r17835: Fix Coverity bugs 306, 309, 310.
[abartlet/samba.git/.git] / source3 / smbd / trans2.c
index e4e1243d68ecec7ea1143fcdbcdf23a4fcaea9c0..f40dd5154bc8fb4e495baf067f1d1509f72c9c83 100644 (file)
@@ -3,6 +3,8 @@
    SMB transaction2 handling
    Copyright (C) Jeremy Allison                        1994-2003
    Copyright (C) Stefan (metze) Metzmacher     2003
+   Copyright (C) Volker Lendecke               2005
+   Copyright (C) Steve French                  2005
 
    Extensively modified by Andrew Tridgell, 1995
 
@@ -23,9 +25,9 @@
 
 #include "includes.h"
 
+extern int max_send;
 extern enum protocol_types Protocol;
 extern int smb_read_error;
-extern int global_oplock_break;
 extern uint32 global_client_caps;
 extern struct current_user current_user;
 
@@ -58,14 +60,18 @@ SMB_BIG_UINT get_allocation_size(connection_struct *conn, files_struct *fsp, SMB
 {
        SMB_BIG_UINT ret;
 
+       if(S_ISDIR(sbuf->st_mode)) {
+               return 0;
+       }
+
 #if defined(HAVE_STAT_ST_BLOCKS) && defined(STAT_ST_BLOCKSIZE)
        ret = (SMB_BIG_UINT)STAT_ST_BLOCKSIZE * (SMB_BIG_UINT)sbuf->st_blocks;
 #else
        ret = (SMB_BIG_UINT)get_file_size(*sbuf);
 #endif
 
-       if (!ret && fsp && fsp->initial_allocation_size)
-               ret = fsp->initial_allocation_size;
+       if (fsp && fsp->initial_allocation_size)
+               ret = MAX(ret,fsp->initial_allocation_size);
 
        return smb_roundup(conn, ret);
 }
@@ -95,11 +101,6 @@ static BOOL samba_private_attr_name(const char *unix_ea_name)
        return False;
 }
 
-struct ea_list {
-       struct ea_list *next, *prev;
-       struct ea_struct ea;
-};
-
 /****************************************************************************
  Get one EA value. Fill in a struct ea_struct.
 ****************************************************************************/
@@ -119,8 +120,8 @@ static BOOL get_ea_value(TALLOC_CTX *mem_ctx, connection_struct *conn, files_str
                return False;
        }
 
-       if (fsp && fsp->fd != -1) {
-               sizeret = SMB_VFS_FGETXATTR(fsp, fsp->fd, ea_name, val, attr_size);
+       if (fsp && fsp->fh->fd != -1) {
+               sizeret = SMB_VFS_FGETXATTR(fsp, fsp->fh->fd, ea_name, val, attr_size);
        } else {
                sizeret = SMB_VFS_GETXATTR(conn, fname, ea_name, val, attr_size);
        }
@@ -134,7 +135,7 @@ static BOOL get_ea_value(TALLOC_CTX *mem_ctx, connection_struct *conn, files_str
                return False;
        }
 
-       DEBUG(10,("get_ea_value: EA %s is of length %d: ", ea_name, sizeret));
+       DEBUG(10,("get_ea_value: EA %s is of length %u: ", ea_name, (unsigned int)sizeret));
        dump_data(10, val, sizeret);
 
        pea->flags = 0;
@@ -143,7 +144,7 @@ static BOOL get_ea_value(TALLOC_CTX *mem_ctx, connection_struct *conn, files_str
        } else {
                pea->name = ea_name;
        }
-       pea->value.data = val;
+       pea->value.data = (unsigned char *)val;
        pea->value.length = (size_t)sizeret;
        return True;
 }
@@ -152,7 +153,8 @@ static BOOL get_ea_value(TALLOC_CTX *mem_ctx, connection_struct *conn, files_str
  Return a linked list of the total EA's. Plus the total size
 ****************************************************************************/
 
-static struct ea_list *get_ea_list(TALLOC_CTX *mem_ctx, connection_struct *conn, files_struct *fsp, const char *fname, size_t *pea_total_len)
+static struct ea_list *get_ea_list_from_file(TALLOC_CTX *mem_ctx, connection_struct *conn, files_struct *fsp,
+                                       const char *fname, size_t *pea_total_len)
 {
        /* Get a list of all xattrs. Max namesize is 64k. */
        size_t ea_namelist_size = 1024;
@@ -168,10 +170,15 @@ static struct ea_list *get_ea_list(TALLOC_CTX *mem_ctx, connection_struct *conn,
                return NULL;
        }
 
-       for (i = 0, ea_namelist = TALLOC(mem_ctx, ea_namelist_size); i < 6;
-                       ea_namelist = TALLOC_REALLOC_ARRAY(mem_ctx, ea_namelist, char, ea_namelist_size), i++) {
-               if (fsp && fsp->fd != -1) {
-                       sizeret = SMB_VFS_FLISTXATTR(fsp, fsp->fd, ea_namelist, ea_namelist_size);
+       for (i = 0, ea_namelist = TALLOC_ARRAY(mem_ctx, char, ea_namelist_size); i < 6;
+            ea_namelist = TALLOC_REALLOC_ARRAY(mem_ctx, ea_namelist, char, ea_namelist_size), i++) {
+
+               if (!ea_namelist) {
+                       return NULL;
+               }
+
+               if (fsp && fsp->fh->fd != -1) {
+                       sizeret = SMB_VFS_FLISTXATTR(fsp, fsp->fh->fd, ea_namelist, ea_namelist_size);
                } else {
                        sizeret = SMB_VFS_LISTXATTR(conn, fname, ea_namelist, ea_namelist_size);
                }
@@ -186,7 +193,7 @@ static struct ea_list *get_ea_list(TALLOC_CTX *mem_ctx, connection_struct *conn,
        if (sizeret == -1)
                return NULL;
 
-       DEBUG(10,("get_ea_list: ea_namelist size = %d\n", sizeret ));
+       DEBUG(10,("get_ea_list_from_file: ea_namelist size = %u\n", (unsigned int)sizeret ));
 
        if (sizeret) {
                for (p = ea_namelist; p - ea_namelist < sizeret; p += strlen(p) + 1) {
@@ -207,8 +214,8 @@ static struct ea_list *get_ea_list(TALLOC_CTX *mem_ctx, connection_struct *conn,
                                fstring dos_ea_name;
                                push_ascii_fstring(dos_ea_name, listp->ea.name);
                                *pea_total_len += 4 + strlen(dos_ea_name) + 1 + listp->ea.value.length;
-                               DEBUG(10,("get_ea_list: total_len = %u, %s, val len = %u\n",
-                                       *pea_total_len, dos_ea_name,
+                               DEBUG(10,("get_ea_list_from_file: total_len = %u, %s, val len = %u\n",
+                                       (unsigned int)*pea_total_len, dos_ea_name,
                                        (unsigned int)listp->ea.value.length ));
                        }
                        DLIST_ADD_END(ea_list_head, listp, tmp);
@@ -219,7 +226,7 @@ static struct ea_list *get_ea_list(TALLOC_CTX *mem_ctx, connection_struct *conn,
                }
        }
 
-       DEBUG(10,("get_ea_list: total_len = %u\n", *pea_total_len));
+       DEBUG(10,("get_ea_list_from_file: total_len = %u\n", (unsigned int)*pea_total_len));
        return ea_list_head;
 }
 
@@ -228,34 +235,16 @@ static struct ea_list *get_ea_list(TALLOC_CTX *mem_ctx, connection_struct *conn,
  that was filled.
 ****************************************************************************/
 
-static unsigned int fill_ea_buffer(char *pdata, unsigned int total_data_size,
-       connection_struct *conn, files_struct *fsp, const char *fname)
+static unsigned int fill_ea_buffer(TALLOC_CTX *mem_ctx, char *pdata, unsigned int total_data_size,
+       connection_struct *conn, struct ea_list *ea_list)
 {
        unsigned int ret_data_size = 4;
        char *p = pdata;
-       size_t total_ea_len;
-       TALLOC_CTX *mem_ctx;
-       struct ea_list *ea_list;
 
        SMB_ASSERT(total_data_size >= 4);
 
-       SIVAL(pdata,0,0);
        if (!lp_ea_support(SNUM(conn))) {
-               return 4;
-       }
-       mem_ctx = talloc_init("fill_ea_buffer");
-       if (!mem_ctx) {
-               return 4;
-       }
-
-       ea_list = get_ea_list(mem_ctx, conn, fsp, fname, &total_ea_len);
-       if (!ea_list) {
-               talloc_destroy(mem_ctx);
-               return 4;
-       }
-
-       if (total_ea_len > total_data_size) {
-               talloc_destroy(mem_ctx);
+               SIVAL(pdata,4,0);
                return 4;
        }
 
@@ -286,9 +275,7 @@ static unsigned int fill_ea_buffer(char *pdata, unsigned int total_data_size,
        }
 
        ret_data_size = PTR_DIFF(p, pdata);
-       DEBUG(10,("fill_ea_buffer: data_size = %u, total_ea_len = %u\n",
-                       ret_data_size, total_ea_len ));
-       talloc_destroy(mem_ctx);
+       DEBUG(10,("fill_ea_buffer: data_size = %u\n", ret_data_size ));
        SIVAL(pdata,0,ret_data_size);
        return ret_data_size;
 }
@@ -302,7 +289,7 @@ static unsigned int estimate_ea_size(connection_struct *conn, files_struct *fsp,
                return 0;
        }
        mem_ctx = talloc_init("estimate_ea_size");
-       (void)get_ea_list(mem_ctx, conn, fsp, fname, &total_ea_len);
+       (void)get_ea_list_from_file(mem_ctx, conn, fsp, fname, &total_ea_len);
        talloc_destroy(mem_ctx);
        return total_ea_len;
 }
@@ -315,7 +302,7 @@ static void canonicalize_ea_name(connection_struct *conn, files_struct *fsp, con
 {
        size_t total_ea_len;
        TALLOC_CTX *mem_ctx = talloc_init("canonicalize_ea_name");
-       struct ea_list *ea_list = get_ea_list(mem_ctx, conn, fsp, fname, &total_ea_len);
+       struct ea_list *ea_list = get_ea_list_from_file(mem_ctx, conn, fsp, fname, &total_ea_len);
 
        for (; ea_list; ea_list = ea_list->next) {
                if (strequal(&unix_ea_name[5], ea_list->ea.name)) {
@@ -332,99 +319,246 @@ static void canonicalize_ea_name(connection_struct *conn, files_struct *fsp, con
  Set or delete an extended attribute.
 ****************************************************************************/
 
-static NTSTATUS set_ea(connection_struct *conn, files_struct *fsp, const char *fname,
-                       char *pdata, int total_data)
+NTSTATUS set_ea(connection_struct *conn, files_struct *fsp, const char *fname, struct ea_list *ea_list)
 {
-       unsigned int namelen;
-       unsigned int ealen;
-       int ret;
-       fstring unix_ea_name;
-
        if (!lp_ea_support(SNUM(conn))) {
                return NT_STATUS_EAS_NOT_SUPPORTED;
        }
 
-       if (total_data < 8) {
-               return NT_STATUS_INVALID_PARAMETER;
+       for (;ea_list; ea_list = ea_list->next) {
+               int ret;
+               fstring unix_ea_name;
+
+               fstrcpy(unix_ea_name, "user."); /* All EA's must start with user. */
+               fstrcat(unix_ea_name, ea_list->ea.name);
+
+               canonicalize_ea_name(conn, fsp, fname, unix_ea_name);
+
+               DEBUG(10,("set_ea: ea_name %s ealen = %u\n", unix_ea_name, (unsigned int)ea_list->ea.value.length));
+
+               if (samba_private_attr_name(unix_ea_name)) {
+                       DEBUG(10,("set_ea: ea name %s is a private Samba name.\n", unix_ea_name));
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+
+               if (ea_list->ea.value.length == 0) {
+                       /* Remove the attribute. */
+                       if (fsp && (fsp->fh->fd != -1)) {
+                               DEBUG(10,("set_ea: deleting ea name %s on file %s by file descriptor.\n",
+                                       unix_ea_name, fsp->fsp_name));
+                               ret = SMB_VFS_FREMOVEXATTR(fsp, fsp->fh->fd, unix_ea_name);
+                       } else {
+                               DEBUG(10,("set_ea: deleting ea name %s on file %s.\n",
+                                       unix_ea_name, fname));
+                               ret = SMB_VFS_REMOVEXATTR(conn, fname, unix_ea_name);
+                       }
+#ifdef ENOATTR
+                       /* Removing a non existent attribute always succeeds. */
+                       if (ret == -1 && errno == ENOATTR) {
+                               DEBUG(10,("set_ea: deleting ea name %s didn't exist - succeeding by default.\n",
+                                               unix_ea_name));
+                               ret = 0;
+                       }
+#endif
+               } else {
+                       if (fsp && (fsp->fh->fd != -1)) {
+                               DEBUG(10,("set_ea: setting ea name %s on file %s by file descriptor.\n",
+                                       unix_ea_name, fsp->fsp_name));
+                               ret = SMB_VFS_FSETXATTR(fsp, fsp->fh->fd, unix_ea_name,
+                                                       ea_list->ea.value.data, ea_list->ea.value.length, 0);
+                       } else {
+                               DEBUG(10,("set_ea: setting ea name %s on file %s.\n",
+                                       unix_ea_name, fname));
+                               ret = SMB_VFS_SETXATTR(conn, fname, unix_ea_name,
+                                                       ea_list->ea.value.data, ea_list->ea.value.length, 0);
+                       }
+               }
+
+               if (ret == -1) {
+#ifdef ENOTSUP
+                       if (errno == ENOTSUP) {
+                               return NT_STATUS_EAS_NOT_SUPPORTED;
+                       }
+#endif
+                       return map_nt_error_from_unix(errno);
+               }
+
        }
+       return NT_STATUS_OK;
+}
+/****************************************************************************
+ Read a list of EA names from an incoming data buffer. Create an ea_list with them.
+****************************************************************************/
+
+static struct ea_list *read_ea_name_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
+{
+       struct ea_list *ea_list_head = NULL;
+       size_t offset = 0;
+
+       while (offset + 2 < data_size) {
+               struct ea_list *tmp;
+               struct ea_list *eal = TALLOC_ZERO_P(ctx, struct ea_list);
+               unsigned int namelen = CVAL(pdata,offset);
+
+               offset++; /* Go past the namelen byte. */
+
+               /* integer wrap paranioa. */
+               if ((offset + namelen < offset) || (offset + namelen < namelen) ||
+                               (offset > data_size) || (namelen > data_size) ||
+                               (offset + namelen >= data_size)) {
+                       break;
+               }
+               /* Ensure the name is null terminated. */
+               if (pdata[offset + namelen] != '\0') {
+                       return NULL;
+               }
+               pull_ascii_talloc(ctx, &eal->ea.name, &pdata[offset]);
+               if (!eal->ea.name) {
+                       return NULL;
+               }
 
-       if (IVAL(pdata,0) > total_data) {
-               DEBUG(10,("set_ea: bad total data size (%u) > %u\n", IVAL(pdata,0), (unsigned int)total_data));
-               return NT_STATUS_INVALID_PARAMETER;
+               offset += (namelen + 1); /* Go past the name + terminating zero. */
+               DLIST_ADD_END(ea_list_head, eal, tmp);
+               DEBUG(10,("read_ea_name_list: read ea name %s\n", eal->ea.name));
        }
 
-       pdata += 4;
-       namelen = CVAL(pdata,1);
-       ealen = SVAL(pdata,2);
-       pdata += 4;
-       if (total_data < 8 + namelen + 1 + ealen) {
-               DEBUG(10,("set_ea: bad total data size (%u) < 8 + namelen (%u) + 1 + ealen (%u)\n",
-                       (unsigned int)total_data, namelen, ealen));
-               return NT_STATUS_INVALID_PARAMETER;
+       return ea_list_head;
+}
+
+/****************************************************************************
+ Read one EA list entry from the buffer.
+****************************************************************************/
+
+struct ea_list *read_ea_list_entry(TALLOC_CTX *ctx, const char *pdata, size_t data_size, size_t *pbytes_used)
+{
+       struct ea_list *eal = TALLOC_ZERO_P(ctx, struct ea_list);
+       uint16 val_len;
+       unsigned int namelen;
+
+       if (!eal) {
+               return NULL;
        }
 
-       if (pdata[namelen] != '\0') {
-               DEBUG(10,("set_ea: ea name not null terminated\n"));
-               return NT_STATUS_INVALID_PARAMETER;
+       if (data_size < 6) {
+               return NULL;
        }
 
-       fstrcpy(unix_ea_name, "user."); /* All EA's must start with user. */
-       pull_ascii(&unix_ea_name[5], pdata, sizeof(fstring) - 5, -1, STR_TERMINATE);
-       pdata += (namelen + 1);
+       eal->ea.flags = CVAL(pdata,0);
+       namelen = CVAL(pdata,1);
+       val_len = SVAL(pdata,2);
 
-       canonicalize_ea_name(conn, fsp, fname, unix_ea_name);
+       if (4 + namelen + 1 + val_len > data_size) {
+               return NULL;
+       }
 
-       DEBUG(10,("set_ea: ea_name %s ealen = %u\n", unix_ea_name, ealen));
-       if (ealen) {
-               DEBUG(10,("set_ea: data :\n"));
-               dump_data(10, pdata, ealen);
+       /* Ensure the name is null terminated. */
+       if (pdata[namelen + 4] != '\0') {
+               return NULL;
+       }
+       pull_ascii_talloc(ctx, &eal->ea.name, pdata + 4);
+       if (!eal->ea.name) {
+               return NULL;
        }
 
-       if (samba_private_attr_name(unix_ea_name)) {
-               DEBUG(10,("set_ea: ea name %s is a private Samba name.\n", unix_ea_name));
-               return NT_STATUS_ACCESS_DENIED;
+       eal->ea.value = data_blob(NULL, (size_t)val_len + 1);
+       if (!eal->ea.value.data) {
+               return NULL;
        }
 
-       if (ealen == 0) {
-               /* Remove the attribute. */
-               if (fsp && (fsp->fd != -1)) {
-                       DEBUG(10,("set_ea: deleting ea name %s on file %s by file descriptor.\n",
-                               unix_ea_name, fsp->fsp_name));
-                       ret = SMB_VFS_FREMOVEXATTR(fsp, fsp->fd, unix_ea_name);
-               } else {
-                       DEBUG(10,("set_ea: deleting ea name %s on file %s.\n",
-                               unix_ea_name, fname));
-                       ret = SMB_VFS_REMOVEXATTR(conn, fname, unix_ea_name);
-               }
-#ifdef ENOATTR
-               /* Removing a non existent attribute always succeeds. */
-               if (ret == -1 && errno == ENOATTR) {
-                       DEBUG(10,("set_ea: deleting ea name %s didn't exist - succeeding by default.\n", unix_ea_name));
-                       ret = 0;
-               }
-#endif
-       } else {
-               if (fsp && (fsp->fd != -1)) {
-                       DEBUG(10,("set_ea: setting ea name %s on file %s by file descriptor.\n",
-                               unix_ea_name, fsp->fsp_name));
-                       ret = SMB_VFS_FSETXATTR(fsp, fsp->fd, unix_ea_name, pdata, ealen, 0);
-               } else {
-                       DEBUG(10,("set_ea: setting ea name %s on file %s.\n",
-                               unix_ea_name, fname));
-                       ret = SMB_VFS_SETXATTR(conn, fname, unix_ea_name, pdata, ealen, 0);
+       memcpy(eal->ea.value.data, pdata + 4 + namelen + 1, val_len);
+
+       /* Ensure we're null terminated just in case we print the value. */
+       eal->ea.value.data[val_len] = '\0';
+       /* But don't count the null. */
+       eal->ea.value.length--;
+
+       if (pbytes_used) {
+               *pbytes_used = 4 + namelen + 1 + val_len;
+       }
+
+       DEBUG(10,("read_ea_list_entry: read ea name %s\n", eal->ea.name));
+       dump_data(10, (const char *)eal->ea.value.data, eal->ea.value.length);
+
+       return eal;
+}
+
+/****************************************************************************
+ Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
+****************************************************************************/
+
+static struct ea_list *read_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
+{
+       struct ea_list *ea_list_head = NULL;
+       size_t offset = 0;
+       size_t bytes_used = 0;
+
+       while (offset < data_size) {
+               struct ea_list *tmp;
+               struct ea_list *eal = read_ea_list_entry(ctx, pdata + offset, data_size - offset, &bytes_used);
+
+               if (!eal) {
+                       return NULL;
                }
+
+               DLIST_ADD_END(ea_list_head, eal, tmp);
+               offset += bytes_used;
        }
 
-       if (ret == -1) {
-#ifdef ENOTSUP
-               if (errno == ENOTSUP) {
-                       return NT_STATUS_EAS_NOT_SUPPORTED;
+       return ea_list_head;
+}
+
+/****************************************************************************
+ Count the total EA size needed.
+****************************************************************************/
+
+static size_t ea_list_size(struct ea_list *ealist)
+{
+       fstring dos_ea_name;
+       struct ea_list *listp;
+       size_t ret = 0;
+
+       for (listp = ealist; listp; listp = listp->next) {
+               push_ascii_fstring(dos_ea_name, listp->ea.name);
+               ret += 4 + strlen(dos_ea_name) + 1 + listp->ea.value.length;
+       }
+       /* Add on 4 for total length. */
+       if (ret) {
+               ret += 4;
+       }
+
+       return ret;
+}
+
+/****************************************************************************
+ Return a union of EA's from a file list and a list of names.
+ The TALLOC context for the two lists *MUST* be identical as we steal
+ memory from one list to add to another. JRA.
+****************************************************************************/
+
+static struct ea_list *ea_list_union(struct ea_list *name_list, struct ea_list *file_list, size_t *total_ea_len)
+{
+       struct ea_list *nlistp, *flistp;
+
+       for (nlistp = name_list; nlistp; nlistp = nlistp->next) {
+               for (flistp = file_list; flistp; flistp = flistp->next) {
+                       if (strequal(nlistp->ea.name, flistp->ea.name)) {
+                               break;
+                       }
+               }
+
+               if (flistp) {
+                       /* Copy the data from this entry. */
+                       nlistp->ea.flags = flistp->ea.flags;
+                       nlistp->ea.value = flistp->ea.value;
+               } else {
+                       /* Null entry. */
+                       nlistp->ea.flags = 0;
+                       ZERO_STRUCT(nlistp->ea.value);
                }
-#endif
-               return map_nt_error_from_unix(errno);
        }
 
-       return NT_STATUS_OK;
+       *total_ea_len = ea_list_size(name_list);
+       return name_list;
 }
 
 /****************************************************************************
@@ -434,12 +568,13 @@ static NTSTATUS set_ea(connection_struct *conn, files_struct *fsp, const char *f
   HACK ! Always assumes smb_setup field is zero.
 ****************************************************************************/
 
