Revert "smbd: introduce sconn->sync_thread_pool"
[garming/samba-autobuild/.git] / source3 / smbd / msdfs.c
index c49cb61f6cc647fe5a6b6d2daee0bc92119bed9c..5283edbecfcd8997378d31447899033a903993ee 100644 (file)
@@ -4,6 +4,7 @@
    MSDFS services for Samba
    Copyright (C) Shirish Kalele 2000
    Copyright (C) Jeremy Allison 2007
+   Copyright (C) Robin McCorkell 2015
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
 #include "smbd/globals.h"
 #include "msdfs.h"
 #include "auth.h"
+#include "../auth/auth_util.h"
 #include "lib/param/loadparm.h"
 #include "libcli/security/security.h"
+#include "librpc/gen_ndr/ndr_dfsblobs.h"
+#include "lib/tsocket/tsocket.h"
 
 /**********************************************************************
  Parse a DFS pathname of the form \hostname\service\reqpath
@@ -80,9 +84,19 @@ static NTSTATUS parse_dfs_path(connection_struct *conn,
        eos_ptr = &pathname_local[strlen(pathname_local)];
        p = temp = pathname_local;
 
-       pdp->posix_path = (lp_posix_pathnames() && *pathname == '/');
+       /*
+        * Non-broken DFS paths *must* start with the
+        * path separator. For Windows this is always '\\',
+        * for posix paths this is always '/'.
+        */
 
-       sepchar = pdp->posix_path ? '/' : '\\';
+       if (*pathname == '/') {
+               pdp->posix_path = true;
+               sepchar = '/';
+       } else {
+               pdp->posix_path = false;
+               sepchar = '\\';
+       }
 
        if (allow_broken_path && (*pathname != sepchar)) {
                DEBUG(10,("parse_dfs_path: path %s doesn't start with %c\n",
@@ -90,6 +104,8 @@ static NTSTATUS parse_dfs_path(connection_struct *conn,
                /*
                 * Possibly client sent a local path by mistake.
                 * Try and convert to a local path.
+                * Note that this is an SMB1-only fallback
+                * to cope with known broken SMB1 clients.
                 */
 
                pdp->hostname = eos_ptr; /* "" */
@@ -146,9 +162,9 @@ static NTSTATUS parse_dfs_path(connection_struct *conn,
        }
 
        /* Is this really our servicename ? */
-       if (conn && !( strequal(servicename, lp_servicename(SNUM(conn)))
+       if (conn && !( strequal(servicename, lp_servicename(talloc_tos(), SNUM(conn)))
                        || (strequal(servicename, HOMES_NAME)
-                       && strequal(lp_servicename(SNUM(conn)),
+                       && strequal(lp_servicename(talloc_tos(), SNUM(conn)),
                                get_current_username()) )) ) {
                DEBUG(10,("parse_dfs_path: %s is not our servicename\n",
                        servicename));
@@ -217,37 +233,73 @@ static NTSTATUS parse_dfs_path(connection_struct *conn,
 }
 
 /********************************************************
- Fake up a connection struct for the VFS layer.
- Note: this performs a vfs connect and CHANGES CWD !!!! JRA.
+ Fake up a connection struct for the VFS layer, for use in
+ applications (such as the python bindings), that do not want the
+ global working directory changed under them.
+
+ SMB_VFS_CONNECT requires root privileges.
 *********************************************************/
 
-NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
-                               struct smbd_server_connection *sconn,
-                               connection_struct **pconn,
-                               int snum,
-                               const char *path,
-                               const struct auth_session_info *session_info,
-                               char **poldcwd)
+static NTSTATUS create_conn_struct_as_root(TALLOC_CTX *ctx,
+                           struct messaging_context *msg,
+                           connection_struct **pconn,
+                           int snum,
+                           const char *path,
+                           const struct auth_session_info *session_info)
 {
        connection_struct *conn;
        char *connpath;
-       char *oldcwd;
        const char *vfs_user;
+       struct smbd_server_connection *sconn;
+       const char *servicename = lp_const_servicename(snum);
 
-       conn = talloc_zero(ctx, connection_struct);
+       sconn = talloc_zero(ctx, struct smbd_server_connection);
+       if (sconn == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       sconn->raw_ev_ctx = samba_tevent_context_init(sconn);
+       if (sconn->raw_ev_ctx == NULL) {
+               TALLOC_FREE(sconn);
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       sconn->root_ev_ctx = smbd_impersonate_root_create(sconn->raw_ev_ctx);
+       if (sconn->root_ev_ctx == NULL) {
+               TALLOC_FREE(sconn);
+               return NT_STATUS_NO_MEMORY;
+       }
+       sconn->guest_ev_ctx = smbd_impersonate_guest_create(sconn->raw_ev_ctx);
+       if (sconn->guest_ev_ctx == NULL) {
+               TALLOC_FREE(sconn);
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       sconn->msg_ctx = msg;
+
+       conn = conn_new(sconn);
        if (conn == NULL) {
+               TALLOC_FREE(sconn);
                return NT_STATUS_NO_MEMORY;
        }
 
+       /* Now we have conn, we need to make sconn a child of conn,
+        * for a proper talloc tree */
+       talloc_steal(conn, sconn);
+
+       if (snum == -1 && servicename == NULL) {
+               servicename = "Unknown Service (snum == -1)";
+       }
+
        connpath = talloc_strdup(conn, path);
        if (!connpath) {
                TALLOC_FREE(conn);
                return NT_STATUS_NO_MEMORY;
        }
        connpath = talloc_string_sub(conn,
-                               connpath,
-                               "%S",
-                               lp_servicename(snum));
+                                    connpath,
+                                    "%S",
+                                    servicename);
        if (!connpath) {
                TALLOC_FREE(conn);
                return NT_STATUS_NO_MEMORY;
@@ -255,16 +307,8 @@ NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
 
        /* needed for smbd_vfs_init() */
 
-       if (!(conn->params = talloc_zero(conn, struct share_params))) {
-               DEBUG(0, ("TALLOC failed\n"));
-               TALLOC_FREE(conn);
-               return NT_STATUS_NO_MEMORY;
-       }
-
        conn->params->service = snum;
-
-       conn->sconn = sconn;
-       conn->sconn->num_tcons_open++;
+       conn->cnum = TID_FIELD_INVALID;
 
        if (session_info != NULL) {
                conn->session_info = copy_session_info(conn, session_info);
@@ -273,32 +317,59 @@ NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
                        TALLOC_FREE(conn);
                        return NT_STATUS_NO_MEMORY;
                }
-               vfs_user = conn->session_info->unix_info->unix_name;
+               /* unix_info could be NULL in session_info */
+               if (conn->session_info->unix_info != NULL) {
+                       vfs_user = conn->session_info->unix_info->unix_name;
+               } else {
+                       vfs_user = get_current_username();
+               }
        } else {
                /* use current authenticated user in absence of session_info */
                vfs_user = get_current_username();
        }
 
+       /*
+        * The impersonation has to be done by the caller
+        * of create_conn_struct_tos[_cwd]().
+        *
+        * Note: the context can't be changed anyway
+        * as we're using our own tevent_context
+        * and not a global one were other requests
+        * could change the current unix token.
+        *
+        * We just use a wrapper tevent_context in order
+        * to avoid crashes because TALLOC_FREE(conn->user_ev_ctx)
+        * would also remove sconn->raw_ev_ctx.
+        */
+       conn->user_ev_ctx = smbd_impersonate_debug_create(sconn->raw_ev_ctx,
+                                                         "FAKE impersonation",
+                                                         DBGLVL_DEBUG);
+       if (conn->user_ev_ctx == NULL) {
+               TALLOC_FREE(conn);
+               return NT_STATUS_NO_MEMORY;
+       }
+
        set_conn_connectpath(conn, connpath);
 
