build: Remove SMB_STRUCT_DIR define
[samba.git] / source3 / smbd / msdfs.c
index fb757a5f7469f76e9385c0ca64de2c0be3f71fa1..b7a505284e7d1f9a83c9924da9636bf9cfa29374 100644 (file)
 
 #define DBGC_CLASS DBGC_MSDFS
 #include "includes.h"
-
-extern uint32 global_client_caps;
+#include "system/filesys.h"
+#include "smbd/smbd.h"
+#include "smbd/globals.h"
+#include "msdfs.h"
+#include "auth.h"
+#include "lib/param/loadparm.h"
+#include "libcli/security/security.h"
+#include "librpc/gen_ndr/ndr_dfsblobs.h"
 
 /**********************************************************************
  Parse a DFS pathname of the form \hostname\service\reqpath
@@ -36,19 +42,25 @@ extern uint32 global_client_caps;
  SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES bit and then
  send a local path, we have to cope with that too....
 
+ If conn != NULL then ensure the provided service is
+ the one pointed to by the connection.
+
  This version does everything using pointers within one copy of the
  pathname string, talloced on the struct dfs_path pointer (which
  must be talloced). This may be too clever to live....
  JRA.
 **********************************************************************/
 
-static NTSTATUS parse_dfs_path(const char *pathname,
+static NTSTATUS parse_dfs_path(connection_struct *conn,
+                               const char *pathname,
                                bool allow_wcards,
+                               bool allow_broken_path,
                                struct dfs_path *pdp, /* MUST BE TALLOCED */
                                bool *ppath_contains_wcard)
 {
        char *pathname_local;
        char *p,*temp;
+       char *servicename;
        char *eos_ptr;
        NTSTATUS status = NT_STATUS_OK;
        char sepchar;
@@ -73,7 +85,7 @@ static NTSTATUS parse_dfs_path(const char *pathname,
 
        sepchar = pdp->posix_path ? '/' : '\\';
 
-       if (*pathname != sepchar) {
+       if (allow_broken_path && (*pathname != sepchar)) {
                DEBUG(10,("parse_dfs_path: path %s doesn't start with %c\n",
                        pathname, sepchar ));
                /*
@@ -128,16 +140,52 @@ static NTSTATUS parse_dfs_path(const char *pathname,
        DEBUG(10,("parse_dfs_path: hostname: %s\n",pdp->hostname));
 
        /* Parse out servicename. */
-       temp = p+1;
-       p = strchr_m(temp,sepchar);
+       servicename = p+1;
+       p = strchr_m(servicename,sepchar);
+       if (p) {
+               *p = '\0';
+       }
+
+       /* Is this really our servicename ? */
+       if (conn && !( strequal(servicename, lp_servicename(SNUM(conn)))
+                       || (strequal(servicename, HOMES_NAME)
+                       && strequal(lp_servicename(SNUM(conn)),
+                               get_current_username()) )) ) {
+               DEBUG(10,("parse_dfs_path: %s is not our servicename\n",
+                       servicename));
+
+               /*
+                * Possibly client sent a local path by mistake.
+                * Try and convert to a local path.
+                */
+
+               pdp->hostname = eos_ptr; /* "" */
+               pdp->servicename = eos_ptr; /* "" */
+
+               /* Repair the path - replace the sepchar's
+                  we nulled out */
+               servicename--;
+               *servicename = sepchar;
+               if (p) {
+                       *p = sepchar;
+               }
+
+               p = temp;
+               DEBUG(10,("parse_dfs_path: trying to convert %s "
+                       "to a local path\n",
+                       temp));
+               goto local_path;
+       }
+
+       pdp->servicename = servicename;
+
+       DEBUG(10,("parse_dfs_path: servicename: %s\n",pdp->servicename));
+
        if(p == NULL) {
-               pdp->servicename = temp;
+               /* Client sent self referral \server\share. */
                pdp->reqpath = eos_ptr; /* "" */
                return NT_STATUS_OK;
        }
-       *p = '\0';
-       pdp->servicename = temp;
-       DEBUG(10,("parse_dfs_path: servicename: %s\n",pdp->servicename));
 
        p++;
 
@@ -171,69 +219,142 @@ static NTSTATUS parse_dfs_path(const char *pathname,
 
 /********************************************************
  Fake up a connection struct for the VFS layer.
- Note this CHANGES CWD !!!! JRA.
+ Note: this performs a vfs connect and CHANGES CWD !!!! JRA.
 *********************************************************/
 
-static NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
-                               connection_struct *conn,
+NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
+                               struct smbd_server_connection *sconn,
+                               connection_struct **pconn,
                                int snum,
-                               const char *path)
+                               const char *path,
+                               const struct auth_session_info *session_info,
+                               char **poldcwd)
 {
+       connection_struct *conn;
        char *connpath;
+       char *oldcwd;
+       const char *vfs_user;
 
-       ZERO_STRUCTP(conn);
+       conn = talloc_zero(ctx, connection_struct);
+       if (conn == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
 
-       connpath = talloc_strdup(ctx, path);
+       connpath = talloc_strdup(conn, path);
        if (!connpath) {
+               TALLOC_FREE(conn);
                return NT_STATUS_NO_MEMORY;
        }
-       connpath = talloc_string_sub(ctx,
+       connpath = talloc_string_sub(conn,
                                connpath,
                                "%S",
                                lp_servicename(snum));
        if (!connpath) {
+               TALLOC_FREE(conn);
                return NT_STATUS_NO_MEMORY;
        }
 
        /* needed for smbd_vfs_init() */
 
-       if ((conn->mem_ctx=talloc_init("connection_struct")) == NULL) {
-               DEBUG(0,("talloc_init(connection_struct) failed!\n"));
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       if (!(conn->params = TALLOC_ZERO_P(conn->mem_ctx,
-                                       struct share_params))) {
+       if (!(conn->params = talloc_zero(conn, struct share_params))) {
                DEBUG(0, ("TALLOC failed\n"));
+               TALLOC_FREE(conn);
                return NT_STATUS_NO_MEMORY;
        }
 
        conn->params->service = snum;
+       conn->cnum = (unsigned)-1;
+
+       conn->sconn = sconn;
+       DLIST_ADD(sconn->connections, conn);
+       conn->sconn->num_connections++;
+
+       if (session_info != NULL) {
+               conn->session_info = copy_session_info(conn, session_info);
+               if (conn->session_info == NULL) {
+                       DEBUG(0, ("copy_serverinfo failed\n"));
+                       TALLOC_FREE(conn);
+                       return NT_STATUS_NO_MEMORY;
+               }
+               vfs_user = conn->session_info->unix_info->unix_name;
+       } else {
+               /* use current authenticated user in absence of session_info */
+               vfs_user = get_current_username();
+       }
 
        set_conn_connectpath(conn, connpath);
 
