TALLOC_FREE happily lives with a NULL ptr. Tim, please check!
[ira/wip.git] / source3 / smbd / reply.c
index ebd85bcd28a9468fbb3e518a7b152a11d683da78..d5ee918b82a69c281c4021f2186c9d291afbddf4 100644 (file)
 */
 
 #include "includes.h"
+#include "smbd/globals.h"
 
-/* look in server.c for some explanation of these variables */
 extern enum protocol_types Protocol;
-extern int max_recv;
-extern uint32 global_client_caps;
-
-extern bool global_encrypted_passwords_negotiated;
 
 /****************************************************************************
  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
@@ -52,11 +48,50 @@ static NTSTATUS check_path_syntax_internal(char *path,
        const char *s = path;
        NTSTATUS ret = NT_STATUS_OK;
        bool start_of_name_component = True;
+       bool stream_started = false;
 
        *p_last_component_contains_wcard = False;
 
        while (*s) {
-               if (IS_PATH_SEP(*s,posix_path)) {
+               if (stream_started) {
+                       switch (*s) {
+                       case '/':
+                       case '\\':
+                               return NT_STATUS_OBJECT_NAME_INVALID;
+                       case ':':
+                               if (s[1] == '\0') {
+                                       return NT_STATUS_OBJECT_NAME_INVALID;
+                               }
+                               if (strchr_m(&s[1], ':')) {
+                                       return NT_STATUS_OBJECT_NAME_INVALID;
+                               }
+                               if (StrCaseCmp(s, ":$DATA") != 0) {
+                                       return NT_STATUS_INVALID_PARAMETER;
+                               }
+                               break;
+                       }
+               }
+
+               if (!posix_path && !stream_started && *s == ':') {
+                       if (*p_last_component_contains_wcard) {
+                               return NT_STATUS_OBJECT_NAME_INVALID;
+                       }
+                       /* Stream names allow more characters than file names.
+                          We're overloading posix_path here to allow a wider
+                          range of characters. If stream_started is true this
+                          is still a Windows path even if posix_path is true.
+                          JRA.
+                       */
+                       stream_started = true;
+                       start_of_name_component = false;
+                       posix_path = true;
+
+                       if (s[1] == '\0') {
+                               return NT_STATUS_OBJECT_NAME_INVALID;
+                       }
+               }
+
+               if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
                        /*
                         * Safe to assume is not the second part of a mb char
                         * as this is handled below.
@@ -119,7 +154,7 @@ static NTSTATUS check_path_syntax_internal(char *path,
 
                if (!(*s & 0x80)) {
                        if (!posix_path) {
-                               if (*s <= 0x1f) {
+                               if (*s <= 0x1f || *s == '|') {
                                        return NT_STATUS_OBJECT_NAME_INVALID;
                                }
                                switch (*s) {
@@ -208,7 +243,7 @@ NTSTATUS check_path_syntax_posix(char *path)
 ****************************************************************************/
 
 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
-                       const char *inbuf,
+                       const char *base_ptr,
                        uint16 smb_flags2,
                        char **pp_dest,
                        const char *src,
@@ -221,8 +256,8 @@ size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 
        *pp_dest = NULL;
 
-       ret = srvstr_pull_talloc(ctx, inbuf, smb_flags2, pp_dest, src, src_len,
-                                flags);
+       ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
+                                src_len, flags);
 
        if (!*pp_dest) {
                *err = NT_STATUS_INVALID_PARAMETER;
@@ -254,7 +289,7 @@ size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 ****************************************************************************/
 
 size_t srvstr_get_path(TALLOC_CTX *ctx,
-                       const char *inbuf,
+                       const char *base_ptr,
                        uint16 smb_flags2,
                        char **pp_dest,
                        const char *src,
@@ -263,7 +298,7 @@ size_t srvstr_get_path(TALLOC_CTX *ctx,
                        NTSTATUS *err)
 {
        bool ignore;
-       return srvstr_get_path_wcard(ctx, inbuf, smb_flags2, pp_dest, src,
+       return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
                                     src_len, flags, err, &ignore);
 }
 
@@ -372,6 +407,95 @@ bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
        return False;
 }
 
+static bool netbios_session_retarget(const char *name, int name_type)
+{
+       char *trim_name;
+       char *trim_name_type;
+       const char *retarget_parm;
+       char *retarget;
+       char *p;
+       int retarget_type = 0x20;
+       int retarget_port = 139;
+       struct sockaddr_storage retarget_addr;
+       struct sockaddr_in *in_addr;
+       bool ret = false;
+       uint8_t outbuf[10];
+
+       if (get_socket_port(smbd_server_fd()) != 139) {
+               return false;
+       }
+
+       trim_name = talloc_strdup(talloc_tos(), name);
+       if (trim_name == NULL) {
+               goto fail;
+       }
+       trim_char(trim_name, ' ', ' ');
+
+       trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
+                                        name_type);
+       if (trim_name_type == NULL) {
+               goto fail;
+       }
+
+       retarget_parm = lp_parm_const_string(-1, "netbios retarget",
+                                            trim_name_type, NULL);
+       if (retarget_parm == NULL) {
+               retarget_parm = lp_parm_const_string(-1, "netbios retarget",
+                                                    trim_name, NULL);
+       }
+       if (retarget_parm == NULL) {
+               goto fail;
+       }
+
+       retarget = talloc_strdup(trim_name, retarget_parm);
+       if (retarget == NULL) {
+               goto fail;
+       }
+
+       DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
+
+       p = strchr(retarget, ':');
+       if (p != NULL) {
+               *p++ = '\0';
+               retarget_port = atoi(p);
+       }
+
+       p = strchr_m(retarget, '#');
+       if (p != NULL) {
+               *p++ = '\0';
+               sscanf(p, "%x", &retarget_type);
+       }
+
+       ret = resolve_name(retarget, &retarget_addr, retarget_type);
+       if (!ret) {
+               DEBUG(10, ("could not resolve %s\n", retarget));
+               goto fail;
+       }
+
+       if (retarget_addr.ss_family != AF_INET) {
+               DEBUG(10, ("Retarget target not an IPv4 addr\n"));
+               goto fail;
+       }
+
+       in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
+
+       _smb_setlen(outbuf, 6);
+       SCVAL(outbuf, 0, 0x84);
+       *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
+       *(uint16_t *)(outbuf+8) = htons(retarget_port);
+
+       if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
+                         NULL)) {
+               exit_server_cleanly("netbios_session_regarget: srv_send_smb "
+                                   "failed.");
+       }
+
+       ret = true;
+ fail:
+       TALLOC_FREE(trim_name);
+       return ret;
+}
+
 /****************************************************************************
  Reply to a (netbios-level) special message.
 ****************************************************************************/
@@ -381,7 +505,7 @@ void reply_special(char *inbuf)
        int msg_type = CVAL(inbuf,0);
        int msg_flags = CVAL(inbuf,1);
        fstring name1,name2;
-       char name_type = 0;
+       char name_type1, name_type2;
 
