                                &mask_contains_wcard,
+                                &smb_dname);
+        } else {
+                ntstatus = filename_convert(ctx, conn,
                                     req->flags2 & FLAGS2_DFS_PATHNAMES,
                                     directory,
@@ -2381 +2636 @@
                                     &mask_contains_wcard,
                                     &smb_dname);
+        }
+
         if (!NT_STATUS_IS_OK(ntstatus)) {
                 if (NT_STATUS_EQUAL(ntstatus,NT_STATUS_PATH_NOT_COVERED)) {
@@ -2422 +2679 @@
 
         if (info_level == SMB_FIND_EA_LIST) {
-                uint32 ea_size;
+                uint32_t ea_size;
 
                 if (total_data < 4) {
@@ -2450 +2707 @@
         }
 
+        if (max_data_bytes + DIR_ENTRY_SAFETY_MARGIN < max_data_bytes) {
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                goto out;
+        }
+
         *ppdata = (char *)SMB_REALLOC(
                 *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
@@ -2458 +2720 @@
         pdata = *ppdata;
         data_end = pdata + max_data_bytes + DIR_ENTRY_SAFETY_MARGIN - 1;
-
+        /*
+         * squash valgrind "writev(vector[...]) points to uninitialised byte(s)"
+         * error.
+         */
+        memset(pdata + total_data, 0, ((max_data_bytes + DIR_ENTRY_SAFETY_MARGIN) - total_data));
         /* Realloc the params space */
         *pparams = (char *)SMB_REALLOC(*pparams, 10);
@@ -2471 +2737 @@
 
         ntstatus = dptr_create(conn,
+                                req,
                                 NULL, /* fsp */
                                 directory,
@@ -2486 +2753 @@
         }
 
+        if (backup_priv) {
+                /* Remember this in case we have
+                   to do a findnext. */
+                dptr_set_priv(dirptr);
+        }
+
         dptr_num = dptr_dnum(dirptr);
         DEBUG(4,("dptr_num is %d, wcard = %s, attr = %d\n", dptr_num, mask, dirtype));
@@ -2496 +2769 @@
 
         DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
-                directory,lp_dontdescend(SNUM(conn))));
-        if (in_list(directory,lp_dontdescend(SNUM(conn)),conn->case_sensitive))
+                 directory,lp_dont_descend(ctx, SNUM(conn))));
+        if (in_list(directory,lp_dont_descend(ctx, SNUM(conn)),conn->case_sensitive))
                 dont_descend = True;
 
@@ -2513 +2786 @@
                         finished = False;
                 } else {
-                        finished = !get_lanman2_dir_entry(ctx,
+                        ntstatus = get_lanman2_dir_entry(ctx,
                                         conn,
                                         dirptr,
@@ -2521 +2794 @@
                                         ask_sharemode,
                                         &p,pdata,data_end,
-                                        space_remaining, &out_of_space,
+                                        space_remaining,
                                         &got_exact_match,
                                         &last_entry_off, ea_list);
-                }
-
-                if (finished && out_of_space)
-                        finished = False;
+                        if (NT_STATUS_EQUAL(ntstatus,
+                                        NT_STATUS_ILLEGAL_CHARACTER)) {
+                                /*
+                                 * Bad character conversion on name. Ignore this
+                                 * entry.
+                                 */
+                                continue;
+                        }
+                        if (NT_STATUS_EQUAL(ntstatus, STATUS_MORE_ENTRIES)) {
+                                out_of_space = true;
+                        } else {
+                                finished = !NT_STATUS_IS_OK(ntstatus);
+                        }
+                }
 
                 if (!finished && !out_of_space)
@@ -2585 +2868 @@
         SSVAL(params,8,last_entry_off);
 
-        send_trans2_replies(conn, req, params, 10, pdata, PTR_DIFF(p,pdata),
+        send_trans2_replies(conn, req, NT_STATUS_OK, params, 10, pdata, PTR_DIFF(p,pdata),
                             max_data_bytes);
 
@@ -2612 +2895 @@
         }
  out:
+
+        if (as_root) {
+                unbecome_root();
+        }
+
         TALLOC_FREE(smb_dname);
         return;
@@ -2636 +2924 @@
         int dptr_num;
         int maxentries;
-        uint16 info_level;
-        uint32 resume_key;
-        uint16 findnext_flags;
+        uint16_t info_level;
+        uint32_t resume_key;
+        uint16_t findnext_flags;
         bool close_after_request;
         bool close_if_end;
@@ -2648 +2936 @@
         const char *directory = NULL;
         char *p = NULL;
-        uint16 dirtype;
+        uint16_t dirtype;
         int numentries = 0;
         int i, last_entry_off=0;
@@ -2661 +2949 @@
         struct dptr_struct *dirptr;
         struct smbd_server_connection *sconn = req->sconn;
+        bool backup_priv = false; 
+        bool as_root = false;
 
         if (total_params < 13) {
@@ -2679 +2969 @@
         if (!continue_bit) {
                 /* We only need resume_name if continue_bit is zero. */
-                srvstr_get_path_wcard(ctx, params, req->flags2, &resume_name,
-                              params+12,
-                              total_params - 12, STR_TERMINATE, &ntstatus,
-                              &mask_contains_wcard);
+                if (req->posix_pathnames) {
+                        srvstr_get_path_wcard_posix(ctx,
+                                params,
+                                req->flags2,
+                                &resume_name,
+                                params+12,
+                                total_params - 12,
+                                STR_TERMINATE,
+                                &ntstatus,
+                                &mask_contains_wcard);
+                } else {
+                        srvstr_get_path_wcard(ctx,
+                                params,
+                                req->flags2,
+                                &resume_name,
+                                params+12,
+                                total_params - 12,
+                                STR_TERMINATE,
+                                &ntstatus,
+                                &mask_contains_wcard);
+                }
                 if (!NT_STATUS_IS_OK(ntstatus)) {
                         /* Win9x or OS/2 can send a resume name of ".." or ".". This will cause the parser to
@@ -2738 +3045 @@
 
         if (info_level == SMB_FIND_EA_LIST) {
-                uint32 ea_size;
+                uint32_t ea_size;
 
                 if (total_data < 4) {
@@ -2766 +3073 @@
         }
 
+        if (max_data_bytes + DIR_ENTRY_SAFETY_MARGIN < max_data_bytes) {
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                return;
+        }
+
         *ppdata = (char *)SMB_REALLOC(
                 *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
@@ -2776 +3088 @@
         data_end = pdata + max_data_bytes + DIR_ENTRY_SAFETY_MARGIN - 1;
 
+        /*
+         * squash valgrind "writev(vector[...]) points to uninitialised byte(s)"
+         * error.
+         */
+        memset(pdata + total_data, 0, (max_data_bytes + DIR_ENTRY_SAFETY_MARGIN) - total_data);
         /* Realloc the params space */
         *pparams = (char *)SMB_REALLOC(*pparams, 6*SIZEOFWORD);
@@ -2794 +3111 @@
 
         /* Get the wildcard mask from the dptr */
-        if((p = dptr_wcard(sconn, dptr_num))== NULL) {
+        if((mask = dptr_wcard(sconn, dptr_num))== NULL) {
                 DEBUG(2,("dptr_num %d has no wildcard\n", dptr_num));
                 reply_nterror(req, STATUS_NO_MORE_FILES);
@@ -2800 +3117 @@
         }
 
-        mask = p;
-
         /* Get the attr mask from the dptr */
         dirtype = dptr_attr(sconn, dptr_num);
 
-        DEBUG(3,("dptr_num is %d, mask = %s, attr = %x, dirptr=(0x%lX,%ld)\n",
+        backup_priv = dptr_get_priv(dirptr);
+
+        DEBUG(3,("dptr_num is %d, mask = %s, attr = %x, dirptr=(0x%lX,%ld) "
+                "backup_priv = %d\n",
                 dptr_num, mask, dirtype,
                 (long)dirptr,
-                dptr_TellDir(dirptr)));
+                dptr_TellDir(dirptr),
+                (int)backup_priv));
 
         /* Initialize per TRANS2_FIND_NEXT operation data */
@@ -2817 +3136 @@
 
         DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
-                 directory,lp_dontdescend(SNUM(conn))));
-        if (in_list(directory,lp_dontdescend(SNUM(conn)),conn->case_sensitive))
+                 directory,lp_dont_descend(ctx, SNUM(conn))));
+        if (in_list(directory,lp_dont_descend(ctx, SNUM(conn)),conn->case_sensitive))
                 dont_descend = True;
 
@@ -2824 +3143 @@
         space_remaining = max_data_bytes;
         out_of_space = False;
+
+        if (backup_priv) {
+                become_root();
+                as_root = true;
+        }
 
         /*
@@ -2872 +3196 @@
                         finished = False;
                 } else {
-                        finished = !get_lanman2_dir_entry(ctx,
+                        ntstatus = get_lanman2_dir_entry(ctx,
                                                 conn,
                                                 dirptr,
@@ -2880 +3204 @@
                                                 ask_sharemode,
                                                 &p,pdata,data_end,
-                                                space_remaining, &out_of_space,
+                                                space_remaining,
                                                 &got_exact_match,
                                                 &last_entry_off, ea_list);
-                }
-
-                if (finished && out_of_space)
-                        finished = False;
+                        if (NT_STATUS_EQUAL(ntstatus,
+                                        NT_STATUS_ILLEGAL_CHARACTER)) {
+                                /*
+                                 * Bad character conversion on name. Ignore this
+                                 * entry.
+                                 */
+                                continue;
+                        }
+                        if (NT_STATUS_EQUAL(ntstatus, STATUS_MORE_ENTRIES)) {
+                                out_of_space = true;
+                        } else {
+                                finished = !NT_STATUS_IS_OK(ntstatus);
+                        }
+                }
 
                 if (!finished && !out_of_space)
@@ -2914 +3248 @@
         }
 
+        if (as_root) {
+                unbecome_root();
+        }
+
         /* Set up the return parameter block */
         SSVAL(params,0,numentries);
@@ -2920 +3258 @@
         SSVAL(params,6,last_entry_off);
 
-        send_trans2_replies(conn, req, params, 8, pdata, PTR_DIFF(p,pdata),
+        send_trans2_replies(conn, req, NT_STATUS_OK, params, 8, pdata, PTR_DIFF(p,pdata),
                             max_data_bytes);
 
@@ -2928 +3266 @@
 unsigned char *create_volume_objectid(connection_struct *conn, unsigned char objid[16])
 {
-        E_md4hash(lp_servicename(SNUM(conn)),objid);
+        E_md4hash(lp_servicename(talloc_tos(), SNUM(conn)),objid);
         return objid;
 }
@@ -2967 +3305 @@
 }
 
-NTSTATUS smbd_do_qfsinfo(connection_struct *conn,
+NTSTATUS smbd_do_qfsinfo(struct smbXsrv_connection *xconn,
+                         connection_struct *conn,
                          TALLOC_CTX *mem_ctx,
                          uint16_t info_level,
@@ -2978 +3317 @@
 {
         char *pdata, *end_data;
-        int data_len = 0, len;
-        const char *vname = volume_label(SNUM(conn));
+        int data_len = 0;
+        size_t len = 0;
+        const char *vname = volume_label(talloc_tos(), SNUM(conn));
         int snum = SNUM(conn);
-        char *fstype = lp_fstype(SNUM(conn));
+        const char *fstype = lp_fstype(SNUM(conn));
         const char *filename = NULL;
-        uint32 additional_flags = 0;
+        const uint64_t bytes_per_sector = 512;
+        uint32_t additional_flags = 0;
         struct smb_filename smb_fname;
         SMB_STRUCT_STAT st;
         NTSTATUS status = NT_STATUS_OK;
+        uint64_t df_ret;
 
         if (fname == NULL || fname->base_name == NULL) {
@@ -3015 +3357 @@
         st = smb_fname.st;
 
+        if (max_data_bytes + DIR_ENTRY_SAFETY_MARGIN < max_data_bytes) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
         *ppdata = (char *)SMB_REALLOC(
                 *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
@@ -3030 +3376 @@
                 case SMB_INFO_ALLOCATION:
                 {
-                        uint64_t dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
+                        uint64_t dfree,dsize,bsize,block_size,sectors_per_unit;
                         data_len = 18;
-                        if (get_dfree_info(conn,filename,False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
+                        df_ret = get_dfree_info(conn, filename, &bsize, &dfree,
+                                                &dsize);
+                        if (df_ret == (uint64_t)-1) {
                                 return map_nt_error_from_unix(errno);
                         }
@@ -3049 +3397 @@
                                 dfree *= factor;
                         }
-                        bytes_per_sector = 512;
                         sectors_per_unit = bsize/bytes_per_sector;
 
