r20479: Both remaining calls of can_delete called it with check_is_at_open==False,
[samba.git] / source3 / smbd / reply.c
index 9a811c14a36adbd9c28f8e460033d167ac377359..a65979e8045eefe126271666c18fb061e4e59d74 100644 (file)
 extern enum protocol_types Protocol;
 extern int max_send;
 extern int max_recv;
-extern char magic_char;
-extern int global_oplock_break;
 unsigned int smb_echo_count = 0;
 extern uint32 global_client_caps;
 
+extern struct current_user current_user;
 extern BOOL global_encrypted_passwords_negotiated;
 
 /****************************************************************************
@@ -118,6 +117,9 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
                }
 
                if (!(*s & 0x80)) {
+                       if (*s <= 0x1f) {
+                               return NT_STATUS_OBJECT_NAME_INVALID;
+                       }
                        switch (*s) {
                                case '*':
                                case '?':
@@ -130,13 +132,22 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
                                        break;
                        }
                } else {
-                       switch(next_mb_char_size(s)) {
+                       size_t siz;
+                       /* Get the size of the next MB character. */
+                       next_codepoint(s,&siz);
+                       switch(siz) {
+                               case 5:
+                                       *d++ = *s++;
+                                       /*fall through*/
                                case 4:
                                        *d++ = *s++;
+                                       /*fall through*/
                                case 3:
                                        *d++ = *s++;
+                                       /*fall through*/
                                case 2:
                                        *d++ = *s++;
+                                       /*fall through*/
                                case 1:
                                        *d++ = *s++;
                                        break;
@@ -170,7 +181,7 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
  set.
 ****************************************************************************/
 
-NTSTATUS check_path_syntax_wcard(pstring destname, const pstring srcname)
+NTSTATUS check_path_syntax_wcard(pstring destname, const pstring srcname, BOOL *p_contains_wcard)
 {
        char *d = destname;
        const char *s = srcname;
@@ -178,6 +189,8 @@ NTSTATUS check_path_syntax_wcard(pstring destname, const pstring srcname)
        BOOL start_of_name_component = True;
        unsigned int num_bad_components = 0;
 
+       *p_contains_wcard = False;
+
        while (*s) {
                if (IS_DIRECTORY_SEP(*s)) {
                        /*
@@ -244,15 +257,40 @@ NTSTATUS check_path_syntax_wcard(pstring destname, const pstring srcname)
                }
 
                if (!(*s & 0x80)) {
+                       if (*s <= 0x1f) {
+                               return NT_STATUS_OBJECT_NAME_INVALID;
+                       }
+                       if (!*p_contains_wcard) {
+                               switch (*s) {
+                                       case '*':
+                                       case '?':
+                                       case '<':
+                                       case '>':
+                                       case '"':
+                                               *p_contains_wcard = True;
+                                               break;
+                                       default:
+                                               break;
+                               }
+                       }
                        *d++ = *s++;
                } else {
-                       switch(next_mb_char_size(s)) {
+                       size_t siz;
+                       /* Get the size of the next MB character. */
+                       next_codepoint(s,&siz);
+                       switch(siz) {
+                               case 5:
+                                       *d++ = *s++;
+                                       /*fall through*/
                                case 4:
                                        *d++ = *s++;
+                                       /*fall through*/
                                case 3:
                                        *d++ = *s++;
+                                       /*fall through*/
                                case 2:
                                        *d++ = *s++;
+                                       /*fall through*/
                                case 1:
                                        *d++ = *s++;
                                        break;
@@ -280,11 +318,145 @@ NTSTATUS check_path_syntax_wcard(pstring destname, const pstring srcname)
        return ret;
 }
 
+/****************************************************************************
+ Check the path for a POSIX client.
+ We're assuming here that '/' is not the second byte in any multibyte char
+ set (a safe assumption).
+****************************************************************************/
+
+NTSTATUS check_path_syntax_posix(pstring destname, const pstring srcname)
+{
+       char *d = destname;
+       const char *s = srcname;
+       NTSTATUS ret = NT_STATUS_OK;
+       BOOL start_of_name_component = True;
+
+       while (*s) {
+               if (*s == '/') {
+                       /*
+                        * Safe to assume is not the second part of a mb char as this is handled below.
+                        */
+                       /* Eat multiple '/' or '\\' */
+                       while (*s == '/') {
+                               s++;
+                       }
+                       if ((d != destname) && (*s != '\0')) {
+                               /* We only care about non-leading or trailing '/' */
+                               *d++ = '/';
+                       }
+
+                       start_of_name_component = True;
+                       continue;
+               }
+
+               if (start_of_name_component) {
+                       if ((s[0] == '.') && (s[1] == '.') && (s[2] == '/' || s[2] == '\0')) {
+                               /* Uh oh - "/../" or "/..\0" ! */
+
+                               /*
+                                * No mb char starts with '.' so we're safe checking the directory separator here.
+                                */
+
+                               /* If  we just added a '/' - delete it */
+                               if ((d > destname) && (*(d-1) == '/')) {
+                                       *(d-1) = '\0';
+                                       d--;
+                               }
+
+                               /* Are we at the start ? Can't go back further if so. */
+                               if (d <= destname) {
+                                       ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
+                                       break;
+                               }
+                               /* Go back one level... */
+                               /* We know this is safe as '/' cannot be part of a mb sequence. */
+                               /* NOTE - if this assumption is invalid we are not in good shape... */
+                               /* Decrement d first as d points to the *next* char to write into. */
+                               for (d--; d > destname; d--) {
+                                       if (*d == '/')
+                                               break;
+                               }
+                               s += 2; /* Else go past the .. */
+                               continue;
+
+                       } else if ((s[0] == '.') && ((s[1] == '\0') || (s[1] == '/'))) {
+                               /* Eat the '.' */
+                               s++;
+                               continue;
+                       }
+               }
+
+               if (!(*s & 0x80)) {
+                       *d++ = *s++;
+               } else {
+                       size_t siz;
+                       /* Get the size of the next MB character. */
+                       next_codepoint(s,&siz);
+                       switch(siz) {
+                               case 5:
+                                       *d++ = *s++;
+                                       /*fall through*/
+                               case 4:
+                                       *d++ = *s++;
+                                       /*fall through*/
+                               case 3:
+                                       *d++ = *s++;
+                                       /*fall through*/
+                               case 2:
+                                       *d++ = *s++;
+                                       /*fall through*/
+                               case 1:
+                                       *d++ = *s++;
+                                       break;
+                               default:
+                                       DEBUG(0,("check_path_syntax_posix: character length assumptions invalid !\n"));
+                                       *d = '\0';
+                                       return NT_STATUS_INVALID_PARAMETER;
+                       }
+               }
+               start_of_name_component = False;
+       }
+
+       *d = '\0';
+       return ret;
+}
+
+/****************************************************************************
+ Pull a string and check the path allowing a wilcard - provide for error return.
+****************************************************************************/
+
+size_t srvstr_get_path_wcard(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags,
+                               NTSTATUS *err, BOOL *contains_wcard)
+{
+       pstring tmppath;
+       char *tmppath_ptr = tmppath;
+       size_t ret;
+#ifdef DEVELOPER
+       SMB_ASSERT(dest_len == sizeof(pstring));
+#endif
+
+       if (src_len == 0) {
+               ret = srvstr_pull_buf( inbuf, tmppath_ptr, src, dest_len, flags);
+       } else {
+               ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
+       }
+
+       *contains_wcard = False;
+
+       if (lp_posix_pathnames()) {
+               *err = check_path_syntax_posix(dest, tmppath);
+       } else {
+               *err = check_path_syntax_wcard(dest, tmppath, contains_wcard);
+       }
+
+       return ret;
+}
+
 /****************************************************************************
  Pull a string and check the path - provide for error return.
 ****************************************************************************/
 
-size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags, NTSTATUS *err, BOOL allow_wcard_names)
+size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags, NTSTATUS *err)
 {
        pstring tmppath;
        char *tmppath_ptr = tmppath;
@@ -298,11 +470,12 @@ size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len
        } else {
                ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
        }
-       if (allow_wcard_names) {
-               *err = check_path_syntax_wcard(dest, tmppath);
+       if (lp_posix_pathnames()) {
+               *err = check_path_syntax_posix(dest, tmppath);
        } else {
                *err = check_path_syntax(dest, tmppath);
        }
+
        return ret;
 }
 
@@ -330,7 +503,7 @@ int reply_special(char *inbuf,char *outbuf)
        case 0x81: /* session request */
                
                if (already_got_session) {
-                       exit_server("multiple session request not permitted");
+                       exit_server_cleanly("multiple session request not permitted");
                }
                
                SCVAL(outbuf,0,0x82);
@@ -397,6 +570,7 @@ int reply_special(char *inbuf,char *outbuf)
 
 /****************************************************************************
  Reply to a tcon.
+ conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
 int reply_tcon(connection_struct *conn,
@@ -455,6 +629,7 @@ int reply_tcon(connection_struct *conn,
 
 /****************************************************************************
  Reply to a tcon and X.
+ conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
 int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
@@ -471,7 +646,6 @@ int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        int passlen = SVAL(inbuf,smb_vwv3);
        pstring path;
        char *p, *q;
-       extern BOOL global_encrypted_passwords_negotiated;
        
        START_PROFILE(SMBtconX);        
 
@@ -589,6 +763,7 @@ int reply_unknown(char *inbuf,char *outbuf)
 
 /****************************************************************************
  Reply to an ioctl.
+ conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
 int reply_ioctl(connection_struct *conn,
@@ -654,9 +829,17 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 
        START_PROFILE(SMBchkpth);
 
-       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, False);
+       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBchkpth);
+
+               /* Strange DOS error code semantics only for chkpth... */
+               if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
+                       if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
+                               /* We need to map to ERRbadpath */
+                               status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                       }
+               }
                return ERROR_NT(status);
        }
 
@@ -699,7 +882,7 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                return(UNIXERROR(ERRDOS,ERRbadpath));
        }
 
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
        DEBUG(3,("chkpth %s mode=%d\n", name, (int)SVAL(inbuf,smb_vwv0)));
 
        END_PROFILE(SMBchkpth);
@@ -726,7 +909,7 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        START_PROFILE(SMBgetatr);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status, False);
+       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBgetatr);
                return ERROR_NT(status);
@@ -771,14 +954,16 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        outsize = set_message(outbuf,10,0,True);
 
        SSVAL(outbuf,smb_vwv0,mode);
-       if(lp_dos_filetime_resolution(SNUM(conn)) )
-               put_dos_date3(outbuf,smb_vwv1,mtime & ~1);
-       else
-               put_dos_date3(outbuf,smb_vwv1,mtime);
+       if(lp_dos_filetime_resolution(SNUM(conn)) ) {
+               srv_put_dos_date3(outbuf,smb_vwv1,mtime & ~1);
+       } else {
+               srv_put_dos_date3(outbuf,smb_vwv1,mtime);
+       }
        SIVAL(outbuf,smb_vwv3,(uint32)size);
 
-       if (Protocol >= PROTOCOL_NT1)
+       if (Protocol >= PROTOCOL_NT1) {
                SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
+       }
   
        DEBUG( 3, ( "getatr name=%s mode=%d size=%d\n", fname, mode, (uint32)size ) );
   
@@ -805,7 +990,7 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        START_PROFILE(SMBsetatr);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status, False);
+       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBsetatr);
                return ERROR_NT(status);
@@ -820,7 +1005,7 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        }
 
        mode = SVAL(inbuf,smb_vwv0);
-       mtime = make_unix_date3(inbuf+smb_vwv1);
+       mtime = srv_make_unix_date3(inbuf+smb_vwv1);
   
        if (mode != FILE_ATTRIBUTE_NORMAL) {
                if (VALID_STAT_OF_DIR(sbuf))
@@ -843,7 +1028,7 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
  
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
   
        DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
   
@@ -861,7 +1046,7 @@ int reply_dskattr(connection_struct *conn, char *inbuf,char *outbuf, int dum_siz
        SMB_BIG_UINT dfree,dsize,bsize;
        START_PROFILE(SMBdskattr);
 
-       if (SMB_VFS_DISK_FREE(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
+       if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
                END_PROFILE(SMBdskattr);
                return(UNIXERROR(ERRHRD,ERRgeneral));
        }
@@ -913,9 +1098,9 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        pstring directory;
        pstring fname;
        SMB_OFF_T size;
-       int mode;
+       uint32 mode;
        time_t date;
-       int dirtype;
+       uint32 dirtype;
        int outsize = 0;
        unsigned int numentries = 0;
        unsigned int maxentries = 0;
@@ -931,10 +1116,16 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        BOOL can_open = True;
        BOOL bad_path = False;
        NTSTATUS nt_status;
+       BOOL mask_contains_wcard = False;
        BOOL allow_long_path_components = (SVAL(inbuf,smb_flg2) & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
 
        START_PROFILE(SMBsearch);
 
+       if (lp_posix_pathnames()) {
+               END_PROFILE(SMBsearch);
+               return reply_unknown(inbuf, outbuf);
+       }
+
        *mask = *directory = *fname = 0;
 
        /* If we were called as SMBffirst then we must expect close. */
@@ -945,7 +1136,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        maxentries = SVAL(inbuf,smb_vwv0); 
        dirtype = SVAL(inbuf,smb_vwv1);
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &nt_status, True);
+       p += srvstr_get_path_wcard(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &nt_status, &mask_contains_wcard);
        if (!NT_STATUS_IS_OK(nt_status)) {
                END_PROFILE(SMBsearch);
                return ERROR_NT(nt_status);
@@ -1010,7 +1201,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                ok = True;
      
                if (status_len == 0) {
-                       dptr_num = dptr_create(conn,directory,True,expect_close,SVAL(inbuf,smb_pid));
+                       dptr_num = dptr_create(conn,directory,True,expect_close,SVAL(inbuf,smb_pid), mask, mask_contains_wcard, dirtype);
                        if (dptr_num < 0) {
                                if(dptr_num == -2) {
                                        END_PROFILE(SMBsearch);
@@ -1019,10 +1210,6 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                END_PROFILE(SMBsearch);
                                return ERROR_DOS(ERRDOS,ERRnofids);
                        }
-                       if (!dptr_set_wcard_and_attributes(dptr_num, mask, dirtype)) {
-                               END_PROFILE(SMBsearch);
-                               return ERROR_DOS(ERRDOS,ERRnomem);
-                       }
                } else {
                        dirtype = dptr_attr(dptr_num);
                }
@@ -1055,7 +1242,9 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                                memcpy(p,status,21);
                                                make_dir_struct(p,mask,fname,size, mode,date,
                                                                !allow_long_path_components);
-                                               dptr_fill(p+12,dptr_num);
+                                               if (!dptr_fill(p+12,dptr_num)) {
+                                                       break;
+                                               }
                                                numentries++;
                                                p += DIR_STRUCT_SIZE;
                                        }
@@ -1083,7 +1272,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                dptr_close(&dptr_num);
        }
 
