r7963: Add aio support to 3.0.
[jra/samba/.git] / source3 / smbd / reply.c
index 565046061ccf830d3645cf1e4809eb2b921525db..312a3ace23cc99925dd7831f6d2883e35a7a796e 100644 (file)
 #include "includes.h"
 
 /* look in server.c for some explanation of these variables */
-extern int Protocol;
+extern enum protocol_types Protocol;
 extern int max_send;
 extern int max_recv;
-extern char magic_char;
 extern int global_oplock_break;
 unsigned int smb_echo_count = 0;
+extern uint32 global_client_caps;
 
+extern struct current_user current_user;
 extern BOOL global_encrypted_passwords_negotiated;
 
 /****************************************************************************
- Ensure we check the path in *exactly* the same way as W2K.
+ Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
  We're assuming here that '/' is not the second byte in any multibyte char
  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  set.
 ****************************************************************************/
 
-NTSTATUS check_path_syntax(pstring destname, const pstring srcname, BOOL allow_wcard_names)
+NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
 {
        char *d = destname;
        const char *s = srcname;
@@ -117,21 +118,139 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname, BOOL allow_w
                }
 
                if (!(*s & 0x80)) {
-                       if (allow_wcard_names) {
-                               *d++ = *s++;
-                       } else {
-                               switch (*s) {
-                                       case '*':
-                                       case '?':
-                                       case '<':
-                                       case '>':
-                                       case '"':
-                                               return NT_STATUS_OBJECT_NAME_INVALID;
-                                       default:
-                                               *d++ = *s++;
+                       if (*s <= 0x1f) {
+                               return NT_STATUS_OBJECT_NAME_INVALID;
+                       }
+                       switch (*s) {
+                               case '*':
+                               case '?':
+                               case '<':
+                               case '>':
+                               case '"':
+                                       return NT_STATUS_OBJECT_NAME_INVALID;
+                               default:
+                                       *d++ = *s++;
+                                       break;
+                       }
+               } else {
+                       switch(next_mb_char_size(s)) {
+                               case 4:
+                                       *d++ = *s++;
+                               case 3:
+                                       *d++ = *s++;
+                               case 2:
+                                       *d++ = *s++;
+                               case 1:
+                                       *d++ = *s++;
+                                       break;
+                               default:
+                                       DEBUG(0,("check_path_syntax: character length assumptions invalid !\n"));
+                                       *d = '\0';
+                                       return NT_STATUS_INVALID_PARAMETER;
+                       }
+               }
+               if (start_of_name_component && num_bad_components) {
+                       num_bad_components++;
+               }
+               start_of_name_component = False;
+       }
+
+       if (NT_STATUS_EQUAL(ret, NT_STATUS_OBJECT_NAME_INVALID)) {
+               if (num_bad_components > 1) {
+                       ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+               }
+       }
+
+       *d = '\0';
+       return ret;
+}
+
+/****************************************************************************
+ Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
+ path or anything including wildcards.
+ We're assuming here that '/' is not the second byte in any multibyte char
+ set (a safe assumption). '\\' *may* be the second byte in a multibyte char
+ set.
+****************************************************************************/
+
+NTSTATUS check_path_syntax_wcard(pstring destname, const pstring srcname)
+{
+       char *d = destname;
+       const char *s = srcname;
+       NTSTATUS ret = NT_STATUS_OK;
+       BOOL start_of_name_component = True;
+       unsigned int num_bad_components = 0;
+
+       while (*s) {
+               if (IS_DIRECTORY_SEP(*s)) {
+                       /*
+                        * Safe to assume is not the second part of a mb char as this is handled below.
+                        */
+                       /* Eat multiple '/' or '\\' */
+                       while (IS_DIRECTORY_SEP(*s)) {
+                               s++;
+                       }
+                       if ((d != destname) && (*s != '\0')) {
+                               /* We only care about non-leading or trailing '/' or '\\' */
+                               *d++ = '/';
+                       }
+
+                       start_of_name_component = True;
+                       continue;
+               }
+
+               if (start_of_name_component) {
+                       if ((s[0] == '.') && (s[1] == '.') && (IS_DIRECTORY_SEP(s[2]) || s[2] == '\0')) {
+                               /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
+
+                               /*
+                                * No mb char starts with '.' so we're safe checking the directory separator here.
+                                */
+
+                               /* If  we just added a '/' - delete it */
+                               if ((d > destname) && (*(d-1) == '/')) {
+                                       *(d-1) = '\0';
+                                       d--;
+                               }
+
+                               /* Are we at the start ? Can't go back further if so. */
+                               if (d <= destname) {
+                                       ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
+                                       break;
+                               }
+                               /* Go back one level... */
+                               /* We know this is safe as '/' cannot be part of a mb sequence. */
+                               /* NOTE - if this assumption is invalid we are not in good shape... */
+                               /* Decrement d first as d points to the *next* char to write into. */
+                               for (d--; d > destname; d--) {
+                                       if (*d == '/')
                                                break;
                                }
+                               s += 2; /* Else go past the .. */
+                               /* We're still at the start of a name component, just the previous one. */
+
+                               if (num_bad_components) {
+                                       /* Hmmm. Should we only decrement the bad_components if
+                                          we're removing a bad component ? Need to check this. JRA. */
+                                       num_bad_components--;
+                               }
+
+                               continue;
+
+                       } else if ((s[0] == '.') && ((s[1] == '\0') || IS_DIRECTORY_SEP(s[1]))) {
+                               /* Component of pathname can't be "." only. */
+                               ret =  NT_STATUS_OBJECT_NAME_INVALID;
+                               num_bad_components++;
+                               *d++ = *s++;
+                               continue;
+                       }
+               }
+
+               if (!(*s & 0x80)) {
+                       if (*s <= 0x1f) {
+                               return NT_STATUS_OBJECT_NAME_INVALID;
                        }
+                       *d++ = *s++;
                } else {
                        switch(next_mb_char_size(s)) {
                                case 4:
@@ -144,7 +263,7 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname, BOOL allow_w
                                        *d++ = *s++;
                                        break;
                                default:
-                                       DEBUG(0,("check_path_syntax: character length assumptions invalid !\n"));
+                                       DEBUG(0,("check_path_syntax_wcard: character length assumptions invalid !\n"));
                                        *d = '\0';
                                        return NT_STATUS_INVALID_PARAMETER;
                        }
@@ -158,15 +277,103 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname, BOOL allow_w
        if (NT_STATUS_EQUAL(ret, NT_STATUS_OBJECT_NAME_INVALID)) {
                /* For some strange reason being called from findfirst changes
                   the num_components number to cause the error return to change. JRA. */
-               if (allow_wcard_names) {
-                       if (num_bad_components > 2) {
-                               ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+               if (num_bad_components > 2) {
+                       ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+               }
+       }
+
+       *d = '\0';
+       return ret;
+}
+
+/****************************************************************************
+ Check the path for a POSIX client.
+ We're assuming here that '/' is not the second byte in any multibyte char
+ set (a safe assumption).
+****************************************************************************/
+
+NTSTATUS check_path_syntax_posix(pstring destname, const pstring srcname)
+{
+       char *d = destname;
+       const char *s = srcname;
+       NTSTATUS ret = NT_STATUS_OK;
+       BOOL start_of_name_component = True;
+
+       while (*s) {
+               if (*s == '/') {
+                       /*
+                        * Safe to assume is not the second part of a mb char as this is handled below.
+                        */
+                       /* Eat multiple '/' or '\\' */
+                       while (*s == '/') {
+                               s++;
+                       }
+                       if ((d != destname) && (*s != '\0')) {
+                               /* We only care about non-leading or trailing '/' */
+                               *d++ = '/';
+                       }
+
+                       start_of_name_component = True;
+                       continue;
+               }
+
+               if (start_of_name_component) {
+                       if ((s[0] == '.') && (s[1] == '.') && (s[2] == '/' || s[2] == '\0')) {
+                               /* Uh oh - "/../" or "/..\0" ! */
+
+                               /*
+                                * No mb char starts with '.' so we're safe checking the directory separator here.
+                                */
+
+                               /* If  we just added a '/' - delete it */
+                               if ((d > destname) && (*(d-1) == '/')) {
+                                       *(d-1) = '\0';
+                                       d--;
+                               }
+
+                               /* Are we at the start ? Can't go back further if so. */
+                               if (d <= destname) {
+                                       ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
+                                       break;
+                               }
+                               /* Go back one level... */
+                               /* We know this is safe as '/' cannot be part of a mb sequence. */
+                               /* NOTE - if this assumption is invalid we are not in good shape... */
+                               /* Decrement d first as d points to the *next* char to write into. */
+                               for (d--; d > destname; d--) {
+                                       if (*d == '/')
+                                               break;
+                               }
+                               s += 2; /* Else go past the .. */
+                               continue;
+
+                       } else if ((s[0] == '.') && ((s[1] == '\0') || (s[1] == '/'))) {
+                               /* Eat the '.' */
+                               s++;
+                               continue;
                        }
+               }
+
+               if (!(*s & 0x80)) {
+                       *d++ = *s++;
                } else {
-                       if (num_bad_components > 1) {
-                               ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                       switch(next_mb_char_size(s)) {
+                               case 4:
+                                       *d++ = *s++;
+                               case 3:
+                                       *d++ = *s++;
+                               case 2:
+                                       *d++ = *s++;
+                               case 1:
+                                       *d++ = *s++;
+                                       break;
+                               default:
+                                       DEBUG(0,("check_path_syntax_posix: character length assumptions invalid !\n"));
+                                       *d = '\0';
+                                       return NT_STATUS_INVALID_PARAMETER;
                        }
                }
+               start_of_name_component = False;
        }
 