-static int send_trans2_replies(char *outbuf,
+int send_trans2_replies(char *outbuf,
                        int bufsize,
                        char *params, 
                        int paramsize,
                        char *pdata,
-                       int datasize)
+                       int datasize,
+                       int max_data_bytes)
 {
        /* As we are using a protocol > LANMAN1 then the max_send
         variable must have been set in the sessetupX call.
@@ -447,7 +582,6 @@ static int send_trans2_replies(char *outbuf,
         global struct. These different max_xmit variables should
         be merged as this is now too confusing */
 
-       extern int max_send;
        int data_to_send = datasize;
        int params_to_send = paramsize;
        int useable_space;
@@ -461,9 +595,22 @@ static int send_trans2_replies(char *outbuf,
        
        set_message(outbuf,10,0,True);
 
+       /* Modify the data_to_send and datasize and set the error if
+          we're trying to send more than max_data_bytes. We still send
+          the part of the packet(s) that fit. Strange, but needed
+          for OS/2. */
+
+       if (max_data_bytes > 0 && datasize > max_data_bytes) {
+               DEBUG(5,("send_trans2_replies: max_data_bytes %d exceeded by data %d\n",
+                       max_data_bytes, datasize ));
+               datasize = data_to_send = max_data_bytes;
+               error_packet_set(outbuf,ERRDOS,ERRbufferoverflow,STATUS_BUFFER_OVERFLOW,__LINE__,__FILE__);
+       }
+
        /* If there genuinely are no parameters or data to send just send the empty packet */
 
        if(params_to_send == 0 && data_to_send == 0) {
+               show_msg(outbuf);
                if (!send_smb(smbd_server_fd(),outbuf))
                        exit_server("send_trans2_replies: send_smb failed.");
                return 0;
@@ -558,6 +705,7 @@ static int send_trans2_replies(char *outbuf,
                        params_to_send, data_to_send, paramsize, datasize));
 
                /* Send the packet */
+               show_msg(outbuf);
                if (!send_smb(smbd_server_fd(),outbuf))
                        exit_server("send_trans2_replies: send_smb failed.");
 
@@ -587,37 +735,51 @@ static int call_trans2open(connection_struct *conn, char *inbuf, char *outbuf, i
                                unsigned int max_data_bytes)
 {
        char *params = *pparams;
-       int16 open_mode;
-       int16 open_attr;
+       char *pdata = *ppdata;
+       int deny_mode;
+       int32 open_attr;
        BOOL oplock_request;
 #if 0
        BOOL return_additional_info;
        int16 open_sattr;
        time_t open_time;
 #endif
-       int16 open_ofun;
-       int32 open_size;
+       int open_ofun;
+       uint32 open_size;
        char *pname;
        pstring fname;
        SMB_OFF_T size=0;
-       int fmode=0,mtime=0,rmode;
+       int fattr=0,mtime=0;
        SMB_INO_T inode = 0;
        SMB_STRUCT_STAT sbuf;
        int smb_action = 0;
        BOOL bad_path = False;
        files_struct *fsp;
+       TALLOC_CTX *ctx = NULL;
+       struct ea_list *ea_list = NULL;
+       uint16 flags = 0;
        NTSTATUS status;
+       uint32 access_mask;
+       uint32 share_mode;
+       uint32 create_disposition;
+       uint32 create_options = 0;
 
        /*
         * Ensure we have enough parameters to perform the operation.
         */
 
-       if (total_params < 29)
-               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+       if (total_params < 29) {
+               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+       }
 
-       open_mode = SVAL(params, 2);
+       flags = SVAL(params, 0);
+       deny_mode = SVAL(params, 2);
        open_attr = SVAL(params,6);
-       oplock_request = (((SVAL(params,0)|(1<<1))>>1) | ((SVAL(params,0)|(1<<2))>>1));
+        oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
+        if (oplock_request) {
+                oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
+        }
+
 #if 0
        return_additional_info = BITSETW(params,0);
        open_sattr = SVAL(params, 4);
@@ -627,16 +789,18 @@ static int call_trans2open(connection_struct *conn, char *inbuf, char *outbuf, i
        open_size = IVAL(params,14);
        pname = &params[28];
 
-       if (IS_IPC(conn))
+       if (IS_IPC(conn)) {
                return(ERROR_DOS(ERRSRV,ERRaccess));
+       }
 
-       srvstr_get_path(inbuf, fname, pname, sizeof(fname), -1, STR_TERMINATE, &status, False);
+       srvstr_get_path(inbuf, fname, pname, sizeof(fname), -1, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                return ERROR_NT(status);
        }
 
-       DEBUG(3,("trans2open %s mode=%d attr=%d ofun=%d size=%d\n",
-               fname,open_mode, open_attr, open_ofun, open_size));
+       DEBUG(3,("call_trans2open %s deny_mode=0x%x attr=%d ofun=0x%x size=%d\n",
+               fname, (unsigned int)deny_mode, (unsigned int)open_attr,
+               (unsigned int)open_ofun, open_size));
 
        /* XXXX we need to handle passed times, sattr and flags */
 
@@ -649,42 +813,122 @@ static int call_trans2open(connection_struct *conn, char *inbuf, char *outbuf, i
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
        }
 
-       fsp = open_file_shared(conn,fname,&sbuf,open_mode,open_ofun,(uint32)open_attr,
-               oplock_request, &rmode,&smb_action);
+       if (!map_open_params_to_ntcreate(fname, deny_mode, open_ofun,
+                               &access_mask,
+                               &share_mode,
+                               &create_disposition,
+                               &create_options)) {
+               return ERROR_DOS(ERRDOS, ERRbadaccess);
+       }
+
+       /* Any data in this call is an EA list. */
+       if (total_data && (total_data != 4) && !lp_ea_support(SNUM(conn))) {
+               return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
+       }
+
+       if (total_data != 4) {
+               if (total_data < 10) {
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+
+               if (IVAL(pdata,0) > total_data) {
+                       DEBUG(10,("call_trans2open: bad total data size (%u) > %u\n",
+                               IVAL(pdata,0), (unsigned int)total_data));
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+
+               ctx = talloc_init("TRANS2_OPEN_SET_EA");
+               if (!ctx) {
+                       return ERROR_NT(NT_STATUS_NO_MEMORY);
+               }
+               ea_list = read_ea_list(ctx, pdata + 4, total_data - 4);
+               if (!ea_list) {
+                       talloc_destroy(ctx);
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+       } else if (IVAL(pdata,0) != 4) {
+               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+       }
+
+       status = open_file_ntcreate(conn,fname,&sbuf,
+               access_mask,
+               share_mode,
+               create_disposition,
+               create_options,
+               open_attr,
+               oplock_request,
+               &smb_action, &fsp);
       
-       if (!fsp) {
+       if (!NT_STATUS_IS_OK(status)) {
+               talloc_destroy(ctx);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
        }
 
        size = get_file_size(sbuf);
-       fmode = dos_mode(conn,fname,&sbuf);
+       fattr = dos_mode(conn,fname,&sbuf);
        mtime = sbuf.st_mtime;
        inode = sbuf.st_ino;
-       if (fmode & aDIR) {
-               close_file(fsp,False);
+       if (fattr & aDIR) {
+               talloc_destroy(ctx);
+               close_file(fsp,ERROR_CLOSE);
                return(ERROR_DOS(ERRDOS,ERRnoaccess));
        }
 
+       /* Save the requested allocation size. */
+       /* Allocate space for the file if a size hint is supplied */
+       if ((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) {
+               SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)open_size;
+               if (allocation_size && (allocation_size > (SMB_BIG_UINT)size)) {
+                        fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
+                        if (fsp->is_directory) {
+                                close_file(fsp,ERROR_CLOSE);
+                                /* Can't set allocation size on a directory. */
+                                return ERROR_NT(NT_STATUS_ACCESS_DENIED);
+                        }
+                        if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
+                                close_file(fsp,ERROR_CLOSE);
+                                return ERROR_NT(NT_STATUS_DISK_FULL);
+                        }
+
+                       /* Adjust size here to return the right size in the reply.
+                          Windows does it this way. */
+                       size = fsp->initial_allocation_size;
+                } else {
+                        fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)size);
+                }
+       }
+
+       if (total_data && smb_action == FILE_WAS_CREATED) {
+               status = set_ea(conn, fsp, fname, ea_list);
+               talloc_destroy(ctx);
+               if (!NT_STATUS_IS_OK(status)) {
+                       close_file(fsp,ERROR_CLOSE);
+                       return ERROR_NT(status);
+               }
+       }
+
        /* Realloc the size of parameters and data we will return */
-       params = SMB_REALLOC(*pparams, 28);
-       if( params == NULL )
-               return(ERROR_DOS(ERRDOS,ERRnomem));
-       *pparams = params;
+       *pparams = (char *)SMB_REALLOC(*pparams, 30);
+       if(*pparams == NULL ) {
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
+       params = *pparams;
 
-       memset((char *)params,'\0',28);
        SSVAL(params,0,fsp->fnum);
-       SSVAL(params,2,fmode);
-       put_dos_date2(params,4, mtime);
+       SSVAL(params,2,open_attr);
+       srv_put_dos_date2(params,4, mtime);
        SIVAL(params,8, (uint32)size);
-       SSVAL(params,12,rmode);
+       SSVAL(params,12,deny_mode);
+       SSVAL(params,14,0); /* open_type - file or directory. */
+       SSVAL(params,16,0); /* open_state - only valid for IPC device. */
 
-       if (oplock_request && lp_fake_oplocks(SNUM(conn)))
+       if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
                smb_action |= EXTENDED_OPLOCK_GRANTED;
+       }
 
        SSVAL(params,18,smb_action);
 
@@ -692,9 +936,16 @@ static int call_trans2open(connection_struct *conn, char *inbuf, char *outbuf, i
         * WARNING - this may need to be changed if SMB_INO_T <> 4 bytes.
         */
        SIVAL(params,20,inode);
+       SSVAL(params,24,0); /* Padding. */
+       if (flags & 8) {
+               uint32 ea_size = estimate_ea_size(conn, fsp, fname);
+               SIVAL(params, 26, ea_size);
+       } else {
+               SIVAL(params, 26, 0);
+       }
+
        /* Send the required number of replies */
-       send_trans2_replies(outbuf, bufsize, params, 28, *ppdata, 0);
+       send_trans2_replies(outbuf, bufsize, params, 30, *ppdata, 0, max_data_bytes);
 
        return -1;
 }
@@ -805,13 +1056,13 @@ static mode_t unix_perms_from_wire( connection_struct *conn, SMB_STRUCT_STAT *ps
 ****************************************************************************/
 
 static BOOL get_lanman2_dir_entry(connection_struct *conn,
-                                 void *inbuf, void *outbuf,
-                                char *path_mask,int dirtype,int info_level,
+                                 void *inbuf, char *outbuf,
+                                char *path_mask,uint32 dirtype,int info_level,
                                 int requires_resume_key,
                                 BOOL dont_descend,char **ppdata, 
                                 char *base_data, int space_remaining, 
                                 BOOL *out_of_space, BOOL *got_exact_match,
-                                int *last_entry_off)
+                                int *last_entry_off, struct ea_list *name_list, TALLOC_CTX *ea_ctx)
 {
        const char *dname;
        BOOL found = False;
@@ -822,21 +1073,27 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
        char *p, *q, *pdata = *ppdata;
        uint32 reskey=0;
        long prev_dirpos=0;
-       int mode=0;
+       uint32 mode=0;
        SMB_OFF_T file_size = 0;
        SMB_BIG_UINT allocation_size = 0;
        uint32 len;
-       time_t mdate=0, adate=0, cdate=0;
+       struct timespec mdate_ts, adate_ts, create_date_ts;
+       time_t mdate = (time_t)0, adate = (time_t)0, create_date = (time_t)0;
        char *nameptr;
        char *last_entry_ptr;
        BOOL was_8_3;
-       int nt_extmode; /* Used for NT connections instead of mode */
+       uint32 nt_extmode; /* Used for NT connections instead of mode */
        BOOL needslash = ( conn->dirpath[strlen(conn->dirpath) -1] != '/');
+       BOOL check_mangled_names = lp_manglednames(conn->params);
 
        *fname = 0;
        *out_of_space = False;
        *got_exact_match = False;
 
+       ZERO_STRUCT(mdate_ts);
+       ZERO_STRUCT(adate_ts);
+       ZERO_STRUCT(create_date_ts);
+
        if (!conn->dirptr)
                return(False);
 
@@ -852,6 +1109,8 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 
        while (!found) {
                BOOL got_match;
+               BOOL ms_dfs_link = False;
+
                /* Needed if we run out of space */
                long curr_dirpos = prev_dirpos = dptr_TellDir(conn->dirptr);
                dname = dptr_ReadDirName(conn->dirptr,&curr_dirpos,&sbuf);
@@ -876,7 +1135,8 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                if(!(got_match = *got_exact_match = exact_match(fname, mask, conn->case_sensitive)))
                        got_match = mask_match(fname, mask, conn->case_sensitive);
 
-               if(!got_match && !mangle_is_8_3(fname, False)) {
+               if(!got_match && check_mangled_names &&
+                  !mangle_is_8_3(fname, False, conn->params)) {
 
                        /*
                         * It turns out that NT matches wildcards against
@@ -887,7 +1147,7 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 
                        pstring newname;
                        pstrcpy( newname, fname);
-                       mangle_map( newname, True, False, SNUM(conn));
+                       mangle_map( newname, True, False, conn->params);
                        if(!(got_match = *got_exact_match = exact_match(newname, mask, conn->case_sensitive)))
                                got_match = mask_match(newname, mask, conn->case_sensitive);
                }
@@ -915,8 +1175,7 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 
                                if(lp_host_msdfs() && 
                                   lp_msdfs_root(SNUM(conn)) &&
-                                  is_msdfs_link(conn, pathreal, NULL, NULL,
-                                                &sbuf)) {
+                                  ((ms_dfs_link = is_msdfs_link(NULL,conn, pathreal, NULL, NULL, &sbuf)) == True)) {
 
                                        DEBUG(5,("get_lanman2_dir_entry: Masquerading msdfs link %s as a directory\n", pathreal));
                                        sbuf.st_mode = (sbuf.st_mode & 0xFFF) | S_IFDIR;
@@ -929,40 +1188,44 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                                }
                        }
 
-                       mode = dos_mode(conn,pathreal,&sbuf);
+                       if (ms_dfs_link) {
+                               mode = dos_mode_msdfs(conn,pathreal,&sbuf);
+                       } else {
+                               mode = dos_mode(conn,pathreal,&sbuf);
+                       }
 
                        if (!dir_check_ftype(conn,mode,dirtype)) {
                                DEBUG(5,("[%s] attribs didn't match %x\n",fname,dirtype));
                                continue;
                        }
 
-                       file_size = get_file_size(sbuf);
+                       if (!(mode & aDIR))
+                               file_size = get_file_size(sbuf);
                        allocation_size = get_allocation_size(conn,NULL,&sbuf);
-                       mdate = sbuf.st_mtime;
-                       adate = sbuf.st_atime;
-                       cdate = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
 
-                       if (lp_dos_filetime_resolution(SNUM(conn))) {
-                               cdate &= ~1;
-                               mdate &= ~1;
-                               adate &= ~1;
-                       }
+                       mdate_ts = get_mtimespec(&sbuf);
+                       adate_ts = get_atimespec(&sbuf);
+                       create_date_ts = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
 
-                       if(mode & aDIR) {
-                               /* This is necessary, as otherwise the
-                                * desktop.ini file in this folder is
-                                * ignored */
-                               mode |= (lp_profile_acls(SNUM(conn)) ? aRONLY : 0);
-                               file_size = 0;
+                       if (lp_dos_filetime_resolution(SNUM(conn))) {
+                               dos_filetime_timespec(&create_date_ts);
+                               dos_filetime_timespec(&mdate_ts);
+                               dos_filetime_timespec(&adate_ts);
                        }
 
+                       create_date = convert_timespec_to_time_t(create_date_ts);
+                       mdate = convert_timespec_to_time_t(mdate_ts);
+                       adate = convert_timespec_to_time_t(adate_ts);
+                       
                        DEBUG(5,("get_lanman2_dir_entry found %s fname=%s\n",pathreal,fname));
          
                        found = True;
+
+                       dptr_DirCacheAdd(conn->dirptr, dname, curr_dirpos);
                }
        }
 
-       mangle_map(fname,False,True,SNUM(conn));
+       mangle_map(fname,False,True,conn->params);
 
        p = pdata;
        last_entry_ptr = p;
@@ -970,19 +1233,19 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
        nt_extmode = mode ? mode : FILE_ATTRIBUTE_NORMAL;
 
        switch (info_level) {
-               case SMB_INFO_STANDARD:
-                       DEBUG(10,("get_lanman2_dir_entry: SMB_INFO_STANDARD\n"));
+               case SMB_FIND_INFO_STANDARD:
+                       DEBUG(10,("get_lanman2_dir_entry: SMB_FIND_INFO_STANDARD\n"));
                        if(requires_resume_key) {
                                SIVAL(p,0,reskey);
                                p += 4;
                        }
-                       put_dos_date2(p,l1_fdateCreation,cdate);
-                       put_dos_date2(p,l1_fdateLastAccess,adate);
-                       put_dos_date2(p,l1_fdateLastWrite,mdate);
-                       SIVAL(p,l1_cbFile,(uint32)file_size);
-                       SIVAL(p,l1_cbFileAlloc,(uint32)allocation_size);
-                       SSVAL(p,l1_attrFile,mode);
-                       p += l1_achName;
+                       srv_put_dos_date2(p,0,create_date);
+                       srv_put_dos_date2(p,4,adate);
+                       srv_put_dos_date2(p,8,mdate);
+                       SIVAL(p,12,(uint32)file_size);
+                       SIVAL(p,16,(uint32)allocation_size);
+                       SSVAL(p,20,mode);
+                       p += 23;
                        nameptr = p;
                        p += align_string(outbuf, p, 0);
                        len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE);
@@ -1002,23 +1265,23 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                        p += len;
                        break;
 
-               case SMB_INFO_QUERY_EA_SIZE:
-                       DEBUG(10,("get_lanman2_dir_entry: SMB_INFO_QUERY_EA_SIZE\n"));
+               case SMB_FIND_EA_SIZE:
+                       DEBUG(10,("get_lanman2_dir_entry: SMB_FIND_EA_SIZE\n"));
                        if(requires_resume_key) {
                                SIVAL(p,0,reskey);
                                p += 4;
                        }
-                       put_dos_date2(p,l2_fdateCreation,cdate);
-                       put_dos_date2(p,l2_fdateLastAccess,adate);
-                       put_dos_date2(p,l2_fdateLastWrite,mdate);
-                       SIVAL(p,l2_cbFile,(uint32)file_size);
-                       SIVAL(p,l2_cbFileAlloc,(uint32)allocation_size);
-                       SSVAL(p,l2_attrFile,mode);
+                       srv_put_dos_date2(p,0,create_date);
+                       srv_put_dos_date2(p,4,adate);
+                       srv_put_dos_date2(p,8,mdate);
+                       SIVAL(p,12,(uint32)file_size);
+                       SIVAL(p,16,(uint32)allocation_size);
+                       SSVAL(p,20,mode);
                        {
                                unsigned int ea_size = estimate_ea_size(conn, NULL, pathreal);
-                               SIVAL(p,l2_cbList,ea_size); /* Extended attributes */
+                               SIVAL(p,22,ea_size); /* Extended attributes */
                        }
-                       p += l2_achName;
+                       p += 27;
                        nameptr = p - 1;
                        len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE | STR_NOALIGN);
                        if (SVAL(outbuf, smb_flg2) & FLAGS2_UNICODE_STRINGS) {
@@ -1039,15 +1302,72 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                        SCVAL(p,0,0); p += 1; /* Extra zero byte ? - why.. */
                        break;
 