+       /*
+        * New code to check if there's a share security descripter
+        * added from NT server manager. This is done after the
+        * smb.conf checks are done as we need a uid and token. JRA.
+        *
+        */
+       if (conn->session_info) {
+               share_access_check(conn->session_info->security_token,
+                                  lp_servicename(snum), MAXIMUM_ALLOWED_ACCESS,
+                                  &conn->share_access);
+
+               if ((conn->share_access & FILE_WRITE_DATA) == 0) {
+                       if ((conn->share_access & FILE_READ_DATA) == 0) {
+                               /* No access, read or write. */
+                               DEBUG(0,("create_conn_struct: connection to %s "
+                                        "denied due to security "
+                                        "descriptor.\n",
+                                        lp_servicename(snum)));
+                               conn_free(conn);
+                               return NT_STATUS_ACCESS_DENIED;
+                       } else {
+                               conn->read_only = true;
+                       }
+               }
+       } else {
+               conn->share_access = 0;
+               conn->read_only = true;
+       }
+
        if (!smbd_vfs_init(conn)) {
                NTSTATUS status = map_nt_error_from_unix(errno);
                DEBUG(0,("create_conn_struct: smbd_vfs_init failed.\n"));
-               conn_free_internal(conn);
+               conn_free(conn);
                return status;
        }
 
+       /* this must be the first filesystem operation that we do */
+       if (SMB_VFS_CONNECT(conn, lp_servicename(snum), vfs_user) < 0) {
+               DEBUG(0,("VFS connect failed!\n"));
+               conn_free(conn);
+               return NT_STATUS_UNSUCCESSFUL;
+       }
+
+       conn->fs_capabilities = SMB_VFS_FS_CAPABILITIES(conn, &conn->ts_res);
+
        /*
         * Windows seems to insist on doing trans2getdfsreferral() calls on
         * the IPC$ share as the anonymous user. If we try to chdir as that
         * user we will fail.... WTF ? JRA.
         */
 
+       oldcwd = vfs_GetWd(ctx, conn);
+       if (oldcwd == NULL) {
+               NTSTATUS status = map_nt_error_from_unix(errno);
+               DEBUG(3, ("vfs_GetWd failed: %s\n", strerror(errno)));
+               conn_free(conn);
+               return status;
+       }
+
        if (vfs_ChDir(conn,conn->connectpath) != 0) {
                NTSTATUS status = map_nt_error_from_unix(errno);
                DEBUG(3,("create_conn_struct: Can't ChDir to new conn path %s. "
                        "Error was %s\n",
                        conn->connectpath, strerror(errno) ));
-               conn_free_internal(conn);
+               conn_free(conn);
                return status;
        }
 
+       *pconn = conn;
+       *poldcwd = oldcwd;
+
        return NT_STATUS_OK;
 }
 
@@ -278,7 +399,7 @@ static bool parse_msdfs_symlink(TALLOC_CTX *ctx,
                return False;
        }
 
-       alt_path = TALLOC_ARRAY(ctx, char *, MAX_REFERRAL_COUNT);
+       alt_path = talloc_array(ctx, char *, MAX_REFERRAL_COUNT);
        if (!alt_path) {
                return False;
        }
@@ -292,7 +413,7 @@ static bool parse_msdfs_symlink(TALLOC_CTX *ctx,
        DEBUG(10,("parse_msdfs_symlink: count=%d\n", count));
 
        if (count) {
-               reflist = *preflist = TALLOC_ZERO_ARRAY(ctx,
+               reflist = *preflist = talloc_zero_array(ctx,
                                struct referral, count);
                if(reflist == NULL) {
                        TALLOC_FREE(alt_path);
@@ -326,9 +447,10 @@ static bool parse_msdfs_symlink(TALLOC_CTX *ctx,
                reflist[i].ttl = REFERRAL_TTL;
                DEBUG(10, ("parse_msdfs_symlink: Created alt path: %s\n",
                                        reflist[i].alternate_path));
-               *refcount += 1;
        }
 
+       *refcount = count;
+
        TALLOC_FREE(alt_path);
        return True;
 }
@@ -344,15 +466,19 @@ static bool is_msdfs_link_internal(TALLOC_CTX *ctx,
                        char **pp_link_target,
                        SMB_STRUCT_STAT *sbufp)
 {
-       SMB_STRUCT_STAT st;
        int referral_len = 0;
+#if defined(HAVE_BROKEN_READLINK)
+       char link_target_buf[PATH_MAX];
+#else
        char link_target_buf[7];
+#endif
        size_t bufsize = 0;
        char *link_target = NULL;
+       struct smb_filename smb_fname;
 
        if (pp_link_target) {
                bufsize = 1024;
-               link_target = TALLOC_ARRAY(ctx, char, bufsize);
+               link_target = talloc_array(ctx, char, bufsize);
                if (!link_target) {
                        return False;
                }
@@ -362,21 +488,22 @@ static bool is_msdfs_link_internal(TALLOC_CTX *ctx,
                link_target = link_target_buf;
        }
 
-       if (sbufp == NULL) {
-               sbufp = &st;
-       }
+       ZERO_STRUCT(smb_fname);
+       smb_fname.base_name = discard_const_p(char, path);
 
-       if (SMB_VFS_LSTAT(conn, path, sbufp) != 0) {
+       if (SMB_VFS_LSTAT(conn, &smb_fname) != 0) {
                DEBUG(5,("is_msdfs_link_read_target: %s does not exist.\n",
                        path));
                goto err;
        }
-
-       if (!S_ISLNK(sbufp->st_mode)) {
+       if (!S_ISLNK(smb_fname.st.st_ex_mode)) {
                DEBUG(5,("is_msdfs_link_read_target: %s is not a link.\n",
                                        path));
                goto err;
        }
+       if (sbufp != NULL) {
+               *sbufp = smb_fname.st;
+       }
 
        referral_len = SMB_VFS_READLINK(conn, path, link_target, bufsize - 1);
        if (referral_len == -1) {
@@ -444,9 +571,8 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
 {
        char *p = NULL;
        char *q = NULL;
-       SMB_STRUCT_STAT sbuf;
        NTSTATUS status;
-       char *localpath = NULL;
+       struct smb_filename *smb_fname = NULL;
        char *canon_dfspath = NULL; /* Canonicalized dfs path. (only '/'
                                  components). */
 
@@ -454,31 +580,34 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
                conn->connectpath, pdp->reqpath));
 