        /*
-        * New code to check if there's a share security descripter
+        * New code to check if there's a share security descriptor
         * added from NT server manager. This is done after the
         * smb.conf checks are done as we need a uid and token. JRA.
         *
         */
        if (conn->session_info) {
                share_access_check(conn->session_info->security_token,
-                                  lp_servicename(snum), MAXIMUM_ALLOWED_ACCESS,
+                                  servicename,
+                                  MAXIMUM_ALLOWED_ACCESS,
                                   &conn->share_access);
 
                if ((conn->share_access & FILE_WRITE_DATA) == 0) {
                        if ((conn->share_access & FILE_READ_DATA) == 0) {
                                /* No access, read or write. */
-                               DEBUG(0,("create_conn_struct: connection to %s "
+                               DEBUG(3,("create_conn_struct: connection to %s "
                                         "denied due to security "
                                         "descriptor.\n",
-                                        lp_servicename(snum)));
+                                        servicename));
                                conn_free(conn);
                                return NT_STATUS_ACCESS_DENIED;
                        } else {
@@ -318,13 +389,111 @@ NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
        }
 
        /* this must be the first filesystem operation that we do */
-       if (SMB_VFS_CONNECT(conn, lp_servicename(snum), vfs_user) < 0) {
+       if (SMB_VFS_CONNECT(conn, servicename, vfs_user) < 0) {
                DEBUG(0,("VFS connect failed!\n"));
                conn_free(conn);
                return NT_STATUS_UNSUCCESSFUL;
        }
 
+       talloc_free(conn->origpath);
+       conn->origpath = talloc_strdup(conn, conn->connectpath);
+       if (conn->origpath == NULL) {
+               conn_free(conn);
+               return NT_STATUS_NO_MEMORY;
+       }
+
        conn->fs_capabilities = SMB_VFS_FS_CAPABILITIES(conn, &conn->ts_res);
+       conn->tcon_done = true;
+       *pconn = talloc_move(ctx, &conn);
+
+       return NT_STATUS_OK;
+}
+
+static int conn_struct_tos_destructor(struct conn_struct_tos *c)
+{
+       if (c->oldcwd_fname != NULL) {
+               vfs_ChDir(c->conn, c->oldcwd_fname);
+               TALLOC_FREE(c->oldcwd_fname);
+       }
+       SMB_VFS_DISCONNECT(c->conn);
+       conn_free(c->conn);
+       return 0;
+}
+
+/********************************************************
+ Fake up a connection struct for the VFS layer, for use in
+ applications (such as the python bindings), that do not want the
+ global working directory changed under them.
+
+ SMB_VFS_CONNECT requires root privileges.
+ This temporary uses become_root() and unbecome_root().
+
+ But further impersonation has to be cone by the caller.
+*********************************************************/
+NTSTATUS create_conn_struct_tos(struct messaging_context *msg,
+                               int snum,
+                               const char *path,
+                               const struct auth_session_info *session_info,
+                               struct conn_struct_tos **_c)
+{
+       struct conn_struct_tos *c = NULL;
+       NTSTATUS status;
+
+       *_c = NULL;
+
+       c = talloc_zero(talloc_tos(), struct conn_struct_tos);
+       if (c == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       become_root();
+       status = create_conn_struct_as_root(c,
+                                           msg,
+                                           &c->conn,
+                                           snum,
+                                           path,
+                                           session_info);
+       unbecome_root();
+       if (!NT_STATUS_IS_OK(status)) {
+               TALLOC_FREE(c);
+               return status;
+       }
+
+       talloc_set_destructor(c, conn_struct_tos_destructor);
+
+       *_c = c;
+       return NT_STATUS_OK;
+}
+
+/********************************************************
+ Fake up a connection struct for the VFS layer.
+ Note: this performs a vfs connect and CHANGES CWD !!!! JRA.
+
+ See also the comment for create_conn_struct_tos() above!
+
+ The CWD change is reverted by the destructor of
+ conn_struct_tos when the current talloc_tos() is destroyed.
+*********************************************************/
+NTSTATUS create_conn_struct_tos_cwd(struct messaging_context *msg,
+                                   int snum,
+                                   const char *path,
+                                   const struct auth_session_info *session_info,
+                                   struct conn_struct_tos **_c)
+{
+       struct conn_struct_tos *c = NULL;
+       struct smb_filename smb_fname_connectpath = {0};
+       NTSTATUS status;
+
+       *_c = NULL;
+
+       status = create_conn_struct_tos(msg,
+                                       snum,
+                                       path,
+                                       session_info,
+                                       &c);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
 
        /*
         * Windows seems to insist on doing trans2getdfsreferral() calls on
@@ -332,29 +501,47 @@ NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
         * user we will fail.... WTF ? JRA.
         */
 
-       oldcwd = vfs_GetWd(ctx, conn);
-       if (oldcwd == NULL) {
-               NTSTATUS status = map_nt_error_from_unix(errno);
+       c->oldcwd_fname = vfs_GetWd(c, c->conn);
+       if (c->oldcwd_fname == NULL) {
+               status = map_nt_error_from_unix(errno);
                DEBUG(3, ("vfs_GetWd failed: %s\n", strerror(errno)));
-               conn_free(conn);
+               TALLOC_FREE(c);
                return status;
        }
 
-       if (vfs_ChDir(conn,conn->connectpath) != 0) {
-               NTSTATUS status = map_nt_error_from_unix(errno);
-               DEBUG(3,("create_conn_struct: Can't ChDir to new conn path %s. "
-                       "Error was %s\n",
-                       conn->connectpath, strerror(errno) ));
-               conn_free(conn);
+       smb_fname_connectpath = (struct smb_filename) {
+               .base_name = c->conn->connectpath
+       };
+
+       if (vfs_ChDir(c->conn, &smb_fname_connectpath) != 0) {
+               status = map_nt_error_from_unix(errno);
+               DBG_NOTICE("Can't ChDir to new conn path %s. "
+                          "Error was %s\n",
+                          c->conn->connectpath, strerror(errno));
+               TALLOC_FREE(c->oldcwd_fname);
+               TALLOC_FREE(c);
                return status;
        }
 
-       *pconn = conn;
-       *poldcwd = oldcwd;
-
+       *_c = c;
        return NT_STATUS_OK;
 }
 
+static void shuffle_strlist(char **list, int count)
+{
+       int i;
+       uint32_t r;
+       char *tmp;
+
+       for (i = count; i > 1; i--) {
+               r = generate_random() % i;
+
+               tmp = list[i-1];
+               list[i-1] = list[r];
+               list[r] = tmp;
+       }
+}
+
 /**********************************************************************
  Parse the contents of a symlink to verify if it is an msdfs referral
  A valid referral is of the form:
@@ -375,6 +562,7 @@ NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
  **********************************************************************/
 
 static bool parse_msdfs_symlink(TALLOC_CTX *ctx,
+                               int snum,
                                const char *target,
                                struct referral **preflist,
                                int *refcount)
@@ -407,6 +595,11 @@ static bool parse_msdfs_symlink(TALLOC_CTX *ctx,
                count++;
        }
 
