r6633: Added "check_path_syntax_posix()" in preparation for handling
[samba.git] / source3 / smbd / reply.c
index f5c4f25e408e46394bdb64f691df0dd5c9e32d9a..e1131c56ed59bc5c478b202b0878ac03bba5dd4c 100644 (file)
 #include "includes.h"
 
 /* look in server.c for some explanation of these variables */
-extern int Protocol;
+extern enum protocol_types Protocol;
 extern int max_send;
 extern int max_recv;
-extern char magic_char;
-extern BOOL case_sensitive;
-extern BOOL case_preserve;
-extern BOOL short_case_preserve;
 extern int global_oplock_break;
 unsigned int smb_echo_count = 0;
+extern uint32 global_client_caps;
 
+extern struct current_user current_user;
 extern BOOL global_encrypted_passwords_negotiated;
 
 /****************************************************************************
- Ensure we check the path in *exactly* the same way as W2K.
+ Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
  We're assuming here that '/' is not the second byte in any multibyte char
  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  set.
@@ -51,6 +49,8 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
        char *d = destname;
        const char *s = srcname;
        NTSTATUS ret = NT_STATUS_OK;
+       BOOL start_of_name_component = True;
+       unsigned int num_bad_components = 0;
 
        while (*s) {
                if (IS_DIRECTORY_SEP(*s)) {
@@ -65,74 +65,311 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
                                /* We only care about non-leading or trailing '/' or '\\' */
                                *d++ = '/';
                        }
-               } else if ((s[0] == '.') && (s[1] == '.') && (IS_DIRECTORY_SEP(s[2]) || s[2] == '\0')) {
-                       /* Uh oh - "../" or "..\\"  or "..\0" ! */
 
-                       /*
-                        * No mb char starts with '.' so we're safe checking the directory separator here.
-                        */
+                       start_of_name_component = True;
+                       continue;
+               }
+
+               if (start_of_name_component) {
+                       if ((s[0] == '.') && (s[1] == '.') && (IS_DIRECTORY_SEP(s[2]) || s[2] == '\0')) {
+                               /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 
-                       /* If we just added a '/', delete it. */
+                               /*
+                                * No mb char starts with '.' so we're safe checking the directory separator here.
+                                */
 
-                       if ((d > destname) && (*(d-1) == '/')) {
-                               *(d-1) = '\0';
-                               if (d == (destname + 1)) {
+                               /* If  we just added a '/' - delete it */
+                               if ((d > destname) && (*(d-1) == '/')) {
+                                       *(d-1) = '\0';
                                        d--;
-                               } else {
-                                       d -= 2;
                                }
+
+                               /* Are we at the start ? Can't go back further if so. */
+                               if (d <= destname) {
+                                       ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
+                                       break;
+                               }
+                               /* Go back one level... */
+                               /* We know this is safe as '/' cannot be part of a mb sequence. */
+                               /* NOTE - if this assumption is invalid we are not in good shape... */
+                               /* Decrement d first as d points to the *next* char to write into. */
+                               for (d--; d > destname; d--) {
+                                       if (*d == '/')
+                                               break;
+                               }
+                               s += 2; /* Else go past the .. */
+                               /* We're still at the start of a name component, just the previous one. */
+
+                               if (num_bad_components) {
+                                       /* Hmmm. Should we only decrement the bad_components if
+                                          we're removing a bad component ? Need to check this. JRA. */
+                                       num_bad_components--;
+                               }
+
+                               continue;
+
+                       } else if ((s[0] == '.') && ((s[1] == '\0') || IS_DIRECTORY_SEP(s[1]))) {
+                               /* Component of pathname can't be "." only. */
+                               ret =  NT_STATUS_OBJECT_NAME_INVALID;
+                               num_bad_components++;
+                               *d++ = *s++;
+                               continue;
                        }
-                       /* Are we at the start ? Can't go back further if so. */
-                       if (d == destname) {
-                               return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
+               }
+
+               if (!(*s & 0x80)) {
+                       switch (*s) {
+                               case '*':
+                               case '?':
+                               case '<':
+                               case '>':
+                               case '"':
+                                       return NT_STATUS_OBJECT_NAME_INVALID;
+                               default:
+                                       *d++ = *s++;
+                                       break;
                        }
-                       /* Go back one level... */
-                       /* We know this is safe as '/' cannot be part of a mb sequence. */
-                       /* NOTE - if this assumption is invalid we are not in good shape... */
-                       while (d > destname) {
-                               if (*d == '/')
+               } else {
+                       switch(next_mb_char_size(s)) {
+                               case 4:
+                                       *d++ = *s++;
+                               case 3:
+                                       *d++ = *s++;
+                               case 2:
+                                       *d++ = *s++;
+                               case 1:
+                                       *d++ = *s++;
                                        break;
-                               d--;
+                               default:
+                                       DEBUG(0,("check_path_syntax: character length assumptions invalid !\n"));
+                                       *d = '\0';
+                                       return NT_STATUS_INVALID_PARAMETER;
                        }
-                       s += 3;
-               } else if ((s[0] == '.') && IS_DIRECTORY_SEP(s[1])) {
+               }
+               if (start_of_name_component && num_bad_components) {
+                       num_bad_components++;
+               }
+               start_of_name_component = False;
+       }
+
+       if (NT_STATUS_EQUAL(ret, NT_STATUS_OBJECT_NAME_INVALID)) {
+               if (num_bad_components > 1) {
+                       ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+               }
+       }
+
+       *d = '\0';
+       return ret;
+}
+
+/****************************************************************************
+ Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
+ path or anything including wildcards.
+ We're assuming here that '/' is not the second byte in any multibyte char
+ set (a safe assumption). '\\' *may* be the second byte in a multibyte char
+ set.
+****************************************************************************/
+
+NTSTATUS check_path_syntax_wcard(pstring destname, const pstring srcname)
+{
+       char *d = destname;
+       const char *s = srcname;
+       NTSTATUS ret = NT_STATUS_OK;
+       BOOL start_of_name_component = True;
+       unsigned int num_bad_components = 0;
 
+       while (*s) {
+               if (IS_DIRECTORY_SEP(*s)) {
                        /*
-                        * No mb char starts with '.' so we're safe checking the directory separator here.
+                        * Safe to assume is not the second part of a mb char as this is handled below.
                         */
+                       /* Eat multiple '/' or '\\' */
+                       while (IS_DIRECTORY_SEP(*s)) {
+                               s++;
+                       }
+                       if ((d != destname) && (*s != '\0')) {
+                               /* We only care about non-leading or trailing '/' or '\\' */
+                               *d++ = '/';
+                       }
+
+                       start_of_name_component = True;
+                       continue;
+               }
 