@@ -3070 +3417 @@
                          * the called hostname and the service name.
                          */
-                        SIVAL(pdata,0,str_checksum(lp_servicename(snum)) ^ (str_checksum(get_local_machine_name())<<16) );
+                        SIVAL(pdata,0,str_checksum(lp_servicename(talloc_tos(), snum)) ^ (str_checksum(get_local_machine_name())<<16) );
                         /*
                          * Win2k3 and previous mess this up by sending a name length
@@ -3077 +3424 @@
                          * the pushed string. The change here was adding the STR_TERMINATE. JRA.
                          */
-                        len = srvstr_push(
+                        status = srvstr_push(
                                 pdata, flags2,
                                 pdata+l2_vol_szVolLabel, vname,
                                 PTR_DIFF(end_data, pdata+l2_vol_szVolLabel),
-                                STR_NOALIGN|STR_TERMINATE);
+                                STR_NOALIGN|STR_TERMINATE, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         SCVAL(pdata,l2_vol_cch,len);
                         data_len = l2_vol_szVolLabel + len;
-                        DEBUG(5,("smbd_do_qfsinfo : time = %x, namelen = %d, name = %s\n",
+                        DEBUG(5,("smbd_do_qfsinfo : time = %x, namelen = %u, name = %s\n",
                                  (unsigned)convert_timespec_to_time_t(st.st_ex_ctime),
-                                 len, vname));
+                                 (unsigned)len, vname));
                         break;
 
@@ -3114 +3464 @@
                         /* NOTE! the fstype must *not* be null terminated or win98 won't recognise it
                                 and will think we can't do long filenames */
-                        len = srvstr_push(pdata, flags2, pdata+12, fstype,
+                        status = srvstr_push(pdata, flags2, pdata+12, fstype,
                                           PTR_DIFF(end_data, pdata+12),
-                                          STR_UNICODE);
+                                          STR_UNICODE, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         SIVAL(pdata,8,len);
                         data_len = 12 + len;
@@ -3130 +3483 @@
                 case SMB_QUERY_FS_LABEL_INFO:
                 case SMB_FS_LABEL_INFORMATION:
-                        len = srvstr_push(pdata, flags2, pdata+4, vname,
-                                          PTR_DIFF(end_data, pdata+4), 0);
+                        status = srvstr_push(pdata, flags2, pdata+4, vname,
+                                          PTR_DIFF(end_data, pdata+4), 0, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         data_len = 4 + len;
                         SIVAL(pdata,0,len);
@@ -3143 +3499 @@
                          * the called hostname and the service name.
                          */
-                        SIVAL(pdata,8,str_checksum(lp_servicename(snum)) ^ 
+                        SIVAL(pdata,8,str_checksum(lp_servicename(talloc_tos(), snum)) ^
                                 (str_checksum(get_local_machine_name())<<16));
 
                         /* Max label len is 32 characters. */
-                        len = srvstr_push(pdata, flags2, pdata+18, vname,
+                        status = srvstr_push(pdata, flags2, pdata+18, vname,
                                           PTR_DIFF(end_data, pdata+18),
-                                          STR_UNICODE);
+                                          STR_UNICODE, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         SIVAL(pdata,12,len);
                         data_len = 18+len;
 
                         DEBUG(5,("smbd_do_qfsinfo : SMB_QUERY_FS_VOLUME_INFO namelen = %d, vol=%s serv=%s\n",
-                                (int)strlen(vname),vname, lp_servicename(snum)));
+                                (int)strlen(vname),vname,
+                                lp_servicename(talloc_tos(), snum)));
                         if (max_data_bytes >= 24 && data_len > max_data_bytes) {
                                 /* the client only requested a portion of the
@@ -3161 +3521 @@
                                 status = STATUS_BUFFER_OVERFLOW;
                         }
-
+                        *fixed_portion = 24;
                         break;
 
@@ -3167 +3527 @@
                 case SMB_FS_SIZE_INFORMATION:
                 {
-                        uint64_t dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
+                        uint64_t dfree,dsize,bsize,block_size,sectors_per_unit;
                         data_len = 24;
-                        if (get_dfree_info(conn,filename,False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
+                        df_ret = get_dfree_info(conn, filename, &bsize, &dfree,
+                                                &dsize);
+                        if (df_ret == (uint64_t)-1) {
                                 return map_nt_error_from_unix(errno);
                         }
@@ -3185 +3547 @@
                                 dfree *= factor;
                         }
-                        bytes_per_sector = 512;
                         sectors_per_unit = bsize/bytes_per_sector;
                         DEBUG(5,("smbd_do_qfsinfo : SMB_QUERY_FS_SIZE_INFO bsize=%u, cSectorUnit=%u, \
@@ -3200 +3561 @@
                 case SMB_FS_FULL_SIZE_INFORMATION:
                 {
-                        uint64_t dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
+                        uint64_t dfree,dsize,bsize,block_size,sectors_per_unit;
                         data_len = 32;
-                        if (get_dfree_info(conn,filename,False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
+                        df_ret = get_dfree_info(conn, filename, &bsize, &dfree,
+                                                &dsize);
+                        if (df_ret == (uint64_t)-1) {
                                 return map_nt_error_from_unix(errno);
                         }
@@ -3218 +3581 @@
                                 dfree *= factor;
                         }
-                        bytes_per_sector = 512;
                         sectors_per_unit = bsize/bytes_per_sector;
                         DEBUG(5,("smbd_do_qfsinfo : SMB_QUERY_FS_FULL_SIZE_INFO bsize=%u, cSectorUnit=%u, \
@@ -3279 +3641 @@
 
                         fsp.conn = conn;
-                        fsp.fnum = -1;
+                        fsp.fnum = FNUM_FIELD_INVALID;
 
                         /* access check */
                         if (get_current_uid(conn) != 0) {
-                                DEBUG(0,("set_user_quota: access_denied "
+                                DEBUG(0,("get_user_quota: access_denied "
                                          "service [%s] user [%s]\n",
-                                         lp_servicename(SNUM(conn)),
-                                         conn->session_info->unix_name));
+                                         lp_servicename(talloc_tos(), SNUM(conn)),
+                                         conn->session_info->unix_info->unix_name));
                                 return NT_STATUS_ACCESS_DENIED;
                         }
 
                         if (vfs_get_ntquota(&fsp, SMB_USER_FS_QUOTA_TYPE, NULL, &quotas)!=0) {
-                                DEBUG(0,("vfs_get_ntquota() failed for service [%s]\n",lp_servicename(SNUM(conn))));
+                                DEBUG(0,("vfs_get_ntquota() failed for service [%s]\n",lp_servicename(talloc_tos(), SNUM(conn))));
                                 return map_nt_error_from_unix(errno);
                         }
@@ -3298 +3660 @@
 
                         DEBUG(10,("SMB_FS_QUOTA_INFORMATION: for service [%s]\n",
-                                  lp_servicename(SNUM(conn))));
+                                  lp_servicename(talloc_tos(), SNUM(conn))));
 
                         /* Unknown1 24 NULL bytes*/
@@ -3336 +3698 @@
                 }
 
+                case SMB_FS_SECTOR_SIZE_INFORMATION:
+                {
+                        data_len = 28;
+                        /*
+                         * These values match a physical Windows Server 2012
+                         * share backed by NTFS atop spinning rust.
+                         */
+                        DEBUG(5, ("SMB_FS_SECTOR_SIZE_INFORMATION:"));
+                        /* logical_bytes_per_sector */
+                        SIVAL(pdata, 0, bytes_per_sector);
+                        /* phys_bytes_per_sector_atomic */
+                        SIVAL(pdata, 4, bytes_per_sector);
+                        /* phys_bytes_per_sector_perf */
+                        SIVAL(pdata, 8, bytes_per_sector);
+                        /* fs_effective_phys_bytes_per_sector_atomic */
+                        SIVAL(pdata, 12, bytes_per_sector);
+                        /* flags */
+                        SIVAL(pdata, 16, SSINFO_FLAGS_ALIGNED_DEVICE
+                                | SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE);
+                        /* byte_off_sector_align */
+                        SIVAL(pdata, 20, 0);
+                        /* byte_off_partition_align */
+                        SIVAL(pdata, 24, 0);
+                        *fixed_portion = 28;
+                        break;
+                }
+
+
                 /*
                  * Query the version and capabilities of the CIFS UNIX extensions
@@ -3344 +3734 @@
                 {
                         bool large_write = lp_min_receive_file_size() &&
-                                        !srv_is_signing_active(conn->sconn);
-                        bool large_read = !srv_is_signing_active(conn->sconn);
+                                        !srv_is_signing_active(xconn);
+                        bool large_read = !srv_is_signing_active(xconn);
                         int encrypt_caps = 0;
 
@@ -3353 +3743 @@
 
                         switch (conn->encrypt_level) {
-                        case 0:
+                        case SMB_SIGNING_OFF:
                                 encrypt_caps = 0;
                                 break;
-                        case 1:
-                        case Auto:
+                        case SMB_SIGNING_DESIRED:
+                        case SMB_SIGNING_IF_REQUIRED:
+                        case SMB_SIGNING_DEFAULT:
                                 encrypt_caps = CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP;
                                 break;
-                        case Required:
+                        case SMB_SIGNING_REQUIRED:
                                 encrypt_caps = CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP|
                                                 CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP;
@@ -3415 +3806 @@
 #endif /* EOPNOTSUPP */
                         } else {
-                                DEBUG(0,("vfs_statvfs() failed for service [%s]\n",lp_servicename(SNUM(conn))));
+                                DEBUG(0,("vfs_statvfs() failed for service [%s]\n",lp_servicename(talloc_tos(), SNUM(conn))));
                                 return NT_STATUS_DOS(ERRSRV, ERRerror);
                         }
-                        *fixed_portion = 24;
                         break;
                 }
@@ -3436 +3826 @@
                         }
 
-                        /* We ARE guest if global_sid_Builtin_Guests is
-                         * in our list of SIDs.
-                         */
-                        if (nt_token_check_sid(&global_sid_Builtin_Guests,
-                                               conn->session_info->security_token)) {
+                        if (security_session_user_level(conn->session_info, NULL) < SECURITY_USER) {
                                 flags |= SMB_WHOAMI_GUEST;
-                        }
-
-                        /* We are NOT guest if global_sid_Authenticated_Users
-                         * is in our list of SIDs.
-                         */
-                        if (nt_token_check_sid(&global_sid_Authenticated_Users,
-                                               conn->session_info->security_token)) {
-                                flags &= ~SMB_WHOAMI_GUEST;
                         }
 
@@ -3464 +3842 @@
                             + 4 /* SID bytes */
                             + 4 /* pad/reserved */
-                            + (conn->session_info->utok.ngroups * 8)
+                            + (conn->session_info->unix_token->ngroups * 8)
                                 /* groups list */
                             + (conn->session_info->security_token->num_sids *
@@ -3473 +3851 @@
                         SIVAL(pdata, 4, SMB_WHOAMI_MASK);
                         SBIG_UINT(pdata, 8,
-                                  (uint64_t)conn->session_info->utok.uid);
+                                  (uint64_t)conn->session_info->unix_token->uid);
                         SBIG_UINT(pdata, 16,
-                                  (uint64_t)conn->session_info->utok.gid);
+                                  (uint64_t)conn->session_info->unix_token->gid);
 
 
@@ -3490 +3868 @@
                         }
 
-                        SIVAL(pdata, 24, conn->session_info->utok.ngroups);
+                        SIVAL(pdata, 24, conn->session_info->unix_token->ngroups);
                         SIVAL(pdata, 28, conn->session_info->security_token->num_sids);
 
@@ -3512 +3890 @@
 
                         /* GID list */
-                        for (i = 0; i < conn->session_info->utok.ngroups; ++i) {
+                        for (i = 0; i < conn->session_info->unix_token->ngroups; ++i) {
                                 SBIG_UINT(pdata, data_len,
-                                          (uint64_t)conn->session_info->utok.groups[i]);
+                                          (uint64_t)conn->session_info->unix_token->groups[i]);
                                 data_len += 8;
                         }
@@ -3525 +3903 @@
                                         0);
 
