Fix bug 7950 - Samba 3.5.x fails BASE-CREATEX_SHAREMODES_DIR smbtorture4 test
[samba.git] / source3 / smbd / open.c
index 3e7b9d2657f592d475d1e6ba6589adac5498db7f..bd748f9661af75a2c49b6f3c212232aaf7d89502 100644 (file)
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "smbd/globals.h"
 
+extern struct current_user current_user;
 extern const struct generic_mapping file_generic_mapping;
 
 struct deferred_open_record {
@@ -49,11 +50,23 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
  SMB1 file varient of se_access_check. Never test FILE_READ_ATTRIBUTES.
 ****************************************************************************/
 
-NTSTATUS smb1_file_se_access_check(const struct security_descriptor *sd,
+NTSTATUS smb1_file_se_access_check(connection_struct *conn,
+                         const struct security_descriptor *sd,
                           const NT_USER_TOKEN *token,
                           uint32_t access_desired,
                           uint32_t *access_granted)
 {
+       *access_granted = 0;
+
+       if (conn->server_info->utok.uid == 0 || conn->admin_user) {
+               /* I'm sorry sir, I didn't know you were root... */
+               *access_granted = access_desired;
+               if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
+                       *access_granted |= FILE_GENERIC_ALL;
+               }
+               return NT_STATUS_OK;
+       }
+
        return se_access_check(sd,
                                token,
                                (access_desired & ~FILE_READ_ATTRIBUTES),
@@ -64,25 +77,14 @@ NTSTATUS smb1_file_se_access_check(const struct security_descriptor *sd,
  Check if we have open rights.
 ****************************************************************************/
 
-static NTSTATUS check_open_rights(struct connection_struct *conn,
+NTSTATUS smbd_check_open_rights(struct connection_struct *conn,
                                const struct smb_filename *smb_fname,
                                uint32_t access_mask,
                                uint32_t *access_granted)
 {
        /* Check if we have rights to open. */
        NTSTATUS status;
-       struct security_descriptor *sd;
-
-       *access_granted = 0;
-
-       if (conn->server_info->utok.uid == 0 || conn->admin_user) {
-               /* I'm sorry sir, I didn't know you were root... */
-               *access_granted = access_mask;
-               if (access_mask & SEC_FLAG_MAXIMUM_ALLOWED) {
-                       *access_granted |= FILE_GENERIC_ALL;
-               }
-               return NT_STATUS_OK;
-       }
+       struct security_descriptor *sd = NULL;
 
        status = SMB_VFS_GET_NT_ACL(conn, smb_fname->base_name,
                        (OWNER_SECURITY_INFORMATION |
@@ -90,27 +92,36 @@ static NTSTATUS check_open_rights(struct connection_struct *conn,
                        DACL_SECURITY_INFORMATION),&sd);
 
        if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(10, ("check_open_rights: Could not get acl "
+               DEBUG(10, ("smbd_check_open_rights: Could not get acl "
                        "on %s: %s\n",
                        smb_fname_str_dbg(smb_fname),
                        nt_errstr(status)));
                return status;
        }
 
-       status = smb1_file_se_access_check(sd,
+       status = smb1_file_se_access_check(conn,
+                               sd,
                                conn->server_info->ptok,
                                access_mask,
                                access_granted);
 
-       TALLOC_FREE(sd);
-
-       DEBUG(10,("check_open_rights: file %s requesting "
+       DEBUG(10,("smbd_check_open_rights: file %s requesting "
                "0x%x returning 0x%x (%s)\n",
                smb_fname_str_dbg(smb_fname),
                (unsigned int)access_mask,
                (unsigned int)*access_granted,
                nt_errstr(status) ));
 
+       if (!NT_STATUS_IS_OK(status)) {
+               if (DEBUGLEVEL >= 10) {
+                       DEBUG(10,("smbd_check_open_rights: acl for %s is:\n",
+                               smb_fname_str_dbg(smb_fname) ));
+                       NDR_PRINT_DEBUG(security_descriptor, sd);
+               }
+       }
+
+       TALLOC_FREE(sd);
+
        return status;
 }
 
@@ -119,11 +130,11 @@ static NTSTATUS check_open_rights(struct connection_struct *conn,
 ****************************************************************************/
 
 static NTSTATUS fd_open(struct connection_struct *conn,
-                   struct smb_filename *smb_fname,
                    files_struct *fsp,
                    int flags,
                    mode_t mode)
 {
+       struct smb_filename *smb_fname = fsp->fsp_name;
        NTSTATUS status = NT_STATUS_OK;
 