+               case SMB_FIND_EA_LIST:
+               {
+                       struct ea_list *file_list = NULL;
+                       size_t ea_len = 0;
+
+                       DEBUG(10,("get_lanman2_dir_entry: SMB_FIND_EA_LIST\n"));
+                       if (!name_list) {
+                               return False;
+                       }
+                       if(requires_resume_key) {
+                               SIVAL(p,0,reskey);
+                               p += 4;
+                       }
+                       srv_put_dos_date2(p,0,create_date);
+                       srv_put_dos_date2(p,4,adate);
+                       srv_put_dos_date2(p,8,mdate);
+                       SIVAL(p,12,(uint32)file_size);
+                       SIVAL(p,16,(uint32)allocation_size);
+                       SSVAL(p,20,mode);
+                       p += 22; /* p now points to the EA area. */
+
+                       file_list = get_ea_list_from_file(ea_ctx, conn, NULL, pathreal, &ea_len);
+                       name_list = ea_list_union(name_list, file_list, &ea_len);
+
+                       /* We need to determine if this entry will fit in the space available. */
+                       /* Max string size is 255 bytes. */
+                       if (PTR_DIFF(p + 255 + ea_len,pdata) > space_remaining) {
+                               /* Move the dirptr back to prev_dirpos */
+                               dptr_SeekDir(conn->dirptr, prev_dirpos);
+                               *out_of_space = True;
+                               DEBUG(9,("get_lanman2_dir_entry: out of space\n"));
+                               return False; /* Not finished - just out of space */
+                       }
+
+                       /* Push the ea_data followed by the name. */
+                       p += fill_ea_buffer(ea_ctx, p, space_remaining, conn, name_list);
+                       nameptr = p;
+                       len = srvstr_push(outbuf, p + 1, fname, -1, STR_TERMINATE | STR_NOALIGN);
+                       if (SVAL(outbuf, smb_flg2) & FLAGS2_UNICODE_STRINGS) {
+                               if (len > 2) {
+                                       len -= 2;
+                               } else {
+                                       len = 0;
+                               }
+                       } else {
+                               if (len > 1) {
+                                       len -= 1;
+                               } else {
+                                       len = 0;
+                               }
+                       }
+                       SCVAL(nameptr,0,len);
+                       p += len + 1;
+                       SCVAL(p,0,0); p += 1; /* Extra zero byte ? - why.. */
+                       break;
+               }
+
                case SMB_FIND_FILE_BOTH_DIRECTORY_INFO:
                        DEBUG(10,("get_lanman2_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO\n"));
-                       was_8_3 = mangle_is_8_3(fname, True);
+                       was_8_3 = mangle_is_8_3(fname, True, conn->params);
                        p += 4;
                        SIVAL(p,0,reskey); p += 4;
-                       put_long_date(p,cdate); p += 8;
-                       put_long_date(p,adate); p += 8;
-                       put_long_date(p,mdate); p += 8;
-                       put_long_date(p,mdate); p += 8;
+                       put_long_date_timespec(p,create_date_ts); p += 8;
+                       put_long_date_timespec(p,adate_ts); p += 8;
+                       put_long_date_timespec(p,mdate_ts); p += 8;
+                       put_long_date_timespec(p,mdate_ts); p += 8;
                        SOFF_T(p,0,file_size); p += 8;
                        SOFF_T(p,0,allocation_size); p += 8;
                        SIVAL(p,0,nt_extmode); p += 4;
@@ -1061,22 +1381,25 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                         * IMPORTANT as not doing so will trigger
                         * a Win2k client bug. JRA.
                         */
-                       memset(p,'\0',26);
-                       if (!was_8_3 && lp_manglednames(SNUM(conn))) {
+                       if (!was_8_3 && check_mangled_names) {
                                pstring mangled_name;
                                pstrcpy(mangled_name, fname);
-                               mangle_map(mangled_name,True,True,SNUM(conn));
+                               mangle_map(mangled_name,True,True,
+                                          conn->params);
                                mangled_name[12] = 0;
                                len = srvstr_push(outbuf, p+2, mangled_name, 24, STR_UPPER|STR_UNICODE);
+                               if (len < 24) {
+                                       memset(p + 2 + len,'\0',24 - len);
+                               }
                                SSVAL(p, 0, len);
                        } else {
-                               SSVAL(p,0,0);
-                               *(p+2) = 0;
+                               memset(p,'\0',26);
                        }
                        p += 2 + 24;
                        len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
                        SIVAL(q,0,len);
                        p += len;
+                       SIVAL(p,0,0); /* Ensure any padding is null. */
                        len = PTR_DIFF(p, pdata);
                        len = (len + 3) & ~3;
                        SIVAL(pdata,0,len);
@@ -1087,16 +1410,17 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                        DEBUG(10,("get_lanman2_dir_entry: SMB_FIND_FILE_DIRECTORY_INFO\n"));
                        p += 4;
                        SIVAL(p,0,reskey); p += 4;
-                       put_long_date(p,cdate); p += 8;
-                       put_long_date(p,adate); p += 8;
-                       put_long_date(p,mdate); p += 8;
-                       put_long_date(p,mdate); p += 8;
+                       put_long_date_timespec(p,create_date_ts); p += 8;
+                       put_long_date_timespec(p,adate_ts); p += 8;
+                       put_long_date_timespec(p,mdate_ts); p += 8;
+                       put_long_date_timespec(p,mdate_ts); p += 8;
                        SOFF_T(p,0,file_size); p += 8;
                        SOFF_T(p,0,allocation_size); p += 8;
                        SIVAL(p,0,nt_extmode); p += 4;
                        len = srvstr_push(outbuf, p + 4, fname, -1, STR_TERMINATE_ASCII);
                        SIVAL(p,0,len);
                        p += 4 + len;
+                       SIVAL(p,0,0); /* Ensure any padding is null. */
                        len = PTR_DIFF(p, pdata);
                        len = (len + 3) & ~3;
                        SIVAL(pdata,0,len);
@@ -1107,10 +1431,10 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                        DEBUG(10,("get_lanman2_dir_entry: SMB_FIND_FILE_FULL_DIRECTORY_INFO\n"));
                        p += 4;
                        SIVAL(p,0,reskey); p += 4;
-                       put_long_date(p,cdate); p += 8;
-                       put_long_date(p,adate); p += 8;
-                       put_long_date(p,mdate); p += 8;
-                       put_long_date(p,mdate); p += 8;
+                       put_long_date_timespec(p,create_date_ts); p += 8;
+                       put_long_date_timespec(p,adate_ts); p += 8;
+                       put_long_date_timespec(p,mdate_ts); p += 8;
+                       put_long_date_timespec(p,mdate_ts); p += 8;
                        SOFF_T(p,0,file_size); p += 8;
                        SOFF_T(p,0,allocation_size); p += 8;
                        SIVAL(p,0,nt_extmode); p += 4;
@@ -1124,6 +1448,7 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                        SIVAL(q, 0, len);
                        p += len;
 
+                       SIVAL(p,0,0); /* Ensure any padding is null. */
                        len = PTR_DIFF(p, pdata);
                        len = (len + 3) & ~3;
                        SIVAL(pdata,0,len);
@@ -1140,6 +1465,7 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                        len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
                        SIVAL(p, -4, len);
                        p += len;
+                       SIVAL(p,0,0); /* Ensure any padding is null. */
                        len = PTR_DIFF(p, pdata);
                        len = (len + 3) & ~3;
                        SIVAL(pdata,0,len);
@@ -1150,10 +1476,10 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                        DEBUG(10,("get_lanman2_dir_entry: SMB_FIND_ID_FULL_DIRECTORY_INFO\n"));
                        p += 4;
                        SIVAL(p,0,reskey); p += 4;
-                       put_long_date(p,cdate); p += 8;
-                       put_long_date(p,adate); p += 8;
-                       put_long_date(p,mdate); p += 8;
-                       put_long_date(p,mdate); p += 8;
+                       put_long_date_timespec(p,create_date_ts); p += 8;
+                       put_long_date_timespec(p,adate_ts); p += 8;
+                       put_long_date_timespec(p,mdate_ts); p += 8;
+                       put_long_date_timespec(p,mdate_ts); p += 8;
                        SOFF_T(p,0,file_size); p += 8;
                        SOFF_T(p,0,allocation_size); p += 8;
                        SIVAL(p,0,nt_extmode); p += 4;
@@ -1164,11 +1490,12 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                                p +=4;
                        }
                        SIVAL(p,0,0); p += 4; /* Unknown - reserved ? */
-                       SIVAL(p,0,sbuf.st_dev); p += 4;
-                       SIVAL(p,0,sbuf.st_ino); p += 4;
+                       SIVAL(p,0,sbuf.st_ino); p += 4; /* FileIndexLow */
+                       SIVAL(p,0,sbuf.st_dev); p += 4; /* FileIndexHigh */
                        len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
                        SIVAL(q, 0, len);
                        p += len; 
+                       SIVAL(p,0,0); /* Ensure any padding is null. */
                        len = PTR_DIFF(p, pdata);
                        len = (len + 3) & ~3;
                        SIVAL(pdata,0,len);
@@ -1177,13 +1504,13 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 
                case SMB_FIND_ID_BOTH_DIRECTORY_INFO:
                        DEBUG(10,("get_lanman2_dir_entry: SMB_FIND_ID_BOTH_DIRECTORY_INFO\n"));
-                       was_8_3 = mangle_is_8_3(fname, True);
+                       was_8_3 = mangle_is_8_3(fname, True, conn->params);
                        p += 4;
                        SIVAL(p,0,reskey); p += 4;
-                       put_long_date(p,cdate); p += 8;
-                       put_long_date(p,adate); p += 8;
-                       put_long_date(p,mdate); p += 8;
-                       put_long_date(p,mdate); p += 8;
+                       put_long_date_timespec(p,create_date_ts); p += 8;
+                       put_long_date_timespec(p,adate_ts); p += 8;
+                       put_long_date_timespec(p,mdate_ts); p += 8;
+                       put_long_date_timespec(p,mdate_ts); p += 8;
                        SOFF_T(p,0,file_size); p += 8;
                        SOFF_T(p,0,allocation_size); p += 8;
                        SIVAL(p,0,nt_extmode); p += 4;
@@ -1197,25 +1524,29 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                         * IMPORTANT as not doing so will trigger
                         * a Win2k client bug. JRA.
                         */
-                       memset(p,'\0',26);
-                       if (!was_8_3 && lp_manglednames(SNUM(conn))) {
+                       if (!was_8_3 && check_mangled_names) {
                                pstring mangled_name;
                                pstrcpy(mangled_name, fname);
-                               mangle_map(mangled_name,True,True,SNUM(conn));
+                               mangle_map(mangled_name,True,True,
+                                          conn->params);
                                mangled_name[12] = 0;
                                len = srvstr_push(outbuf, p+2, mangled_name, 24, STR_UPPER|STR_UNICODE);
                                SSVAL(p, 0, len);
+                               if (len < 24) {
+                                       memset(p + 2 + len,'\0',24 - len);
+                               }
+                               SSVAL(p, 0, len);
                        } else {
-                               SSVAL(p,0,0);
-                               *(p+2) = 0;
+                               memset(p,'\0',26);
                        }
                        p += 26;
                        SSVAL(p,0,0); p += 2; /* Reserved ? */
-                       SIVAL(p,0,sbuf.st_dev); p += 4;
-                       SIVAL(p,0,sbuf.st_ino); p += 4;
+                       SIVAL(p,0,sbuf.st_ino); p += 4; /* FileIndexLow */
+                       SIVAL(p,0,sbuf.st_dev); p += 4; /* FileIndexHigh */
                        len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
                        SIVAL(q,0,len);
                        p += len;
+                       SIVAL(p,0,0); /* Ensure any padding is null. */
                        len = PTR_DIFF(p, pdata);
                        len = (len + 3) & ~3;
                        SIVAL(pdata,0,len);
@@ -1236,9 +1567,9 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                        SOFF_T(p,0,get_allocation_size(conn,NULL,&sbuf)); /* Number of bytes used on disk - 64 Bit */
                        p+= 8;
 
-                       put_long_date(p,sbuf.st_ctime);       /* Inode change Time 64 Bit */
-                       put_long_date(p+8,sbuf.st_atime);     /* Last access time 64 Bit */
-                       put_long_date(p+16,sbuf.st_mtime);    /* Last modification time 64 Bit */
+                       put_long_date_timespec(p,get_ctimespec(&sbuf));       /* Inode change Time 64 Bit */
+                       put_long_date_timespec(p+8,get_atimespec(&sbuf));     /* Last access time 64 Bit */
+                       put_long_date_timespec(p+16,get_mtimespec(&sbuf));    /* Last modification time 64 Bit */
                        p+= 24;
 
                        SIVAL(p,0,sbuf.st_uid);               /* user id for the owner */
@@ -1260,7 +1591,7 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
                        SIVAL(p,4,0);
                        p+= 8;
 
-                       SINO_T(p,0,(SMB_INO_T)sbuf.st_ino);   /* inode number */
+                       SINO_T_VAL(p,0,(SMB_INO_T)sbuf.st_ino);   /* inode number */
                        p+= 8;
 
                        SIVAL(p,0, unix_perms_to_wire(sbuf.st_mode));     /* Standard UNIX file permissions */
@@ -1273,6 +1604,7 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 
                        len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE);
                        p += len;
+                       SIVAL(p,0,0); /* Ensure any padding is null. */
 
                        len = PTR_DIFF(p, pdata);
                        len = (len + 3) & ~3;
@@ -1318,7 +1650,7 @@ static int call_trans2findfirst(connection_struct *conn, char *inbuf, char *outb
                requested. */
        char *params = *pparams;
        char *pdata = *ppdata;
-       int dirtype = SVAL(params,0);
+       uint32 dirtype = SVAL(params,0);
        int maxentries = SVAL(params,2);
        uint16 findfirst_flags = SVAL(params,4);
        BOOL close_after_first = (findfirst_flags & FLAG_TRANS2_FIND_CLOSE);
@@ -1337,17 +1669,21 @@ static int call_trans2findfirst(connection_struct *conn, char *inbuf, char *outb
        BOOL out_of_space = False;
        int space_remaining;
        BOOL bad_path = False;
+       BOOL mask_contains_wcard = False;
        SMB_STRUCT_STAT sbuf;
+       TALLOC_CTX *ea_ctx = NULL;
+       struct ea_list *ea_list = NULL;
        NTSTATUS ntstatus = NT_STATUS_OK;
 
-       if (total_params < 12)
-               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+       if (total_params < 12) {
+               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+       }
 
        *directory = *mask = 0;
 
-       DEBUG(3,("call_trans2findfirst: dirtype = %d, maxentries = %d, close_after_first=%d, \
+       DEBUG(3,("call_trans2findfirst: dirtype = %x, maxentries = %d, close_after_first=%d, \
 close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
-               dirtype, maxentries, close_after_first, close_if_end, requires_resume_key,
+               (unsigned int)dirtype, maxentries, close_after_first, close_if_end, requires_resume_key,
                info_level, max_data_bytes));
 
        if (!maxentries) {
@@ -1356,8 +1692,9 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
        }
  
        switch (info_level) {
-               case SMB_INFO_STANDARD:
-               case SMB_INFO_QUERY_EA_SIZE:
+               case SMB_FIND_INFO_STANDARD:
+               case SMB_FIND_EA_SIZE:
+               case SMB_FIND_EA_LIST:
                case SMB_FIND_FILE_DIRECTORY_INFO:
                case SMB_FIND_FILE_FULL_DIRECTORY_INFO:
                case SMB_FIND_FILE_NAMES_INFO:
@@ -1366,19 +1703,20 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
                case SMB_FIND_ID_BOTH_DIRECTORY_INFO:
                        break;
                case SMB_FIND_FILE_UNIX:
-                       if (!lp_unix_extensions())
-                               return(ERROR_DOS(ERRDOS,ERRunknownlevel));
+                       if (!lp_unix_extensions()) {
+                               return ERROR_NT(NT_STATUS_INVALID_LEVEL);
+                       }
                        break;
                default:
-                       return(ERROR_DOS(ERRDOS,ERRunknownlevel));
+                       return ERROR_NT(NT_STATUS_INVALID_LEVEL);
        }
 
-       srvstr_get_path(inbuf, directory, params+12, sizeof(directory), -1, STR_TERMINATE, &ntstatus, True);
+       srvstr_get_path_wcard(inbuf, directory, params+12, sizeof(directory), -1, STR_TERMINATE, &ntstatus, &mask_contains_wcard);
        if (!NT_STATUS_IS_OK(ntstatus)) {
                return ERROR_NT(ntstatus);
        }
 
-       RESOLVE_DFSPATH(directory, conn, inbuf, outbuf);
+       RESOLVE_DFSPATH_WCARD(directory, conn, inbuf, outbuf);
 
        unix_convert(directory,conn,0,&bad_path,&sbuf);
        if (bad_path) {
@@ -1391,10 +1729,12 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
        p = strrchr_m(directory,'/');
        if(p == NULL) {
                /* Windows and OS/2 systems treat search on the root '\' as if it were '\*' */
-               if((directory[0] == '.') && (directory[1] == '\0'))
+               if((directory[0] == '.') && (directory[1] == '\0')) {
                        pstrcpy(mask,"*");
-               else
+                       mask_contains_wcard = True;
+               } else {
                        pstrcpy(mask,directory);
+               }
                pstrcpy(directory,"./");
        } else {
                pstrcpy(mask,p+1);
@@ -1403,29 +1743,59 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
 
        DEBUG(5,("dir=%s, mask = %s\n",directory, mask));
 
-       pdata = SMB_REALLOC(*ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
-       if( pdata == NULL )
-               return(ERROR_DOS(ERRDOS,ERRnomem));
+       if (info_level == SMB_FIND_EA_LIST) {
+               uint32 ea_size;
 
-       *ppdata = pdata;
-       memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
+               if (total_data < 4) {
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
 
-       /* Realloc the params space */
-       params = SMB_REALLOC(*pparams, 10);
-       if (params == NULL)
-               return ERROR_DOS(ERRDOS,ERRnomem);
-       *pparams = params;
+               ea_size = IVAL(pdata,0);
+               if (ea_size != total_data) {
+                       DEBUG(4,("call_trans2findfirst: Rejecting EA request with incorrect \
+total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pdata,0) ));
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
 
-       dptr_num = dptr_create(conn,directory, False, True ,SVAL(inbuf,smb_pid));
-       if (dptr_num < 0)
-               return(UNIXERROR(ERRDOS,ERRbadfile));
+               if (!lp_ea_support(SNUM(conn))) {
+                       return ERROR_DOS(ERRDOS,ERReasnotsupported);
+               }
+                                                                                                                                                        
+               if ((ea_ctx = talloc_init("findnext_ea_list")) == NULL) {
+                       return ERROR_NT(NT_STATUS_NO_MEMORY);
+               }
+                                                                                                                                                        
+               /* Pull out the list of names. */
+               ea_list = read_ea_name_list(ea_ctx, pdata + 4, ea_size - 4);
+               if (!ea_list) {
+                       talloc_destroy(ea_ctx);
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+       }
+
+       *ppdata = (char *)SMB_REALLOC(
+               *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
+       if(*ppdata == NULL ) {
+               talloc_destroy(ea_ctx);
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
+       pdata = *ppdata;
+
+       /* Realloc the params space */
+       *pparams = (char *)SMB_REALLOC(*pparams, 10);
+       if (*pparams == NULL) {
+               talloc_destroy(ea_ctx);
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
+       params = *pparams;
 
        /* Save the wildcard match and attribs we are using on this directory - 
                needed as lanman2 assumes these are being saved between calls */
 
-       if (!dptr_set_wcard_and_attributes(dptr_num, mask, dirtype)) {
-               dptr_close(&dptr_num);
-               return ERROR_DOS(ERRDOS,ERRnomem);
+       dptr_num = dptr_create(conn,directory, False, True ,SVAL(inbuf,smb_pid), mask, mask_contains_wcard, dirtype);
+       if (dptr_num < 0) {
+               talloc_destroy(ea_ctx);
+               return(UNIXERROR(ERRDOS,ERRbadfile));
        }
 
        DEBUG(4,("dptr_num is %d, wcard = %s, attr = %d\n",dptr_num, mask, dirtype));
@@ -1455,7 +1825,7 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
                                        mask,dirtype,info_level,
                                        requires_resume_key,dont_descend,
                                        &p,pdata,space_remaining, &out_of_space, &got_exact_match,
-                                       &last_entry_off);
+                                       &last_entry_off, ea_list, ea_ctx);
                }
 
                if (finished && out_of_space)
@@ -1477,6 +1847,8 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
                space_remaining = max_data_bytes - PTR_DIFF(p,pdata);
        }
   
+       talloc_destroy(ea_ctx);
+
        /* Check if we can close the dirptr */
        if(close_after_first || (finished && close_if_end)) {
                DEBUG(5,("call_trans2findfirst - (2) closing dptr_num %d\n", dptr_num));
@@ -1485,12 +1857,18 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
 
        /* 
         * If there are no matching entries we must return ERRDOS/ERRbadfile - 
-        * from observation of NT.
+        * from observation of NT. NB. This changes to ERRDOS,ERRnofiles if
+        * the protocol level is less than NT1. Tested with smbclient. JRA.
+        * This should fix the OS/2 client bug #2335.
         */
 
        if(numentries == 0) {
                dptr_close(&dptr_num);
-               return ERROR_DOS(ERRDOS,ERRbadfile);
+               if (Protocol < PROTOCOL_NT1) {
+                       return ERROR_DOS(ERRDOS,ERRnofiles);
+               } else {
+                       return ERROR_BOTH(NT_STATUS_NO_SUCH_FILE,ERRDOS,ERRbadfile);
+               }
        }
 
        /* At this point pdata points to numentries directory entries. */
@@ -1502,7 +1880,7 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
        SSVAL(params,6,0); /* Never an EA error */
        SSVAL(params,8,last_entry_off);
 
-       send_trans2_replies( outbuf, bufsize, params, 10, pdata, PTR_DIFF(p,pdata));
+       send_trans2_replies( outbuf, bufsize, params, 10, pdata, PTR_DIFF(p,pdata), max_data_bytes);
 
        if ((! *directory) && dptr_path(dptr_num))
                slprintf(directory,sizeof(directory)-1, "(%s)",dptr_path(dptr_num));
@@ -1519,8 +1897,8 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
         * (see PR#13758). JRA.
         */
 
-       if(!mangle_is_8_3_wildcards( mask, False))
-               mangle_map(mask, True, True, SNUM(conn));
+       if(!mangle_is_8_3_wildcards( mask, False, conn->params))
+               mangle_map(mask, True, True, conn->params);
 
        return(-1);
 }
@@ -1549,6 +1927,7 @@ static int call_trans2findnext(connection_struct *conn, char *inbuf, char *outbu
        BOOL close_if_end = (findnext_flags & FLAG_TRANS2_FIND_CLOSE_IF_END);
        BOOL requires_resume_key = (findnext_flags & FLAG_TRANS2_FIND_REQUIRE_RESUME);
        BOOL continue_bit = (findnext_flags & FLAG_TRANS2_FIND_CONTINUE);
+       BOOL mask_contains_wcard = False;
        pstring resume_name;
        pstring mask;
        pstring directory;
@@ -1560,14 +1939,17 @@ static int call_trans2findnext(connection_struct *conn, char *inbuf, char *outbu
        BOOL dont_descend = False;
        BOOL out_of_space = False;
        int space_remaining;
+       TALLOC_CTX *ea_ctx = NULL;
+       struct ea_list *ea_list = NULL;
        NTSTATUS ntstatus = NT_STATUS_OK;
 
-       if (total_params < 12)
-               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+       if (total_params < 12) {
+               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+       }
 
        *mask = *directory = *resume_name = 0;
 
-       srvstr_get_path(inbuf, resume_name, params+12, sizeof(resume_name), -1, STR_TERMINATE, &ntstatus, True);
+       srvstr_get_path_wcard(inbuf, resume_name, params+12, sizeof(resume_name), -1, STR_TERMINATE, &ntstatus, &mask_contains_wcard);
        if (!NT_STATUS_IS_OK(ntstatus)) {
                /* Win9x or OS/2 can send a resume name of ".." or ".". This will cause the parser to
                   complain (it thinks we're asking for the directory above the shared
@@ -1594,44 +1976,85 @@ resume_key = %d resume name = %s continue=%d level = %d\n",
        }
 
        switch (info_level) {
-               case SMB_INFO_STANDARD:
-               case SMB_INFO_QUERY_EA_SIZE:
+               case SMB_FIND_INFO_STANDARD:
+               case SMB_FIND_EA_SIZE:
+               case SMB_FIND_EA_LIST:
                case SMB_FIND_FILE_DIRECTORY_INFO:
                case SMB_FIND_FILE_FULL_DIRECTORY_INFO:
                case SMB_FIND_FILE_NAMES_INFO:
                case SMB_FIND_FILE_BOTH_DIRECTORY_INFO:
+               case SMB_FIND_ID_FULL_DIRECTORY_INFO:
+               case SMB_FIND_ID_BOTH_DIRECTORY_INFO:
                        break;
                case SMB_FIND_FILE_UNIX:
-                       if (!lp_unix_extensions())
-                               return(ERROR_DOS(ERRDOS,ERRunknownlevel));
+                       if (!lp_unix_extensions()) {
+                               return ERROR_NT(NT_STATUS_INVALID_LEVEL);
+                       }
                        break;
                default:
-                       return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                       return ERROR_NT(NT_STATUS_INVALID_LEVEL);
        }
 
-       pdata = SMB_REALLOC( *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
-       if(pdata == NULL)
-               return ERROR_DOS(ERRDOS,ERRnomem);
+       if (info_level == SMB_FIND_EA_LIST) {
+               uint32 ea_size;
 