        /*
         * We only really use 4 bytes of the outbuf, but for the smb_setlen
@@ -390,8 +514,6 @@ void reply_special(char *inbuf)
         */
        char outbuf[smb_size];
 
-       static bool already_got_session = False;
-
        *name1 = *name2 = 0;
 
        memset(outbuf, '\0', sizeof(outbuf));
@@ -412,19 +534,23 @@ void reply_special(char *inbuf)
                        DEBUG(0,("Invalid name length in session request\n"));
                        return;
                }
-               name_extract(inbuf,4,name1);
-               name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
-               DEBUG(2,("netbios connect: name1=%s name2=%s\n",
-                        name1,name2));      
+               name_type1 = name_extract(inbuf,4,name1);
+               name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
+               DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
+                        name1, name_type1, name2, name_type2));
+
+               if (netbios_session_retarget(name1, name_type1)) {
+                       exit_server_cleanly("retargeted client");
+               }
 
                set_local_machine_name(name1, True);
                set_remote_machine_name(name2, True);
 
                DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
                         get_local_machine_name(), get_remote_machine_name(),
-                        name_type));
+                        name_type2));
 
-               if (name_type == 'R') {
+               if (name_type2 == 'R') {
                        /* We are being asked for a pathworks session --- 
                           no thanks! */
                        SCVAL(outbuf, 0,0x83);
@@ -464,7 +590,7 @@ void reply_special(char *inbuf)
        DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
                    msg_type, msg_flags));
 
-       srv_send_smb(smbd_server_fd(), outbuf, false);
+       srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
        return;
 }
 
@@ -568,8 +694,8 @@ void reply_tcon_and_X(struct smb_request *req)
                return;
        }
 
-       passlen = SVAL(req->inbuf,smb_vwv3);
-       tcon_flags = SVAL(req->inbuf,smb_vwv2);
+       passlen = SVAL(req->vwv+3, 0);
+       tcon_flags = SVAL(req->vwv+2, 0);
 
        /* we might have to close an old one */
        if ((tcon_flags & 0x1) && conn) {
@@ -764,8 +890,8 @@ void reply_ioctl(struct smb_request *req)
                return;
        }
 
-       device     = SVAL(req->inbuf,smb_vwv1);
-       function   = SVAL(req->inbuf,smb_vwv2);
+       device     = SVAL(req->vwv+1, 0);
+       function   = SVAL(req->vwv+2, 0);
        ioctl_code = (device << 16) + function;
 
        DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
@@ -792,7 +918,7 @@ void reply_ioctl(struct smb_request *req)
                case IOCTL_QUERY_JOB_INFO:                  
                {
                        files_struct *fsp = file_fsp(
-                               req, SVAL(req->inbuf, smb_vwv0));
+                               req, SVAL(req->vwv+0, 0));
                        if (!fsp) {
                                reply_doserror(req, ERRDOS, ERRbadfid);
                                END_PROFILE(SMBioctl);
@@ -821,10 +947,10 @@ void reply_ioctl(struct smb_request *req)
  Strange checkpath NTSTATUS mapping.
 ****************************************************************************/
 
-static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
+static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
 {
        /* Strange DOS error code semantics only for checkpath... */
-       if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
+       if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
                if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
                        /* We need to map to ERRbadpath */
                        return NT_STATUS_OBJECT_PATH_NOT_FOUND;
@@ -840,8 +966,8 @@ static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
 void reply_checkpath(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
+       struct smb_filename *smb_fname = NULL;
        char *name = NULL;
-       SMB_STRUCT_STAT sbuf;
        NTSTATUS status;
        TALLOC_CTX *ctx = talloc_tos();
 
@@ -851,7 +977,7 @@ void reply_checkpath(struct smb_request *req)
                            STR_TERMINATE, &status);
 
        if (!NT_STATUS_IS_OK(status)) {
-               status = map_checkpath_error((char *)req->inbuf, status);
+               status = map_checkpath_error(req->flags2, status);
                reply_nterror(req, status);
                END_PROFILE(SMBcheckpath);
                return;
@@ -871,9 +997,14 @@ void reply_checkpath(struct smb_request *req)
                goto path_err;
        }
 
-       DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->inbuf,smb_vwv0)));
+       DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
+
+       status = unix_convert(ctx, conn, name, &smb_fname, 0);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto path_err;
+       }
 
-       status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
+       status = get_full_smb_filename(ctx, smb_fname, &name);
        if (!NT_STATUS_IS_OK(status)) {
                goto path_err;
        }
@@ -884,25 +1015,28 @@ void reply_checkpath(struct smb_request *req)
                goto path_err;
        }
 
-       if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
+       if (!VALID_STAT(smb_fname->st) &&
+           (SMB_VFS_STAT(conn, name, &smb_fname->st) != 0)) {
                DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
                status = map_nt_error_from_unix(errno);
                goto path_err;
        }
 
-       if (!S_ISDIR(sbuf.st_mode)) {
+       if (!S_ISDIR(smb_fname->st.st_mode)) {
                reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
                                ERRDOS, ERRbadpath);
-               END_PROFILE(SMBcheckpath);
-               return;
+               goto out;
        }
 
        reply_outbuf(req, 0, 0);
-
+ out:
+       TALLOC_FREE(smb_fname);
        END_PROFILE(SMBcheckpath);
        return;
 
-  path_err:
+ path_err:
+
+       TALLOC_FREE(smb_fname);
 
        END_PROFILE(SMBcheckpath);
 