        /*
-        * Note the unix path conversion here we're doing we can
+        * Note the unix path conversion here we're doing we
         * throw away. We're looking for a symlink for a dfs
         * resolution, if we don't find it we'll do another
         * unix_convert later in the codepath.
-        * If we needed to remember what we'd resolved in
-        * dp->reqpath (as the original code did) we'd
-        * copy (localhost, dp->reqpath) on any code
-        * path below that returns True - but I don't
-        * think this is needed. JRA.
         */
 
-       status = unix_convert(ctx, conn, pdp->reqpath, search_flag, &localpath,
-                       NULL, &sbuf);
-       if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status,
-                                       NT_STATUS_OBJECT_PATH_NOT_FOUND)) {
-               return status;
+       status = unix_convert(ctx, conn, pdp->reqpath, &smb_fname,
+                             search_flag ? UCF_ALWAYS_ALLOW_WCARD_LCOMP : 0);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               if (!NT_STATUS_EQUAL(status,
+                                    NT_STATUS_OBJECT_PATH_NOT_FOUND)) {
+                       return status;
+               }
+               if (smb_fname == NULL || smb_fname->base_name == NULL) {
+                       return status;
+               }
        }
 
        /* Optimization - check if we can redirect the whole path. */
 
-       if (is_msdfs_link_internal(ctx, conn, localpath, pp_targetpath, NULL)) {
+       if (is_msdfs_link_internal(ctx, conn, smb_fname->base_name,
+                                  pp_targetpath, NULL)) {
                if (search_flag) {
                        DEBUG(6,("dfs_path_lookup (FindFirst) No redirection "
                                 "for dfs link %s.\n", dfspath));
-                       return NT_STATUS_OK;
+                       status = NT_STATUS_OK;
+                       goto out;
                }
 
                DEBUG(6,("dfs_path_lookup: %s resolves to a "
@@ -488,7 +617,8 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
                if (consumedcntp) {
                        *consumedcntp = strlen(dfspath);
                }
-               return NT_STATUS_PATH_NOT_COVERED;
+               status = NT_STATUS_PATH_NOT_COVERED;
+               goto out;
        }
 
        /* Prepare to test only for '/' components in the given path,
@@ -497,7 +627,8 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
 
        canon_dfspath = talloc_strdup(ctx, dfspath);
        if (!canon_dfspath) {
-               return NT_STATUS_NO_MEMORY;
+               status = NT_STATUS_NO_MEMORY;
+               goto out;
        }
        if (!pdp->posix_path) {
                string_replace(canon_dfspath, '\\', '/');
@@ -519,7 +650,7 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
         * DFS path. If we hit a DFS link then we're done.
         */
 
-       p = strrchr_m(localpath, '/');
+       p = strrchr_m(smb_fname->base_name, '/');
        if (consumedcntp) {
                q = strrchr_m(canon_dfspath, '/');
        }
@@ -531,9 +662,11 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
                }
 
                if (is_msdfs_link_internal(ctx, conn,
-                                       localpath, pp_targetpath, NULL)) {
+                                          smb_fname->base_name, pp_targetpath,
+                                          NULL)) {
                        DEBUG(4, ("dfs_path_lookup: Redirecting %s because "
-                               "parent %s is dfs link\n", dfspath, localpath));
+                                 "parent %s is dfs link\n", dfspath,
+                                 smb_fname_str_dbg(smb_fname)));
 
                        if (consumedcntp) {
                                *consumedcntp = strlen(canon_dfspath);
@@ -543,11 +676,12 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
                                        *consumedcntp));
                        }
 
-                       return NT_STATUS_PATH_NOT_COVERED;
+                       status = NT_STATUS_PATH_NOT_COVERED;
+                       goto out;
                }
 
                /* Step back on the filesystem. */
-               p = strrchr_m(localpath, '/');
+               p = strrchr_m(smb_fname->base_name, '/');
 
                if (consumedcntp) {
                        /* And in the canonicalized dfs path. */
@@ -555,7 +689,10 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
                }
        }
 
-       return NT_STATUS_OK;
+       status = NT_STATUS_OK;
+ out:
+       TALLOC_FREE(smb_fname);
+       return status;
 }
 
 /*****************************************************************
@@ -577,17 +714,19 @@ static NTSTATUS dfs_redirect(TALLOC_CTX *ctx,
                        connection_struct *conn,
                        const char *path_in,
                        bool search_wcard_flag,
+                       bool allow_broken_path,
                        char **pp_path_out,
                        bool *ppath_contains_wcard)
 {
        NTSTATUS status;
-       struct dfs_path *pdp = TALLOC_P(ctx, struct dfs_path);
+       struct dfs_path *pdp = talloc(ctx, struct dfs_path);
 
        if (!pdp) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       status = parse_dfs_path(path_in, search_wcard_flag, pdp,
+       status = parse_dfs_path(conn, path_in, search_wcard_flag,
+                               allow_broken_path, pdp,
                        ppath_contains_wcard);
        if (!NT_STATUS_IS_OK(status)) {
                TALLOC_FREE(pdp);
@@ -631,7 +770,7 @@ static NTSTATUS dfs_redirect(TALLOC_CTX *ctx,
        if (!( strequal(pdp->servicename, lp_servicename(SNUM(conn)))
                        || (strequal(pdp->servicename, HOMES_NAME)
                        && strequal(lp_servicename(SNUM(conn)),
-                               get_current_username()) )) ) {
+                               conn->session_info->unix_info->sanitized_username) )) ) {
 
                /* The given sharename doesn't match this connection. */
                TALLOC_FREE(pdp);
@@ -683,7 +822,7 @@ static NTSTATUS self_ref(TALLOC_CTX *ctx,
        *self_referralp = True;
 
        jucn->referral_count = 1;
-       if((ref = TALLOC_ZERO_P(ctx, struct referral)) == NULL) {
+       if((ref = talloc_zero(ctx, struct referral)) == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -705,26 +844,27 @@ static NTSTATUS self_ref(TALLOC_CTX *ctx,
 
 NTSTATUS get_referred_path(TALLOC_CTX *ctx,
                        const char *dfs_path,
+                       struct smbd_server_connection *sconn,
                        struct junction_map *jucn,
                        int *consumedcntp,
                        bool *self_referralp)
 {
-       struct connection_struct conns;
-       struct connection_struct *conn = &conns;
+       struct connection_struct *conn;
        char *targetpath = NULL;
        int snum;
        NTSTATUS status = NT_STATUS_NOT_FOUND;
        bool dummy;
-       struct dfs_path *pdp = TALLOC_P(ctx, struct dfs_path);
+       struct dfs_path *pdp = talloc(ctx, struct dfs_path);
+       char *oldpath;
 
        if (!pdp) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       ZERO_STRUCT(conns);
        *self_referralp = False;
 