-       *ppdata = pdata;
-       memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
+               if (total_data < 4) {
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+
+               ea_size = IVAL(pdata,0);
+               if (ea_size != total_data) {
+                       DEBUG(4,("call_trans2findnext: Rejecting EA request with incorrect \
+total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pdata,0) ));
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+                                                                                                                                                     
+               if (!lp_ea_support(SNUM(conn))) {
+                       return ERROR_DOS(ERRDOS,ERReasnotsupported);
+               }
+                                                                                                                                                     
+               if ((ea_ctx = talloc_init("findnext_ea_list")) == NULL) {
+                       return ERROR_NT(NT_STATUS_NO_MEMORY);
+               }
+
+               /* Pull out the list of names. */
+               ea_list = read_ea_name_list(ea_ctx, pdata + 4, ea_size - 4);
+               if (!ea_list) {
+                       talloc_destroy(ea_ctx);
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+       }
+
+       *ppdata = (char *)SMB_REALLOC(
+               *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
+       if(*ppdata == NULL) {
+               talloc_destroy(ea_ctx);
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
+
+       pdata = *ppdata;
 
        /* Realloc the params space */
-       params = SMB_REALLOC(*pparams, 6*SIZEOFWORD);
-       if( params == NULL )
-               return ERROR_DOS(ERRDOS,ERRnomem);
+       *pparams = (char *)SMB_REALLOC(*pparams, 6*SIZEOFWORD);
+       if(*pparams == NULL ) {
+               talloc_destroy(ea_ctx);
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
 
-       *pparams = params;
+       params = *pparams;
 
        /* Check that the dptr is valid */
-       if(!(conn->dirptr = dptr_fetch_lanman2(dptr_num)))
+       if(!(conn->dirptr = dptr_fetch_lanman2(dptr_num))) {
+               talloc_destroy(ea_ctx);
                return ERROR_DOS(ERRDOS,ERRnofiles);
+       }
 
        string_set(&conn->dirpath,dptr_path(dptr_num));
 
        /* Get the wildcard mask from the dptr */
        if((p = dptr_wcard(dptr_num))== NULL) {
                DEBUG(2,("dptr_num %d has no wildcard\n", dptr_num));
+               talloc_destroy(ea_ctx);
                return ERROR_DOS(ERRDOS,ERRnofiles);
        }
 
@@ -1672,8 +2095,9 @@ resume_key = %d resume name = %s continue=%d level = %d\n",
                 * could be mangled. Ensure we check the unmangled name.
                 */
 
-               if (mangle_is_mangled(resume_name)) {
-                       mangle_check_cache(resume_name, sizeof(resume_name)-1);
+               if (mangle_is_mangled(resume_name, conn->params)) {
+                       mangle_check_cache(resume_name, sizeof(resume_name)-1,
+                                          conn->params);
                }
 
                /*
@@ -1702,7 +2126,7 @@ resume_key = %d resume name = %s continue=%d level = %d\n",
                                                mask,dirtype,info_level,
                                                requires_resume_key,dont_descend,
                                                &p,pdata,space_remaining, &out_of_space, &got_exact_match,
-                                               &last_entry_off);
+                                               &last_entry_off, ea_list, ea_ctx);
                }
 
                if (finished && out_of_space)
@@ -1724,6 +2148,8 @@ resume_key = %d resume name = %s continue=%d level = %d\n",
                space_remaining = max_data_bytes - PTR_DIFF(p,pdata);
        }
   
+       talloc_destroy(ea_ctx);
+
        /* Check if we can close the dirptr */
        if(close_after_request || (finished && close_if_end)) {
                DEBUG(5,("call_trans2findnext: closing dptr_num = %d\n", dptr_num));
@@ -1736,7 +2162,7 @@ resume_key = %d resume name = %s continue=%d level = %d\n",
        SSVAL(params,4,0); /* Never an EA error */
        SSVAL(params,6,last_entry_off);
 
-       send_trans2_replies( outbuf, bufsize, params, 8, pdata, PTR_DIFF(p,pdata));
+       send_trans2_replies( outbuf, bufsize, params, 8, pdata, PTR_DIFF(p,pdata), max_data_bytes);
 
        if ((! *directory) && dptr_path(dptr_num))
                slprintf(directory,sizeof(directory)-1, "(%s)",dptr_path(dptr_num));
@@ -1773,11 +2199,13 @@ static int call_trans2qfsinfo(connection_struct *conn, char *inbuf, char *outbuf
                return ERROR_DOS(ERRSRV,ERRinvdevice);
        }
 
-       pdata = SMB_REALLOC(*ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
-       if ( pdata == NULL )
-               return ERROR_DOS(ERRDOS,ERRnomem);
+       *ppdata = (char *)SMB_REALLOC(
+               *ppdata, max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
+       if (*ppdata == NULL ) {
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
 
-       *ppdata = pdata;
+       pdata = *ppdata;
        memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
 
        switch (info_level) {
@@ -1785,7 +2213,7 @@ static int call_trans2qfsinfo(connection_struct *conn, char *inbuf, char *outbuf
                {
                        SMB_BIG_UINT dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
                        data_len = 18;
-                       if (SMB_VFS_DISK_FREE(conn,".",False,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
+                       if (get_dfree_info(conn,".",False,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
                                return(UNIXERROR(ERRHRD,ERRgeneral));
                        }
 
@@ -1824,8 +2252,14 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)st.st_dev, (unsi
                         * the called hostname and the service name.
                         */
                        SIVAL(pdata,0,str_checksum(lp_servicename(snum)) ^ (str_checksum(get_local_machine_name())<<16) );
-                       len = srvstr_push(outbuf, pdata+l2_vol_szVolLabel, vname, -1, STR_NOALIGN);
-                       SCVAL(pdata,l2_vol_cch,len);
+                       /*
+                        * Win2k3 and previous mess this up by sending a name length
+                        * one byte short. I believe only older clients (OS/2 Win9x) use
+                        * this call so try fixing this by adding a terminating null to
+                        * the pushed string. The change here was adding the STR_TERMINATE. JRA.
+                        */
+                       len = srvstr_push(outbuf, pdata+l2_vol_szVolLabel, vname, -1, STR_NOALIGN|STR_TERMINATE);
+                       SCVAL(pdata,l2_vol_cch,len);
                        data_len = l2_vol_szVolLabel + len;
                        DEBUG(5,("call_trans2qfsinfo : time = %x, namelen = %d, name = %s\n",
                                (unsigned)st.st_ctime, len, vname));
@@ -1880,7 +2314,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)st.st_dev, (unsi
                {
                        SMB_BIG_UINT dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
                        data_len = 24;
-                       if (SMB_VFS_DISK_FREE(conn,".",False,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
+                       if (get_dfree_info(conn,".",False,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
                                return(UNIXERROR(ERRHRD,ERRgeneral));
                        }
                        block_size = lp_block_size(snum);
@@ -1912,7 +2346,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
                {
                        SMB_BIG_UINT dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
                        data_len = 32;
-                       if (SMB_VFS_DISK_FREE(conn,".",False,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
+                       if (get_dfree_info(conn,".",False,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
                                return(UNIXERROR(ERRHRD,ERRgeneral));
                        }
                        block_size = lp_block_size(snum);
@@ -1981,10 +2415,9 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
                        
                        fsp.conn = conn;
                        fsp.fnum = -1;
-                       fsp.fd = -1;
                        
                        /* access check */
-                       if (current_user.uid != 0) {
+                       if (current_user.ut.uid != 0) {
                                DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n",
                                        lp_servicename(SNUM(conn)),conn->user));
                                return ERROR_DOS(ERRDOS,ERRnoaccess);
@@ -2030,13 +2463,51 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
                 */
 
                case SMB_QUERY_CIFS_UNIX_INFO:
-                       if (!lp_unix_extensions())
-                               return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                       if (!lp_unix_extensions()) {
+                               return ERROR_NT(NT_STATUS_INVALID_LEVEL);
+                       }
                        data_len = 12;
                        SSVAL(pdata,0,CIFS_UNIX_MAJOR_VERSION);
                        SSVAL(pdata,2,CIFS_UNIX_MINOR_VERSION);
-                       SBIG_UINT(pdata,4,((SMB_BIG_UINT)CIFS_UNIX_POSIX_ACLS_CAP)); /* We have POSIX ACLs. */
+                       /* We have POSIX ACLs, pathname and locking capability. */
+                       SBIG_UINT(pdata,4,((SMB_BIG_UINT)(
+                                       CIFS_UNIX_POSIX_ACLS_CAP|
+                                       CIFS_UNIX_POSIX_PATHNAMES_CAP|
+                                       CIFS_UNIX_FCNTL_LOCKS_CAP)));
+                       break;
+
+               case SMB_QUERY_POSIX_FS_INFO:
+               {
+                       int rc;
+                       vfs_statvfs_struct svfs;
+
+                       if (!lp_unix_extensions()) {
+                               return ERROR_NT(NT_STATUS_INVALID_LEVEL);
+                       }
+
+                       rc = SMB_VFS_STATVFS(conn, ".", &svfs);
+
+                       if (!rc) {
+                               data_len = 56;
+                               SIVAL(pdata,0,svfs.OptimalTransferSize);
+                               SIVAL(pdata,4,svfs.BlockSize);
+                               SBIG_UINT(pdata,8,svfs.TotalBlocks);
+                               SBIG_UINT(pdata,16,svfs.BlocksAvail);
+                               SBIG_UINT(pdata,24,svfs.UserBlocksAvail);
+                               SBIG_UINT(pdata,32,svfs.TotalFileNodes);
+                               SBIG_UINT(pdata,40,svfs.FreeFileNodes);
+                               SBIG_UINT(pdata,48,svfs.FsIdentifier);
+                               DEBUG(5,("call_trans2qfsinfo : SMB_QUERY_POSIX_FS_INFO succsessful\n"));
+#ifdef EOPNOTSUPP
+                       } else if (rc == EOPNOTSUPP) {
+                               return ERROR_NT(NT_STATUS_INVALID_LEVEL);
+#endif /* EOPNOTSUPP */
+                       } else {
+                               DEBUG(0,("vfs_statvfs() failed for service [%s]\n",lp_servicename(SNUM(conn))));
+                               return ERROR_DOS(ERRSRV,ERRerror);
+                       }
                        break;
+               }
 
                case SMB_MAC_QUERY_FS_INFO:
                        /*
@@ -2050,18 +2521,17 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
                        }
                        /* drop through */
                default:
-                       return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                       return ERROR_NT(NT_STATUS_INVALID_LEVEL);
        }
 
 
-       send_trans2_replies( outbuf, bufsize, params, 0, pdata, data_len);
+       send_trans2_replies( outbuf, bufsize, params, 0, pdata, data_len, max_data_bytes);
 
        DEBUG( 4, ( "%s info_level = %d\n", smb_fn_name(CVAL(inbuf,smb_com)), info_level) );
 
        return -1;
 }
 
-#ifdef HAVE_SYS_QUOTAS
 /****************************************************************************
  Reply to a TRANS2_SETFSINFO (set filesystem info).
 ****************************************************************************/
@@ -2072,94 +2542,134 @@ static int call_trans2setfsinfo(connection_struct *conn, char *inbuf, char *outb
 {
        char *pdata = *ppdata;
        char *params = *pparams;
-       files_struct *fsp = NULL;
        uint16 info_level;
        int outsize;
-       SMB_NTQUOTA_STRUCT quotas;
-       
-       ZERO_STRUCT(quotas);
-
-       DEBUG(10,("call_trans2setfsinfo: SET_FS_QUOTA: for service [%s]\n",lp_servicename(SNUM(conn))));
 
-       /* access check */
-       if ((current_user.uid != 0)||!CAN_WRITE(conn)) {
-               DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n",
-                       lp_servicename(SNUM(conn)),conn->user));
-               return ERROR_DOS(ERRSRV,ERRaccess);
-       }
+       DEBUG(10,("call_trans2setfsinfo: for service [%s]\n",lp_servicename(SNUM(conn))));
 
        /*  */
        if (total_params < 4) {
                DEBUG(0,("call_trans2setfsinfo: requires total_params(%d) >= 4 bytes!\n",
                        total_params));
-               return ERROR_DOS(ERRDOS,ERRinvalidparam);
-       }
-
-       fsp = file_fsp(params,0);
-
-       if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
-               DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
-               return ERROR_NT(NT_STATUS_INVALID_HANDLE);
+               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
        }
 
        info_level = SVAL(params,2);
 
        switch(info_level) {
-               case SMB_FS_QUOTA_INFORMATION:
-                       /* note: normaly there're 48 bytes,
-                        * but we didn't use the last 6 bytes for now 
-                        * --metze 
-                        */
-                       if (total_data < 42) {
-                               DEBUG(0,("call_trans2setfsinfo: SET_FS_QUOTA: requires total_data(%d) >= 42 bytes!\n",
-                                       total_data));
-                               return ERROR_DOS(ERRDOS,ERRunknownlevel);
+               case SMB_SET_CIFS_UNIX_INFO:
+                       {
+                               uint16 client_unix_major;
+                               uint16 client_unix_minor;
+                               uint32 client_unix_cap_low;
+                               uint32 client_unix_cap_high;
+
+                               if (!lp_unix_extensions()) {
+                                       return ERROR_NT(NT_STATUS_INVALID_LEVEL);
+                               }
+
+                               /* There should be 12 bytes of capabilities set. */
+                               if (total_data < 8) {
+                                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                               }
+                               client_unix_major = SVAL(pdata,0);
+                               client_unix_minor = SVAL(pdata,2);
+                               client_unix_cap_low = IVAL(pdata,4);
+                               client_unix_cap_high = IVAL(pdata,8);
+                               /* Just print these values for now. */
+                               DEBUG(10,("call_trans2setfsinfo: set unix info. major = %u, minor = %u \
+cap_low = 0x%x, cap_high = 0x%x\n",
+                                       (unsigned int)client_unix_major,
+                                       (unsigned int)client_unix_minor,
+                                       (unsigned int)client_unix_cap_low,
+                                       (unsigned int)client_unix_cap_high ));
+
+                               /* Here is where we must switch to posix pathname processing... */
+                               if (client_unix_cap_low & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
+                                       lp_set_posix_pathnames();
+                                       mangle_change_to_posix();
+                               }
+
+                               if (client_unix_cap_low & CIFS_UNIX_FCNTL_LOCKS_CAP) {
+                                       lp_set_posix_cifsx_locktype(POSIX_LOCK);
+                               }
+                               break;
                        }
+               case SMB_FS_QUOTA_INFORMATION:
+                       {
+                               files_struct *fsp = NULL;
+                               SMB_NTQUOTA_STRUCT quotas;
+       
+                               ZERO_STRUCT(quotas);
+
+                               /* access check */
+                               if ((current_user.ut.uid != 0)||!CAN_WRITE(conn)) {
+                                       DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n",
+                                               lp_servicename(SNUM(conn)),conn->user));
+                                       return ERROR_DOS(ERRSRV,ERRaccess);
+                               }
+
+                               /* note: normaly there're 48 bytes,
+                                * but we didn't use the last 6 bytes for now 
+                                * --metze 
+                                */
+                               fsp = file_fsp(params,0);
+                               if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
+                                       DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
+                                       return ERROR_NT(NT_STATUS_INVALID_HANDLE);
+                               }
+
+                               if (total_data < 42) {
+                                       DEBUG(0,("call_trans2setfsinfo: SET_FS_QUOTA: requires total_data(%d) >= 42 bytes!\n",
+                                               total_data));
+                                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                               }
                        
-                       /* unknown_1 24 NULL bytes in pdata*/
+                               /* unknown_1 24 NULL bytes in pdata*/
                
-                       /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
-                       quotas.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
+                               /* the soft quotas 8 bytes (SMB_BIG_UINT)*/
+                               quotas.softlim = (SMB_BIG_UINT)IVAL(pdata,24);
 #ifdef LARGE_SMB_OFF_T
-                       quotas.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
+                               quotas.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32);
 #else /* LARGE_SMB_OFF_T */
-                       if ((IVAL(pdata,28) != 0)&&
-                               ((quotas.softlim != 0xFFFFFFFF)||
-                               (IVAL(pdata,28)!=0xFFFFFFFF))) {
-                               /* more than 32 bits? */
-                               return ERROR_DOS(ERRDOS,ERRunknownlevel);
-                       }
+                               if ((IVAL(pdata,28) != 0)&&
+                                       ((quotas.softlim != 0xFFFFFFFF)||
+                                       (IVAL(pdata,28)!=0xFFFFFFFF))) {
+                                       /* more than 32 bits? */
+                                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                               }
 #endif /* LARGE_SMB_OFF_T */
                
-                       /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
-                       quotas.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
+                               /* the hard quotas 8 bytes (SMB_BIG_UINT)*/
+                               quotas.hardlim = (SMB_BIG_UINT)IVAL(pdata,32);
 #ifdef LARGE_SMB_OFF_T
-                       quotas.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
+                               quotas.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32);
 #else /* LARGE_SMB_OFF_T */
-                       if ((IVAL(pdata,36) != 0)&&
-                               ((quotas.hardlim != 0xFFFFFFFF)||
-                               (IVAL(pdata,36)!=0xFFFFFFFF))) {
-                               /* more than 32 bits? */
-                               return ERROR_DOS(ERRDOS,ERRunknownlevel);
-                       }
+                               if ((IVAL(pdata,36) != 0)&&
+                                       ((quotas.hardlim != 0xFFFFFFFF)||
+                                       (IVAL(pdata,36)!=0xFFFFFFFF))) {
+                                       /* more than 32 bits? */
+                                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                               }
 #endif /* LARGE_SMB_OFF_T */
                
-                       /* quota_flags 2 bytes **/
-                       quotas.qflags = SVAL(pdata,40);
+                               /* quota_flags 2 bytes **/
+                               quotas.qflags = SVAL(pdata,40);
                
-                       /* unknown_2 6 NULL bytes follow*/
+                               /* unknown_2 6 NULL bytes follow*/
                
-                       /* now set the quotas */
-                       if (vfs_set_ntquota(fsp, SMB_USER_FS_QUOTA_TYPE, NULL, &quotas)!=0) {
-                               DEBUG(0,("vfs_set_ntquota() failed for service [%s]\n",lp_servicename(SNUM(conn))));
-                               return ERROR_DOS(ERRSRV,ERRerror);
-                       }
+                               /* now set the quotas */
+                               if (vfs_set_ntquota(fsp, SMB_USER_FS_QUOTA_TYPE, NULL, &quotas)!=0) {
+                                       DEBUG(0,("vfs_set_ntquota() failed for service [%s]\n",lp_servicename(SNUM(conn))));
+                                       return ERROR_DOS(ERRSRV,ERRerror);
+                               }
                        
-                       break;
+                               break;
+                       }
                default:
                        DEBUG(3,("call_trans2setfsinfo: unknown level (0x%X) not implemented yet.\n",
                                info_level));
-                       return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                       return ERROR_NT(NT_STATUS_INVALID_LEVEL);
                        break;
        }
 
@@ -2173,7 +2683,6 @@ static int call_trans2setfsinfo(connection_struct *conn, char *inbuf, char *outb
 
        return outsize;
 }
-#endif /* HAVE_SYS_QUOTAS */
 
 /****************************************************************************
  Utility function to set bad path error.
@@ -2317,17 +2826,18 @@ static BOOL marshall_posix_acl(connection_struct *conn, char *pdata, SMB_STRUCT_
 ****************************************************************************/
 
 static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
+                                       unsigned int tran_call,
                                        char **pparams, int total_params, char **ppdata, int total_data,
                                        unsigned int max_data_bytes)
 {
        char *params = *pparams;
        char *pdata = *ppdata;
-       uint16 tran_call = SVAL(inbuf, smb_setup0);
        uint16 info_level;
        int mode=0;
+       int nlink;
        SMB_OFF_T file_size=0;
        SMB_BIG_UINT allocation_size=0;
-       unsigned int data_size;
+       unsigned int data_size = 0;
        unsigned int param_size = 2;
        SMB_STRUCT_STAT sbuf;
        pstring fname, dos_fname;
@@ -2338,9 +2848,13 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
        BOOL bad_path = False;
        BOOL delete_pending = False;
        int len;
-       time_t c_time;
+       time_t create_time, mtime, atime;
+       struct timespec create_time_ts, mtime_ts, atime_ts;
        files_struct *fsp = NULL;
-       uint32 desired_access = 0x12019F; /* Default - GENERIC_EXECUTE mapping from Windows */
+       TALLOC_CTX *data_ctx = NULL;
+       struct ea_list *ea_list = NULL;
+       uint32 access_mask = 0x12019F; /* Default - GENERIC_EXECUTE mapping from Windows */
+       char *lock_data = NULL;
 
        if (!params)
                return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
@@ -2348,8 +2862,9 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
        ZERO_STRUCT(sbuf);
 
        if (tran_call == TRANSACT2_QFILEINFO) {
-               if (total_params < 4)
-                       return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+               if (total_params < 4) {
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
 
                fsp = file_fsp(params,0);
                info_level = SVAL(params,2);
@@ -2364,7 +2879,7 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        pstrcpy(fname, fsp->fsp_name);
                        /* We know this name is ok, it's already passed the checks. */
                        
-               } else if(fsp && (fsp->is_directory || fsp->fd == -1)) {
+               } else if(fsp && (fsp->is_directory || fsp->fh->fd == -1)) {
                        /*
                         * This is actually a QFILEINFO on a directory
                         * handle (returned from an NT SMB). NT5.0 seems
@@ -2384,7 +2899,7 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
                        }
 
-                       delete_pending = fsp->is_directory ? fsp->directory_delete_on_close : 0;
+                       delete_pending = get_delete_on_close_flag(sbuf.st_dev, sbuf.st_ino);
                } else {
                        /*
                         * Original code - this is an open file.
@@ -2392,26 +2907,27 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        CHECK_FSP(fsp,conn);
 
                        pstrcpy(fname, fsp->fsp_name);
-                       if (SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf) != 0) {
+                       if (SMB_VFS_FSTAT(fsp,fsp->fh->fd,&sbuf) != 0) {
                                DEBUG(3,("fstat of fnum %d failed (%s)\n", fsp->fnum, strerror(errno)));
                                return(UNIXERROR(ERRDOS,ERRbadfid));
                        }
-                       pos = fsp->position_information;
-                       delete_pending = fsp->delete_on_close;
-                       desired_access = fsp->desired_access;
+                       pos = fsp->fh->position_information;
+                       delete_pending = get_delete_on_close_flag(sbuf.st_dev, sbuf.st_ino);
+                       access_mask = fsp->access_mask;
                }
        } else {
                NTSTATUS status = NT_STATUS_OK;
 
                /* qpathinfo */
-               if (total_params < 6)
-                       return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+               if (total_params < 6) {
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
 
                info_level = SVAL(params,0);
 
                DEBUG(3,("call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = %d\n", info_level));
 