@@ -911,7 +1045,7 @@ void reply_checkpath(struct smb_request *req)
                one at a time - if a component fails it expects
                ERRbadpath, not ERRbadfile.
        */
-       status = map_checkpath_error((char *)req->inbuf, status);
+       status = map_checkpath_error(req->flags2, status);
        if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
                /*
                 * Windows returns different error codes if
@@ -935,8 +1069,8 @@ void reply_checkpath(struct smb_request *req)
 void reply_getatr(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
+       struct smb_filename *smb_fname = NULL;
        char *fname = NULL;
-       SMB_STRUCT_STAT sbuf;
        int mode=0;
        SMB_OFF_T size=0;
        time_t mtime=0;
@@ -950,8 +1084,7 @@ void reply_getatr(struct smb_request *req)
        p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBgetatr);
-               return;
+               goto out;
        }
 
        status = resolve_dfspath(ctx, conn,
@@ -962,12 +1095,10 @@ void reply_getatr(struct smb_request *req)
                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
                                        ERRSRV, ERRbadpath);
-                       END_PROFILE(SMBgetatr);
-                       return;
+                       goto out;
                }
                reply_nterror(req, status);
-               END_PROFILE(SMBgetatr);
-               return;
+               goto out;
        }
 
        /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
@@ -980,29 +1111,32 @@ void reply_getatr(struct smb_request *req)
                size = 0;
                mtime = 0;
        } else {
-               status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
+               status = unix_convert(ctx, conn, fname, &smb_fname, 0);
                if (!NT_STATUS_IS_OK(status)) {
                        reply_nterror(req, status);
-                       END_PROFILE(SMBgetatr);
-                       return;
+                       goto out;
+               }
+               status = get_full_smb_filename(ctx, smb_fname, &fname);
+               if (!NT_STATUS_IS_OK(status)) {
+                       reply_nterror(req, status);
+                       goto out;
                }
                status = check_name(conn, fname);
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
                        reply_nterror(req, status);
-                       END_PROFILE(SMBgetatr);
-                       return;
+                       goto out;
                }
-               if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
+               if (!VALID_STAT(smb_fname->st) &&
+                   (SMB_VFS_STAT(conn, fname, &smb_fname->st) != 0)) {
                        DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
                        reply_unixerror(req, ERRDOS,ERRbadfile);
-                       END_PROFILE(SMBgetatr);
-                       return;
+                       goto out;
                }
 
-               mode = dos_mode(conn,fname,&sbuf);
-               size = sbuf.st_size;
-               mtime = sbuf.st_mtime;
+               mode = dos_mode(conn, fname, &smb_fname->st);
+               size = smb_fname->st.st_size;
+               mtime = smb_fname->st.st_mtime;
                if (mode & aDIR) {
                        size = 0;
                }
@@ -1025,6 +1159,8 @@ void reply_getatr(struct smb_request *req)
 
        DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
 
+ out:
+       TALLOC_FREE(smb_fname);
        END_PROFILE(SMBgetatr);
        return;
 }
@@ -1035,31 +1171,30 @@ void reply_getatr(struct smb_request *req)
 
 void reply_setatr(struct smb_request *req)
 {
-       struct timespec ts[2];
+       struct smb_file_time ft;
        connection_struct *conn = req->conn;
+       struct smb_filename *smb_fname = NULL;
        char *fname = NULL;
        int mode;
        time_t mtime;
-       SMB_STRUCT_STAT sbuf;
        const char *p;
        NTSTATUS status;
        TALLOC_CTX *ctx = talloc_tos();
 
        START_PROFILE(SMBsetatr);
 
-       ZERO_STRUCT(ts);
+       ZERO_STRUCT(ft);
 
        if (req->wct < 2) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-               return;
+               goto out;
        }
 
        p = (const char *)req->buf + 1;
        p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBsetatr);
-               return;
+               goto out;
        }
 
        status = resolve_dfspath(ctx, conn,
@@ -1070,26 +1205,28 @@ void reply_setatr(struct smb_request *req)
                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
                                        ERRSRV, ERRbadpath);
-                       END_PROFILE(SMBsetatr);
-                       return;
+                       goto out;
                }
                reply_nterror(req, status);
-               END_PROFILE(SMBsetatr);
-               return;
+               goto out;
        }
 
-       status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
+       status = unix_convert(ctx, conn, fname, &smb_fname, 0);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBsetatr);
-               return;
+               goto out;
+       }
+
+       status = get_full_smb_filename(ctx, smb_fname, &fname);
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
+               goto out;
        }
 
        status = check_name(conn, fname);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBsetatr);
-               return;
+               goto out;
        }
 
        if (fname[0] == '.' && fname[1] == '\0') {
@@ -1098,39 +1235,38 @@ void reply_setatr(struct smb_request *req)
                 * condition. Might be moved to somewhere else later -- vl
                 */
                reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-               END_PROFILE(SMBsetatr);
-               return;
+               goto out;
        }
 
-       mode = SVAL(req->inbuf,smb_vwv0);
-       mtime = srv_make_unix_date3(req->inbuf+smb_vwv1);
+       mode = SVAL(req->vwv+0, 0);
+       mtime = srv_make_unix_date3(req->vwv+1);
 
-       ts[1] = convert_time_t_to_timespec(mtime);
+       ft.mtime = convert_time_t_to_timespec(mtime);
        status = smb_set_file_time(conn, NULL, fname,
-                                  &sbuf, ts, true);
+                                  &smb_fname->st, &ft, true);
        if (!NT_STATUS_IS_OK(status)) {
                reply_unixerror(req, ERRDOS, ERRnoaccess);
-               END_PROFILE(SMBsetatr);
-               return;
+               goto out;
        }
 
        if (mode != FILE_ATTRIBUTE_NORMAL) {
-               if (VALID_STAT_OF_DIR(sbuf))
+               if (VALID_STAT_OF_DIR(smb_fname->st))
                        mode |= aDIR;
                else
                        mode &= ~aDIR;
 
-               if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
+               if (file_set_dosmode(conn, fname, mode, &smb_fname->st, NULL,
+                                    false) != 0) {
                        reply_unixerror(req, ERRDOS, ERRnoaccess);
-                       END_PROFILE(SMBsetatr);
-                       return;
+                       goto out;
                }
        }
 
        reply_outbuf(req, 0, 0);
 
        DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
-
+ out:
+       TALLOC_FREE(smb_fname);
        END_PROFILE(SMBsetatr);
        return;
 }
@@ -1227,19 +1363,19 @@ void reply_search(struct smb_request *req)
        }
 
        if (lp_posix_pathnames()) {
-               reply_unknown_new(req, CVAL(req->inbuf, smb_com));
+               reply_unknown_new(req, req->cmd);
                END_PROFILE(SMBsearch);
                return;
        }
 