-                                sid_linearize(pdata + data_len, sid_len,
+                                sid_linearize((uint8_t *)(pdata + data_len),
+                                              sid_len,
                                     &conn->session_info->security_token->sids[i]);
                                 data_len += sid_len;
@@ -3550 +3929 @@
         *ret_data_len = data_len;
         return status;
+}
+
+static NTSTATUS smb_set_fsquota(connection_struct *conn,
+                        struct smb_request *req,
+                        files_struct *fsp,
+                        const DATA_BLOB *qdata)
+{
+        NTSTATUS status;
+        SMB_NTQUOTA_STRUCT quotas;
+
+        ZERO_STRUCT(quotas);
+
+        /* access check */
+        if ((get_current_uid(conn) != 0) || !CAN_WRITE(conn)) {
+                DEBUG(3, ("set_fsquota: access_denied service [%s] user [%s]\n",
+                          lp_servicename(talloc_tos(), SNUM(conn)),
+                          conn->session_info->unix_info->unix_name));
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        if (!check_fsp_ntquota_handle(conn, req,
+                                      fsp)) {
+                DEBUG(1, ("set_fsquota: no valid QUOTA HANDLE\n"));
+                return NT_STATUS_INVALID_HANDLE;
+        }
+
+        /* note: normally there're 48 bytes,
+         * but we didn't use the last 6 bytes for now
+         * --metze
+         */
+        if (qdata->length < 42) {
+                DEBUG(0,("set_fsquota: requires total_data(%u) >= 42 bytes!\n",
+                        (unsigned int)qdata->length));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        /* unknown_1 24 NULL bytes in pdata*/
+
+        /* the soft quotas 8 bytes (uint64_t)*/
+        quotas.softlim = BVAL(qdata->data,24);
+
+        /* the hard quotas 8 bytes (uint64_t)*/
+        quotas.hardlim = BVAL(qdata->data,32);
+
+        /* quota_flags 2 bytes **/
+        quotas.qflags = SVAL(qdata->data,40);
+
+        /* unknown_2 6 NULL bytes follow*/
+
+        /* now set the quotas */
+        if (vfs_set_ntquota(fsp, SMB_USER_FS_QUOTA_TYPE, NULL, &quotas)!=0) {
+                DEBUG(1, ("vfs_set_ntquota() failed for service [%s]\n",
+                          lp_servicename(talloc_tos(), SNUM(conn))));
+                status =  map_nt_error_from_unix(errno);
+        } else {
+                status = NT_STATUS_OK;
+        }
+        return status;
+}
+
+NTSTATUS smbd_do_setfsinfo(connection_struct *conn,
+                                struct smb_request *req,
+                                TALLOC_CTX *mem_ctx,
+                                uint16_t info_level,
+                                files_struct *fsp,
+                                const DATA_BLOB *pdata)
+{
+        switch (info_level) {
+                case SMB_FS_QUOTA_INFORMATION:
+                {
+                        return smb_set_fsquota(conn,
+                                                req,
+                                                fsp,
+                                                pdata);
+                }
+
+                default:
+                        break;
+        }
+        return NT_STATUS_INVALID_LEVEL;
 }
 
@@ -3580 +4039 @@
                                 "and info level 0x%x sent.\n",
                                 (unsigned int)info_level));
-                        exit_server_cleanly("encryption required "
-                                "on connection");
+                        reply_nterror(req, NT_STATUS_ACCESS_DENIED);
                         return;
                 }
@@ -3588 +4046 @@
         DEBUG(3,("call_trans2qfsinfo: level = %d\n", info_level));
 
-        status = smbd_do_qfsinfo(conn, req,
+        status = smbd_do_qfsinfo(req->xconn, conn, req,
                                  info_level,
                                  req->flags2,
@@ -3600 +4058 @@
         }
 
-        send_trans2_replies(conn, req, params, 0, *ppdata, data_len,
+        send_trans2_replies(conn, req, NT_STATUS_OK, params, 0, *ppdata, data_len,
                             max_data_bytes);
 
@@ -3619 +4077 @@
                                  unsigned int max_data_bytes)
 {
+        struct smbXsrv_connection *xconn = req->xconn;
         char *pdata = *ppdata;
         char *params = *pparams;
-        uint16 info_level;
-
-        DEBUG(10,("call_trans2setfsinfo: for service [%s]\n",lp_servicename(SNUM(conn))));
+        uint16_t info_level;
+
+        DEBUG(10,("call_trans2setfsinfo: for service [%s]\n",
+                  lp_servicename(talloc_tos(), SNUM(conn))));
 
         /*  */
@@ -3651 +4111 @@
                                 "and info level 0x%x sent.\n",
                                 (unsigned int)info_level));
-                        exit_server_cleanly("encryption required "
-                                "on connection");
+                        reply_nterror(req, NT_STATUS_ACCESS_DENIED);
                         return;
                 }
@@ -3659 +4118 @@
         switch(info_level) {
                 case SMB_SET_CIFS_UNIX_INFO:
-                        {
-                                uint16 client_unix_major;
-                                uint16 client_unix_minor;
-                                uint32 client_unix_cap_low;
-                                uint32 client_unix_cap_high;
-
-                                if (!lp_unix_extensions()) {
-                                        reply_nterror(req,
-                                                      NT_STATUS_INVALID_LEVEL);
-                                        return;
-                                }
-
-                                /* There should be 12 bytes of capabilities set. */
-                                if (total_data < 8) {
-                                        reply_nterror(
-                                                req,
-                                                NT_STATUS_INVALID_PARAMETER);
-                                        return;
-                                }
-                                client_unix_major = SVAL(pdata,0);
-                                client_unix_minor = SVAL(pdata,2);
-                                client_unix_cap_low = IVAL(pdata,4);
-                                client_unix_cap_high = IVAL(pdata,8);
-                                /* Just print these values for now. */
-                                DEBUG(10,("call_trans2setfsinfo: set unix info. major = %u, minor = %u \
-cap_low = 0x%x, cap_high = 0x%x\n",
-                                        (unsigned int)client_unix_major,
-                                        (unsigned int)client_unix_minor,
-                                        (unsigned int)client_unix_cap_low,
-                                        (unsigned int)client_unix_cap_high ));
-
-                                /* Here is where we must switch to posix pathname processing... */
-                                if (client_unix_cap_low & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
-                                        lp_set_posix_pathnames();
-                                        mangle_change_to_posix();
-                                }
-
-                                if ((client_unix_cap_low & CIFS_UNIX_FCNTL_LOCKS_CAP) &&
-                                    !(client_unix_cap_low & CIFS_UNIX_POSIX_PATH_OPERATIONS_CAP)) {
-                                        /* Client that knows how to do posix locks,
-                                         * but not posix open/mkdir operations. Set a
-                                         * default type for read/write checks. */
-
-                                        lp_set_posix_default_cifsx_readwrite_locktype(POSIX_LOCK);
-
-                                }
-                                break;
-                        }
+                        if (!lp_unix_extensions()) {
+                                DEBUG(2,("call_trans2setfsinfo: "
+                                        "SMB_SET_CIFS_UNIX_INFO is invalid with "
+                                        "unix extensions off\n"));
+                                reply_nterror(req,
+                                              NT_STATUS_INVALID_LEVEL);
+                                return;
+                        }
+
+                        /* There should be 12 bytes of capabilities set. */
+                        if (total_data < 12) {
+                                reply_nterror(
+                                        req,
+                                        NT_STATUS_INVALID_PARAMETER);
+                                return;
+                        }
+                        xconn->smb1.unix_info.client_major = SVAL(pdata,0);
+                        xconn->smb1.unix_info.client_minor = SVAL(pdata,2);
+                        xconn->smb1.unix_info.client_cap_low = IVAL(pdata,4);
+                        xconn->smb1.unix_info.client_cap_high = IVAL(pdata,8);
+                        /* Just print these values for now. */
+                        DEBUG(10, ("call_trans2setfsinfo: set unix_info info. "
+                                   "major = %u, minor = %u cap_low = 0x%x, "
+                                   "cap_high = 0x%xn",
+                                   (unsigned int)xconn->
+                                   smb1.unix_info.client_major,
+                                   (unsigned int)xconn->
+                                   smb1.unix_info.client_minor,
+                                   (unsigned int)xconn->
+                                   smb1.unix_info.client_cap_low,
+                                   (unsigned int)xconn->
+                                   smb1.unix_info.client_cap_high));
+
+                        /* Here is where we must switch to posix pathname processing... */
+                        if (xconn->smb1.unix_info.client_cap_low & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
+                                lp_set_posix_pathnames();
+                                mangle_change_to_posix();
+                        }
+
+                        if ((xconn->smb1.unix_info.client_cap_low & CIFS_UNIX_FCNTL_LOCKS_CAP) &&
+                            !(xconn->smb1.unix_info.client_cap_low & CIFS_UNIX_POSIX_PATH_OPERATIONS_CAP)) {
+                                /* Client that knows how to do posix locks,
+                                 * but not posix open/mkdir operations. Set a
+                                 * default type for read/write checks. */
+
+                                lp_set_posix_default_cifsx_readwrite_locktype(POSIX_LOCK);
+
+                        }
+                        break;
 
                 case SMB_REQUEST_TRANSPORT_ENCRYPTION:
@@ -3721 +4181 @@
                                 }
 
-                                if (lp_smb_encrypt(SNUM(conn)) == false) {
+                                if (lp_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) {
                                         reply_nterror(
                                                 req,
@@ -3728 +4188 @@
                                 }
 
-                                if (req->sconn->smb1.echo_handler.trusted_fde) {
+                                if (xconn->smb1.echo_handler.trusted_fde) {
                                         DEBUG( 2,("call_trans2setfsinfo: "
                                                 "request transport encryption disabled"
@@ -3754 +4214 @@
 
                                 send_trans2_replies(conn, req,
+                                                NT_STATUS_OK,
                                                 *pparams,
                                                 param_len,
@@ -3765 +4226 @@
                                         status = srv_encryption_start(conn);
                                         if (!NT_STATUS_IS_OK(status)) {
-                                                exit_server_cleanly(
-                                                        "Failure in setting "
-                                                        "up encrypted transport");
+                                                char *reason = talloc_asprintf(talloc_tos(),
+                                                                               "Failure in setting "
+                                                                               "up encrypted transport: %s",
+                                                                               nt_errstr(status));
+                                                exit_server_cleanly(reason);
                                         }
                                 }
@@ -3775 +4238 @@
                 case SMB_FS_QUOTA_INFORMATION:
                         {
+                                NTSTATUS status;
+                                DATA_BLOB qdata = {
+                                                .data = (uint8_t *)pdata,
+                                                .length = total_data
+                                };
                                 files_struct *fsp = NULL;
-                                SMB_NTQUOTA_STRUCT quotas;
-
-                                ZERO_STRUCT(quotas);
-
-                                /* access check */
-                                if ((get_current_uid(conn) != 0) || !CAN_WRITE(conn)) {
-                                        DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n",
-                                                 lp_servicename(SNUM(conn)),
-                                                 conn->session_info->unix_name));
-                                        reply_nterror(req, NT_STATUS_ACCESS_DENIED);
+                                fsp = file_fsp(req, SVAL(params,0));
+
+                                status = smb_set_fsquota(conn,
+                                                        req,
+                                                        fsp,
+                                                        &qdata);
+                                if (!NT_STATUS_IS_OK(status)) {
+                                        reply_nterror(req, status);
                                         return;
                                 }
-
-                                /* note: normaly there're 48 bytes,
-                                 * but we didn't use the last 6 bytes for now 
-                                 * --metze 
-                                 */
-                                fsp = file_fsp(req, SVAL(params,0));
-
-                                if (!check_fsp_ntquota_handle(conn, req,
-                                                              fsp)) {
-                                        DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
-                                        reply_nterror(
-                                                req, NT_STATUS_INVALID_HANDLE);
-                                        return;
-                                }
-
-                                if (total_data < 42) {
-                                        DEBUG(0,("call_trans2setfsinfo: SET_FS_QUOTA: requires total_data(%d) >= 42 bytes!\n",
-                                                total_data));
-                                        reply_nterror(
-                                                req,
-                                                NT_STATUS_INVALID_PARAMETER);
-                                        return;
-                                }
-
-                                /* unknown_1 24 NULL bytes in pdata*/
-
-                                /* the soft quotas 8 bytes (uint64_t)*/
-                                quotas.softlim = BVAL(pdata,24);
-
-                                /* the hard quotas 8 bytes (uint64_t)*/
-                                quotas.hardlim = BVAL(pdata,32);
-
-                                /* quota_flags 2 bytes **/
-                                quotas.qflags = SVAL(pdata,40);
-
-                                /* unknown_2 6 NULL bytes follow*/
-
-                                /* now set the quotas */
-                                if (vfs_set_ntquota(fsp, SMB_USER_FS_QUOTA_TYPE, NULL, &quotas)!=0) {
-                                        DEBUG(0,("vfs_set_ntquota() failed for service [%s]\n",lp_servicename(SNUM(conn))));
-                                        reply_nterror(req, map_nt_error_from_unix(errno));
-                                        return;
-                                }
-
                                 break;
                         }
@@ -3862 +4284 @@
         SMB_ACL_ENTRY_T entry;
 
-        while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
+        while ( posix_acl && (sys_acl_get_entry(posix_acl, entry_id, &entry) == 1)) {
                 /* get_next... */
                 if (entry_id == SMB_ACL_FIRST_ENTRY) {
@@ -3881 +4303 @@
         SMB_ACL_ENTRY_T entry;
 
-        while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) {
+        while ( posix_acl && (sys_acl_get_entry(posix_acl, entry_id, &entry) == 1)) {
                 SMB_ACL_TAG_T tagtype;
                 SMB_ACL_PERMSET_T permset;
@@ -3892 +4314 @@
                 }
 