 #ifdef O_NOFOLLOW
@@ -218,13 +229,13 @@ void change_file_owner_to_parent(connection_struct *conn,
        if (ret == -1) {
                DEBUG(0,("change_file_owner_to_parent: failed to fchown "
                         "file %s to parent directory uid %u. Error "
-                        "was %s\n", fsp->fsp_name,
+                        "was %s\n", fsp_str_dbg(fsp),
                         (unsigned int)smb_fname_parent->st.st_ex_uid,
                         strerror(errno) ));
        }
 
        DEBUG(10,("change_file_owner_to_parent: changed new file %s to "
-                 "parent directory uid %u.\n", fsp->fsp_name,
+                 "parent directory uid %u.\n", fsp_str_dbg(fsp),
                  (unsigned int)smb_fname_parent->st.st_ex_uid));
 
        TALLOC_FREE(smb_fname_parent);
@@ -343,27 +354,20 @@ static NTSTATUS open_file(files_struct *fsp,
                          connection_struct *conn,
                          struct smb_request *req,
                          const char *parent_dir,
-                         struct smb_filename *smb_fname,
                          int flags,
                          mode_t unx_mode,
                          uint32 access_mask, /* client requested access mask. */
                          uint32 open_access_mask) /* what we're actually using in the open. */
 {
-       char *path = NULL;
+       struct smb_filename *smb_fname = fsp->fsp_name;
        NTSTATUS status = NT_STATUS_OK;
        int accmode = (flags & O_ACCMODE);
        int local_flags = flags;
-       bool file_existed = VALID_STAT(smb_fname->st);
+       bool file_existed = VALID_STAT(fsp->fsp_name->st);
 
        fsp->fh->fd = -1;
        errno = EPERM;
 
-       status = get_full_smb_filename(talloc_tos(), smb_fname,
-                                      &path);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
-       }
-
        /* Check permissions */
 
        /*
@@ -440,9 +444,9 @@ static NTSTATUS open_file(files_struct *fsp,
                         * wildcard characters are allowed in stream names
                         * only test the basefilename
                         */
-                       wild = fsp->base_fsp->fsp_name;
+                       wild = fsp->base_fsp->fsp_name->base_name;
                } else {
-                       wild = path;
+                       wild = smb_fname->base_name;
                }
                if ((local_flags & O_CREAT) && !file_existed &&
                    ms_has_wild(wild))  {
@@ -450,7 +454,7 @@ static NTSTATUS open_file(files_struct *fsp,
                }
 
                /* Actually do the open */
-               status = fd_open(conn, smb_fname, fsp, local_flags, unx_mode);
+               status = fd_open(conn, fsp, local_flags, unx_mode);
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(3,("Error opening file %s (%s) (local_flags=%d) "
                                 "(flags=%d)\n", smb_fname_str_dbg(smb_fname),
@@ -462,8 +466,9 @@ static NTSTATUS open_file(files_struct *fsp,
 
                        /* Inherit the ACL if required */
                        if (lp_inherit_perms(SNUM(conn))) {
-                               inherit_access_posix_acl(conn, parent_dir, path,
-                                                  unx_mode);
+                               inherit_access_posix_acl(conn, parent_dir,
+                                                        smb_fname->base_name,
+                                                        unx_mode);
                        }
 
                        /* Change the owner if required. */
@@ -473,7 +478,8 @@ static NTSTATUS open_file(files_struct *fsp,
                        }
 
                        notify_fname(conn, NOTIFY_ACTION_ADDED,
-                                    FILE_NOTIFY_CHANGE_FILE_NAME, path);
+                                    FILE_NOTIFY_CHANGE_FILE_NAME,
+                                    smb_fname->base_name);
                }
 
        } else {
@@ -481,7 +487,7 @@ static NTSTATUS open_file(files_struct *fsp,
                if (file_existed) {
                        uint32_t access_granted = 0;
 
-                       status = check_open_rights(conn,
+                       status = smbd_check_open_rights(conn,
                                        smb_fname,
                                        access_mask,
                                        &access_granted);
@@ -551,7 +557,7 @@ static NTSTATUS open_file(files_struct *fsp,
                                                          smb_fname)));
                                } else {
                                        DEBUG(10,("open_file: "
-                                                 "check_open_rights on file "
+                                                 "smbd_check_open_rights on file "
                                                  "%s returned %s\n",
                                                  smb_fname_str_dbg(smb_fname),
                                                  nt_errstr(status) ));
@@ -619,12 +625,11 @@ static NTSTATUS open_file(files_struct *fsp,
                fsp->aio_write_behind = True;
        }
 
-       string_set(&fsp->fsp_name, path);
        fsp->wcp = NULL; /* Write cache pointer. */
 