-               srvstr_get_path(inbuf, fname, &params[6], sizeof(fname), -1, STR_TERMINATE, &status, False);
+               srvstr_get_path(inbuf, fname, &params[6], sizeof(fname), -1, STR_TERMINATE, &status);
                if (!NT_STATUS_IS_OK(status)) {
                        return ERROR_NT(status);
                }
@@ -2437,10 +2953,27 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_STAT of %s failed (%s)\n",fname,strerror(errno)));
                        return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath);
                }
+
+               delete_pending = get_delete_on_close_flag(sbuf.st_dev, sbuf.st_ino);
+               if (delete_pending) {
+                       return ERROR_NT(NT_STATUS_DELETE_PENDING);
+               }
+       }
+
+       nlink = sbuf.st_nlink;
+
+       if ((nlink > 0) && S_ISDIR(sbuf.st_mode)) {
+               /* NTFS does not seem to count ".." */
+               nlink -= 1;
+       }
+
+       if ((nlink > 0) && delete_pending) {
+               nlink -= 1;
        }
 
-       if (INFO_LEVEL_IS_UNIX(info_level) && !lp_unix_extensions())
-               return ERROR_DOS(ERRDOS,ERRunknownlevel);
+       if (INFO_LEVEL_IS_UNIX(info_level) && !lp_unix_extensions()) {
+               return ERROR_NT(NT_STATUS_INVALID_LEVEL);
+       }
 
        DEBUG(3,("call_trans2qfilepathinfo %s (fnum = %d) level=%d call=%d total_data=%d\n",
                fname,fsp ? fsp->fnum : -1, info_level,tran_call,total_data));
@@ -2456,57 +2989,120 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                mode = FILE_ATTRIBUTE_NORMAL;
 
        fullpathname = fname;
-       file_size = get_file_size(sbuf);
-       allocation_size = get_allocation_size(conn,fsp,&sbuf);
-       if (mode & aDIR) {
-               /* This is necessary, as otherwise the desktop.ini file in
-                * this folder is ignored */
-               mode |= (lp_profile_acls(SNUM(conn)) ? aRONLY : 0);
-               file_size = 0;
-       }
-
-       params = SMB_REALLOC(*pparams,2);
-       if (params == NULL)
-         return ERROR_DOS(ERRDOS,ERRnomem);
-       *pparams = params;
-       memset((char *)params,'\0',2);
-       data_size = max_data_bytes + DIR_ENTRY_SAFETY_MARGIN;
-       pdata = SMB_REALLOC(*ppdata, data_size); 
-       if ( pdata == NULL )
-               return ERROR_DOS(ERRDOS,ERRnomem);
-       *ppdata = pdata;
+       if (!(mode & aDIR))
+               file_size = get_file_size(sbuf);
+
+       /* Pull out any data sent here before we realloc. */
+       switch (info_level) {
+               case SMB_INFO_QUERY_EAS_FROM_LIST:
+               {
+                       /* Pull any EA list from the data portion. */
+                       uint32 ea_size;
+
+                       if (total_data < 4) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+                       ea_size = IVAL(pdata,0);
+
+                       if (total_data > 0 && ea_size != total_data) {
+                               DEBUG(4,("call_trans2qfilepathinfo: Rejecting EA request with incorrect \
+total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pdata,0) ));
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+
+                       if (!lp_ea_support(SNUM(conn))) {
+                               return ERROR_DOS(ERRDOS,ERReasnotsupported);
+                       }
+
+                       if ((data_ctx = talloc_init("ea_list")) == NULL) {
+                               return ERROR_NT(NT_STATUS_NO_MEMORY);
+                       }
+
+                       /* Pull out the list of names. */
+                       ea_list = read_ea_name_list(data_ctx, pdata + 4, ea_size - 4);
+                       if (!ea_list) {
+                               talloc_destroy(data_ctx);
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+                       break;
+               }
+
+               case SMB_QUERY_POSIX_LOCK:
+               {
+                       if (fsp == NULL || fsp->fh->fd == -1) {
+                               return ERROR_NT(NT_STATUS_INVALID_HANDLE);
+                       }
+
+                       if (total_data != POSIX_LOCK_DATA_SIZE) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+
+                       if ((data_ctx = talloc_init("lock_request")) == NULL) {
+                               return ERROR_NT(NT_STATUS_NO_MEMORY);
+                       }
+
+                       /* Copy the lock range data. */
+                       lock_data = (char *)talloc_memdup(
+                               data_ctx, pdata, total_data);
+                       if (!lock_data) {
+                               talloc_destroy(data_ctx);
+                               return ERROR_NT(NT_STATUS_NO_MEMORY);
+                       }
+               }
+               default:
+                       break;
+       }
 
-       if (total_data > 0 && IVAL(pdata,0) == total_data) {
-               /* uggh, EAs for OS2 */
-               DEBUG(4,("Rejecting EA request with total_data=%d\n",total_data));
-               return ERROR_DOS(ERRDOS,ERReasnotsupported);
+       *pparams = (char *)SMB_REALLOC(*pparams,2);
+       if (*pparams == NULL) {
+               talloc_destroy(data_ctx);
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
+       params = *pparams;
+       SSVAL(params,0,0);
+       data_size = max_data_bytes + DIR_ENTRY_SAFETY_MARGIN;
+       *ppdata = (char *)SMB_REALLOC(*ppdata, data_size); 
+       if (*ppdata == NULL ) {
+               talloc_destroy(data_ctx);
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
        }
+       pdata = *ppdata;
 
-       memset((char *)pdata,'\0',data_size);
+       create_time_ts = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
+       mtime_ts = get_mtimespec(&sbuf);
+       atime_ts = get_atimespec(&sbuf);
 
-       c_time = get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
+       allocation_size = get_allocation_size(conn,fsp,&sbuf);
 
        if (fsp) {
                if (fsp->pending_modtime) {
                        /* the pending modtime overrides the current modtime */
-                       sbuf.st_mtime = fsp->pending_modtime;
+                       mtime_ts.tv_sec = fsp->pending_modtime;
+                       mtime_ts.tv_nsec = 0;
                }
        } else {
                /* Do we have this path open ? */
                files_struct *fsp1 = file_find_di_first(sbuf.st_dev, sbuf.st_ino);
                if (fsp1 && fsp1->pending_modtime) {
                        /* the pending modtime overrides the current modtime */
-                       sbuf.st_mtime = fsp1->pending_modtime;
+                       mtime_ts.tv_sec = fsp1->pending_modtime;
+                       mtime_ts.tv_nsec = 0;
+               }
+               if (fsp1 && fsp1->initial_allocation_size) {
+                       allocation_size = get_allocation_size(conn, fsp1, &sbuf);
                }
        }
 
        if (lp_dos_filetime_resolution(SNUM(conn))) {
-               c_time &= ~1;
-               sbuf.st_atime &= ~1;
-               sbuf.st_ctime &= ~1;
-               sbuf.st_mtime &= ~1;
+               dos_filetime_timespec(&create_time_ts);
+               dos_filetime_timespec(&mtime_ts);
+               dos_filetime_timespec(&atime_ts);
        }
 
+       create_time = convert_timespec_to_time_t(create_time_ts);
+       mtime = convert_timespec_to_time_t(mtime_ts);
+       atime = convert_timespec_to_time_t(atime_ts);
+
        /* NT expects the name to be in an exact form of the *full*
           filename. See the trans2 torture test */
        if (strequal(base_name,".")) {
@@ -2520,9 +3116,9 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                case SMB_INFO_STANDARD:
                        DEBUG(10,("call_trans2qfilepathinfo: SMB_INFO_STANDARD\n"));
                        data_size = 22;
-                       put_dos_date2(pdata,l1_fdateCreation,c_time);
-                       put_dos_date2(pdata,l1_fdateLastAccess,sbuf.st_atime);
-                       put_dos_date2(pdata,l1_fdateLastWrite,sbuf.st_mtime); /* write time */
+                       srv_put_dos_date2(pdata,l1_fdateCreation,create_time);
+                       srv_put_dos_date2(pdata,l1_fdateLastAccess,atime);
+                       srv_put_dos_date2(pdata,l1_fdateLastWrite,mtime); /* write time */
                        SIVAL(pdata,l1_cbFile,(uint32)file_size);
                        SIVAL(pdata,l1_cbFileAlloc,(uint32)allocation_size);
                        SSVAL(pdata,l1_attrFile,mode);
@@ -2533,13 +3129,13 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        unsigned int ea_size = estimate_ea_size(conn, fsp, fname);
                        DEBUG(10,("call_trans2qfilepathinfo: SMB_INFO_QUERY_EA_SIZE\n"));
                        data_size = 26;
-                       put_dos_date2(pdata,l1_fdateCreation,c_time);
-                       put_dos_date2(pdata,l1_fdateLastAccess,sbuf.st_atime);
-                       put_dos_date2(pdata,l1_fdateLastWrite,sbuf.st_mtime); /* write time */
-                       SIVAL(pdata,l1_cbFile,(uint32)file_size);
-                       SIVAL(pdata,l1_cbFileAlloc,(uint32)allocation_size);
-                       SSVAL(pdata,l1_attrFile,mode);
-                       SIVAL(pdata,l1_attrFile+2,ea_size);
+                       srv_put_dos_date2(pdata,0,create_time);
+                       srv_put_dos_date2(pdata,4,atime);
+                       srv_put_dos_date2(pdata,8,mtime); /* write time */
+                       SIVAL(pdata,12,(uint32)file_size);
+                       SIVAL(pdata,16,(uint32)allocation_size);
+                       SSVAL(pdata,20,mode);
+                       SIVAL(pdata,22,ea_size);
                        break;
                }
 
@@ -2554,21 +3150,51 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        break;
                        
                case SMB_INFO_QUERY_EAS_FROM_LIST:
+               {
+                       size_t total_ea_len = 0;
+                       struct ea_list *ea_file_list = NULL;
+
                        DEBUG(10,("call_trans2qfilepathinfo: SMB_INFO_QUERY_EAS_FROM_LIST\n"));
-                       data_size = 24;
-                       put_dos_date2(pdata,0,c_time);
-                       put_dos_date2(pdata,4,sbuf.st_atime);
-                       put_dos_date2(pdata,8,sbuf.st_mtime);
-                       SIVAL(pdata,12,(uint32)file_size);
-                       SIVAL(pdata,16,(uint32)allocation_size);
-                       SIVAL(pdata,20,mode);
+
+                       ea_file_list = get_ea_list_from_file(data_ctx, conn, fsp, fname, &total_ea_len);
+                       ea_list = ea_list_union(ea_list, ea_file_list, &total_ea_len);
+
+                       if (!ea_list || (total_ea_len > data_size)) {
+                               talloc_destroy(data_ctx);
+                               data_size = 4;
+                               SIVAL(pdata,0,4);   /* EA List Length must be set to 4 if no EA's. */
+                               break;
+                       }
+
+                       data_size = fill_ea_buffer(data_ctx, pdata, data_size, conn, ea_list);
+                       talloc_destroy(data_ctx);
                        break;
+               }
 
                case SMB_INFO_QUERY_ALL_EAS:
-                       DEBUG(10,("call_trans2qfilepathinfo: SMB_INFO_QUERY_ALL_EAS\n"));
+               {
                        /* We have data_size bytes to put EA's into. */
-                       data_size = fill_ea_buffer(pdata, data_size, conn, fsp, fname);
+                       size_t total_ea_len = 0;
+
+                       DEBUG(10,("call_trans2qfilepathinfo: SMB_INFO_QUERY_ALL_EAS\n"));
+
+                       data_ctx = talloc_init("ea_ctx");
+                       if (!data_ctx) {
+                               return ERROR_NT(NT_STATUS_NO_MEMORY);
+                       }
+
+                       ea_list = get_ea_list_from_file(data_ctx, conn, fsp, fname, &total_ea_len);
+                       if (!ea_list || (total_ea_len > data_size)) {
+                               talloc_destroy(data_ctx);
+                               data_size = 4;
+                               SIVAL(pdata,0,4);   /* EA List Length must be set to 4 if no EA's. */
+                               break;
+                       }
+
+                       data_size = fill_ea_buffer(data_ctx, pdata, data_size, conn, ea_list);
+                       talloc_destroy(data_ctx);
                        break;
+               }
 
                case SMB_FILE_BASIC_INFORMATION:
                case SMB_QUERY_FILE_BASIC_INFO:
@@ -2581,22 +3207,18 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                                data_size = 40;
                                SIVAL(pdata,36,0);
                        }
-                       put_long_date(pdata,c_time);
-                       put_long_date(pdata+8,sbuf.st_atime);
-                       put_long_date(pdata+16,sbuf.st_mtime); /* write time */
-                       put_long_date(pdata+24,sbuf.st_mtime); /* change time */
+                       put_long_date_timespec(pdata,create_time_ts);
+                       put_long_date_timespec(pdata+8,atime_ts);
+                       put_long_date_timespec(pdata+16,mtime_ts); /* write time */
+                       put_long_date_timespec(pdata+24,mtime_ts); /* change time */
                        SIVAL(pdata,32,mode);
 
                        DEBUG(5,("SMB_QFBI - "));
-                       {
-                               time_t create_time = c_time;
-                               DEBUG(5,("create: %s ", ctime(&create_time)));
-                       }
-                       DEBUG(5,("access: %s ", ctime(&sbuf.st_atime)));
-                       DEBUG(5,("write: %s ", ctime(&sbuf.st_mtime)));
-                       DEBUG(5,("change: %s ", ctime(&sbuf.st_mtime)));
+                       DEBUG(5,("create: %s ", ctime(&create_time)));
+                       DEBUG(5,("access: %s ", ctime(&atime)));
+                       DEBUG(5,("write: %s ", ctime(&mtime)));
+                       DEBUG(5,("change: %s ", ctime(&mtime)));
                        DEBUG(5,("mode: %x\n", mode));
-
                        break;
 
                case SMB_FILE_STANDARD_INFORMATION:
@@ -2606,12 +3228,10 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        data_size = 24;
                        SOFF_T(pdata,0,allocation_size);
                        SOFF_T(pdata,8,file_size);
-                       if (delete_pending & sbuf.st_nlink)
-                               SIVAL(pdata,16,sbuf.st_nlink - 1);
-                       else
-                               SIVAL(pdata,16,sbuf.st_nlink);
-                       SCVAL(pdata,20,0);
+                       SIVAL(pdata,16,nlink);
+                       SCVAL(pdata,20,delete_pending?1:0);
                        SCVAL(pdata,21,(mode&aDIR)?1:0);
+                       SSVAL(pdata,22,0); /* Padding. */
                        break;
 
                case SMB_FILE_EA_INFORMATION:
@@ -2633,8 +3253,8 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        DEBUG(10,("call_trans2qfilepathinfo: SMB_FILE_ALTERNATE_NAME_INFORMATION\n"));
                        pstrcpy(short_name,base_name);
                        /* Mangle if not already 8.3 */
-                       if(!mangle_is_8_3(short_name, True)) {
-                               mangle_map(short_name,True,True,SNUM(conn));
+                       if(!mangle_is_8_3(short_name, True, conn->params)) {
+                               mangle_map(short_name,True,True,conn->params);
                        }
                        len = srvstr_push(outbuf, pdata+4, short_name, -1, STR_UNICODE);
                        data_size = 4 + len;
@@ -2671,20 +3291,19 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                {
                        unsigned int ea_size = estimate_ea_size(conn, fsp, fname);
                        DEBUG(10,("call_trans2qfilepathinfo: SMB_FILE_ALL_INFORMATION\n"));
-                       put_long_date(pdata,c_time);
-                       put_long_date(pdata+8,sbuf.st_atime);
-                       put_long_date(pdata+16,sbuf.st_mtime); /* write time */
-                       put_long_date(pdata+24,sbuf.st_mtime); /* change time */
+                       put_long_date_timespec(pdata,create_time_ts);
+                       put_long_date_timespec(pdata+8,atime_ts);
+                       put_long_date_timespec(pdata+16,mtime_ts); /* write time */
+                       put_long_date_timespec(pdata+24,mtime_ts); /* change time */
                        SIVAL(pdata,32,mode);
+                       SIVAL(pdata,36,0); /* padding. */
                        pdata += 40;
                        SOFF_T(pdata,0,allocation_size);
                        SOFF_T(pdata,8,file_size);
-                       if (delete_pending && sbuf.st_nlink)
-                               SIVAL(pdata,16,sbuf.st_nlink - 1);
-                       else
-                               SIVAL(pdata,16,sbuf.st_nlink);
+                       SIVAL(pdata,16,nlink);
                        SCVAL(pdata,20,delete_pending);
                        SCVAL(pdata,21,(mode&aDIR)?1:0);
+                       SSVAL(pdata,22,0);
                        pdata += 24;
                        SIVAL(pdata,0,ea_size);
                        pdata += 4; /* EA info */
@@ -2702,14 +3321,14 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                           BasicFileInformationTest. -tpot */
 
                        DEBUG(10,("call_trans2qfilepathinfo: SMB_FILE_INTERNAL_INFORMATION\n"));
-                       SIVAL(pdata,0,sbuf.st_dev);
-                       SIVAL(pdata,4,sbuf.st_ino);
+                       SIVAL(pdata,0,sbuf.st_ino); /* FileIndexLow */
+                       SIVAL(pdata,4,sbuf.st_dev); /* FileIndexHigh */
                        data_size = 8;
                        break;
 
                case SMB_FILE_ACCESS_INFORMATION:
                        DEBUG(10,("call_trans2qfilepathinfo: SMB_FILE_ACCESS_INFORMATION\n"));
-                       SIVAL(pdata,0,desired_access);
+                       SIVAL(pdata,0,access_mask);
                        data_size = 4;
                        break;
 
@@ -2717,7 +3336,7 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        /* Pathname with leading '\'. */
                        {
                                size_t byte_len;
-                               byte_len = dos_PutUniCode(pdata+4,dos_fname,max_data_bytes,False);
+                               byte_len = dos_PutUniCode(pdata+4,dos_fname,(size_t)max_data_bytes,False);
                                DEBUG(10,("call_trans2qfilepathinfo: SMB_FILE_NAME_INFORMATION\n"));
                                SIVAL(pdata,0,byte_len);
                                data_size = 4 + byte_len;
@@ -2761,7 +3380,7 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        if (mode & aDIR) {
                                data_size = 0;
                        } else {
-                               size_t byte_len = dos_PutUniCode(pdata+24,"::$DATA", 0xE, False);
+                               size_t byte_len = dos_PutUniCode(pdata+24,"::$DATA", (size_t)0xE, False);
                                SIVAL(pdata,0,0); /* ??? */
                                SIVAL(pdata,4,byte_len); /* Byte length of unicode string ::$DATA */
                                SOFF_T(pdata,8,file_size);
@@ -2782,10 +3401,10 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
 
                case SMB_FILE_NETWORK_OPEN_INFORMATION:
                        DEBUG(10,("call_trans2qfilepathinfo: SMB_FILE_NETWORK_OPEN_INFORMATION\n"));
-                       put_long_date(pdata,c_time);
-                       put_long_date(pdata+8,sbuf.st_atime);
-                       put_long_date(pdata+16,sbuf.st_mtime); /* write time */
-                       put_long_date(pdata+24,sbuf.st_mtime); /* change time */
+                       put_long_date_timespec(pdata,create_time_ts);
+                       put_long_date_timespec(pdata+8,atime_ts);
+                       put_long_date_timespec(pdata+16,mtime_ts); /* write time */
+                       put_long_date_timespec(pdata+24,mtime_ts); /* change time */
                        SIVAL(pdata,32,allocation_size);
                        SOFF_T(pdata,40,file_size);
                        SIVAL(pdata,48,mode);
@@ -2815,9 +3434,9 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        SOFF_T(pdata,0,get_allocation_size(conn,fsp,&sbuf)); /* Number of bytes used on disk - 64 Bit */
                        pdata += 8;
 
-                       put_long_date(pdata,sbuf.st_ctime);       /* Creation Time 64 Bit */
-                       put_long_date(pdata+8,sbuf.st_atime);     /* Last access time 64 Bit */
-                       put_long_date(pdata+16,sbuf.st_mtime);    /* Last modification time 64 Bit */
+                       put_long_date_timespec(pdata,get_ctimespec(&sbuf));       /* Creation Time 64 Bit */
+                       put_long_date_timespec(pdata+8,get_atimespec(&sbuf));     /* Last access time 64 Bit */
+                       put_long_date_timespec(pdata+16,get_mtimespec(&sbuf));    /* Last modification time 64 Bit */
                        pdata += 24;
 
                        SIVAL(pdata,0,sbuf.st_uid);               /* user id for the owner */
@@ -2839,7 +3458,7 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        SIVAL(pdata,4,0);
                        pdata += 8;
 
-                       SINO_T(pdata,0,(SMB_INO_T)sbuf.st_ino);   /* inode number */
+                       SINO_T_VAL(pdata,0,(SMB_INO_T)sbuf.st_ino);   /* inode number */
                        pdata += 8;
                                
                        SIVAL(pdata,0, unix_perms_to_wire(sbuf.st_mode));     /* Standard UNIX file permissions */
@@ -2848,12 +3467,12 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
 
                        SIVAL(pdata,0,sbuf.st_nlink);             /* number of hard links */
                        SIVAL(pdata,4,0);
-                       pdata += 8+1;
+                       pdata += 8;
                        data_size = PTR_DIFF(pdata,(*ppdata));
 
                        {
                                int i;
-                               DEBUG(4,("call_trans2qfilepathinfo: SMB_QUERY_FILE_UNIX_BASIC"));
+                               DEBUG(4,("call_trans2qfilepathinfo: SMB_QUERY_FILE_UNIX_BASIC "));
 
                                for (i=0; i<100; i++)
                                        DEBUG(4,("%d=%x, ",i, (*ppdata)[i]));
@@ -2892,8 +3511,8 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                                uint16 num_file_acls = 0;
                                uint16 num_def_acls = 0;
 
-                               if (fsp && !fsp->is_directory && (fsp->fd != -1)) {
-                                       file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, fsp->fd);
+                               if (fsp && !fsp->is_directory && (fsp->fh->fd != -1)) {
+                                       file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, fsp->fh->fd);
                                } else {
                                        file_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS);
                                }
@@ -2963,99 +3582,87 @@ static int call_trans2qfilepathinfo(connection_struct *conn, char *inbuf, char *
                        }
 #endif
 
-               default:
-                       return ERROR_DOS(ERRDOS,ERRunknownlevel);
-       }
-
-       send_trans2_replies(outbuf, bufsize, params, param_size, *ppdata, data_size);
-
-       return(-1);
-}
-
-/****************************************************************************
- Deal with the internal needs of setting the delete on close flag. Note that
- as the tdb locking is recursive, it is safe to call this from within 
- open_file_shared. JRA.
-****************************************************************************/
-
-NTSTATUS set_delete_on_close_internal(files_struct *fsp, BOOL delete_on_close, uint32 dosmode)
-{
-       if (delete_on_close) {
-               /*
-                * Only allow delete on close for writable files.
-                */
 