        *d = '\0';
@@ -191,7 +398,13 @@ size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len
        } else {
                ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
        }
-       *err = check_path_syntax(dest, tmppath, allow_wcard_names);
+       if (lp_posix_pathnames()) {
+               *err = check_path_syntax_posix(dest, tmppath);
+       } else if (allow_wcard_names) {
+               *err = check_path_syntax_wcard(dest, tmppath);
+       } else {
+               *err = check_path_syntax(dest, tmppath);
+       }
        return ret;
 }
 
@@ -258,8 +471,6 @@ int reply_special(char *inbuf,char *outbuf)
                reload_services(True);
                reopen_logs();
 
-               claim_connection(NULL,"",0,True,FLAG_MSG_GENERAL|FLAG_MSG_SMBD|FLAG_MSG_PRINT_GENERAL);
-
                already_got_session = True;
                break;
                
@@ -362,7 +573,6 @@ int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        int passlen = SVAL(inbuf,smb_vwv3);
        pstring path;
        char *p, *q;
-       extern BOOL global_encrypted_passwords_negotiated;
        
        START_PROFILE(SMBtconX);        
 
@@ -702,6 +912,8 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                return ERROR_NT(status);
        }
 
+       RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
+  
        unix_convert(fname,conn,0,&bad_path,&sbuf);
        if (bad_path) {
                END_PROFILE(SMBsetatr);
@@ -718,7 +930,7 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                        mode &= ~aDIR;
 
                if (check_name(fname,conn)) {
-                       ok = (file_set_dosmode(conn,fname,mode,NULL) == 0);
+                       ok = (file_set_dosmode(conn,fname,mode,&sbuf,False) == 0);
                }
        } else {
                ok = True;
@@ -750,7 +962,10 @@ int reply_dskattr(connection_struct *conn, char *inbuf,char *outbuf, int dum_siz
        SMB_BIG_UINT dfree,dsize,bsize;
        START_PROFILE(SMBdskattr);
 
-       SMB_VFS_DISK_FREE(conn,".",True,&bsize,&dfree,&dsize);
+       if (SMB_VFS_DISK_FREE(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
+               END_PROFILE(SMBdskattr);
+               return(UNIXERROR(ERRHRD,ERRgeneral));
+       }
   
        outsize = set_message(outbuf,5,0,True);
        
@@ -799,9 +1014,9 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        pstring directory;
        pstring fname;
        SMB_OFF_T size;
-       int mode;
+       uint32 mode;
        time_t date;
-       int dirtype;
+       uint32 dirtype;
        int outsize = 0;
        unsigned int numentries = 0;
        unsigned int maxentries = 0;
@@ -817,6 +1032,12 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        BOOL can_open = True;
        BOOL bad_path = False;
        NTSTATUS nt_status;
+       BOOL allow_long_path_components = (SVAL(inbuf,smb_flg2) & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
+
+       if (lp_posix_pathnames()) {
+               return reply_unknown(inbuf, outbuf);
+       }
+
        START_PROFILE(SMBsearch);
 
        *mask = *directory = *fname = 0;
@@ -834,6 +1055,9 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                END_PROFILE(SMBsearch);
                return ERROR_NT(nt_status);
        }
+
+       RESOLVE_DFSPATH_WCARD(path, conn, inbuf, outbuf);
+  
        p++;
        status_len = SVAL(p, 0);
        p += 2;
@@ -891,7 +1115,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                ok = True;
      
                if (status_len == 0) {
-                       dptr_num = dptr_create(conn,directory,True,expect_close,SVAL(inbuf,smb_pid));
+                       dptr_num = dptr_create(conn,directory,True,expect_close,SVAL(inbuf,smb_pid), mask, dirtype);
                        if (dptr_num < 0) {
                                if(dptr_num == -2) {
                                        END_PROFILE(SMBsearch);
@@ -900,8 +1124,6 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                END_PROFILE(SMBsearch);
                                return ERROR_DOS(ERRDOS,ERRnofids);
                        }
-                       dptr_set_wcard(dptr_num, strdup(mask));
-                       dptr_set_attr(dptr_num, dirtype);
                } else {
                        dirtype = dptr_attr(dptr_num);
                }
@@ -911,7 +1133,8 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                if (ok) {
                        if ((dirtype&0x1F) == aVOLID) {   
                                memcpy(p,status,21);
-                               make_dir_struct(p,"???????????",volume_label(SNUM(conn)),0,aVOLID,0,conn->case_sensitive);
+                               make_dir_struct(p,"???????????",volume_label(SNUM(conn)),
+                                               0,aVOLID,0,!allow_long_path_components);
                                dptr_fill(p+12,dptr_num);
                                if (dptr_zero(p+12) && (status_len==0))
                                        numentries = 1;
@@ -931,11 +1154,12 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                        finished = !get_dir_entry(conn,mask,dirtype,fname,&size,&mode,&date,check_descend);
                                        if (!finished) {
                                                memcpy(p,status,21);
-                                               make_dir_struct(p,mask,fname,size,mode,date,conn->case_sensitive);
+                                               make_dir_struct(p,mask,fname,size, mode,date,
+                                                               !allow_long_path_components);
                                                dptr_fill(p+12,dptr_num);
                                                numentries++;
+                                               p += DIR_STRUCT_SIZE;
                                        }
-                                       p += DIR_STRUCT_SIZE;
                                }
                        }
                } /* if (ok ) */
@@ -948,33 +1172,36 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                and no entries were found then return error and close dirptr 
                (X/Open spec) */
 