-       if ((numentries == 0) && !ms_has_wild(mask)) {
+       if ((numentries == 0) && !mask_contains_wcard) {
                return ERROR_BOTH(STATUS_NO_MORE_FILES,ERRDOS,ERRnofiles);
        }
 
@@ -1128,12 +1317,18 @@ int reply_fclose(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        int dptr_num= -2;
        char *p;
        NTSTATUS err;
+       BOOL path_contains_wcard = False;
 
        START_PROFILE(SMBfclose);
 
+       if (lp_posix_pathnames()) {
+               END_PROFILE(SMBfclose);
+               return reply_unknown(inbuf, outbuf);
+       }
+
        outsize = set_message(outbuf,1,0,True);
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &err, True);
+       p += srvstr_get_path_wcard(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &err, &path_contains_wcard);
        if (!NT_STATUS_IS_OK(err)) {
                END_PROFILE(SMBfclose);
                return ERROR_NT(err);
@@ -1170,22 +1365,26 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 {
        pstring fname;
        int outsize = 0;
-       int fmode=0;
-       int share_mode;
+       uint32 fattr=0;
        SMB_OFF_T size = 0;
        time_t mtime=0;
-       int rmode=0;
+       int info;
        SMB_STRUCT_STAT sbuf;
        BOOL bad_path = False;
        files_struct *fsp;
        int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
-       uint16 dos_attr = SVAL(inbuf,smb_vwv1);
+       int deny_mode;
+       uint32 dos_attr = SVAL(inbuf,smb_vwv1);
+       uint32 access_mask;
+       uint32 share_mode;
+       uint32 create_disposition;
+       uint32 create_options = 0;
        NTSTATUS status;
        START_PROFILE(SMBopen);
  
-       share_mode = SVAL(inbuf,smb_vwv0);
+       deny_mode = SVAL(inbuf,smb_vwv0);
 
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status, False);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopen);
                return ERROR_NT(status);
@@ -1199,45 +1398,59 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
        }
     
-       fsp = open_file_shared(conn,fname,&sbuf,share_mode,(FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),
-                       (uint32)dos_attr, oplock_request,&rmode,NULL);
+       if (!map_open_params_to_ntcreate(fname, deny_mode, OPENX_FILE_EXISTS_OPEN,
+                       &access_mask, &share_mode, &create_disposition, &create_options)) {
+               END_PROFILE(SMBopen);
+               return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRbadaccess));
+       }
 
-       if (!fsp) {
+       status = open_file_ntcreate(conn,fname,&sbuf,
+                       access_mask,
+                       share_mode,
+                       create_disposition,
+                       create_options,
+                       dos_attr,
+                       oplock_request,
+                       &info, &fsp);
+
+       if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopen);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
-               return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
+               return ERROR_NT(status);
        }
 
        size = sbuf.st_size;
-       fmode = dos_mode(conn,fname,&sbuf);
+       fattr = dos_mode(conn,fname,&sbuf);
        mtime = sbuf.st_mtime;
 
-       if (fmode & aDIR) {
+       if (fattr & aDIR) {
                DEBUG(3,("attempt to open a directory %s\n",fname));
-               close_file(fsp,False);
+               close_file(fsp,ERROR_CLOSE);
                END_PROFILE(SMBopen);
                return ERROR_DOS(ERRDOS,ERRnoaccess);
        }
   
        outsize = set_message(outbuf,7,0,True);
        SSVAL(outbuf,smb_vwv0,fsp->fnum);
-       SSVAL(outbuf,smb_vwv1,fmode);
-       if(lp_dos_filetime_resolution(SNUM(conn)) )
-               put_dos_date3(outbuf,smb_vwv2,mtime & ~1);
-       else
-               put_dos_date3(outbuf,smb_vwv2,mtime);
+       SSVAL(outbuf,smb_vwv1,fattr);
+       if(lp_dos_filetime_resolution(SNUM(conn)) ) {
+               srv_put_dos_date3(outbuf,smb_vwv2,mtime & ~1);
+       } else {
+               srv_put_dos_date3(outbuf,smb_vwv2,mtime);
+       }
        SIVAL(outbuf,smb_vwv4,(uint32)size);
-       SSVAL(outbuf,smb_vwv6,rmode);
+       SSVAL(outbuf,smb_vwv6,deny_mode);
 
-       if (oplock_request && lp_fake_oplocks(SNUM(conn)))
+       if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
+       }
     
-       if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
+       if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
+       }
        END_PROFILE(SMBopen);
        return(outsize);
 }
@@ -1249,26 +1462,34 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
 {
        pstring fname;
-       int smb_mode = SVAL(inbuf,smb_vwv3);
-       int smb_attr = SVAL(inbuf,smb_vwv5);
+       uint16 open_flags = SVAL(inbuf,smb_vwv2);
+       int deny_mode = SVAL(inbuf,smb_vwv3);
+       uint32 smb_attr = SVAL(inbuf,smb_vwv5);
        /* Breakout the oplock request bits so we can set the
                reply bits separately. */
-       BOOL ex_oplock_request = EXTENDED_OPLOCK_REQUEST(inbuf);
-       BOOL core_oplock_request = CORE_OPLOCK_REQUEST(inbuf);
-       BOOL oplock_request = ex_oplock_request | core_oplock_request;
+       int ex_oplock_request = EXTENDED_OPLOCK_REQUEST(inbuf);
+       int core_oplock_request = CORE_OPLOCK_REQUEST(inbuf);
+       int oplock_request = ex_oplock_request | core_oplock_request;
 #if 0
-       int open_flags = SVAL(inbuf,smb_vwv2);
        int smb_sattr = SVAL(inbuf,smb_vwv4); 
        uint32 smb_time = make_unix_date3(inbuf+smb_vwv6);
 #endif
        int smb_ofun = SVAL(inbuf,smb_vwv8);
        SMB_OFF_T size=0;
-       int fmode=0,mtime=0,rmode=0;
+       uint32 fattr=0;
+       int mtime=0;
        SMB_STRUCT_STAT sbuf;
        int smb_action = 0;
        BOOL bad_path = False;
        files_struct *fsp;
        NTSTATUS status;
+       SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv9);
+       ssize_t retval = -1;
+       uint32 access_mask;
+       uint32 share_mode;
+       uint32 create_disposition;
+       uint32 create_options = 0;
+
        START_PROFILE(SMBopenX);
 
        /* If it's an IPC, pass off the pipe handler. */
@@ -1283,7 +1504,7 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        }
 
        /* XXXX we need to handle passed times, sattr and flags */
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status, False);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopenX);
                return ERROR_NT(status);
@@ -1296,25 +1517,58 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
                END_PROFILE(SMBopenX);
                return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
        }
-    
-       fsp = open_file_shared(conn,fname,&sbuf,smb_mode,smb_ofun,(uint32)smb_attr,
-                       oplock_request, &rmode,&smb_action);
+
+       if (!map_open_params_to_ntcreate(fname, deny_mode, smb_ofun,
+                               &access_mask,
+                               &share_mode,
+                               &create_disposition,
+                               &create_options)) {
+               END_PROFILE(SMBopenX);
+               return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRbadaccess));
+       }
+
+       status = open_file_ntcreate(conn,fname,&sbuf,
+                       access_mask,
+                       share_mode,
+                       create_disposition,
+                       create_options,
+                       smb_attr,
+                       oplock_request,
+                       &smb_action, &fsp);
       
-       if (!fsp) {
+       if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopenX);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
-               return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
+               return ERROR_NT(status);
        }
 
        size = sbuf.st_size;
-       fmode = dos_mode(conn,fname,&sbuf);
+
+       /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
+          if the file is truncated or created. */
+       if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
+               fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
+               if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
+                       close_file(fsp,ERROR_CLOSE);
+                       END_PROFILE(SMBopenX);
+                       return ERROR_NT(NT_STATUS_DISK_FULL);
+               }
+               retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
+               if (retval < 0) {
+                       close_file(fsp,ERROR_CLOSE);
+                       END_PROFILE(SMBopenX);
+                       return ERROR_NT(NT_STATUS_DISK_FULL);
+               }
+               size = get_allocation_size(conn,fsp,&sbuf);
+       }
+
+       fattr = dos_mode(conn,fname,&sbuf);
        mtime = sbuf.st_mtime;
-       if (fmode & aDIR) {
-               close_file(fsp,False);
+       if (fattr & aDIR) {
+               close_file(fsp,ERROR_CLOSE);
                END_PROFILE(SMBopenX);
                return ERROR_DOS(ERRDOS,ERRnoaccess);
        }
@@ -1324,40 +1578,54 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
                correct bit for extended oplock reply.
        */
 
-       if (ex_oplock_request && lp_fake_oplocks(SNUM(conn)))
+       if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
                smb_action |= EXTENDED_OPLOCK_GRANTED;
+       }
 
-       if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
+       if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
                smb_action |= EXTENDED_OPLOCK_GRANTED;
+       }
 
        /* If the caller set the core oplock request bit
                and we granted one (by whatever means) - set the
                correct bit for core oplock reply.
        */
 
-       if (core_oplock_request && lp_fake_oplocks(SNUM(conn)))
+       if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
+       }
 
-       if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
+       if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
+       }
 
-       set_message(outbuf,15,0,True);
+       if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
+               set_message(outbuf,19,0,True);
+       } else {
+               set_message(outbuf,15,0,True);
+       }
        SSVAL(outbuf,smb_vwv2,fsp->fnum);
-       SSVAL(outbuf,smb_vwv3,fmode);
-       if(lp_dos_filetime_resolution(SNUM(conn)) )
-               put_dos_date3(outbuf,smb_vwv4,mtime & ~1);
-       else
-               put_dos_date3(outbuf,smb_vwv4,mtime);
+       SSVAL(outbuf,smb_vwv3,fattr);
+       if(lp_dos_filetime_resolution(SNUM(conn)) ) {
+               srv_put_dos_date3(outbuf,smb_vwv4,mtime & ~1);
+       } else {
+               srv_put_dos_date3(outbuf,smb_vwv4,mtime);
+       }
        SIVAL(outbuf,smb_vwv6,(uint32)size);
-       SSVAL(outbuf,smb_vwv8,rmode);
+       SSVAL(outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
        SSVAL(outbuf,smb_vwv11,smb_action);
 
+       if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
+               SIVAL(outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
+       }
+
        END_PROFILE(SMBopenX);
        return chain_reply(inbuf,outbuf,length,bufsize);
 }
 
 /****************************************************************************
  Reply to a SMBulogoffX.
+ conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
 int reply_ulogoffX(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
@@ -1393,19 +1661,22 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        pstring fname;
        int com;
        int outsize = 0;
-       int createmode;
-       int ofun = 0;
+       uint32 fattr = SVAL(inbuf,smb_vwv0);
        BOOL bad_path = False;
        files_struct *fsp;
        int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
        SMB_STRUCT_STAT sbuf;
        NTSTATUS status;
+       uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
+       uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
+       uint32 create_disposition;
+       uint32 create_options = 0;
+
        START_PROFILE(SMBcreate);
  
        com = SVAL(inbuf,smb_com);
 
-       createmode = SVAL(inbuf,smb_vwv0);
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), 0, STR_TERMINATE, &status, False);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), 0, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcreate);
                return ERROR_NT(status);
@@ -1419,42 +1690,50 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
        }
 
-       if (createmode & aVOLID)
+       if (fattr & aVOLID) {
                DEBUG(0,("Attempt to create file (%s) with volid set - please report this\n",fname));
-  
+       }
+
        if(com == SMBmknew) {
                /* We should fail if file exists. */
-               ofun = FILE_CREATE_IF_NOT_EXIST;
+               create_disposition = FILE_CREATE;
        } else {
-               /* SMBcreate - Create if file doesn't exist, truncate if it does. */
-               ofun = FILE_CREATE_IF_NOT_EXIST|FILE_EXISTS_TRUNCATE;
-       }
-
-       /* Open file in dos compatibility share mode. */
-       fsp = open_file_shared(conn,fname,&sbuf,SET_DENY_MODE(DENY_FCB)|SET_OPEN_MODE(DOS_OPEN_FCB), 
-                       ofun, (uint32)createmode, oplock_request, NULL, NULL);
+               /* Create if file doesn't exist, truncate if it does. */
+               create_disposition = FILE_OVERWRITE_IF;
+       }
+
+       /* Open file using ntcreate. */
+       status = open_file_ntcreate(conn,fname,&sbuf,
+                               access_mask,
+                               share_mode,
+                               create_disposition,
+                               create_options,
+                               fattr,
+                               oplock_request,
+                               NULL, &fsp);
   
-       if (!fsp) {
+       if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcreate);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
-               return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
+               return ERROR_NT(status);
        }
  
        outsize = set_message(outbuf,1,0,True);
        SSVAL(outbuf,smb_vwv0,fsp->fnum);
 
-       if (oplock_request && lp_fake_oplocks(SNUM(conn)))
+       if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
+       }
  
-       if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
+       if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
+       }
  
-       DEBUG( 2, ( "new file %s\n", fname ) );
-       DEBUG( 3, ( "mknew %s fd=%d dmode=%d\n", fname, fsp->fd, createmode ) );
+       DEBUG( 2, ( "reply_mknew: file %s\n", fname ) );
+       DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n", fname, fsp->fh->fd, (unsigned int)fattr ) );
 
        END_PROFILE(SMBcreate);
        return(outsize);
@@ -1468,7 +1747,7 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 {
        pstring fname;
        int outsize = 0;
-       int createattr;
+       uint32 fattr = SVAL(inbuf,smb_vwv0);
        BOOL bad_path = False;
        files_struct *fsp;
        int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
@@ -1480,8 +1759,7 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
        START_PROFILE(SMBctemp);
 
-       createattr = SVAL(inbuf,smb_vwv0);
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status, False);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBctemp);
                return ERROR_NT(status);
@@ -1508,24 +1786,26 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
        SMB_VFS_STAT(conn,fname,&sbuf);
 
-       /* Open file in dos compatibility share mode. */
        /* We should fail if file does not exist. */
-       fsp = open_file_shared(conn,fname,&sbuf,
-               SET_DENY_MODE(DENY_FCB)|SET_OPEN_MODE(DOS_OPEN_FCB),
-               FILE_EXISTS_OPEN|FILE_FAIL_IF_NOT_EXIST,
-               (uint32)createattr, oplock_request, NULL, NULL);
+       status = open_file_ntcreate(conn,fname,&sbuf,
+                               FILE_GENERIC_READ | FILE_GENERIC_WRITE,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE,
+                               FILE_OPEN,
+                               0,
+                               fattr,
+                               oplock_request,
+                               NULL, &fsp);
 