        DEBUG(2,("%s opened file %s read=%s write=%s (numopen=%d)\n",
                 conn->server_info->unix_name,
-                fsp->fsp_name,
+                smb_fname_str_dbg(smb_fname),
                 BOOLSTR(fsp->can_read), BOOLSTR(fsp->can_write),
                 conn->num_files_open));
 
@@ -791,7 +796,8 @@ static void validate_my_share_entries(int num,
                str = talloc_asprintf(talloc_tos(),
                        "validate_my_share_entries: "
                        "file %s, oplock_type = 0x%x, op_type = 0x%x\n",
-                        fsp->fsp_name, (unsigned int)fsp->oplock_type,
+                        fsp->fsp_name->base_name,
+                        (unsigned int)fsp->oplock_type,
                         (unsigned int)share_entry->op_type );
                smb_panic(str);
        }
@@ -1025,7 +1031,7 @@ static bool delay_for_oplocks(struct share_mode_lock *lck,
        }
 
        DEBUG(10,("delay_for_oplocks: oplock type 0x%x on file %s\n",
-               fsp->oplock_type, fsp->fsp_name));
+                 fsp->oplock_type, fsp_str_dbg(fsp)));
 
        /* No delay. */
        return false;
@@ -1148,13 +1154,6 @@ NTSTATUS fcb_or_dos_open(struct smb_request *req,
                                     uint32 create_options)
 {
        files_struct *fsp;
-       char *fname = NULL;
-       NTSTATUS status;
-
-       status = get_full_smb_filename(talloc_tos(), smb_fname, &fname);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
-       }
 
        DEBUG(5,("fcb_or_dos_open: attempting old open semantics for "
                 "file %s.\n", smb_fname_str_dbg(smb_fname)));
@@ -1164,7 +1163,7 @@ NTSTATUS fcb_or_dos_open(struct smb_request *req,
 
                DEBUG(10,("fcb_or_dos_open: checking file %s, fd = %d, "
                          "vuid = %u, file_pid = %u, private_options = 0x%x "
-                         "access_mask = 0x%x\n", fsp->fsp_name,
+                         "access_mask = 0x%x\n", fsp_str_dbg(fsp),
                          fsp->fh->fd, (unsigned int)fsp->vuid,
                          (unsigned int)fsp->file_pid,
                          (unsigned int)fsp->fh->private_options,
@@ -1176,7 +1175,9 @@ NTSTATUS fcb_or_dos_open(struct smb_request *req,
                    (fsp->fh->private_options & (NTCREATEX_OPTIONS_PRIVATE_DENY_DOS |
                                                 NTCREATEX_OPTIONS_PRIVATE_DENY_FCB)) &&
                    (fsp->access_mask & FILE_WRITE_DATA) &&
-                   strequal(fsp->fsp_name, fname)) {
+                   strequal(fsp->fsp_name->base_name, smb_fname->base_name) &&
+                   strequal(fsp->fsp_name->stream_name,
+                            smb_fname->stream_name)) {
                        DEBUG(10,("fcb_or_dos_open: file match\n"));
                        break;
                }
@@ -1194,17 +1195,16 @@ NTSTATUS fcb_or_dos_open(struct smb_request *req,
        }
 
        /* We need to duplicate this fsp. */
-       dup_file_fsp(req, fsp, access_mask, share_access,
-                       create_options, fsp_to_dup_into);
-
-       return NT_STATUS_OK;
+       return dup_file_fsp(req, fsp, access_mask, share_access,
+                           create_options, fsp_to_dup_into);
 }
 
 /****************************************************************************
  Open a file with a share mode - old openX method - map into NTCreate.
 ****************************************************************************/
 
-bool map_open_params_to_ntcreate(const char *fname, int deny_mode, int open_func,
+bool map_open_params_to_ntcreate(const struct smb_filename *smb_fname,
+                                int deny_mode, int open_func,
                                 uint32 *paccess_mask,
                                 uint32 *pshare_mode,
                                 uint32 *pcreate_disposition,
@@ -1217,7 +1217,8 @@ bool map_open_params_to_ntcreate(const char *fname, int deny_mode, int open_func
 
        DEBUG(10,("map_open_params_to_ntcreate: fname = %s, deny_mode = 0x%x, "
                  "open_func = 0x%x\n",
-                 fname, (unsigned int)deny_mode, (unsigned int)open_func ));
+                 smb_fname_str_dbg(smb_fname), (unsigned int)deny_mode,
+                 (unsigned int)open_func ));
 