        /* If we were called as SMBffirst then we must expect close. */
-       if(CVAL(req->inbuf,smb_com) == SMBffirst) {
+       if(req->cmd == SMBffirst) {
                expect_close = True;
        }
 
        reply_outbuf(req, 1, 3);
-       maxentries = SVAL(req->inbuf,smb_vwv0);
-       dirtype = SVAL(req->inbuf,smb_vwv1);
+       maxentries = SVAL(req->vwv+0, 0);
+       dirtype = SVAL(req->vwv+1, 0);
        p = (const char *)req->buf + 1;
        p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
                                       &nt_status, &mask_contains_wcard);
@@ -1273,10 +1409,18 @@ void reply_search(struct smb_request *req)
        /* dirtype &= ~aDIR; */
 
        if (status_len == 0) {
-               SMB_STRUCT_STAT sbuf;
+               struct smb_filename *smb_fname = NULL;
 
-               nt_status = unix_convert(ctx, conn, path, True,
-                               &directory, NULL, &sbuf);
+               nt_status = unix_convert(ctx, conn, path, &smb_fname,
+                                        UCF_ALLOW_WCARD_LCOMP);
+               if (!NT_STATUS_IS_OK(nt_status)) {
+                       reply_nterror(req, nt_status);
+                       END_PROFILE(SMBsearch);
+                       return;
+               }
+
+               nt_status = get_full_smb_filename(ctx, smb_fname, &directory);
+               TALLOC_FREE(smb_fname);
                if (!NT_STATUS_IS_OK(nt_status)) {
                        reply_nterror(req, nt_status);
                        END_PROFILE(SMBsearch);
@@ -1352,6 +1496,9 @@ void reply_search(struct smb_request *req)
 
        DEBUG(4,("dptr_num is %d\n",dptr_num));
 
+       /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
+       dptr_init_search_op(conn->dirptr);
+
        if ((dirtype&0x1F) == aVOLID) {
                char buf[DIR_STRUCT_SIZE];
                memcpy(buf,status,21);
@@ -1443,7 +1590,7 @@ void reply_search(struct smb_request *req)
        }
 
        /* If we were called as SMBfunique, then we can close the dirptr now ! */
-       if(dptr_num >= 0 && CVAL(req->inbuf,smb_com) == SMBfunique) {
+       if(dptr_num >= 0 && req->cmd == SMBfunique) {
                dptr_close(&dptr_num);
        }
 
@@ -1476,7 +1623,7 @@ void reply_search(struct smb_request *req)
        }
 
        DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
-               smb_fn_name(CVAL(req->inbuf,smb_com)),
+               smb_fn_name(req->cmd),
                mask,
                directory ? directory : "./",
                dirtype,
@@ -1505,7 +1652,7 @@ void reply_fclose(struct smb_request *req)
        START_PROFILE(SMBfclose);
 
        if (lp_posix_pathnames()) {
-               reply_unknown_new(req, CVAL(req->inbuf, smb_com));
+               reply_unknown_new(req, req->cmd);
                END_PROFILE(SMBfclose);
                return;
        }
@@ -1570,6 +1717,8 @@ void reply_open(struct smb_request *req)
 
        START_PROFILE(SMBopen);
 
+       SET_STAT_INVALID(sbuf);
+
        if (req->wct < 2) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                END_PROFILE(SMBopen);
@@ -1577,8 +1726,8 @@ void reply_open(struct smb_request *req)
        }
 
        oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
-       deny_mode = SVAL(req->inbuf,smb_vwv0);
-       dos_attr = SVAL(req->inbuf,smb_vwv1);
+       deny_mode = SVAL(req->vwv+0, 0);
+       dos_attr = SVAL(req->vwv+1, 0);
 
        srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
                            STR_TERMINATE, &status);
@@ -1596,22 +1745,24 @@ void reply_open(struct smb_request *req)
                return;
        }
 
-       status = create_file(conn,                      /* conn */
-                            req,                       /* req */
-                            0,                         /* root_dir_fid */
-                            fname,                     /* fname */
-                            access_mask,               /* access_mask */
-                            share_mode,                /* share_access */
-                            create_disposition,        /* create_disposition*/
-                            create_options,            /* create_options */
-                            dos_attr,                  /* file_attributes */
-                            oplock_request,            /* oplock_request */
-                            0,                         /* allocation_size */
-                            NULL,                      /* sd */
-                            NULL,                      /* ea_list */
-                            &fsp,                      /* result */
-                            &info,                     /* pinfo */
-                            &sbuf);                    /* psbuf */
+       status = SMB_VFS_CREATE_FILE(
+               conn,                                   /* conn */
+               req,                                    /* req */
+               0,                                      /* root_dir_fid */
+               fname,                                  /* fname */
+               CFF_DOS_PATH,                           /* create_file_flags */
+               access_mask,                            /* access_mask */
+               share_mode,                             /* share_access */
+               create_disposition,                     /* create_disposition*/
+               create_options,                         /* create_options */
+               dos_attr,                               /* file_attributes */
+               oplock_request,                         /* oplock_request */
+               0,                                      /* allocation_size */
+               NULL,                                   /* sd */
+               NULL,                                   /* ea_list */
+               &fsp,                                   /* result */
+               &info,                                  /* pinfo */
+               &sbuf);                                 /* psbuf */
 
        if (!NT_STATUS_IS_OK(status)) {
                if (open_was_deferred(req->mid)) {
@@ -1677,8 +1828,8 @@ void reply_open_and_X(struct smb_request *req)
        int core_oplock_request;
        int oplock_request;
 #if 0
-       int smb_sattr = SVAL(req->inbuf,smb_vwv4);
-       uint32 smb_time = make_unix_date3(req->inbuf+smb_vwv6);
+       int smb_sattr = SVAL(req->vwv+4, 0);
+       uint32 smb_time = make_unix_date3(req->vwv+6);
 #endif
        int smb_ofun;
        uint32 fattr=0;
@@ -1703,14 +1854,16 @@ void reply_open_and_X(struct smb_request *req)
                return;
        }
 
-       open_flags = SVAL(req->inbuf,smb_vwv2);
-       deny_mode = SVAL(req->inbuf,smb_vwv3);
-       smb_attr = SVAL(req->inbuf,smb_vwv5);
+       SET_STAT_INVALID(sbuf);
+
+       open_flags = SVAL(req->vwv+2, 0);
+       deny_mode = SVAL(req->vwv+3, 0);
+       smb_attr = SVAL(req->vwv+5, 0);
        ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
        core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
        oplock_request = ex_oplock_request | core_oplock_request;
-       smb_ofun = SVAL(req->inbuf,smb_vwv8);
-       allocation_size = (uint64_t)IVAL(req->inbuf,smb_vwv9);
+       smb_ofun = SVAL(req->vwv+8, 0);
+       allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
 