        /* close fd from smb_mkstemp() */
        close(tmpfd);
 
-       if (!fsp) {
+       if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBctemp);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
-               return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
+               return ERROR_NT(status);
        }
 
        outsize = set_message(outbuf,1,0,True);
@@ -1533,10 +1813,11 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
        /* the returned filename is relative to the directory */
        s = strrchr_m(fname, '/');
-       if (!s)
+       if (!s) {
                s = fname;
-       else
+       } else {
                s++;
+       }
 
        p = smb_buf(outbuf);
 #if 0
@@ -1548,15 +1829,17 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        p += namelen;
        outsize = set_message_end(outbuf, p);
 
-       if (oplock_request && lp_fake_oplocks(SNUM(conn)))
+       if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
+       }
   
-       if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
+       if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
+       }
 
-       DEBUG( 2, ( "created temp file %s\n", fname ) );
-       DEBUG( 3, ( "ctemp %s fd=%d umode=%o\n",
-                       fname, fsp->fd, sbuf.st_mode ) );
+       DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fname ) );
+       DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fname, fsp->fh->fd,
+                       (unsigned int)sbuf.st_mode ) );
 
        END_PROFILE(SMBctemp);
        return(outsize);
@@ -1568,38 +1851,36 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
 static NTSTATUS can_rename(connection_struct *conn, char *fname, uint16 dirtype, SMB_STRUCT_STAT *pst)
 {
-       int smb_action;
-       int access_mode;
        files_struct *fsp;
-       uint16 fmode;
+       uint32 fmode;
+       NTSTATUS status;
 
-       if (!CAN_WRITE(conn))
+       if (!CAN_WRITE(conn)) {
                return NT_STATUS_MEDIA_WRITE_PROTECTED;
+       }
 
        fmode = dos_mode(conn,fname,pst);
-       if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM))
+       if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
                return NT_STATUS_NO_SUCH_FILE;
+       }
 
-       if (S_ISDIR(pst->st_mode))
+       if (S_ISDIR(pst->st_mode)) {
                return NT_STATUS_OK;
+       }
 
-       /* We need a better way to return NT status codes from open... */
-       unix_ERR_class = 0;
-       unix_ERR_code = 0;
-
-       fsp = open_file_shared1(conn, fname, pst, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
-               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
+       status = open_file_ntcreate(conn, fname, pst,
+                               DELETE_ACCESS,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE,
+                               FILE_OPEN,
+                               0,
+                               FILE_ATTRIBUTE_NORMAL,
+                               0,
+                               NULL, &fsp);
 
-       if (!fsp) {
-               NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
-               if (unix_ERR_class == ERRDOS && unix_ERR_code == ERRbadshare)
-                       ret = NT_STATUS_SHARING_VIOLATION;
-               unix_ERR_class = 0;
-               unix_ERR_code = 0;
-               unix_ERR_ntstatus = NT_STATUS_OK;
-               return ret;
-       }
-       close_file(fsp,False);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+       close_file(fsp,NORMAL_CLOSE);
        return NT_STATUS_OK;
 }
 
@@ -1607,76 +1888,80 @@ static NTSTATUS can_rename(connection_struct *conn, char *fname, uint16 dirtype,
  Check if a user is allowed to delete a file.
 ********************************************************************/
 
-NTSTATUS can_delete(connection_struct *conn, char *fname, int dirtype, BOOL bad_path, BOOL check_is_at_open)
+static NTSTATUS can_delete(connection_struct *conn, char *fname,
+                          uint32 dirtype, BOOL bad_path)
 {
        SMB_STRUCT_STAT sbuf;
-       int fmode;
-       int smb_action;
-       int access_mode;
+       uint32 fattr;
        files_struct *fsp;
+       NTSTATUS status;
 
-       DEBUG(10,("can_delete: %s, dirtype = %d\n",
-               fname, dirtype ));
+       DEBUG(10,("can_delete: %s, dirtype = %d\n", fname, dirtype ));
 
-       if (!CAN_WRITE(conn))
+       if (!CAN_WRITE(conn)) {
                return NT_STATUS_MEDIA_WRITE_PROTECTED;
+       }
 
        if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
                if(errno == ENOENT) {
-                       if (bad_path)
+                       if (bad_path) {
                                return NT_STATUS_OBJECT_PATH_NOT_FOUND;
-                       else
+                       } else {
                                return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+                       }
                }
                return map_nt_error_from_unix(errno);
        }
 
-       fmode = dos_mode(conn,fname,&sbuf);
+       fattr = dos_mode(conn,fname,&sbuf);
 
        /* Can't delete a directory. */
-       if (fmode & aDIR)
+       if (fattr & aDIR) {
                return NT_STATUS_FILE_IS_A_DIRECTORY;
+       }
+
 #if 0 /* JRATEST */
        else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
                return NT_STATUS_OBJECT_NAME_INVALID;
 #endif /* JRATEST */
 
+       /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
+
+         On a Windows share, a file with read-only dosmode can be opened with
+         DELETE_ACCESS. But on a Samba share (delete readonly = no), it
+         fails with NT_STATUS_CANNOT_DELETE error.
+
+         This semantic causes a problem that a user can not
+         rename a file with read-only dosmode on a Samba share
+         from a Windows command prompt (i.e. cmd.exe, but can rename
+         from Windows Explorer).
+       */
+
        if (!lp_delete_readonly(SNUM(conn))) {
-               if (fmode & aRONLY)
+               if (fattr & aRONLY) {
                        return NT_STATUS_CANNOT_DELETE;
+               }
        }
-       if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM))
+       if ((fattr & ~dirtype) & (aHIDDEN | aSYSTEM)) {
                return NT_STATUS_NO_SUCH_FILE;
+       }
 
-       if (check_is_at_open) {
-               if (!can_delete_file_in_directory(conn, fname)) {
-                       return NT_STATUS_ACCESS_DENIED;
-               }
-       } else {
-               /* On open checks the open itself will check the share mode, so
-                  don't do it here as we'll get it wrong. */
-
-               /* We need a better way to return NT status codes from open... */
-               unix_ERR_class = 0;
-               unix_ERR_code = 0;
-
-               fsp = open_file_shared1(conn, fname, &sbuf, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
-                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
-
-               if (!fsp) {
-                       NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
-                       if (!NT_STATUS_IS_OK(unix_ERR_ntstatus))
-                               ret = unix_ERR_ntstatus;
-                       else if (unix_ERR_class == ERRDOS && unix_ERR_code == ERRbadshare)
-                               ret = NT_STATUS_SHARING_VIOLATION;
-                       unix_ERR_class = 0;
-                       unix_ERR_code = 0;
-                       unix_ERR_ntstatus = NT_STATUS_OK;
-                       return ret;
-               }
-               close_file(fsp,False);
+       /* On open checks the open itself will check the share mode, so
+          don't do it here as we'll get it wrong. */
+
+       status = open_file_ntcreate(conn, fname, &sbuf,
+                                   DELETE_ACCESS,
+                                   FILE_SHARE_NONE,
+                                   FILE_OPEN,
+                                   0,
+                                   FILE_ATTRIBUTE_NORMAL,
+                                   0,
+                                   NULL, &fsp);
+
+       if (NT_STATUS_IS_OK(status)) {
+               close_file(fsp,NORMAL_CLOSE);
        }
-       return NT_STATUS_OK;
+       return status;
 }
 
 /****************************************************************************
@@ -1684,31 +1969,27 @@ NTSTATUS can_delete(connection_struct *conn, char *fname, int dirtype, BOOL bad_
  code.
 ****************************************************************************/
 
-NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
+NTSTATUS unlink_internals(connection_struct *conn, uint32 dirtype,
+                         char *name, BOOL has_wild)
 {
        pstring directory;
        pstring mask;
+       pstring orig_name;
        char *p;
        int count=0;
        NTSTATUS error = NT_STATUS_OK;
-       BOOL has_wild;
        BOOL bad_path = False;
        BOOL rc = True;
        SMB_STRUCT_STAT sbuf;
        
        *directory = *mask = 0;
        
-       /* We must check for wildcards in the name given
-        * directly by the client - before any unmangling.
-        * This prevents an unmangling of a UNIX name containing
-        * a DOS wildcard like '*' or '?' from unmangling into
-        * a wildcard delete which was not intended.
-        * FIX for #226. JRA.
-        */
-
-       has_wild = ms_has_wild(name);
-
        rc = unix_convert(name,conn,0,&bad_path,&sbuf);
+
+       /*
+        * Feel my pain, this code needs rewriting *very* badly! -- vl
+        */
+       pstrcpy(orig_name, name);
        
        p = strrchr_m(name,'/');
        if (!p) {
@@ -1729,25 +2010,39 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
        
-       if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask, sizeof(pstring)-1 );
+       if (!rc && mangle_is_mangled(mask,conn->params))
+               mangle_check_cache( mask, sizeof(pstring)-1, conn->params );
        
        if (!has_wild) {
+               char *dir;
+               const char *fname;
+
                pstrcat(directory,"/");
                pstrcat(directory,mask);
-               error = can_delete(conn,directory,dirtype,bad_path,False);
+               error = can_delete(conn,directory,dirtype,bad_path);
                if (!NT_STATUS_IS_OK(error))
                        return error;
 
                if (SMB_VFS_UNLINK(conn,directory) == 0) {
                        count++;
                }
+
+               if (parent_dirname_talloc(tmp_talloc_ctx(), orig_name,
+                                         &dir, &fname)) {
+                       notify_action(conn, dir, fname, -1,
+                                     NOTIFY_ACTION_REMOVED);
+                       TALLOC_FREE(dir); /* not strictly necessary */
+               }
+
        } else {
                struct smb_Dir *dir_hnd = NULL;
                const char *dname;
                
+               if (strequal(mask,"????????.???"))
+                       pstrcpy(mask,"*");
+
                if (check_name(directory,conn))
-                       dir_hnd = OpenDir(conn, directory);
+                       dir_hnd = OpenDir(conn, directory, mask, dirtype);
                
                /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
                   the pattern matches against the long name, otherwise the short name 
@@ -1758,9 +2053,6 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                        long offset = 0;
                        error = NT_STATUS_NO_SUCH_FILE;
 
-                       if (strequal(mask,"????????.???"))
-                               pstrcpy(mask,"*");
-
                        while ((dname = ReadDirName(dir_hnd, &offset))) {
                                SMB_STRUCT_STAT st;
                                pstring fname;
@@ -1774,7 +2066,7 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                                /* Quick check for "." and ".." */
                                if (fname[0] == '.') {
                                        if (!fname[1] || (fname[1] == '.' && !fname[2])) {
-                                               if ((dirtype & FILE_ATTRIBUTE_DIRECTORY) && (dirtype & FILE_ATTRIBUTE_SYSTEM)) {
+                                               if (dirtype & FILE_ATTRIBUTE_DIRECTORY) {
                                                        sys_direntry = True;
                                                } else {
                                                        continue;
@@ -1793,12 +2085,15 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                                }
 
                                slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
-                               error = can_delete(conn,fname,dirtype,bad_path,False);
+                               error = can_delete(conn, fname, dirtype,
+                                                  bad_path);
                                if (!NT_STATUS_IS_OK(error)) {
                                        continue;
                                }
                                if (SMB_VFS_UNLINK(conn,fname) == 0)
                                        count++;
+                               notify_action(conn, directory, dname,
+                                             -1, NOTIFY_ACTION_REMOVED);
                                DEBUG(3,("unlink_internals: succesful unlink [%s]\n",fname));
                        }
                        CloseDir(dir_hnd);
@@ -1821,13 +2116,15 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 {
        int outsize = 0;
        pstring name;
-       int dirtype;
+       uint32 dirtype;
        NTSTATUS status;
+       BOOL path_contains_wcard = False;
+
        START_PROFILE(SMBunlink);
-       
+
        dirtype = SVAL(inbuf,smb_vwv0);
        
-       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, True);
+       srvstr_get_path_wcard(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, &path_contains_wcard);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBunlink);
                return ERROR_NT(status);
@@ -1837,11 +2134,10 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        
        DEBUG(3,("reply_unlink : %s\n",name));
        
-       status = unlink_internals(conn, dirtype, name);
+       status = unlink_internals(conn, dirtype, name, path_contains_wcard);
        if (!NT_STATUS_IS_OK(status)) {
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
                return ERROR_NT(status);
@@ -1853,7 +2149,7 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
         */
        process_pending_change_notify_queue((time_t)0);
        
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
   
        END_PROFILE(SMBunlink);
        return outsize;
@@ -1868,7 +2164,7 @@ static void fail_readraw(void)
        pstring errstr;
        slprintf(errstr, sizeof(errstr)-1, "FAIL ! reply_readbraw: socket write fail (%s)",
                strerror(errno) );
-       exit_server(errstr);
+       exit_server_cleanly(errstr);
 }
 
 #if defined(WITH_SENDFILE)
@@ -1922,15 +2218,16 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
         * reply_readbraw has already checked the length.
         */
 
-       if (chain_size ==0 && (nread > 0) && (lp_write_cache_size(SNUM(conn)) == 0) && lp_use_sendfile(SNUM(conn)) ) {
+       if ( (chain_size == 0) && (nread > 0) &&
+           (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
                DATA_BLOB header;
 
                _smb_setlen(outbuf,nread);
-               header.data = outbuf;
+               header.data = (uint8 *)outbuf;
                header.length = 4;
                header.free = NULL;
 
-               if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, nread) == -1) {
+               if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fh->fd, &header, startpos, nread) == -1) {
                        /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
                        if (errno == ENOSYS) {
                                goto normal_readbraw;
@@ -1949,14 +2246,14 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
                                if (fake_sendfile(fsp, startpos, nread, outbuf + 4, out_buffsize - 4) == -1) {
                                        DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
                                                fsp->fsp_name, strerror(errno) ));
-                                       exit_server("send_file_readbraw fake_sendfile failed");
+                                       exit_server_cleanly("send_file_readbraw fake_sendfile failed");
                                }
                                return;
                        }
 
                        DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
                                fsp->fsp_name, strerror(errno) ));
-                       exit_server("send_file_readbraw sendfile failed");
+                       exit_server_cleanly("send_file_readbraw sendfile failed");
                }
 
        }
@@ -1987,7 +2284,6 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
 
 int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int out_buffsize)
 {
-       extern struct current_user current_user;
        ssize_t maxcount,mincount;
        size_t nread = 0;
        SMB_OFF_T startpos;
@@ -1996,7 +2292,7 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
        START_PROFILE(SMBreadbraw);
 
        if (srv_is_signing_active()) {
-               exit_server("reply_readbraw: SMB signing is active - raw reads/writes are disallowed.");
+               exit_server_cleanly("reply_readbraw: SMB signing is active - raw reads/writes are disallowed.");
        }
 