        /* Create the NT compatible access_mask. */
        switch (GET_OPENX_MODE(deny_mode)) {
@@ -1291,7 +1292,7 @@ bool map_open_params_to_ntcreate(const char *fname, int deny_mode, int open_func
 
                case DENY_DOS:
                        create_options |= NTCREATEX_OPTIONS_PRIVATE_DENY_DOS;
-                       if (is_executable(fname)) {
+                       if (is_executable(smb_fname->base_name)) {
                                share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
                        } else {
                                if (GET_OPENX_MODE(deny_mode) == DOS_OPEN_RDONLY) {
@@ -1316,7 +1317,7 @@ bool map_open_params_to_ntcreate(const char *fname, int deny_mode, int open_func
        DEBUG(10,("map_open_params_to_ntcreate: file %s, access_mask = 0x%x, "
                  "share_mode = 0x%x, create_disposition = 0x%x, "
                  "create_options = 0x%x\n",
-                 fname,
+                 smb_fname_str_dbg(smb_fname),
                  (unsigned int)access_mask,
                  (unsigned int)share_mode,
                  (unsigned int)create_disposition,
@@ -1414,7 +1415,8 @@ static NTSTATUS calculate_access_mask(connection_struct *conn,
                                return NT_STATUS_ACCESS_DENIED;
                        }
 
-                       status = smb1_file_se_access_check(sd,
+                       status = smb1_file_se_access_check(conn,
+                                       sd,
                                        conn->server_info->ptok,
                                        access_mask,
                                        &access_granted);
@@ -1444,7 +1446,6 @@ static NTSTATUS calculate_access_mask(connection_struct *conn,
 
 static NTSTATUS open_file_ntcreate(connection_struct *conn,
                            struct smb_request *req,
-                           struct smb_filename *smb_fname,
                            uint32 access_mask,         /* access bits (FILE_READ_DATA etc.) */
                            uint32 share_access,        /* share constants (FILE_SHARE_READ etc) */
                            uint32 create_disposition,  /* FILE_OPEN_IF etc. */
@@ -1455,6 +1456,7 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
                            int *pinfo,
                            files_struct *fsp)
 {
+       struct smb_filename *smb_fname = fsp->fsp_name;
        int flags=0;
        int flags2=0;
        bool file_existed = VALID_STAT(smb_fname->st);
@@ -1473,11 +1475,16 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
        struct share_mode_lock *lck = NULL;
        uint32 open_access_mask = access_mask;
        NTSTATUS status;
-       int ret_flock;
        char *parent_dir;
 
        ZERO_STRUCT(id);
 
+       /* Windows allows a new file to be created and
+          silently removes a FILE_ATTRIBUTE_DIRECTORY
+          sent by the client. Do the same. */
+
+       new_dos_attributes &= ~FILE_ATTRIBUTE_DIRECTORY;
+
        if (conn->printer) {
                /*
                 * Printers are handled completely differently.
@@ -1498,7 +1505,7 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
                }
 
                return print_fsp_open(req, conn, smb_fname->base_name,
-                                     req->vuid, fsp, &smb_fname->st);
+                                     req->vuid, fsp);
        }
 
        if (!parent_dirname(talloc_tos(), smb_fname->base_name, &parent_dir,
@@ -1960,7 +1967,7 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
 
         if ((flags2 & O_CREAT) && lp_inherit_acls(SNUM(conn)) &&
            (def_acl = directory_has_default_acl(conn, parent_dir))) {
-               unx_mode = 0777;
+               unx_mode = (0777 & lp_create_mask(SNUM(conn)));
        }
 
        DEBUG(4,("calling open_file with flags=0x%X flags2=0x%X mode=0%o, "
@@ -1973,7 +1980,7 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
         * open_file strips any O_TRUNC flags itself.
         */
 
-       fsp_open = open_file(fsp, conn, req, parent_dir, smb_fname,
+       fsp_open = open_file(fsp, conn, req, parent_dir,
                             flags|flags2, unx_mode, access_mask,
                             open_access_mask);
 
@@ -2094,7 +2101,8 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
           note that GPFS supports it as well - jmcd */
 
        if (fsp->fh->fd != -1) {
-               ret_flock = SMB_VFS_KERNEL_FLOCK(fsp, share_access);
+               int ret_flock;
+               ret_flock = SMB_VFS_KERNEL_FLOCK(fsp, share_access, access_mask);
                if(ret_flock == -1 ){
 
                        TALLOC_FREE(lck);
@@ -2175,7 +2183,7 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
        /* Handle strange delete on close create semantics. */
        if (create_options & FILE_DELETE_ON_CLOSE) {
 