-       status = parse_dfs_path(dfs_path, False, pdp, &dummy);
+       status = parse_dfs_path(NULL, dfs_path, False, !sconn->using_smb2,
+                               pdp, &dummy);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -739,11 +879,13 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
        /* Verify the share is a dfs root */
        snum = lp_servicenumber(jucn->service_name);
        if(snum < 0) {
-               fstring service_name;
-               fstrcpy(service_name, jucn->service_name);
-               if ((snum = find_service(service_name)) < 0) {
+               char *service_name = NULL;
+               if ((snum = find_service(ctx, jucn->service_name, &service_name)) < 0) {
                        return NT_STATUS_NOT_FOUND;
                }
+               if (!service_name) {
+                       return NT_STATUS_NO_MEMORY;
+               }
                TALLOC_FREE(jucn->service_name);
                jucn->service_name = talloc_strdup(ctx, service_name);
                if (!jucn->service_name) {
@@ -787,7 +929,7 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
                 */
 
                jucn->referral_count = 1;
-               if ((ref = TALLOC_ZERO_P(ctx, struct referral)) == NULL) {
+               if ((ref = talloc_zero(ctx, struct referral)) == NULL) {
                        TALLOC_FREE(pdp);
                        return NT_STATUS_NO_MEMORY;
                }
@@ -825,7 +967,8 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
                return NT_STATUS_OK;
        }
 
-       status = create_conn_struct(ctx, conn, snum, lp_pathname(snum));
+       status = create_conn_struct(ctx, sconn, &conn, snum,
+                                   lp_pathname(snum), NULL, &oldpath);
        if (!NT_STATUS_IS_OK(status)) {
                TALLOC_FREE(pdp);
                return status;
@@ -840,9 +983,7 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
        if (!NT_STATUS_EQUAL(status, NT_STATUS_PATH_NOT_COVERED)) {
                DEBUG(3,("get_referred_path: No valid referrals for path %s\n",
                        dfs_path));
-               conn_free_internal(conn);
-               TALLOC_FREE(pdp);
-               return status;
+               goto err_exit;
        }
 
        /* We know this is a valid dfs link. Parse the targetpath. */
@@ -851,223 +992,17 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
                                &jucn->referral_count)) {
                DEBUG(3,("get_referred_path: failed to parse symlink "
                        "target %s\n", targetpath ));
-               conn_free_internal(conn);
-               TALLOC_FREE(pdp);
-               return NT_STATUS_NOT_FOUND;
+               status = NT_STATUS_NOT_FOUND;
+               goto err_exit;
        }
 