        /*
@@ -2005,15 +2301,6 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
         * return a zero length response here.
         */
 
-       if(global_oplock_break) {
-               _smb_setlen(header,0);
-               if (write_data(smbd_server_fd(),header,4) != 4)
-                       fail_readraw();
-               DEBUG(5,("readbraw - oplock break finished\n"));
-               END_PROFILE(SMBreadbraw);
-               return -1;
-       }
-
        fsp = file_fsp(inbuf,smb_vwv0);
 
        if (!FNUM_OK(fsp,conn) || !fsp->can_read) {
@@ -2074,22 +2361,19 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
        /* ensure we don't overrun the packet size */
        maxcount = MIN(65535,maxcount);
 
-       if (!is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
-               SMB_OFF_T size = fsp->size;
-               SMB_OFF_T sizeneeded = startpos + maxcount;
+       if (!is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
+               SMB_STRUCT_STAT st;
+               SMB_OFF_T size = 0;
   
-               if (size < sizeneeded) {
-                       SMB_STRUCT_STAT st;
-                       if (SMB_VFS_FSTAT(fsp,fsp->fd,&st) == 0)
-                               size = st.st_size;
-                       if (!fsp->can_write) 
-                               fsp->size = size;
+               if (SMB_VFS_FSTAT(fsp,fsp->fh->fd,&st) == 0) {
+                       size = st.st_size;
                }
 
-               if (startpos >= size)
+               if (startpos >= size) {
                        nread = 0;
-               else
+               } else {
                        nread = MIN(maxcount,(size - startpos));          
+               }
        }
 
 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
@@ -2097,8 +2381,8 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
                nread = 0;
 #endif
   
-       DEBUG( 3, ( "readbraw fnum=%d start=%.0f max=%d min=%d nread=%d\n", fsp->fnum, (double)startpos,
-                               (int)maxcount, (int)mincount, (int)nread ) );
+       DEBUG( 3, ( "readbraw fnum=%d start=%.0f max=%lu min=%lu nread=%lu\n", fsp->fnum, (double)startpos,
+                               (unsigned long)maxcount, (unsigned long)mincount, (unsigned long)nread ) );
   
        send_file_readbraw(conn, fsp, startpos, nread, mincount, outbuf, out_buffsize);
 
@@ -2107,6 +2391,9 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
        return -1;
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Reply to a lockread (core+ protocol).
 ****************************************************************************/
@@ -2120,11 +2407,13 @@ int reply_lockread(connection_struct *conn, char *inbuf,char *outbuf, int length
        size_t numtoread;
        NTSTATUS status;
        files_struct *fsp = file_fsp(inbuf,smb_vwv0);
-       BOOL my_lock_ctx = False;
+       struct byte_range_lock *br_lck = NULL;
        START_PROFILE(SMBlockread);
 
        CHECK_FSP(fsp,conn);
-       CHECK_READ(fsp);
+       if (!CHECK_READ(fsp,inbuf)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
 
        release_level_2_oplocks_on_change(fsp);
 
@@ -2143,30 +2432,17 @@ int reply_lockread(connection_struct *conn, char *inbuf,char *outbuf, int length
         * Note that the requested lock size is unaffected by max_recv.
         */
        
-       status = do_lock_spin(fsp, conn, SVAL(inbuf,smb_pid), 
-                        (SMB_BIG_UINT)numtoread, (SMB_BIG_UINT)startpos, WRITE_LOCK, &my_lock_ctx);
+       br_lck = do_lock(fsp,
+                       (uint32)SVAL(inbuf,smb_pid), 
+                       (SMB_BIG_UINT)numtoread,
+                       (SMB_BIG_UINT)startpos,
+                       WRITE_LOCK,
+                       WINDOWS_LOCK,
+                       False, /* Non-blocking lock. */
+                       &status);
+       TALLOC_FREE(br_lck);
 
        if (NT_STATUS_V(status)) {
-#if 0
-               /*
-                * We used to make lockread a blocking lock. It turns out
-                * that this isn't on W2k. Found by the Samba 4 RAW-READ torture
-                * tester. JRA.
-                */
-
-               if (lp_blocking_locks(SNUM(conn)) && !my_lock_ctx && ERROR_WAS_LOCK_DENIED(status)) {
-                       /*
-                        * A blocking lock was requested. Package up
-                        * this smb into a queued request and push it
-                        * onto the blocking lock queue.
-                        */
-                       if(push_blocking_lock_request(inbuf, length, -1, 0, SVAL(inbuf,smb_pid), (SMB_BIG_UINT)startpos,
-                                                               (SMB_BIG_UINT)numtoread)) {
-                               END_PROFILE(SMBlockread);
-                               return -1;
-                       }
-               }
-#endif
                END_PROFILE(SMBlockread);
                return ERROR_NT(status);
        }
@@ -2200,6 +2476,9 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a read.
 ****************************************************************************/
@@ -2215,7 +2494,9 @@ int reply_read(connection_struct *conn, char *inbuf,char *outbuf, int size, int
        START_PROFILE(SMBread);
 
        CHECK_FSP(fsp,conn);
-       CHECK_READ(fsp);
+       if (!CHECK_READ(fsp,inbuf)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
 
        numtoread = SVAL(inbuf,smb_vwv1);
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
@@ -2234,7 +2515,7 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 
        data = smb_buf(outbuf) + 3;
   
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK)) {
+       if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBread);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2278,12 +2559,12 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
         * on a train in Germany :-). JRA.
         */
 
-       if (chain_size ==0 && (CVAL(inbuf,smb_vwv0) == 0xFF) && lp_use_sendfile(SNUM(conn)) &&
-                       (lp_write_cache_size(SNUM(conn)) == 0) ) {
+       if ((chain_size == 0) && (CVAL(inbuf,smb_vwv0) == 0xFF) &&
+           lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
                SMB_STRUCT_STAT sbuf;
                DATA_BLOB header;
 
-               if(SMB_VFS_FSTAT(fsp,fsp->fd, &sbuf) == -1)
+               if(SMB_VFS_FSTAT(fsp,fsp->fh->fd, &sbuf) == -1)
                        return(UNIXERROR(ERRDOS,ERRnoaccess));
 
                if (startpos > sbuf.st_size)
@@ -2308,11 +2589,11 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
                SCVAL(outbuf,smb_vwv0,0xFF);
                set_message(outbuf,12,smb_maxcnt,False);
-               header.data = outbuf;
+               header.data = (uint8 *)outbuf;
                header.length = data - outbuf;
                header.free = NULL;
 
-               if ((nread = SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, smb_maxcnt)) == -1) {
+               if ((nread = SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fh->fd, &header, startpos, smb_maxcnt)) == -1) {
                        /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
                        if (errno == ENOSYS) {
                                goto normal_read;
@@ -2333,7 +2614,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                                                        len_outbuf - (data-outbuf))) == -1) {
                                        DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
                                                fsp->fsp_name, strerror(errno) ));
-                                       exit_server("send_file_readX: fake_sendfile failed");
+                                       exit_server_cleanly("send_file_readX: fake_sendfile failed");
                                }
                                DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
                                        fsp->fnum, (int)smb_maxcnt, (int)nread ) );
@@ -2343,7 +2624,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
 
                        DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
                                fsp->fsp_name, strerror(errno) ));
-                       exit_server("send_file_readX sendfile failed");
+                       exit_server_cleanly("send_file_readX sendfile failed");
                }
 
                DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
@@ -2359,7 +2640,6 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
        nread = read_file(fsp,data,startpos,smb_maxcnt);
   
        if (nread < 0) {
-               END_PROFILE(SMBreadX);
                return(UNIXERROR(ERRDOS,ERRnoaccess));
        }
 
@@ -2400,7 +2680,9 @@ int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        }
 
        CHECK_FSP(fsp,conn);
-       CHECK_READ(fsp);
+       if (!CHECK_READ(fsp,inbuf)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
 
        set_message(outbuf,12,0,True);
 
@@ -2440,11 +2722,16 @@ int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
 
        }
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK)) {
+       if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBreadX);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
 
+       if (schedule_aio_read_and_X(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt)) {
+               END_PROFILE(SMBreadX);
+               return -1;
+       }
+
        nread = send_file_readX(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt);
        if (nread != -1)
                nread = chain_reply(inbuf,outbuf,length,bufsize);
@@ -2471,11 +2758,13 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        START_PROFILE(SMBwritebraw);
 
        if (srv_is_signing_active()) {
-               exit_server("reply_writebraw: SMB signing is active - raw reads/writes are disallowed.");
+               exit_server_cleanly("reply_writebraw: SMB signing is active - raw reads/writes are disallowed.");
        }
 
        CHECK_FSP(fsp,conn);
-       CHECK_WRITE(fsp);
+       if (!CHECK_WRITE(fsp)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
   
        tcount = IVAL(inbuf,smb_vwv1);
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
@@ -2496,7 +2785,7 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        SCVAL(inbuf,smb_com,SMBwritec);
        SCVAL(outbuf,smb_com,SMBwritec);
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
+       if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwritebraw);
                return(ERROR_DOS(ERRDOS,ERRlock));
        }
@@ -2518,12 +2807,13 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        SCVAL(outbuf,smb_com,SMBwritebraw);
        SSVALS(outbuf,smb_vwv0,-1);
        outsize = set_message(outbuf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
+       show_msg(outbuf);
        if (!send_smb(smbd_server_fd(),outbuf))
-               exit_server("reply_writebraw: send_smb failed.");
+               exit_server_cleanly("reply_writebraw: send_smb failed.");
   
        /* Now read the raw data into the buffer and write it */
        if (read_smb_length(smbd_server_fd(),inbuf,SMB_SECONDARY_WAIT) == -1) {
-               exit_server("secondary writebraw failed");
+               exit_server_cleanly("secondary writebraw failed");
        }
   
        /* Even though this is not an smb message, smb_len returns the generic length of an smb message */
@@ -2532,14 +2822,13 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        /* Set up outbuf to return the correct return */
        outsize = set_message(outbuf,1,0,True);
        SCVAL(outbuf,smb_com,SMBwritec);
-       SSVAL(outbuf,smb_vwv0,total_written);
 
        if (numtowrite != 0) {
 
                if (numtowrite > BUFFER_SIZE) {
                        DEBUG(0,("reply_writebraw: Oversize secondary write raw requested (%u). Terminating\n",
                                (unsigned int)numtowrite ));
-                       exit_server("secondary writebraw failed");
+                       exit_server_cleanly("secondary writebraw failed");
                }
 
                if (tcount > nwritten+numtowrite) {
@@ -2550,10 +2839,14 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
                if (read_data( smbd_server_fd(), inbuf+4, numtowrite) != numtowrite ) {
                        DEBUG(0,("reply_writebraw: Oversize secondary write raw read failed (%s). Terminating\n",
                                strerror(errno) ));
-                       exit_server("secondary writebraw failed");
+                       exit_server_cleanly("secondary writebraw failed");
                }
 
                nwritten = write_file(fsp,inbuf+4,startpos+nwritten,numtowrite);
+               if (nwritten == -1) {
+                       END_PROFILE(SMBwritebraw);
+                       return(UNIXERROR(ERRHRD,ERRdiskfull));
+               }
 
                if (nwritten < (ssize_t)numtowrite) {
                        SCVAL(outbuf,smb_rcls,ERRHRD);
@@ -2564,8 +2857,9 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
                        total_written += nwritten;
        }
  
-       if ((lp_syncalways(SNUM(conn)) || write_through) && lp_strict_sync(SNUM(conn)))
-               sync_file(conn,fsp);
+       SSVAL(outbuf,smb_vwv0,total_written);
+
+       sync_file(conn, fsp, write_through);
 
        DEBUG(3,("writebraw2 fnum=%d start=%.0f num=%d wrote=%d\n",
                fsp->fnum, (double)startpos, (int)numtowrite,(int)total_written));
@@ -2580,7 +2874,7 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
                 * sending a SMBkeepalive. Thanks to DaveCB at Sun for this. JRA.
                 */
                if (!send_keepalive(smbd_server_fd()))
-                       exit_server("reply_writebraw: send of keepalive failed");
+                       exit_server_cleanly("reply_writebraw: send of keepalive failed");
 #endif
                return(-1);
        }
@@ -2588,6 +2882,9 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Reply to a writeunlock (core+).
 ****************************************************************************/
@@ -2605,13 +2902,15 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        START_PROFILE(SMBwriteunlock);
        
        CHECK_FSP(fsp,conn);
-       CHECK_WRITE(fsp);
+       if (!CHECK_WRITE(fsp)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
 
        numtowrite = SVAL(inbuf,smb_vwv1);
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
        data = smb_buf(inbuf) + 3;
   
-       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
+       if (numtowrite && is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteunlock);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2619,13 +2918,13 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        /* The special X/Open SMB protocol handling of
           zero length writes is *NOT* done for
           this call */
-       if(numtowrite == 0)
+       if(numtowrite == 0) {
                nwritten = 0;
-       else
+       } else {
                nwritten = write_file(fsp,data,startpos,numtowrite);
+       }
   
-       if (lp_syncalways(SNUM(conn)))
-               sync_file(conn,fsp);
+       sync_file(conn, fsp, False /* write through */);
 
        if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
                END_PROFILE(SMBwriteunlock);
@@ -2633,8 +2932,12 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        }
 
        if (numtowrite) {
-               status = do_unlock(fsp, conn, SVAL(inbuf,smb_pid), (SMB_BIG_UINT)numtowrite, 
-                                  (SMB_BIG_UINT)startpos);
+               status = do_unlock(fsp,
+                               (uint32)SVAL(inbuf,smb_pid),
+                               (SMB_BIG_UINT)numtowrite, 
+                               (SMB_BIG_UINT)startpos,
+                               WINDOWS_LOCK);
+
                if (NT_STATUS_V(status)) {
                        END_PROFILE(SMBwriteunlock);
                        return ERROR_NT(status);
@@ -2652,6 +2955,9 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        return outsize;
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a write.
 ****************************************************************************/
@@ -2673,13 +2979,15 @@ int reply_write(connection_struct *conn, char *inbuf,char *outbuf,int size,int d
        }
 
        CHECK_FSP(fsp,conn);
-       CHECK_WRITE(fsp);
+       if (!CHECK_WRITE(fsp)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
 
        numtowrite = SVAL(inbuf,smb_vwv1);
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
        data = smb_buf(inbuf) + 3;
   
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
+       if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwrite);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2707,8 +3015,7 @@ int reply_write(connection_struct *conn, char *inbuf,char *outbuf,int size,int d
        } else
                nwritten = write_file(fsp,data,startpos,numtowrite);
   
-       if (lp_syncalways(SNUM(conn)))
-               sync_file(conn,fsp);
+       sync_file(conn, fsp, False);
 
        if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
                END_PROFILE(SMBwrite);
@@ -2754,11 +3061,16 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng
        }
 