-                if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) {
+                if (sys_acl_get_tag_type(entry, &tagtype) == -1) {
                         DEBUG(0,("marshall_posix_acl: SMB_VFS_SYS_ACL_GET_TAG_TYPE failed.\n"));
                         return False;
                 }
 
-                if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) {
+                if (sys_acl_get_permset(entry, &permset) == -1) {
                         DEBUG(0,("marshall_posix_acl: SMB_VFS_SYS_ACL_GET_PERMSET failed.\n"));
                         return False;
                 }
 
-                perms |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? SMB_POSIX_ACL_READ : 0);
-                perms |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? SMB_POSIX_ACL_WRITE : 0);
-                perms |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? SMB_POSIX_ACL_EXECUTE : 0);
+                perms |= (sys_acl_get_perm(permset, SMB_ACL_READ) ? SMB_POSIX_ACL_READ : 0);
+                perms |= (sys_acl_get_perm(permset, SMB_ACL_WRITE) ? SMB_POSIX_ACL_WRITE : 0);
+                perms |= (sys_acl_get_perm(permset, SMB_ACL_EXECUTE) ? SMB_POSIX_ACL_EXECUTE : 0);
 
                 SCVAL(pdata,1,perms);
@@ -3917 +4339 @@
                         case SMB_ACL_USER:
                                 {
-                                        uid_t *puid = (uid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
+                                        uid_t *puid = (uid_t *)sys_acl_get_qualifier(entry);
                                         if (!puid) {
                                                 DEBUG(0,("marshall_posix_acl: SMB_VFS_SYS_ACL_GET_QUALIFIER failed.\n"));
@@ -3923 +4345 @@
                                         }
                                         own_grp = (unsigned int)*puid;
-                                        SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype);
                                         SCVAL(pdata,0,SMB_POSIX_ACL_USER);
                                         SIVAL(pdata,2,own_grp);
@@ -3937 +4358 @@
                         case SMB_ACL_GROUP:
                                 {
-                                        gid_t *pgid= (gid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry);
+                                        gid_t *pgid= (gid_t *)sys_acl_get_qualifier(entry);
                                         if (!pgid) {
                                                 DEBUG(0,("marshall_posix_acl: SMB_VFS_SYS_ACL_GET_QUALIFIER failed.\n"));
@@ -3943 +4364 @@
                                         }
                                         own_grp = (unsigned int)*pgid;
-                                        SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype);
                                         SCVAL(pdata,0,SMB_POSIX_ACL_GROUP);
                                         SIVAL(pdata,2,own_grp);
@@ -3980 +4400 @@
 {
         uint64_t file_index = get_FileIndex(conn, psbuf);
+        dev_t devno;
 
         DEBUG(10,("store_file_unix_basic: SMB_QUERY_FILE_UNIX_BASIC\n"));
@@ -4006 +4427 @@
         pdata += 4;
 
-        SIVAL(pdata,0,unix_dev_major(psbuf->st_ex_rdev));   /* Major device number if type is device */
+        if (S_ISBLK(psbuf->st_ex_mode) || S_ISCHR(psbuf->st_ex_mode)) {
+                devno = psbuf->st_ex_rdev;
+        } else {
+                devno = psbuf->st_ex_dev;
+        }
+
+        SIVAL(pdata,0,unix_dev_major(devno));   /* Major device number if type is device */
         SIVAL(pdata,4,0);
         pdata += 8;
 
-        SIVAL(pdata,0,unix_dev_minor(psbuf->st_ex_rdev));   /* Minor device number if type is device */
+        SIVAL(pdata,0,unix_dev_minor(devno));   /* Minor device number if type is device */
         SIVAL(pdata,4,0);
         pdata += 8;
@@ -4063 +4490 @@
 
 static void map_info2_flags_from_sbuf(const SMB_STRUCT_STAT *psbuf,
-                                uint32 *smb_fflags, uint32 *smb_fmask)
+                                uint32_t *smb_fflags, uint32_t *smb_fmask)
 {
         int i;
@@ -4076 +4503 @@
 
 static bool map_info2_flags_to_sbuf(const SMB_STRUCT_STAT *psbuf,
-                                const uint32 smb_fflags,
-                                const uint32 smb_fmask,
+                                const uint32_t smb_fflags,
+                                const uint32_t smb_fmask,
                                 int *stat_fflags)
 {
-        uint32 max_fmask = 0;
+        uint32_t max_fmask = 0;
         int i;
 
@@ -4120 +4547 @@
                                 const SMB_STRUCT_STAT *psbuf)
 {
-        uint32 file_flags = 0;
-        uint32 flags_mask = 0;
+        uint32_t file_flags = 0;
+        uint32_t flags_mask = 0;
 
         pdata = store_file_unix_basic(conn, pdata, fsp, psbuf);
@@ -4233 +4660 @@
         unsigned int data_size = 0;
         unsigned int param_size = 2;
-        uint16 info_level;
+        uint16_t info_level;
         files_struct *fsp;
 
@@ -4261 +4688 @@
         params = *pparams;
         SSVAL(params,0,0);
+        if (max_data_bytes + DIR_ENTRY_SAFETY_MARGIN < max_data_bytes) {
+                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                return;
+        }
         data_size = max_data_bytes + DIR_ENTRY_SAFETY_MARGIN;
         *ppdata = (char *)SMB_REALLOC(*ppdata, data_size); 
@@ -4283 +4714 @@
         }
 
-        send_trans2_replies(conn, req, params, param_size, *ppdata, data_size,
+        send_trans2_replies(conn, req, NT_STATUS_OK, params, param_size, *ppdata, data_size,
                             max_data_bytes);
 
@@ -4322 +4753 @@
         uint64_t file_index = 0;
         uint32_t access_mask = 0;
+        size_t len = 0;
 
         if (INFO_LEVEL_IS_UNIX(info_level) && !lp_unix_extensions()) {
@@ -4327 +4759 @@
         }
 
-        DEBUG(5,("smbd_do_qfilepathinfo: %s (fnum = %d) level=%d max_data=%u\n",
-                 smb_fname_str_dbg(smb_fname), fsp ? fsp->fnum : -1,
+        DEBUG(5,("smbd_do_qfilepathinfo: %s (%s) level=%d max_data=%u\n",
+                 smb_fname_str_dbg(smb_fname),
+                 fsp_fnum_dbg(fsp),
                  info_level, max_data_bytes));
 
@@ -4340 +4773 @@
         if ((nlink > 0) && delete_pending) {
                 nlink -= 1;
+        }
+
+        if (max_data_bytes + DIR_ENTRY_SAFETY_MARGIN < max_data_bytes) {
+                return NT_STATUS_INVALID_PARAMETER;
         }
 
@@ -4446 +4883 @@
                         srv_put_dos_date2(pdata,l1_fdateLastAccess,atime);
                         srv_put_dos_date2(pdata,l1_fdateLastWrite,mtime); /* write time */
-                        SIVAL(pdata,l1_cbFile,(uint32)file_size);
-                        SIVAL(pdata,l1_cbFileAlloc,(uint32)allocation_size);
+                        SIVAL(pdata,l1_cbFile,(uint32_t)file_size);
+                        SIVAL(pdata,l1_cbFileAlloc,(uint32_t)allocation_size);
                         SSVAL(pdata,l1_attrFile,mode);
                         break;
@@ -4455 +4892 @@
                         unsigned int ea_size =
                             estimate_ea_size(conn, fsp,
-                                             smb_fname->base_name);
+                                             smb_fname);
                         DEBUG(10,("smbd_do_qfilepathinfo: SMB_INFO_QUERY_EA_SIZE\n"));
                         data_size = 26;
@@ -4461 +4898 @@
                         srv_put_dos_date2(pdata,4,atime);
                         srv_put_dos_date2(pdata,8,mtime); /* write time */
-                        SIVAL(pdata,12,(uint32)file_size);
-                        SIVAL(pdata,16,(uint32)allocation_size);
+                        SIVAL(pdata,12,(uint32_t)file_size);
+                        SIVAL(pdata,16,(uint32_t)allocation_size);
                         SSVAL(pdata,20,mode);
                         SIVAL(pdata,22,ea_size);
@@ -4482 +4919 @@
                         size_t total_ea_len = 0;
                         struct ea_list *ea_file_list = NULL;
-
                         DEBUG(10,("smbd_do_qfilepathinfo: SMB_INFO_QUERY_EAS_FROM_LIST\n"));
 
-                        ea_file_list =
+                        status =
                             get_ea_list_from_file(mem_ctx, conn, fsp,
-                                                  smb_fname->base_name,
-                                                  &total_ea_len);
+                                                  smb_fname,
+                                                  &total_ea_len, &ea_file_list);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
+
                         ea_list = ea_list_union(ea_list, ea_file_list, &total_ea_len);
 
@@ -4505 +4945 @@
                         /* We have data_size bytes to put EA's into. */
                         size_t total_ea_len = 0;
-
                         DEBUG(10,("smbd_do_qfilepathinfo: SMB_INFO_QUERY_ALL_EAS\n"));
 
-                        ea_list = get_ea_list_from_file(mem_ctx, conn, fsp,
-                                                        smb_fname->base_name,
-                                                        &total_ea_len);
+                        status = get_ea_list_from_file(mem_ctx, conn, fsp,
+                                                        smb_fname,
+                                                        &total_ea_len, &ea_list);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
+
                         if (!ea_list || (total_ea_len > data_size)) {
                                 data_size = 4;
@@ -4534 +4977 @@
                         /*TODO: add filtering and index handling */
 
-                        ea_file_list =
-                            get_ea_list_from_file(mem_ctx, conn, fsp,
-                                                  smb_fname->base_name,
-                                                  &total_ea_len);
+                        status  =
+                                get_ea_list_from_file(mem_ctx, conn, fsp,
+                                                  smb_fname,
+                                                  &total_ea_len, &ea_file_list);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         if (!ea_file_list) {
                                 return NT_STATUS_NO_EAS_ON_FILE;
@@ -4597 +5043 @@
                 {
                         unsigned int ea_size =
-                            estimate_ea_size(conn, fsp, smb_fname->base_name);
+                            estimate_ea_size(conn, fsp, smb_fname);
                         DEBUG(10,("smbd_do_qfilepathinfo: SMB_FILE_EA_INFORMATION\n"));
                         data_size = 4;
@@ -4609 +5055 @@
                 case SMB_FILE_ALTERNATE_NAME_INFORMATION:
                 {
-                        int len;
                         char mangled_name[13];
                         DEBUG(10,("smbd_do_qfilepathinfo: SMB_FILE_ALTERNATE_NAME_INFORMATION\n"));
@@ -4616 +5061 @@
                                 return NT_STATUS_NO_MEMORY;
                         }
-                        len = srvstr_push(dstart, flags2,
+                        status = srvstr_push(dstart, flags2,
                                           pdata+4, mangled_name,
                                           PTR_DIFF(dend, pdata+4),
-                                          STR_UNICODE);
+                                          STR_UNICODE, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         data_size = 4 + len;
                         SIVAL(pdata,0,len);
@@ -4628 +5076 @@
                 case SMB_QUERY_FILE_NAME_INFO:
                 {
-                        int len;
                         /*
                           this must be *exactly* right for ACLs on mapped drives to work
                          */
-                        len = srvstr_push(dstart, flags2,
+                        status = srvstr_push(dstart, flags2,
                                           pdata+4, dos_fname,
                                           PTR_DIFF(dend, pdata+4),
-                                          STR_UNICODE);
+                                          STR_UNICODE, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         DEBUG(10,("smbd_do_qfilepathinfo: SMB_QUERY_FILE_NAME_INFO\n"));
                         data_size = 4 + len;
@@ -4659 +5109 @@
                 case SMB_FILE_ALL_INFORMATION:
                 {
-                        int len;
                         unsigned int ea_size =
-                            estimate_ea_size(conn, fsp, smb_fname->base_name);
+                            estimate_ea_size(conn, fsp, smb_fname);
                         DEBUG(10,("smbd_do_qfilepathinfo: SMB_FILE_ALL_INFORMATION\n"));
                         put_long_date_timespec(conn->ts_res,pdata,create_time_ts);
@@ -4679 +5128 @@
                         SIVAL(pdata,0,ea_size);
                         pdata += 4; /* EA info */
-                        len = srvstr_push(dstart, flags2,
+                        status = srvstr_push(dstart, flags2,
                                           pdata+4, dos_fname,
                                           PTR_DIFF(dend, pdata+4),
-                                          STR_UNICODE);
+                                          STR_UNICODE, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         SIVAL(pdata,0,len);
                         pdata += 4 + len;
@@ -4692 +5144 @@
                 case 0xFF12:/*SMB2_FILE_ALL_INFORMATION*/
                 {
-                        int len;
                         unsigned int ea_size =
-                            estimate_ea_size(conn, fsp, smb_fname->base_name);
+                            estimate_ea_size(conn, fsp, smb_fname);
                         DEBUG(10,("smbd_do_qfilepathinfo: SMB2_FILE_ALL_INFORMATION\n"));
                         put_long_date_timespec(conn->ts_res,pdata+0x00,create_time_ts);
@@ -4717 +5168 @@
                         pdata += 0x60;
 