+       /* shuffle alternate paths */
+       if (lp_msdfs_shuffle_referrals(snum)) {
+               shuffle_strlist(alt_path, count);
+       }
+
        DEBUG(10,("parse_msdfs_symlink: count=%d\n", count));
 
        if (count) {
@@ -459,9 +652,8 @@ static bool parse_msdfs_symlink(TALLOC_CTX *ctx,
 
 static bool is_msdfs_link_internal(TALLOC_CTX *ctx,
                        connection_struct *conn,
-                       const char *path,
-                       char **pp_link_target,
-                       SMB_STRUCT_STAT *sbufp)
+                       struct smb_filename *smb_fname,
+                       char **pp_link_target)
 {
        int referral_len = 0;
 #if defined(HAVE_BROKEN_READLINK)
@@ -471,7 +663,6 @@ static bool is_msdfs_link_internal(TALLOC_CTX *ctx,
 #endif
        size_t bufsize = 0;
        char *link_target = NULL;
-       struct smb_filename smb_fname;
 
        if (pp_link_target) {
                bufsize = 1024;
@@ -485,33 +676,28 @@ static bool is_msdfs_link_internal(TALLOC_CTX *ctx,
                link_target = link_target_buf;
        }
 
-       ZERO_STRUCT(smb_fname);
-       smb_fname.base_name = discard_const_p(char, path);
-
-       if (SMB_VFS_LSTAT(conn, &smb_fname) != 0) {
+       if (SMB_VFS_LSTAT(conn, smb_fname) != 0) {
                DEBUG(5,("is_msdfs_link_read_target: %s does not exist.\n",
-                       path));
+                       smb_fname->base_name));
                goto err;
        }
-       if (!S_ISLNK(smb_fname.st.st_ex_mode)) {
+       if (!S_ISLNK(smb_fname->st.st_ex_mode)) {
                DEBUG(5,("is_msdfs_link_read_target: %s is not a link.\n",
-                                       path));
+                       smb_fname->base_name));
                goto err;
        }
-       if (sbufp != NULL) {
-               *sbufp = smb_fname.st;
-       }
 
-       referral_len = SMB_VFS_READLINK(conn, path, link_target, bufsize - 1);
+       referral_len = SMB_VFS_READLINK(conn, smb_fname,
+                               link_target, bufsize - 1);
        if (referral_len == -1) {
                DEBUG(0,("is_msdfs_link_read_target: Error reading "
                        "msdfs link %s: %s\n",
-                       path, strerror(errno)));
+                       smb_fname->base_name, strerror(errno)));
                goto err;
        }
        link_target[referral_len] = '\0';
 
-       DEBUG(5,("is_msdfs_link_internal: %s -> %s\n",path,
+       DEBUG(5,("is_msdfs_link_internal: %s -> %s\n", smb_fname->base_name,
                                link_target));
 
        if (!strnequal(link_target, "msdfs:", 6)) {
@@ -532,14 +718,12 @@ static bool is_msdfs_link_internal(TALLOC_CTX *ctx,
 **********************************************************************/
 
 bool is_msdfs_link(connection_struct *conn,
-               const char *path,
-               SMB_STRUCT_STAT *sbufp)
+               struct smb_filename *smb_fname)
 {
        return is_msdfs_link_internal(talloc_tos(),
                                        conn,
-                                       path,
-                                       NULL,
-                                       sbufp);
+                                       smb_fname,
+                                       NULL);
 }
 
 /*****************************************************************
@@ -562,7 +746,7 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
                const char *dfspath, /* Incoming complete dfs path */
                const struct dfs_path *pdp, /* Parsed out
                                               server+share+extrapath. */
-               bool search_flag, /* Called from a findfirst ? */
+               uint32_t ucf_flags,
                int *consumedcntp,
                char **pp_targetpath)
 {
@@ -584,7 +768,7 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
         */
 
        status = unix_convert(ctx, conn, pdp->reqpath, &smb_fname,
-                             search_flag ? UCF_ALWAYS_ALLOW_WCARD_LCOMP : 0);
+                             ucf_flags);
 
        if (!NT_STATUS_IS_OK(status)) {
                if (!NT_STATUS_EQUAL(status,
@@ -598,9 +782,11 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
 
        /* Optimization - check if we can redirect the whole path. */
 
-       if (is_msdfs_link_internal(ctx, conn, smb_fname->base_name,
-                                  pp_targetpath, NULL)) {
-               if (search_flag) {
+       if (is_msdfs_link_internal(ctx, conn, smb_fname, pp_targetpath)) {
+               /* XX_ALLOW_WCARD_XXX is called from search functions. */
+               if (ucf_flags &
+                               (UCF_COND_ALLOW_WCARD_LCOMP|
+                                UCF_ALWAYS_ALLOW_WCARD_LCOMP)) {
                        DEBUG(6,("dfs_path_lookup (FindFirst) No redirection "
                                 "for dfs link %s.\n", dfspath));
                        status = NT_STATUS_OK;
@@ -659,8 +845,7 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
                }
 
                if (is_msdfs_link_internal(ctx, conn,
-                                          smb_fname->base_name, pp_targetpath,
-                                          NULL)) {
+                                          smb_fname, pp_targetpath)) {
                        DEBUG(4, ("dfs_path_lookup: Redirecting %s because "
                                  "parent %s is dfs link\n", dfspath,
                                  smb_fname_str_dbg(smb_fname)));
@@ -710,12 +895,14 @@ static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
 static NTSTATUS dfs_redirect(TALLOC_CTX *ctx,
                        connection_struct *conn,
                        const char *path_in,
-                       bool search_wcard_flag,
+                       uint32_t ucf_flags,
                        bool allow_broken_path,
                        char **pp_path_out,
                        bool *ppath_contains_wcard)
 {
        NTSTATUS status;
+       bool search_wcard_flag = (ucf_flags &
+               (UCF_COND_ALLOW_WCARD_LCOMP|UCF_ALWAYS_ALLOW_WCARD_LCOMP));
        struct dfs_path *pdp = talloc(ctx, struct dfs_path);
 
        if (!pdp) {
@@ -764,9 +951,9 @@ static NTSTATUS dfs_redirect(TALLOC_CTX *ctx,
                return NT_STATUS_OK;
        }
 
-       if (!( strequal(pdp->servicename, lp_servicename(SNUM(conn)))
+       if (!( strequal(pdp->servicename, lp_servicename(talloc_tos(), SNUM(conn)))
                        || (strequal(pdp->servicename, HOMES_NAME)
-                       && strequal(lp_servicename(SNUM(conn)),
+                       && strequal(lp_servicename(talloc_tos(), SNUM(conn)),
                                conn->session_info->unix_info->sanitized_username) )) ) {
 
                /* The given sharename doesn't match this connection. */
@@ -776,7 +963,7 @@ static NTSTATUS dfs_redirect(TALLOC_CTX *ctx,
        }
 
        status = dfs_path_lookup(ctx, conn, path_in, pdp,
-                       search_wcard_flag, NULL, NULL);
+                                ucf_flags, NULL, NULL);
        if (!NT_STATUS_IS_OK(status)) {
                if (NT_STATUS_EQUAL(status, NT_STATUS_PATH_NOT_COVERED)) {
                        DEBUG(3,("dfs_redirect: Redirecting %s\n", path_in));
@@ -825,6 +1012,7 @@ static NTSTATUS self_ref(TALLOC_CTX *ctx,
 
        ref->alternate_path = talloc_strdup(ctx, dfs_path);
        if (!ref->alternate_path) {
+               TALLOC_FREE(ref);
                return NT_STATUS_NO_MEMORY;
        }
        ref->proximity = 0;
@@ -840,36 +1028,41 @@ static NTSTATUS self_ref(TALLOC_CTX *ctx,
 **********************************************************************/
 