        CHECK_FSP(fsp,conn);
-       CHECK_WRITE(fsp);
+       if (!CHECK_WRITE(fsp)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
 
+       set_message(outbuf,6,0,True);
+  
        /* Deal with possible LARGE_WRITEX */
-       if (large_writeX)
+       if (large_writeX) {
                numtowrite |= ((((size_t)SVAL(inbuf,smb_vwv9)) & 1 )<<16);
+       }
 
        if(smb_doff > smblen || (smb_doff + numtowrite > smblen)) {
                END_PROFILE(SMBwriteX);
@@ -2790,7 +3102,7 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng
 #endif /* LARGE_SMB_OFF_T */
        }
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
+       if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteX);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2800,18 +3112,24 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng
        done, just a write of zero. To truncate a file,
        use SMBwrite. */
 
-       if(numtowrite == 0)
+       if(numtowrite == 0) {
                nwritten = 0;
-       else
+       } else {
+
+               if (schedule_aio_write_and_X(conn, inbuf, outbuf, length, bufsize,
+                                       fsp,data,startpos,numtowrite)) {
+                       END_PROFILE(SMBwriteX);
+                       return -1;
+               }
+
                nwritten = write_file(fsp,data,startpos,numtowrite);
+       }
   
        if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
                END_PROFILE(SMBwriteX);
                return(UNIXERROR(ERRHRD,ERRdiskfull));
        }
 
-       set_message(outbuf,6,0,True);
-  
        SSVAL(outbuf,smb_vwv2,nwritten);
        if (large_writeX)
                SSVAL(outbuf,smb_vwv4,(nwritten>>16)&1);
@@ -2824,8 +3142,7 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng
        DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
                fsp->fnum, (int)numtowrite, (int)nwritten));
 
-       if (lp_syncalways(SNUM(conn)) || write_through)
-               sync_file(conn,fsp);
+       sync_file(conn, fsp, write_through);
 
        END_PROFILE(SMBwriteX);
        return chain_reply(inbuf,outbuf,length,bufsize);
@@ -2859,7 +3176,7 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int
                        break;
                case 1:
                        umode = SEEK_CUR;
-                       res = fsp->pos + startpos;
+                       res = fsp->fh->pos + startpos;
                        break;
                case 2:
                        umode = SEEK_END;
@@ -2871,19 +3188,19 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int
        }
 
        if (umode == SEEK_END) {
-               if((res = SMB_VFS_LSEEK(fsp,fsp->fd,startpos,umode)) == -1) {
+               if((res = SMB_VFS_LSEEK(fsp,fsp->fh->fd,startpos,umode)) == -1) {
                        if(errno == EINVAL) {
                                SMB_OFF_T current_pos = startpos;
                                SMB_STRUCT_STAT sbuf;
 
-                               if(SMB_VFS_FSTAT(fsp,fsp->fd, &sbuf) == -1) {
+                               if(SMB_VFS_FSTAT(fsp,fsp->fh->fd, &sbuf) == -1) {
                                        END_PROFILE(SMBlseek);
                                        return(UNIXERROR(ERRDOS,ERRnoaccess));
                                }
 
                                current_pos += sbuf.st_size;
                                if(current_pos < 0)
-                                       res = SMB_VFS_LSEEK(fsp,fsp->fd,0,SEEK_SET);
+                                       res = SMB_VFS_LSEEK(fsp,fsp->fh->fd,0,SEEK_SET);
                        }
                }
 
@@ -2893,7 +3210,7 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int
                }
        }
 
-       fsp->pos = res;
+       fsp->fh->pos = res;
   
        outsize = set_message(outbuf,2,0,True);
        SIVAL(outbuf,smb_vwv0,res);
@@ -2911,7 +3228,7 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int
 
 int reply_flush(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize)
 {
-       int outsize = set_message(outbuf,0,0,True);
+       int outsize = set_message(outbuf,0,0,False);
        uint16 fnum = SVAL(inbuf,smb_vwv0);
        files_struct *fsp = file_fsp(inbuf,smb_vwv0);
        START_PROFILE(SMBflush);
@@ -2922,7 +3239,7 @@ int reply_flush(connection_struct *conn, char *inbuf,char *outbuf, int size, int
        if (!fsp) {
                file_sync_all(conn);
        } else {
-               sync_file(conn,fsp);
+               sync_file(conn,fsp, True);
        }
        
        DEBUG(3,("flush\n"));
@@ -2932,6 +3249,7 @@ int reply_flush(connection_struct *conn, char *inbuf,char *outbuf, int size, int
 
 /****************************************************************************
  Reply to a exit.
+ conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
 int reply_exit(connection_struct *conn, 
@@ -2940,9 +3258,9 @@ int reply_exit(connection_struct *conn,
        int outsize;
        START_PROFILE(SMBexit);
 
-       file_close_pid(SVAL(inbuf,smb_pid));
+       file_close_pid(SVAL(inbuf,smb_pid),SVAL(inbuf,smb_uid));
 
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
 
        DEBUG(3,("exit\n"));
 
@@ -2957,14 +3275,13 @@ int reply_exit(connection_struct *conn,
 int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
                 int dum_buffsize)
 {
-       extern struct current_user current_user;
        int outsize = 0;
        time_t mtime;
        int32 eclass = 0, err = 0;
        files_struct *fsp = NULL;
        START_PROFILE(SMBclose);
 
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
 
        /* If it's an IPC, pass off to the pipe handler. */
        if (IS_IPC(conn)) {
@@ -2987,27 +3304,23 @@ int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
                /*
                 * Special case - close NT SMB directory handle.
                 */
-               DEBUG(3,("close %s fnum=%d\n", fsp->is_directory ? "directory" : "stat file open", fsp->fnum));
-               close_file(fsp,True);
+               DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
+               close_file(fsp,NORMAL_CLOSE);
        } else {
                /*
                 * Close ordinary file.
                 */
                int close_err;
-               pstring file_name;
-
-               /* Save the name for time set in close. */
-               pstrcpy( file_name, fsp->fsp_name);
 
                DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
-                        fsp->fd, fsp->fnum,
+                        fsp->fh->fd, fsp->fnum,
                         conn->num_files_open));
  
                /*
                 * Take care of any time sent in the close.
                 */
 
-               mtime = make_unix_date3(inbuf+smb_vwv1);
+               mtime = srv_make_unix_date3(inbuf+smb_vwv1);
                fsp_set_pending_modtime(fsp, mtime);
 
                /*
@@ -3016,7 +3329,7 @@ int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size,
                 * a disk full error. If not then it was probably an I/O error.
                 */
  
-               if((close_err = close_file(fsp,True)) != 0) {
+               if((close_err = close_file(fsp,NORMAL_CLOSE)) != 0) {
                        errno = close_err;
                        END_PROFILE(SMBclose);
                        return (UNIXERROR(ERRHRD,ERRgeneral));
@@ -3051,14 +3364,16 @@ int reply_writeclose(connection_struct *conn,
        START_PROFILE(SMBwriteclose);
 
        CHECK_FSP(fsp,conn);
-       CHECK_WRITE(fsp);
+       if (!CHECK_WRITE(fsp)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
 
        numtowrite = SVAL(inbuf,smb_vwv1);
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
-       mtime = make_unix_date3(inbuf+smb_vwv4);
+       mtime = srv_make_unix_date3(inbuf+smb_vwv4);
        data = smb_buf(inbuf) + 1;
   
-       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
+       if (numtowrite && is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteclose);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -3075,7 +3390,7 @@ int reply_writeclose(connection_struct *conn,
        if (numtowrite) {
                DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
                        fsp->fsp_name ));
-               close_err = close_file(fsp,True);
+               close_err = close_file(fsp,NORMAL_CLOSE);
        }
 
        DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
@@ -3100,6 +3415,9 @@ int reply_writeclose(connection_struct *conn,
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Reply to a lock.
 ****************************************************************************/
@@ -3107,11 +3425,11 @@ int reply_writeclose(connection_struct *conn,
 int reply_lock(connection_struct *conn,
               char *inbuf,char *outbuf, int length, int dum_buffsize)
 {
-       int outsize = set_message(outbuf,0,0,True);
+       int outsize = set_message(outbuf,0,0,False);
        SMB_BIG_UINT count,offset;
        NTSTATUS status;
        files_struct *fsp = file_fsp(inbuf,smb_vwv0);
-       BOOL my_lock_ctx = False;
+       struct byte_range_lock *br_lck = NULL;
 
        START_PROFILE(SMBlock);
 
@@ -3123,24 +3441,20 @@ int reply_lock(connection_struct *conn,
        offset = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv3);
 
        DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
-                fsp->fd, fsp->fnum, (double)offset, (double)count));
+                fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
+
+       br_lck = do_lock(fsp,
+                       (uint32)SVAL(inbuf,smb_pid),
+                       count,
+                       offset,
+                       WRITE_LOCK,
+                       WINDOWS_LOCK,
+                       False, /* Non-blocking lock. */
+                       &status);
+
+       TALLOC_FREE(br_lck);
 
-       status = do_lock_spin(fsp, conn, SVAL(inbuf,smb_pid), count, offset, WRITE_LOCK, &my_lock_ctx);
        if (NT_STATUS_V(status)) {
-#if 0
-               /* Tests using Samba4 against W2K show this call never creates a blocking lock. */
-               if (lp_blocking_locks(SNUM(conn)) && !my_lock_ctx && ERROR_WAS_LOCK_DENIED(status)) {
-                       /*
-                        * A blocking lock was requested. Package up
-                        * this smb into a queued request and push it
-                        * onto the blocking lock queue.
-                        */
-                       if(push_blocking_lock_request(inbuf, length, -1, 0, SVAL(inbuf,smb_pid), offset, count)) {
-                               END_PROFILE(SMBlock);
-                               return -1;
-                       }
-               }
-#endif
                END_PROFILE(SMBlock);
                return ERROR_NT(status);
        }
@@ -3156,7 +3470,7 @@ int reply_lock(connection_struct *conn,
 int reply_unlock(connection_struct *conn, char *inbuf,char *outbuf, int size, 
                 int dum_buffsize)
 {
-       int outsize = set_message(outbuf,0,0,True);
+       int outsize = set_message(outbuf,0,0,False);
        SMB_BIG_UINT count,offset;
        NTSTATUS status;
        files_struct *fsp = file_fsp(inbuf,smb_vwv0);
@@ -3167,27 +3481,36 @@ int reply_unlock(connection_struct *conn, char *inbuf,char *outbuf, int size,
        count = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv1);
        offset = (SMB_BIG_UINT)IVAL(inbuf,smb_vwv3);
        
-       status = do_unlock(fsp, conn, SVAL(inbuf,smb_pid), count, offset);
+       status = do_unlock(fsp,
+                       (uint32)SVAL(inbuf,smb_pid),
+                       count,
+                       offset,
+                       WINDOWS_LOCK);
+
        if (NT_STATUS_V(status)) {
                END_PROFILE(SMBunlock);
                return ERROR_NT(status);
        }
 
        DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
-                   fsp->fd, fsp->fnum, (double)offset, (double)count ) );
+                   fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
        
        END_PROFILE(SMBunlock);
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a tdis.
+ conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
 int reply_tdis(connection_struct *conn, 
               char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 {
-       int outsize = set_message(outbuf,0,0,True);
+       int outsize = set_message(outbuf,0,0,False);
        uint16 vuid;
        START_PROFILE(SMBtdis);
 
@@ -3209,6 +3532,7 @@ int reply_tdis(connection_struct *conn,
 
 /****************************************************************************
  Reply to a echo.
+ conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
 int reply_echo(connection_struct *conn,
@@ -3240,8 +3564,9 @@ int reply_echo(connection_struct *conn,
 
                smb_setlen(outbuf,outsize - 4);
 
+               show_msg(outbuf);
                if (!send_smb(smbd_server_fd(),outbuf))
-                       exit_server("reply_echo: send_smb failed.");
+                       exit_server_cleanly("reply_echo: send_smb failed.");
        }
 
        DEBUG(3,("echo %d times\n", smb_reverb));
@@ -3261,6 +3586,8 @@ int reply_printopen(connection_struct *conn,
 {
        int outsize = 0;
        files_struct *fsp;
+       NTSTATUS status;
+       
        START_PROFILE(SMBsplopen);
        
        if (!CAN_PRINT(conn)) {
@@ -3269,18 +3596,18 @@ int reply_printopen(connection_struct *conn,
        }
 
        /* Open for exclusive use, write only. */
-       fsp = print_fsp_open(conn, NULL);
+       status = print_fsp_open(conn, NULL, &fsp);
 
-       if (!fsp) {
+       if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBsplopen);
-               return(UNIXERROR(ERRDOS,ERRnoaccess));
+               return(ERROR_NT(status));
        }
 
        outsize = set_message(outbuf,1,0,True);
        SSVAL(outbuf,smb_vwv0,fsp->fnum);
   
        DEBUG(3,("openprint fd=%d fnum=%d\n",
-                fsp->fd, fsp->fnum));
+                fsp->fh->fd, fsp->fnum));
 
        END_PROFILE(SMBsplopen);
        return(outsize);
@@ -3293,7 +3620,7 @@ int reply_printopen(connection_struct *conn,
 int reply_printclose(connection_struct *conn,
                     char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 {
-       int outsize = set_message(outbuf,0,0,True);
+       int outsize = set_message(outbuf,0,0,False);
        files_struct *fsp = file_fsp(inbuf,smb_vwv0);
        int close_err = 0;
        START_PROFILE(SMBsplclose);
@@ -3306,9 +3633,9 @@ int reply_printclose(connection_struct *conn,
        }
   
        DEBUG(3,("printclose fd=%d fnum=%d\n",
-                fsp->fd,fsp->fnum));
+                fsp->fh->fd,fsp->fnum));
   
-       close_err = close_file(fsp,True);
+       close_err = close_file(fsp,NORMAL_CLOSE);
 
        if(close_err != 0) {
                errno = close_err;
@@ -3365,7 +3692,7 @@ int reply_printqueue(connection_struct *conn,
     
 
                for (i=first;i<first+num_to_get;i++) {
-                       put_dos_date2(p,0,queue[i].time);
+                       srv_put_dos_date2(p,0,queue[i].time);
                        SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
                        SSVAL(p,5, queue[i].job);
                        SIVAL(p,7,queue[i].size);
@@ -3398,7 +3725,7 @@ int reply_printqueue(connection_struct *conn,
 int reply_printwrite(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 {
        int numtowrite;
-       int outsize = set_message(outbuf,0,0,True);
+       int outsize = set_message(outbuf,0,0,False);
        char *data;
        files_struct *fsp = file_fsp(inbuf,smb_vwv0);
 