-                       /* "./" or ".\\" fails with a different error depending on where it is... */
+               if (start_of_name_component) {
+                       if ((s[0] == '.') && (s[1] == '.') && (IS_DIRECTORY_SEP(s[2]) || s[2] == '\0')) {
+                               /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 
-                       if (s == srcname) {
-                               ret = NT_STATUS_OBJECT_NAME_INVALID;
-                       } else {
-                               if (s[2] == '\0') {
-                                       return NT_STATUS_INVALID_PARAMETER;
+                               /*
+                                * No mb char starts with '.' so we're safe checking the directory separator here.
+                                */
+
+                               /* If  we just added a '/' - delete it */
+                               if ((d > destname) && (*(d-1) == '/')) {
+                                       *(d-1) = '\0';
+                                       d--;
+                               }
+
+                               /* Are we at the start ? Can't go back further if so. */
+                               if (d <= destname) {
+                                       ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
+                                       break;
+                               }
+                               /* Go back one level... */
+                               /* We know this is safe as '/' cannot be part of a mb sequence. */
+                               /* NOTE - if this assumption is invalid we are not in good shape... */
+                               /* Decrement d first as d points to the *next* char to write into. */
+                               for (d--; d > destname; d--) {
+                                       if (*d == '/')
+                                               break;
                                }
-                               ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                               s += 2; /* Else go past the .. */
+                               /* We're still at the start of a name component, just the previous one. */
+
+                               if (num_bad_components) {
+                                       /* Hmmm. Should we only decrement the bad_components if
+                                          we're removing a bad component ? Need to check this. JRA. */
+                                       num_bad_components--;
+                               }
+
+                               continue;
+
+                       } else if ((s[0] == '.') && ((s[1] == '\0') || IS_DIRECTORY_SEP(s[1]))) {
+                               /* Component of pathname can't be "." only. */
+                               ret =  NT_STATUS_OBJECT_NAME_INVALID;
+                               num_bad_components++;
+                               *d++ = *s++;
+                               continue;
                        }
-                       s++;
+               }
+
+               if (!(*s & 0x80)) {
+                       *d++ = *s++;
                } else {
-                       if (!(*s & 0x80)) {
-                               *d++ = *s++;
-                       } else {
-                               switch(next_mb_char_size(s)) {
-                                       case 4:
-                                               *d++ = *s++;
-                                       case 3:
-                                               *d++ = *s++;
-                                       case 2:
-                                               *d++ = *s++;
-                                       case 1:
-                                               *d++ = *s++;
+                       switch(next_mb_char_size(s)) {
+                               case 4:
+                                       *d++ = *s++;
+                               case 3:
+                                       *d++ = *s++;
+                               case 2:
+                                       *d++ = *s++;
+                               case 1:
+                                       *d++ = *s++;
+                                       break;
+                               default:
+                                       DEBUG(0,("check_path_syntax_wcard: character length assumptions invalid !\n"));
+                                       *d = '\0';
+                                       return NT_STATUS_INVALID_PARAMETER;
+                       }
+               }
+               if (start_of_name_component && num_bad_components) {
+                       num_bad_components++;
+               }
+               start_of_name_component = False;
+       }
+
+       if (NT_STATUS_EQUAL(ret, NT_STATUS_OBJECT_NAME_INVALID)) {
+               /* For some strange reason being called from findfirst changes
+                  the num_components number to cause the error return to change. JRA. */
+               if (num_bad_components > 2) {
+                       ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+               }
+       }
+
+       *d = '\0';
+       return ret;
+}
+
+/****************************************************************************
+ Check the path for a POSIX client.
+ We're assuming here that '/' is not the second byte in any multibyte char
+ set (a safe assumption).
+****************************************************************************/
+
+NTSTATUS check_path_syntax_posix(pstring destname, const pstring srcname)
+{
+       char *d = destname;
+       const char *s = srcname;
+       NTSTATUS ret = NT_STATUS_OK;
+       BOOL start_of_name_component = True;
+
+       while (*s) {
+               if (*s == '/') {
+                       /*
+                        * Safe to assume is not the second part of a mb char as this is handled below.
+                        */
+                       /* Eat multiple '/' or '\\' */
+                       while (*s == '/') {
+                               s++;
+                       }
+                       if ((d != destname) && (*s != '\0')) {
+                               /* We only care about non-leading or trailing '/' */
+                               *d++ = '/';
+                       }
+
+                       start_of_name_component = True;
+                       continue;
+               }
+
+               if (start_of_name_component) {
+                       if ((s[0] == '.') && (s[1] == '.') && (s[2] == '/' || s[2] == '\0')) {
+                               /* Uh oh - "/../" or "/..\0" ! */
+
+                               /*
+                                * No mb char starts with '.' so we're safe checking the directory separator here.
+                                */
+
+                               /* If  we just added a '/' - delete it */
+                               if ((d > destname) && (*(d-1) == '/')) {
+                                       *(d-1) = '\0';
+                                       d--;
+                               }
+
+                               /* Are we at the start ? Can't go back further if so. */
+                               if (d <= destname) {
+                                       ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
+                                       break;
+                               }
+                               /* Go back one level... */
+                               /* We know this is safe as '/' cannot be part of a mb sequence. */
+                               /* NOTE - if this assumption is invalid we are not in good shape... */
+                               /* Decrement d first as d points to the *next* char to write into. */
+                               for (d--; d > destname; d--) {
+                                       if (*d == '/')
                                                break;
-                                       default:
-                                               DEBUG(0,("check_path_syntax: character length assumptions invalid !\n"));
-                                               return NT_STATUS_INVALID_PARAMETER;
                                }
+                               s += 2; /* Else go past the .. */
+                               continue;
+
+                       } else if ((s[0] == '.') && ((s[1] == '\0') || (s[1] == '/'))) {
+                               /* Eat the '.' */
+                               s++;
+                               continue;
+                       }
+               }
+
+               if (!(*s & 0x80)) {
+                       *d++ = *s++;
+               } else {
+                       switch(next_mb_char_size(s)) {
+                               case 4:
+                                       *d++ = *s++;
+                               case 3:
+                                       *d++ = *s++;
+                               case 2:
+                                       *d++ = *s++;
+                               case 1:
+                                       *d++ = *s++;
+                                       break;
+                               default:
+                                       DEBUG(0,("check_path_syntax_posix: character length assumptions invalid !\n"));
+                                       *d = '\0';
+                                       return NT_STATUS_INVALID_PARAMETER;
                        }
                }
+               start_of_name_component = False;
        }
+
        *d = '\0';
        return ret;
 }
@@ -141,7 +378,7 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
  Pull a string and check the path - provide for error return.
 ****************************************************************************/
 
-size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags, NTSTATUS *err)
+size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags, NTSTATUS *err, BOOL allow_wcard_names)
 {
        pstring tmppath;
        char *tmppath_ptr = tmppath;
@@ -155,7 +392,11 @@ size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len
        } else {
                ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
        }
-       *err = check_path_syntax(dest, tmppath);
+       if (allow_wcard_names) {
+               *err = check_path_syntax_wcard(dest, tmppath);
+       } else {
+               *err = check_path_syntax(dest, tmppath);
+       }
        return ret;
 }
 
@@ -222,8 +463,6 @@ int reply_special(char *inbuf,char *outbuf)
                reload_services(True);
                reopen_logs();
 
-               claim_connection(NULL,"",0,True,FLAG_MSG_GENERAL|FLAG_MSG_SMBD);
-
                already_got_session = True;
                break;
                
@@ -326,7 +565,6 @@ int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        int passlen = SVAL(inbuf,smb_vwv3);
        pstring path;
        char *p, *q;
-       extern BOOL global_encrypted_passwords_negotiated;
        
        START_PROFILE(SMBtconX);        
 
@@ -483,7 +721,9 @@ int reply_ioctl(connection_struct *conn,
                        }
                        SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
                        srvstr_push(outbuf, p+2, global_myname(), 15, STR_TERMINATE|STR_ASCII);
-                       srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII);
+                       if (conn) {
+                               srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII);
+                       }
                        break;
                }
        }
@@ -499,7 +739,6 @@ int reply_ioctl(connection_struct *conn,
 int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 {
        int outsize = 0;
-       int mode;
        pstring name;
        BOOL ok = False;
        BOOL bad_path = False;
@@ -508,7 +747,7 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 
        START_PROFILE(SMBchkpth);
 
-       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBchkpth);
                return ERROR_NT(status);
@@ -517,8 +756,10 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
 
        unix_convert(name,conn,0,&bad_path,&sbuf);
-
-       mode = SVAL(inbuf,smb_vwv0);
+       if (bad_path) {
+               END_PROFILE(SMBchkpth);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
 
        if (check_name(name,conn)) {
                if (VALID_STAT(sbuf) || SMB_VFS_STAT(conn,name,&sbuf) == 0)
@@ -540,18 +781,11 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                         * the parent directory is valid but not the
                         * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
                         * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
-                        * if the path is invalid.
+                        * if the path is invalid. This is different from set_bad_path_error()
+                        * in the non-NT error case.
                         */
-                       if (bad_path) {
-                               END_PROFILE(SMBchkpth);
-                               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
-                       } else {
-                               END_PROFILE(SMBchkpth);
-                               return ERROR_NT(NT_STATUS_OBJECT_NAME_NOT_FOUND);
-                       }
-               } else if (errno == ENOTDIR) {
                        END_PROFILE(SMBchkpth);
-                       return ERROR_NT(NT_STATUS_NOT_A_DIRECTORY);
+                       return ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpath);
                }
 
                END_PROFILE(SMBchkpth);
@@ -559,8 +793,7 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        }
 
        outsize = set_message(outbuf,0,0,True);
-
-       DEBUG(3,("chkpth %s mode=%d\n", name, mode));
+       DEBUG(3,("chkpth %s mode=%d\n", name, (int)SVAL(inbuf,smb_vwv0)));
 
        END_PROFILE(SMBchkpth);
        return(outsize);
@@ -586,7 +819,7 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        START_PROFILE(SMBgetatr);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBgetatr);
                return ERROR_NT(status);
@@ -605,6 +838,10 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                ok = True;
        } else {
                unix_convert(fname,conn,0,&bad_path,&sbuf);
+               if (bad_path) {
+                       END_PROFILE(SMBgetatr);
+                       return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+               }
                if (check_name(fname,conn)) {
                        if (VALID_STAT(sbuf) || SMB_VFS_STAT(conn,fname,&sbuf) == 0) {
                                mode = dos_mode(conn,fname,&sbuf);
@@ -661,13 +898,19 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        START_PROFILE(SMBsetatr);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBsetatr);
                return ERROR_NT(status);
        }
 
+       RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
+  
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBsetatr);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
 
        mode = SVAL(inbuf,smb_vwv0);
        mtime = make_unix_date3(inbuf+smb_vwv1);
@@ -678,8 +921,9 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                else
                        mode &= ~aDIR;
 
-               if (check_name(fname,conn))
-                       ok =  (file_chmod(conn,fname,mode,NULL) == 0);
+               if (check_name(fname,conn)) {
+                       ok = (file_set_dosmode(conn,fname,mode,&sbuf,False) == 0);
+               }
        } else {
                ok = True;
        }
@@ -710,7 +954,10 @@ int reply_dskattr(connection_struct *conn, char *inbuf,char *outbuf, int dum_siz
        SMB_BIG_UINT dfree,dsize,bsize;
        START_PROFILE(SMBdskattr);
 
-       SMB_VFS_DISK_FREE(conn,".",True,&bsize,&dfree,&dsize);
+       if (SMB_VFS_DISK_FREE(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
+               END_PROFILE(SMBdskattr);
+               return(UNIXERROR(ERRHRD,ERRgeneral));
+       }
   
        outsize = set_message(outbuf,5,0,True);
        
@@ -777,6 +1024,8 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        BOOL can_open = True;
        BOOL bad_path = False;
        NTSTATUS nt_status;
+       BOOL allow_long_path_components = (SVAL(inbuf,smb_flg2) & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
+
        START_PROFILE(SMBsearch);
 