-               if (!lp_delete_readonly(SNUM(fsp->conn))) {
-                       if (dosmode & aRONLY) {
-                               DEBUG(10,("set_delete_on_close_internal: file %s delete on close flag set but file attribute is readonly.\n",
-                                       fsp->fsp_name ));
-                               return NT_STATUS_CANNOT_DELETE;
+               case SMB_QUERY_POSIX_LOCK:
+               {
+                       NTSTATUS status = NT_STATUS_INVALID_LEVEL;
+                       SMB_BIG_UINT count;
+                       SMB_BIG_UINT offset;
+                       uint32 lock_pid;
+                       enum brl_type lock_type;
+
+                       if (total_data != POSIX_LOCK_DATA_SIZE) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
                        }
-               }
-
-               /*
-                * Only allow delete on close for writable shares.
-                */
-
-               if (!CAN_WRITE(fsp->conn)) {
-                       DEBUG(10,("set_delete_on_close_internal: file %s delete on close flag set but write access denied on share.\n",
-                               fsp->fsp_name ));
-                       return NT_STATUS_ACCESS_DENIED;
-               }
 
-               /*
-                * Only allow delete on close for files/directories opened with delete intent.
-                */
+                       switch (SVAL(pdata, POSIX_LOCK_TYPE_OFFSET)) {
+                               case POSIX_LOCK_TYPE_READ:
+                                       lock_type = READ_LOCK;
+                                       break;
+                               case POSIX_LOCK_TYPE_WRITE:
+                                       lock_type = WRITE_LOCK;
+                                       break;
+                               case POSIX_LOCK_TYPE_UNLOCK:
+                               default:
+                                       /* There's no point in asking for an unlock... */
+                                       talloc_destroy(data_ctx);
+                                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 
-               if (!(fsp->desired_access & DELETE_ACCESS)) {
-                       DEBUG(10,("set_delete_on_close_internal: file %s delete on close flag set but delete access denied.\n",
-                               fsp->fsp_name ));
-                       return NT_STATUS_ACCESS_DENIED;
+                       lock_pid = IVAL(pdata, POSIX_LOCK_PID_OFFSET);
+#if defined(HAVE_LONGLONG)
+                       offset = (((SMB_BIG_UINT) IVAL(pdata,(POSIX_LOCK_START_OFFSET+4))) << 32) |
+                                       ((SMB_BIG_UINT) IVAL(pdata,POSIX_LOCK_START_OFFSET));
+                       count = (((SMB_BIG_UINT) IVAL(pdata,(POSIX_LOCK_LEN_OFFSET+4))) << 32) |
+                                       ((SMB_BIG_UINT) IVAL(pdata,POSIX_LOCK_LEN_OFFSET));
+#else /* HAVE_LONGLONG */
+                       offset = (SMB_BIG_UINT)IVAL(pdata,POSIX_LOCK_START_OFFSET);
+                       count = (SMB_BIG_UINT)IVAL(pdata,POSIX_LOCK_LEN_OFFSET);
+#endif /* HAVE_LONGLONG */
+
+                       status = query_lock(fsp,
+                                       &lock_pid,
+                                       &count,
+                                       &offset,
+                                       &lock_type,
+                                       POSIX_LOCK);
+
+                       if (ERROR_WAS_LOCK_DENIED(status)) {
+                               /* Here we need to report who has it locked... */
+                               data_size = POSIX_LOCK_DATA_SIZE;
+
+                               SSVAL(pdata, POSIX_LOCK_TYPE_OFFSET, lock_type);
+                               SSVAL(pdata, POSIX_LOCK_FLAGS_OFFSET, 0);
+                               SIVAL(pdata, POSIX_LOCK_PID_OFFSET, lock_pid);
+#if defined(HAVE_LONGLONG)
+                               SIVAL(pdata, POSIX_LOCK_START_OFFSET, (uint32)(offset & 0xFFFFFFFF));
+                               SIVAL(pdata, POSIX_LOCK_START_OFFSET + 4, (uint32)((offset >> 32) & 0xFFFFFFFF));
+                               SIVAL(pdata, POSIX_LOCK_LEN_OFFSET, (uint32)(count & 0xFFFFFFFF));
+                               SIVAL(pdata, POSIX_LOCK_LEN_OFFSET + 4, (uint32)((count >> 32) & 0xFFFFFFFF));
+#else /* HAVE_LONGLONG */
+                               SIVAL(pdata, POSIX_LOCK_START_OFFSET, offset);
+                               SIVAL(pdata, POSIX_LOCK_LEN_OFFSET, count);
+#endif /* HAVE_LONGLONG */
+
+                       } else if (NT_STATUS_IS_OK(status)) {
+                               /* For success we just return a copy of what we sent
+                                  with the lock type set to POSIX_LOCK_TYPE_UNLOCK. */
+                               data_size = POSIX_LOCK_DATA_SIZE;
+                               memcpy(pdata, lock_data, POSIX_LOCK_DATA_SIZE);
+                               SSVAL(pdata, POSIX_LOCK_TYPE_OFFSET, POSIX_LOCK_TYPE_UNLOCK);
+                       } else {
+                               return ERROR_NT(status);
+                       }
+                       break;
                }
-       }
 
-       if(fsp->is_directory) {
-               fsp->directory_delete_on_close = delete_on_close;
-               DEBUG(10, ("set_delete_on_close_internal: %s delete on close flag for fnum = %d, directory %s\n",
-                       delete_on_close ? "Added" : "Removed", fsp->fnum, fsp->fsp_name ));
-       } else {
-               fsp->delete_on_close = delete_on_close;
-               DEBUG(10, ("set_delete_on_close_internal: %s delete on close flag for fnum = %d, file %s\n",
-                       delete_on_close ? "Added" : "Removed", fsp->fnum, fsp->fsp_name ));
+               default:
+                       return ERROR_NT(NT_STATUS_INVALID_LEVEL);
        }
 
-       return NT_STATUS_OK;
-}
-
-/****************************************************************************
- Sets the delete on close flag over all share modes on this file.
- Modify the share mode entry for all files open
- on this device and inode to tell other smbds we have
- changed the delete on close flag. This will be noticed
- in the close code, the last closer will delete the file
- if flag is set.
-****************************************************************************/
-
-NTSTATUS set_delete_on_close_over_all(files_struct *fsp, BOOL delete_on_close)
-{
-       DEBUG(10,("set_delete_on_close_over_all: %s delete on close flag for fnum = %d, file %s\n",
-               delete_on_close ? "Adding" : "Removing", fsp->fnum, fsp->fsp_name ));
-
-       if (fsp->is_directory || fsp->is_stat)
-               return NT_STATUS_OK;
-
-       if (lock_share_entry_fsp(fsp) == False)
-               return NT_STATUS_ACCESS_DENIED;
+       send_trans2_replies(outbuf, bufsize, params, param_size, *ppdata, data_size, max_data_bytes);
 
-       if (!modify_delete_flag(fsp->dev, fsp->inode, delete_on_close)) {
-               DEBUG(0,("set_delete_on_close_over_all: failed to change delete on close flag for file %s\n",
-                       fsp->fsp_name ));
-               unlock_share_entry_fsp(fsp);
-               return NT_STATUS_ACCESS_DENIED;
-       }
-
-       unlock_share_entry_fsp(fsp);
-       return NT_STATUS_OK;
+       return(-1);
 }
 
 /****************************************************************************
@@ -3147,12 +3754,12 @@ NTSTATUS hardlink_internals(connection_struct *conn, char *oldname, char *newnam
 ****************************************************************************/
 
 static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
+                                       unsigned int tran_call,
                                        char **pparams, int total_params, char **ppdata, int total_data,
                                        unsigned int max_data_bytes)
 {
        char *params = *pparams;
        char *pdata = *ppdata;
-       uint16 tran_call = SVAL(inbuf, smb_setup0);
        uint16 info_level;
        int dosmode=0;
        SMB_OFF_T size=0;
@@ -3171,15 +3778,17 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 
        ZERO_STRUCT(sbuf);
+       ZERO_STRUCT(tvs);
 
        if (tran_call == TRANSACT2_SETFILEINFO) {
-               if (total_params < 4)
-                       return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+               if (total_params < 4) {
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
 
                fsp = file_fsp(params,0);
                info_level = SVAL(params,2);    
 
-               if(fsp && (fsp->is_directory || fsp->fd == -1)) {
+               if(fsp && (fsp->is_directory || fsp->fh->fd == -1)) {
                        /*
                         * This is actually a SETFILEINFO on a directory
                         * handle (returned from an NT SMB). NT5.0 seems
@@ -3195,12 +3804,12 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                         * Doing a DELETE_ON_CLOSE should cancel a print job.
                         */
                        if ((info_level == SMB_SET_FILE_DISPOSITION_INFO) && CVAL(pdata,0)) {
-                               fsp->share_mode = FILE_DELETE_ON_CLOSE;
+                               fsp->fh->private_options |= FILE_DELETE_ON_CLOSE;
 
                                DEBUG(3,("call_trans2setfilepathinfo: Cancelling print job (%s)\n", fsp->fsp_name ));
        
                                SSVAL(params,0,0);
-                               send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0);
+                               send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
                                return(-1);
                        } else
                                return (UNIXERROR(ERRDOS,ERRbadpath));
@@ -3211,7 +3820,7 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                        CHECK_FSP(fsp,conn);
 
                        pstrcpy(fname, fsp->fsp_name);
-                       fd = fsp->fd;
+                       fd = fsp->fh->fd;
 
                        if (SMB_VFS_FSTAT(fsp,fd,&sbuf) != 0) {
                                DEBUG(3,("call_trans2setfilepathinfo: fstat of fnum %d failed (%s)\n",fsp->fnum, strerror(errno)));
@@ -3220,11 +3829,12 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                }
        } else {
                /* set path info */
-               if (total_params < 6)
-                       return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+               if (total_params < 6) {
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
 
                info_level = SVAL(params,0);    
-               srvstr_get_path(inbuf, fname, &params[6], sizeof(fname), -1, STR_TERMINATE, &status, False);
+               srvstr_get_path(inbuf, fname, &params[6], sizeof(fname), -1, STR_TERMINATE, &status);
                if (!NT_STATUS_IS_OK(status)) {
                        return ERROR_NT(status);
                }
@@ -3251,8 +3861,9 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
        if (!CAN_WRITE(conn))
                return ERROR_DOS(ERRSRV,ERRaccess);
 
-       if (INFO_LEVEL_IS_UNIX(info_level) && !lp_unix_extensions())
-               return ERROR_DOS(ERRDOS,ERRunknownlevel);
+       if (INFO_LEVEL_IS_UNIX(info_level) && !lp_unix_extensions()) {
+               return ERROR_NT(NT_STATUS_INVALID_LEVEL);
+       }
 
        if (VALID_STAT(sbuf))
                unixmode = sbuf.st_mode;
@@ -3260,11 +3871,12 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
        DEBUG(3,("call_trans2setfilepathinfo(%d) %s (fnum %d) info_level=%d totdata=%d\n",
                tran_call,fname, fsp ? fsp->fnum : -1, info_level,total_data));
 
-       /* Realloc the parameter and data sizes */
-       params = SMB_REALLOC(*pparams,2);
-       if(params == NULL)
-               return ERROR_DOS(ERRDOS,ERRnomem);
-       *pparams = params;
+       /* Realloc the parameter size */
+       *pparams = (char *)SMB_REALLOC(*pparams,2);
+       if (*pparams == NULL) {
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
+       params = *pparams;
 
        SSVAL(params,0,0);
 
@@ -3285,28 +3897,73 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
        switch (info_level) {
                case SMB_INFO_STANDARD:
                {
-                       if (total_data < 12)
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                       if (total_data < 12) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 
                        /* access time */
-                       tvs.actime = make_unix_date2(pdata+l1_fdateLastAccess);
+                       tvs.actime = srv_make_unix_date2(pdata+l1_fdateLastAccess);
                        /* write time */
-                       tvs.modtime = make_unix_date2(pdata+l1_fdateLastWrite);
+                       tvs.modtime = srv_make_unix_date2(pdata+l1_fdateLastWrite);
                        break;
                }
 
                case SMB_INFO_SET_EA:
-                       status = set_ea(conn, fsp, fname, pdata, total_data);
-                       if (NT_STATUS_V(status) !=  NT_STATUS_V(NT_STATUS_OK))
+               {
+                       struct ea_list *ea_list = NULL;
+                       TALLOC_CTX *ctx = NULL;
+
+                       if (total_data < 10) {
+
+                               /* OS/2 workplace shell seems to send SET_EA requests of "null"
+                                  length. They seem to have no effect. Bug #3212. JRA */
+
+                               if ((total_data == 4) && (IVAL(pdata,0) == 4)) {
+                                       /* We're done. We only get EA info in this call. */
+                                       SSVAL(params,0,0);
+                                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
+                                       return(-1);
+                               }
+
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+
+                       if (IVAL(pdata,0) > total_data) {
+                               DEBUG(10,("call_trans2setfilepathinfo: bad total data size (%u) > %u\n",
+                                       IVAL(pdata,0), (unsigned int)total_data));
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+
+                       ctx = talloc_init("SMB_INFO_SET_EA");
+                       if (!ctx) {
+                               return ERROR_NT(NT_STATUS_NO_MEMORY);
+                       }
+                       ea_list = read_ea_list(ctx, pdata + 4, total_data - 4);
+                       if (!ea_list) {
+                               talloc_destroy(ctx);
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+                       status = set_ea(conn, fsp, fname, ea_list);
+                       talloc_destroy(ctx);
+
+                       if (!NT_STATUS_IS_OK(status)) {
                                return ERROR_NT(status);
-                       break;
+                       }
+
+                       /* We're done. We only get EA info in this call. */
+                       SSVAL(params,0,0);
+                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
+                       return(-1);
+               }
 
+#if 0
+               /* The following 2 info levels are only valid on query, not set. Remove them. JRA. */
                /* XXXX um, i don't think this is right.
                        it's also not in the cifs6.txt spec.
                */
                case SMB_INFO_QUERY_EAS_FROM_LIST:
                        if (total_data < 28)
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 
                        tvs.actime = make_unix_date2(pdata+8);
                        tvs.modtime = make_unix_date2(pdata+12);
@@ -3317,13 +3974,14 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                /* XXXX nor this.  not in cifs6.txt, either. */
                case SMB_INFO_QUERY_ALL_EAS:
                        if (total_data < 28)
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 
                        tvs.actime = make_unix_date2(pdata+8);
                        tvs.modtime = make_unix_date2(pdata+12);
                        size = IVAL(pdata,16);
                        dosmode = IVAL(pdata,24);
                        break;
+#endif
 
                case SMB_SET_FILE_BASIC_INFO:
                case SMB_FILE_BASIC_INFORMATION:
@@ -3332,16 +3990,17 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                        time_t write_time;
                        time_t changed_time;
 
-                       if (total_data < 36)
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                       if (total_data < 36) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 
                        /* Ignore create time at offset pdata. */
 
                        /* access time */
-                       tvs.actime = interpret_long_date(pdata+8);
+                       tvs.actime = convert_timespec_to_time_t(interpret_long_date(pdata+8));
 
-                       write_time = interpret_long_date(pdata+16);
-                       changed_time = interpret_long_date(pdata+24);
+                       write_time = convert_timespec_to_time_t(interpret_long_date(pdata+16));
+                       changed_time = convert_timespec_to_time_t(interpret_long_date(pdata+24));
 
                        tvs.modtime = MIN(write_time, changed_time);
 
@@ -3364,15 +4023,18 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                        int ret = -1;
                        SMB_BIG_UINT allocation_size;
 
-                       if (total_data < 8)
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                       if (total_data < 8) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 
                        allocation_size = (SMB_BIG_UINT)IVAL(pdata,0);
 #ifdef LARGE_SMB_OFF_T
                        allocation_size |= (((SMB_BIG_UINT)IVAL(pdata,4)) << 32);
 #else /* LARGE_SMB_OFF_T */
-                       if (IVAL(pdata,4) != 0) /* more than 32 bits? */
-                               return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                       if (IVAL(pdata,4) != 0) {
+                               /* more than 32 bits? */
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 #endif /* LARGE_SMB_OFF_T */
                        DEBUG(10,("call_trans2setfilepathinfo: Set file allocation info for file %s to %.0f\n",
                                        fname, (double)allocation_size ));
@@ -3389,34 +4051,30 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
  
                                if (fd == -1) {
                                        files_struct *new_fsp = NULL;
-                                       int access_mode = 0;
-                                       int action = 0;
-                                       if(global_oplock_break) {
-                                               /* Queue this file modify as we are the process of an oplock break.  */
-                                               DEBUG(2,("call_trans2setfilepathinfo: queueing message due to being "));
-                                               DEBUGADD(2,( "in oplock break state.\n"));
-                                               push_oplock_pending_smb_message(inbuf, length);
-                                               return -1;
-                                       }
  
-                                       new_fsp = open_file_shared1(conn, fname, &sbuf,FILE_WRITE_DATA,
-                                                                       SET_OPEN_MODE(DOS_OPEN_RDWR),
-                                                                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),
+                                       status = open_file_ntcreate(conn, fname, &sbuf,
+                                                                       FILE_WRITE_DATA,
+                                                                       FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
+                                                                       FILE_OPEN,
+                                                                       0,
                                                                        FILE_ATTRIBUTE_NORMAL,
-                                                                       INTERNAL_OPEN_ONLY, &access_mode, &action);
+                                                                       FORCE_OPLOCK_BREAK_TO_NONE,
+                                                                       NULL, &new_fsp);
  
-                                       if (new_fsp == NULL)
-                                               return(UNIXERROR(ERRDOS,ERRbadpath));
+                                       if (!NT_STATUS_IS_OK(status)) {
+                                               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                                                       /* We have re-scheduled this call. */
+                                                       return -1;
+                                               }
+                                               return(UNIXERROR(ERRDOS,ERRnoaccess));
+                                       }
                                        ret = vfs_allocate_file_space(new_fsp, allocation_size);
-                                       if (SMB_VFS_FSTAT(new_fsp,new_fsp->fd,&new_sbuf) != 0) {
+                                       if (SMB_VFS_FSTAT(new_fsp,new_fsp->fh->fd,&new_sbuf) != 0) {
                                                DEBUG(3,("call_trans2setfilepathinfo: fstat of fnum %d failed (%s)\n",
                                                                        new_fsp->fnum, strerror(errno)));
                                                ret = -1;
                                        }
-                                       close_file(new_fsp,True);
+                                       close_file(new_fsp,NORMAL_CLOSE);
                                } else {
                                        ret = vfs_allocate_file_space(fsp, allocation_size);
                                        if (SMB_VFS_FSTAT(fsp,fd,&new_sbuf) != 0) {
@@ -3438,15 +4096,18 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                case SMB_FILE_END_OF_FILE_INFORMATION:
                case SMB_SET_FILE_END_OF_FILE_INFO:
                {
-                       if (total_data < 8)
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                       if (total_data < 8) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 
                        size = IVAL(pdata,0);
 #ifdef LARGE_SMB_OFF_T
                        size |= (((SMB_OFF_T)IVAL(pdata,4)) << 32);
 #else /* LARGE_SMB_OFF_T */
-                       if (IVAL(pdata,4) != 0) /* more than 32 bits? */
-                               return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                       if (IVAL(pdata,4) != 0) {
+                               /* more than 32 bits? */
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 #endif /* LARGE_SMB_OFF_T */
                        DEBUG(10,("call_trans2setfilepathinfo: Set end of file info for file %s to %.0f\n", fname, (double)size ));
                        break;
@@ -3457,8 +4118,9 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                {
                        BOOL delete_on_close;
 
-                       if (total_data < 1)
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                       if (total_data < 1) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 
                        delete_on_close = (CVAL(pdata,0) ? True : False);
 
@@ -3469,38 +4131,74 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                        if (fsp == NULL)
                                return(UNIXERROR(ERRDOS,ERRbadfid));
 
-                       status = set_delete_on_close_internal(fsp, delete_on_close, dosmode);
+                       status = can_set_delete_on_close(fsp, delete_on_close,
+                                                        dosmode);
  
-                       if (NT_STATUS_V(status) !=  NT_STATUS_V(NT_STATUS_OK))
+                       if (!NT_STATUS_IS_OK(status)) {
                                return ERROR_NT(status);
+                       }
 
                        /* The set is across all open files on this dev/inode pair. */
-                       status =set_delete_on_close_over_all(fsp, delete_on_close);
-                       if (NT_STATUS_V(status) !=  NT_STATUS_V(NT_STATUS_OK))
-                               return ERROR_NT(status);
+                       if (!set_delete_on_close(fsp, delete_on_close, &current_user.ut)) {
+                               return ERROR_NT(NT_STATUS_ACCESS_DENIED);
+                       }
 
-                       break;
+                       SSVAL(params,0,0);
+                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
+                       return(-1);
                }
 
                case SMB_FILE_POSITION_INFORMATION:
                {
                        SMB_BIG_UINT position_information;
 
-                       if (total_data < 8)
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                       if (total_data < 8) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 
                        position_information = (SMB_BIG_UINT)IVAL(pdata,0);
 #ifdef LARGE_SMB_OFF_T
                        position_information |= (((SMB_BIG_UINT)IVAL(pdata,4)) << 32);
 #else /* LARGE_SMB_OFF_T */
-                       if (IVAL(pdata,4) != 0) /* more than 32 bits? */
-                               return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                       if (IVAL(pdata,4) != 0) {
+                               /* more than 32 bits? */
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 #endif /* LARGE_SMB_OFF_T */
                        DEBUG(10,("call_trans2setfilepathinfo: Set file position information for file %s to %.0f\n",
                                        fname, (double)position_information ));
-                       if (fsp)
-                               fsp->position_information = position_information;
-                       break;
+                       if (fsp) {
+                               fsp->fh->position_information = position_information;
+                       }
+
+                       /* We're done. We only get position info in this call. */
+                       SSVAL(params,0,0);
+                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
+                       return(-1);
+               }
+
+               /* From tridge Samba4 : 
+                * MODE_INFORMATION in setfileinfo (I have no
+                * idea what "mode information" on a file is - it takes a value of 0,
+                * 2, 4 or 6. What could it be?).
+                */
+
+               case SMB_FILE_MODE_INFORMATION:
+               {
+                       uint32 mode;
+
+                       if (total_data < 4) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+                       mode = IVAL(pdata,0);
+                       if (mode != 0 && mode != 2 && mode != 4 && mode != 6) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+
+                       /* We're done. We only get mode info in this call. */
+                       SSVAL(params,0,0);
+                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
+                       return(-1);
                }
 
                /*
@@ -3511,8 +4209,9 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
                {
                        uint32 raw_unixmode;
 