-               status = can_set_delete_on_close(fsp, True, new_dos_attributes);
+               status = can_set_delete_on_close(fsp, new_dos_attributes);
 
                if (!NT_STATUS_IS_OK(status)) {
                        /* Remember to delete the mode we just added. */
@@ -2263,23 +2271,15 @@ static NTSTATUS open_file_ntcreate(connection_struct *conn,
  Open a file for for write to ensure that we can fchmod it.
 ****************************************************************************/
 
-NTSTATUS open_file_fchmod(struct smb_request *req, connection_struct *conn,
+NTSTATUS open_file_fchmod(connection_struct *conn,
                          struct smb_filename *smb_fname,
                          files_struct **result)
 {
-       files_struct *fsp = NULL;
-       NTSTATUS status;
-
        if (!VALID_STAT(smb_fname->st)) {
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       status = file_new(req, conn, &fsp);
-       if(!NT_STATUS_IS_OK(status)) {
-               return status;
-       }
-
-        status = SMB_VFS_CREATE_FILE(
+        return SMB_VFS_CREATE_FILE(
                conn,                                   /* conn */
                NULL,                                   /* req */
                0,                                      /* root_dir_fid */
@@ -2290,36 +2290,12 @@ NTSTATUS open_file_fchmod(struct smb_request *req, connection_struct *conn,
                FILE_OPEN,                              /* create_disposition*/
                0,                                      /* create_options */
                0,                                      /* file_attributes */
-               0,                                      /* oplock_request */
+               INTERNAL_OPEN_ONLY,                     /* oplock_request */
                0,                                      /* allocation_size */
                NULL,                                   /* sd */
                NULL,                                   /* ea_list */
-               &fsp,                                   /* result */
+               result,                                 /* result */
                NULL);                                  /* pinfo */
-
-       /*
-        * This is not a user visible file open.
-        * Don't set a share mode.
-        */
-
-       if (!NT_STATUS_IS_OK(status)) {
-               file_free(req, fsp);
-               return status;
-       }
-
-       *result = fsp;
-       return NT_STATUS_OK;
-}
-
-/****************************************************************************
- Close the fchmod file fd - ensure no locks are lost.
-****************************************************************************/
-
-NTSTATUS close_file_fchmod(struct smb_request *req, files_struct *fsp)
-{
-       NTSTATUS status = fd_close(fsp);
-       file_free(req, fsp);
-       return status;
 }
 
 static NTSTATUS mkdir_internal(connection_struct *conn,
@@ -2386,7 +2362,7 @@ static NTSTATUS mkdir_internal(connection_struct *conn,
                                         smb_dname->base_name, mode);
        }
 
-       if (!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
+       if (!posix_open) {
                /*
                 * Check if high bits should have been set,
                 * then (if bits are missing): add them.
@@ -2438,6 +2414,9 @@ static NTSTATUS open_directory(connection_struct *conn,
 
        SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
 
+       /* Ensure we have a directory attribute. */
+       file_attributes |= FILE_ATTRIBUTE_DIRECTORY;
+
        DEBUG(5,("open_directory: opening directory %s, access_mask = 0x%x, "
                 "share_access = 0x%x create_options = 0x%x, "
                 "create_disposition = 0x%x, file_attributes = 0x%x\n",
@@ -2466,8 +2445,8 @@ static NTSTATUS open_directory(connection_struct *conn,
                return status;
        }
 
-       /* We need to support SeSecurityPrivilege for this. */
-       if (access_mask & SEC_FLAG_SYSTEM_SECURITY) {
+       if ((access_mask & SEC_FLAG_SYSTEM_SECURITY) &&
+                       !user_has_privileges(current_user.nt_user_token, &se_security)) {
                DEBUG(10, ("open_directory: open on %s "
                        "failed - SEC_FLAG_SYSTEM_SECURITY denied.\n",
                        smb_fname_str_dbg(smb_dname)));
@@ -2548,8 +2527,8 @@ static NTSTATUS open_directory(connection_struct *conn,
 
        if (info == FILE_WAS_OPENED) {
                uint32_t access_granted = 0;
-               status = check_open_rights(conn, smb_dname, access_mask,
-                                          &access_granted);
+               status = smbd_check_open_rights(conn, smb_dname, access_mask,
+                                               &access_granted);
 