        *mask = *directory = *fname = 0;
@@ -789,11 +1038,14 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        maxentries = SVAL(inbuf,smb_vwv0); 
        dirtype = SVAL(inbuf,smb_vwv1);
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &nt_status);
+       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &nt_status, True);
        if (!NT_STATUS_IS_OK(nt_status)) {
                END_PROFILE(SMBsearch);
                return ERROR_NT(nt_status);
        }
+
+       RESOLVE_DFSPATH_WCARD(path, conn, inbuf, outbuf);
+  
        p++;
        status_len = SVAL(p, 0);
        p += 2;
@@ -860,8 +1112,10 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                END_PROFILE(SMBsearch);
                                return ERROR_DOS(ERRDOS,ERRnofids);
                        }
-                       dptr_set_wcard(dptr_num, strdup(mask));
-                       dptr_set_attr(dptr_num, dirtype);
+                       if (!dptr_set_wcard_and_attributes(dptr_num, mask, dirtype)) {
+                               END_PROFILE(SMBsearch);
+                               return ERROR_DOS(ERRDOS,ERRnomem);
+                       }
                } else {
                        dirtype = dptr_attr(dptr_num);
                }
@@ -871,7 +1125,8 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                if (ok) {
                        if ((dirtype&0x1F) == aVOLID) {   
                                memcpy(p,status,21);
-                               make_dir_struct(p,"???????????",volume_label(SNUM(conn)),0,aVOLID,0);
+                               make_dir_struct(p,"???????????",volume_label(SNUM(conn)),
+                                               0,aVOLID,0,!allow_long_path_components);
                                dptr_fill(p+12,dptr_num);
                                if (dptr_zero(p+12) && (status_len==0))
                                        numentries = 1;
@@ -891,11 +1146,12 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                        finished = !get_dir_entry(conn,mask,dirtype,fname,&size,&mode,&date,check_descend);
                                        if (!finished) {
                                                memcpy(p,status,21);
-                                               make_dir_struct(p,mask,fname,size,mode,date);
+                                               make_dir_struct(p,mask,fname,size, mode,date,
+                                                               !allow_long_path_components);
                                                dptr_fill(p+12,dptr_num);
                                                numentries++;
+                                               p += DIR_STRUCT_SIZE;
                                        }
-                                       p += DIR_STRUCT_SIZE;
                                }
                        }
                } /* if (ok ) */
@@ -908,33 +1164,36 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                and no entries were found then return error and close dirptr 
                (X/Open spec) */
 
-       if(ok && expect_close && numentries == 0 && status_len == 0) {
-               if (Protocol < PROTOCOL_NT1) {
-                       SCVAL(outbuf,smb_rcls,ERRDOS);
-                       SSVAL(outbuf,smb_err,ERRnofiles);
-               }
-               /* Also close the dptr - we know it's gone */
+       if (numentries == 0 || !ok) {
                dptr_close(&dptr_num);
-       } else if (numentries == 0 || !ok) {
-               if (Protocol < PROTOCOL_NT1) {
-                       SCVAL(outbuf,smb_rcls,ERRDOS);
-                       SSVAL(outbuf,smb_err,ERRnofiles);
-               }
+       } else if(ok && expect_close && status_len == 0) {
+               /* Close the dptr - we know it's gone */
                dptr_close(&dptr_num);
        }
 
        /* If we were called as SMBfunique, then we can close the dirptr now ! */
-       if(dptr_num >= 0 && CVAL(inbuf,smb_com) == SMBfunique)
+       if(dptr_num >= 0 && CVAL(inbuf,smb_com) == SMBfunique) {
                dptr_close(&dptr_num);
+       }
+
+       if ((numentries == 0) && !ms_has_wild(mask)) {
+               return ERROR_BOTH(STATUS_NO_MORE_FILES,ERRDOS,ERRnofiles);
+       }
 
        SSVAL(outbuf,smb_vwv0,numentries);
        SSVAL(outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
        SCVAL(smb_buf(outbuf),0,5);
        SSVAL(smb_buf(outbuf),1,numentries*DIR_STRUCT_SIZE);
 
-       if (Protocol >= PROTOCOL_NT1)
-               SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
-  
+       /* The replies here are never long name. */
+       SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
+       if (!allow_long_path_components) {
+               SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) & (~FLAGS2_LONG_PATH_COMPONENTS));
+       }
+
+       /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
+       SSVAL(outbuf,smb_flg2, (SVAL(outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
+         
        outsize += DIR_STRUCT_SIZE*numentries;
        smb_setlen(outbuf,outsize - 4);
   
@@ -967,7 +1226,7 @@ int reply_fclose(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 
        outsize = set_message(outbuf,1,0,True);
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &err);
+       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &err, True);
        if (!NT_STATUS_IS_OK(err)) {
                END_PROFILE(SMBfclose);
                return ERROR_NT(err);
@@ -1008,18 +1267,18 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        int share_mode;
        SMB_OFF_T size = 0;
        time_t mtime=0;
-       mode_t unixmode;
        int rmode=0;
        SMB_STRUCT_STAT sbuf;
        BOOL bad_path = False;
        files_struct *fsp;
        int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
+       uint16 dos_attr = SVAL(inbuf,smb_vwv1);
        NTSTATUS status;
        START_PROFILE(SMBopen);
  
        share_mode = SVAL(inbuf,smb_vwv0);
 
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopen);
                return ERROR_NT(status);
@@ -1028,14 +1287,20 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBopen);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
     
-       unixmode = unix_mode(conn,aARCH,fname);
-      
        fsp = open_file_shared(conn,fname,&sbuf,share_mode,(FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),
-                       unixmode, oplock_request,&rmode,NULL);
+                       (uint32)dos_attr, oplock_request,&rmode,NULL);
 
        if (!fsp) {
                END_PROFILE(SMBopen);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
 
@@ -1089,7 +1354,6 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        uint32 smb_time = make_unix_date3(inbuf+smb_vwv6);
 #endif
        int smb_ofun = SVAL(inbuf,smb_vwv8);
-       mode_t unixmode;
        SMB_OFF_T size=0;
        int fmode=0,mtime=0,rmode=0;
        SMB_STRUCT_STAT sbuf;
@@ -1097,6 +1361,9 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        BOOL bad_path = False;
        files_struct *fsp;
        NTSTATUS status;
+       SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv9);
+       ssize_t retval = -1;
+
        START_PROFILE(SMBopenX);
 
        /* If it's an IPC, pass off the pipe handler. */
@@ -1111,7 +1378,7 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        }
 
        /* XXXX we need to handle passed times, sattr and flags */
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopenX);
                return ERROR_NT(status);
@@ -1120,18 +1387,53 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
-    
-       unixmode = unix_mode(conn,smb_attr | aARCH, fname);
-      
-       fsp = open_file_shared(conn,fname,&sbuf,smb_mode,smb_ofun,unixmode,
+       if (bad_path) {
+               END_PROFILE(SMBopenX);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
+
+       /* Strange open mode mapping. */
+       if (smb_ofun == 0) {
+               if (GET_OPEN_MODE(smb_mode) == DOS_OPEN_EXEC) {
+                       smb_ofun = FILE_EXISTS_FAIL | FILE_CREATE_IF_NOT_EXIST;
+               } else {
+                       END_PROFILE(SMBopenX);
+                       return ERROR_FORCE_DOS(ERRDOS, ERRbadaccess);
+               }
+       }
+
+       fsp = open_file_shared(conn,fname,&sbuf,smb_mode,smb_ofun,(uint32)smb_attr,
                        oplock_request, &rmode,&smb_action);
       
        if (!fsp) {
                END_PROFILE(SMBopenX);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
 
        size = sbuf.st_size;
+
+       /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
+          if the file is truncated or created. */
+       if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
+               fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
+               if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
+                       close_file(fsp,False);
+                       END_PROFILE(SMBntcreateX);
+                       return ERROR_NT(NT_STATUS_DISK_FULL);
+               }
+               retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
+               if (retval < 0) {
+                       close_file(fsp,False);
+                       END_PROFILE(SMBwrite);
+                       return ERROR_NT(NT_STATUS_DISK_FULL);
+               }
+               size = get_allocation_size(conn,fsp,&sbuf);
+       }
+
        fmode = dos_mode(conn,fname,&sbuf);
        mtime = sbuf.st_mtime;
        if (fmode & aDIR) {
@@ -1215,7 +1517,6 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        int com;
        int outsize = 0;
        int createmode;
-       mode_t unixmode;
        int ofun = 0;
        BOOL bad_path = False;
        files_struct *fsp;
@@ -1227,7 +1528,7 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        com = SVAL(inbuf,smb_com);
 
        createmode = SVAL(inbuf,smb_vwv0);
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcreate);
                return ERROR_NT(status);
@@ -1236,12 +1537,14 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBcreate);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
 
        if (createmode & aVOLID)
                DEBUG(0,("Attempt to create file (%s) with volid set - please report this\n",fname));
   
-       unixmode = unix_mode(conn,createmode,fname);
-  
        if(com == SMBmknew) {
                /* We should fail if file exists. */
                ofun = FILE_CREATE_IF_NOT_EXIST;
@@ -1252,10 +1555,14 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
        /* Open file in dos compatibility share mode. */
        fsp = open_file_shared(conn,fname,&sbuf,SET_DENY_MODE(DENY_FCB)|SET_OPEN_MODE(DOS_OPEN_FCB), 
-                       ofun, unixmode, oplock_request, NULL, NULL);
+                       ofun, (uint32)createmode, oplock_request, NULL, NULL);
   
        if (!fsp) {
                END_PROFILE(SMBcreate);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
  