@@ -3410,7 +3737,9 @@ int reply_printwrite(connection_struct *conn, char *inbuf,char *outbuf, int dum_
        }
 
        CHECK_FSP(fsp,conn);
-       CHECK_WRITE(fsp);
+       if (!CHECK_WRITE(fsp)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
 
        numtowrite = SVAL(smb_buf(inbuf),1);
        data = smb_buf(inbuf) + 3;
@@ -3426,62 +3755,6 @@ int reply_printwrite(connection_struct *conn, char *inbuf,char *outbuf, int dum_
        return(outsize);
 }
 
-/****************************************************************************
- The guts of the mkdir command, split out so it may be called by the NT SMB
- code. 
-****************************************************************************/
-
-NTSTATUS mkdir_internal(connection_struct *conn, const pstring directory, BOOL bad_path)
-{
-       int ret= -1;
-       
-       if(!CAN_WRITE(conn)) {
-               DEBUG(5,("mkdir_internal: failing create on read-only share %s\n", lp_servicename(SNUM(conn))));
-               errno = EACCES;
-               return map_nt_error_from_unix(errno);
-       }
-
-       /* The following 2 clauses set explicit DOS error codes. JRA. */
-       if (ms_has_wild(directory)) {
-               DEBUG(5,("mkdir_internal: failing create on filename %s with wildcards\n", directory));
-               unix_ERR_class = ERRDOS;
-               unix_ERR_code = ERRinvalidname;
-               return NT_STATUS_OBJECT_NAME_INVALID;
-       }
-
-       if( strchr_m(directory, ':')) {
-               DEBUG(5,("mkdir_internal: failing create on filename %s with colon in name\n", directory));
-               unix_ERR_class = ERRDOS;
-               unix_ERR_code = ERRinvalidname;
-               return NT_STATUS_NOT_A_DIRECTORY;
-       }
-
-       if (bad_path) {
-               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
-       }
-
-       if (!check_name(directory, conn)) {
-               if(errno == ENOENT) {
-                       if (bad_path) {
-                               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
-                       } else {
-                               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
-                       }
-               }
-               return map_nt_error_from_unix(errno);
-       }
-
-       ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory,True));
-       if (ret == -1) {
-               if(errno == ENOENT) {
-                       return NT_STATUS_OBJECT_NAME_NOT_FOUND;
-               }
-               return map_nt_error_from_unix(errno);
-       }
-       
-       return NT_STATUS_OK;
-}
-
 /****************************************************************************
  Reply to a mkdir.
 ****************************************************************************/
@@ -3496,7 +3769,7 @@ int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
        START_PROFILE(SMBmkdir);
  
-       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status, False);
+       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmkdir);
                return ERROR_NT(status);
@@ -3506,31 +3779,28 @@ int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
        unix_convert(directory,conn,0,&bad_path,&sbuf);
 
-       status = mkdir_internal(conn, directory,bad_path);
+       status = create_directory(conn, directory);
+
+       DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
+
        if (!NT_STATUS_IS_OK(status)) {
-               END_PROFILE(SMBmkdir);
-               return ERROR_NT(status);
-       }
 
-       if (lp_inherit_owner(SNUM(conn))) {
-               /* Ensure we're checking for a symlink here.... */
-               /* We don't want to get caught by a symlink racer. */
-                                                                                                                                                   
-               if(SMB_VFS_LSTAT(conn,directory, &sbuf) != 0) {
-                       END_PROFILE(SMBmkdir);
-                       return(UNIXERROR(ERRDOS,ERRnoaccess));
-               }
-                                                                                                                                                   
-               if(!S_ISDIR(sbuf.st_mode)) {
-                       DEBUG(0,("reply_mkdir: %s is not a directory !\n", directory ));
-                       END_PROFILE(SMBmkdir);
-                       return(UNIXERROR(ERRDOS,ERRnoaccess));
+               if (!use_nt_status()
+                   && NT_STATUS_EQUAL(status,
+                                      NT_STATUS_OBJECT_NAME_COLLISION)) {
+                       /*
+                        * Yes, in the DOS error code case we get a
+                        * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
+                        * samba4 torture test.
+                        */
+                       status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
                }
 
-               change_owner_to_parent(conn, NULL, directory, &sbuf);
+               END_PROFILE(SMBmkdir);
+               return ERROR_NT(status);
        }
 
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
 
        DEBUG( 3, ( "mkdir %s ret=%d\n", directory, outsize ) );
 
@@ -3548,7 +3818,7 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory)
        const char *dname = NULL;
        BOOL ret = False;
        long offset = 0;
-       struct smb_Dir *dir_hnd = OpenDir(conn, directory);
+       struct smb_Dir *dir_hnd = OpenDir(conn, directory, NULL, 0);
 
        if(dir_hnd == NULL)
                return True;
@@ -3601,7 +3871,7 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory)
  The internals of the rmdir code - called elsewhere.
 ****************************************************************************/
 
-BOOL rmdir_internals(connection_struct *conn, char *directory)
+BOOL rmdir_internals(connection_struct *conn, const char *directory)
 {
        BOOL ok;
        SMB_STRUCT_STAT st;
@@ -3616,10 +3886,10 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
                 */
                BOOL all_veto_files = True;
                const char *dname;
-               struct smb_Dir *dir_hnd = OpenDir(conn, directory);
+               struct smb_Dir *dir_hnd = OpenDir(conn, directory, NULL, 0);
 
                if(dir_hnd != NULL) {
-                       long dirpos = TellDir(dir_hnd);
+                       long dirpos = 0;
                        while ((dname = ReadDirName(dir_hnd,&dirpos))) {
                                if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
                                        continue;
@@ -3632,7 +3902,7 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
                        }
 
                        if(all_veto_files) {
-                               SeekDir(dir_hnd,dirpos);
+                               RewindDir(dir_hnd,&dirpos);
                                while ((dname = ReadDirName(dir_hnd,&dirpos))) {
                                        pstring fullname;
 
@@ -3674,10 +3944,25 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
                }
        }
 
-       if (!ok)
-               DEBUG(3,("rmdir_internals: couldn't remove directory %s : %s\n", directory,strerror(errno)));
+       if (!ok) {
+               DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
+                        "%s\n", directory,strerror(errno)));
+               return False;
+       }
+
+       {
+               char *parent_dir;
+               const char *dirname;
+
+               if (parent_dirname_talloc(tmp_talloc_ctx(), directory,
+                                         &parent_dir, &dirname)) {
+                       notify_action(conn, parent_dir, dirname, -1,
+                                     NOTIFY_ACTION_REMOVED);
+                       TALLOC_FREE(parent_dir); /* Not strictly necessary */
+               }
+       }
 
-       return ok;
+       return True;
 }
 
 /****************************************************************************
@@ -3694,7 +3979,7 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        NTSTATUS status;
        START_PROFILE(SMBrmdir);
 
-       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status, False);
+       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBrmdir);
                return ERROR_NT(status);
@@ -3718,7 +4003,7 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRbadpath);
        }
  
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
   
        DEBUG( 3, ( "rmdir %s\n", directory ) );
   
@@ -3813,15 +4098,24 @@ static BOOL resolve_wildcards(const char *name1, char *name2)
 }
 
 /****************************************************************************
- Ensure open files have their names updates.
+ Ensure open files have their names updated. Updated to notify other smbd's
+ asynchronously.
 ****************************************************************************/
 
-static void rename_open_files(connection_struct *conn, SMB_DEV_T dev, SMB_INO_T inode, char *newname)
+static void rename_open_files(connection_struct *conn, struct share_mode_lock *lck,
+                               SMB_DEV_T dev, SMB_INO_T inode, const char *newname)
 {
        files_struct *fsp;
        BOOL did_rename = False;
 
        for(fsp = file_find_di_first(dev, inode); fsp; fsp = file_find_di_next(fsp)) {
+               /* fsp_name is a relative path under the fsp. To change this for other
+                  sharepaths we need to manipulate relative paths. */
+               /* TODO - create the absolute path and manipulate the newname
+                  relative to the sharepath. */
+               if (fsp->conn != conn) {
+                       continue;
+               }
                DEBUG(10,("rename_open_files: renaming file fnum %d (dev = %x, inode = %.0f) from %s -> %s\n",
                        fsp->fnum, (unsigned int)fsp->dev, (double)fsp->inode,
                        fsp->fsp_name, newname ));
@@ -3829,16 +4123,49 @@ static void rename_open_files(connection_struct *conn, SMB_DEV_T dev, SMB_INO_T
                did_rename = True;
        }
 
-       if (!did_rename)
+       if (!did_rename) {
                DEBUG(10,("rename_open_files: no open files on dev %x, inode %.0f for %s\n",
                        (unsigned int)dev, (double)inode, newname ));
+       }
+
+       /* Send messages to all smbd's (not ourself) that the name has changed. */
+       rename_share_filename(lck, conn->connectpath, newname);
+}
+
+/****************************************************************************
+ We need to check if the source path is a parent directory of the destination
+ (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
+ refuse the rename with a sharing violation. Under UNIX the above call can
+ *succeed* if /foo/bar/baz is a symlink to another area in the share. We
+ probably need to check that the client is a Windows one before disallowing
+ this as a UNIX client (one with UNIX extensions) can know the source is a
+ symlink and make this decision intelligently. Found by an excellent bug
+ report from <AndyLiebman@aol.com>.
+****************************************************************************/
+
+static BOOL rename_path_prefix_equal(const char *src, const char *dest)
+{
+       const char *psrc = src;
+       const char *pdst = dest;
+       size_t slen;
+
+       if (psrc[0] == '.' && psrc[1] == '/') {
+               psrc += 2;
+       }
+       if (pdst[0] == '.' && pdst[1] == '/') {
+               pdst += 2;
+       }
+       if ((slen = strlen(psrc)) > strlen(pdst)) {
+               return False;
+       }
+       return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
 }
 
 /****************************************************************************
  Rename an open file - given an fsp.
 ****************************************************************************/
 
-NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, uint16 attrs, BOOL replace_if_exists)
+NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, uint32 attrs, BOOL replace_if_exists)
 {
        SMB_STRUCT_STAT sbuf;
        BOOL bad_path = False;
@@ -3846,6 +4173,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
        NTSTATUS error = NT_STATUS_OK;
        BOOL dest_exists;
        BOOL rcdest = True;
+       struct share_mode_lock *lck = NULL;
 
        ZERO_STRUCT(sbuf);
        rcdest = unix_convert(newname,conn,newname_last_component,&bad_path,&sbuf);
@@ -3929,17 +4257,27 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
                return error;
        }
 
+       if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
+               return NT_STATUS_ACCESS_DENIED;
+       }
+
+       lck = get_share_mode_lock(NULL, fsp->dev, fsp->inode, NULL, NULL);
+
        if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
                DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
                        fsp->fsp_name,newname));
-               rename_open_files(conn, fsp->dev, fsp->inode, newname);
+               rename_open_files(conn, lck, fsp->dev, fsp->inode, newname);
+               TALLOC_FREE(lck);
                return NT_STATUS_OK;    
        }
 
-       if (errno == ENOTDIR || errno == EISDIR)
+       TALLOC_FREE(lck);
+
+       if (errno == ENOTDIR || errno == EISDIR) {
                error = NT_STATUS_OBJECT_NAME_COLLISION;
-       else
+       } else {
                error = map_nt_error_from_unix(errno);
+       }
                
        DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
                nt_errstr(error), fsp->fsp_name,newname));
@@ -3952,14 +4290,13 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
  code. 
 ****************************************************************************/
 
-NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, uint16 attrs, BOOL replace_if_exists)
+NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, uint32 attrs, BOOL replace_if_exists, BOOL has_wild)
 {
        pstring directory;
        pstring mask;
        pstring last_component_src;
        pstring last_component_dest;
        char *p;
-       BOOL has_wild;
        BOOL bad_path_src = False;
        BOOL bad_path_dest = False;
        int count=0;
@@ -3967,6 +4304,7 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, ui
        BOOL rc = True;
        BOOL rcdest = True;
        SMB_STRUCT_STAT sbuf1, sbuf2;
+       struct share_mode_lock *lck = NULL;
 
        *directory = *mask = 0;
 
@@ -4025,16 +4363,14 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, ui
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
 
-       if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask, sizeof(pstring)-1 );
-
-       has_wild = ms_has_wild(mask);
+       if (!rc && mangle_is_mangled(mask, conn->params))
+               mangle_check_cache( mask, sizeof(pstring)-1, conn->params );
 
        if (!has_wild) {
                /*
                 * No wildcards - just process the one file.
                 */
-               BOOL is_short_name = mangle_is_8_3(name, True);
+               BOOL is_short_name = mangle_is_8_3(name, True, conn->params);
 
                /* Add a terminating '/' to the directory name. */
                pstrcat(directory,"/");
@@ -4139,7 +4475,7 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                 */
 
                if (strcsequal(directory, newname)) {
-                       rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname);
+                       rename_open_files(conn, NULL, sbuf1.st_dev, sbuf1.st_ino, newname);
                        DEBUG(3,("rename_internals: identical names in rename %s - returning success\n", directory));
                        return NT_STATUS_OK;
                }
@@ -4150,13 +4486,21 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                        return NT_STATUS_OBJECT_NAME_COLLISION;
                }
 
+               if (rename_path_prefix_equal(directory, newname)) {
+                       return NT_STATUS_SHARING_VIOLATION;
+               }
+
+               lck = get_share_mode_lock(NULL, sbuf1.st_dev, sbuf1.st_ino, NULL, NULL);
+
                if(SMB_VFS_RENAME(conn,directory, newname) == 0) {
                        DEBUG(3,("rename_internals: succeeded doing rename on %s -> %s\n",
                                directory,newname));
-                       rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname);
+                       rename_open_files(conn, lck, sbuf1.st_dev, sbuf1.st_ino, newname);
+                       TALLOC_FREE(lck);
                        return NT_STATUS_OK;    
                }
 
+               TALLOC_FREE(lck);
                if (errno == ENOTDIR || errno == EISDIR)
                        error = NT_STATUS_OBJECT_NAME_COLLISION;
                else
@@ -4174,17 +4518,17 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                const char *dname;
                pstring destname;
                
+               if (strequal(mask,"????????.???"))
+                       pstrcpy(mask,"*");
+                       
                if (check_name(directory,conn))
-                       dir_hnd = OpenDir(conn, directory);
+                       dir_hnd = OpenDir(conn, directory, mask, attrs);
                
                if (dir_hnd) {
                        long offset = 0;
                        error = NT_STATUS_NO_SUCH_FILE;
 /*                     Was error = NT_STATUS_OBJECT_NAME_NOT_FOUND; - gentest fix. JRA */
                        