        /* If it's an IPC, pass off the pipe handler. */
        if (IS_IPC(conn)) {
@@ -1740,22 +1893,24 @@ void reply_open_and_X(struct smb_request *req)
                return;
        }
 
-       status = create_file(conn,                      /* conn */
-                            req,                       /* req */
-                            0,                         /* root_dir_fid */
-                            fname,                     /* fname */
-                            access_mask,               /* access_mask */
-                            share_mode,                /* share_access */
-                            create_disposition,        /* create_disposition*/
-                            create_options,            /* create_options */
-                            smb_attr,                  /* file_attributes */
-                            oplock_request,            /* oplock_request */
-                            0,                         /* allocation_size */
-                            NULL,                      /* sd */
-                            NULL,                      /* ea_list */
-                            &fsp,                      /* result */
-                            &smb_action,               /* pinfo */
-                            &sbuf);                    /* psbuf */
+       status = SMB_VFS_CREATE_FILE(
+               conn,                                   /* conn */
+               req,                                    /* req */
+               0,                                      /* root_dir_fid */
+               fname,                                  /* fname */
+               CFF_DOS_PATH,                           /* create_file_flags */
+               access_mask,                            /* access_mask */
+               share_mode,                             /* share_access */
+               create_disposition,                     /* create_disposition*/
+               create_options,                         /* create_options */
+               smb_attr,                               /* file_attributes */
+               oplock_request,                         /* oplock_request */
+               0,                                      /* allocation_size */
+               NULL,                                   /* sd */
+               NULL,                                   /* ea_list */
+               &fsp,                                   /* result */
+               &smb_action,                            /* pinfo */
+               &sbuf);                                 /* psbuf */
 
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopenX);
@@ -1784,7 +1939,7 @@ void reply_open_and_X(struct smb_request *req)
                        END_PROFILE(SMBopenX);
                        return;
                }
-               sbuf.st_size = get_allocation_size(conn,fsp,&sbuf);
+               sbuf.st_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp,&sbuf);
        }
 
        fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
@@ -1891,9 +2046,8 @@ void reply_mknew(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
        char *fname = NULL;
-       int com;
        uint32 fattr = 0;
-       struct timespec ts[2];
+       struct smb_file_time ft;
        files_struct *fsp;
        int oplock_request = 0;
        SMB_STRUCT_STAT sbuf;
@@ -1905,6 +2059,8 @@ void reply_mknew(struct smb_request *req)
        TALLOC_CTX *ctx = talloc_tos();
 
        START_PROFILE(SMBcreate);
+       ZERO_STRUCT(ft);
+       SET_STAT_INVALID(sbuf);
 
         if (req->wct < 3) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -1912,13 +2068,11 @@ void reply_mknew(struct smb_request *req)
                return;
        }
 
-       fattr = SVAL(req->inbuf,smb_vwv0);
+       fattr = SVAL(req->vwv+0, 0);
        oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
-       com = SVAL(req->inbuf,smb_com);
 
-       ts[1] =convert_time_t_to_timespec(
-                       srv_make_unix_date3(req->inbuf + smb_vwv1));
-                       /* mtime. */
+       /* mtime. */
+       ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
 
        srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
                            STR_TERMINATE, &status);
@@ -1933,7 +2087,7 @@ void reply_mknew(struct smb_request *req)
                        "please report this\n", fname));
        }
 
-       if(com == SMBmknew) {
+       if(req->cmd == SMBmknew) {
                /* We should fail if file exists. */
                create_disposition = FILE_CREATE;
        } else {
@@ -1941,22 +2095,24 @@ void reply_mknew(struct smb_request *req)
                create_disposition = FILE_OVERWRITE_IF;
        }
 
-       status = create_file(conn,                      /* conn */
-                            req,                       /* req */
-                            0,                         /* root_dir_fid */
-                            fname,                     /* fname */
-                            access_mask,               /* access_mask */
-                            share_mode,                /* share_access */
-                            create_disposition,        /* create_disposition*/
-                            create_options,            /* create_options */
-                            fattr,                     /* file_attributes */
-                            oplock_request,            /* oplock_request */
-                            0,                         /* allocation_size */
-                            NULL,                      /* sd */
-                            NULL,                      /* ea_list */
-                            &fsp,                      /* result */
-                            NULL,                      /* pinfo */
-                            &sbuf);                    /* psbuf */
+       status = SMB_VFS_CREATE_FILE(
+               conn,                                   /* conn */
+               req,                                    /* req */
+               0,                                      /* root_dir_fid */
+               fname,                                  /* fname */
+               CFF_DOS_PATH,                           /* create_file_flags */
+               access_mask,                            /* access_mask */
+               share_mode,                             /* share_access */
+               create_disposition,                     /* create_disposition*/
+               create_options,                         /* create_options */
+               fattr,                                  /* file_attributes */
+               oplock_request,                         /* oplock_request */
+               0,                                      /* allocation_size */
+               NULL,                                   /* sd */
+               NULL,                                   /* ea_list */
+               &fsp,                                   /* result */
+               NULL,                                   /* pinfo */
+               &sbuf);                                 /* psbuf */
 
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcreate);
@@ -1968,8 +2124,8 @@ void reply_mknew(struct smb_request *req)
                return;
        }
 
-       ts[0] = get_atimespec(&sbuf); /* atime. */
-       status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, ts, true);
+       ft.atime = get_atimespec(&sbuf); /* atime. */
+       status = smb_set_file_time(conn, fsp, fsp->fsp_name, &sbuf, &ft, true);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcreate);
                reply_openerror(req, status);
@@ -2004,12 +2160,12 @@ void reply_mknew(struct smb_request *req)
 void reply_ctemp(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
+       struct smb_filename *smb_fname = NULL;
        char *fname = NULL;
        uint32 fattr;
        files_struct *fsp;
        int oplock_request;
        int tmpfd;
-       SMB_STRUCT_STAT sbuf;
        char *s;
        NTSTATUS status;
        TALLOC_CTX *ctx = talloc_tos();
@@ -2018,19 +2174,17 @@ void reply_ctemp(struct smb_request *req)
 
        if (req->wct < 3) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-               END_PROFILE(SMBctemp);
-               return;
+               goto out;
        }
 