@@ -1269,7 +1576,7 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
  
        DEBUG( 2, ( "new file %s\n", fname ) );
-       DEBUG( 3, ( "mknew %s fd=%d dmode=%d umode=%o\n", fname, fsp->fd, createmode, (int)unixmode ) );
+       DEBUG( 3, ( "mknew %s fd=%d dmode=%d\n", fname, fsp->fd, createmode ) );
 
        END_PROFILE(SMBcreate);
        return(outsize);
@@ -1283,8 +1590,7 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 {
        pstring fname;
        int outsize = 0;
-       int createmode;
-       mode_t unixmode;
+       int createattr;
        BOOL bad_path = False;
        files_struct *fsp;
        int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
@@ -1292,22 +1598,29 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        SMB_STRUCT_STAT sbuf;
        char *p, *s;
        NTSTATUS status;
+       unsigned int namelen;
 
        START_PROFILE(SMBctemp);
 
-       createmode = SVAL(inbuf,smb_vwv0);
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
+       createattr = SVAL(inbuf,smb_vwv0);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBctemp);
                return ERROR_NT(status);
        }
-       pstrcat(fname,"\\TMXXXXXX");
+       if (*fname) {
+               pstrcat(fname,"/TMXXXXXX");
+       } else {
+               pstrcat(fname,"TMXXXXXX");
+       }
 
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
-  
-       unixmode = unix_mode(conn,createmode,fname);
+       if (bad_path) {
+               END_PROFILE(SMBctemp);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
   
        tmpfd = smb_mkstemp(fname);
        if (tmpfd == -1) {
@@ -1322,13 +1635,17 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        fsp = open_file_shared(conn,fname,&sbuf,
                SET_DENY_MODE(DENY_FCB)|SET_OPEN_MODE(DOS_OPEN_FCB),
                FILE_EXISTS_OPEN|FILE_FAIL_IF_NOT_EXIST,
-               unixmode, oplock_request, NULL, NULL);
+               (uint32)createattr, oplock_request, NULL, NULL);
 
        /* close fd from smb_mkstemp() */
        close(tmpfd);
 
        if (!fsp) {
                END_PROFILE(SMBctemp);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
 
@@ -1343,10 +1660,13 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                s++;
 
        p = smb_buf(outbuf);
+#if 0
+       /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
+          thing in the byte section. JRA */
        SSVALS(p, 0, -1); /* what is this? not in spec */
-       SSVAL(p, 2, strlen(s));
-       p += 4;
-       p += srvstr_push(outbuf, p, s, -1, STR_ASCII);
+#endif
+       namelen = srvstr_push(outbuf, p, s, -1, STR_ASCII|STR_TERMINATE);
+       p += namelen;
        outsize = set_message_end(outbuf, p);
 
        if (oplock_request && lp_fake_oplocks(SNUM(conn)))
@@ -1356,8 +1676,8 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
 
        DEBUG( 2, ( "created temp file %s\n", fname ) );
-       DEBUG( 3, ( "ctemp %s fd=%d dmode=%d umode=%o\n",
-                       fname, fsp->fd, createmode, (int)unixmode ) );
+       DEBUG( 3, ( "ctemp %s fd=%d umode=%o\n",
+                       fname, fsp->fd, sbuf.st_mode ) );
 
        END_PROFILE(SMBctemp);
        return(outsize);
@@ -1367,33 +1687,37 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
  Check if a user is allowed to rename a file.
 ********************************************************************/
 
-static NTSTATUS can_rename(char *fname,connection_struct *conn, SMB_STRUCT_STAT *pst)
+static NTSTATUS can_rename(connection_struct *conn, char *fname, uint16 dirtype, SMB_STRUCT_STAT *pst)
 {
        int smb_action;
        int access_mode;
        files_struct *fsp;
+       uint16 fmode;
 
        if (!CAN_WRITE(conn))
                return NT_STATUS_MEDIA_WRITE_PROTECTED;
-       
+
+       fmode = dos_mode(conn,fname,pst);
+       if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM))
+               return NT_STATUS_NO_SUCH_FILE;
+
        if (S_ISDIR(pst->st_mode))
                return NT_STATUS_OK;
 
        /* We need a better way to return NT status codes from open... */
-       unix_ERR_class = 0;
-       unix_ERR_code = 0;
+       set_saved_error_triple(0, 0, NT_STATUS_OK);
 
        fsp = open_file_shared1(conn, fname, pst, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
-               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), 0, 0, &access_mode, &smb_action);
+               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
 
        if (!fsp) {
-               NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
-               if (unix_ERR_class == ERRDOS && unix_ERR_code == ERRbadshare)
-                       ret = NT_STATUS_SHARING_VIOLATION;
-               unix_ERR_class = 0;
-               unix_ERR_code = 0;
-               unix_ERR_ntstatus = NT_STATUS_OK;
-               return ret;
+               NTSTATUS ret;
+               if (get_saved_error_triple(NULL, NULL, &ret)) {
+                       set_saved_error_triple(0, 0, NT_STATUS_OK);
+                       return ret;
+               }
+               set_saved_error_triple(0, 0, NT_STATUS_OK);
+               return NT_STATUS_ACCESS_DENIED;
        }
        close_file(fsp,False);
        return NT_STATUS_OK;
@@ -1403,7 +1727,7 @@ static NTSTATUS can_rename(char *fname,connection_struct *conn, SMB_STRUCT_STAT
  Check if a user is allowed to delete a file.
 ********************************************************************/
 
-static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype, BOOL bad_path)
+NTSTATUS can_delete(connection_struct *conn, char *fname, int dirtype, BOOL bad_path, BOOL check_is_at_open)
 {
        SMB_STRUCT_STAT sbuf;
        int fmode;
@@ -1444,25 +1768,31 @@ static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype, BOO
        if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM))
                return NT_STATUS_NO_SUCH_FILE;
 
-       /* We need a better way to return NT status codes from open... */
-       unix_ERR_class = 0;
-       unix_ERR_code = 0;
+       if (check_is_at_open) {
+               if (!can_delete_file_in_directory(conn, fname)) {
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+       } else {
+               /* On open checks the open itself will check the share mode, so
+                  don't do it here as we'll get it wrong. */
 
-       fsp = open_file_shared1(conn, fname, &sbuf, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
-               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), 0, 0, &access_mode, &smb_action);
+               /* We need a better way to return NT status codes from open... */
+               set_saved_error_triple(0, 0, NT_STATUS_OK);
 
-       if (!fsp) {
-               NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
-               if (!NT_STATUS_IS_OK(unix_ERR_ntstatus))
-                       ret = unix_ERR_ntstatus;
-               else if (unix_ERR_class == ERRDOS && unix_ERR_code == ERRbadshare)
-                       ret = NT_STATUS_SHARING_VIOLATION;
-               unix_ERR_class = 0;
-               unix_ERR_code = 0;
-               unix_ERR_ntstatus = NT_STATUS_OK;
-               return ret;
+               fsp = open_file_shared1(conn, fname, &sbuf, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
+                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
+
+               if (!fsp) {
+                       NTSTATUS ret;
+                       if (get_saved_error_triple(NULL, NULL, &ret)) {
+                               set_saved_error_triple(0, 0, NT_STATUS_OK);
+                               return ret;
+                       }
+                       set_saved_error_triple(0, 0, NT_STATUS_OK);
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+               close_file(fsp,False);
        }
-       close_file(fsp,False);
        return NT_STATUS_OK;
 }
 
@@ -1516,13 +1846,13 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
        
-       if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask );
+       if (!rc && mangle_is_mangled(mask,SNUM(conn)))
+               mangle_check_cache( mask, sizeof(pstring)-1, SNUM(conn));
        
        if (!has_wild) {
                pstrcat(directory,"/");
                pstrcat(directory,mask);
-               error = can_delete(directory,conn,dirtype,bad_path);
+               error = can_delete(conn,directory,dirtype,bad_path,False);
                if (!NT_STATUS_IS_OK(error))
                        return error;
 
@@ -1530,32 +1860,38 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                        count++;
                }
        } else {
-               void *dirptr = NULL;
+               struct smb_Dir *dir_hnd = NULL;
                const char *dname;
                
                if (check_name(directory,conn))
-                       dirptr = OpenDir(conn, directory, True);
+                       dir_hnd = OpenDir(conn, directory);
                
                /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
                   the pattern matches against the long name, otherwise the short name 
                   We don't implement this yet XXXX
                */
                
-               if (dirptr) {
+               if (dir_hnd) {
+                       long offset = 0;
                        error = NT_STATUS_NO_SUCH_FILE;
-                       
+
                        if (strequal(mask,"????????.???"))
                                pstrcpy(mask,"*");
 
-                       while ((dname = ReadDirName(dirptr))) {
+                       while ((dname = ReadDirName(dir_hnd, &offset))) {
+                               SMB_STRUCT_STAT st;
                                pstring fname;
                                BOOL sys_direntry = False;
                                pstrcpy(fname,dname);
 
+                               if (!is_visible_file(conn, directory, dname, &st, True)) {
+                                       continue;
+                               }
+
                                /* Quick check for "." and ".." */
                                if (fname[0] == '.') {
                                        if (!fname[1] || (fname[1] == '.' && !fname[2])) {
-                                               if ((dirtype & aDIR)) {
+                                               if ((dirtype & FILE_ATTRIBUTE_DIRECTORY) && (dirtype & FILE_ATTRIBUTE_SYSTEM)) {
                                                        sys_direntry = True;
                                                } else {
                                                        continue;
@@ -1563,23 +1899,26 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                                        }
                                }
 