 NTSTATUS get_referred_path(TALLOC_CTX *ctx,
-                       const char *dfs_path,
-                       struct smbd_server_connection *sconn,
-                       struct junction_map *jucn,
-                       int *consumedcntp,
-                       bool *self_referralp)
+                          const char *dfs_path,
+                          const struct tsocket_address *remote_address,
+                          const struct tsocket_address *local_address,
+                          bool allow_broken_path,
+                          struct junction_map *jucn,
+                          int *consumedcntp,
+                          bool *self_referralp)
 {
-       struct connection_struct *conn;
+       TALLOC_CTX *frame = talloc_stackframe();
+       struct conn_struct_tos *c = NULL;
+       struct connection_struct *conn = NULL;
        char *targetpath = NULL;
        int snum;
        NTSTATUS status = NT_STATUS_NOT_FOUND;
        bool dummy;
-       struct dfs_path *pdp = talloc(ctx, struct dfs_path);
-       char *oldpath;
+       struct dfs_path *pdp = talloc_zero(frame, struct dfs_path);
 
        if (!pdp) {
+               TALLOC_FREE(frame);
                return NT_STATUS_NO_MEMORY;
        }
 
        *self_referralp = False;
 
-       status = parse_dfs_path(NULL, dfs_path, False, !sconn->using_smb2,
+       status = parse_dfs_path(NULL, dfs_path, False, allow_broken_path,
                                pdp, &dummy);
        if (!NT_STATUS_IS_OK(status)) {
+               TALLOC_FREE(frame);
                return status;
        }
 
        jucn->service_name = talloc_strdup(ctx, pdp->servicename);
        jucn->volume_name = talloc_strdup(ctx, pdp->reqpath);
        if (!jucn->service_name || !jucn->volume_name) {
-               TALLOC_FREE(pdp);
+               TALLOC_FREE(frame);
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -878,24 +1071,26 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
        if(snum < 0) {
                char *service_name = NULL;
                if ((snum = find_service(ctx, jucn->service_name, &service_name)) < 0) {
+                       TALLOC_FREE(frame);
                        return NT_STATUS_NOT_FOUND;
                }
                if (!service_name) {
+                       TALLOC_FREE(frame);
                        return NT_STATUS_NO_MEMORY;
                }
                TALLOC_FREE(jucn->service_name);
                jucn->service_name = talloc_strdup(ctx, service_name);
                if (!jucn->service_name) {
-                       TALLOC_FREE(pdp);
+                       TALLOC_FREE(frame);
                        return NT_STATUS_NO_MEMORY;
                }
        }
 
-       if (!lp_msdfs_root(snum) && (*lp_msdfs_proxy(snum) == '\0')) {
+       if (!lp_msdfs_root(snum) && (*lp_msdfs_proxy(talloc_tos(), snum) == '\0')) {
                DEBUG(3,("get_referred_path: |%s| in dfs path %s is not "
                        "a dfs root.\n",
                        pdp->servicename, dfs_path));
-               TALLOC_FREE(pdp);
+               TALLOC_FREE(frame);
                return NT_STATUS_NOT_FOUND;
        }
 
@@ -910,9 +1105,10 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
        if (pdp->reqpath[0] == '\0') {
                char *tmp;
                struct referral *ref;
+               int refcount;
 
-               if (*lp_msdfs_proxy(snum) == '\0') {
-                       TALLOC_FREE(pdp);
+               if (*lp_msdfs_proxy(talloc_tos(), snum) == '\0') {
+                       TALLOC_FREE(frame);
                        return self_ref(ctx,
                                        dfs_path,
                                        jucn,
@@ -925,66 +1121,85 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
                 * the configured target share.
                 */
 
-               jucn->referral_count = 1;
-               if ((ref = talloc_zero(ctx, struct referral)) == NULL) {
-                       TALLOC_FREE(pdp);
-                       return NT_STATUS_NO_MEMORY;
-               }
-
-               if (!(tmp = talloc_strdup(ctx, lp_msdfs_proxy(snum)))) {
-                       TALLOC_FREE(pdp);
-                       return NT_STATUS_NO_MEMORY;
-               }
-
-               trim_string(tmp, "\\", 0);
-
-               ref->alternate_path = talloc_asprintf(ctx, "\\%s", tmp);
-               TALLOC_FREE(tmp);
-
-               if (!ref->alternate_path) {
-                       TALLOC_FREE(pdp);
+               tmp = talloc_asprintf(frame, "msdfs:%s",
+                                     lp_msdfs_proxy(frame, snum));
+               if (tmp == NULL) {
+                       TALLOC_FREE(frame);
                        return NT_STATUS_NO_MEMORY;
                }
 
-               if (pdp->reqpath[0] != '\0') {
-                       ref->alternate_path = talloc_asprintf_append(
-                                       ref->alternate_path,
-                                       "%s",
-                                       pdp->reqpath);
-                       if (!ref->alternate_path) {
-                               TALLOC_FREE(pdp);
-                               return NT_STATUS_NO_MEMORY;
-                       }
+               if (!parse_msdfs_symlink(ctx, snum, tmp, &ref, &refcount)) {
+                       TALLOC_FREE(frame);
+                       return NT_STATUS_INVALID_PARAMETER;
                }
-               ref->proximity = 0;
-               ref->ttl = REFERRAL_TTL;
+               jucn->referral_count = refcount;
                jucn->referral_list = ref;
                *consumedcntp = strlen(dfs_path);
-               TALLOC_FREE(pdp);
+               TALLOC_FREE(frame);
                return NT_STATUS_OK;
        }
 
-       status = create_conn_struct(ctx, sconn, &conn, snum,
-                                   lp_pathname(snum), NULL, &oldpath);
+       status = create_conn_struct_tos_cwd(global_messaging_context(),
+                                           snum,
+                                           lp_path(frame, snum),
+                                           NULL,
+                                           &c);
        if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(pdp);
+               TALLOC_FREE(frame);
                return status;
        }
+       conn = c->conn;
+
+       /*
+        * TODO
+        *
+        * The remote and local address should be passed down to
+        * create_conn_struct_cwd.
+        */
+       if (conn->sconn->remote_address == NULL) {
+               conn->sconn->remote_address =
+                       tsocket_address_copy(remote_address, conn->sconn);
+               if (conn->sconn->remote_address == NULL) {
+                       TALLOC_FREE(frame);
+                       return NT_STATUS_NO_MEMORY;
+               }
+       }
+       if (conn->sconn->local_address == NULL) {
+               conn->sconn->local_address =
+                       tsocket_address_copy(local_address, conn->sconn);
+               if (conn->sconn->local_address == NULL) {
+                       TALLOC_FREE(frame);
+                       return NT_STATUS_NO_MEMORY;
+               }
+       }
 
        /* If this is a DFS path dfs_lookup should return
         * NT_STATUS_PATH_NOT_COVERED. */
 
        status = dfs_path_lookup(ctx, conn, dfs_path, pdp,
-                       False, consumedcntp, &targetpath);
+                                0, consumedcntp, &targetpath);
 
        if (!NT_STATUS_EQUAL(status, NT_STATUS_PATH_NOT_COVERED)) {
                DEBUG(3,("get_referred_path: No valid referrals for path %s\n",
                        dfs_path));
+               if (NT_STATUS_IS_OK(status)) {
+                       /*
+                        * We are in an error path here (we
+                        * know it's not a DFS path), but
+                        * dfs_path_lookup() can return
+                        * NT_STATUS_OK. Ensure we always
+                        * return a valid error code.
+                        *
+                        * #9588 - ACLs are not inherited to directories
+                        *         for DFS shares.
+                        */
+                       status = NT_STATUS_NOT_FOUND;
+               }
                goto err_exit;
        }
 