                /* Were we trying to do a directory open
                 * for delete and didn't get DELETE
@@ -2570,7 +2549,7 @@ static NTSTATUS open_directory(connection_struct *conn,
                }
 
                if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(10, ("open_directory: check_open_rights on "
+                       DEBUG(10, ("open_directory: smbd_check_open_rights on "
                                "file %s failed with %s\n",
                                smb_fname_str_dbg(smb_dname),
                                nt_errstr(status)));
@@ -2607,8 +2586,10 @@ static NTSTATUS open_directory(connection_struct *conn,
        fsp->sent_oplock_break = NO_BREAK_SENT;
        fsp->is_directory = True;
        fsp->posix_open = (file_attributes & FILE_FLAG_POSIX_SEMANTICS) ? True : False;
-
-       string_set(&fsp->fsp_name, smb_dname->base_name);
+       status = fsp_set_smb_fname(fsp, smb_dname);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
 
        mtimespec = smb_dname->st.st_ex_mtime;
 
@@ -2636,7 +2617,7 @@ static NTSTATUS open_directory(connection_struct *conn,
        /* For directories the delete on close bit at open time seems
           always to be honored on close... See test 19 in Samba4 BASE-DELETE. */
        if (create_options & FILE_DELETE_ON_CLOSE) {
-               status = can_set_delete_on_close(fsp, True, 0);
+               status = can_set_delete_on_close(fsp, 0);
                if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, NT_STATUS_DIRECTORY_NOT_EMPTY)) {
                        TALLOC_FREE(lck);
                        file_free(req, fsp);
@@ -2726,6 +2707,11 @@ void msg_file_was_renamed(struct messaging_context *msg,
        bn_len = strlen(base_name);
        stream_name = sharepath + sp_len + 1 + bn_len + 1;
 
+       /* stream_name must always be NULL if there is no stream. */
+       if (stream_name[0] == '\0') {
+               stream_name = NULL;
+       }
+
        status = create_synthetic_smb_fname(talloc_tos(), base_name,
                                            stream_name, NULL, &smb_fname);
        if (!NT_STATUS_IS_OK(status)) {
@@ -2739,18 +2725,14 @@ void msg_file_was_renamed(struct messaging_context *msg,
 
        for(fsp = file_find_di_first(id); fsp; fsp = file_find_di_next(fsp)) {
                if (memcmp(fsp->conn->connectpath, sharepath, sp_len) == 0) {
-                       char *newname = NULL;
 
                        DEBUG(10,("msg_file_was_renamed: renaming file fnum %d from %s -> %s\n",
-                               fsp->fnum, fsp->fsp_name,
+                               fsp->fnum, fsp_str_dbg(fsp),
                                smb_fname_str_dbg(smb_fname)));
-                       status = get_full_smb_filename(talloc_tos(),
-                                                      smb_fname, &newname);
+                       status = fsp_set_smb_fname(fsp, smb_fname);
                        if (!NT_STATUS_IS_OK(status)) {
                                goto out;
                        }
-                       string_set(&fsp->fsp_name, newname);
-                       TALLOC_FREE(newname);
                } else {
                        /* TODO. JRA. */
                        /* Now we have the complete path we can work out if this is
@@ -2761,7 +2743,7 @@ void msg_file_was_renamed(struct messaging_context *msg,
                                fsp->conn->connectpath,
                                sharepath,
                                fsp->fnum,
-                               fsp->fsp_name,
+                               fsp_str_dbg(fsp),
                                smb_fname_str_dbg(smb_fname)));
                }
         }
@@ -2770,52 +2752,6 @@ void msg_file_was_renamed(struct messaging_context *msg,
        return;
 }
 
-struct case_semantics_state {
-       connection_struct *conn;
-       bool case_sensitive;
-       bool case_preserve;
-       bool short_case_preserve;
-};
-
-/****************************************************************************
- Restore case semantics.
-****************************************************************************/
-static int restore_case_semantics(struct case_semantics_state *state)
-{
-       state->conn->case_sensitive = state->case_sensitive;
-       state->conn->case_preserve = state->case_preserve;
-       state->conn->short_case_preserve = state->short_case_preserve;
-       return 0;
-}
-
-/****************************************************************************
- Save case semantics.
-****************************************************************************/
-struct case_semantics_state *set_posix_case_semantics(TALLOC_CTX *mem_ctx,
-                                                     connection_struct *conn)
-{
-       struct case_semantics_state *result;
-
-       if (!(result = talloc(mem_ctx, struct case_semantics_state))) {
-               DEBUG(0, ("talloc failed\n"));
-               return NULL;
-       }
-
-       result->conn = conn;
-       result->case_sensitive = conn->case_sensitive;
-       result->case_preserve = conn->case_preserve;
-       result->short_case_preserve = conn->short_case_preserve;
-
-       /* Set to POSIX. */
-       conn->case_sensitive = True;
-       conn->case_preserve = True;
-       conn->short_case_preserve = True;
-
-       talloc_set_destructor(result, restore_case_semantics);
-
-       return result;
-}
-
 /*
  * If a main file is opened for delete, all streams need to be checked for
  * !FILE_SHARE_DELETE. Do this by opening with DELETE_ACCESS.
@@ -2922,7 +2858,7 @@ NTSTATUS open_streams_for_delete(connection_struct *conn,
                }
 