-                               if(!mask_match(fname, mask, case_sensitive))
+                               if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
                                
                                if (sys_direntry) {
                                        error = NT_STATUS_OBJECT_NAME_INVALID;
-                                       continue;
+                                       DEBUG(3,("unlink_internals: system directory delete denied [%s] mask [%s]\n",
+                                               fname, mask));
+                                       break;
                                }
 
                                slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
-                               error = can_delete(fname,conn,dirtype,bad_path);
-                               if (!NT_STATUS_IS_OK(error))
+                               error = can_delete(conn,fname,dirtype,bad_path,False);
+                               if (!NT_STATUS_IS_OK(error)) {
                                        continue;
+                               }
                                if (SMB_VFS_UNLINK(conn,fname) == 0)
                                        count++;
                                DEBUG(3,("unlink_internals: succesful unlink [%s]\n",fname));
                        }
-                       CloseDir(dirptr);
+                       CloseDir(dir_hnd);
                }
        }
        
@@ -1605,19 +1944,24 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        
        dirtype = SVAL(inbuf,smb_vwv0);
        
-       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBunlink);
                return ERROR_NT(status);
        }
        
-       RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(name, conn, inbuf, outbuf);
        
        DEBUG(3,("reply_unlink : %s\n",name));
        
        status = unlink_internals(conn, dirtype, name);
-       if (!NT_STATUS_IS_OK(status))
+       if (!NT_STATUS_IS_OK(status)) {
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       return -1;
+               }
                return ERROR_NT(status);
+       }
 
        /*
         * Win2k needs a changenotify request response before it will
@@ -1635,7 +1979,7 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
  Fail for readbraw.
 ****************************************************************************/
 
-void fail_readraw(void)
+static void fail_readraw(void)
 {
        pstring errstr;
        slprintf(errstr, sizeof(errstr)-1, "FAIL ! reply_readbraw: socket write fail (%s)",
@@ -1643,23 +1987,58 @@ void fail_readraw(void)
        exit_server(errstr);
 }
 
+#if defined(WITH_SENDFILE)
+/****************************************************************************
+ Fake (read/write) sendfile. Returns -1 on read or write fail.
+****************************************************************************/
+
+static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread, char *buf, int bufsize)
+{
+       ssize_t ret=0;
+
+       /* Paranioa check... */
+       if (nread > bufsize) {
+               fail_readraw();
+       }
+
+       if (nread > 0) {
+               ret = read_file(fsp,buf,startpos,nread);
+               if (ret == -1) {
+                       return -1;
+               }
+       }
+
+       /* If we had a short read, fill with zeros. */
+       if (ret < nread) {
+               memset(buf, '\0', nread - ret);
+       }
+
+       if (write_data(smbd_server_fd(),buf,nread) != nread) {
+               return -1;
+       }       
+
+       return (ssize_t)nread;
+}
+#endif
+
 /****************************************************************************
  Use sendfile in readbraw.
 ****************************************************************************/
 
 void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T startpos, size_t nread,
-               ssize_t mincount, char *outbuf)
+               ssize_t mincount, char *outbuf, int out_buffsize)
 {
        ssize_t ret=0;
 
 #if defined(WITH_SENDFILE)
        /*
-        * We can only use sendfile on a non-chained packet and on a file
-        * that is exclusively oplocked. reply_readbraw has already checked the length.
+        * We can only use sendfile on a non-chained packet 
+        * but we can use on a non-oplocked file. tridge proved this
+        * on a train in Germany :-). JRA.
+        * reply_readbraw has already checked the length.
         */
 
-       if ((nread > 0) && (lp_write_cache_size(SNUM(conn)) == 0) &&
-                       EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type) && lp_use_sendfile(SNUM(conn)) ) {
+       if (chain_size ==0 && (nread > 0) && (lp_write_cache_size(SNUM(conn)) == 0) && lp_use_sendfile(SNUM(conn)) ) {
                DATA_BLOB header;
 
                _smb_setlen(outbuf,nread);
@@ -1668,12 +2047,28 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
                header.free = NULL;
 
                if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, nread) == -1) {
+                       /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
+                       if (errno == ENOSYS) {
+                               goto normal_readbraw;
+                       }
+
                        /*
-                        * Special hack for broken Linux with no 64 bit clean sendfile. If we
-                        * return ENOSYS then pretend we just got a normal read.
+                        * Special hack for broken Linux with no working sendfile. If we
+                        * return EINTR we sent the header but not the rest of the data.
+                        * Fake this up by doing read/write calls.
                         */
-                       if (errno == ENOSYS)
-                               goto normal_read;
+                       if (errno == EINTR) {
+                               /* Ensure we don't do this again. */
+                               set_use_sendfile(SNUM(conn), False);
+                               DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
+
+                               if (fake_sendfile(fsp, startpos, nread, outbuf + 4, out_buffsize - 4) == -1) {
+                                       DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
+                                               fsp->fsp_name, strerror(errno) ));
+                                       exit_server("send_file_readbraw fake_sendfile failed");
+                               }
+                               return;
+                       }
 
                        DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
                                fsp->fsp_name, strerror(errno) ));
@@ -1682,7 +2077,8 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
 
        }
 
-  normal_read:
+  normal_readbraw:
+
 #endif
 
        if (nread > 0) {
@@ -1705,9 +2101,8 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
  Reply to a readbraw (core+ protocol).
 ****************************************************************************/
 
-int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int dum_buffsize)
+int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int out_buffsize)
 {
-       extern struct current_user current_user;
        ssize_t maxcount,mincount;
        size_t nread = 0;
        SMB_OFF_T startpos;
@@ -1794,7 +2189,7 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
        /* ensure we don't overrun the packet size */
        maxcount = MIN(65535,maxcount);
 
-       if (!is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (!is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                SMB_OFF_T size = fsp->size;
                SMB_OFF_T sizeneeded = startpos + maxcount;
   
@@ -1820,13 +2215,16 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
        DEBUG( 3, ( "readbraw fnum=%d start=%.0f max=%d min=%d nread=%d\n", fsp->fnum, (double)startpos,
                                (int)maxcount, (int)mincount, (int)nread ) );
   
-       send_file_readbraw(conn, fsp, startpos, nread, mincount, outbuf);
+       send_file_readbraw(conn, fsp, startpos, nread, mincount, outbuf, out_buffsize);
 
        DEBUG(5,("readbraw finished\n"));
        END_PROFILE(SMBreadbraw);
        return -1;
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Reply to a lockread (core+ protocol).
 ****************************************************************************/
@@ -1920,6 +2318,9 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a read.
 ****************************************************************************/
@@ -1954,7 +2355,7 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 
        data = smb_buf(outbuf) + 3;
   
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBread);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -1984,20 +2385,22 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
  Reply to a read and X - possibly using sendfile.
 ****************************************************************************/
 
-int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length, 
+int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length, int len_outbuf,
                files_struct *fsp, SMB_OFF_T startpos, size_t smb_maxcnt)
 {
+       int outsize = 0;
        ssize_t nread = -1;
        char *data = smb_buf(outbuf);
 
 #if defined(WITH_SENDFILE)
        /*
-        * We can only use sendfile on a non-chained packet and on a file
-        * that is exclusively oplocked.
+        * We can only use sendfile on a non-chained packet 
+        * but we can use on a non-oplocked file. tridge proved this
+        * on a train in Germany :-). JRA.
         */
 
-       if ((CVAL(inbuf,smb_vwv0) == 0xFF) && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type) &&
-                       lp_use_sendfile(SNUM(conn)) && (lp_write_cache_size(SNUM(conn)) == 0) ) {
+       if (chain_size ==0 && (CVAL(inbuf,smb_vwv0) == 0xFF) && lp_use_sendfile(SNUM(conn)) &&
+                       (lp_write_cache_size(SNUM(conn)) == 0) ) {
                SMB_STRUCT_STAT sbuf;
                DATA_BLOB header;
 
@@ -2022,6 +2425,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
                SSVAL(outbuf,smb_vwv5,smb_maxcnt);
                SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
+               SSVAL(outbuf,smb_vwv7,((smb_maxcnt >> 16) & 1));
                SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
                SCVAL(outbuf,smb_vwv0,0xFF);
                set_message(outbuf,12,smb_maxcnt,False);
@@ -2029,13 +2433,34 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                header.length = data - outbuf;
                header.free = NULL;
 
-               if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, smb_maxcnt) == -1) {
+               if ((nread = SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, smb_maxcnt)) == -1) {
+                       /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
+                       if (errno == ENOSYS) {
+                               goto normal_read;
+                       }
+
                        /*
-                        * Special hack for broken Linux with no 64 bit clean sendfile. If we
-                        * return ENOSYS then pretend we just got a normal read.
+                        * Special hack for broken Linux with no working sendfile. If we
+                        * return EINTR we sent the header but not the rest of the data.
+                        * Fake this up by doing read/write calls.
                         */
-                       if (errno == ENOSYS)
-                               goto normal_read;
+
+                       if (errno == EINTR) {
+                               /* Ensure we don't do this again. */
+                               set_use_sendfile(SNUM(conn), False);
+                               DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
+
+                               if ((nread = fake_sendfile(fsp, startpos, smb_maxcnt, data,
+                                                       len_outbuf - (data-outbuf))) == -1) {
+                                       DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
+                                               fsp->fsp_name, strerror(errno) ));
+                                       exit_server("send_file_readX: fake_sendfile failed");
+                               }
+                               DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
+                                       fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+                               /* Returning -1 here means successful sendfile. */
+                               return -1;
+                       }
 