-                       if (strequal(mask,"????????.???"))
-                               pstrcpy(mask,"*");
-                       
                        while ((dname = ReadDirName(dir_hnd, &offset))) {
                                pstring fname;
                                BOOL sysdir_entry = False;
@@ -4234,7 +4578,7 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                }
                                
                                if (strcsequal(fname,destname)) {
-                                       rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname);
+                                       rename_open_files(conn, NULL, sbuf1.st_dev, sbuf1.st_ino, newname);
                                        DEBUG(3,("rename_internals: identical names in wildcard rename %s - success\n", fname));
                                        count++;
                                        error = NT_STATUS_OK;
@@ -4248,11 +4592,18 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                        continue;
                                }
                                
+                               if (rename_path_prefix_equal(fname, destname)) {
+                                       return NT_STATUS_SHARING_VIOLATION;
+                               }
+
+                               lck = get_share_mode_lock(NULL, sbuf1.st_dev, sbuf1.st_ino, NULL, NULL);
+
                                if (!SMB_VFS_RENAME(conn,fname,destname)) {
-                                       rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname);
+                                       rename_open_files(conn, lck, sbuf1.st_dev, sbuf1.st_ino, newname);
                                        count++;
                                        error = NT_STATUS_OK;
                                }
+                               TALLOC_FREE(lck);
                                DEBUG(3,("rename_internals: doing rename on %s -> %s\n",fname,destname));
                        }
                        CloseDir(dir_hnd);
@@ -4285,19 +4636,21 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        pstring name;
        pstring newname;
        char *p;
-       uint16 attrs = SVAL(inbuf,smb_vwv0);
+       uint32 attrs = SVAL(inbuf,smb_vwv0);
        NTSTATUS status;
+       BOOL path1_contains_wcard = False;
+       BOOL path2_contains_wcard = False;
 
        START_PROFILE(SMBmv);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, True);
+       p += srvstr_get_path_wcard(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, &path1_contains_wcard);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
                return ERROR_NT(status);
        }
        p++;
-       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, True);
+       p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &path2_contains_wcard);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
                return ERROR_NT(status);
@@ -4308,12 +4661,11 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        
        DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
        
-       status = rename_internals(conn, name, newname, attrs, False);
+       status = rename_internals(conn, name, newname, attrs, False, path1_contains_wcard);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
                if (open_was_deferred(SVAL(inbuf,smb_mid))) {
                        /* We have re-scheduled this call. */
-                       clear_cached_errors();
                        return -1;
                }
                return ERROR_NT(status);
@@ -4324,7 +4676,7 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
         * update after a rename..
         */     
        process_pending_change_notify_queue((time_t)0);
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
   
        END_PROFILE(SMBmv);
        return(outsize);
@@ -4334,56 +4686,78 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
  Copy a file as part of a reply_copy.
 ******************************************************************/
 
-static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
+BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
                      int count,BOOL target_is_directory, int *err_ret)
 {
-       int Access,action;
        SMB_STRUCT_STAT src_sbuf, sbuf2;
        SMB_OFF_T ret=-1;
        files_struct *fsp1,*fsp2;
        pstring dest;
        uint32 dosattrs;
+       uint32 new_create_disposition;
+       NTSTATUS status;
  
        *err_ret = 0;
 
        pstrcpy(dest,dest1);
        if (target_is_directory) {
                char *p = strrchr_m(src,'/');
-               if (p) 
+               if (p) {
                        p++;
-               else
+               } else {
                        p = src;
+               }
                pstrcat(dest,"/");
                pstrcat(dest,p);
        }
 
-       if (!vfs_file_exist(conn,src,&src_sbuf))
+       if (!vfs_file_exist(conn,src,&src_sbuf)) {
                return(False);
+       }
 
-       fsp1 = open_file_shared(conn,src,&src_sbuf,SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_RDONLY),
-                                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),FILE_ATTRIBUTE_NORMAL,INTERNAL_OPEN_ONLY,
-                                       &Access,&action);
+       if (!target_is_directory && count) {
+               new_create_disposition = FILE_OPEN;
+       } else {
+               if (!map_open_params_to_ntcreate(dest1,0,ofun,
+                               NULL, NULL, &new_create_disposition, NULL)) {
+                       return(False);
+               }
+       }
 
-       if (!fsp1)
-               return(False);
+       status = open_file_ntcreate(conn,src,&src_sbuf,
+                       FILE_GENERIC_READ,
+                       FILE_SHARE_READ|FILE_SHARE_WRITE,
+                       FILE_OPEN,
+                       0,
+                       FILE_ATTRIBUTE_NORMAL,
+                       INTERNAL_OPEN_ONLY,
+                       NULL, &fsp1);
 
-       if (!target_is_directory && count)
-               ofun = FILE_EXISTS_OPEN;
+       if (!NT_STATUS_IS_OK(status)) {
+               return(False);
+       }
 
        dosattrs = dos_mode(conn, src, &src_sbuf);
-       if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1)
+       if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
                ZERO_STRUCTP(&sbuf2);
+       }
 
-       fsp2 = open_file_shared(conn,dest,&sbuf2,SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_WRONLY),
-                       ofun,dosattrs,INTERNAL_OPEN_ONLY,&Access,&action);
+       status = open_file_ntcreate(conn,dest,&sbuf2,
+                       FILE_GENERIC_WRITE,
+                       FILE_SHARE_READ|FILE_SHARE_WRITE,
+                       new_create_disposition,
+                       0,
+                       dosattrs,
+                       INTERNAL_OPEN_ONLY,
+                       NULL, &fsp2);
 
-       if (!fsp2) {
-               close_file(fsp1,False);
+       if (!NT_STATUS_IS_OK(status)) {
+               close_file(fsp1,ERROR_CLOSE);
                return(False);
        }
 
        if ((ofun&3) == 1) {
-               if(SMB_VFS_LSEEK(fsp2,fsp2->fd,0,SEEK_END) == -1) {
+               if(SMB_VFS_LSEEK(fsp2,fsp2->fh->fd,0,SEEK_END) == -1) {
                        DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
                        /*
                         * Stop the copy from occurring.
@@ -4393,10 +4767,11 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
                }
        }
   
-       if (src_sbuf.st_size)
+       if (src_sbuf.st_size) {
                ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
+       }
 
-       close_file(fsp1,False);
+       close_file(fsp1,NORMAL_CLOSE);
 
        /* Ensure the modtime is set correctly on the destination file. */
        fsp_set_pending_modtime( fsp2, src_sbuf.st_mtime);
@@ -4407,7 +4782,7 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
         * Thus we don't look at the error return from the
         * close of fsp1.
         */
-       *err_ret = close_file(fsp2,False);
+       *err_ret = close_file(fsp2,NORMAL_CLOSE);
 
        return(ret == (SMB_OFF_T)src_sbuf.st_size);
 }
@@ -4434,21 +4809,22 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        BOOL target_is_directory=False;
        BOOL bad_path1 = False;
        BOOL bad_path2 = False;
+       BOOL path_contains_wcard1 = False;
+       BOOL path_contains_wcard2 = False;
        BOOL rc = True;
        SMB_STRUCT_STAT sbuf1, sbuf2;
        NTSTATUS status;
-
        START_PROFILE(SMBcopy);
 
        *directory = *mask = 0;
 
        p = smb_buf(inbuf);
-       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, True);
+       p += srvstr_get_path_wcard(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, &path_contains_wcard1);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcopy);
                return ERROR_NT(status);
        }
-       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, True);
+       p += srvstr_get_path_wcard(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, &path_contains_wcard2);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcopy);
                return ERROR_NT(status);
@@ -4507,10 +4883,10 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
 
-       if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask, sizeof(pstring)-1 );
+       if (!rc && mangle_is_mangled(mask, conn->params))
+               mangle_check_cache( mask, sizeof(pstring)-1, conn->params );
 
-       has_wild = ms_has_wild(mask);
+       has_wild = path_contains_wcard1;
 
        if (!has_wild) {
                pstrcat(directory,"/");
@@ -4531,16 +4907,16 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                const char *dname;
                pstring destname;
 
+               if (strequal(mask,"????????.???"))
+                       pstrcpy(mask,"*");
+
                if (check_name(directory,conn))
-                       dir_hnd = OpenDir(conn, directory);
+                       dir_hnd = OpenDir(conn, directory, mask, 0);
 
                if (dir_hnd) {
                        long offset = 0;
                        error = ERRbadfile;
 
-                       if (strequal(mask,"????????.???"))
-                               pstrcpy(mask,"*");
-
                        while ((dname = ReadDirName(dir_hnd, &offset))) {
                                pstring fname;
                                pstrcpy(fname,dname);
@@ -4576,9 +4952,12 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                        END_PROFILE(SMBcopy);
                        return ERROR_DOS(ERRDOS,error);
                } else {
-                       if((errno == ENOENT) && (bad_path1 || bad_path2)) {
-                               unix_ERR_class = ERRDOS;
-                               unix_ERR_code = ERRbadpath;
+                       if((errno == ENOENT) && (bad_path1 || bad_path2) &&
+                          !use_nt_status()) {
+                               /* Samba 3.0.22 has ERRDOS/ERRbadpath in the
+                                * DOS error code case
+                                */
+                               return ERROR_DOS(ERRDOS, ERRbadpath);
                        }
                        END_PROFILE(SMBcopy);
                        return(UNIXERROR(ERRDOS,error));
@@ -4612,7 +4991,7 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                return ERROR_DOS(ERRDOS,ERRnoaccess);
        }
 
-       srvstr_get_path(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), 0, STR_TERMINATE, &status, False);
+       srvstr_get_path(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), 0, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(pathworks_setdir);
                return ERROR_NT(status);
@@ -4625,7 +5004,7 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        } else {
                ok = vfs_directory_exist(conn,newdir,NULL);
                if (ok)
-                       string_set(&conn->connectpath,newdir);
+                       set_conn_connectpath(conn,newdir);
        }
   
        if (!ok) {
@@ -4633,7 +5012,7 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                return ERROR_DOS(ERRDOS,ERRbadpath);
        }
   
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
        SCVAL(outbuf,smb_reh,CVAL(inbuf,smb_reh));
   
        DEBUG(3,("setdir %s\n", newdir));
@@ -4642,16 +5021,19 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        return(outsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_LOCKING
+
 /****************************************************************************
  Get a lock pid, dealing with large count requests.
 ****************************************************************************/
 
-uint16 get_lock_pid( char *data, int data_offset, BOOL large_file_format)
+uint32 get_lock_pid( char *data, int data_offset, BOOL large_file_format)
 {
        if(!large_file_format)
-               return SVAL(data,SMB_LPID_OFFSET(data_offset));
+               return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
        else
-               return SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
+               return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
 }
 
 /****************************************************************************
@@ -4779,7 +5161,8 @@ SMB_BIG_UINT get_lock_offset( char *data, int data_offset, BOOL large_file_forma
  Reply to a lockingX request.
 ****************************************************************************/
 
-int reply_lockingX(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize)
+int reply_lockingX(connection_struct *conn, char *inbuf, char *outbuf,
+                  int length, int bufsize)
 {
        files_struct *fsp = file_fsp(inbuf,smb_vwv2);
        unsigned char locktype = CVAL(inbuf,smb_vwv3);
@@ -4787,14 +5170,14 @@ int reply_lockingX(connection_struct *conn, char *inbuf,char *outbuf,int length,
        uint16 num_ulocks = SVAL(inbuf,smb_vwv6);
        uint16 num_locks = SVAL(inbuf,smb_vwv7);
        SMB_BIG_UINT count = 0, offset = 0;
-       uint16 lock_pid;
+       uint32 lock_pid;
        int32 lock_timeout = IVAL(inbuf,smb_vwv4);
        int i;
        char *data;
-       BOOL large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
+       BOOL large_file_format =
+               (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
        BOOL err;
-       BOOL my_lock_ctx = False;
-       NTSTATUS status;
+       NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 
        START_PROFILE(SMBlockingX);
        
@@ -4806,12 +5189,7 @@ int reply_lockingX(connection_struct *conn, char *inbuf,char *outbuf,int length,
                /* we don't support these - and CANCEL_LOCK makes w2k
                   and XP reboot so I don't really want to be
                   compatible! (tridge) */
-               return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
-       }
-       
-       if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
-               /* Need to make this like a cancel.... JRA. */
-               return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
+               return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
        }
        
        /* Check if this is an oplock break on a file
@@ -4820,19 +5198,32 @@ int reply_lockingX(connection_struct *conn, char *inbuf,char *outbuf,int length,
        if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
                /* Client can insist on breaking to none. */
                BOOL break_to_none = (oplocklevel == 0);
-               
-               DEBUG(5,("reply_lockingX: oplock break reply (%u) from client for fnum = %d\n",
-                        (unsigned int)oplocklevel, fsp->fnum ));
+               BOOL result;
+
+               DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
+                        "for fnum = %d\n", (unsigned int)oplocklevel,
+                        fsp->fnum ));
 
                /*
-                * Make sure we have granted an exclusive or batch oplock on this file.
+                * Make sure we have granted an exclusive or batch oplock on
+                * this file.
                 */
                
-               if(!EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
-                       DEBUG(0,("reply_lockingX: Error : oplock break from client for fnum = %d and \
-no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
+               if (fsp->oplock_type == 0) {
+
+                       /* The Samba4 nbench simulator doesn't understand
+                          the difference between break to level2 and break
+                          to none from level2 - it sends oplock break
+                          replies in both cases. Don't keep logging an error
+                          message here - just ignore it. JRA. */
 
-                       /* if this is a pure oplock break request then don't send a reply */
+                       DEBUG(5,("reply_lockingX: Error : oplock break from "
+                                "client for fnum = %d (oplock=%d) and no "
+                                "oplock granted on this file (%s).\n",
+                                fsp->fnum, fsp->oplock_type, fsp->fsp_name));
+
+                       /* if this is a pure oplock break request then don't
+                        * send a reply */
                        if (num_locks == 0 && num_ulocks == 0) {
                                END_PROFILE(SMBlockingX);
                                return -1;
@@ -4842,17 +5233,30 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
                        }
                }
 
-               if (remove_oplock(fsp, break_to_none) == False) {
-                       DEBUG(0,("reply_lockingX: error in removing oplock on file %s\n",
-                                fsp->fsp_name ));
+               if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
+                   (break_to_none)) {
+                       result = remove_oplock(fsp);
+               } else {
+                       result = downgrade_oplock(fsp);
                }
                