-       if(ok && expect_close && numentries == 0 && status_len == 0) {
-               if (Protocol < PROTOCOL_NT1) {
-                       SCVAL(outbuf,smb_rcls,ERRDOS);
-                       SSVAL(outbuf,smb_err,ERRnofiles);
-               }
-               /* Also close the dptr - we know it's gone */
+       if (numentries == 0 || !ok) {
                dptr_close(&dptr_num);
-       } else if (numentries == 0 || !ok) {
-               if (Protocol < PROTOCOL_NT1) {
-                       SCVAL(outbuf,smb_rcls,ERRDOS);
-                       SSVAL(outbuf,smb_err,ERRnofiles);
-               }
+       } else if(ok && expect_close && status_len == 0) {
+               /* Close the dptr - we know it's gone */
                dptr_close(&dptr_num);
        }
 
        /* If we were called as SMBfunique, then we can close the dirptr now ! */
-       if(dptr_num >= 0 && CVAL(inbuf,smb_com) == SMBfunique)
+       if(dptr_num >= 0 && CVAL(inbuf,smb_com) == SMBfunique) {
                dptr_close(&dptr_num);
+       }
+
+       if ((numentries == 0) && !ms_has_wild(mask)) {
+               return ERROR_BOTH(STATUS_NO_MORE_FILES,ERRDOS,ERRnofiles);
+       }
 
        SSVAL(outbuf,smb_vwv0,numentries);
        SSVAL(outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
        SCVAL(smb_buf(outbuf),0,5);
        SSVAL(smb_buf(outbuf),1,numentries*DIR_STRUCT_SIZE);
 
-       if (Protocol >= PROTOCOL_NT1)
-               SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
-  
+       /* The replies here are never long name. */
+       SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
+       if (!allow_long_path_components) {
+               SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) & (~FLAGS2_LONG_PATH_COMPONENTS));
+       }
+
+       /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
+       SSVAL(outbuf,smb_flg2, (SVAL(outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
+         
        outsize += DIR_STRUCT_SIZE*numentries;
        smb_setlen(outbuf,outsize - 4);
   
@@ -1003,6 +1230,10 @@ int reply_fclose(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        char *p;
        NTSTATUS err;
 
+       if (lp_posix_pathnames()) {
+               return reply_unknown(inbuf, outbuf);
+       }
+
        START_PROFILE(SMBfclose);
 
        outsize = set_message(outbuf,1,0,True);
@@ -1080,7 +1311,6 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                END_PROFILE(SMBopen);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
@@ -1143,6 +1373,9 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        BOOL bad_path = False;
        files_struct *fsp;
        NTSTATUS status;
+       SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv9);
+       ssize_t retval = -1;
+
        START_PROFILE(SMBopenX);
 
        /* If it's an IPC, pass off the pipe handler. */
@@ -1170,7 +1403,17 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
                END_PROFILE(SMBopenX);
                return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
        }
-    
+
+       /* Strange open mode mapping. */
+       if (smb_ofun == 0) {
+               if (GET_OPEN_MODE(smb_mode) == DOS_OPEN_EXEC) {
+                       smb_ofun = FILE_EXISTS_FAIL | FILE_CREATE_IF_NOT_EXIST;
+               } else {
+                       END_PROFILE(SMBopenX);
+                       return ERROR_FORCE_DOS(ERRDOS, ERRbadaccess);
+               }
+       }
+
        fsp = open_file_shared(conn,fname,&sbuf,smb_mode,smb_ofun,(uint32)smb_attr,
                        oplock_request, &rmode,&smb_action);
       
@@ -1178,13 +1421,31 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
                END_PROFILE(SMBopenX);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
 
        size = sbuf.st_size;
+
+       /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
+          if the file is truncated or created. */
+       if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
+               fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
+               if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
+                       close_file(fsp,False);
+                       END_PROFILE(SMBntcreateX);
+                       return ERROR_NT(NT_STATUS_DISK_FULL);
+               }
+               retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
+               if (retval < 0) {
+                       close_file(fsp,False);
+                       END_PROFILE(SMBwrite);
+                       return ERROR_NT(NT_STATUS_DISK_FULL);
+               }
+               size = get_allocation_size(conn,fsp,&sbuf);
+       }
+
        fmode = dos_mode(conn,fname,&sbuf);
        mtime = sbuf.st_mtime;
        if (fmode & aDIR) {
@@ -1312,7 +1573,6 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                END_PROFILE(SMBcreate);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
@@ -1396,7 +1656,6 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                END_PROFILE(SMBctemp);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
@@ -1440,7 +1699,7 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
  Check if a user is allowed to rename a file.
 ********************************************************************/
 
-static NTSTATUS can_rename(char *fname,connection_struct *conn, uint16 dirtype, SMB_STRUCT_STAT *pst)
+static NTSTATUS can_rename(connection_struct *conn, char *fname, uint16 dirtype, SMB_STRUCT_STAT *pst)
 {
        int smb_action;
        int access_mode;
@@ -1458,20 +1717,19 @@ static NTSTATUS can_rename(char *fname,connection_struct *conn, uint16 dirtype,
                return NT_STATUS_OK;
 
        /* We need a better way to return NT status codes from open... */
-       unix_ERR_class = 0;
-       unix_ERR_code = 0;
+       set_saved_error_triple(0, 0, NT_STATUS_OK);
 
        fsp = open_file_shared1(conn, fname, pst, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
                (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
 
        if (!fsp) {
-               NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
-               if (unix_ERR_class == ERRDOS && unix_ERR_code == ERRbadshare)
-                       ret = NT_STATUS_SHARING_VIOLATION;
-               unix_ERR_class = 0;
-               unix_ERR_code = 0;
-               unix_ERR_ntstatus = NT_STATUS_OK;
-               return ret;
+               NTSTATUS ret;
+               if (get_saved_error_triple(NULL, NULL, &ret)) {
+                       set_saved_error_triple(0, 0, NT_STATUS_OK);
+                       return ret;
+               }
+               set_saved_error_triple(0, 0, NT_STATUS_OK);
+               return NT_STATUS_ACCESS_DENIED;
        }
        close_file(fsp,False);
        return NT_STATUS_OK;
@@ -1481,10 +1739,10 @@ static NTSTATUS can_rename(char *fname,connection_struct *conn, uint16 dirtype,
  Check if a user is allowed to delete a file.
 ********************************************************************/
 
-static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype, BOOL bad_path)
+NTSTATUS can_delete(connection_struct *conn, char *fname, uint32 dirtype, BOOL bad_path, BOOL check_is_at_open)
 {
        SMB_STRUCT_STAT sbuf;
-       int fmode;
+       uint32 fmode;
        int smb_action;
        int access_mode;
        files_struct *fsp;
@@ -1522,25 +1780,31 @@ static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype, BOO
        if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM))
                return NT_STATUS_NO_SUCH_FILE;
 
-       /* We need a better way to return NT status codes from open... */
-       unix_ERR_class = 0;
-       unix_ERR_code = 0;
+       if (check_is_at_open) {
+               if (!can_delete_file_in_directory(conn, fname)) {
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+       } else {
+               /* On open checks the open itself will check the share mode, so
+                  don't do it here as we'll get it wrong. */
 
-       fsp = open_file_shared1(conn, fname, &sbuf, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
-               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
+               /* We need a better way to return NT status codes from open... */
+               set_saved_error_triple(0, 0, NT_STATUS_OK);
 