                DEBUG(10, ("Closing stream # %d, %s\n", i,
-                          streams[i]->fsp_name));
+                          fsp_str_dbg(streams[i])));
                close_file(NULL, streams[i], NORMAL_CLOSE);
        }
 
@@ -3019,29 +2955,14 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
                goto fail;
        }
 
-#if 0
-       /* We need to support SeSecurityPrivilege for this. */
        if ((access_mask & SEC_FLAG_SYSTEM_SECURITY) &&
-           !user_has_privileges(current_user.nt_user_token,
-                                &se_security)) {
-               status = NT_STATUS_PRIVILEGE_NOT_HELD;
-               goto fail;
-       }
-#else
-       /* We need to support SeSecurityPrivilege for this. */
-       if (access_mask & SEC_FLAG_SYSTEM_SECURITY) {
-               status = NT_STATUS_PRIVILEGE_NOT_HELD;
-               goto fail;
-       }
-       /* Don't allow a SACL set from an NTtrans create until we
-        * support SeSecurityPrivilege. */
-       if (!VALID_STAT(smb_fname->st) &&
-                       lp_nt_acl_support(SNUM(conn)) &&
-                       sd && (sd->sacl != NULL)) {
+                       !user_has_privileges(current_user.nt_user_token, &se_security)) {
+               DEBUG(10, ("create_file_unixpath:: open on %s "
+                       "failed - SEC_FLAG_SYSTEM_SECURITY denied.\n",
+                       smb_fname_str_dbg(smb_fname)));
                status = NT_STATUS_PRIVILEGE_NOT_HELD;
                goto fail;
        }
-#endif
 
        if ((conn->fs_capabilities & FILE_NAMED_STREAMS)
            && is_ntfs_stream_smb_fname(smb_fname)
@@ -3137,6 +3058,11 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
                        goto fail;
                }
 
+               status = fsp_set_smb_fname(fsp, smb_fname);
+               if (!NT_STATUS_IS_OK(status)) {
+                       goto fail;
+               }
+
                /*
                 * We're opening the stream element of a base_fsp
                 * we already opened. Set up the base_fsp pointer.
@@ -3147,7 +3073,6 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
 
                status = open_file_ntcreate(conn,
                                            req,
-                                           smb_fname,
                                            access_mask,
                                            share_access,
                                            create_disposition,
@@ -3237,13 +3162,13 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
 
        if ((ea_list != NULL) &&
            ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN))) {
-               status = set_ea(conn, fsp, smb_fname, ea_list);
+               status = set_ea(conn, fsp, fsp->fsp_name, ea_list);
                if (!NT_STATUS_IS_OK(status)) {
                        goto fail;
                }
        }
 
-       if (!fsp->is_directory && S_ISDIR(smb_fname->st.st_ex_mode)) {
+       if (!fsp->is_directory && S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
                status = NT_STATUS_ACCESS_DENIED;
                goto fail;
        }
@@ -3251,7 +3176,7 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
        /* Save the requested allocation size. */
        if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
                if (allocation_size
-                   && (allocation_size > smb_fname->st.st_ex_size)) {
+                   && (allocation_size > fsp->fsp_name->st.st_ex_size)) {
                        fsp->initial_allocation_size = smb_roundup(
                                fsp->conn, allocation_size);
                        if (fsp->is_directory) {
@@ -3266,7 +3191,7 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
                        }
                } else {
                        fsp->initial_allocation_size = smb_roundup(
-                               fsp->conn, (uint64_t)smb_fname->st.st_ex_size);
+                               fsp->conn, (uint64_t)fsp->fsp_name->st.st_ex_size);
                }
        }
 
@@ -3276,9 +3201,9 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
        if (pinfo != NULL) {
                *pinfo = info;
        }
-       if ((fsp->fh != NULL) && (fsp->fh->fd != -1)) {
-               SMB_VFS_FSTAT(fsp, &smb_fname->st);
-       }
+
+       smb_fname->st = fsp->fsp_name->st;
+
        return NT_STATUS_OK;
 
  fail:
@@ -3308,7 +3233,8 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
 NTSTATUS get_relative_fid_filename(connection_struct *conn,
                                   struct smb_request *req,
                                   uint16_t root_dir_fid,
-                                  struct smb_filename *smb_fname)
+                                  const struct smb_filename *smb_fname,
+                                  struct smb_filename **smb_fname_out)
 {
        files_struct *dir_fsp;
        char *parent_fname = NULL;
@@ -3327,6 +3253,11 @@ NTSTATUS get_relative_fid_filename(connection_struct *conn,
                goto out;
        }
 