-       conn_free_internal(conn);
+       status = NT_STATUS_OK;
+ err_exit:
+       vfs_ChDir(conn, oldpath);
+       SMB_VFS_DISCONNECT(conn);
+       conn_free(conn);
        TALLOC_FREE(pdp);
-       return NT_STATUS_OK;
-}
-
-static int setup_ver2_dfs_referral(const char *pathname,
-                               char **ppdata,
-                               struct junction_map *junction,
-                               int consumedcnt,
-                               bool self_referral)
-{
-       char* pdata = *ppdata;
-
-       smb_ucs2_t *uni_requestedpath = NULL;
-       int uni_reqpathoffset1,uni_reqpathoffset2;
-       int uni_curroffset;
-       int requestedpathlen=0;
-       int offset;
-       int reply_size = 0;
-       int i=0;
-
-       DEBUG(10,("Setting up version2 referral\nRequested path:\n"));
-
-       requestedpathlen = rpcstr_push_talloc(talloc_tos(),
-                                       &uni_requestedpath, pathname);
-       if (uni_requestedpath == NULL || requestedpathlen == 0) {
-               return -1;
-       }
-
-       if (DEBUGLVL(10)) {
-               dump_data(0, (unsigned char *)uni_requestedpath,
-                       requestedpathlen);
-       }
-
-       DEBUG(10,("ref count = %u\n",junction->referral_count));
-
-       uni_reqpathoffset1 = REFERRAL_HEADER_SIZE +
-                       VERSION2_REFERRAL_SIZE * junction->referral_count;
-
-       uni_reqpathoffset2 = uni_reqpathoffset1 + requestedpathlen;
-
-       uni_curroffset = uni_reqpathoffset2 + requestedpathlen;
-
-       reply_size = REFERRAL_HEADER_SIZE +
-                       VERSION2_REFERRAL_SIZE*junction->referral_count +
-                       2 * requestedpathlen;
-       DEBUG(10,("reply_size: %u\n",reply_size));
-
-       /* add up the unicode lengths of all the referral paths */
-       for(i=0;i<junction->referral_count;i++) {
-               DEBUG(10,("referral %u : %s\n",
-                       i,
-                       junction->referral_list[i].alternate_path));
-               reply_size +=
-                       (strlen(junction->referral_list[i].alternate_path)+1)*2;
-       }
-
-       DEBUG(10,("reply_size = %u\n",reply_size));
-       /* add the unexplained 0x16 bytes */
-       reply_size += 0x16;
-
-       pdata = (char *)SMB_REALLOC(pdata,reply_size);
-       if(pdata == NULL) {
-               DEBUG(0,("Realloc failed!\n"));
-               return -1;
-       }
-       *ppdata = pdata;
-
-       /* copy in the dfs requested paths.. required for offset calculations */
-       memcpy(pdata+uni_reqpathoffset1,uni_requestedpath,requestedpathlen);
-       memcpy(pdata+uni_reqpathoffset2,uni_requestedpath,requestedpathlen);
-
-       /* create the header */
-       SSVAL(pdata,0,consumedcnt * 2); /* path consumed */
-       /* number of referral in this pkt */
-       SSVAL(pdata,2,junction->referral_count);
-       if(self_referral) {
-               SIVAL(pdata,4,DFSREF_REFERRAL_SERVER | DFSREF_STORAGE_SERVER);
-       } else {
-               SIVAL(pdata,4,DFSREF_STORAGE_SERVER);
-       }
-
-       offset = 8;
-       /* add the referral elements */
-       for(i=0;i<junction->referral_count;i++) {
-               struct referral* ref = &junction->referral_list[i];
-               int unilen;
-
-               SSVAL(pdata,offset,2); /* version 2 */
-               SSVAL(pdata,offset+2,VERSION2_REFERRAL_SIZE);
-               if(self_referral) {
-                       SSVAL(pdata,offset+4,1);
-               } else {
-                       SSVAL(pdata,offset+4,0);
-               }
-
-               /* ref_flags :use path_consumed bytes? */
-               SSVAL(pdata,offset+6,0);
-               SIVAL(pdata,offset+8,ref->proximity);
-               SIVAL(pdata,offset+12,ref->ttl);
-
-               SSVAL(pdata,offset+16,uni_reqpathoffset1-offset);
-               SSVAL(pdata,offset+18,uni_reqpathoffset2-offset);
-               /* copy referred path into current offset */
-               unilen = rpcstr_push(pdata+uni_curroffset,
-                                       ref->alternate_path,
-                                       reply_size - uni_curroffset,
-                                       STR_UNICODE);
-
-               SSVAL(pdata,offset+20,uni_curroffset-offset);
-
-               uni_curroffset += unilen;
-               offset += VERSION2_REFERRAL_SIZE;
-       }
-       /* add in the unexplained 22 (0x16) bytes at the end */
-       memset(pdata+uni_curroffset,'\0',0x16);
-       return reply_size;
-}
-
-static int setup_ver3_dfs_referral(const char *pathname,
-                               char **ppdata,
-                               struct junction_map *junction,
-                               int consumedcnt,
-                               bool self_referral)
-{
-       char *pdata = *ppdata;
-
-       smb_ucs2_t *uni_reqpath = NULL;
-       int uni_reqpathoffset1, uni_reqpathoffset2;
-       int uni_curroffset;
-       int reply_size = 0;
-
-       int reqpathlen = 0;
-       int offset,i=0;
-
-       DEBUG(10,("setting up version3 referral\n"));
-
-       reqpathlen = rpcstr_push_talloc(talloc_tos(), &uni_reqpath, pathname);
-       if (uni_reqpath == NULL || reqpathlen == 0) {
-               return -1;
-       }
-
-       if (DEBUGLVL(10)) {
-               dump_data(0, (unsigned char *)uni_reqpath,
-                       reqpathlen);
-       }
-
-       uni_reqpathoffset1 = REFERRAL_HEADER_SIZE +
-                       VERSION3_REFERRAL_SIZE * junction->referral_count;
-       uni_reqpathoffset2 = uni_reqpathoffset1 + reqpathlen;
-       reply_size = uni_curroffset = uni_reqpathoffset2 + reqpathlen;
-
-       for(i=0;i<junction->referral_count;i++) {
-               DEBUG(10,("referral %u : %s\n",
-                       i,
-                       junction->referral_list[i].alternate_path));
-               reply_size +=
-                       (strlen(junction->referral_list[i].alternate_path)+1)*2;
-       }
-
-       pdata = (char *)SMB_REALLOC(pdata,reply_size);
-       if(pdata == NULL) {
-               DEBUG(0,("version3 referral setup:"
-                       "malloc failed for Realloc!\n"));
-               return -1;
-       }
-       *ppdata = pdata;
-
-       /* create the header */
-       SSVAL(pdata,0,consumedcnt * 2); /* path consumed */
-       SSVAL(pdata,2,junction->referral_count); /* number of referral */
-       if(self_referral) {
-               SIVAL(pdata,4,DFSREF_REFERRAL_SERVER | DFSREF_STORAGE_SERVER);
-       } else {
-               SIVAL(pdata,4,DFSREF_STORAGE_SERVER);
-       }
-
-       /* copy in the reqpaths */
-       memcpy(pdata+uni_reqpathoffset1,uni_reqpath,reqpathlen);
-       memcpy(pdata+uni_reqpathoffset2,uni_reqpath,reqpathlen);
-
-       offset = 8;
-       for(i=0;i<junction->referral_count;i++) {
-               struct referral* ref = &(junction->referral_list[i]);
-               int unilen;
-
-               SSVAL(pdata,offset,3); /* version 3 */
-               SSVAL(pdata,offset+2,VERSION3_REFERRAL_SIZE);
-               if(self_referral) {
-                       SSVAL(pdata,offset+4,1);
-               } else {
-                       SSVAL(pdata,offset+4,0);
-               }
-
-               /* ref_flags :use path_consumed bytes? */
-               SSVAL(pdata,offset+6,0);
-               SIVAL(pdata,offset+8,ref->ttl);
-
-               SSVAL(pdata,offset+12,uni_reqpathoffset1-offset);
-               SSVAL(pdata,offset+14,uni_reqpathoffset2-offset);
-               /* copy referred path into current offset */
-               unilen = rpcstr_push(pdata+uni_curroffset,ref->alternate_path,
-                                       reply_size - uni_curroffset,
-                                       STR_UNICODE | STR_TERMINATE);
-               SSVAL(pdata,offset+16,uni_curroffset-offset);
-               /* copy 0x10 bytes of 00's in the ServiceSite GUID */
-               memset(pdata+offset+18,'\0',16);
-
-               uni_curroffset += unilen;
-               offset += VERSION3_REFERRAL_SIZE;
-       }
-       return reply_size;
+       return status;
 }
 
 /******************************************************************
@@ -1082,110 +1017,55 @@ int setup_dfs_referral(connection_struct *orig_conn,
                        int max_referral_level,
                        char **ppdata, NTSTATUS *pstatus)
 {
-       struct junction_map *junction = NULL;
-       int consumedcnt = 0;
-       bool self_referral = False;
+       char *pdata = *ppdata;
        int reply_size = 0;
-       char *pathnamep = NULL;
-       char *local_dfs_path = NULL;
-       TALLOC_CTX *ctx;
+       struct dfs_GetDFSReferral *r;
+       DATA_BLOB blob = data_blob_null;
+       NTSTATUS status;
+       enum ndr_err_code ndr_err;
 
-       if (!(ctx=talloc_init("setup_dfs_referral"))) {
+       r = talloc_zero(talloc_tos(), struct dfs_GetDFSReferral);
+       if (r == NULL) {
                *pstatus = NT_STATUS_NO_MEMORY;
                return -1;
        }
 
-       /* get the junction entry */
-       if (!dfs_path) {
-               talloc_destroy(ctx);
-               *pstatus = NT_STATUS_NOT_FOUND;
-               return -1;
-       }
-
-       /*
-        * Trim pathname sent by client so it begins with only one backslash.
-        * Two backslashes confuse some dfs clients
-        */
-
-       local_dfs_path = talloc_strdup(ctx,dfs_path);
-       if (!local_dfs_path) {
+       r->in.req.max_referral_level = max_referral_level;
+       r->in.req.servername = talloc_strdup(r, dfs_path);
+       if (r->in.req.servername == NULL) {
+               talloc_free(r);
                *pstatus = NT_STATUS_NO_MEMORY;
-               talloc_destroy(ctx);
                return -1;
        }
-       pathnamep = local_dfs_path;
-       while (IS_DIRECTORY_SEP(pathnamep[0]) &&
-                       IS_DIRECTORY_SEP(pathnamep[1])) {
-               pathnamep++;
-       }
 