        /* We know this is a valid dfs link. Parse the targetpath. */
-       if (!parse_msdfs_symlink(ctx, targetpath,
+       if (!parse_msdfs_symlink(ctx, snum, targetpath,
                                &jucn->referral_list,
                                &jucn->referral_count)) {
                DEBUG(3,("get_referred_path: failed to parse symlink "
@@ -995,222 +1210,10 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
 
        status = NT_STATUS_OK;
  err_exit:
-       vfs_ChDir(conn, oldpath);
-       SMB_VFS_DISCONNECT(conn);
-       conn_free(conn);
-       TALLOC_FREE(pdp);
+       TALLOC_FREE(frame);
        return status;
 }
 
-static int setup_ver2_dfs_referral(const char *pathname,
-                               char **ppdata,
-                               struct junction_map *junction,
-                               bool self_referral)
-{
-       char* pdata = *ppdata;
-
-       smb_ucs2_t *uni_requestedpath = NULL;
-       int uni_reqpathoffset1,uni_reqpathoffset2;
-       int uni_curroffset;
-       int requestedpathlen=0;
-       int offset;
-       int reply_size = 0;
-       int i=0;
-
-       DEBUG(10,("Setting up version2 referral\nRequested path:\n"));
-
-       requestedpathlen = rpcstr_push_talloc(talloc_tos(),
-                                       &uni_requestedpath, pathname);
-       if (uni_requestedpath == NULL || requestedpathlen == 0) {
-               return -1;
-       }
-
-       if (DEBUGLVL(10)) {
-               dump_data(0, (unsigned char *)uni_requestedpath,
-                       requestedpathlen);
-       }
-
-       DEBUG(10,("ref count = %u\n",junction->referral_count));
-
-       uni_reqpathoffset1 = REFERRAL_HEADER_SIZE +
-                       VERSION2_REFERRAL_SIZE * junction->referral_count;
-
-       uni_reqpathoffset2 = uni_reqpathoffset1 + requestedpathlen;
-
-       uni_curroffset = uni_reqpathoffset2 + requestedpathlen;
-
-       reply_size = REFERRAL_HEADER_SIZE +
-                       VERSION2_REFERRAL_SIZE*junction->referral_count +
-                       2 * requestedpathlen;
-       DEBUG(10,("reply_size: %u\n",reply_size));
-
-       /* add up the unicode lengths of all the referral paths */
-       for(i=0;i<junction->referral_count;i++) {
-               DEBUG(10,("referral %u : %s\n",
-                       i,
-                       junction->referral_list[i].alternate_path));
-               reply_size +=
-                       (strlen(junction->referral_list[i].alternate_path)+1)*2;
-       }
-
-       DEBUG(10,("reply_size = %u\n",reply_size));
-       /* add the unexplained 0x16 bytes */
-       reply_size += 0x16;
-
-       pdata = (char *)SMB_REALLOC(pdata,reply_size);
-       if(pdata == NULL) {
-               DEBUG(0,("Realloc failed!\n"));
-               return -1;
-       }
-       *ppdata = pdata;
-
-       /* copy in the dfs requested paths.. required for offset calculations */
-       memcpy(pdata+uni_reqpathoffset1,uni_requestedpath,requestedpathlen);
-       memcpy(pdata+uni_reqpathoffset2,uni_requestedpath,requestedpathlen);
-
-       /* create the header */
-       SSVAL(pdata,0,requestedpathlen - 2); /* UCS2 of path consumed minus
-                                               2 byte null */
-       /* number of referral in this pkt */
-       SSVAL(pdata,2,junction->referral_count);
-       if(self_referral) {
-               SIVAL(pdata,4,DFSREF_REFERRAL_SERVER | DFSREF_STORAGE_SERVER);
-       } else {
-               SIVAL(pdata,4,DFSREF_STORAGE_SERVER);
-       }
-
-       offset = 8;
-       /* add the referral elements */
-       for(i=0;i<junction->referral_count;i++) {
-               struct referral* ref = &junction->referral_list[i];
-               int unilen;
-
-               SSVAL(pdata,offset,2); /* version 2 */
-               SSVAL(pdata,offset+2,VERSION2_REFERRAL_SIZE);
-               if(self_referral) {
-                       SSVAL(pdata,offset+4,1);
-               } else {
-                       SSVAL(pdata,offset+4,0);
-               }
-
-               /* ref_flags :use path_consumed bytes? */
-               SSVAL(pdata,offset+6,0);
-               SIVAL(pdata,offset+8,ref->proximity);
-               SIVAL(pdata,offset+12,ref->ttl);
-
-               SSVAL(pdata,offset+16,uni_reqpathoffset1-offset);
-               SSVAL(pdata,offset+18,uni_reqpathoffset2-offset);
-               /* copy referred path into current offset */
-               unilen = rpcstr_push(pdata+uni_curroffset,
-                                       ref->alternate_path,
-                                       reply_size - uni_curroffset,
-                                       STR_UNICODE);
-
-               SSVAL(pdata,offset+20,uni_curroffset-offset);
-
-               uni_curroffset += unilen;
-               offset += VERSION2_REFERRAL_SIZE;
-       }
-       /* add in the unexplained 22 (0x16) bytes at the end */
-       memset(pdata+uni_curroffset,'\0',0x16);
-       return reply_size;
-}
-
-static int setup_ver3_dfs_referral(const char *pathname,
-                               char **ppdata,
-                               struct junction_map *junction,
-                               bool self_referral)
-{
-       char *pdata = *ppdata;
-
-       smb_ucs2_t *uni_reqpath = NULL;
-       int uni_reqpathoffset1, uni_reqpathoffset2;
-       int uni_curroffset;
-       int reply_size = 0;
-
-       int reqpathlen = 0;
-       int offset,i=0;
-
-       DEBUG(10,("setting up version3 referral\n"));
-
-       reqpathlen = rpcstr_push_talloc(talloc_tos(), &uni_reqpath, pathname);
-       if (uni_reqpath == NULL || reqpathlen == 0) {
-               return -1;
-       }
-
-       if (DEBUGLVL(10)) {
-               dump_data(0, (unsigned char *)uni_reqpath,
-                       reqpathlen);
-       }
-
-       uni_reqpathoffset1 = REFERRAL_HEADER_SIZE +
-                       VERSION3_REFERRAL_SIZE * junction->referral_count;
-       uni_reqpathoffset2 = uni_reqpathoffset1 + reqpathlen;
-       reply_size = uni_curroffset = uni_reqpathoffset2 + reqpathlen;
-
-       for(i=0;i<junction->referral_count;i++) {
-               DEBUG(10,("referral %u : %s\n",
-                       i,
-                       junction->referral_list[i].alternate_path));
-               reply_size +=
-                       (strlen(junction->referral_list[i].alternate_path)+1)*2;
-       }
-
-       pdata = (char *)SMB_REALLOC(pdata,reply_size);
-       if(pdata == NULL) {
-               DEBUG(0,("version3 referral setup:"
-                       "malloc failed for Realloc!\n"));
-               return -1;
-       }
-       *ppdata = pdata;
-
-       /* create the header */
-       SSVAL(pdata,0,reqpathlen - 2); /* UCS2 of path consumed minus
-                                         2 byte null */
-       SSVAL(pdata,2,junction->referral_count); /* number of referral */
-       if(self_referral) {
-               SIVAL(pdata,4,DFSREF_REFERRAL_SERVER | DFSREF_STORAGE_SERVER);
-       } else {
-               SIVAL(pdata,4,DFSREF_STORAGE_SERVER);
-       }
-
-       /* copy in the reqpaths */
-       memcpy(pdata+uni_reqpathoffset1,uni_reqpath,reqpathlen);
-       memcpy(pdata+uni_reqpathoffset2,uni_reqpath,reqpathlen);
-
-       offset = 8;
-       for(i=0;i<junction->referral_count;i++) {
-               struct referral* ref = &(junction->referral_list[i]);
-               int unilen;
-
-               SSVAL(pdata,offset,3); /* version 3 */
-               SSVAL(pdata,offset+2,VERSION3_REFERRAL_SIZE);
-               if(self_referral) {
-                       SSVAL(pdata,offset+4,1);
-               } else {
-                       SSVAL(pdata,offset+4,0);
-               }
-
-               /* ref_flags :use path_consumed bytes? */
-               SSVAL(pdata,offset+6,0);
-               SIVAL(pdata,offset+8,ref->ttl);
-
-               SSVAL(pdata,offset+12,uni_reqpathoffset1-offset);
-               SSVAL(pdata,offset+14,uni_reqpathoffset2-offset);
-               /* copy referred path into current offset */
-               unilen = rpcstr_push(pdata+uni_curroffset,ref->alternate_path,
-                                       reply_size - uni_curroffset,
-                                       STR_UNICODE | STR_TERMINATE);
-               SSVAL(pdata,offset+16,uni_curroffset-offset);
-               /* copy 0x10 bytes of 00's in the ServiceSite GUID */
-               memset(pdata+offset+18,'\0',16);
-
-               uni_curroffset += unilen;
-               offset += VERSION3_REFERRAL_SIZE;
-       }
-       return reply_size;
-}
-
 /******************************************************************
  Set up the DFS referral for the dfs pathname. This call returns
  the amount of the path covered by this server, and where the
@@ -1223,110 +1226,55 @@ int setup_dfs_referral(connection_struct *orig_conn,
                        int max_referral_level,
                        char **ppdata, NTSTATUS *pstatus)
 {
-       struct junction_map *junction = NULL;
-       int consumedcnt = 0;
-       bool self_referral = False;
+       char *pdata = *ppdata;
        int reply_size = 0;
-       char *pathnamep = NULL;
-       char *local_dfs_path = NULL;
-       TALLOC_CTX *ctx;
+       struct dfs_GetDFSReferral *r;
+       DATA_BLOB blob = data_blob_null;
+       NTSTATUS status;
+       enum ndr_err_code ndr_err;
 