-                        len = srvstr_push(dstart, flags2,
+                        status = srvstr_push(dstart, flags2,
                                           pdata+4, dos_fname,
                                           PTR_DIFF(dend, pdata+4),
-                                          STR_UNICODE);
+                                          STR_UNICODE, &len);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                return status;
+                        }
                         SIVAL(pdata,0,len);
                         pdata += 4 + len;
@@ -4892 +5346 @@
                 case SMB_QUERY_FILE_UNIX_LINK:
                         {
-                                int len;
-                                char *buffer = TALLOC_ARRAY(mem_ctx, char, PATH_MAX+1);
+                                int link_len = 0;
+                                char *buffer = talloc_array(mem_ctx, char, PATH_MAX+1);
 
                                 if (!buffer) {
@@ -4907 +5361 @@
                                 return NT_STATUS_DOS(ERRDOS, ERRbadlink);
 #endif
-                                len = SMB_VFS_READLINK(conn,
+                                link_len = SMB_VFS_READLINK(conn,
                                                        smb_fname->base_name,
                                                        buffer, PATH_MAX);
-                                if (len == -1) {
+                                if (link_len == -1) {
                                         return map_nt_error_from_unix(errno);
                                 }
-                                buffer[len] = 0;
-                                len = srvstr_push(dstart, flags2,
+                                buffer[link_len] = 0;
+                                status = srvstr_push(dstart, flags2,
                                                   pdata, buffer,
                                                   PTR_DIFF(dend, pdata),
-                                                  STR_TERMINATE);
+                                                  STR_TERMINATE, &len);
+                                if (!NT_STATUS_IS_OK(status)) {
+                                        return status;
+                                }
                                 pdata += len;
                                 data_size = PTR_DIFF(pdata,(*ppdata));
@@ -4929 +5386 @@
                                 SMB_ACL_T file_acl = NULL;
                                 SMB_ACL_T def_acl = NULL;
-                                uint16 num_file_acls = 0;
-                                uint16 num_def_acls = 0;
+                                uint16_t num_file_acls = 0;
+                                uint16_t num_def_acls = 0;
+
+                                status = refuse_symlink(conn,
+                                                fsp,
+                                                smb_fname->base_name);
+                                if (!NT_STATUS_IS_OK(status)) {
+                                        return status;
+                                }
 
                                 if (fsp && fsp->fh->fd != -1) {
-                                        file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
+                                        file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp,
+                                                talloc_tos());
                                 } else {
                                         file_acl =
                                             SMB_VFS_SYS_ACL_GET_FILE(conn,
                                                 smb_fname->base_name,
-                                                SMB_ACL_TYPE_ACCESS);
+                                                SMB_ACL_TYPE_ACCESS,
+                                                talloc_tos());
                                 }
 
@@ -4955 +5421 @@
                                                             conn,
                                                             fsp->fsp_name->base_name,
-                                                            SMB_ACL_TYPE_DEFAULT);
+                                                            SMB_ACL_TYPE_DEFAULT,
+                                                            talloc_tos());
                                         } else {
                                                 def_acl =
@@ -4961 +5428 @@
                                                             conn,
                                                             smb_fname->base_name,
-                                                            SMB_ACL_TYPE_DEFAULT);
+                                                            SMB_ACL_TYPE_DEFAULT,
+                                                            talloc_tos());
                                         }
                                         def_acl = free_empty_sys_acl(conn, def_acl);
@@ -4975 +5443 @@
                                                         SMB_POSIX_ACL_HEADER_SIZE) ));
                                         if (file_acl) {
-                                                SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
+                                                TALLOC_FREE(file_acl);
                                         }
                                         if (def_acl) {
-                                                SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
+                                                TALLOC_FREE(def_acl);
                                         }
                                         return NT_STATUS_BUFFER_TOO_SMALL;
@@ -4988 +5456 @@
                                 if (!marshall_posix_acl(conn, pdata + SMB_POSIX_ACL_HEADER_SIZE, psbuf, file_acl)) {
                                         if (file_acl) {
-                                                SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
+                                                TALLOC_FREE(file_acl);
                                         }
                                         if (def_acl) {
-                                                SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
+                                                TALLOC_FREE(def_acl);
                                         }
                                         return NT_STATUS_INTERNAL_ERROR;
@@ -4997 +5465 @@
                                 if (!marshall_posix_acl(conn, pdata + SMB_POSIX_ACL_HEADER_SIZE + (num_file_acls*SMB_POSIX_ACL_ENTRY_SIZE), psbuf, def_acl)) {
                                         if (file_acl) {
-                                                SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
+                                                TALLOC_FREE(file_acl);
                                         }
                                         if (def_acl) {
-                                                SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
+                                                TALLOC_FREE(def_acl);
                                         }
                                         return NT_STATUS_INTERNAL_ERROR;
@@ -5006 +5474 @@
 
                                 if (file_acl) {
-                                        SMB_VFS_SYS_ACL_FREE_ACL(conn, file_acl);
+                                        TALLOC_FREE(file_acl);
                                 }
                                 if (def_acl) {
-                                        SMB_VFS_SYS_ACL_FREE_ACL(conn, def_acl);
+                                        TALLOC_FREE(def_acl);
                                 }
                                 data_size = (num_file_acls + num_def_acls)*SMB_POSIX_ACL_ENTRY_SIZE + SMB_POSIX_ACL_HEADER_SIZE;
@@ -5047 +5515 @@
 
                         smblctx = (uint64_t)IVAL(pdata, POSIX_LOCK_PID_OFFSET);
-#if defined(HAVE_LONGLONG)
-                        offset = (((uint64_t) IVAL(pdata,(POSIX_LOCK_START_OFFSET+4))) << 32) |
-                                        ((uint64_t) IVAL(pdata,POSIX_LOCK_START_OFFSET));
-                        count = (((uint64_t) IVAL(pdata,(POSIX_LOCK_LEN_OFFSET+4))) << 32) |
-                                        ((uint64_t) IVAL(pdata,POSIX_LOCK_LEN_OFFSET));
-#else /* HAVE_LONGLONG */
-                        offset = (uint64_t)IVAL(pdata,POSIX_LOCK_START_OFFSET);
-                        count = (uint64_t)IVAL(pdata,POSIX_LOCK_LEN_OFFSET);
-#endif /* HAVE_LONGLONG */
+                        offset = BVAL(pdata,POSIX_LOCK_START_OFFSET);
+                        count = BVAL(pdata,POSIX_LOCK_LEN_OFFSET);
 
                         status = query_lock(fsp,
@@ -5071 +5532 @@
                                 SSVAL(pdata, POSIX_LOCK_FLAGS_OFFSET, 0);
                                 SIVAL(pdata, POSIX_LOCK_PID_OFFSET, (uint32_t)smblctx);
-#if defined(HAVE_LONGLONG)
-                                SIVAL(pdata, POSIX_LOCK_START_OFFSET, (uint32)(offset & 0xFFFFFFFF));
-                                SIVAL(pdata, POSIX_LOCK_START_OFFSET + 4, (uint32)((offset >> 32) & 0xFFFFFFFF));
-                                SIVAL(pdata, POSIX_LOCK_LEN_OFFSET, (uint32)(count & 0xFFFFFFFF));
-                                SIVAL(pdata, POSIX_LOCK_LEN_OFFSET + 4, (uint32)((count >> 32) & 0xFFFFFFFF));
-#else /* HAVE_LONGLONG */
-                                SIVAL(pdata, POSIX_LOCK_START_OFFSET, offset);
-                                SIVAL(pdata, POSIX_LOCK_LEN_OFFSET, count);
-#endif /* HAVE_LONGLONG */
+                                SBVAL(pdata, POSIX_LOCK_START_OFFSET, offset);
+                                SBVAL(pdata, POSIX_LOCK_LEN_OFFSET, count);
 
                         } else if (NT_STATUS_IS_OK(status)) {
@@ -5115 +5569 @@
         char *params = *pparams;
         char *pdata = *ppdata;
-        uint16 info_level;
+        uint16_t info_level;
         unsigned int data_size = 0;
         unsigned int param_size = 2;
@@ -5165 +5619 @@
                 }
 
-                status = copy_smb_filename(talloc_tos(), fsp->fsp_name,
-                                           &smb_fname);
-                if (!NT_STATUS_IS_OK(status)) {
-                        reply_nterror(req, status);
+                smb_fname = cp_smb_filename(talloc_tos(), fsp->fsp_name);
+                if (smb_fname == NULL) {
+                        reply_nterror(req, NT_STATUS_NO_MEMORY);
                         return;
                 }
@@ -5215 +5668 @@
                          */
                         if (SMB_VFS_FSTAT(fsp, &smb_fname->st) != 0) {
-                                DEBUG(3, ("fstat of fnum %d failed (%s)\n",
-                                          fsp->fnum, strerror(errno)));
+                                DEBUG(3, ("fstat of %s failed (%s)\n",
+                                          fsp_fnum_dbg(fsp), strerror(errno)));
                                 reply_nterror(req,
                                         map_nt_error_from_unix(errno));
@@ -5228 +5681 @@
                 uint32_t name_hash;
                 char *fname = NULL;
-                uint32_t ucf_flags = 0;
+                uint32_t ucf_flags = (req->posix_pathnames ?
+                                UCF_POSIX_PATHNAMES : 0);
 
                 /* qpathinfo */
@@ -5252 +5706 @@
                 }
 
-                srvstr_get_path(req, params, req->flags2, &fname, &params[6],
+                if (req->posix_pathnames) {
+                        srvstr_get_path_posix(req,
+                                params,
+                                req->flags2,
+                                &fname,
+                                &params[6],
                                 total_params - 6,
-                                STR_TERMINATE, &status);
+                                STR_TERMINATE,
+                                &status);
+                } else {
+                        srvstr_get_path(req,
+                                params,
+                                req->flags2,
+                                &fname,
+                                &params[6],
+                                total_params - 6,
+                                STR_TERMINATE,
+                                &status);
+                }
                 if (!NT_STATUS_IS_OK(status)) {
                         reply_nterror(req, status);
@@ -5281 +5751 @@
                 if ((conn->fs_capabilities & FILE_NAMED_STREAMS)
                     && is_ntfs_stream_smb_fname(smb_fname)) {
-                        struct smb_filename *smb_fname_base = NULL;
+                        struct smb_filename *smb_fname_base;
 
                         /* Create an smb_filename with stream_name == NULL. */
-                        status =
-                            create_synthetic_smb_fname(talloc_tos(),
-                                                       smb_fname->base_name,
-                                                       NULL, NULL,
-                                                       &smb_fname_base);
-                        if (!NT_STATUS_IS_OK(status)) {
-                                reply_nterror(req, status);
+                        smb_fname_base = synthetic_smb_fname(
+                                talloc_tos(), smb_fname->base_name,
+                                NULL, NULL);
+                        if (smb_fname_base == NULL) {
+                                reply_nterror(req, NT_STATUS_NO_MEMORY);
                                 return;
                         }
@@ -5380 +5848 @@
         }
 
-        DEBUG(3,("call_trans2qfilepathinfo %s (fnum = %d) level=%d call=%d "
+        DEBUG(3,("call_trans2qfilepathinfo %s (%s) level=%d call=%d "
                  "total_data=%d\n", smb_fname_str_dbg(smb_fname),
-                 fsp ? fsp->fnum : -1, info_level,tran_call,total_data));
+                 fsp_fnum_dbg(fsp),
+                 info_level,tran_call,total_data));
 
         /* Pull out any data sent here before we realloc. */
@@ -5389 +5858 @@
                 {
                         /* Pull any EA list from the data portion. */
-                        uint32 ea_size;
+                        uint32_t ea_size;
 
                         if (total_data < 4) {
@@ -5435 +5904 @@
 
                         /* Copy the lock range data. */
-                        lock_data = (char *)TALLOC_MEMDUP(
+                        lock_data = (char *)talloc_memdup(
                                 req, pdata, total_data);
                         if (!lock_data) {
@@ -5499 +5968 @@
         }
 
-        send_trans2_replies(conn, req, params, param_size, *ppdata, data_size,
+        send_trans2_replies(conn, req, NT_STATUS_OK, params, param_size, *ppdata, data_size,
                             max_data_bytes);
 
@@ -5569 +6038 @@
 /****************************************************************************
  Deal with setting the time from any of the setfilepathinfo functions.
+ NOTE !!!! The check for FILE_WRITE_ATTRIBUTES access must be done *before*
+ calling this function.
 ****************************************************************************/
 