-       junction = TALLOC_ZERO_P(ctx, struct junction_map);
-       if (!junction) {
-               *pstatus = NT_STATUS_NO_MEMORY;
-               talloc_destroy(ctx);
+       status = SMB_VFS_GET_DFS_REFERRALS(orig_conn, r);
+       if (!NT_STATUS_IS_OK(status)) {
+               talloc_free(r);
+               *pstatus = status;
                return -1;
        }
 
-       /* The following call can change cwd. */
-       *pstatus = get_referred_path(ctx, pathnamep, junction,
-                       &consumedcnt, &self_referral);
-       if (!NT_STATUS_IS_OK(*pstatus)) {
-               vfs_ChDir(orig_conn,orig_conn->connectpath);
-               talloc_destroy(ctx);
+       ndr_err = ndr_push_struct_blob(&blob, r,
+                               r->out.resp,
+                               (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               TALLOC_FREE(r);
+               *pstatus = NT_STATUS_INVALID_PARAMETER;
                return -1;
        }
-       vfs_ChDir(orig_conn,orig_conn->connectpath);
 
-       if (!self_referral) {
-               pathnamep[consumedcnt] = '\0';
-
-               if( DEBUGLVL( 3 ) ) {
-                       int i=0;
-                       dbgtext("setup_dfs_referral: Path %s to "
-                               "alternate path(s):",
-                               pathnamep);
-                       for(i=0;i<junction->referral_count;i++)
-                               dbgtext(" %s",
-                               junction->referral_list[i].alternate_path);
-                       dbgtext(".\n");
-               }
-       }
-
-       /* create the referral depeding on version */
-       DEBUG(10,("max_referral_level :%d\n",max_referral_level));
-
-       if (max_referral_level < 2) {
-               max_referral_level = 2;
-       }
-       if (max_referral_level > 3) {
-               max_referral_level = 3;
-       }
-
-       switch(max_referral_level) {
-       case 2:
-               reply_size = setup_ver2_dfs_referral(pathnamep,
-                                       ppdata, junction,
-                                       consumedcnt, self_referral);
-               break;
-       case 3:
-               reply_size = setup_ver3_dfs_referral(pathnamep, ppdata,
-                                       junction, consumedcnt, self_referral);
-               break;
-       default:
-               DEBUG(0,("setup_dfs_referral: Invalid dfs referral "
-                       "version: %d\n",
-                       max_referral_level));
-               talloc_destroy(ctx);
-               *pstatus = NT_STATUS_INVALID_LEVEL;
+       pdata = (char *)SMB_REALLOC(pdata, blob.length);
+       if(pdata == NULL) {
+               TALLOC_FREE(r);
+               DEBUG(0,("referral setup:"
+                        "malloc failed for Realloc!\n"));
                return -1;
        }
+       *ppdata = pdata;
+       reply_size = blob.length;
+       memcpy(pdata, blob.data, blob.length);
+       TALLOC_FREE(r);
 
-       if (DEBUGLVL(10)) {
-               DEBUGADD(0,("DFS Referral pdata:\n"));
-               dump_data(0,(uint8 *)*ppdata,reply_size);
-       }
-
-       talloc_destroy(ctx);
        *pstatus = NT_STATUS_OK;
        return reply_size;
 }
@@ -1200,17 +1080,19 @@ int setup_dfs_referral(connection_struct *orig_conn,
 
 bool create_junction(TALLOC_CTX *ctx,
                const char *dfs_path,
+               bool allow_broken_path,
                struct junction_map *jucn)
 {
        int snum;
        bool dummy;
-       struct dfs_path *pdp = TALLOC_P(ctx,struct dfs_path);
+       struct dfs_path *pdp = talloc(ctx,struct dfs_path);
        NTSTATUS status;
 
        if (!pdp) {
                return False;
        }
-       status = parse_dfs_path(dfs_path, False, pdp, &dummy);
+       status = parse_dfs_path(NULL, dfs_path, False, allow_broken_path,
+                               pdp, &dummy);
        if (!NT_STATUS_IS_OK(status)) {
                return False;
        }
@@ -1250,50 +1132,52 @@ bool create_junction(TALLOC_CTX *ctx,
  **********************************************************************/
 
 static bool junction_to_local_path(const struct junction_map *jucn,
-                               char **pp_path_out,
-                               connection_struct *conn_out)
+                                  char **pp_path_out,
+                                  connection_struct **conn_out,
+                                  char **oldpath)
 {
        int snum;
+       NTSTATUS status;
 
        snum = lp_servicenumber(jucn->service_name);
        if(snum < 0) {
                return False;
        }
-       if (!NT_STATUS_IS_OK(create_conn_struct(talloc_tos(),
-                                       conn_out, snum,
-                                       lp_pathname(snum)))) {
+       status = create_conn_struct(talloc_tos(), smbd_server_conn, conn_out,
+                                   snum, lp_pathname(snum), NULL, oldpath);
+       if (!NT_STATUS_IS_OK(status)) {
                return False;
        }
 
-       *pp_path_out = talloc_asprintf(conn_out->mem_ctx,
+       *pp_path_out = talloc_asprintf(*conn_out,
                        "%s/%s",
                        lp_pathname(snum),
                        jucn->volume_name);
        if (!*pp_path_out) {
+               vfs_ChDir(*conn_out, *oldpath);
+               SMB_VFS_DISCONNECT(*conn_out);
+               conn_free(*conn_out);
                return False;
        }
        return True;
 }
 
-bool create_msdfs_link(const struct junction_map *jucn,
-               bool exists)
+bool create_msdfs_link(const struct junction_map *jucn)
 {
        char *path = NULL;
+       char *cwd;
        char *msdfs_link = NULL;
-       connection_struct conns;
-       connection_struct *conn = &conns;
+       connection_struct *conn;
        int i=0;
        bool insert_comma = False;
        bool ret = False;
 
-       ZERO_STRUCT(conns);
-
-       if(!junction_to_local_path(jucn, &path, conn)) {
+       if(!junction_to_local_path(jucn, &path, &conn, &cwd)) {
                return False;
        }
 