-       if (!(ctx=talloc_init("setup_dfs_referral"))) {
+       r = talloc_zero(talloc_tos(), struct dfs_GetDFSReferral);
+       if (r == NULL) {
                *pstatus = NT_STATUS_NO_MEMORY;
                return -1;
        }
 
-       /* get the junction entry */
-       if (!dfs_path) {
-               talloc_destroy(ctx);
-               *pstatus = NT_STATUS_NOT_FOUND;
-               return -1;
-       }
-
-       /*
-        * Trim pathname sent by client so it begins with only one backslash.
-        * Two backslashes confuse some dfs clients
-        */
-
-       local_dfs_path = talloc_strdup(ctx,dfs_path);
-       if (!local_dfs_path) {
+       r->in.req.max_referral_level = max_referral_level;
+       r->in.req.servername = talloc_strdup(r, dfs_path);
+       if (r->in.req.servername == NULL) {
+               talloc_free(r);
                *pstatus = NT_STATUS_NO_MEMORY;
-               talloc_destroy(ctx);
                return -1;
        }
-       pathnamep = local_dfs_path;
-       while (IS_DIRECTORY_SEP(pathnamep[0]) &&
-                       IS_DIRECTORY_SEP(pathnamep[1])) {
-               pathnamep++;
-       }
 
-       junction = talloc_zero(ctx, struct junction_map);
-       if (!junction) {
-               *pstatus = NT_STATUS_NO_MEMORY;
-               talloc_destroy(ctx);
+       status = SMB_VFS_GET_DFS_REFERRALS(orig_conn, r);
+       if (!NT_STATUS_IS_OK(status)) {
+               talloc_free(r);
+               *pstatus = status;
                return -1;
        }
 
-       /* The following call can change cwd. */
-       *pstatus = get_referred_path(ctx, pathnamep, orig_conn->sconn,
-                                    junction, &consumedcnt, &self_referral);
-       if (!NT_STATUS_IS_OK(*pstatus)) {
-               vfs_ChDir(orig_conn,orig_conn->connectpath);
-               talloc_destroy(ctx);
+       ndr_err = ndr_push_struct_blob(&blob, r,
+                               r->out.resp,
+                               (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               TALLOC_FREE(r);
+               *pstatus = NT_STATUS_INVALID_PARAMETER;
                return -1;
        }
-       vfs_ChDir(orig_conn,orig_conn->connectpath);
-
-       if (!self_referral) {
-               pathnamep[consumedcnt] = '\0';
 
-               if( DEBUGLVL( 3 ) ) {
-                       int i=0;
-                       dbgtext("setup_dfs_referral: Path %s to "
-                               "alternate path(s):",
-                               pathnamep);
-                       for(i=0;i<junction->referral_count;i++)
-                               dbgtext(" %s",
-                               junction->referral_list[i].alternate_path);
-                       dbgtext(".\n");
-               }
-       }
-
-       /* create the referral depeding on version */
-       DEBUG(10,("max_referral_level :%d\n",max_referral_level));
-
-       if (max_referral_level < 2) {
-               max_referral_level = 2;
-       }
-       if (max_referral_level > 3) {
-               max_referral_level = 3;
-       }
-
-       switch(max_referral_level) {
-       case 2:
-               reply_size = setup_ver2_dfs_referral(pathnamep,
-                                       ppdata, junction,
-                                       self_referral);
-               break;
-       case 3:
-               reply_size = setup_ver3_dfs_referral(pathnamep, ppdata,
-                                       junction, self_referral);
-               break;
-       default:
-               DEBUG(0,("setup_dfs_referral: Invalid dfs referral "
-                       "version: %d\n",
-                       max_referral_level));
-               talloc_destroy(ctx);
-               *pstatus = NT_STATUS_INVALID_LEVEL;
+       pdata = (char *)SMB_REALLOC(pdata, blob.length);
+       if(pdata == NULL) {
+               TALLOC_FREE(r);
+               DEBUG(0,("referral setup:"
+                        "malloc failed for Realloc!\n"));
                return -1;
        }
+       *ppdata = pdata;
+       reply_size = blob.length;
+       memcpy(pdata, blob.data, blob.length);
+       TALLOC_FREE(r);
 
-       if (DEBUGLVL(10)) {
-               DEBUGADD(0,("DFS Referral pdata:\n"));
-               dump_data(0,(uint8 *)*ppdata,reply_size);
-       }
-
-       talloc_destroy(ctx);
        *pstatus = NT_STATUS_OK;
        return reply_size;
 }
@@ -1379,7 +1327,7 @@ bool create_junction(TALLOC_CTX *ctx,
 
        jucn->service_name = talloc_strdup(ctx, pdp->servicename);
        jucn->volume_name = talloc_strdup(ctx, pdp->reqpath);
-       jucn->comment = talloc_strdup(ctx, lp_comment(snum));
+       jucn->comment = lp_comment(ctx, snum);
 
        TALLOC_FREE(pdp);
        if (!jucn->service_name || !jucn->volume_name || ! jucn->comment) {
@@ -1392,48 +1340,56 @@ bool create_junction(TALLOC_CTX *ctx,
  Forms a valid Unix pathname from the junction
  **********************************************************************/
 
-static bool junction_to_local_path(const struct junction_map *jucn,
-                                  char **pp_path_out,
-                                  connection_struct **conn_out,
-                                  char **oldpath)
+static bool junction_to_local_path_tos(const struct junction_map *jucn,
+                                      char **pp_path_out,
+                                      connection_struct **conn_out)
 {
+       struct conn_struct_tos *c = NULL;
        int snum;
+       char *path_out = NULL;
        NTSTATUS status;
 
        snum = lp_servicenumber(jucn->service_name);
        if(snum < 0) {
                return False;
        }
-       status = create_conn_struct(talloc_tos(), smbd_server_conn, conn_out,
-                                   snum, lp_pathname(snum), NULL, oldpath);
+       status = create_conn_struct_tos_cwd(global_messaging_context(),
+                                           snum,
+                                           lp_path(talloc_tos(), snum),
+                                           NULL,
+                                           &c);
        if (!NT_STATUS_IS_OK(status)) {
                return False;
        }
 