@@ -5578 +6049 @@
 {
         struct smb_filename smb_fname_base;
-        uint32 action =
+        uint32_t action =
                 FILE_NOTIFY_CHANGE_LAST_ACCESS
                 |FILE_NOTIFY_CHANGE_LAST_WRITE
@@ -5585 +6056 @@
         if (!VALID_STAT(smb_fname->st)) {
                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
-        }
-
-        if (fsp && !(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
-                return NT_STATUS_ACCESS_DENIED;
         }
 
@@ -5671 +6138 @@
 /****************************************************************************
  Deal with setting the dosmode from any of the setfilepathinfo functions.
+ NB. The check for FILE_WRITE_ATTRIBUTES access on this path must have been
+ done before calling this function.
 ****************************************************************************/
 
 static NTSTATUS smb_set_file_dosmode(connection_struct *conn,
                                      const struct smb_filename *smb_fname,
-                                     uint32 dosmode)
+                                     uint32_t dosmode)
 {
-        struct smb_filename *smb_fname_base = NULL;
+        struct smb_filename *smb_fname_base;
         NTSTATUS status;
 
@@ -5685 +6154 @@
 
         /* Always operate on the base_name, even if a stream was passed in. */
-        status = create_synthetic_smb_fname(talloc_tos(), smb_fname->base_name,
-                                            NULL, &smb_fname->st,
-                                            &smb_fname_base);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
+        smb_fname_base = synthetic_smb_fname(
+                talloc_tos(), smb_fname->base_name, NULL, &smb_fname->st);
+        if (smb_fname_base == NULL) {
+                return NT_STATUS_NO_MEMORY;
         }
 
@@ -5733 +6201 @@
                                   const struct smb_filename *smb_fname,
                                   const SMB_STRUCT_STAT *psbuf,
-                                  SMB_OFF_T size,
+                                  off_t size,
                                   bool fail_after_createfile)
 {
@@ -5744 +6212 @@
         }
 
-        if (fsp && !(fsp->access_mask & FILE_WRITE_DATA)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
         DEBUG(6,("smb_set_file_size: size: %.0f ", (double)size));
 
@@ -5759 +6223 @@
         if (fsp && fsp->fh->fd != -1) {
                 /* Handle based call. */
+                if (!(fsp->access_mask & FILE_WRITE_DATA)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+
                 if (vfs_set_filelen(fsp, size) == -1) {
                         return map_nt_error_from_unix(errno);
@@ -5766 +6234 @@
         }
 
-        status = copy_smb_filename(talloc_tos(), smb_fname, &smb_fname_tmp);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
+        smb_fname_tmp = cp_smb_filename(talloc_tos(), smb_fname);
+        if (smb_fname_tmp == NULL) {
+                return NT_STATUS_NO_MEMORY;
         }
 
@@ -5784 +6252 @@
                 0,                                      /* create_options */
                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
-                FORCE_OPLOCK_BREAK_TO_NONE,             /* oplock_request */
+                0,                                      /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 0,                                      /* private_flags */
@@ -5790 +6259 @@
                 NULL,                                   /* ea_list */
                 &new_fsp,                               /* result */
-                NULL);                                  /* pinfo */
+                NULL,                                   /* pinfo */
+                NULL, NULL);                            /* create context */
 
         TALLOC_FREE(smb_fname_tmp);
@@ -5855 +6325 @@
         }
 
-        if (fsp && !(fsp->access_mask & FILE_WRITE_EA)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
         status = set_ea(conn, fsp, smb_fname, ea_list);
 
@@ -5900 +6366 @@
         if (!ea_list) {
                 return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (fsp && !(fsp->access_mask & FILE_WRITE_EA)) {
-                return NT_STATUS_ACCESS_DENIED;
         }
 
@@ -5928 +6390 @@
         NTSTATUS status = NT_STATUS_OK;
         bool delete_on_close;
-        uint32 dosmode = 0;
+        uint32_t dosmode = 0;
 
         if (total_data < 1) {
@@ -5957 +6419 @@
         if (!set_delete_on_close(fsp, delete_on_close,
                                  conn->session_info->security_token,
-                                 &conn->session_info->utok)) {
+                                 conn->session_info->unix_token)) {
                 return NT_STATUS_ACCESS_DENIED;
         }
@@ -5984 +6446 @@
 
         position_information = (uint64_t)IVAL(pdata,0);
-#ifdef LARGE_SMB_OFF_T
         position_information |= (((uint64_t)IVAL(pdata,4)) << 32);
-#else /* LARGE_SMB_OFF_T */
-        if (IVAL(pdata,4) != 0) {
-                /* more than 32 bits? */
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-#endif /* LARGE_SMB_OFF_T */
 
         DEBUG(10,("smb_file_position_information: Set file position "
@@ -6008 +6463 @@
                                 int total_data)
 {
-        uint32 mode;
+        uint32_t mode;
 
         if (total_data < 4) {
@@ -6041 +6496 @@
         }
 
-        if (!lp_symlinks(SNUM(conn))) {
+        if (!lp_follow_symlinks(SNUM(conn))) {
                 return NT_STATUS_ACCESS_DENIED;
         }
@@ -6073 +6528 @@
         char *oldname = NULL;
         struct smb_filename *smb_fname_old = NULL;
+        uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
         NTSTATUS status = NT_STATUS_OK;
@@ -6081 +6537 @@
         }
 
-        srvstr_get_path(ctx, pdata, req->flags2, &oldname, pdata,
-                        total_data, STR_TERMINATE, &status);
+        if (req->posix_pathnames) {
+                srvstr_get_path_posix(ctx,
+                        pdata,
+                        req->flags2,
+                        &oldname,
+                        pdata,
+                        total_data,
+                        STR_TERMINATE,
+                        &status);
+        } else {
+                srvstr_get_path(ctx,
+                        pdata,
+                        req->flags2,
+                        &oldname,
+                        pdata,
+                        total_data,
+                        STR_TERMINATE,
+                        &status);
+        }
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -6094 +6567 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 oldname,
-                                0,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname_old);
@@ -6120 +6593 @@
         char *newname = NULL;
         struct smb_filename *smb_fname_dst = NULL;
+        uint32_t ucf_flags = UCF_SAVE_LCOMP |
+                (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         NTSTATUS status = NT_STATUS_OK;
         TALLOC_CTX *ctx = talloc_tos();
@@ -6138 +6613 @@
         }
 
-        srvstr_get_path(ctx, pdata, req->flags2, &newname,
-                                &pdata[20], len, STR_TERMINATE,
+        if (req->posix_pathnames) {
+                srvstr_get_path_posix(ctx,
+                                pdata,
+                                req->flags2,
+                                &newname,
+                                &pdata[20],
+                                len,
+                                STR_TERMINATE,
                                 &status);
+        } else {
+                srvstr_get_path(ctx,
+                                pdata,
+                                req->flags2,
+                                &newname,
+                                &pdata[20],
+                                len,
+                                STR_TERMINATE,
+                                &status);
+        }
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -6152 +6643 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 newname,
-                                UCF_SAVE_LCOMP,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname_dst);
@@ -6166 +6657 @@
 
                 /* Create an smb_fname to call rename_internals_fsp() with. */
-                status = create_synthetic_smb_fname(talloc_tos(),
-                    fsp->base_fsp->fsp_name->base_name, newname, NULL,
-                    &smb_fname_dst);
-                if (!NT_STATUS_IS_OK(status)) {
+                smb_fname_dst = synthetic_smb_fname(
+                        talloc_tos(), fsp->base_fsp->fsp_name->base_name,
+                        newname, NULL);
+                if (smb_fname_dst == NULL) {
+                        status = NT_STATUS_NO_MEMORY;
                         goto out;
                 }
@@ -6187 +6679 @@
 
         DEBUG(10,("smb2_file_rename_information: "
-                  "SMB_FILE_RENAME_INFORMATION (fnum %d) %s -> %s\n",
-                  fsp->fnum, fsp_str_dbg(fsp),
+                  "SMB_FILE_RENAME_INFORMATION (%s) %s -> %s\n",
+                  fsp_fnum_dbg(fsp), fsp_str_dbg(fsp),
                   smb_fname_str_dbg(smb_fname_dst)));
         status = rename_internals_fsp(conn, fsp, smb_fname_dst,
@@ -6211 +6703 @@
         struct smb_filename *smb_fname_dst = NULL;
         NTSTATUS status = NT_STATUS_OK;
+        uint32_t ucf_flags = UCF_SAVE_LCOMP |
+                (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -6228 +6722 @@
         }
 
-        srvstr_get_path(ctx, pdata, req->flags2, &newname,
-                                &pdata[20], len, STR_TERMINATE,
+        if (req->posix_pathnames) {
+                srvstr_get_path_posix(ctx,
+                                pdata,
+                                req->flags2,
+                                &newname,
+                                &pdata[20],
+                                len,
+                                STR_TERMINATE,
                                 &status);
+        } else {
+                srvstr_get_path(ctx,
+                                pdata,
+                                req->flags2,
+                                &newname,
+                                &pdata[20],
+                                len,
+                                STR_TERMINATE,
+                                &status);
+        }
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -6242 +6752 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 newname,
-                                UCF_SAVE_LCOMP,
+                                ucf_flags,
                                 NULL,
                                 &smb_fname_dst);
@@ -6255 +6765 @@
 
         DEBUG(10,("smb_file_link_information: "
-                  "SMB_FILE_LINK_INFORMATION (fnum %d) %s -> %s\n",
-                  fsp->fnum, fsp_str_dbg(fsp),
+                  "SMB_FILE_LINK_INFORMATION (%s) %s -> %s\n",
+                  fsp_fnum_dbg(fsp), fsp_str_dbg(fsp),
                   smb_fname_str_dbg(smb_fname_dst)));
         status = hardlink_internals(ctx,
@@ -6281 +6791 @@
 {
         bool overwrite;
-        uint32 root_fid;
-        uint32 len;
+        uint32_t root_fid;
+        uint32_t len;
         char *newname = NULL;
         struct smb_filename *smb_fname_dst = NULL;
@@ -6302 +6812 @@
         }
 
-        srvstr_get_path_wcard(ctx, pdata, req->flags2, &newname, &pdata[12],
-                              len, 0, &status,
-                              &dest_has_wcard);
+        if (req->posix_pathnames) {
+                srvstr_get_path_wcard_posix(ctx,
+                                pdata,
+                                req->flags2,
+                                &newname,
+                                &pdata[12],
+                                len,
+                                0,
+                                &status,
+                                &dest_has_wcard);
+        } else {
+                srvstr_get_path_wcard(ctx,
+                                pdata,
+                                req->flags2,
+                                &newname,
+                                &pdata[12],
+                                len,
+                                0,
+                                &status,
+                                &dest_has_wcard);
+        }
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -6316 +6844 @@
                                        newname,
                                        true,
+                                       !conn->sconn->using_smb2,
                                        &newname,
                                        &dest_has_wcard);
@@ -6334 +6863 @@
 
                 /* Create an smb_fname to call rename_internals_fsp() with. */
-                status = create_synthetic_smb_fname(talloc_tos(),
-                    fsp->base_fsp->fsp_name->base_name, newname, NULL,
-                    &smb_fname_dst);
-                if (!NT_STATUS_IS_OK(status)) {
+                smb_fname_dst = synthetic_smb_fname(
+                        talloc_tos(), fsp->base_fsp->fsp_name->base_name,
+                        newname, NULL);
+                if (smb_fname_dst == NULL) {
+                        status = NT_STATUS_NO_MEMORY;
                         goto out;
                 }
@@ -6405 +6935 @@
                         }
                         /* Create an smb_fname to call rename_internals_fsp() */
-                        status = create_synthetic_smb_fname(ctx,
-                                                            base_name, NULL,
-                                                            NULL,
-                                                            &smb_fname_dst);
-                        if (!NT_STATUS_IS_OK(status)) {
+                        smb_fname_dst = synthetic_smb_fname(
+                                ctx, base_name, NULL, NULL);
+                        if (smb_fname_dst == NULL) {
+                                status = NT_STATUS_NO_MEMORY;
                                 goto out;
                         }
@@ -6417 +6946 @@
         if (fsp) {
                 DEBUG(10,("smb_file_rename_information: "
-                          "SMB_FILE_RENAME_INFORMATION (fnum %d) %s -> %s\n",
-                          fsp->fnum, fsp_str_dbg(fsp),
+                          "SMB_FILE_RENAME_INFORMATION (%s) %s -> %s\n",
+                          fsp_fnum_dbg(fsp), fsp_str_dbg(fsp),
                           smb_fname_str_dbg(smb_fname_dst)));
                 status = rename_internals_fsp(conn, fsp, smb_fname_dst, 0,
@@ -6448 +6977 @@
                                 const struct smb_filename *smb_fname)
 {
-        uint16 posix_acl_version;
-        uint16 num_file_acls;
-        uint16 num_def_acls;
+        uint16_t posix_acl_version;
+        uint16_t num_file_acls;
+        uint16_t num_def_acls;
         bool valid_file_acls = True;
         bool valid_def_acls = True;
+        NTSTATUS status;
 
         if (total_data < SMB_POSIX_ACL_HEADER_SIZE) {
@@ -6478 +7008 @@
                         (num_file_acls+num_def_acls)*SMB_POSIX_ACL_ENTRY_SIZE) {
                 return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        status = refuse_symlink(conn, fsp, smb_fname->base_name);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
         }
 