-                       if (total_data < 100)
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                       if (total_data < 100) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 
                        if(IVAL(pdata, 0) != SMB_SIZE_NO_CHANGE_LO &&
                           IVAL(pdata, 4) != SMB_SIZE_NO_CHANGE_HI) {
@@ -3520,13 +4219,15 @@ static int call_trans2setfilepathinfo(connection_struct *conn, char *inbuf, char
 #ifdef LARGE_SMB_OFF_T
                                size |= (((SMB_OFF_T)IVAL(pdata,4)) << 32);
 #else /* LARGE_SMB_OFF_T */
-                               if (IVAL(pdata,4) != 0) /* more than 32 bits? */
-                                       return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                               if (IVAL(pdata,4) != 0) {
+                                       /* more than 32 bits? */
+                                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                               }
 #endif /* LARGE_SMB_OFF_T */
                        }
                        pdata+=24;          /* ctime & st_blocks are not changed */
-                       tvs.actime = interpret_long_date(pdata); /* access_time */
-                       tvs.modtime = interpret_long_date(pdata+8); /* modification_time */
+                       tvs.actime = convert_timespec_to_time_t(interpret_long_date(pdata)); /* access_time */
+                       tvs.modtime = convert_timespec_to_time_t(interpret_long_date(pdata+8)); /* modification_time */
                        pdata+=16;
                        set_owner = (uid_t)IVAL(pdata,0);
                        pdata += 8;
@@ -3561,8 +4262,9 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
                                if (tran_call == TRANSACT2_SETFILEINFO)
                                        return(ERROR_DOS(ERRDOS,ERRnoaccess));
 
-                               if (raw_unixmode == SMB_MODE_NO_CHANGE)
-                                       return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                               if (raw_unixmode == SMB_MODE_NO_CHANGE) {
+                                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                               }
 
 #if defined(HAVE_MAKEDEV)
                                dev = makedev(dev_major, dev_minor);
@@ -3610,7 +4312,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
                                inherit_access_acl(conn, fname, unixmode);
 
                                SSVAL(params,0,0);
-                               send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0);
+                               send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
                                return(-1);
                        }
 
@@ -3693,7 +4395,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
                        if (SMB_VFS_SYMLINK(conn,link_target,newname) != 0)
                                return(UNIXERROR(ERRDOS,ERRnoaccess));
                        SSVAL(params,0,0);
-                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0);
+                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
                        return(-1);
                }
 
@@ -3703,7 +4405,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
                        char *newname = fname;
 
                        /* Set a hard link. */
-                       srvstr_get_path(inbuf, oldname, pdata, sizeof(oldname), -1, STR_TERMINATE, &status, False);
+                       srvstr_get_path(inbuf, oldname, pdata, sizeof(oldname), -1, STR_TERMINATE, &status);
                        if (!NT_STATUS_IS_OK(status)) {
                                return ERROR_NT(status);
                        }
@@ -3717,26 +4419,27 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
                        }
 
                        SSVAL(params,0,0);
-                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0);
+                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
                        return(-1);
                }
 
                case SMB_FILE_RENAME_INFORMATION:
                {
                        BOOL overwrite;
-                       uint32 root_fid;
+                       /* uint32 root_fid; */  /* Not used */
                        uint32 len;
                        pstring newname;
                        pstring base_name;
                        char *p;
 
-                       if (total_data < 12)
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                       if (total_data < 12) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
 
                        overwrite = (CVAL(pdata,0) ? True : False);
-                       root_fid = IVAL(pdata,4);
+                       /* root_fid = IVAL(pdata,4); */
                        len = IVAL(pdata,8);
-                       srvstr_get_path(inbuf, newname, &pdata[12], sizeof(newname), len, 0, &status, False);
+                       srvstr_get_path(inbuf, newname, &pdata[12], sizeof(newname), len, 0, &status);
                        if (!NT_STATUS_IS_OK(status)) {
                                return ERROR_NT(status);
                        }
@@ -3763,14 +4466,14 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
                        } else {
                                DEBUG(10,("call_trans2setfilepathinfo: SMB_FILE_RENAME_INFORMATION %s -> %s\n",
                                        fname, newname ));
-                               status = rename_internals(conn, fname, base_name, 0, overwrite);
+                               status = rename_internals(conn, fname, base_name, 0, overwrite, False);
                        }
                        if (!NT_STATUS_IS_OK(status)) {
                                return ERROR_NT(status);
                        }
                        process_pending_change_notify_queue((time_t)0);
                        SSVAL(params,0,0);
-                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0);
+                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
                        return(-1);
                }
 
@@ -3784,7 +4487,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
                        BOOL valid_def_acls = True;
 
                        if (total_data < SMB_POSIX_ACL_HEADER_SIZE) {
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
                        }
                        posix_acl_version = SVAL(pdata,0);
                        num_file_acls = SVAL(pdata,2);
@@ -3801,12 +4504,12 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
                        }
 
                        if (posix_acl_version != SMB_POSIX_ACL_VERSION) {
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
                        }
 
                        if (total_data < SMB_POSIX_ACL_HEADER_SIZE +
                                        (num_file_acls+num_def_acls)*SMB_POSIX_ACL_ENTRY_SIZE) {
-                               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
                        }
 
                        if (valid_file_acls && !set_unix_posix_acl(conn, fsp, fname, num_file_acls,
@@ -3821,13 +4524,118 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
                        }
 
                        SSVAL(params,0,0);
-                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0);
+                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
                        return(-1);
                }
 #endif
 
+               case SMB_SET_POSIX_LOCK:
+               {
+                       SMB_BIG_UINT count;
+                       SMB_BIG_UINT offset;
+                       uint32 lock_pid;
+                       BOOL blocking_lock = False;
+                       enum brl_type lock_type;
+
+                       if (fsp == NULL || fsp->fh->fd == -1) {
+                               return ERROR_NT(NT_STATUS_INVALID_HANDLE);
+                       }
+
+                       if (total_data != POSIX_LOCK_DATA_SIZE) {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+
+                       switch (SVAL(pdata, POSIX_LOCK_TYPE_OFFSET)) {
+                               case POSIX_LOCK_TYPE_READ:
+                                       lock_type = READ_LOCK;
+                                       break;
+                               case POSIX_LOCK_TYPE_WRITE:
+                                       /* Return the right POSIX-mappable error code for files opened read-only. */
+                                       if (!fsp->can_write) {
+                                               return ERROR_NT(NT_STATUS_INVALID_HANDLE);
+                                       }
+                                       lock_type = WRITE_LOCK;
+                                       break;
+                               case POSIX_LOCK_TYPE_UNLOCK:
+                                       lock_type = UNLOCK_LOCK;
+                                       break;
+                               default:
+                                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+
+                       if (SVAL(pdata,POSIX_LOCK_FLAGS_OFFSET) == POSIX_LOCK_FLAG_NOWAIT) {
+                               blocking_lock = False;
+                       } else if (SVAL(pdata,POSIX_LOCK_FLAGS_OFFSET) == POSIX_LOCK_FLAG_WAIT) {
+                               blocking_lock = True;
+                       } else {
+                               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+                       }
+
+                       if (!lp_blocking_locks(SNUM(conn))) { 
+                               blocking_lock = False;
+                       }
+
+                       lock_pid = IVAL(pdata, POSIX_LOCK_PID_OFFSET);
+#if defined(HAVE_LONGLONG)
+                       offset = (((SMB_BIG_UINT) IVAL(pdata,(POSIX_LOCK_START_OFFSET+4))) << 32) |
+                                       ((SMB_BIG_UINT) IVAL(pdata,POSIX_LOCK_START_OFFSET));
+                       count = (((SMB_BIG_UINT) IVAL(pdata,(POSIX_LOCK_LEN_OFFSET+4))) << 32) |
+                                       ((SMB_BIG_UINT) IVAL(pdata,POSIX_LOCK_LEN_OFFSET));
+#else /* HAVE_LONGLONG */
+                       offset = (SMB_BIG_UINT)IVAL(pdata,POSIX_LOCK_START_OFFSET);
+                       count = (SMB_BIG_UINT)IVAL(pdata,POSIX_LOCK_LEN_OFFSET);
+#endif /* HAVE_LONGLONG */
+
+                       if (lock_type == UNLOCK_LOCK) {
+                               status = do_unlock(fsp,
+                                               lock_pid,
+                                               count,
+                                               offset,
+                                               POSIX_LOCK);
+                       } else {
+                               struct byte_range_lock *br_lck = do_lock(fsp,
+                                                                       lock_pid,
+                                                                       count,
+                                                                       offset,
+                                                                       lock_type,
+                                                                       POSIX_LOCK,
+                                                                       blocking_lock,
+                                                                       &status);
+
+                               if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
+                                       /*
+                                        * A blocking lock was requested. Package up
+                                        * this smb into a queued request and push it
+                                        * onto the blocking lock queue.
+                                        */
+                                       if(push_blocking_lock_request(br_lck,
+                                                               inbuf, length,
+                                                               fsp,
+                                                               -1, /* infinite timeout. */
+                                                               0,
+                                                               lock_pid,
+                                                               lock_type,
+                                                               POSIX_LOCK,
+                                                               offset,
+                                                               count)) {
+                                               TALLOC_FREE(br_lck);
+                                               return -1;
+                                       }
+                               }
+                               TALLOC_FREE(br_lck);
+                       }
+
+                       if (!NT_STATUS_IS_OK(status)) {
+                               return ERROR_NT(status);
+                       }
+
+                       SSVAL(params,0,0);
+                       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
+                       return(-1);
+               }
+
                default:
-                       return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                       return ERROR_NT(NT_STATUS_INVALID_LEVEL);
        }
 
        /* get some defaults (no modifications) if any info is zero or -1. */
@@ -3891,35 +4699,32 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
 
                if (fd == -1) {
                        files_struct *new_fsp = NULL;
-                       int access_mode = 0;
-                       int action = 0;
-
-                       if(global_oplock_break) {
-                               /* Queue this file modify as we are the process of an oplock break.  */
 
-                               DEBUG(2,("call_trans2setfilepathinfo: queueing message due to being "));
-                               DEBUGADD(2,( "in oplock break state.\n"));
-
-                               push_oplock_pending_smb_message(inbuf, length);
-                               return -1;
-                       }
-
-                       new_fsp = open_file_shared(conn, fname, &sbuf,
-                                               SET_OPEN_MODE(DOS_OPEN_RDWR),
-                                               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),
+                       status = open_file_ntcreate(conn, fname, &sbuf,
+                                               FILE_WRITE_DATA,
+                                               FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
+                                               FILE_OPEN,
+                                               0,
                                                FILE_ATTRIBUTE_NORMAL,
-                                               INTERNAL_OPEN_ONLY, &access_mode, &action);
+                                               FORCE_OPLOCK_BREAK_TO_NONE,
+                                               NULL, &new_fsp);
        
-                       if (new_fsp == NULL)
-                               return(UNIXERROR(ERRDOS,ERRbadpath));
+                       if (!NT_STATUS_IS_OK(status)) {
+                               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                                       /* We have re-scheduled this call. */
+                                       return -1;
+                               }
+                               return(UNIXERROR(ERRDOS,ERRnoaccess));
+                       }
                        ret = vfs_set_filelen(new_fsp, size);
-                       close_file(new_fsp,True);
+                       close_file(new_fsp,NORMAL_CLOSE);
                } else {
                        ret = vfs_set_filelen(fsp, size);
                }
 
-               if (ret == -1)
+               if (ret == -1) {
                        return (UNIXERROR(ERRHRD,ERRdiskfull));
+               }
        }
 
        /*
@@ -3951,7 +4756,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n",
        }
 
        SSVAL(params,0,0);
-       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0);
+       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
   
        return(-1);
 }
@@ -3965,19 +4770,23 @@ static int call_trans2mkdir(connection_struct *conn, char *inbuf, char *outbuf,
                                        unsigned int max_data_bytes)
 {
        char *params = *pparams;
+       char *pdata = *ppdata;
        pstring directory;
        int ret = -1;
        SMB_STRUCT_STAT sbuf;
        BOOL bad_path = False;
        NTSTATUS status = NT_STATUS_OK;
+       TALLOC_CTX *ctx = NULL;
+       struct ea_list *ea_list = NULL;
 
        if (!CAN_WRITE(conn))
                return ERROR_DOS(ERRSRV,ERRaccess);
 
-       if (total_params < 4)
-               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+       if (total_params < 4) {
+               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+       }
 
-       srvstr_get_path(inbuf, directory, &params[4], sizeof(directory), -1, STR_TERMINATE, &status, False);
+       srvstr_get_path(inbuf, directory, &params[4], sizeof(directory), -1, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                return ERROR_NT(status);
        }
@@ -3988,23 +4797,71 @@ static int call_trans2mkdir(connection_struct *conn, char *inbuf, char *outbuf,
        if (bad_path) {
                return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
        }
-       if (check_name(directory,conn))
+
+       /* Any data in this call is an EA list. */
+       if (total_data && (total_data != 4) && !lp_ea_support(SNUM(conn))) {
+               return ERROR_NT(NT_STATUS_EAS_NOT_SUPPORTED);
+       }
+
+       /*
+        * OS/2 workplace shell seems to send SET_EA requests of "null"
+        * length (4 bytes containing IVAL 4).
+        * They seem to have no effect. Bug #3212. JRA.
+        */
+
+       if (total_data != 4) {
+               if (total_data < 10) {
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+
+               if (IVAL(pdata,0) > total_data) {
+                       DEBUG(10,("call_trans2mkdir: bad total data size (%u) > %u\n",
+                               IVAL(pdata,0), (unsigned int)total_data));
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+
+               ctx = talloc_init("TRANS2_MKDIR_SET_EA");
+               if (!ctx) {
+                       return ERROR_NT(NT_STATUS_NO_MEMORY);
+               }
+               ea_list = read_ea_list(ctx, pdata + 4, total_data - 4);
+               if (!ea_list) {
+                       talloc_destroy(ctx);
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+       } else if (IVAL(pdata,0) != 4) {
+               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+       }
+
+       if (check_name(directory,conn)) {
                ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory,True));
+       }
   
        if(ret < 0) {
+               talloc_destroy(ctx);
                DEBUG(5,("call_trans2mkdir error (%s)\n", strerror(errno)));
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess);
        }
 
+       /* Try and set any given EA. */
+       if (total_data) {
+               status = set_ea(conn, NULL, directory, ea_list);
+               talloc_destroy(ctx);
+               if (!NT_STATUS_IS_OK(status)) {
+                       return ERROR_NT(status);
+               }
+       }
+
        /* Realloc the parameter and data sizes */
-       params = SMB_REALLOC(*pparams,2);
-       if(params == NULL)
-               return ERROR_DOS(ERRDOS,ERRnomem);
-       *pparams = params;
+       *pparams = (char *)SMB_REALLOC(*pparams,2);
+       if(*pparams == NULL) {
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
+       params = *pparams;
 
        SSVAL(params,0,0);
 
-       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0);
+       send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0, max_data_bytes);
   
        return(-1);
 }
@@ -4022,8 +4879,9 @@ static int call_trans2findnotifyfirst(connection_struct *conn, char *inbuf, char
        char *params = *pparams;
        uint16 info_level;
 
-       if (total_params < 6)
-               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+       if (total_params < 6) {
+               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+       }
 
        info_level = SVAL(params,4);
        DEBUG(3,("call_trans2findnotifyfirst - info_level %d\n", info_level));
@@ -4033,14 +4891,15 @@ static int call_trans2findnotifyfirst(connection_struct *conn, char *inbuf, char
                case 2:
                        break;
                default:
-                       return ERROR_DOS(ERRDOS,ERRunknownlevel);
+                       return ERROR_NT(NT_STATUS_INVALID_LEVEL);
        }
 
        /* Realloc the parameter and data sizes */
-       params = SMB_REALLOC(*pparams,6);
-       if(params == NULL) 
-               return ERROR_DOS(ERRDOS,ERRnomem);
-       *pparams = params;
+       *pparams = (char *)SMB_REALLOC(*pparams,6);
+       if (*pparams == NULL) {
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
+       params = *pparams;
 
        SSVAL(params,0,fnf_handle);
        SSVAL(params,2,0); /* No changes */
@@ -4051,7 +4910,7 @@ static int call_trans2findnotifyfirst(connection_struct *conn, char *inbuf, char
        if(fnf_handle == 0)
                fnf_handle = 257;
 
-       send_trans2_replies(outbuf, bufsize, params, 6, *ppdata, 0);
+       send_trans2_replies(outbuf, bufsize, params, 6, *ppdata, 0, max_data_bytes);
   
        return(-1);
 }
@@ -4070,15 +4929,16 @@ static int call_trans2findnotifynext(connection_struct *conn, char *inbuf, char
        DEBUG(3,("call_trans2findnotifynext\n"));
 
        /* Realloc the parameter and data sizes */
-       params = SMB_REALLOC(*pparams,4);
-       if(params == NULL)
-               return ERROR_DOS(ERRDOS,ERRnomem);
-       *pparams = params;
+       *pparams = (char *)SMB_REALLOC(*pparams,4);
+       if (*pparams == NULL) {
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
+       params = *pparams;
 
        SSVAL(params,0,0); /* No changes */
        SSVAL(params,2,0); /* No EA errors */
 
-       send_trans2_replies(outbuf, bufsize, params, 4, *ppdata, 0);
+       send_trans2_replies(outbuf, bufsize, params, 4, *ppdata, 0, max_data_bytes);
   
        return(-1);
 }
@@ -4098,8 +4958,9 @@ static int call_trans2getdfsreferral(connection_struct *conn, char* inbuf, char*
 
        DEBUG(10,("call_trans2getdfsreferral\n"));
 
-       if (total_params < 2)
-               return(ERROR_DOS(ERRDOS,ERRinvalidparam));
+       if (total_params < 2) {
+               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+       }
 
        max_referral_level = SVAL(params,0);
 
@@ -4111,7 +4972,7 @@ static int call_trans2getdfsreferral(connection_struct *conn, char* inbuf, char*
                return UNIXERROR(ERRDOS,ERRbadfile);
     
        SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | FLAGS2_DFS_PATHNAMES);
-       send_trans2_replies(outbuf,bufsize,0,0,*ppdata,reply_size);
+       send_trans2_replies(outbuf,bufsize,0,0,*ppdata,reply_size, max_data_bytes);
 
        return(-1);
 }
@@ -4137,10 +4998,11 @@ static int call_trans2ioctl(connection_struct *conn, char* inbuf, char* outbuf,
 
        if ((SVAL(inbuf,(smb_setup+4)) == LMCAT_SPL) &&
                        (SVAL(inbuf,(smb_setup+6)) == LMFUNC_GETJOBID)) {
-               pdata = SMB_REALLOC(*ppdata, 32);
-               if(pdata == NULL)
-                       return ERROR_DOS(ERRDOS,ERRnomem);
-               *ppdata = pdata;
+               *ppdata = (char *)SMB_REALLOC(*ppdata, 32);
+               if (*ppdata == NULL) {
+                       return ERROR_NT(NT_STATUS_NO_MEMORY);
+               }
+               pdata = *ppdata;
 
                /* NOTE - THIS IS ASCII ONLY AT THE MOMENT - NOT SURE IF OS/2
                        CAN ACCEPT THIS IN UNICODE. JRA. */
@@ -4148,7 +5010,7 @@ static int call_trans2ioctl(connection_struct *conn, char* inbuf, char* outbuf,
                SSVAL(pdata,0,fsp->rap_print_jobid);                     /* Job number */
                srvstr_push( outbuf, pdata + 2, global_myname(), 15, STR_ASCII|STR_TERMINATE); /* Our NetBIOS name */
                srvstr_push( outbuf, pdata+18, lp_servicename(SNUM(conn)), 13, STR_ASCII|STR_TERMINATE); /* Service name */
-               send_trans2_replies(outbuf,bufsize,*pparams,0,*ppdata,32);
+               send_trans2_replies(outbuf,bufsize,*pparams,0,*ppdata,32, max_data_bytes);
                return(-1);
        } else {
                DEBUG(2,("Unknown TRANS2_IOCTL\n"));
@@ -4171,7 +5033,7 @@ int reply_findclose(connection_struct *conn,
 
        dptr_close(&dptr_num);
 
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
 
        DEBUG(3,("SMBfindclose dptr_num = %d\n", dptr_num));
 
@@ -4198,7 +5060,7 @@ int reply_findnclose(connection_struct *conn,
           findnotifyfirst - so any dptr_num is ok here. 
           Just ignore it. */
 
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
 
        DEBUG(3,("SMB_findnclose dptr_num = %d\n", dptr_num));
 
@@ -4206,340 +5068,448 @@ int reply_findnclose(connection_struct *conn,
        return(outsize);
 }
 