                        DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
                                fsp->fsp_name, strerror(errno) ));
@@ -2044,6 +2469,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
 
                DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
                        fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+               /* Returning -1 here means successful sendfile. */
                return -1;
        }
 
@@ -2058,15 +2484,18 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                return(UNIXERROR(ERRDOS,ERRnoaccess));
        }
 
+       outsize = set_message(outbuf,12,nread,False);
        SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
        SSVAL(outbuf,smb_vwv5,nread);
        SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
+       SSVAL(outbuf,smb_vwv7,((nread >> 16) & 1));
        SSVAL(smb_buf(outbuf),-2,nread);
   
        DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
                fsp->fnum, (int)smb_maxcnt, (int)nread ) );
 
-       return nread;
+       /* Returning the number of bytes we want to send back - including header. */
+       return outsize;
 }
 
 /****************************************************************************
@@ -2096,6 +2525,18 @@ int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
 
        set_message(outbuf,12,0,True);
 
+       if (global_client_caps & CAP_LARGE_READX) {
+               if (SVAL(inbuf,smb_vwv7) == 1) {
+                       smb_maxcnt |= (1<<16);
+               }
+               if (smb_maxcnt > BUFFER_SIZE) {
+                       DEBUG(0,("reply_read_and_X - read too large (%u) for reply buffer %u\n",
+                               (unsigned int)smb_maxcnt, (unsigned int)BUFFER_SIZE));
+                       END_PROFILE(SMBreadX);
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+       }
+
        if(CVAL(inbuf,smb_wct) == 12) {
 #ifdef LARGE_SMB_OFF_T
                /*
@@ -2120,12 +2561,12 @@ int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
 
        }
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBreadX);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
 
-       nread = send_file_readX(conn, inbuf, outbuf, length, fsp, startpos, smb_maxcnt);
+       nread = send_file_readX(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt);
        if (nread != -1)
                nread = chain_reply(inbuf,outbuf,length,bufsize);
 
@@ -2176,7 +2617,7 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        SCVAL(inbuf,smb_com,SMBwritec);
        SCVAL(outbuf,smb_com,SMBwritec);
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwritebraw);
                return(ERROR_DOS(ERRDOS,ERRlock));
        }
@@ -2268,6 +2709,9 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Reply to a writeunlock (core+).
 ****************************************************************************/
@@ -2291,8 +2735,7 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
        data = smb_buf(inbuf) + 3;
   
-       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, 
-                     WRITE_LOCK,False)) {
+       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteunlock);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2333,6 +2776,9 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        return outsize;
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a write.
 ****************************************************************************/
@@ -2360,7 +2806,7 @@ int reply_write(connection_struct *conn, char *inbuf,char *outbuf,int size,int d
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
        data = smb_buf(inbuf) + 3;
   
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwrite);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2471,7 +2917,7 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng
 #endif /* LARGE_SMB_OFF_T */
        }
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteX);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2638,7 +3084,6 @@ int reply_exit(connection_struct *conn,
 int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
                 int dum_buffsize)
 {
-       extern struct current_user current_user;
        int outsize = 0;
        time_t mtime;
        int32 eclass = 0, err = 0;
@@ -2684,6 +3129,13 @@ int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
                         fsp->fd, fsp->fnum,
                         conn->num_files_open));
  
+               /*
+                * Take care of any time sent in the close.
+                */
+
+               mtime = make_unix_date3(inbuf+smb_vwv1);
+               fsp_set_pending_modtime(fsp, mtime);
+
                /*
                 * close_file() returns the unix errno if an error
                 * was detected on close - normally this is due to
@@ -2695,16 +3147,6 @@ int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
                        END_PROFILE(SMBclose);
                        return (UNIXERROR(ERRHRD,ERRgeneral));
                }
-
-               /*
-                * Now take care of any time sent in the close.
-                */
-
-               mtime = make_unix_date3(inbuf+smb_vwv1);
-               
-               /* try and set the date */
-               set_filetime(conn, file_name, mtime);
-
        }  
 
        /* We have a cached error */
@@ -2742,7 +3184,7 @@ int reply_writeclose(connection_struct *conn,
        mtime = make_unix_date3(inbuf+smb_vwv4);
        data = smb_buf(inbuf) + 1;
   
-       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteclose);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2784,6 +3226,9 @@ int reply_writeclose(connection_struct *conn,
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Reply to a lock.
 ****************************************************************************/
@@ -2864,6 +3309,9 @@ int reply_unlock(connection_struct *conn, char *inbuf,char *outbuf, int size,
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a tdis.
 ****************************************************************************/
@@ -3115,31 +3563,35 @@ int reply_printwrite(connection_struct *conn, char *inbuf,char *outbuf, int dum_
  code. 
 ****************************************************************************/
 
-NTSTATUS mkdir_internal(connection_struct *conn, pstring directory)
+NTSTATUS mkdir_internal(connection_struct *conn, const pstring directory, BOOL bad_path)
 {
-       BOOL bad_path = False;
-       SMB_STRUCT_STAT sbuf;
        int ret= -1;
        
-       unix_convert(directory,conn,0,&bad_path,&sbuf);
+       if(!CAN_WRITE(conn)) {
+               DEBUG(5,("mkdir_internal: failing create on read-only share %s\n", lp_servicename(SNUM(conn))));
+               errno = EACCES;
+               return map_nt_error_from_unix(errno);
+       }
 
-       if( strchr_m(directory, ':')) {
-               return NT_STATUS_NOT_A_DIRECTORY;
+       if (bad_path) {
+               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
        }
 
-       if (ms_has_wild(directory)) {
-               return NT_STATUS_OBJECT_NAME_INVALID;
+       if (!check_name(directory, conn)) {
+               if(errno == ENOENT) {
+                       if (bad_path) {
+                               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                       } else {
+                               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+                       }
+               }
+               return map_nt_error_from_unix(errno);
        }
 
-       if (check_name(directory, conn))
-               ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory));
-       
+       ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory,True));
        if (ret == -1) {
                if(errno == ENOENT) {
-                       if (bad_path)
-                               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
-                       else
-                               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+                       return NT_STATUS_OBJECT_NAME_NOT_FOUND;
                }
                return map_nt_error_from_unix(errno);
        }
@@ -3156,9 +3608,12 @@ int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        pstring directory;
        int outsize;
        NTSTATUS status;
+       BOOL bad_path = False;
+       SMB_STRUCT_STAT sbuf;
+
        START_PROFILE(SMBmkdir);
  
-       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmkdir);
                return ERROR_NT(status);
@@ -3166,12 +3621,38 @@ int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
        RESOLVE_DFSPATH(directory, conn, inbuf, outbuf);
 
-       status = mkdir_internal(conn, directory);
+       unix_convert(directory,conn,0,&bad_path,&sbuf);
+
+       if( is_ntfs_stream_name(directory)) {
+               DEBUG(5,("reply_mkdir: failing create on filename %s with colon in name\n", directory));
+               END_PROFILE(SMBmkdir);
+               return ERROR_FORCE_DOS(ERRDOS, ERRinvalidname);
+       }
+
+       status = mkdir_internal(conn, directory,bad_path);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmkdir);
                return ERROR_NT(status);
        }
 
+       if (lp_inherit_owner(SNUM(conn))) {
+               /* Ensure we're checking for a symlink here.... */
+               /* We don't want to get caught by a symlink racer. */
+
+               if(SMB_VFS_LSTAT(conn,directory, &sbuf) != 0) {
+                       END_PROFILE(SMBmkdir);
+                       return(UNIXERROR(ERRDOS,ERRnoaccess));
+               }
+                                                                                                                                                   
+               if(!S_ISDIR(sbuf.st_mode)) {
+                       DEBUG(0,("reply_mkdir: %s is not a directory !\n", directory ));
+                       END_PROFILE(SMBmkdir);
+                       return(UNIXERROR(ERRDOS,ERRnoaccess));
+               }
+
+               change_owner_to_parent(conn, NULL, directory, &sbuf);
+       }
+
        outsize = set_message(outbuf,0,0,True);
 
        DEBUG( 3, ( "mkdir %s ret=%d\n", directory, outsize ) );
@@ -3189,18 +3670,22 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory)
 {
        const char *dname = NULL;
        BOOL ret = False;
-       void *dirptr = OpenDir(conn, directory, False);
+       long offset = 0;
+       struct smb_Dir *dir_hnd = OpenDir(conn, directory);
 
-       if(dirptr == NULL)
+       if(dir_hnd == NULL)
                return True;
 
-       while((dname = ReadDirName(dirptr))) {
+       while((dname = ReadDirName(dir_hnd, &offset))) {
                pstring fullname;
                SMB_STRUCT_STAT st;
 
                if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
                        continue;
 
+               if (!is_visible_file(conn, directory, dname, &st, False))
+                       continue;
+
                /* Construct the full name. */
                if(strlen(directory) + strlen(dname) + 1 >= sizeof(fullname)) {
                        errno = ENOMEM;
@@ -3231,7 +3716,7 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory)
                        break;
                }
        }
-       CloseDir(dirptr);
+       CloseDir(dir_hnd);
        return ret;
 }
 