        /* Form the msdfs_link contents */
-       msdfs_link = talloc_strdup(conn->mem_ctx, "msdfs:");
+       msdfs_link = talloc_strdup(conn, "msdfs:");
        if (!msdfs_link) {
                goto out;
        }
@@ -1329,43 +1213,71 @@ bool create_msdfs_link(const struct junction_map *jucn,
        DEBUG(5,("create_msdfs_link: Creating new msdfs link: %s -> %s\n",
                path, msdfs_link));
 
-       if(exists) {
-               if(SMB_VFS_UNLINK(conn,path)!=0) {
+       if(SMB_VFS_SYMLINK(conn, msdfs_link, path) < 0) {
+               if (errno == EEXIST) {
+                       struct smb_filename *smb_fname = NULL;
+                       NTSTATUS status;
+
+                       status = create_synthetic_smb_fname(talloc_tos(), path,
+                                                           NULL, NULL,
+                                                           &smb_fname);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               errno = map_errno_from_nt_status(status);
+                               goto out;
+                       }
+
+                       if(SMB_VFS_UNLINK(conn, smb_fname)!=0) {
+                               TALLOC_FREE(smb_fname);
+                               goto out;
+                       }
+                       TALLOC_FREE(smb_fname);
+               }
+               if (SMB_VFS_SYMLINK(conn, msdfs_link, path) < 0) {
+                       DEBUG(1,("create_msdfs_link: symlink failed "
+                                "%s -> %s\nError: %s\n",
+                                path, msdfs_link, strerror(errno)));
                        goto out;
                }
        }
 
-       if(SMB_VFS_SYMLINK(conn, msdfs_link, path) < 0) {
-               DEBUG(1,("create_msdfs_link: symlink failed "
-                       "%s -> %s\nError: %s\n", 
-                       path, msdfs_link, strerror(errno)));
-               goto out;
-       }
-
        ret = True;
 
 out:
-
-       conn_free_internal(conn);
+       vfs_ChDir(conn, cwd);
+       SMB_VFS_DISCONNECT(conn);
+       conn_free(conn);
        return ret;
 }
 
 bool remove_msdfs_link(const struct junction_map *jucn)
 {
        char *path = NULL;
-       connection_struct conns;
-       connection_struct *conn = &conns;
+       char *cwd;
+       connection_struct *conn;
        bool ret = False;
+       struct smb_filename *smb_fname = NULL;
+       NTSTATUS status;
 
-       ZERO_STRUCT(conns);
+       if (!junction_to_local_path(jucn, &path, &conn, &cwd)) {
+               return false;
+       }
 
-       if( junction_to_local_path(jucn, &path, conn) ) {
-               if( SMB_VFS_UNLINK(conn, path) == 0 ) {
-                       ret = True;
-               }
+       status = create_synthetic_smb_fname(talloc_tos(), path,
+                                           NULL, NULL,
+                                           &smb_fname);
+       if (!NT_STATUS_IS_OK(status)) {
+               errno = map_errno_from_nt_status(status);
+               return false;
+       }
+
+       if( SMB_VFS_UNLINK(conn, smb_fname) == 0 ) {
+               ret = True;
        }
 
-       conn_free_internal(conn);
+       TALLOC_FREE(smb_fname);
+       vfs_ChDir(conn, cwd);
+       SMB_VFS_DISCONNECT(conn);
+       conn_free(conn);
        return ret;
 }
 
@@ -1376,13 +1288,14 @@ bool remove_msdfs_link(const struct junction_map *jucn)
 static int count_dfs_links(TALLOC_CTX *ctx, int snum)
 {
        size_t cnt = 0;
-       SMB_STRUCT_DIR *dirp = NULL;
-       char *dname = NULL;
+       DIR *dirp = NULL;
+       const char *dname = NULL;
+       char *talloced = NULL;
        const char *connect_path = lp_pathname(snum);
        const char *msdfs_proxy = lp_msdfs_proxy(snum);
-       connection_struct conn;
-
-       ZERO_STRUCT(conn);
+       connection_struct *conn;
+       NTSTATUS status;
+       char *cwd;
 
        if(*connect_path == '\0') {
                return 0;
@@ -1392,8 +1305,11 @@ static int count_dfs_links(TALLOC_CTX *ctx, int snum)
         * Fake up a connection struct for the VFS layer.
         */
 
-       if (!NT_STATUS_IS_OK(create_conn_struct(talloc_tos(),
-                                       &conn, snum, connect_path))) {
+       status = create_conn_struct(talloc_tos(), smbd_server_conn, &conn,
+                                   snum, connect_path, NULL, &cwd);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(3, ("create_conn_struct failed: %s\n",
+                         nt_errstr(status)));
                return 0;
        }
 
@@ -1406,24 +1322,27 @@ static int count_dfs_links(TALLOC_CTX *ctx, int snum)
        }
 
        /* Now enumerate all dfs links */
-       dirp = SMB_VFS_OPENDIR(&conn, ".", NULL, 0);
+       dirp = SMB_VFS_OPENDIR(conn, ".", NULL, 0);
        if(!dirp) {
                goto out;
        }
 
-       while ((dname = vfs_readdirname(&conn, dirp)) != NULL) {
-               if (is_msdfs_link(&conn,
+       while ((dname = vfs_readdirname(conn, dirp, NULL, &talloced))
+              != NULL) {
+               if (is_msdfs_link(conn,
                                dname,
                                NULL)) {
                        cnt++;
                }
+               TALLOC_FREE(talloced);
        }
 
-       SMB_VFS_CLOSEDIR(&conn,dirp);
+       SMB_VFS_CLOSEDIR(conn,dirp);
 
 out:
-
-       conn_free_internal(&conn);
+       vfs_ChDir(conn, cwd);
+       SMB_VFS_DISCONNECT(conn);
+       conn_free(conn);
        return cnt;
 }
 
@@ -1436,15 +1355,16 @@ static int form_junctions(TALLOC_CTX *ctx,
                                size_t jn_remain)
 {
        size_t cnt = 0;
-       SMB_STRUCT_DIR *dirp = NULL;
-       char *dname = NULL;
+       DIR *dirp = NULL;
+       const char *dname = NULL;
+       char *talloced = NULL;
        const char *connect_path = lp_pathname(snum);
        char *service_name = lp_servicename(snum);
        const char *msdfs_proxy = lp_msdfs_proxy(snum);
-       connection_struct conn;
+       connection_struct *conn;
        struct referral *ref = NULL;
-
-       ZERO_STRUCT(conn);
+       char *cwd;
+       NTSTATUS status;
 
        if (jn_remain == 0) {
                return 0;
@@ -1458,7 +1378,11 @@ static int form_junctions(TALLOC_CTX *ctx,
         * Fake up a connection struct for the VFS layer.
         */
 