-/****************************************************************************
- Reply to a SMBtranss2 - just ignore it!
-****************************************************************************/
-
-int reply_transs2(connection_struct *conn,
-                 char *inbuf,char *outbuf,int length,int bufsize)
+int handle_trans2(connection_struct *conn,
+                 struct trans_state *state,
+                 char *inbuf, char *outbuf, int size, int bufsize)
 {
-       START_PROFILE(SMBtranss2);
-       DEBUG(4,("Ignoring transs2 of length %d\n",length));
-       END_PROFILE(SMBtranss2);
-       return(-1);
-}
-
-/****************************************************************************
- Reply to a SMBtrans2.
-****************************************************************************/
-
-int reply_trans2(connection_struct *conn,
-                char *inbuf,char *outbuf,int length,int bufsize)
-{
-       int outsize = 0;
-       unsigned int total_params = SVAL(inbuf, smb_tpscnt);
-       unsigned int total_data =SVAL(inbuf, smb_tdscnt);
-       unsigned int max_data_bytes = SVAL(inbuf, smb_mdrcnt);
-#if 0
-       unsigned int max_param_reply = SVAL(inbuf, smb_mprcnt);
-       unsigned int max_setup_fields = SVAL(inbuf, smb_msrcnt);
-       BOOL close_tid = BITSETW(inbuf+smb_flags,0);
-       BOOL no_final_response = BITSETW(inbuf+smb_flags,1);
-       int32 timeout = IVALS(inbuf,smb_timeout);
-#endif
-       unsigned int suwcnt = SVAL(inbuf, smb_suwcnt);
-       unsigned int tran_call = SVAL(inbuf, smb_setup0);
-       char *params = NULL, *data = NULL;
-       unsigned int num_params, num_params_sofar, num_data, num_data_sofar;
-       START_PROFILE(SMBtrans2);
-
-       if(global_oplock_break && (tran_call == TRANSACT2_OPEN)) {
-               /* Queue this open message as we are the process of an
-                * oplock break.  */
-
-               DEBUG(2,("reply_trans2: queueing message trans2open due to being "));
-               DEBUGADD(2,( "in oplock break state.\n"));
-
-               push_oplock_pending_smb_message(inbuf, length);
-               END_PROFILE(SMBtrans2);
-               return -1;
-       }
-       
-       if (IS_IPC(conn) && (tran_call != TRANSACT2_OPEN)
-            && (tran_call != TRANSACT2_GET_DFS_REFERRAL)) {
-               END_PROFILE(SMBtrans2);
-               return ERROR_DOS(ERRSRV,ERRaccess);
-       }
-
-       outsize = set_message(outbuf,0,0,True);
-
-       /* All trans2 messages we handle have smb_sucnt == 1 - ensure this
-          is so as a sanity check */
-       if (suwcnt != 1) {
-               /*
-                * Need to have rc=0 for ioctl to get job id for OS/2.
-                *  Network printing will fail if function is not successful.
-                *  Similar function in reply.c will be used if protocol
-                *  is LANMAN1.0 instead of LM1.2X002.
-                *  Until DosPrintSetJobInfo with PRJINFO3 is supported,
-                *  outbuf doesn't have to be set(only job id is used).
-                */
-               if ( (suwcnt == 4) && (tran_call == TRANSACT2_IOCTL) &&
-                               (SVAL(inbuf,(smb_setup+4)) == LMCAT_SPL) &&
-                               (SVAL(inbuf,(smb_setup+6)) == LMFUNC_GETJOBID)) {
-                       DEBUG(2,("Got Trans2 DevIOctl jobid\n"));
-               } else {
-                       DEBUG(2,("Invalid smb_sucnt in trans2 call(%u)\n",suwcnt));
-                       DEBUG(2,("Transaction is %d\n",tran_call));
-                       END_PROFILE(SMBtrans2);
-                       ERROR_DOS(ERRDOS,ERRinvalidparam);
-               }
-       }
-    
-       /* Allocate the space for the maximum needed parameters and data */
-       if (total_params > 0)
-               params = (char *)SMB_MALLOC(total_params);
-       if (total_data > 0)
-               data = (char *)SMB_MALLOC(total_data);
-  
-       if ((total_params && !params)  || (total_data && !data)) {
-               DEBUG(2,("Out of memory in reply_trans2\n"));
-               SAFE_FREE(params);
-               SAFE_FREE(data); 
-               END_PROFILE(SMBtrans2);
-               return ERROR_DOS(ERRDOS,ERRnomem);
-       }
-
-       /* Copy the param and data bytes sent with this request into
-          the params buffer */
-       num_params = num_params_sofar = SVAL(inbuf,smb_pscnt);
-       num_data = num_data_sofar = SVAL(inbuf, smb_dscnt);
-
-       if (num_params > total_params || num_data > total_data)
-               exit_server("invalid params in reply_trans2");
-
-       if(params) {
-               unsigned int psoff = SVAL(inbuf, smb_psoff);
-               if ((psoff + num_params < psoff) || (psoff + num_params < num_params))
-                       goto bad_param;
-               if ((smb_base(inbuf) + psoff + num_params > inbuf + length) ||
-                               (smb_base(inbuf) + psoff + num_params < smb_base(inbuf)))
-                       goto bad_param;
-               memcpy( params, smb_base(inbuf) + psoff, num_params);
-       }
-       if(data) {
-               unsigned int dsoff = SVAL(inbuf, smb_dsoff);
-               if ((dsoff + num_data < dsoff) || (dsoff + num_data < num_data))
-                       goto bad_param;
-               if ((smb_base(inbuf) + dsoff + num_data > inbuf + length) ||
-                               (smb_base(inbuf) + dsoff + num_data < smb_base(inbuf)))
-                       goto bad_param;
-               memcpy( data, smb_base(inbuf) + dsoff, num_data);
-       }
-
-       srv_signing_trans_start(SVAL(inbuf,smb_mid));
-
-       if(num_data_sofar < total_data || num_params_sofar < total_params)  {
-               /* We need to send an interim response then receive the rest
-                  of the parameter/data bytes */
-               outsize = set_message(outbuf,0,0,True);
-               srv_signing_trans_stop();
-               if (!send_smb(smbd_server_fd(),outbuf))
-                       exit_server("reply_trans2: send_smb failed.");
-
-               while (num_data_sofar < total_data || 
-                      num_params_sofar < total_params) {
-                       BOOL ret;
-                       unsigned int param_disp;
-                       unsigned int param_off;
-                       unsigned int data_disp;
-                       unsigned int data_off;
-
-                       ret = receive_next_smb(inbuf,bufsize,SMB_SECONDARY_WAIT);
-                       
-                       /*
-                        * The sequence number for the trans reply is always
-                        * based on the last secondary received.
-                        */
+       int outsize;
 
-                       srv_signing_trans_start(SVAL(inbuf,smb_mid));
-
-                       if ((ret && 
-                            (CVAL(inbuf, smb_com) != SMBtranss2)) || !ret) {
-                               outsize = set_message(outbuf,0,0,True);
-                               if(ret)
-                                       DEBUG(0,("reply_trans2: Invalid secondary trans2 packet\n"));
-                               else
-                                       DEBUG(0,("reply_trans2: %s in getting secondary trans2 response.\n",
-                                                (smb_read_error == READ_ERROR) ? "error" : "timeout" ));
-                               goto bad_param;
-                       }
-      
-                       /* Revise total_params and total_data in case
-                           they have changed downwards */
-                       if (SVAL(inbuf, smb_tpscnt) < total_params)
-                               total_params = SVAL(inbuf, smb_tpscnt);
-                       if (SVAL(inbuf, smb_tdscnt) < total_data)
-                               total_data = SVAL(inbuf, smb_tdscnt);
-
-                       num_params = SVAL(inbuf,smb_spscnt);
-                       param_off = SVAL(inbuf, smb_spsoff);
-                       param_disp = SVAL(inbuf, smb_spsdisp);
-                       num_params_sofar += num_params;
-
-                       num_data = SVAL(inbuf, smb_sdscnt);
-                       data_off = SVAL(inbuf, smb_sdsoff);
-                       data_disp = SVAL(inbuf, smb_sdsdisp);
-                       num_data_sofar += num_data;
-
-                       if (num_params_sofar > total_params || num_data_sofar > total_data)
-                               goto bad_param;
-                       
-                       if (num_params) {
-                               if (param_disp + num_params > total_params)
-                                       goto bad_param;
-                               if ((param_disp + num_params < param_disp) ||
-                                               (param_disp + num_params < num_params))
-                                       goto bad_param;
-                               if (param_disp > total_params)
-                                       goto bad_param;
-                               if ((smb_base(inbuf) + param_off + num_params >= inbuf + bufsize) ||
-                                               (smb_base(inbuf) + param_off + num_params < smb_base(inbuf)))
-                                       goto bad_param;
-                               if (params + param_disp < params)
-                                       goto bad_param;
-
-                               memcpy( &params[param_disp], smb_base(inbuf) + param_off, num_params);
-                       }
-                       if (num_data) {
-                               if (data_disp + num_data > total_data)
-                                       goto bad_param;
-                               if ((data_disp + num_data < data_disp) ||
-                                               (data_disp + num_data < num_data))
-                                       goto bad_param;
-                               if (data_disp > total_data)
-                                       goto bad_param;
-                               if ((smb_base(inbuf) + data_off + num_data >= inbuf + bufsize) ||
-                                               (smb_base(inbuf) + data_off + num_data < smb_base(inbuf)))
-                                       goto bad_param;
-                               if (data + data_disp < data)
-                                       goto bad_param;
-
-                               memcpy( &data[data_disp], smb_base(inbuf) + data_off, num_data);
-                       }
-               }
-       }
-       
        if (Protocol >= PROTOCOL_NT1) {
                SSVAL(outbuf,smb_flg2,SVAL(outbuf,smb_flg2) | 0x40); /* IS_LONG_NAME */
        }
 
        /* Now we must call the relevant TRANS2 function */
-       switch(tran_call)  {
+       switch(state->call)  {
        case TRANSACT2_OPEN:
+       {
                START_PROFILE_NESTED(Trans2_open);
-               outsize = call_trans2open(conn, inbuf, outbuf, bufsize, 
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2open(
+                       conn, inbuf, outbuf, bufsize, 
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_open);
                break;
+       }
 
        case TRANSACT2_FINDFIRST:
+       {
                START_PROFILE_NESTED(Trans2_findfirst);
-               outsize = call_trans2findfirst(conn, inbuf, outbuf, bufsize,
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2findfirst(
+                       conn, inbuf, outbuf, bufsize,
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_findfirst);
                break;
+       }
 
        case TRANSACT2_FINDNEXT:
+       {
                START_PROFILE_NESTED(Trans2_findnext);
-               outsize = call_trans2findnext(conn, inbuf, outbuf, length, bufsize, 
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2findnext(
+                       conn, inbuf, outbuf, size, bufsize, 
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_findnext);
                break;
+       }
 
        case TRANSACT2_QFSINFO:
+       {
                START_PROFILE_NESTED(Trans2_qfsinfo);
-               outsize = call_trans2qfsinfo(conn, inbuf, outbuf, length, bufsize,
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2qfsinfo(
+                       conn, inbuf, outbuf, size, bufsize,
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_qfsinfo);
            break;
+       }
 
-#ifdef HAVE_SYS_QUOTAS
        case TRANSACT2_SETFSINFO:
+       {
                START_PROFILE_NESTED(Trans2_setfsinfo);
-               outsize = call_trans2setfsinfo(conn, inbuf, outbuf, length, bufsize, 
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2setfsinfo(
+                       conn, inbuf, outbuf, size, bufsize, 
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_setfsinfo);
                break;
-#endif
+       }
+
        case TRANSACT2_QPATHINFO:
        case TRANSACT2_QFILEINFO:
+       {
                START_PROFILE_NESTED(Trans2_qpathinfo);
-               outsize = call_trans2qfilepathinfo(conn, inbuf, outbuf, length, bufsize, 
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2qfilepathinfo(
+                       conn, inbuf, outbuf, size, bufsize, state->call,
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_qpathinfo);
                break;
+       }
+
        case TRANSACT2_SETPATHINFO:
        case TRANSACT2_SETFILEINFO:
+       {
                START_PROFILE_NESTED(Trans2_setpathinfo);
-               outsize = call_trans2setfilepathinfo(conn, inbuf, outbuf, length, bufsize, 
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2setfilepathinfo(
+                       conn, inbuf, outbuf, size, bufsize, state->call,
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_setpathinfo);
                break;
+       }
 
        case TRANSACT2_FINDNOTIFYFIRST:
+       {
                START_PROFILE_NESTED(Trans2_findnotifyfirst);
-               outsize = call_trans2findnotifyfirst(conn, inbuf, outbuf, length, bufsize, 
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2findnotifyfirst(
+                       conn, inbuf, outbuf, size, bufsize, 
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_findnotifyfirst);
                break;
+       }
 
        case TRANSACT2_FINDNOTIFYNEXT:
+       {
                START_PROFILE_NESTED(Trans2_findnotifynext);
-               outsize = call_trans2findnotifynext(conn, inbuf, outbuf, length, bufsize, 
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2findnotifynext(
+                       conn, inbuf, outbuf, size, bufsize, 
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_findnotifynext);
                break;
+       }
+
        case TRANSACT2_MKDIR:
+       {
                START_PROFILE_NESTED(Trans2_mkdir);
-               outsize = call_trans2mkdir(conn, inbuf, outbuf, length, bufsize,
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2mkdir(
+                       conn, inbuf, outbuf, size, bufsize,
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_mkdir);
                break;
+       }
 
        case TRANSACT2_GET_DFS_REFERRAL:
+       {
                START_PROFILE_NESTED(Trans2_get_dfs_referral);
-               outsize = call_trans2getdfsreferral(conn,inbuf,outbuf,length, bufsize,
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2getdfsreferral(
+                       conn, inbuf, outbuf, size, bufsize,
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_get_dfs_referral);
                break;
+       }
+
        case TRANSACT2_IOCTL:
+       {
                START_PROFILE_NESTED(Trans2_ioctl);
-               outsize = call_trans2ioctl(conn,inbuf,outbuf,length, bufsize,
-                                         &params, total_params, &data, total_data, max_data_bytes);
+               outsize = call_trans2ioctl(
+                       conn, inbuf, outbuf, size, bufsize,
+                       &state->param, state->total_param,
+                       &state->data, state->total_data,
+                       state->max_data_return);
                END_PROFILE_NESTED(Trans2_ioctl);
                break;
+       }
+
        default:
                /* Error in request */
-               DEBUG(2,("Unknown request %d in trans2 call\n", tran_call));
-               SAFE_FREE(params);
-               SAFE_FREE(data);
+               DEBUG(2,("Unknown request %d in trans2 call\n", state->call));
+               outsize = ERROR_DOS(ERRSRV,ERRerror);
+       }
+
+       return outsize;
+}
+
+/****************************************************************************
+ Reply to a SMBtrans2.
+ ****************************************************************************/
+
+int reply_trans2(connection_struct *conn, char *inbuf,char *outbuf,
+                int size, int bufsize)
+{
+       int outsize = 0;
+       unsigned int dsoff = SVAL(inbuf, smb_dsoff);
+       unsigned int dscnt = SVAL(inbuf, smb_dscnt);
+       unsigned int psoff = SVAL(inbuf, smb_psoff);
+       unsigned int pscnt = SVAL(inbuf, smb_pscnt);
+       unsigned int tran_call = SVAL(inbuf, smb_setup0);
+       struct trans_state *state;
+       NTSTATUS result;
+
+       START_PROFILE(SMBtrans2);
+
+       result = allow_new_trans(conn->pending_trans, SVAL(inbuf, smb_mid));
+       if (!NT_STATUS_IS_OK(result)) {
+               DEBUG(2, ("Got invalid trans2 request: %s\n",
+                         nt_errstr(result)));
                END_PROFILE(SMBtrans2);
-               srv_signing_trans_stop();
-               return ERROR_DOS(ERRSRV,ERRerror);
+               return ERROR_NT(result);
+       }
+
+       if (IS_IPC(conn) && (tran_call != TRANSACT2_OPEN)
+            && (tran_call != TRANSACT2_GET_DFS_REFERRAL)) {
+               END_PROFILE(SMBtrans2);
+               return ERROR_DOS(ERRSRV,ERRaccess);
+       }
+
+       if ((state = TALLOC_P(NULL, struct trans_state)) == NULL) {
+               DEBUG(0, ("talloc failed\n"));
+               END_PROFILE(SMBtrans2);
+               return ERROR_NT(NT_STATUS_NO_MEMORY);
+       }
+
+       state->cmd = SMBtrans2;
+
+       state->mid = SVAL(inbuf, smb_mid);
+       state->vuid = SVAL(inbuf, smb_uid);
+       state->setup_count = SVAL(inbuf, smb_suwcnt);
+       state->total_param = SVAL(inbuf, smb_tpscnt);
+       state->param = NULL;
+       state->total_data =  SVAL(inbuf, smb_tdscnt);
+       state->data = NULL;
+       state->max_param_return = SVAL(inbuf, smb_mprcnt);
+       state->max_data_return  = SVAL(inbuf, smb_mdrcnt);
+       state->max_setup_return = SVAL(inbuf, smb_msrcnt);
+       state->close_on_completion = BITSETW(inbuf+smb_vwv5,0);
+       state->one_way = BITSETW(inbuf+smb_vwv5,1);
+
+       state->call = tran_call;
+
+       /* All trans2 messages we handle have smb_sucnt == 1 - ensure this
+          is so as a sanity check */
+       if (state->setup_count != 1) {
+               /*
+                * Need to have rc=0 for ioctl to get job id for OS/2.
+                *  Network printing will fail if function is not successful.
+                *  Similar function in reply.c will be used if protocol
+                *  is LANMAN1.0 instead of LM1.2X002.
+                *  Until DosPrintSetJobInfo with PRJINFO3 is supported,
+                *  outbuf doesn't have to be set(only job id is used).
+                */
+               if ( (state->setup_count == 4) && (tran_call == TRANSACT2_IOCTL) &&
+                               (SVAL(inbuf,(smb_setup+4)) == LMCAT_SPL) &&
+                               (SVAL(inbuf,(smb_setup+6)) == LMFUNC_GETJOBID)) {
+                       DEBUG(2,("Got Trans2 DevIOctl jobid\n"));
+               } else {
+                       DEBUG(2,("Invalid smb_sucnt in trans2 call(%u)\n",state->setup_count));
+                       DEBUG(2,("Transaction is %d\n",tran_call));
+                       TALLOC_FREE(state);
+                       END_PROFILE(SMBtrans2);
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+       }
+
+       if ((dscnt > state->total_data) || (pscnt > state->total_param))
+               goto bad_param;
+
+       if (state->total_data) {
+               /* Can't use talloc here, the core routines do realloc on the
+                * params and data. */
+               state->data = (char *)SMB_MALLOC(state->total_data);
+               if (state->data == NULL) {
+                       DEBUG(0,("reply_trans2: data malloc fail for %u "
+                                "bytes !\n", (unsigned int)state->total_data));
+                       TALLOC_FREE(state);
+                       END_PROFILE(SMBtrans2);
+                       return(ERROR_DOS(ERRDOS,ERRnomem));
+               }
+               if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
+                       goto bad_param;
+               if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) ||
+                   (smb_base(inbuf)+dsoff+dscnt < smb_base(inbuf)))
+                       goto bad_param;
+
+               memcpy(state->data,smb_base(inbuf)+dsoff,dscnt);
        }
-       
-       /* As we do not know how many data packets will need to be
-          returned here the various call_trans2xxxx calls
-          must send their own. Thus a call_trans2xxx routine only
-          returns a value other than -1 when it wants to send
-          an error packet. 
-       */
-       
-       srv_signing_trans_stop();
 
-       SAFE_FREE(params);
-       SAFE_FREE(data);
+       if (state->total_param) {
+               /* Can't use talloc here, the core routines do realloc on the
+                * params and data. */
+               state->param = (char *)SMB_MALLOC(state->total_param);
+               if (state->param == NULL) {
+                       DEBUG(0,("reply_trans: param malloc fail for %u "
+                                "bytes !\n", (unsigned int)state->total_param));
+                       SAFE_FREE(state->data);
+                       TALLOC_FREE(state);
+                       END_PROFILE(SMBtrans2);
+                       return(ERROR_DOS(ERRDOS,ERRnomem));
+               } 
+               if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
+                       goto bad_param;
+               if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) ||
+                   (smb_base(inbuf)+psoff+pscnt < smb_base(inbuf)))
+                       goto bad_param;
+
+               memcpy(state->param,smb_base(inbuf)+psoff,pscnt);
+       }
+
+       state->received_data  = dscnt;
+       state->received_param = pscnt;
+
+       if ((state->received_param == state->total_param) &&
+           (state->received_data == state->total_data)) {
+
+               outsize = handle_trans2(conn, state, inbuf, outbuf,
+                                       size, bufsize);
+               SAFE_FREE(state->data);
+               SAFE_FREE(state->param);
+               TALLOC_FREE(state);
+               END_PROFILE(SMBtrans2);
+               return outsize;
+       }
+
+       DLIST_ADD(conn->pending_trans, state);
+
+       /* We need to send an interim response then receive the rest
+          of the parameter/data bytes */
+       outsize = set_message(outbuf,0,0,False);
+       show_msg(outbuf);
        END_PROFILE(SMBtrans2);
-       return outsize; /* If a correct response was needed the
-                          call_trans2xxx calls have already sent
-                          it. If outsize != -1 then it is returning */
+       return outsize;
 
   bad_param:
 
-       srv_signing_trans_stop();
-       SAFE_FREE(params);
-       SAFE_FREE(data);
+       DEBUG(0,("reply_trans2: invalid trans parameters\n"));
+       SAFE_FREE(state->data);
+       SAFE_FREE(state->param);
+       TALLOC_FREE(state);
        END_PROFILE(SMBtrans2);
        return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 }
+
+
+/****************************************************************************
+ Reply to a SMBtranss2
+ ****************************************************************************/
+
+int reply_transs2(connection_struct *conn,
+                 char *inbuf,char *outbuf,int size,int bufsize)
+{
+       int outsize = 0;
+       unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
+       struct trans_state *state;
+
+       START_PROFILE(SMBtranss2);
+
+       show_msg(inbuf);
+
+       for (state = conn->pending_trans; state != NULL;
+            state = state->next) {
+               if (state->mid == SVAL(inbuf,smb_mid)) {
+                       break;
+               }
+       }
+
+       if ((state == NULL) || (state->cmd != SMBtrans2)) {
+               END_PROFILE(SMBtranss2);
+               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+       }
+
+       /* Revise state->total_param and state->total_data in case they have
+          changed downwards */
+
+       if (SVAL(inbuf, smb_tpscnt) < state->total_param)
+               state->total_param = SVAL(inbuf, smb_tpscnt);
+       if (SVAL(inbuf, smb_tdscnt) < state->total_data)
+               state->total_data = SVAL(inbuf, smb_tdscnt);
+
+       pcnt = SVAL(inbuf, smb_spscnt);
+       poff = SVAL(inbuf, smb_spsoff);
+       pdisp = SVAL(inbuf, smb_spsdisp);
+
+       dcnt = SVAL(inbuf, smb_sdscnt);
+       doff = SVAL(inbuf, smb_sdsoff);
+       ddisp = SVAL(inbuf, smb_sdsdisp);
+
+       state->received_param += pcnt;
+       state->received_data += dcnt;
+               
+       if ((state->received_data > state->total_data) ||
+           (state->received_param > state->total_param))
+               goto bad_param;
+
+       if (pcnt) {
+               if (pdisp+pcnt > state->total_param)
+                       goto bad_param;
+               if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
+                       goto bad_param;
+               if (pdisp > state->total_param)
+                       goto bad_param;
+               if ((smb_base(inbuf) + poff + pcnt > inbuf + size) ||
+                   (smb_base(inbuf) + poff + pcnt < smb_base(inbuf)))
+                       goto bad_param;
+               if (state->param + pdisp < state->param)
+                       goto bad_param;
+
+               memcpy(state->param+pdisp,smb_base(inbuf)+poff,
+                      pcnt);
+       }
+
+       if (dcnt) {
+               if (ddisp+dcnt > state->total_data)
+                       goto bad_param;
+               if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
+                       goto bad_param;
+               if (ddisp > state->total_data)
+                       goto bad_param;
+               if ((smb_base(inbuf) + doff + dcnt > inbuf + size) ||
+                   (smb_base(inbuf) + doff + dcnt < smb_base(inbuf)))
+                       goto bad_param;
+               if (state->data + ddisp < state->data)
+                       goto bad_param;
+
+               memcpy(state->data+ddisp, smb_base(inbuf)+doff,
+                      dcnt);      
+       }
+
+       if ((state->received_param < state->total_param) ||
+           (state->received_data < state->total_data)) {
+               END_PROFILE(SMBtranss2);
+               return -1;
+       }
+
+       /* construct_reply_common has done us the favor to pre-fill the
+        * command field with SMBtranss2 which is wrong :-)
+        */
+       SCVAL(outbuf,smb_com,SMBtrans2);
+
+       outsize = handle_trans2(conn, state, inbuf, outbuf, size, bufsize);
+
+       DLIST_REMOVE(conn->pending_trans, state);
+       SAFE_FREE(state->data);
+       SAFE_FREE(state->param);
+       TALLOC_FREE(state);
+
+       if (outsize == 0) {
+               END_PROFILE(SMBtranss2);
+               return(ERROR_DOS(ERRSRV,ERRnosupport));
+       }
+       
+       END_PROFILE(SMBtranss2);
+       return(outsize);
+
+  bad_param:
+
+       DEBUG(0,("reply_transs2: invalid trans parameters\n"));
+       DLIST_REMOVE(conn->pending_trans, state);
+       SAFE_FREE(state->data);
+       SAFE_FREE(state->param);
+       TALLOC_FREE(state);
+       END_PROFILE(SMBtranss2);
+       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+}