+       if (is_ntfs_stream_smb_fname(dir_fsp->fsp_name)) {
+               status = NT_STATUS_INVALID_HANDLE;
+               goto out;
+       }
+
        if (!dir_fsp->is_directory) {
 
                /*
@@ -3350,7 +3281,7 @@ NTSTATUS get_relative_fid_filename(connection_struct *conn,
                goto out;
        }
 
-       if (ISDOT(dir_fsp->fsp_name)) {
+       if (ISDOT(dir_fsp->fsp_name->base_name)) {
                /*
                 * We're at the toplevel dir, the final file name
                 * must not contain ./, as this is filtered out
@@ -3363,7 +3294,7 @@ NTSTATUS get_relative_fid_filename(connection_struct *conn,
                        goto out;
                }
        } else {
-               size_t dir_name_len = strlen(dir_fsp->fsp_name);
+               size_t dir_name_len = strlen(dir_fsp->fsp_name->base_name);
 
                /*
                 * Copy in the base directory name.
@@ -3375,7 +3306,7 @@ NTSTATUS get_relative_fid_filename(connection_struct *conn,
                        status = NT_STATUS_NO_MEMORY;
                        goto out;
                }
-               memcpy(parent_fname, dir_fsp->fsp_name,
+               memcpy(parent_fname, dir_fsp->fsp_name->base_name,
                    dir_name_len+1);
 
                /*
@@ -3391,16 +3322,23 @@ NTSTATUS get_relative_fid_filename(connection_struct *conn,
                }
        }
 
-       new_base_name = talloc_asprintf(smb_fname, "%s%s", parent_fname,
+       new_base_name = talloc_asprintf(talloc_tos(), "%s%s", parent_fname,
                                        smb_fname->base_name);
        if (new_base_name == NULL) {
                status = NT_STATUS_NO_MEMORY;
                goto out;
        }
 
-       TALLOC_FREE(smb_fname->base_name);
-       smb_fname->base_name = new_base_name;
-       status = NT_STATUS_OK;
+       status = filename_convert(req,
+                               conn,
+                               req->flags2 & FLAGS2_DFS_PATHNAMES,
+                               new_base_name,
+                               0,
+                               NULL,
+                               smb_fname_out);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto out;
+       }
 
  out:
        TALLOC_FREE(parent_fname);
@@ -3447,11 +3385,13 @@ NTSTATUS create_file_default(connection_struct *conn,
         */
 
        if (root_dir_fid != 0) {
+               struct smb_filename *smb_fname_out = NULL;
                status = get_relative_fid_filename(conn, req, root_dir_fid,
-                                                  smb_fname);
+                                                  smb_fname, &smb_fname_out);
                if (!NT_STATUS_IS_OK(status)) {
                        goto fail;
                }
+               smb_fname = smb_fname_out;
        }
 
        /*
@@ -3459,16 +3399,9 @@ NTSTATUS create_file_default(connection_struct *conn,
         */
 
        if (is_ntfs_stream_smb_fname(smb_fname)) {
-               char *fname = NULL;
                enum FAKE_FILE_TYPE fake_file_type;
 
-               status = get_full_smb_filename(talloc_tos(), smb_fname,
-                                              &fname);
-               if (!NT_STATUS_IS_OK(status)) {
-                       goto fail;
-               }
-
-               fake_file_type = is_fake_file(fname);
+               fake_file_type = is_fake_file(smb_fname);
 
                if (fake_file_type != FAKE_FILE_TYPE_NONE) {
 
@@ -3484,9 +3417,8 @@ NTSTATUS create_file_default(connection_struct *conn,
                         * close it
                         */
                        status = open_fake_file(req, conn, req->vuid,
-                                               fake_file_type, fname,
+                                               fake_file_type, smb_fname,
                                                access_mask, &fsp);
-                       TALLOC_FREE(fname);
                        if (!NT_STATUS_IS_OK(status)) {
                                goto fail;
                        }
@@ -3494,7 +3426,6 @@ NTSTATUS create_file_default(connection_struct *conn,
                        ZERO_STRUCT(smb_fname->st);
                        goto done;
                }
-               TALLOC_FREE(fname);
 
                if (!(conn->fs_capabilities & FILE_NAMED_STREAMS)) {
                        status = NT_STATUS_OBJECT_NAME_NOT_FOUND;