-       if (!fsp) {
-               NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
-               if (!NT_STATUS_IS_OK(unix_ERR_ntstatus))
-                       ret = unix_ERR_ntstatus;
-               else if (unix_ERR_class == ERRDOS && unix_ERR_code == ERRbadshare)
-                       ret = NT_STATUS_SHARING_VIOLATION;
-               unix_ERR_class = 0;
-               unix_ERR_code = 0;
-               unix_ERR_ntstatus = NT_STATUS_OK;
-               return ret;
+               fsp = open_file_shared1(conn, fname, &sbuf, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
+                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
+
+               if (!fsp) {
+                       NTSTATUS ret;
+                       if (get_saved_error_triple(NULL, NULL, &ret)) {
+                               set_saved_error_triple(0, 0, NT_STATUS_OK);
+                               return ret;
+                       }
+                       set_saved_error_triple(0, 0, NT_STATUS_OK);
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+               close_file(fsp,False);
        }
-       close_file(fsp,False);
        return NT_STATUS_OK;
 }
 
@@ -1549,7 +1813,7 @@ static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype, BOO
  code.
 ****************************************************************************/
 
-NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
+NTSTATUS unlink_internals(connection_struct *conn, uint32 dirtype, char *name)
 {
        pstring directory;
        pstring mask;
@@ -1594,13 +1858,13 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
        
-       if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask, sizeof(pstring)-1 );
+       if (!rc && mangle_is_mangled(mask,SNUM(conn)))
+               mangle_check_cache( mask, sizeof(pstring)-1, SNUM(conn));
        
        if (!has_wild) {
                pstrcat(directory,"/");
                pstrcat(directory,mask);
-               error = can_delete(directory,conn,dirtype,bad_path);
+               error = can_delete(conn,directory,dirtype,bad_path,False);
                if (!NT_STATUS_IS_OK(error))
                        return error;
 
@@ -1608,28 +1872,34 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                        count++;
                }
        } else {
-               void *dirptr = NULL;
+               struct smb_Dir *dir_hnd = NULL;
                const char *dname;
                
+               if (strequal(mask,"????????.???"))
+                       pstrcpy(mask,"*");
+
                if (check_name(directory,conn))
-                       dirptr = OpenDir(conn, directory, True);
+                       dir_hnd = OpenDir(conn, directory, mask, dirtype);
                
                /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
                   the pattern matches against the long name, otherwise the short name 
                   We don't implement this yet XXXX
                */
                
-               if (dirptr) {
+               if (dir_hnd) {
+                       long offset = 0;
                        error = NT_STATUS_NO_SUCH_FILE;
-                       
-                       if (strequal(mask,"????????.???"))
-                               pstrcpy(mask,"*");
 
-                       while ((dname = ReadDirName(dirptr))) {
+                       while ((dname = ReadDirName(dir_hnd, &offset))) {
+                               SMB_STRUCT_STAT st;
                                pstring fname;
                                BOOL sys_direntry = False;
                                pstrcpy(fname,dname);
 
+                               if (!is_visible_file(conn, directory, dname, &st, True)) {
+                                       continue;
+                               }
+
                                /* Quick check for "." and ".." */
                                if (fname[0] == '.') {
                                        if (!fname[1] || (fname[1] == '.' && !fname[2])) {
@@ -1652,7 +1922,7 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                                }
 
                                slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
-                               error = can_delete(fname,conn,dirtype,bad_path);
+                               error = can_delete(conn,fname,dirtype,bad_path,False);
                                if (!NT_STATUS_IS_OK(error)) {
                                        continue;
                                }
@@ -1660,7 +1930,7 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                                        count++;
                                DEBUG(3,("unlink_internals: succesful unlink [%s]\n",fname));
                        }
-                       CloseDir(dirptr);
+                       CloseDir(dir_hnd);
                }
        }
        
@@ -1680,7 +1950,7 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 {
        int outsize = 0;
        pstring name;
-       int dirtype;
+       uint32 dirtype;
        NTSTATUS status;
        START_PROFILE(SMBunlink);
        
@@ -1692,7 +1962,7 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                return ERROR_NT(status);
        }
        
-       RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(name, conn, inbuf, outbuf);
        
        DEBUG(3,("reply_unlink : %s\n",name));
        
@@ -1700,7 +1970,6 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        if (!NT_STATUS_IS_OK(status)) {
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
                return ERROR_NT(status);
@@ -1722,7 +1991,7 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
  Fail for readbraw.
 ****************************************************************************/
 
-void fail_readraw(void)
+static void fail_readraw(void)
 {
        pstring errstr;
        slprintf(errstr, sizeof(errstr)-1, "FAIL ! reply_readbraw: socket write fail (%s)",
@@ -1730,12 +1999,46 @@ void fail_readraw(void)
        exit_server(errstr);
 }
 
+#if defined(WITH_SENDFILE)
+/****************************************************************************
+ Fake (read/write) sendfile. Returns -1 on read or write fail.
+****************************************************************************/
+
+static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread, char *buf, int bufsize)
+{
+       ssize_t ret=0;
+
+       /* Paranioa check... */
+       if (nread > bufsize) {
+               fail_readraw();
+       }
+
+       if (nread > 0) {
+               ret = read_file(fsp,buf,startpos,nread);
+               if (ret == -1) {
+                       return -1;
+               }
+       }
+
+       /* If we had a short read, fill with zeros. */
+       if (ret < nread) {
+               memset(buf, '\0', nread - ret);
+       }
+
+       if (write_data(smbd_server_fd(),buf,nread) != nread) {
+               return -1;
+       }       
+
+       return (ssize_t)nread;
+}
+#endif
+
 /****************************************************************************
  Use sendfile in readbraw.
 ****************************************************************************/
 
 void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T startpos, size_t nread,
-               ssize_t mincount, char *outbuf)
+               ssize_t mincount, char *outbuf, int out_buffsize)
 {
        ssize_t ret=0;
 
@@ -1756,13 +2059,27 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
                header.free = NULL;
 
                if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, nread) == -1) {
+                       /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
+                       if (errno == ENOSYS) {
+                               goto normal_readbraw;
+                       }
+
                        /*
-                        * Special hack for broken Linux with no 64 bit clean sendfile. If we
-                        * return ENOSYS then pretend we just got a normal read.
+                        * Special hack for broken Linux with no working sendfile. If we
+                        * return EINTR we sent the header but not the rest of the data.
+                        * Fake this up by doing read/write calls.
                         */
-                       if (errno == ENOSYS) {
+                       if (errno == EINTR) {
+                               /* Ensure we don't do this again. */
                                set_use_sendfile(SNUM(conn), False);
-                               goto normal_read;
+                               DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
+
+                               if (fake_sendfile(fsp, startpos, nread, outbuf + 4, out_buffsize - 4) == -1) {
+                                       DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
+                                               fsp->fsp_name, strerror(errno) ));
+                                       exit_server("send_file_readbraw fake_sendfile failed");
+                               }
+                               return;
                        }
 
                        DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
@@ -1772,7 +2089,8 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
 
        }
 
-  normal_read:
+  normal_readbraw:
+
 #endif
 
        if (nread > 0) {
@@ -1795,9 +2113,8 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
  Reply to a readbraw (core+ protocol).
 ****************************************************************************/
 
-int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int dum_buffsize)
+int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int out_buffsize)
 {
-       extern struct current_user current_user;
        ssize_t maxcount,mincount;
        size_t nread = 0;
        SMB_OFF_T startpos;
@@ -1884,22 +2201,19 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
        /* ensure we don't overrun the packet size */
        maxcount = MIN(65535,maxcount);
 
-       if (!is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
-               SMB_OFF_T size = fsp->size;
-               SMB_OFF_T sizeneeded = startpos + maxcount;
+       if (!is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
+               SMB_STRUCT_STAT st;
+               SMB_OFF_T size = 0;
   
-               if (size < sizeneeded) {
-                       SMB_STRUCT_STAT st;
-                       if (SMB_VFS_FSTAT(fsp,fsp->fd,&st) == 0)
-                               size = st.st_size;
-                       if (!fsp->can_write) 
-                               fsp->size = size;
+               if (SMB_VFS_FSTAT(fsp,fsp->fd,&st) == 0) {
+                       size = st.st_size;
                }
 