@@ -3242,6 +3727,7 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory)
 BOOL rmdir_internals(connection_struct *conn, char *directory)
 {
        BOOL ok;
+       SMB_STRUCT_STAT st;
 
        ok = (SMB_VFS_RMDIR(conn,directory) == 0);
        if(!ok && ((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
@@ -3253,13 +3739,15 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
                 */
                BOOL all_veto_files = True;
                const char *dname;
-               void *dirptr = OpenDir(conn, directory, False);
+               struct smb_Dir *dir_hnd = OpenDir(conn, directory);
 
-               if(dirptr != NULL) {
-                       int dirpos = TellDir(dirptr);
-                       while ((dname = ReadDirName(dirptr))) {
+               if(dir_hnd != NULL) {
+                       long dirpos = TellDir(dir_hnd);
+                       while ((dname = ReadDirName(dir_hnd,&dirpos))) {
                                if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
                                        continue;
+                               if (!is_visible_file(conn, directory, dname, &st, False))
+                                       continue;
                                if(!IS_VETO_PATH(conn, dname)) {
                                        all_veto_files = False;
                                        break;
@@ -3267,13 +3755,14 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
                        }
 
                        if(all_veto_files) {
-                               SeekDir(dirptr,dirpos);
-                               while ((dname = ReadDirName(dirptr))) {
+                               SeekDir(dir_hnd,dirpos);
+                               while ((dname = ReadDirName(dir_hnd,&dirpos))) {
                                        pstring fullname;
-                                       SMB_STRUCT_STAT st;
 
                                        if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
                                                continue;
+                                       if (!is_visible_file(conn, directory, dname, &st, False))
+                                               continue;
 
                                        /* Construct the full name. */
                                        if(strlen(directory) + strlen(dname) + 1 >= sizeof(fullname)) {
@@ -3297,11 +3786,11 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
                                        } else if(SMB_VFS_UNLINK(conn,fullname) != 0)
                                                break;
                                }
-                               CloseDir(dirptr);
+                               CloseDir(dir_hnd);
                                /* Retry the rmdir */
                                ok = (SMB_VFS_RMDIR(conn,directory) == 0);
                        } else {
-                               CloseDir(dirptr);
+                               CloseDir(dir_hnd);
                        }
                } else {
                        errno = ENOTEMPTY;
@@ -3328,7 +3817,7 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        NTSTATUS status;
        START_PROFILE(SMBrmdir);
 
-       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBrmdir);
                return ERROR_NT(status);
@@ -3337,6 +3826,10 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        RESOLVE_DFSPATH(directory, conn, inbuf, outbuf)
 
        unix_convert(directory,conn, NULL,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBrmdir);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
   
        if (check_name(directory,conn)) {
                dptr_closepath(directory,SVAL(inbuf,smb_pid));
@@ -3401,6 +3894,9 @@ static BOOL resolve_wildcards(const char *name1, char *name2)
                if (*p2 == '?') {
                        *p2 = *p;
                        p2++;
+               } else if (*p2 == '*') {
+                       pstrcpy(p2, p);
+                       break;
                } else {
                        p2++;
                }
@@ -3414,6 +3910,9 @@ static BOOL resolve_wildcards(const char *name1, char *name2)
                if (*p2 == '?') {
                        *p2 = *p;
                        p2++;
+               } else if (*p2 == '*') {
+                       pstrcpy(p2, p);
+                       break;
                } else {
                        p2++;
                }
@@ -3462,7 +3961,7 @@ static void rename_open_files(connection_struct *conn, SMB_DEV_T dev, SMB_INO_T
  Rename an open file - given an fsp.
 ****************************************************************************/
 
-NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, BOOL replace_if_exists)
+NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, uint16 attrs, BOOL replace_if_exists)
 {
        SMB_STRUCT_STAT sbuf;
        BOOL bad_path = False;
@@ -3501,7 +4000,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
         * filename).
         */
 
-       if((case_sensitive == False) && (case_preserve == True) &&
+       if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
                        strequal(newname, fsp->fsp_name)) {
                char *p;
                pstring newname_modified_last_component;
@@ -3543,7 +4042,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
                return NT_STATUS_OBJECT_NAME_COLLISION;
        }
 
-       error = can_rename(newname,conn,&sbuf);
+       error = can_rename(conn,newname,attrs,&sbuf);
 
        if (dest_exists && !NT_STATUS_IS_OK(error)) {
                DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
@@ -3649,8 +4148,8 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, ui
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
 
-       if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask );
+       if (!rc && mangle_is_mangled(mask,SNUM(conn)))
+               mangle_check_cache( mask, sizeof(pstring)-1, SNUM(conn));
 
        has_wild = ms_has_wild(mask);
 
@@ -3658,7 +4157,7 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, ui
                /*
                 * No wildcards - just process the one file.
                 */
-               BOOL is_short_name = mangle_is_8_3(name, True);
+               BOOL is_short_name = mangle_is_8_3(name, True, SNUM(conn));
 
                /* Add a terminating '/' to the directory name. */
                pstrcat(directory,"/");
@@ -3675,7 +4174,7 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, ui
                
                DEBUG(3,("rename_internals: case_sensitive = %d, case_preserve = %d, short case preserve = %d, \
 directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n", 
-                        case_sensitive, case_preserve, short_case_preserve, directory, 
+                        conn->case_sensitive, conn->case_preserve, conn->short_case_preserve, directory, 
                         newname, last_component_dest, is_short_name));
 
                /*
@@ -3686,10 +4185,10 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                 * the rename (user is trying to change the case of the
                 * filename).
                 */
-               if((case_sensitive == False) && 
-                  (((case_preserve == True) && 
+               if((conn->case_sensitive == False) && 
+                  (((conn->case_preserve == True) && 
                     (is_short_name == False)) || 
-                   ((short_case_preserve == True) && 
+                   ((conn->short_case_preserve == True) && 
                     (is_short_name == True))) &&
                   strcsequal(directory, newname)) {
                        pstring modified_last_component;
@@ -3749,7 +4248,7 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                        return NT_STATUS_OBJECT_PATH_NOT_FOUND;
                }
 
-               error = can_rename(directory,conn,&sbuf1);
+               error = can_rename(conn,directory,attrs,&sbuf1);
 
                if (!NT_STATUS_IS_OK(error)) {
                        DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
@@ -3794,21 +4293,22 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                /*
                 * Wildcards - process each file that matches.
                 */
-               void *dirptr = NULL;
+               struct smb_Dir *dir_hnd = NULL;
                const char *dname;
                pstring destname;
                
                if (check_name(directory,conn))
-                       dirptr = OpenDir(conn, directory, True);
+                       dir_hnd = OpenDir(conn, directory);
                
-               if (dirptr) {
+               if (dir_hnd) {
+                       long offset = 0;
                        error = NT_STATUS_NO_SUCH_FILE;
 /*                     Was error = NT_STATUS_OBJECT_NAME_NOT_FOUND; - gentest fix. JRA */
                        
                        if (strequal(mask,"????????.???"))
                                pstrcpy(mask,"*");
                        
-                       while ((dname = ReadDirName(dirptr))) {
+                       while ((dname = ReadDirName(dir_hnd, &offset))) {
                                pstring fname;
                                BOOL sysdir_entry = False;
 
@@ -3825,12 +4325,15 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                        }
                                }
 
-                               if(!mask_match(fname, mask, case_sensitive))
+                               if (!is_visible_file(conn, directory, dname, &sbuf1, False))
+                                       continue;
+
+                               if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
                                
                                if (sysdir_entry) {
                                        error = NT_STATUS_OBJECT_NAME_INVALID;
-                                       continue;
+                                       break;
                                }
 
                                error = NT_STATUS_ACCESS_DENIED;
@@ -3840,7 +4343,7 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                        DEBUG(6,("rename %s failed. Error %s\n", fname, nt_errstr(error)));
                                        continue;
                                }
-                               error = can_rename(fname,conn,&sbuf1);
+                               error = can_rename(conn,fname,attrs,&sbuf1);
                                if (!NT_STATUS_IS_OK(error)) {
                                        DEBUG(6,("rename %s refused\n", fname));
                                        continue;
@@ -3853,6 +4356,14 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                        continue;
                                }
                                
+                               if (strcsequal(fname,destname)) {
+                                       rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname);
+                                       DEBUG(3,("rename_internals: identical names in wildcard rename %s - success\n", fname));
+                                       count++;
+                                       error = NT_STATUS_OK;
+                                       continue;
+                               }
+
                                if (!replace_if_exists && 
                                     vfs_file_exist(conn,destname, NULL)) {
                                        DEBUG(6,("file_exist %s\n", destname));
@@ -3867,7 +4378,7 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                }
                                DEBUG(3,("rename_internals: doing rename on %s -> %s\n",fname,destname));
                        }
-                       CloseDir(dirptr);
+                       CloseDir(dir_hnd);
                }
 
                if (!NT_STATUS_EQUAL(error,NT_STATUS_NO_SUCH_FILE)) {
@@ -3903,26 +4414,30 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        START_PROFILE(SMBmv);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
                return ERROR_NT(status);
        }
        p++;
-       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
                return ERROR_NT(status);
        }
        
-       RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
-       RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(name, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(newname, conn, inbuf, outbuf);
        
        DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
        
        status = rename_internals(conn, name, newname, attrs, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       return -1;
+               }
                return ERROR_NT(status);
        }
 