-       fattr = SVAL(req->inbuf,smb_vwv0);
+       fattr = SVAL(req->vwv+0, 0);
        oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
 
        srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
                            STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBctemp);
-               return;
+               goto out;
        }
        if (*fname) {
                fname = talloc_asprintf(ctx,
@@ -2042,8 +2196,7 @@ void reply_ctemp(struct smb_request *req)
 
        if (!fname) {
                reply_nterror(req, NT_STATUS_NO_MEMORY);
-               END_PROFILE(SMBctemp);
-               return;
+               goto out;
        }
 
        status = resolve_dfspath(ctx, conn,
@@ -2054,59 +2207,69 @@ void reply_ctemp(struct smb_request *req)
                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
                                        ERRSRV, ERRbadpath);
-                       END_PROFILE(SMBctemp);
-                       return;
+                       goto out;
                }
                reply_nterror(req, status);
-               END_PROFILE(SMBctemp);
-               return;
+               goto out;
        }
 
-       status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
+       status = unix_convert(ctx, conn, fname, &smb_fname, 0);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBctemp);
-               return;
+               goto out;
+       }
+
+       status = get_full_smb_filename(ctx, smb_fname, &fname);
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
+               goto out;
        }
 
        status = check_name(conn, fname);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBctemp);
-               return;
+               goto out;
        }
 
-       tmpfd = smb_mkstemp(fname);
+       tmpfd = mkstemp(fname);
        if (tmpfd == -1) {
                reply_unixerror(req, ERRDOS, ERRnoaccess);
-               END_PROFILE(SMBctemp);
-               return;
+               goto out;
        }
 
-       SMB_VFS_STAT(conn,fname,&sbuf);
+       SET_STAT_INVALID(smb_fname->st);
+       SMB_VFS_STAT(conn, fname, &smb_fname->st);
 
        /* We should fail if file does not exist. */
-       status = open_file_ntcreate(conn, req, fname, &sbuf,
-                               FILE_GENERIC_READ | FILE_GENERIC_WRITE,
-                               FILE_SHARE_READ|FILE_SHARE_WRITE,
-                               FILE_OPEN,
-                               0,
-                               fattr,
-                               oplock_request,
-                               NULL, &fsp);
-
-       /* close fd from smb_mkstemp() */
+       status = SMB_VFS_CREATE_FILE(
+               conn,                                   /* conn */
+               req,                                    /* req */
+               0,                                      /* root_dir_fid */
+               fname,                                  /* fname */
+               0,                                      /* create_file_flags */
+               FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
+               FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
+               FILE_OPEN,                              /* create_disposition*/
+               0,                                      /* create_options */
+               fattr,                                  /* file_attributes */
+               oplock_request,                         /* oplock_request */
+               0,                                      /* allocation_size */
+               NULL,                                   /* sd */
+               NULL,                                   /* ea_list */
+               &fsp,                                   /* result */
+               NULL,                                   /* pinfo */
+               &smb_fname->st);                        /* psbuf */
+
+       /* close fd from mkstemp() */
        close(tmpfd);
 
        if (!NT_STATUS_IS_OK(status)) {
                if (open_was_deferred(req->mid)) {
                        /* We have re-scheduled this call. */
-                       END_PROFILE(SMBctemp);
-                       return;
+                       goto out;
                }
                reply_openerror(req, status);
-               END_PROFILE(SMBctemp);
-               return;
+               goto out;
        }
 
        reply_outbuf(req, 1, 0);
@@ -2128,8 +2291,7 @@ void reply_ctemp(struct smb_request *req)
        if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
            == -1) {
                reply_nterror(req, NT_STATUS_NO_MEMORY);
-               END_PROFILE(SMBctemp);
-               return;
+               goto out;
        }
 
        if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
@@ -2144,8 +2306,9 @@ void reply_ctemp(struct smb_request *req)
 
        DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
        DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
-                   fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
-
+                   fsp->fh->fd, (unsigned int)smb_fname->st.st_mode));
+ out:
+       TALLOC_FREE(smb_fname);
        END_PROFILE(SMBctemp);
        return;
 }
@@ -2169,6 +2332,16 @@ static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
        }
 
        if (S_ISDIR(pst->st_mode)) {
+               if (fsp->posix_open) {
+                       return NT_STATUS_OK;
+               }
+
+               /* If no pathnames are open below this
+                  directory, allow the rename. */
+
+               if (file_find_subpath(fsp)) {
+                       return NT_STATUS_ACCESS_DENIED;
+               }
                return NT_STATUS_OK;
        }
 
@@ -2278,10 +2451,12 @@ static NTSTATUS do_unlink(connection_struct *conn,
        /* On open checks the open itself will check the share mode, so
           don't do it here as we'll get it wrong. */
 
-       status = create_file_unixpath
+       status = SMB_VFS_CREATE_FILE
                (conn,                  /* conn */
                 req,                   /* req */
+                0,                     /* root_dir_fid */
                 fname,                 /* fname */
+                0,                     /* create_file_flags */
                 DELETE_ACCESS,         /* access_mask */
                 FILE_SHARE_NONE,       /* share_access */
                 FILE_OPEN,             /* create_disposition*/
@@ -2296,7 +2471,7 @@ static NTSTATUS do_unlink(connection_struct *conn,
                 &sbuf);                /* psbuf */
 
        if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(10, ("create_file_unixpath failed: %s\n",
+               DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
                           nt_errstr(status)));
                return status;
        }
@@ -2318,17 +2493,25 @@ static NTSTATUS do_unlink(connection_struct *conn,
 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
                          uint32 dirtype, const char *name_in, bool has_wild)
 {
+       struct smb_filename *smb_fname = NULL;
        const char *directory = NULL;
        char *mask = NULL;
        char *name = NULL;
        char *p = NULL;
        int count=0;
        NTSTATUS status = NT_STATUS_OK;
-       SMB_STRUCT_STAT sbuf;
+       SMB_STRUCT_STAT st;
        TALLOC_CTX *ctx = talloc_tos();
 
-       status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
+       status = unix_convert(ctx, conn, name_in, &smb_fname,
+                             has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
+       status = get_full_smb_filename(ctx, smb_fname, &name);
        if (!NT_STATUS_IS_OK(status)) {
+               TALLOC_FREE(smb_fname);
                return status;
        }
 
@@ -2336,6 +2519,7 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
        if (!p) {
                directory = talloc_strdup(ctx, ".");
                if (!directory) {
+                       TALLOC_FREE(smb_fname);
                        return NT_STATUS_NO_MEMORY;
                }
                mask = name;
@@ -2354,7 +2538,7 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
 
-       if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
+       if (!VALID_STAT(smb_fname->st) && mangle_is_mangled(mask,conn->params)) {
                char *new_mask = NULL;
                mangle_lookup_name_from_8_3(ctx,
                                mask,
@@ -2364,6 +2548,7 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
                        mask = new_mask;
                }
        }
+       TALLOC_FREE(smb_fname);
 
        if (!has_wild) {
                directory = talloc_asprintf(ctx,
@@ -2420,11 +2605,12 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
 
                status = NT_STATUS_NO_SUCH_FILE;
 