-               if (startpos >= size)
+               if (startpos >= size) {
                        nread = 0;
-               else
+               } else {
                        nread = MIN(maxcount,(size - startpos));          
+               }
        }
 
 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
@@ -1910,13 +2224,16 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
        DEBUG( 3, ( "readbraw fnum=%d start=%.0f max=%d min=%d nread=%d\n", fsp->fnum, (double)startpos,
                                (int)maxcount, (int)mincount, (int)nread ) );
   
-       send_file_readbraw(conn, fsp, startpos, nread, mincount, outbuf);
+       send_file_readbraw(conn, fsp, startpos, nread, mincount, outbuf, out_buffsize);
 
        DEBUG(5,("readbraw finished\n"));
        END_PROFILE(SMBreadbraw);
        return -1;
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Reply to a lockread (core+ protocol).
 ****************************************************************************/
@@ -2010,6 +2327,9 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a read.
 ****************************************************************************/
@@ -2044,7 +2364,7 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 
        data = smb_buf(outbuf) + 3;
   
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBread);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2074,9 +2394,10 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
  Reply to a read and X - possibly using sendfile.
 ****************************************************************************/
 
-int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length, 
+int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length, int len_outbuf,
                files_struct *fsp, SMB_OFF_T startpos, size_t smb_maxcnt)
 {
+       int outsize = 0;
        ssize_t nread = -1;
        char *data = smb_buf(outbuf);
 
@@ -2113,6 +2434,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
                SSVAL(outbuf,smb_vwv5,smb_maxcnt);
                SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
+               SSVAL(outbuf,smb_vwv7,((smb_maxcnt >> 16) & 1));
                SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
                SCVAL(outbuf,smb_vwv0,0xFF);
                set_message(outbuf,12,smb_maxcnt,False);
@@ -2120,14 +2442,33 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                header.length = data - outbuf;
                header.free = NULL;
 
-               if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, smb_maxcnt) == -1) {
+               if ((nread = SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, smb_maxcnt)) == -1) {
+                       /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
+                       if (errno == ENOSYS) {
+                               goto normal_read;
+                       }
+
                        /*
-                        * Special hack for broken Linux with no 64 bit clean sendfile. If we
-                        * return ENOSYS then pretend we just got a normal read.
+                        * Special hack for broken Linux with no working sendfile. If we
+                        * return EINTR we sent the header but not the rest of the data.
+                        * Fake this up by doing read/write calls.
                         */
-                       if (errno == ENOSYS) {
+
+                       if (errno == EINTR) {
+                               /* Ensure we don't do this again. */
                                set_use_sendfile(SNUM(conn), False);
-                               goto normal_read;
+                               DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
+
+                               if ((nread = fake_sendfile(fsp, startpos, smb_maxcnt, data,
+                                                       len_outbuf - (data-outbuf))) == -1) {
+                                       DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
+                                               fsp->fsp_name, strerror(errno) ));
+                                       exit_server("send_file_readX: fake_sendfile failed");
+                               }
+                               DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
+                                       fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+                               /* Returning -1 here means successful sendfile. */
+                               return -1;
                        }
 
                        DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
@@ -2137,6 +2478,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
 
                DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
                        fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+               /* Returning -1 here means successful sendfile. */
                return -1;
        }
 
@@ -2151,15 +2493,18 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                return(UNIXERROR(ERRDOS,ERRnoaccess));
        }
 
+       outsize = set_message(outbuf,12,nread,False);
        SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
        SSVAL(outbuf,smb_vwv5,nread);
        SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
+       SSVAL(outbuf,smb_vwv7,((nread >> 16) & 1));
        SSVAL(smb_buf(outbuf),-2,nread);
   
        DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
                fsp->fnum, (int)smb_maxcnt, (int)nread ) );
 
-       return nread;
+       /* Returning the number of bytes we want to send back - including header. */
+       return outsize;
 }
 
 /****************************************************************************
@@ -2189,6 +2534,18 @@ int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
 
        set_message(outbuf,12,0,True);
 
+       if (global_client_caps & CAP_LARGE_READX) {
+               if (SVAL(inbuf,smb_vwv7) == 1) {
+                       smb_maxcnt |= (1<<16);
+               }
+               if (smb_maxcnt > BUFFER_SIZE) {
+                       DEBUG(0,("reply_read_and_X - read too large (%u) for reply buffer %u\n",
+                               (unsigned int)smb_maxcnt, (unsigned int)BUFFER_SIZE));
+                       END_PROFILE(SMBreadX);
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+       }
+
        if(CVAL(inbuf,smb_wct) == 12) {
 #ifdef LARGE_SMB_OFF_T
                /*
@@ -2213,12 +2570,17 @@ int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
 
        }
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBreadX);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
 
-       nread = send_file_readX(conn, inbuf, outbuf, length, fsp, startpos, smb_maxcnt);
+       if (schedule_aio_read_and_X(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt)) {
+               END_PROFILE(SMBreadX);
+               return -1;
+       }
+
+       nread = send_file_readX(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt);
        if (nread != -1)
                nread = chain_reply(inbuf,outbuf,length,bufsize);
 
@@ -2269,7 +2631,7 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        SCVAL(inbuf,smb_com,SMBwritec);
        SCVAL(outbuf,smb_com,SMBwritec);
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwritebraw);
                return(ERROR_DOS(ERRDOS,ERRlock));
        }
@@ -2291,6 +2653,7 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        SCVAL(outbuf,smb_com,SMBwritebraw);
        SSVALS(outbuf,smb_vwv0,-1);
        outsize = set_message(outbuf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
+       show_msg(outbuf);
        if (!send_smb(smbd_server_fd(),outbuf))
                exit_server("reply_writebraw: send_smb failed.");
   
@@ -2361,6 +2724,9 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Reply to a writeunlock (core+).
 ****************************************************************************/
@@ -2384,8 +2750,7 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
        data = smb_buf(inbuf) + 3;
   
-       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, 
-                     WRITE_LOCK,False)) {
+       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteunlock);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2426,6 +2791,9 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        return outsize;
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a write.
 ****************************************************************************/
@@ -2453,7 +2821,7 @@ int reply_write(connection_struct *conn, char *inbuf,char *outbuf,int size,int d
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
        data = smb_buf(inbuf) + 3;
   
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwrite);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2530,9 +2898,12 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng
        CHECK_FSP(fsp,conn);
        CHECK_WRITE(fsp);
 
+       set_message(outbuf,6,0,True);
+  
        /* Deal with possible LARGE_WRITEX */
-       if (large_writeX)
+       if (large_writeX) {
                numtowrite |= ((((size_t)SVAL(inbuf,smb_vwv9)) & 1 )<<16);
+       }
 
        if(smb_doff > smblen || (smb_doff + numtowrite > smblen)) {
                END_PROFILE(SMBwriteX);
@@ -2564,7 +2935,7 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng
 #endif /* LARGE_SMB_OFF_T */
        }
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteX);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2574,18 +2945,24 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng
        done, just a write of zero. To truncate a file,
        use SMBwrite. */
 
-       if(numtowrite == 0)
+       if(numtowrite == 0) {
                nwritten = 0;
-       else
+       } else {
+
+               if (schedule_aio_write_and_X(conn, inbuf, outbuf, length, bufsize,
+                                       fsp,data,startpos,numtowrite)) {
+                       END_PROFILE(SMBwriteX);
+                       return -1;
+               }
+
                nwritten = write_file(fsp,data,startpos,numtowrite);
+       }
   
        if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
                END_PROFILE(SMBwriteX);
                return(UNIXERROR(ERRHRD,ERRdiskfull));
        }
 