@@ -6558 +7093 @@
 
         smblctx = (uint64_t)IVAL(pdata, POSIX_LOCK_PID_OFFSET);
-#if defined(HAVE_LONGLONG)
         offset = (((uint64_t) IVAL(pdata,(POSIX_LOCK_START_OFFSET+4))) << 32) |
                         ((uint64_t) IVAL(pdata,POSIX_LOCK_START_OFFSET));
         count = (((uint64_t) IVAL(pdata,(POSIX_LOCK_LEN_OFFSET+4))) << 32) |
                         ((uint64_t) IVAL(pdata,POSIX_LOCK_LEN_OFFSET));
-#else /* HAVE_LONGLONG */
-        offset = (uint64_t)IVAL(pdata,POSIX_LOCK_START_OFFSET);
-        count = (uint64_t)IVAL(pdata,POSIX_LOCK_LEN_OFFSET);
-#endif /* HAVE_LONGLONG */
 
         DEBUG(10,("smb_set_posix_lock: file %s, lock_type = %u,"
@@ -6595 +7125 @@
                                                         blocking_lock,
                                                         &status,
-                                                        &block_smblctx,
-                                                        NULL);
+                                                        &block_smblctx);
 
                 if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
@@ -6637 +7166 @@
         /* Patch to do this correctly from Paul Eggert <eggert@twinsun.com>. */
         struct smb_file_time ft;
-        uint32 dosmode = 0;
+        uint32_t dosmode = 0;
         NTSTATUS status = NT_STATUS_OK;
 
@@ -6646 +7175 @@
         }
 
-        if (fsp && !(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
-                return NT_STATUS_ACCESS_DENIED;
+        status = check_access(conn, fsp, smb_fname, FILE_WRITE_ATTRIBUTES);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
         }
 
@@ -6686 +7216 @@
                                         const struct smb_filename *smb_fname)
 {
+        NTSTATUS status;
         struct smb_file_time ft;
 
@@ -6692 +7223 @@
         if (total_data < 12) {
                 return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        if (fsp && !(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
-                return NT_STATUS_ACCESS_DENIED;
         }
 
@@ -6707 +7234 @@
         DEBUG(10,("smb_set_info_standard: file %s\n",
                 smb_fname_str_dbg(smb_fname)));
+
+        status = check_access(conn, fsp, smb_fname, FILE_WRITE_ATTRIBUTES);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
 
         return smb_set_file_time(conn,
@@ -6739 +7271 @@
 
         allocation_size = (uint64_t)IVAL(pdata,0);
-#ifdef LARGE_SMB_OFF_T
         allocation_size |= (((uint64_t)IVAL(pdata,4)) << 32);
-#else /* LARGE_SMB_OFF_T */
-        if (IVAL(pdata,4) != 0) {
-                /* more than 32 bits? */
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-#endif /* LARGE_SMB_OFF_T */
-
         DEBUG(10,("smb_set_file_allocation_info: Set file allocation info for "
                   "file %s to %.0f\n", smb_fname_str_dbg(smb_fname),
@@ -6756 +7280 @@
         }
 
-        if (fsp && !(fsp->access_mask & FILE_WRITE_DATA)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
         DEBUG(10,("smb_set_file_allocation_info: file %s : setting new "
                   "allocation size to %.0f\n", smb_fname_str_dbg(smb_fname),
@@ -6766 +7286 @@
         if (fsp && fsp->fh->fd != -1) {
                 /* Open file handle. */
+                if (!(fsp->access_mask & FILE_WRITE_DATA)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+
                 /* Only change if needed. */
                 if (allocation_size != get_file_size_stat(&smb_fname->st)) {
@@ -6793 +7317 @@
                 0,                                      /* create_options */
                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
-                FORCE_OPLOCK_BREAK_TO_NONE,             /* oplock_request */
+                0,                                      /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 0,                                      /* private_flags */
@@ -6799 +7324 @@
                 NULL,                                   /* ea_list */
                 &new_fsp,                               /* result */
-                NULL);                                  /* pinfo */
+                NULL,                                   /* pinfo */
+                NULL, NULL);                            /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -6821 +7347 @@
          */
         trigger_write_time_update_immediate(new_fsp);
-
         close_file(req, new_fsp, NORMAL_CLOSE);
         return NT_STATUS_OK;
@@ -6838 +7363 @@
                                         bool fail_after_createfile)
 {
-        SMB_OFF_T size;
+        off_t size;
 
         if (total_data < 8) {
@@ -6845 +7370 @@
 
         size = IVAL(pdata,0);
-#ifdef LARGE_SMB_OFF_T
-        size |= (((SMB_OFF_T)IVAL(pdata,4)) << 32);
-#else /* LARGE_SMB_OFF_T */
-        if (IVAL(pdata,4) != 0) {
-                /* more than 32 bits? */
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-#endif /* LARGE_SMB_OFF_T */
+        size |= (((off_t)IVAL(pdata,4)) << 32);
         DEBUG(10,("smb_set_file_end_of_file_info: Set end of file info for "
                   "file %s to %.0f\n", smb_fname_str_dbg(smb_fname),
                   (double)size));
-
-        if (fsp && !(fsp->access_mask & FILE_WRITE_DATA)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
 
         return smb_set_file_size(conn, req,
@@ -6878 +7392 @@
                                         const struct smb_filename *smb_fname)
 {
-        uint32 file_type = IVAL(pdata,56);
+        uint32_t file_type = IVAL(pdata,56);
 #if defined(HAVE_MAKEDEV)
-        uint32 dev_major = IVAL(pdata,60);
-        uint32 dev_minor = IVAL(pdata,68);
+        uint32_t dev_major = IVAL(pdata,60);
+        uint32_t dev_minor = IVAL(pdata,68);
 #endif
         SMB_DEV_T dev = (SMB_DEV_T)0;
-        uint32 raw_unixmode = IVAL(pdata,84);
+        uint32_t raw_unixmode = IVAL(pdata,84);
         NTSTATUS status;
         mode_t unixmode;
@@ -6940 +7454 @@
          */
 
-        if (lp_inherit_perms(SNUM(conn))) {
+        if (lp_inherit_permissions(SNUM(conn))) {
                 char *parent;
                 if (!parent_dirname(talloc_tos(), smb_fname->base_name,
@@ -6966 +7480 @@
 {
         struct smb_file_time ft;
-        uint32 raw_unixmode;
+        uint32_t raw_unixmode;
         mode_t unixmode;
-        SMB_OFF_T size = 0;
+        off_t size = 0;
         uid_t set_owner = (uid_t)SMB_UID_NO_CHANGE;
         gid_t set_grp = (uid_t)SMB_GID_NO_CHANGE;
@@ -6989 +7503 @@
            IVAL(pdata, 4) != SMB_SIZE_NO_CHANGE_HI) {
                 size=IVAL(pdata,0); /* first 8 Bytes are size */
-#ifdef LARGE_SMB_OFF_T
-                size |= (((SMB_OFF_T)IVAL(pdata,4)) << 32);
-#else /* LARGE_SMB_OFF_T */
-                if (IVAL(pdata,4) != 0) {
-                        /* more than 32 bits? */
-                        return NT_STATUS_INVALID_PARAMETER;
-                }
-#endif /* LARGE_SMB_OFF_T */
+                size |= (((off_t)IVAL(pdata,4)) << 32);
         }
 
@@ -7044 +7551 @@
                 }
 
-                status = copy_smb_filename(talloc_tos(), smb_fname,
-                                           &smb_fname_tmp);
-                if (!NT_STATUS_IS_OK(status)) {
-                        return status;
+                smb_fname_tmp = cp_smb_filename(talloc_tos(), smb_fname);
+                if (smb_fname_tmp == NULL) {
+                        return NT_STATUS_NO_MEMORY;
                 }
 
@@ -7087 +7593 @@
 
         if (raw_unixmode != SMB_MODE_NO_CHANGE) {
+                int ret;
+
                 DEBUG(10,("smb_set_file_unix_basic: SMB_SET_FILE_UNIX_BASIC "
                           "setting mode 0%o for file %s\n",
                           (unsigned int)unixmode,
                           smb_fname_str_dbg(smb_fname)));
-                if (SMB_VFS_CHMOD(conn, smb_fname->base_name, unixmode) != 0) {
+                if (fsp && fsp->fh->fd != -1) {
+                        ret = SMB_VFS_FCHMOD(fsp, unixmode);
+                } else {
+                        ret = SMB_VFS_CHMOD(conn, smb_fname->base_name, unixmode);
+                }
+                if (ret != 0) {
                         return map_nt_error_from_unix(errno);
                 }
@@ -7109 +7622 @@
                           smb_fname_str_dbg(smb_fname)));
 
-                if (S_ISLNK(sbuf.st_ex_mode)) {
+                if (fsp && fsp->fh->fd != -1) {
+                        ret = SMB_VFS_FCHOWN(fsp, set_owner, (gid_t)-1);
+                } else {
+                        /*
+                         * UNIX extensions calls must always operate
+                         * on symlinks.
+                         */
                         ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name,
                                              set_owner, (gid_t)-1);
-                } else {
-                        ret = SMB_VFS_CHOWN(conn, smb_fname->base_name,
-                                            set_owner, (gid_t)-1);
                 }
 
@@ -7132 +7648 @@
         if ((set_grp != (uid_t)SMB_GID_NO_CHANGE) &&
             (sbuf.st_ex_gid != set_grp)) {
+                int ret;
+
                 DEBUG(10,("smb_set_file_unix_basic: SMB_SET_FILE_UNIX_BASIC "
                           "changing group %u for file %s\n",
                           (unsigned int)set_owner,
                           smb_fname_str_dbg(smb_fname)));
-                if (SMB_VFS_CHOWN(conn, smb_fname->base_name, (uid_t)-1,
-                                  set_grp) != 0) {
+                if (fsp && fsp->fh->fd != -1) {
+                        ret = SMB_VFS_FCHOWN(fsp, set_owner, (gid_t)-1);
+                } else {
+                        /*
+                         * UNIX extensions calls must always operate
+                         * on symlinks.
+                         */
+                        ret = SMB_VFS_LCHOWN(conn, smb_fname->base_name, (uid_t)-1,
+                                  set_grp);
+                }
+                if (ret != 0) {
                         status = map_nt_error_from_unix(errno);
                         if (delete_on_fail) {
@@ -7209 +7736 @@
 {
         NTSTATUS status;
-        uint32 smb_fflags;
-        uint32 smb_fmask;
+        uint32_t smb_fflags;
+        uint32_t smb_fmask;
 
         if (total_data < 116) {
@@ -7271 +7798 @@
 {
         NTSTATUS status = NT_STATUS_OK;
-        uint32 raw_unixmode = 0;
-        uint32 mod_unixmode = 0;
+        uint32_t raw_unixmode = 0;
+        uint32_t mod_unixmode = 0;
         mode_t unixmode = (mode_t)0;
         files_struct *fsp = NULL;
-        uint16 info_level_return = 0;
+        uint16_t info_level_return = 0;
         int info;
         char *pdata = *ppdata;
@@ -7292 +7819 @@
         }
 
-        mod_unixmode = (uint32)unixmode | FILE_FLAG_POSIX_SEMANTICS;
+        mod_unixmode = (uint32_t)unixmode | FILE_FLAG_POSIX_SEMANTICS;
 