-               /* if this is a pure oplock break request then don't send a reply */
+               if (!result) {
+                       DEBUG(0, ("reply_lockingX: error in removing "
+                                 "oplock on file %s\n", fsp->fsp_name));
+                       /* Hmmm. Is this panic justified? */
+                       smb_panic("internal tdb error");
+               }
+
+               reply_to_oplock_break_requests(fsp);
+
+               /* if this is a pure oplock break request then don't send a
+                * reply */
                if (num_locks == 0 && num_ulocks == 0) {
                        /* Sanity check - ensure a pure oplock break is not a
                           chained request. */
                        if(CVAL(inbuf,smb_vwv0) != 0xff)
-                               DEBUG(0,("reply_lockingX: Error : pure oplock break is a chained %d request !\n",
+                               DEBUG(0,("reply_lockingX: Error : pure oplock "
+                                        "break is a chained %d request !\n",
                                         (unsigned int)CVAL(inbuf,smb_vwv0) ));
                        END_PROFILE(SMBlockingX);
                        return -1;
@@ -4881,10 +5285,16 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
                        return ERROR_DOS(ERRDOS,ERRnoaccess);
                }
 
-               DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for pid %u, file %s\n",
-                         (double)offset, (double)count, (unsigned int)lock_pid, fsp->fsp_name ));
+               DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
+                         "pid %u, file %s\n", (double)offset, (double)count,
+                         (unsigned int)lock_pid, fsp->fsp_name ));
                
-               status = do_unlock(fsp,conn,lock_pid,count,offset);
+               status = do_unlock(fsp,
+                               lock_pid,
+                               count,
+                               offset,
+                               WINDOWS_LOCK);
+
                if (NT_STATUS_V(status)) {
                        END_PROFILE(SMBlockingX);
                        return ERROR_NT(status);
@@ -4893,7 +5303,9 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
 
        /* Setup the timeout in seconds. */
 
-       lock_timeout = ((lock_timeout == -1) ? -1 : (lock_timeout+999)/1000);
+       if (!lp_blocking_locks(SNUM(conn))) {
+               lock_timeout = 0;
+       }
        
        /* Now do any requested locks */
        data += ((large_file_format ? 20 : 10)*num_ulocks);
@@ -4902,6 +5314,8 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
           of smb_lkrng structs */
        
        for(i = 0; i < (int)num_locks; i++) {
+               enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
+                               READ_LOCK:WRITE_LOCK);
                lock_pid = get_lock_pid( data, i, large_file_format);
                count = get_lock_count( data, i, large_file_format);
                offset = get_lock_offset( data, i, large_file_format, &err);
@@ -4914,38 +5328,106 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
                        return ERROR_DOS(ERRDOS,ERRnoaccess);
                }
                
-               DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid %u, file %s timeout = %d\n",
-                       (double)offset, (double)count, (unsigned int)lock_pid,
-                       fsp->fsp_name, (int)lock_timeout ));
+               DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
+                         "%u, file %s timeout = %d\n", (double)offset,
+                         (double)count, (unsigned int)lock_pid,
+                         fsp->fsp_name, (int)lock_timeout ));
                
-               status = do_lock_spin(fsp,conn,lock_pid, count,offset, 
-                                ((locktype & 1) ? READ_LOCK : WRITE_LOCK), &my_lock_ctx);
-               if (NT_STATUS_V(status)) {
-                       /*
-                        * Interesting fact found by IFSTEST /t LockOverlappedTest...
-                        * Even if it's our own lock context, we need to wait here as
-                        * there may be an unlock on the way.
-                        * So I removed a "&& !my_lock_ctx" from the following
-                        * if statement. JRA.
-                        */
-                       if ((lock_timeout != 0) && lp_blocking_locks(SNUM(conn)) && ERROR_WAS_LOCK_DENIED(status)) {
+               if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
+                       if (lp_blocking_locks(SNUM(conn))) {
+
+                               /* Schedule a message to ourselves to
+                                  remove the blocking lock record and
+                                  return the right error. */
+
+                               if (!blocking_lock_cancel(fsp,
+                                               lock_pid,
+                                               offset,
+                                               count,
+                                               WINDOWS_LOCK,
+                                               locktype,
+                                               NT_STATUS_FILE_LOCK_CONFLICT)) {
+                                       END_PROFILE(SMBlockingX);
+                                       return ERROR_NT(NT_STATUS_DOS(ERRDOS, ERRcancelviolation));
+                               }
+                       }
+                       /* Remove a matching pending lock. */
+                       status = do_lock_cancel(fsp,
+                                               lock_pid,
+                                               count,
+                                               offset,
+                                               WINDOWS_LOCK);
+               } else {
+                       BOOL blocking_lock = lock_timeout ? True : False;
+                       BOOL defer_lock = False;
+                       struct byte_range_lock *br_lck;
+
+                       br_lck = do_lock(fsp,
+                                       lock_pid,
+                                       count,
+                                       offset, 
+                                       lock_type,
+                                       WINDOWS_LOCK,
+                                       blocking_lock,
+                                       &status);
+
+                       if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
+                               /* Windows internal resolution for blocking locks seems
+                                  to be about 200ms... Don't wait for less than that. JRA. */
+                               if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
+                                       lock_timeout = lp_lock_spin_time();
+                               }
+                               defer_lock = True;
+                       }
+
+                       /* This heuristic seems to match W2K3 very well. If a
+                          lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
+                          it pretends we asked for a timeout of between 150 - 300 milliseconds as
+                          far as I can tell. Replacement for do_lock_spin(). JRA. */
+
+                       if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
+                                       NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
+                               defer_lock = True;
+                               lock_timeout = lp_lock_spin_time();
+                       }
+
+                       if (br_lck && defer_lock) {
                                /*
                                 * A blocking lock was requested. Package up
                                 * this smb into a queued request and push it
                                 * onto the blocking lock queue.
                                 */
-                               if(push_blocking_lock_request(inbuf, length, lock_timeout, i, lock_pid, offset, count)) {
+                               if(push_blocking_lock_request(br_lck,
+                                                       inbuf, length,
+                                                       fsp,
+                                                       lock_timeout,
+                                                       i,
+                                                       lock_pid,
+                                                       lock_type,
+                                                       WINDOWS_LOCK,
+                                                       offset,
+                                                       count)) {
+                                       TALLOC_FREE(br_lck);
                                        END_PROFILE(SMBlockingX);
                                        return -1;
                                }
                        }
-                       break;
+
+                       TALLOC_FREE(br_lck);
+               }
+
+               if (NT_STATUS_V(status)) {
+                       END_PROFILE(SMBlockingX);
+                       return ERROR_NT(status);
                }
        }
        
        /* If any of the above locks failed, then we must unlock
           all of the previous locks (X/Open spec). */
-       if (i != num_locks && num_locks != 0) {
+
+       if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
+                       (i != num_locks) &&
+                       (num_locks != 0)) {
                /*
                 * Ensure we don't do a remove on the lock that just failed,
                 * as under POSIX rules, if we have a lock already there, we
@@ -4954,17 +5436,23 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
                for(i--; i >= 0; i--) {
                        lock_pid = get_lock_pid( data, i, large_file_format);
                        count = get_lock_count( data, i, large_file_format);
-                       offset = get_lock_offset( data, i, large_file_format, &err);
+                       offset = get_lock_offset( data, i, large_file_format,
+                                                 &err);
                        
                        /*
-                        * There is no error code marked "stupid client bug".... :-).
+                        * There is no error code marked "stupid client
+                        * bug".... :-).
                         */
                        if(err) {
                                END_PROFILE(SMBlockingX);
                                return ERROR_DOS(ERRDOS,ERRnoaccess);
                        }
                        
-                       do_unlock(fsp,conn,lock_pid,count,offset);
+                       do_unlock(fsp,
+                               lock_pid,
+                               count,
+                               offset,
+                               WINDOWS_LOCK);
                }
                END_PROFILE(SMBlockingX);
                return ERROR_NT(status);
@@ -4972,13 +5460,16 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
 
        set_message(outbuf,2,0,True);
        
-       DEBUG( 3, ( "lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
-                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks ) );
+       DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
+                 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
        
        END_PROFILE(SMBlockingX);
        return chain_reply(inbuf,outbuf,length,bufsize);
 }
 
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_ALL
+
 /****************************************************************************
  Reply to a SMBreadbmpx (read block multiplex) request.
 ****************************************************************************/
@@ -5006,7 +5497,9 @@ int reply_readbmpx(connection_struct *conn, char *inbuf,char *outbuf,int length,
        outsize = set_message(outbuf,8,0,True);
 
        CHECK_FSP(fsp,conn);
-       CHECK_READ(fsp);
+       if (!CHECK_READ(fsp,inbuf)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
 
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv1);
        maxcount = SVAL(inbuf,smb_vwv3);
@@ -5021,7 +5514,7 @@ int reply_readbmpx(connection_struct *conn, char *inbuf,char *outbuf,int length,
        tcount = maxcount;
        total_read = 0;
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
+       if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBreadBmpx);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -5037,14 +5530,15 @@ int reply_readbmpx(connection_struct *conn, char *inbuf,char *outbuf,int length,
                if (nread < (ssize_t)N)
                        tcount = total_read + nread;
 
-               set_message(outbuf,8,nread,False);
+               set_message(outbuf,8,nread+pad,False);
                SIVAL(outbuf,smb_vwv0,startpos);
                SSVAL(outbuf,smb_vwv2,tcount);
                SSVAL(outbuf,smb_vwv6,nread);
                SSVAL(outbuf,smb_vwv7,smb_offset(data,outbuf));
 
+               show_msg(outbuf);
                if (!send_smb(smbd_server_fd(),outbuf))
-                       exit_server("reply_readbmpx: send_smb failed.");
+                       exit_server_cleanly("reply_readbmpx: send_smb failed.");
 
                total_read += nread;
                startpos += nread;
@@ -5065,10 +5559,10 @@ int reply_setattrE(connection_struct *conn, char *inbuf,char *outbuf, int size,
        files_struct *fsp = file_fsp(inbuf,smb_vwv0);
        START_PROFILE(SMBsetattrE);
 
-       outsize = set_message(outbuf,0,0,True);
+       outsize = set_message(outbuf,0,0,False);
 
        if(!fsp || (fsp->conn != conn)) {
-               END_PROFILE(SMBgetattrE);
+               END_PROFILE(SMBsetattrE);
                return ERROR_DOS(ERRDOS,ERRbadfid);
        }
 
@@ -5077,8 +5571,8 @@ int reply_setattrE(connection_struct *conn, char *inbuf,char *outbuf, int size,
         * time as UNIX can't set this.
         */
 
-       unix_times.actime = make_unix_date2(inbuf+smb_vwv3);
-       unix_times.modtime = make_unix_date2(inbuf+smb_vwv5);
+       unix_times.actime = srv_make_unix_date2(inbuf+smb_vwv3);
+       unix_times.modtime = srv_make_unix_date2(inbuf+smb_vwv5);
   
        /* 
         * Patch from Ray Frush <frush@engr.colostate.edu>
@@ -5133,8 +5627,12 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
        START_PROFILE(SMBwriteBmpx);
 
        CHECK_FSP(fsp,conn);
-       CHECK_WRITE(fsp);
-       CHECK_ERROR(fsp);
+       if (!CHECK_WRITE(fsp)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
+       if (HAS_CACHED_ERROR(fsp)) {
+               return(CACHED_ERROR(fsp));
+       }
 
        tcount = SVAL(inbuf,smb_vwv1);
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv3);
@@ -5148,15 +5646,14 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
                not an SMBwritebmpx - set this up now so we don't forget */
        SCVAL(outbuf,smb_com,SMBwritec);
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos,WRITE_LOCK)) {
+       if (is_locked(fsp,(uint32)SVAL(inbuf,smb_pid),(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos,WRITE_LOCK)) {
                END_PROFILE(SMBwriteBmpx);
                return(ERROR_DOS(ERRDOS,ERRlock));
        }
 
        nwritten = write_file(fsp,data,startpos,numtowrite);
 
-       if(lp_syncalways(SNUM(conn)) || write_through)
-               sync_file(conn,fsp);
+       sync_file(conn, fsp, write_through);
   
        if(nwritten < (ssize_t)numtowrite) {
                END_PROFILE(SMBwriteBmpx);
@@ -5201,8 +5698,9 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
        if (write_through && tcount==nwritten) {
                /* We need to send both a primary and a secondary response */
                smb_setlen(outbuf,outsize - 4);
+               show_msg(outbuf);
                if (!send_smb(smbd_server_fd(),outbuf))
-                       exit_server("reply_writebmpx: send_smb failed.");
+                       exit_server_cleanly("reply_writebmpx: send_smb failed.");
 
                /* Now the secondary */
                outsize = set_message(outbuf,1,0,True);
@@ -5234,7 +5732,9 @@ int reply_writebs(connection_struct *conn, char *inbuf,char *outbuf, int dum_siz
        START_PROFILE(SMBwriteBs);
 
        CHECK_FSP(fsp,conn);
-       CHECK_WRITE(fsp);
+       if (!CHECK_WRITE(fsp)) {
+               return(ERROR_DOS(ERRDOS,ERRbadaccess));
+       }
 
        tcount = SVAL(inbuf,smb_vwv1);
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
@@ -5265,8 +5765,7 @@ int reply_writebs(connection_struct *conn, char *inbuf,char *outbuf, int dum_siz
 
        nwritten = write_file(fsp,data,startpos,numtowrite);
 
-       if(lp_syncalways(SNUM(conn)) || write_through)
-               sync_file(conn,fsp);
+       sync_file(conn, fsp, write_through);
   
        if (nwritten < (ssize_t)numtowrite) {
                if(write_through) {
@@ -5277,8 +5776,12 @@ int reply_writebs(connection_struct *conn, char *inbuf,char *outbuf, int dum_siz
                        END_PROFILE(SMBwriteBs);
                        return(ERROR_DOS(ERRHRD,ERRdiskfull));
                }
+               wbms->wr_errclass = ERRHRD;
+               wbms->wr_error = ERRdiskfull;
+               wbms->wr_status = NT_STATUS_DISK_FULL;
+               wbms->wr_discard = True;
                END_PROFILE(SMBwriteBs);
-               return(CACHE_ERROR(wbms,ERRHRD,ERRdiskfull));
+               return -1;
        }
 
        /* Increment the total written, if this matches tcount
@@ -5337,10 +5840,10 @@ int reply_getattrE(connection_struct *conn, char *inbuf,char *outbuf, int size,
         * this.
         */
 
-       put_dos_date2(outbuf,smb_vwv0,get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn))));
-       put_dos_date2(outbuf,smb_vwv2,sbuf.st_atime);
+       srv_put_dos_date2(outbuf,smb_vwv0,get_create_time(&sbuf,lp_fake_dir_create_times(SNUM(conn))));
+       srv_put_dos_date2(outbuf,smb_vwv2,sbuf.st_atime);
        /* Should we check pending modtime here ? JRA */
-       put_dos_date2(outbuf,smb_vwv4,sbuf.st_mtime);
+       srv_put_dos_date2(outbuf,smb_vwv4,sbuf.st_mtime);
 
        if (mode & aDIR) {
                SIVAL(outbuf,smb_vwv6,0);