-       set_message(outbuf,6,0,True);
-  
        SSVAL(outbuf,smb_vwv2,nwritten);
        if (large_writeX)
                SSVAL(outbuf,smb_vwv4,(nwritten>>16)&1);
@@ -2731,7 +3108,6 @@ int reply_exit(connection_struct *conn,
 int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
                 int dum_buffsize)
 {
-       extern struct current_user current_user;
        int outsize = 0;
        time_t mtime;
        int32 eclass = 0, err = 0;
@@ -2777,6 +3153,13 @@ int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
                         fsp->fd, fsp->fnum,
                         conn->num_files_open));
  
+               /*
+                * Take care of any time sent in the close.
+                */
+
+               mtime = make_unix_date3(inbuf+smb_vwv1);
+               fsp_set_pending_modtime(fsp, mtime);
+
                /*
                 * close_file() returns the unix errno if an error
                 * was detected on close - normally this is due to
@@ -2788,16 +3171,6 @@ int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
                        END_PROFILE(SMBclose);
                        return (UNIXERROR(ERRHRD,ERRgeneral));
                }
-
-               /*
-                * Now take care of any time sent in the close.
-                */
-
-               mtime = make_unix_date3(inbuf+smb_vwv1);
-               
-               /* try and set the date */
-               set_filetime(conn, file_name, mtime);
-
        }  
 
        /* We have a cached error */
@@ -2835,7 +3208,7 @@ int reply_writeclose(connection_struct *conn,
        mtime = make_unix_date3(inbuf+smb_vwv4);
        data = smb_buf(inbuf) + 1;
   
-       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteclose);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2877,6 +3250,9 @@ int reply_writeclose(connection_struct *conn,
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Reply to a lock.
 ****************************************************************************/
@@ -2957,6 +3333,9 @@ int reply_unlock(connection_struct *conn, char *inbuf,char *outbuf, int size,
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a tdis.
 ****************************************************************************/
@@ -3017,6 +3396,7 @@ int reply_echo(connection_struct *conn,
 
                smb_setlen(outbuf,outsize - 4);
 
+               show_msg(outbuf);
                if (!send_smb(smbd_server_fd(),outbuf))
                        exit_server("reply_echo: send_smb failed.");
        }
@@ -3208,29 +3588,32 @@ int reply_printwrite(connection_struct *conn, char *inbuf,char *outbuf, int dum_
  code. 
 ****************************************************************************/
 
-NTSTATUS mkdir_internal(connection_struct *conn, pstring directory)
+NTSTATUS mkdir_internal(connection_struct *conn, const pstring directory, BOOL bad_path)
 {
-       BOOL bad_path = False;
-       SMB_STRUCT_STAT sbuf;
        int ret= -1;
        
-       unix_convert(directory,conn,0,&bad_path,&sbuf);
-
-       if( strchr_m(directory, ':')) {
-               return NT_STATUS_NOT_A_DIRECTORY;
-       }
-
-       if (ms_has_wild(directory)) {
-               return NT_STATUS_OBJECT_NAME_INVALID;
+       if(!CAN_WRITE(conn)) {
+               DEBUG(5,("mkdir_internal: failing create on read-only share %s\n", lp_servicename(SNUM(conn))));
+               errno = EACCES;
+               return map_nt_error_from_unix(errno);
        }
 
        if (bad_path) {
                return NT_STATUS_OBJECT_PATH_NOT_FOUND;
        }
 
-       if (check_name(directory, conn))
-               ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory));
-       
+       if (!check_name(directory, conn)) {
+               if(errno == ENOENT) {
+                       if (bad_path) {
+                               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                       } else {
+                               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+                       }
+               }
+               return map_nt_error_from_unix(errno);
+       }
+
+       ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory,True));
        if (ret == -1) {
                if(errno == ENOENT) {
                        return NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -3250,6 +3633,9 @@ int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        pstring directory;
        int outsize;
        NTSTATUS status;
+       BOOL bad_path = False;
+       SMB_STRUCT_STAT sbuf;
+
        START_PROFILE(SMBmkdir);
  
        srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status, False);
@@ -3260,12 +3646,38 @@ int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
        RESOLVE_DFSPATH(directory, conn, inbuf, outbuf);
 
-       status = mkdir_internal(conn, directory);
+       unix_convert(directory,conn,0,&bad_path,&sbuf);
+
+       if( is_ntfs_stream_name(directory)) {
+               DEBUG(5,("reply_mkdir: failing create on filename %s with colon in name\n", directory));
+               END_PROFILE(SMBmkdir);
+               return ERROR_FORCE_DOS(ERRDOS, ERRinvalidname);
+       }
+
+       status = mkdir_internal(conn, directory,bad_path);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmkdir);
                return ERROR_NT(status);
        }
 
+       if (lp_inherit_owner(SNUM(conn))) {
+               /* Ensure we're checking for a symlink here.... */
+               /* We don't want to get caught by a symlink racer. */
+
+               if(SMB_VFS_LSTAT(conn,directory, &sbuf) != 0) {
+                       END_PROFILE(SMBmkdir);
+                       return(UNIXERROR(ERRDOS,ERRnoaccess));
+               }
+                                                                                                                                                   
+               if(!S_ISDIR(sbuf.st_mode)) {
+                       DEBUG(0,("reply_mkdir: %s is not a directory !\n", directory ));
+                       END_PROFILE(SMBmkdir);
+                       return(UNIXERROR(ERRDOS,ERRnoaccess));
+               }
+
+               change_owner_to_parent(conn, NULL, directory, &sbuf);
+       }
+
        outsize = set_message(outbuf,0,0,True);
 
        DEBUG( 3, ( "mkdir %s ret=%d\n", directory, outsize ) );
@@ -3283,18 +3695,22 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory)
 {
        const char *dname = NULL;
        BOOL ret = False;
-       void *dirptr = OpenDir(conn, directory, False);
+       long offset = 0;
+       struct smb_Dir *dir_hnd = OpenDir(conn, directory, NULL, 0);
 
-       if(dirptr == NULL)
+       if(dir_hnd == NULL)
                return True;
 
-       while((dname = ReadDirName(dirptr))) {
+       while((dname = ReadDirName(dir_hnd, &offset))) {
                pstring fullname;
                SMB_STRUCT_STAT st;
 
                if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
                        continue;
 
+               if (!is_visible_file(conn, directory, dname, &st, False))
+                       continue;
+
                /* Construct the full name. */
                if(strlen(directory) + strlen(dname) + 1 >= sizeof(fullname)) {
                        errno = ENOMEM;
@@ -3325,7 +3741,7 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory)
                        break;
                }
        }
-       CloseDir(dirptr);
+       CloseDir(dir_hnd);
        return ret;
 }
 
@@ -3336,6 +3752,7 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory)
 BOOL rmdir_internals(connection_struct *conn, char *directory)
 {
        BOOL ok;
+       SMB_STRUCT_STAT st;
 
        ok = (SMB_VFS_RMDIR(conn,directory) == 0);
        if(!ok && ((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
@@ -3347,13 +3764,15 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
                 */
                BOOL all_veto_files = True;
                const char *dname;
-               void *dirptr = OpenDir(conn, directory, False);
+               struct smb_Dir *dir_hnd = OpenDir(conn, directory, NULL, 0);
 
-               if(dirptr != NULL) {
-                       int dirpos = TellDir(dirptr);
-                       while ((dname = ReadDirName(dirptr))) {
+               if(dir_hnd != NULL) {
+                       long dirpos = 0;
+                       while ((dname = ReadDirName(dir_hnd,&dirpos))) {
                                if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
                                        continue;
+                               if (!is_visible_file(conn, directory, dname, &st, False))
+                                       continue;
                                if(!IS_VETO_PATH(conn, dname)) {
                                        all_veto_files = False;
                                        break;
@@ -3361,13 +3780,14 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
                        }
 