-               while ((dname = ReadDirName(dir_hnd, &offset))) {
-                       SMB_STRUCT_STAT st;
+               while ((dname = ReadDirName(dir_hnd, &offset, &st))) {
                        char *fname = NULL;
 
-                       if (!is_visible_file(conn, directory, dname, &st, True)) {
+                       if (!is_visible_file(conn, directory, dname, &st,
+                           true))
+                       {
                                continue;
                        }
 
@@ -2493,7 +2679,7 @@ void reply_unlink(struct smb_request *req)
                return;
        }
 
-       dirtype = SVAL(req->inbuf,smb_vwv0);
+       dirtype = SVAL(req->vwv+0, 0);
 
        srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
                                  STR_TERMINATE, &status,
@@ -2595,7 +2781,7 @@ static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
 
                /* If we had a short read, fill with zeros. */
                if (ret < cur_read) {
-                       memset(buf, '\0', cur_read - ret);
+                       memset(buf + ret, '\0', cur_read - ret);
                }
 
                if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
@@ -2610,6 +2796,66 @@ static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
        return (ssize_t)nread;
 }
 
+#if defined(WITH_SENDFILE)
+/****************************************************************************
+ Deal with the case of sendfile reading less bytes from the file than
+ requested. Fill with zeros (all we can do).
+****************************************************************************/
+
+static void sendfile_short_send(files_struct *fsp,
+                               ssize_t nread,
+                               size_t headersize,
+                               size_t smb_maxcnt)
+{
+#define SHORT_SEND_BUFSIZE 1024
+       if (nread < headersize) {
+               DEBUG(0,("sendfile_short_send: sendfile failed to send "
+                       "header for file %s (%s). Terminating\n",
+                       fsp->fsp_name, strerror(errno) ));
+               exit_server_cleanly("sendfile_short_send failed");
+       }
+
+       nread -= headersize;
+
+       if (nread < smb_maxcnt) {
+               char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
+               if (!buf) {
+                       exit_server_cleanly("sendfile_short_send: "
+                               "malloc failed");
+               }
+
+               DEBUG(0,("sendfile_short_send: filling truncated file %s "
+                       "with zeros !\n", fsp->fsp_name));
+
+               while (nread < smb_maxcnt) {
+                       /*
+                        * We asked for the real file size and told sendfile
+                        * to not go beyond the end of the file. But it can
+                        * happen that in between our fstat call and the
+                        * sendfile call the file was truncated. This is very
+                        * bad because we have already announced the larger
+                        * number of bytes to the client.
+                        *
+                        * The best we can do now is to send 0-bytes, just as
+                        * a read from a hole in a sparse file would do.
+                        *
+                        * This should happen rarely enough that I don't care
+                        * about efficiency here :-)
+                        */
+                       size_t to_write;
+
+                       to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
+                       if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
+                               exit_server_cleanly("sendfile_short_send: "
+                                       "write_data failed");
+                       }
+                       nread += to_write;
+               }
+               SAFE_FREE(buf);
+       }
+}
+#endif /* defined WITH_SENDFILE */
+
 /****************************************************************************
  Return a readbraw error (4 bytes of zero).
 ****************************************************************************/
@@ -2627,11 +2873,12 @@ static void reply_readbraw_error(void)
  Use sendfile in readbraw.
 ****************************************************************************/
 
-void send_file_readbraw(connection_struct *conn,
-                       files_struct *fsp,
-                       SMB_OFF_T startpos,
-                       size_t nread,
-                       ssize_t mincount)
+static void send_file_readbraw(connection_struct *conn,
+                              struct smb_request *req,
+                              files_struct *fsp,
+                              SMB_OFF_T startpos,
+                              size_t nread,
+                              ssize_t mincount)
 {
        char *outbuf = NULL;
        ssize_t ret=0;
@@ -2644,16 +2891,18 @@ void send_file_readbraw(connection_struct *conn,
         * reply_readbraw has already checked the length.
         */
 
-       if ( (chain_size == 0) && (nread > 0) && (fsp->base_fsp == NULL) &&
-           (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
+       if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
+           (fsp->wcp == NULL) &&
+           lp_use_sendfile(SNUM(conn), smbd_server_conn->signing_state) ) {
+               ssize_t sendfile_read = -1;
                char header[4];
                DATA_BLOB header_blob;
 
                _smb_setlen(header,nread);
                header_blob = data_blob_const(header, 4);
 
-               if (SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
-                               &header_blob, startpos, nread) == -1) {
+               if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
+                               &header_blob, startpos, nread)) == -1) {
                        /* Returning ENOSYS means no data at all was sent.
                         * Do this as a normal read. */
                        if (errno == ENOSYS) {
@@ -2681,13 +2930,29 @@ void send_file_readbraw(connection_struct *conn,
                        DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
                                fsp->fsp_name, strerror(errno) ));
                        exit_server_cleanly("send_file_readbraw sendfile failed");
+               } else if (sendfile_read == 0) {
+                       /*
+                        * Some sendfile implementations return 0 to indicate
+                        * that there was a short read, but nothing was
+                        * actually written to the socket.  In this case,
+                        * fallback to the normal read path so the header gets
+                        * the correct byte count.
+                        */
+                       DEBUG(3, ("send_file_readbraw: sendfile sent zero "
+                                 "bytes falling back to the normal read: "
+                                 "%s\n", fsp->fsp_name));
+                       goto normal_readbraw;
                }
 
+               /* Deal with possible short send. */
+               if (sendfile_read != 4+nread) {
+                       sendfile_short_send(fsp, sendfile_read, 4, nread);
+               }
                return;
        }
-#endif
 
 normal_readbraw:
+#endif
 
        outbuf = TALLOC_ARRAY(NULL, char, nread+4);
        if (!outbuf) {
@@ -2726,12 +2991,14 @@ void reply_readbraw(struct smb_request *req)
        size_t nread = 0;
        SMB_OFF_T startpos;
        files_struct *fsp;
+       struct lock_struct lock;
        SMB_STRUCT_STAT st;
        SMB_OFF_T size = 0;
 
        START_PROFILE(SMBreadbraw);
 