-       *pp_path_out = talloc_asprintf(*conn_out,
+       path_out = talloc_asprintf(c,
                        "%s/%s",
-                       lp_pathname(snum),
+                       lp_path(talloc_tos(), snum),
                        jucn->volume_name);
-       if (!*pp_path_out) {
-               vfs_ChDir(*conn_out, *oldpath);
-               SMB_VFS_DISCONNECT(*conn_out);
-               conn_free(*conn_out);
+       if (path_out == NULL) {
+               TALLOC_FREE(c);
                return False;
        }
+       *pp_path_out = path_out;
+       *conn_out = c->conn;
        return True;
 }
 
 bool create_msdfs_link(const struct junction_map *jucn)
 {
+       TALLOC_CTX *frame = talloc_stackframe();
        char *path = NULL;
-       char *cwd;
        char *msdfs_link = NULL;
        connection_struct *conn;
        int i=0;
        bool insert_comma = False;
        bool ret = False;
+       struct smb_filename *smb_fname = NULL;
+       bool ok;
 
-       if(!junction_to_local_path(jucn, &path, &conn, &cwd)) {
+       ok = junction_to_local_path_tos(jucn, &path, &conn);
+       if (!ok) {
+               TALLOC_FREE(frame);
                return False;
        }
 
@@ -1474,26 +1430,24 @@ bool create_msdfs_link(const struct junction_map *jucn)
        DEBUG(5,("create_msdfs_link: Creating new msdfs link: %s -> %s\n",
                path, msdfs_link));
 
-       if(SMB_VFS_SYMLINK(conn, msdfs_link, path) < 0) {
-               if (errno == EEXIST) {
-                       struct smb_filename *smb_fname = NULL;
-                       NTSTATUS status;
-
-                       status = create_synthetic_smb_fname(talloc_tos(), path,
-                                                           NULL, NULL,
-                                                           &smb_fname);
-                       if (!NT_STATUS_IS_OK(status)) {
-                               errno = map_errno_from_nt_status(status);
-                               goto out;
-                       }
+       smb_fname = synthetic_smb_fname(frame,
+                               path,
+                               NULL,
+                               NULL,
+                               0);
+       if (smb_fname == NULL) {
+               errno = ENOMEM;
+               goto out;
+       }
 
+       if(SMB_VFS_SYMLINK(conn, msdfs_link, smb_fname) < 0) {
+               if (errno == EEXIST) {
                        if(SMB_VFS_UNLINK(conn, smb_fname)!=0) {
                                TALLOC_FREE(smb_fname);
                                goto out;
                        }
-                       TALLOC_FREE(smb_fname);
                }
-               if (SMB_VFS_SYMLINK(conn, msdfs_link, path) < 0) {
+               if (SMB_VFS_SYMLINK(conn, msdfs_link, smb_fname) < 0) {
                        DEBUG(1,("create_msdfs_link: symlink failed "
                                 "%s -> %s\nError: %s\n",
                                 path, msdfs_link, strerror(errno)));
@@ -1504,30 +1458,33 @@ bool create_msdfs_link(const struct junction_map *jucn)
        ret = True;
 
 out:
-       vfs_ChDir(conn, cwd);
-       SMB_VFS_DISCONNECT(conn);
-       conn_free(conn);
+       TALLOC_FREE(frame);
        return ret;
 }
 
 bool remove_msdfs_link(const struct junction_map *jucn)
 {
+       TALLOC_CTX *frame = talloc_stackframe();
        char *path = NULL;
-       char *cwd;
        connection_struct *conn;
        bool ret = False;
-       struct smb_filename *smb_fname = NULL;
-       NTSTATUS status;
+       struct smb_filename *smb_fname;
+       bool ok;
 
-       if (!junction_to_local_path(jucn, &path, &conn, &cwd)) {
+       ok = junction_to_local_path_tos(jucn, &path, &conn);
+       if (!ok) {
+               TALLOC_FREE(frame);
                return false;
        }
 
-       status = create_synthetic_smb_fname(talloc_tos(), path,
-                                           NULL, NULL,
-                                           &smb_fname);
-       if (!NT_STATUS_IS_OK(status)) {
-               errno = map_errno_from_nt_status(status);
+       smb_fname = synthetic_smb_fname(frame,
+                                       path,
+                                       NULL,
+                                       NULL,
+                                       0);
+       if (smb_fname == NULL) {
+               TALLOC_FREE(frame);
+               errno = ENOMEM;
                return false;
        }
 
@@ -1535,10 +1492,7 @@ bool remove_msdfs_link(const struct junction_map *jucn)
                ret = True;
        }
 
-       TALLOC_FREE(smb_fname);
-       vfs_ChDir(conn, cwd);
-       SMB_VFS_DISCONNECT(conn);
-       conn_free(conn);
+       TALLOC_FREE(frame);
        return ret;
 }
 
@@ -1548,17 +1502,20 @@ bool remove_msdfs_link(const struct junction_map *jucn)
 
 static int count_dfs_links(TALLOC_CTX *ctx, int snum)
 {
+       TALLOC_CTX *frame = talloc_stackframe();
        size_t cnt = 0;
-       SMB_STRUCT_DIR *dirp = NULL;
+       DIR *dirp = NULL;
        const char *dname = NULL;
        char *talloced = NULL;
-       const char *connect_path = lp_pathname(snum);
-       const char *msdfs_proxy = lp_msdfs_proxy(snum);
-       connection_struct *conn;
+       const char *connect_path = lp_path(frame, snum);
+       const char *msdfs_proxy = lp_msdfs_proxy(frame, snum);
+       struct conn_struct_tos *c = NULL;
+       connection_struct *conn = NULL;
        NTSTATUS status;
-       char *cwd;
+       struct smb_filename *smb_fname = NULL;
 
        if(*connect_path == '\0') {
+               TALLOC_FREE(frame);
                return 0;
        }
 
@@ -1566,13 +1523,18 @@ static int count_dfs_links(TALLOC_CTX *ctx, int snum)
         * Fake up a connection struct for the VFS layer.
         */
 
-       status = create_conn_struct(talloc_tos(), smbd_server_conn, &conn,
-                                   snum, connect_path, NULL, &cwd);
+       status = create_conn_struct_tos_cwd(global_messaging_context(),
+                                           snum,
+                                           connect_path,
+                                           NULL,
+                                           &c);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(3, ("create_conn_struct failed: %s\n",
                          nt_errstr(status)));
+               TALLOC_FREE(frame);
                return 0;
        }
+       conn = c->conn;
 
        /* Count a link for the msdfs root - convention */
        cnt = 1;
@@ -1582,28 +1544,43 @@ static int count_dfs_links(TALLOC_CTX *ctx, int snum)
                goto out;
        }
 