                        if(all_veto_files) {
-                               SeekDir(dirptr,dirpos);
-                               while ((dname = ReadDirName(dirptr))) {
+                               RewindDir(dir_hnd,&dirpos);
+                               while ((dname = ReadDirName(dir_hnd,&dirpos))) {
                                        pstring fullname;
-                                       SMB_STRUCT_STAT st;
 
                                        if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
                                                continue;
+                                       if (!is_visible_file(conn, directory, dname, &st, False))
+                                               continue;
 
                                        /* Construct the full name. */
                                        if(strlen(directory) + strlen(dname) + 1 >= sizeof(fullname)) {
@@ -3391,11 +3811,11 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
                                        } else if(SMB_VFS_UNLINK(conn,fullname) != 0)
                                                break;
                                }
-                               CloseDir(dirptr);
+                               CloseDir(dir_hnd);
                                /* Retry the rmdir */
                                ok = (SMB_VFS_RMDIR(conn,directory) == 0);
                        } else {
-                               CloseDir(dirptr);
+                               CloseDir(dir_hnd);
                        }
                } else {
                        errno = ENOTEMPTY;
@@ -3566,7 +3986,7 @@ static void rename_open_files(connection_struct *conn, SMB_DEV_T dev, SMB_INO_T
  Rename an open file - given an fsp.
 ****************************************************************************/
 
-NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, uint16 attrs, BOOL replace_if_exists)
+NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, uint32 attrs, BOOL replace_if_exists)
 {
        SMB_STRUCT_STAT sbuf;
        BOOL bad_path = False;
@@ -3647,7 +4067,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
                return NT_STATUS_OBJECT_NAME_COLLISION;
        }
 
-       error = can_rename(newname,conn,attrs,&sbuf);
+       error = can_rename(conn,newname,attrs,&sbuf);
 
        if (dest_exists && !NT_STATUS_IS_OK(error)) {
                DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
@@ -3680,7 +4100,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
  code. 
 ****************************************************************************/
 
-NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, uint16 attrs, BOOL replace_if_exists)
+NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, uint32 attrs, BOOL replace_if_exists)
 {
        pstring directory;
        pstring mask;
@@ -3753,8 +4173,8 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, ui
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
 
-       if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask, sizeof(pstring)-1 );
+       if (!rc && mangle_is_mangled(mask,SNUM(conn)))
+               mangle_check_cache( mask, sizeof(pstring)-1, SNUM(conn));
 
        has_wild = ms_has_wild(mask);
 
@@ -3762,7 +4182,7 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, ui
                /*
                 * No wildcards - just process the one file.
                 */
-               BOOL is_short_name = mangle_is_8_3(name, True);
+               BOOL is_short_name = mangle_is_8_3(name, True, SNUM(conn));
 
                /* Add a terminating '/' to the directory name. */
                pstrcat(directory,"/");
@@ -3853,7 +4273,7 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                        return NT_STATUS_OBJECT_PATH_NOT_FOUND;
                }
 
-               error = can_rename(directory,conn,attrs,&sbuf1);
+               error = can_rename(conn,directory,attrs,&sbuf1);
 
                if (!NT_STATUS_IS_OK(error)) {
                        DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
@@ -3898,21 +4318,22 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                /*
                 * Wildcards - process each file that matches.
                 */
-               void *dirptr = NULL;
+               struct smb_Dir *dir_hnd = NULL;
                const char *dname;
                pstring destname;
                
+               if (strequal(mask,"????????.???"))
+                       pstrcpy(mask,"*");
+                       
                if (check_name(directory,conn))
-                       dirptr = OpenDir(conn, directory, True);
+                       dir_hnd = OpenDir(conn, directory, mask, attrs);
                
-               if (dirptr) {
+               if (dir_hnd) {
+                       long offset = 0;
                        error = NT_STATUS_NO_SUCH_FILE;
 /*                     Was error = NT_STATUS_OBJECT_NAME_NOT_FOUND; - gentest fix. JRA */
                        
-                       if (strequal(mask,"????????.???"))
-                               pstrcpy(mask,"*");
-                       
-                       while ((dname = ReadDirName(dirptr))) {
+                       while ((dname = ReadDirName(dir_hnd, &offset))) {
                                pstring fname;
                                BOOL sysdir_entry = False;
 
@@ -3929,6 +4350,9 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                        }
                                }
 
+                               if (!is_visible_file(conn, directory, dname, &sbuf1, False))
+                                       continue;
+
                                if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
                                
@@ -3944,7 +4368,7 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                        DEBUG(6,("rename %s failed. Error %s\n", fname, nt_errstr(error)));
                                        continue;
                                }
-                               error = can_rename(fname,conn,attrs,&sbuf1);
+                               error = can_rename(conn,fname,attrs,&sbuf1);
                                if (!NT_STATUS_IS_OK(error)) {
                                        DEBUG(6,("rename %s refused\n", fname));
                                        continue;
@@ -3979,7 +4403,7 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                }
                                DEBUG(3,("rename_internals: doing rename on %s -> %s\n",fname,destname));
                        }
-                       CloseDir(dirptr);
+                       CloseDir(dir_hnd);
                }
 
                if (!NT_STATUS_EQUAL(error,NT_STATUS_NO_SUCH_FILE)) {
@@ -4009,7 +4433,7 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        pstring name;
        pstring newname;
        char *p;
-       uint16 attrs = SVAL(inbuf,smb_vwv0);
+       uint32 attrs = SVAL(inbuf,smb_vwv0);
        NTSTATUS status;
 
        START_PROFILE(SMBmv);
@@ -4027,8 +4451,8 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                return ERROR_NT(status);
        }
        
-       RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
-       RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(name, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(newname, conn, inbuf, outbuf);
        
        DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
        
@@ -4037,7 +4461,6 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                END_PROFILE(SMBmv);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
                return ERROR_NT(status);
@@ -4058,7 +4481,7 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
  Copy a file as part of a reply_copy.
 ******************************************************************/
 
-static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
+BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
                      int count,BOOL target_is_directory, int *err_ret)
 {
        int Access,action;
@@ -4123,7 +4546,7 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
        close_file(fsp1,False);
 
        /* Ensure the modtime is set correctly on the destination file. */
-       fsp2->pending_modtime = src_sbuf.st_mtime;
+       fsp_set_pending_modtime( fsp2, src_sbuf.st_mtime);
 
        /*
         * As we are opening fsp1 read-only we only expect
@@ -4187,8 +4610,8 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                return ERROR_DOS(ERRSRV,ERRinvdevice);
        }
 
-       RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
-       RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(name, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(newname, conn, inbuf, outbuf);
 
        rc = unix_convert(name,conn,0,&bad_path1,&sbuf1);
        unix_convert(newname,conn,0,&bad_path2,&sbuf2);
@@ -4231,8 +4654,8 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
 
-       if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask, sizeof(pstring)-1 );
+       if (!rc && mangle_is_mangled(mask, SNUM(conn)))
+               mangle_check_cache( mask, sizeof(pstring)-1, SNUM(conn));
 
        has_wild = ms_has_wild(mask);
 
@@ -4251,23 +4674,27 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                        exists = vfs_file_exist(conn,directory,NULL);
                }
        } else {
-               void *dirptr = NULL;
+               struct smb_Dir *dir_hnd = NULL;
                const char *dname;
                pstring destname;
 