         DEBUG(10,("smb_posix_mkdir: file %s, mode 0%o\n",
@@ -7308 +7835 @@
                 mod_unixmode,                           /* file_attributes */
                 0,                                      /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 0,                                      /* private_flags */
@@ -7313 +7841 @@
                 NULL,                                   /* ea_list */
                 &fsp,                                   /* result */
-                &info);                                 /* pinfo */
+                &info,                                  /* pinfo */
+                NULL, NULL);                            /* create context */
 
         if (NT_STATUS_IS_OK(status)) {
@@ -7379 +7908 @@
         bool extended_oplock_granted = False;
         char *pdata = *ppdata;
-        uint32 flags = 0;
-        uint32 wire_open_mode = 0;
-        uint32 raw_unixmode = 0;
-        uint32 mod_unixmode = 0;
-        uint32 create_disp = 0;
-        uint32 access_mask = 0;
-        uint32 create_options = FILE_NON_DIRECTORY_FILE;
+        uint32_t flags = 0;
+        uint32_t wire_open_mode = 0;
+        uint32_t raw_unixmode = 0;
+        uint32_t mod_unixmode = 0;
+        uint32_t create_disp = 0;
+        uint32_t access_mask = 0;
+        uint32_t create_options = FILE_NON_DIRECTORY_FILE;
         NTSTATUS status = NT_STATUS_OK;
         mode_t unixmode = (mode_t)0;
@@ -7391 +7920 @@
         int oplock_request = 0;
         int info = 0;
-        uint16 info_level_return = 0;
+        uint16_t info_level_return = 0;
 
         if (total_data < 18) {
@@ -7502 +8031 @@
         }
 
-        mod_unixmode = (uint32)unixmode | FILE_FLAG_POSIX_SEMANTICS;
+        mod_unixmode = (uint32_t)unixmode | FILE_FLAG_POSIX_SEMANTICS;
 
         if (wire_open_mode & SMB_O_SYNC) {
@@ -7540 +8069 @@
                 mod_unixmode,                           /* file_attributes */
                 oplock_request,                         /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 0,                                      /* private_flags */
@@ -7545 +8075 @@
                 NULL,                                   /* ea_list */
                 &fsp,                                   /* result */
-                &info);                                 /* pinfo */
+                &info,                                  /* pinfo */
+                NULL, NULL);                            /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -7628 +8159 @@
         NTSTATUS status = NT_STATUS_OK;
         files_struct *fsp = NULL;
-        uint16 flags = 0;
+        uint16_t flags = 0;
         char del = 1;
         int info = 0;
@@ -7670 +8201 @@
                 FILE_FLAG_POSIX_SEMANTICS|0777,         /* file_attributes */
                 0,                                      /* oplock_request */
+                NULL,                                   /* lease */
                 0,                                      /* allocation_size */
                 0,                                      /* private_flags */
@@ -7675 +8207 @@
                 NULL,                                   /* ea_list */
                 &fsp,                                   /* result */
-                &info);                                 /* pinfo */
+                &info,                                  /* pinfo */
+                NULL, NULL);                            /* create context */
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -7686 +8219 @@
          */
 
-        lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
-                                  NULL);
+        lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
         if (lck == NULL) {
                 DEBUG(0, ("smb_posix_unlink: Could not get share mode "
@@ -7700 +8232 @@
          * on close disposition.
          */
-        for (i=0; i<lck->num_share_modes; i++) {
-                struct share_mode_entry *e = &lck->share_modes[i];
+        for (i=0; i<lck->data->num_share_modes; i++) {
+                struct share_mode_entry *e = &lck->data->share_modes[i];
                 if (is_valid_share_mode_entry(e)) {
                         if (e->flags & SHARE_MODE_FLAG_POSIX_OPEN) {
+                                continue;
+                        }
+                        if (share_mode_stale_pid(lck->data, i)) {
                                 continue;
                         }
@@ -7758 +8293 @@
         }
 
-        DEBUG(3,("smbd_do_setfilepathinfo: %s (fnum %d) info_level=%d "
+        DEBUG(3,("smbd_do_setfilepathinfo: %s (%s) info_level=%d "
                  "totdata=%d\n", smb_fname_str_dbg(smb_fname),
-                 fsp ? fsp->fnum : -1, info_level, total_data));
+                 fsp_fnum_dbg(fsp),
+                 info_level, total_data));
 
         switch (info_level) {
@@ -8028 +8564 @@
         char *params = *pparams;
         char *pdata = *ppdata;
-        uint16 info_level;
+        uint16_t info_level;
         struct smb_filename *smb_fname = NULL;
         files_struct *fsp = NULL;
@@ -8052 +8588 @@
                 info_level = SVAL(params,2);
 
-                status = copy_smb_filename(talloc_tos(), fsp->fsp_name,
-                                           &smb_fname);
-                if (!NT_STATUS_IS_OK(status)) {
-                        reply_nterror(req, status);
+                smb_fname = cp_smb_filename(talloc_tos(), fsp->fsp_name);
+                if (smb_fname == NULL) {
+                        reply_nterror(req, NT_STATUS_NO_MEMORY);
                         return;
                 }
@@ -8098 +8633 @@
 
                                 SSVAL(params,0,0);
-                                send_trans2_replies(conn, req, params, 2,
+                                send_trans2_replies(conn, req, NT_STATUS_OK, params, 2,
                                                     *ppdata, 0,
                                                     max_data_bytes);
@@ -8113 +8648 @@
                         if (SMB_VFS_FSTAT(fsp, &smb_fname->st) != 0) {
                                 DEBUG(3,("call_trans2setfilepathinfo: fstat "
-                                         "of fnum %d failed (%s)\n", fsp->fnum,
+                                         "of %s failed (%s)\n", fsp_fnum_dbg(fsp),
                                          strerror(errno)));
                                 reply_nterror(req, map_nt_error_from_unix(errno));
@@ -8121 +8656 @@
         } else {
                 char *fname = NULL;
-                uint32_t ucf_flags = 0;
+                uint32_t ucf_flags = (req->posix_pathnames ?
+                        UCF_POSIX_PATHNAMES : 0);
 
                 /* set path info */
@@ -8130 +8666 @@
 
                 info_level = SVAL(params,0);
-                srvstr_get_path(req, params, req->flags2, &fname, &params[6],
-                                total_params - 6, STR_TERMINATE,
+                if (req->posix_pathnames) {
+                        srvstr_get_path_posix(req,
+                                params,
+                                req->flags2,
+                                &fname,
+                                &params[6],
+                                total_params - 6,
+                                STR_TERMINATE,
                                 &status);
+                } else {
+                        srvstr_get_path(req,
+                                params,
+                                req->flags2,
+                                &fname,
+                                &params[6],
+                                total_params - 6,
+                                STR_TERMINATE,
+                                &status);
+                }
                 if (!NT_STATUS_IS_OK(status)) {
                         reply_nterror(req, status);
@@ -8181 +8733 @@
         }
 
-        DEBUG(3,("call_trans2setfilepathinfo(%d) %s (fnum %d) info_level=%d "
+        DEBUG(3,("call_trans2setfilepathinfo(%d) %s (%s) info_level=%d "
                  "totdata=%d\n", tran_call, smb_fname_str_dbg(smb_fname),
-                 fsp ? fsp->fnum : -1, info_level,total_data));
+                 fsp_fnum_dbg(fsp),
+                 info_level,total_data));
 
         /* Realloc the parameter size */
@@ -8202 +8755 @@
                                          &data_return_size);
         if (!NT_STATUS_IS_OK(status)) {
-                if (open_was_deferred(req->mid)) {
+                if (open_was_deferred(req->xconn, req->mid)) {
                         /* We have re-scheduled this call. */
                         return;
@@ -8220 +8773 @@
                 }
 
-                reply_nterror(req, status);
+                /*
+                 * Invalid EA name needs to return 2 param bytes,
+                 * not a zero-length error packet.
+                 */
+                if (NT_STATUS_EQUAL(status, STATUS_INVALID_EA_NAME)) {
+                        send_trans2_replies(conn, req, status, params, 2, NULL, 0,
+                                        max_data_bytes);
+                } else {
+                        reply_nterror(req, status);
+                }
                 return;
         }
 
-        send_trans2_replies(conn, req, params, 2, *ppdata, data_return_size,
+        send_trans2_replies(conn, req, NT_STATUS_OK, params, 2, *ppdata, data_return_size,
                             max_data_bytes);
 
@@ -8245 +8807 @@
         NTSTATUS status = NT_STATUS_OK;
         struct ea_list *ea_list = NULL;
+        uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -8257 +8820 @@
         }
 
-        srvstr_get_path(ctx, params, req->flags2, &directory, &params[4],
-                        total_params - 4, STR_TERMINATE,
+        if (req->posix_pathnames) {
+                srvstr_get_path_posix(ctx,
+                        params,
+                        req->flags2,
+                        &directory,
+                        &params[4],
+                        total_params - 4,
+                        STR_TERMINATE,
                         &status);
+        } else {
+                srvstr_get_path(ctx,
+                        params,
+                        req->flags2,
+                        &directory,
+                        &params[4],
+                        total_params - 4,
+                        STR_TERMINATE,
+                        &status);
+        }
         if (!NT_STATUS_IS_OK(status)) {
                 reply_nterror(req, status);
@@ -8271 +8850 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 directory,
-                                0,
+                                ucf_flags,
                                 NULL,
                                 &smb_dname);
@@ -8349 +8928 @@
         SSVAL(params,0,0);
 
-        send_trans2_replies(conn, req, params, 2, *ppdata, 0, max_data_bytes);
+        send_trans2_replies(conn, req, NT_STATUS_OK, params, 2, *ppdata, 0, max_data_bytes);
 
  out:
@@ -8368 +8947 @@
 {
         char *params = *pparams;
-        uint16 info_level;
+        uint16_t info_level;
 
         if (total_params < 6) {
@@ -8404 +8983 @@
                 fnf_handle = 257;
 
-        send_trans2_replies(conn, req, params, 6, *ppdata, 0, max_data_bytes);
+        send_trans2_replies(conn, req, NT_STATUS_OK, params, 6, *ppdata, 0, max_data_bytes);
 
         return;
@@ -8435 +9014 @@
         SSVAL(params,2,0); /* No EA errors */
 
-        send_trans2_replies(conn, req, params, 4, *ppdata, 0, max_data_bytes);
+        send_trans2_replies(conn, req, NT_STATUS_OK, params, 4, *ppdata, 0, max_data_bytes);
 
         return;
@@ -8483 +9062 @@
         }
 
-        SSVAL(req->inbuf, smb_flg2,
+        SSVAL((discard_const_p(uint8_t, req->inbuf)), smb_flg2,
               SVAL(req->inbuf,smb_flg2) | FLAGS2_DFS_PATHNAMES);
-        send_trans2_replies(conn, req,0,0,*ppdata,reply_size, max_data_bytes);
+        send_trans2_replies(conn, req, NT_STATUS_OK, 0,0,*ppdata,reply_size, max_data_bytes);
 
         return;
@@ -8505 +9084 @@
         char *pdata = *ppdata;
         files_struct *fsp = file_fsp(req, SVAL(req->vwv+15, 0));
+        NTSTATUS status;
+        size_t len = 0;
 
         /* check for an invalid fid before proceeding */
@@ -8526 +9107 @@
 
                 /* Job number */
-                if (fsp->print_file) {
-                        SSVAL(pdata, 0, fsp->print_file->rap_jobid);
-                } else {
-                        SSVAL(pdata, 0, 0);
-                }
-                srvstr_push(pdata, req->flags2, pdata + 2,
-                            global_myname(), 15,
-                            STR_ASCII|STR_TERMINATE); /* Our NetBIOS name */
-                srvstr_push(pdata, req->flags2, pdata+18,
-                            lp_servicename(SNUM(conn)), 13,
-                            STR_ASCII|STR_TERMINATE); /* Service name */
-                send_trans2_replies(conn, req, *pparams, 0, *ppdata, 32,
+                SSVAL(pdata, 0, print_spool_rap_jobid(fsp->print_file));
+
+                status = srvstr_push(pdata, req->flags2, pdata + 2,
+                            lp_netbios_name(), 15,
+                            STR_ASCII|STR_TERMINATE, &len); /* Our NetBIOS name */
+                if (!NT_STATUS_IS_OK(status)) {
+                        reply_nterror(req, status);
+                        return;
+                }
+                status = srvstr_push(pdata, req->flags2, pdata+18,
+                            lp_servicename(talloc_tos(), SNUM(conn)), 13,
+                            STR_ASCII|STR_TERMINATE, &len); /* Service name */
+                if (!NT_STATUS_IS_OK(status)) {
+                        reply_nterror(req, status);
+                        return;
+                }
+                send_trans2_replies(conn, req, NT_STATUS_OK, *pparams, 0, *ppdata, 32,
                                     max_data_bytes);
                 return;
@@ -8614 +9200 @@
         if (get_Protocol() >= PROTOCOL_NT1) {
                 req->flags2 |= 0x40; /* IS_LONG_NAME */
-                SSVAL(req->inbuf,smb_flg2,req->flags2);
-        }
-
-        if (conn->encrypt_level == Required && !req->encrypted) {
+                SSVAL((discard_const_p(uint8_t, req->inbuf)),smb_flg2,req->flags2);
+        }
+
+        if (ENCRYPTION_REQUIRED(conn) && !req->encrypted) {
                 if (state->call != TRANSACT2_QFSINFO &&
-                                state->call != TRANSACT2_SETFSINFO) {
+                    state->call != TRANSACT2_SETFSINFO) {
                         DEBUG(0,("handle_trans2: encryption required "
                                 "with call 0x%x\n",
@@ -8827 +9413 @@
         }
 
-        if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
+        if ((state = talloc(conn, struct trans_state)) == NULL) {
                 DEBUG(0, ("talloc failed\n"));
                 reply_nterror(req, NT_STATUS_NO_MEMORY);
@@ -8973 +9559 @@
         START_PROFILE(SMBtranss2);
 
-        show_msg((char *)req->inbuf);
+        show_msg((const char *)req->inbuf);
 
         /* Windows clients expect all replies to