+       smb_fname = synthetic_smb_fname(frame,
+                                       ".",
+                                       NULL,
+                                       NULL,
+                                       0);
+       if (smb_fname == NULL) {
+               goto out;
+       }
+
        /* Now enumerate all dfs links */
-       dirp = SMB_VFS_OPENDIR(conn, ".", NULL, 0);
+       dirp = SMB_VFS_OPENDIR(conn, smb_fname, NULL, 0);
        if(!dirp) {
                goto out;
        }
 
        while ((dname = vfs_readdirname(conn, dirp, NULL, &talloced))
               != NULL) {
-               if (is_msdfs_link(conn,
-                               dname,
-                               NULL)) {
+               struct smb_filename *smb_dname =
+                       synthetic_smb_fname(frame,
+                                       dname,
+                                       NULL,
+                                       NULL,
+                                       0);
+               if (smb_dname == NULL) {
+                       goto out;
+               }
+               if (is_msdfs_link(conn, smb_dname)) {
                        cnt++;
                }
                TALLOC_FREE(talloced);
+               TALLOC_FREE(smb_dname);
        }
 
        SMB_VFS_CLOSEDIR(conn,dirp);
 
 out:
-       vfs_ChDir(conn, cwd);
-       SMB_VFS_DISCONNECT(conn);
-       conn_free(conn);
+       TALLOC_FREE(frame);
        return cnt;
 }
 
@@ -1615,23 +1592,27 @@ static int form_junctions(TALLOC_CTX *ctx,
                                struct junction_map *jucn,
                                size_t jn_remain)
 {
+       TALLOC_CTX *frame = talloc_stackframe();
        size_t cnt = 0;
-       SMB_STRUCT_DIR *dirp = NULL;
+       DIR *dirp = NULL;
        const char *dname = NULL;
        char *talloced = NULL;
-       const char *connect_path = lp_pathname(snum);
-       char *service_name = lp_servicename(snum);
-       const char *msdfs_proxy = lp_msdfs_proxy(snum);
-       connection_struct *conn;
+       const char *connect_path = lp_path(frame, snum);
+       char *service_name = lp_servicename(frame, snum);
+       const char *msdfs_proxy = lp_msdfs_proxy(frame, snum);
+       struct conn_struct_tos *c = NULL;
+       connection_struct *conn = NULL;
        struct referral *ref = NULL;
-       char *cwd;
+       struct smb_filename *smb_fname = NULL;
        NTSTATUS status;
 
        if (jn_remain == 0) {
+               TALLOC_FREE(frame);
                return 0;
        }
 
        if(*connect_path == '\0') {
+               TALLOC_FREE(frame);
                return 0;
        }
 
@@ -1639,13 +1620,18 @@ static int form_junctions(TALLOC_CTX *ctx,
         * Fake up a connection struct for the VFS layer.
         */
 
-       status = create_conn_struct(ctx, smbd_server_conn, &conn, snum, connect_path, NULL,
-                                   &cwd);
+       status = create_conn_struct_tos_cwd(global_messaging_context(),
+                                           snum,
+                                           connect_path,
+                                           NULL,
+                                           &c);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(3, ("create_conn_struct failed: %s\n",
                          nt_errstr(status)));
+               TALLOC_FREE(frame);
                return 0;
        }
+       conn = c->conn;
 
        /* form a junction for the msdfs root - convention
           DO NOT REMOVE THIS: NT clients will not work with us
@@ -1686,8 +1672,17 @@ static int form_junctions(TALLOC_CTX *ctx,
                goto out;
        }
 
+       smb_fname = synthetic_smb_fname(frame,
+                                       ".",
+                                       NULL,
+                                       NULL,
+                                       0);
+       if (smb_fname == NULL) {
+               goto out;
+       }
+
        /* Now enumerate all dfs links */
-       dirp = SMB_VFS_OPENDIR(conn, ".", NULL, 0);
+       dirp = SMB_VFS_OPENDIR(conn, smb_fname, NULL, 0);
        if(!dirp) {
                goto out;
        }
@@ -1695,17 +1690,27 @@ static int form_junctions(TALLOC_CTX *ctx,
        while ((dname = vfs_readdirname(conn, dirp, NULL, &talloced))
               != NULL) {
                char *link_target = NULL;
+               struct smb_filename *smb_dname = NULL;
+
                if (cnt >= jn_remain) {
                        DEBUG(2, ("form_junctions: ran out of MSDFS "
                                "junction slots"));
                        TALLOC_FREE(talloced);
                        goto out;
                }
+               smb_dname = synthetic_smb_fname(talloc_tos(),
+                               dname,
+                               NULL,
+                               NULL,
+                               0);
+               if (smb_dname == NULL) {
+                       TALLOC_FREE(talloced);
+                       goto out;
+               }
                if (is_msdfs_link_internal(ctx,
                                        conn,
-                                       dname, &link_target,
-                                       NULL)) {
-                       if (parse_msdfs_symlink(ctx,
+                                       smb_dname, &link_target)) {
+                       if (parse_msdfs_symlink(ctx, snum,
                                        link_target,
                                        &jucn[cnt].referral_list,
                                        &jucn[cnt].referral_count)) {
@@ -1725,6 +1730,7 @@ static int form_junctions(TALLOC_CTX *ctx,
                        TALLOC_FREE(link_target);
                }
                TALLOC_FREE(talloced);
+               TALLOC_FREE(smb_dname);
        }
 
 out:
@@ -1733,13 +1739,11 @@ out:
                SMB_VFS_CLOSEDIR(conn,dirp);
        }
 
-       vfs_ChDir(conn, cwd);
-       conn_free(conn);
+       TALLOC_FREE(frame);
        return cnt;
 }
 
-struct junction_map *enum_msdfs_links(struct smbd_server_connection *sconn,
-                                     TALLOC_CTX *ctx, size_t *p_num_jn)
+struct junction_map *enum_msdfs_links(TALLOC_CTX *ctx, size_t *p_num_jn)
 {
        struct junction_map *jn = NULL;
        int i=0;
@@ -1754,7 +1758,7 @@ struct junction_map *enum_msdfs_links(struct smbd_server_connection *sconn,
        /* Ensure all the usershares are loaded. */
        become_root();
        load_registry_shares();
-       sharecount = load_usershare_shares(sconn);
+       sharecount = load_usershare_shares(NULL, connections_snum_used);
        unbecome_root();
 
        for(i=0;i < sharecount;i++) {
@@ -1790,34 +1794,27 @@ struct junction_map *enum_msdfs_links(struct smbd_server_connection *sconn,
 
 NTSTATUS resolve_dfspath_wcard(TALLOC_CTX *ctx,
                                connection_struct *conn,
-                               bool dfs_pathnames,
                                const char *name_in,
-                               bool allow_wcards,
+                               uint32_t ucf_flags,
+                               bool allow_broken_path,
                                char **pp_name_out,
                                bool *ppath_contains_wcard)
 {
-       bool path_contains_wcard;
+       bool path_contains_wcard = false;
        NTSTATUS status = NT_STATUS_OK;
 
-       if (dfs_pathnames) {
-               status = dfs_redirect(ctx,
-                                       conn,
-                                       name_in,
-                                       allow_wcards,
-                                       !smbd_server_conn->using_smb2,
-                                       pp_name_out,
-                                       &path_contains_wcard);
-
-               if (NT_STATUS_IS_OK(status) && ppath_contains_wcard != NULL) {
-                       *ppath_contains_wcard = path_contains_wcard;
-               }
-       } else {
-               /*
-                * Cheat and just return a copy of the in ptr.
-                * Once srvstr_get_path() uses talloc it'll
-                * be a talloced ptr anyway.
-                */
-               *pp_name_out = discard_const_p(char, name_in);
+       status = dfs_redirect(ctx,
+                               conn,
+                               name_in,
+                               ucf_flags,
+                               allow_broken_path,
+                               pp_name_out,
+                               &path_contains_wcard);
+
+       if (NT_STATUS_IS_OK(status) &&
+                               ppath_contains_wcard != NULL &&
+                               path_contains_wcard) {
+               *ppath_contains_wcard = path_contains_wcard;
        }
        return status;
 }