+               if (strequal(mask,"????????.???"))
+                       pstrcpy(mask,"*");
+
                if (check_name(directory,conn))
-                       dirptr = OpenDir(conn, directory, True);
+                       dir_hnd = OpenDir(conn, directory, mask, 0);
 
-               if (dirptr) {
+               if (dir_hnd) {
+                       long offset = 0;
                        error = ERRbadfile;
 
-                       if (strequal(mask,"????????.???"))
-                               pstrcpy(mask,"*");
-
-                       while ((dname = ReadDirName(dirptr))) {
+                       while ((dname = ReadDirName(dir_hnd, &offset))) {
                                pstring fname;
                                pstrcpy(fname,dname);
     
+                               if (!is_visible_file(conn, directory, dname, &sbuf1, False))
+                                       continue;
+
                                if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
 
@@ -4280,7 +4707,7 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                                        count++;
                                DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname,destname));
                        }
-                       CloseDir(dirptr);
+                       CloseDir(dir_hnd);
                }
        }
   
@@ -4297,8 +4724,7 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                        return ERROR_DOS(ERRDOS,error);
                } else {
                        if((errno == ENOENT) && (bad_path1 || bad_path2)) {
-                               unix_ERR_class = ERRDOS;
-                               unix_ERR_code = ERRbadpath;
+                               set_saved_error_triple(ERRDOS, ERRbadpath, NT_STATUS_OK);
                        }
                        END_PROFILE(SMBcopy);
                        return(UNIXERROR(ERRDOS,error));
@@ -4338,6 +4764,8 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                return ERROR_NT(status);
        }
   
+       RESOLVE_DFSPATH(newdir, conn, inbuf, outbuf);
+
        if (strlen(newdir) == 0) {
                ok = True;
        } else {
@@ -4360,6 +4788,9 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Get a lock pid, dealing with large count requests.
 ****************************************************************************/
@@ -4520,11 +4951,16 @@ int reply_lockingX(connection_struct *conn, char *inbuf,char *outbuf,int length,
        
        data = smb_buf(inbuf);
 
-       if (locktype & (LOCKING_ANDX_CANCEL_LOCK | LOCKING_ANDX_CHANGE_LOCKTYPE)) {
+       if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
                /* we don't support these - and CANCEL_LOCK makes w2k
                   and XP reboot so I don't really want to be
                   compatible! (tridge) */
-               return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
+               return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
+       }
+       
+       if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
+               /* Need to make this like a cancel.... JRA. */
+               return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
        }
        
        /* Check if this is an oplock break on a file
@@ -4692,6 +5128,9 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
        return chain_reply(inbuf,outbuf,length,bufsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a SMBreadbmpx (read block multiplex) request.
 ****************************************************************************/
@@ -4734,7 +5173,7 @@ int reply_readbmpx(connection_struct *conn, char *inbuf,char *outbuf,int length,
        tcount = maxcount;
        total_read = 0;
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBreadBmpx);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -4756,6 +5195,7 @@ int reply_readbmpx(connection_struct *conn, char *inbuf,char *outbuf,int length,
                SSVAL(outbuf,smb_vwv6,nread);
                SSVAL(outbuf,smb_vwv7,smb_offset(data,outbuf));
 
+               show_msg(outbuf);
                if (!send_smb(smbd_server_fd(),outbuf))
                        exit_server("reply_readbmpx: send_smb failed.");
 
@@ -4798,7 +5238,7 @@ int reply_setattrE(connection_struct *conn, char *inbuf,char *outbuf, int size,
         * Sometimes times are sent as zero - ignore them.
         */
 
-       if ((unix_times.actime == 0) && (unix_times.modtime == 0)) {
+       if (null_mtime(unix_times.actime) && null_mtime(unix_times.modtime)) {
                /* Ignore request */
                if( DEBUGLVL( 3 ) ) {
                        dbgtext( "reply_setattrE fnum=%d ", fsp->fnum);
@@ -4806,12 +5246,13 @@ int reply_setattrE(connection_struct *conn, char *inbuf,char *outbuf, int size,
                }
                END_PROFILE(SMBsetattrE);
                return(outsize);
-       } else if ((unix_times.actime != 0) && (unix_times.modtime == 0)) {
-               /* set modify time = to access time if modify time was 0 */
+       } else if (!null_mtime(unix_times.actime) && null_mtime(unix_times.modtime)) {
+               /* set modify time = to access time if modify time was unset */
                unix_times.modtime = unix_times.actime;
        }
 
        /* Set the date on this file */
+       /* Should we set pending modtime here ? JRA */
        if(file_utime(conn, fsp->fsp_name, &unix_times)) {
                END_PROFILE(SMBsetattrE);
                return ERROR_DOS(ERRDOS,ERRnoaccess);
@@ -4846,7 +5287,9 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
 
        CHECK_FSP(fsp,conn);
        CHECK_WRITE(fsp);
-       CHECK_ERROR(fsp);
+       if (HAS_CACHED_ERROR(fsp)) {
+               return(CACHED_ERROR(fsp));
+       }
 
        tcount = SVAL(inbuf,smb_vwv1);
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
@@ -4860,7 +5303,7 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
                not an SMBwritebmpx - set this up now so we don't forget */
        SCVAL(outbuf,smb_com,SMBwritec);
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos,WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos,WRITE_LOCK)) {
                END_PROFILE(SMBwriteBmpx);
                return(ERROR_DOS(ERRDOS,ERRlock));
        }
@@ -4885,7 +5328,7 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
                if(fsp->wbmpx_ptr != NULL)
                        wbms = fsp->wbmpx_ptr; /* Use an existing struct */
                else
-                       wbms = (write_bmpx_struct *)malloc(sizeof(write_bmpx_struct));
+                       wbms = SMB_MALLOC_P(write_bmpx_struct);
                if(!wbms) {
                        DEBUG(0,("Out of memory in reply_readmpx\n"));
                        END_PROFILE(SMBwriteBmpx);
@@ -4913,6 +5356,7 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
        if (write_through && tcount==nwritten) {
                /* We need to send both a primary and a secondary response */
                smb_setlen(outbuf,outsize - 4);
+               show_msg(outbuf);
                if (!send_smb(smbd_server_fd(),outbuf))
                        exit_server("reply_writebmpx: send_smb failed.");
 
@@ -4989,8 +5433,12 @@ int reply_writebs(connection_struct *conn, char *inbuf,char *outbuf, int dum_siz
                        END_PROFILE(SMBwriteBs);
                        return(ERROR_DOS(ERRHRD,ERRdiskfull));
                }
+               wbms->wr_errclass = ERRHRD;
+               wbms->wr_error = ERRdiskfull;
+               wbms->wr_status = NT_STATUS_DISK_FULL;
+               wbms->wr_discard = True;
                END_PROFILE(SMBwriteBs);
-               return(CACHE_ERROR(wbms,ERRHRD,ERRdiskfull));
+               return -1;
        }
 
        /* Increment the total written, if this matches tcount
@@ -5051,13 +5499,14 @@ int reply_getattrE(connection_struct *conn, char *inbuf,char *outbuf, int size,
 
        put_dos_date2(outbuf,smb_vwv0,get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn))));
        put_dos_date2(outbuf,smb_vwv2,sbuf.st_atime);
+       /* Should we check pending modtime here ? JRA */
        put_dos_date2(outbuf,smb_vwv4,sbuf.st_mtime);
 
        if (mode & aDIR) {
                SIVAL(outbuf,smb_vwv6,0);
                SIVAL(outbuf,smb_vwv8,0);
        } else {
-               uint32 allocation_size = get_allocation_size(fsp, &sbuf);
+               uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
                SIVAL(outbuf,smb_vwv6,(uint32)sbuf.st_size);
                SIVAL(outbuf,smb_vwv8,allocation_size);
        }