@@ -3949,7 +4464,8 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
        SMB_OFF_T ret=-1;
        files_struct *fsp1,*fsp2;
        pstring dest;
-  
+       uint32 dosattrs;
        *err_ret = 0;
 
        pstrcpy(dest,dest1);
@@ -3967,7 +4483,8 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
                return(False);
 
        fsp1 = open_file_shared(conn,src,&src_sbuf,SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_RDONLY),
-                                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),0,0,&Access,&action);
+                                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),FILE_ATTRIBUTE_NORMAL,INTERNAL_OPEN_ONLY,
+                                       &Access,&action);
 
        if (!fsp1)
                return(False);
@@ -3975,11 +4492,12 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
        if (!target_is_directory && count)
                ofun = FILE_EXISTS_OPEN;
 
+       dosattrs = dos_mode(conn, src, &src_sbuf);
        if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1)
                ZERO_STRUCTP(&sbuf2);
 
        fsp2 = open_file_shared(conn,dest,&sbuf2,SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_WRONLY),
-                       ofun,src_sbuf.st_mode,0,&Access,&action);
+                       ofun,dosattrs,INTERNAL_OPEN_ONLY,&Access,&action);
 
        if (!fsp2) {
                close_file(fsp1,False);
@@ -4003,7 +4521,7 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
        close_file(fsp1,False);
 
        /* Ensure the modtime is set correctly on the destination file. */
-       fsp2->pending_modtime = src_sbuf.st_mtime;
+       fsp_set_pending_modtime( fsp2, src_sbuf.st_mtime);
 
        /*
         * As we are opening fsp1 read-only we only expect
@@ -4047,12 +4565,12 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        *directory = *mask = 0;
 
        p = smb_buf(inbuf);
-       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcopy);
                return ERROR_NT(status);
        }
-       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcopy);
                return ERROR_NT(status);
@@ -4067,8 +4585,8 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                return ERROR_DOS(ERRSRV,ERRinvdevice);
        }
 
-       RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
-       RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(name, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(newname, conn, inbuf, outbuf);
 
        rc = unix_convert(name,conn,0,&bad_path1,&sbuf1);
        unix_convert(newname,conn,0,&bad_path2,&sbuf2);
@@ -4111,8 +4629,8 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
 
-       if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask );
+       if (!rc && mangle_is_mangled(mask, SNUM(conn)))
+               mangle_check_cache( mask, sizeof(pstring)-1, SNUM(conn));
 
        has_wild = ms_has_wild(mask);
 
@@ -4131,24 +4649,28 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                        exists = vfs_file_exist(conn,directory,NULL);
                }
        } else {
-               void *dirptr = NULL;
+               struct smb_Dir *dir_hnd = NULL;
                const char *dname;
                pstring destname;
 
                if (check_name(directory,conn))
-                       dirptr = OpenDir(conn, directory, True);
+                       dir_hnd = OpenDir(conn, directory);
 
-               if (dirptr) {
+               if (dir_hnd) {
+                       long offset = 0;
                        error = ERRbadfile;
 
                        if (strequal(mask,"????????.???"))
                                pstrcpy(mask,"*");
 
-                       while ((dname = ReadDirName(dirptr))) {
+                       while ((dname = ReadDirName(dir_hnd, &offset))) {
                                pstring fname;
                                pstrcpy(fname,dname);
     
-                               if(!mask_match(fname, mask, case_sensitive))
+                               if (!is_visible_file(conn, directory, dname, &sbuf1, False))
+                                       continue;
+
+                               if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
 
                                error = ERRnoaccess;
@@ -4160,7 +4682,7 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                                        count++;
                                DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname,destname));
                        }
-                       CloseDir(dirptr);
+                       CloseDir(dir_hnd);
                }
        }
   
@@ -4177,8 +4699,7 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                        return ERROR_DOS(ERRDOS,error);
                } else {
                        if((errno == ENOENT) && (bad_path1 || bad_path2)) {
-                               unix_ERR_class = ERRDOS;
-                               unix_ERR_code = ERRbadpath;
+                               set_saved_error_triple(ERRDOS, ERRbadpath, NT_STATUS_OK);
                        }
                        END_PROFILE(SMBcopy);
                        return(UNIXERROR(ERRDOS,error));
@@ -4212,12 +4733,14 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                return ERROR_DOS(ERRDOS,ERRnoaccess);
        }
 
-       srvstr_get_path(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(pathworks_setdir);
                return ERROR_NT(status);
        }
   
+       RESOLVE_DFSPATH(newdir, conn, inbuf, outbuf);
+
        if (strlen(newdir) == 0) {
                ok = True;
        } else {
@@ -4240,6 +4763,9 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Get a lock pid, dealing with large count requests.
 ****************************************************************************/
@@ -4400,11 +4926,16 @@ int reply_lockingX(connection_struct *conn, char *inbuf,char *outbuf,int length,
        
        data = smb_buf(inbuf);
 
-       if (locktype & (LOCKING_ANDX_CANCEL_LOCK | LOCKING_ANDX_CHANGE_LOCKTYPE)) {
+       if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
                /* we don't support these - and CANCEL_LOCK makes w2k
                   and XP reboot so I don't really want to be
                   compatible! (tridge) */
-               return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
+               return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
+       }
+       
+       if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
+               /* Need to make this like a cancel.... JRA. */
+               return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
        }
        
        /* Check if this is an oplock break on a file
@@ -4572,6 +5103,9 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
        return chain_reply(inbuf,outbuf,length,bufsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a SMBreadbmpx (read block multiplex) request.
 ****************************************************************************/
@@ -4614,7 +5148,7 @@ int reply_readbmpx(connection_struct *conn, char *inbuf,char *outbuf,int length,
        tcount = maxcount;
        total_read = 0;
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBreadBmpx);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -4678,7 +5212,7 @@ int reply_setattrE(connection_struct *conn, char *inbuf,char *outbuf, int size,
         * Sometimes times are sent as zero - ignore them.
         */
 
-       if ((unix_times.actime == 0) && (unix_times.modtime == 0)) {
+       if (null_mtime(unix_times.actime) && null_mtime(unix_times.modtime)) {
                /* Ignore request */
                if( DEBUGLVL( 3 ) ) {
                        dbgtext( "reply_setattrE fnum=%d ", fsp->fnum);
@@ -4686,12 +5220,13 @@ int reply_setattrE(connection_struct *conn, char *inbuf,char *outbuf, int size,
                }
                END_PROFILE(SMBsetattrE);
                return(outsize);
-       } else if ((unix_times.actime != 0) && (unix_times.modtime == 0)) {
-               /* set modify time = to access time if modify time was 0 */
+       } else if (!null_mtime(unix_times.actime) && null_mtime(unix_times.modtime)) {
+               /* set modify time = to access time if modify time was unset */
                unix_times.modtime = unix_times.actime;
        }
 
        /* Set the date on this file */
+       /* Should we set pending modtime here ? JRA */
        if(file_utime(conn, fsp->fsp_name, &unix_times)) {
                END_PROFILE(SMBsetattrE);
                return ERROR_DOS(ERRDOS,ERRnoaccess);
@@ -4726,7 +5261,9 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
 
        CHECK_FSP(fsp,conn);
        CHECK_WRITE(fsp);
-       CHECK_ERROR(fsp);
+       if (HAS_CACHED_ERROR(fsp)) {
+               return(CACHED_ERROR(fsp));
+       }
 
        tcount = SVAL(inbuf,smb_vwv1);
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
@@ -4740,7 +5277,7 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
                not an SMBwritebmpx - set this up now so we don't forget */
        SCVAL(outbuf,smb_com,SMBwritec);
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos,WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos,WRITE_LOCK)) {
                END_PROFILE(SMBwriteBmpx);
                return(ERROR_DOS(ERRDOS,ERRlock));
        }
@@ -4765,7 +5302,7 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
                if(fsp->wbmpx_ptr != NULL)
                        wbms = fsp->wbmpx_ptr; /* Use an existing struct */
                else
-                       wbms = (write_bmpx_struct *)malloc(sizeof(write_bmpx_struct));
+                       wbms = SMB_MALLOC_P(write_bmpx_struct);
                if(!wbms) {
                        DEBUG(0,("Out of memory in reply_readmpx\n"));
                        END_PROFILE(SMBwriteBmpx);
@@ -4869,8 +5406,12 @@ int reply_writebs(connection_struct *conn, char *inbuf,char *outbuf, int dum_siz
                        END_PROFILE(SMBwriteBs);
                        return(ERROR_DOS(ERRHRD,ERRdiskfull));
                }
+               wbms->wr_errclass = ERRHRD;
+               wbms->wr_error = ERRdiskfull;
+               wbms->wr_status = NT_STATUS_DISK_FULL;
+               wbms->wr_discard = True;
                END_PROFILE(SMBwriteBs);
-               return(CACHE_ERROR(wbms,ERRHRD,ERRdiskfull));
+               return -1;
        }
 
        /* Increment the total written, if this matches tcount
@@ -4931,13 +5472,14 @@ int reply_getattrE(connection_struct *conn, char *inbuf,char *outbuf, int size,
 
        put_dos_date2(outbuf,smb_vwv0,get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn))));
        put_dos_date2(outbuf,smb_vwv2,sbuf.st_atime);
+       /* Should we check pending modtime here ? JRA */
        put_dos_date2(outbuf,smb_vwv4,sbuf.st_mtime);
 
        if (mode & aDIR) {
                SIVAL(outbuf,smb_vwv6,0);
                SIVAL(outbuf,smb_vwv8,0);
        } else {
-               uint32 allocation_size = get_allocation_size(fsp, &sbuf);
+               uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
                SIVAL(outbuf,smb_vwv6,(uint32)sbuf.st_size);
                SIVAL(outbuf,smb_vwv8,allocation_size);
        }