-       if (!NT_STATUS_IS_OK(create_conn_struct(ctx, &conn, snum, connect_path))) {
+       status = create_conn_struct(ctx, smbd_server_conn, &conn, snum, connect_path, NULL,
+                                   &cwd);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(3, ("create_conn_struct failed: %s\n",
+                         nt_errstr(status)));
                return 0;
        }
 
@@ -1468,12 +1392,13 @@ static int form_junctions(TALLOC_CTX *ctx,
        */
        jucn[cnt].service_name = talloc_strdup(ctx,service_name);
        jucn[cnt].volume_name = talloc_strdup(ctx, "");
-       if (!jucn[cnt].service_name || jucn[cnt].volume_name) {
+       if (!jucn[cnt].service_name || !jucn[cnt].volume_name) {
                goto out;
        }
+       jucn[cnt].comment = "";
        jucn[cnt].referral_count = 1;
 
-       ref = jucn[cnt].referral_list = TALLOC_ZERO_P(ctx, struct referral);
+       ref = jucn[cnt].referral_list = talloc_zero(ctx, struct referral);
        if (jucn[cnt].referral_list == NULL) {
                goto out;
        }
@@ -1501,21 +1426,22 @@ static int form_junctions(TALLOC_CTX *ctx,
        }
 
        /* Now enumerate all dfs links */
-       dirp = SMB_VFS_OPENDIR(&conn, ".", NULL, 0);
+       dirp = SMB_VFS_OPENDIR(conn, ".", NULL, 0);
        if(!dirp) {
                goto out;
        }
 
-       while ((dname = vfs_readdirname(&conn, dirp)) != NULL) {
+       while ((dname = vfs_readdirname(conn, dirp, NULL, &talloced))
+              != NULL) {
                char *link_target = NULL;
                if (cnt >= jn_remain) {
-                       SMB_VFS_CLOSEDIR(&conn,dirp);
                        DEBUG(2, ("form_junctions: ran out of MSDFS "
                                "junction slots"));
+                       TALLOC_FREE(talloced);
                        goto out;
                }
                if (is_msdfs_link_internal(ctx,
-                                       &conn,
+                                       conn,
                                        dname, &link_target,
                                        NULL)) {
                        if (parse_msdfs_symlink(ctx,
@@ -1529,20 +1455,25 @@ static int form_junctions(TALLOC_CTX *ctx,
                                                                dname);
                                if (!jucn[cnt].service_name ||
                                                !jucn[cnt].volume_name) {
+                                       TALLOC_FREE(talloced);
                                        goto out;
                                }
+                               jucn[cnt].comment = "";
                                cnt++;
                        }
+                       TALLOC_FREE(link_target);
                }
+               TALLOC_FREE(talloced);
        }
 
 out:
 
        if (dirp) {
-               SMB_VFS_CLOSEDIR(&conn,dirp);
+               SMB_VFS_CLOSEDIR(conn,dirp);
        }
 
-       conn_free_internal(&conn);
+       vfs_ChDir(conn, cwd);
+       conn_free(conn);
        return cnt;
 }
 
@@ -1561,7 +1492,7 @@ struct junction_map *enum_msdfs_links(TALLOC_CTX *ctx, size_t *p_num_jn)
        /* Ensure all the usershares are loaded. */
        become_root();
        load_registry_shares();
-       sharecount = load_usershare_shares();
+       sharecount = load_usershare_shares(NULL, connections_snum_used);
        unbecome_root();
 
        for(i=0;i < sharecount;i++) {
@@ -1572,7 +1503,7 @@ struct junction_map *enum_msdfs_links(TALLOC_CTX *ctx, size_t *p_num_jn)
        if (jn_count == 0) {
                return NULL;
        }
-       jn = TALLOC_ARRAY(ctx,  struct junction_map, jn_count);
+       jn = talloc_array(ctx,  struct junction_map, jn_count);
        if (!jn) {
                return NULL;
        }
@@ -1590,64 +1521,41 @@ struct junction_map *enum_msdfs_links(TALLOC_CTX *ctx, size_t *p_num_jn)
 }
 
 /******************************************************************************
- Core function to resolve a dfs pathname.
-******************************************************************************/
-
-NTSTATUS resolve_dfspath(TALLOC_CTX *ctx,
-                       connection_struct *conn,
-                       bool dfs_pathnames,
-                       const char *name_in,
-                       char **pp_name_out)
-{
-       NTSTATUS status = NT_STATUS_OK;
-       bool dummy;
-       if (dfs_pathnames) {
-               status = dfs_redirect(ctx,
-                                       conn,
-                                       name_in,
-                                       False,
-                                       pp_name_out,
-                                       &dummy);
-       } else {
-               /*
-                * Cheat and just return a copy of the in ptr.
-                * Once srvstr_get_path() uses talloc it'll
-                * be a talloced ptr anyway.
-                */
-               *pp_name_out = CONST_DISCARD(char *,name_in);
-       }
-       return status;
-}
-
-/******************************************************************************
- Core function to resolve a dfs pathname possibly containing a wildcard.
- This function is identical to the above except for the bool param to
- dfs_redirect but I need this to be separate so it's really clear when
- we're allowing wildcards and when we're not. JRA.
+ Core function to resolve a dfs pathname possibly containing a wildcard.  If
+ ppath_contains_wcard != NULL, it will be set to true if a wildcard is
+ detected during dfs resolution.
 ******************************************************************************/
 
 NTSTATUS resolve_dfspath_wcard(TALLOC_CTX *ctx,
                                connection_struct *conn,
                                bool dfs_pathnames,
                                const char *name_in,
+                               bool allow_wcards,
                                char **pp_name_out,
                                bool *ppath_contains_wcard)
 {
+       bool path_contains_wcard;
        NTSTATUS status = NT_STATUS_OK;
+
        if (dfs_pathnames) {
                status = dfs_redirect(ctx,
                                        conn,
                                        name_in,
-                                       True,
+                                       allow_wcards,
+                                       !smbd_server_conn->using_smb2,
                                        pp_name_out,
-                                       ppath_contains_wcard);
+                                       &path_contains_wcard);
+
+               if (NT_STATUS_IS_OK(status) && ppath_contains_wcard != NULL) {
+                       *ppath_contains_wcard = path_contains_wcard;
+               }
        } else {
                /*
                 * Cheat and just return a copy of the in ptr.
                 * Once srvstr_get_path() uses talloc it'll
                 * be a talloced ptr anyway.
                 */
-               *pp_name_out = CONST_DISCARD(char *,name_in);
+               *pp_name_out = discard_const_p(char, name_in);
        }
        return status;
 }