-       if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
+       if (srv_is_signing_active(smbd_server_conn) ||
+           is_encrypted_packet(req->inbuf)) {
                exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
                        "raw reads/writes are disallowed.");
        }
@@ -2748,7 +3015,7 @@ void reply_readbraw(struct smb_request *req)
         * return a zero length response here.
         */
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        /*
         * We have to do a check_fsp by hand here, as
@@ -2764,7 +3031,7 @@ void reply_readbraw(struct smb_request *req)
                 */
                DEBUG(3,("reply_readbraw: fnum %d not valid "
                        "- cache prime?\n",
-                       (int)SVAL(req->inbuf,smb_vwv0)));
+                       (int)SVAL(req->vwv+0, 0)));
                reply_readbraw_error();
                END_PROFILE(SMBreadbraw);
                return;
@@ -2775,7 +3042,7 @@ void reply_readbraw(struct smb_request *req)
                        ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
                                (fsp->access_mask & FILE_EXECUTE)))) {
                DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
-                               (int)SVAL(req->inbuf,smb_vwv0)));
+                               (int)SVAL(req->vwv+0, 0)));
                reply_readbraw_error();
                END_PROFILE(SMBreadbraw);
                return;
@@ -2783,14 +3050,14 @@ void reply_readbraw(struct smb_request *req)
 
        flush_write_cache(fsp, READRAW_FLUSH);
 
-       startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv1);
+       startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
        if(req->wct == 10) {
                /*
                 * This is a large offset (64 bit) read.
                 */
 #ifdef LARGE_SMB_OFF_T
 
-               startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv8)) << 32);
+               startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
 
 #else /* !LARGE_SMB_OFF_T */
 
@@ -2798,11 +3065,11 @@ void reply_readbraw(struct smb_request *req)
                 * Ensure we haven't been sent a >32 bit offset.
                 */
 
-               if(IVAL(req->inbuf,smb_vwv8) != 0) {
+               if(IVAL(req->vwv+8, 0) != 0) {
                        DEBUG(0,("reply_readbraw: large offset "
                                "(%x << 32) used and we don't support "
                                "64 bit offsets.\n",
-                       (unsigned int)IVAL(req->inbuf,smb_vwv8) ));
+                       (unsigned int)IVAL(req->vwv+8, 0) ));
                        reply_readbraw_error();
                        END_PROFILE(SMBreadbraw);
                        return;
@@ -2820,16 +3087,17 @@ void reply_readbraw(struct smb_request *req)
                }      
        }
 
-       maxcount = (SVAL(req->inbuf,smb_vwv3) & 0xFFFF);
-       mincount = (SVAL(req->inbuf,smb_vwv4) & 0xFFFF);
+       maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
+       mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
 
        /* ensure we don't overrun the packet size */
        maxcount = MIN(65535,maxcount);
 
-       if (is_locked(fsp,(uint32)req->smbpid,
-                       (uint64_t)maxcount,
-                       (uint64_t)startpos,
-                       READ_LOCK)) {
+       init_strict_lock_struct(fsp, (uint32)req->smbpid,
+           (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
+           &lock);
+
+       if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
                reply_readbraw_error();
                END_PROFILE(SMBreadbraw);
                return;
@@ -2857,10 +3125,14 @@ void reply_readbraw(struct smb_request *req)
                (unsigned long)mincount,
                (unsigned long)nread ) );
 
-       send_file_readbraw(conn, fsp, startpos, nread, mincount);
+       send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
 
        DEBUG(5,("reply_readbraw finished\n"));
+
+       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+
        END_PROFILE(SMBreadbraw);
+       return;
 }
 
 #undef DBGC_CLASS
@@ -2890,23 +3162,21 @@ void reply_lockread(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if (!check_fsp(conn, req, fsp)) {
                END_PROFILE(SMBlockread);
                return;
        }
 
-       if (!CHECK_READ(fsp,req->inbuf)) {
+       if (!CHECK_READ(fsp,req)) {
                reply_doserror(req, ERRDOS, ERRbadaccess);
                END_PROFILE(SMBlockread);
                return;
        }
 
-       release_level_2_oplocks_on_change(fsp);
-
-       numtoread = SVAL(req->inbuf,smb_vwv1);
-       startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
+       numtoread = SVAL(req->vwv+1, 0);
+       startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
 
        numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
 
@@ -2931,6 +3201,7 @@ void reply_lockread(struct smb_request *req)
                        WINDOWS_LOCK,
                        False, /* Non-blocking lock. */
                        &status,
+                       NULL,
                        NULL);
        TALLOC_FREE(br_lck);
 
@@ -2989,6 +3260,7 @@ void reply_read(struct smb_request *req)
        SMB_OFF_T startpos;
        int outsize = 0;
        files_struct *fsp;
+       struct lock_struct lock;
 
        START_PROFILE(SMBread);
 
@@ -2998,21 +3270,21 @@ void reply_read(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if (!check_fsp(conn, req, fsp)) {
                END_PROFILE(SMBread);
                return;
        }
 
-       if (!CHECK_READ(fsp,req->inbuf)) {
+       if (!CHECK_READ(fsp,req)) {
                reply_doserror(req, ERRDOS, ERRbadaccess);
                END_PROFILE(SMBread);
                return;
        }
 
-       numtoread = SVAL(req->inbuf,smb_vwv1);
-       startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
+       numtoread = SVAL(req->vwv+1, 0);
+       startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
 
        numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
 
@@ -3030,8 +3302,11 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 
        data = smb_buf(req->outbuf) + 3;
 
-       if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtoread,
-                     (uint64_t)startpos, READ_LOCK)) {
+       init_strict_lock_struct(fsp, (uint32)req->smbpid,
+           (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
+           &lock);
+
+       if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
                reply_doserror(req, ERRDOS,ERRlock);
                END_PROFILE(SMBread);
                return;
@@ -3042,8 +3317,7 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 
        if (nread < 0) {
                reply_unixerror(req, ERRDOS,ERRnoaccess);
-               END_PROFILE(SMBread);
-               return;
+               goto strict_unlock;
        }
 
        srv_set_message((char *)req->outbuf, 5, nread+3, False);
@@ -3056,6 +3330,9 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
        DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
                fsp->fnum, (int)numtoread, (int)nread ) );
 
+strict_unlock:
+       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+
        END_PROFILE(SMBread);
        return;
 }
@@ -3064,7 +3341,8 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
  Setup readX header.
 ****************************************************************************/
 
-static int setup_readX_header(char *outbuf, size_t smb_maxcnt)
+static int setup_readX_header(struct smb_request *req, char *outbuf,
+                             size_t smb_maxcnt)
 {
        int outsize;
        char *data;
@@ -3077,9 +3355,13 @@ static int setup_readX_header(char *outbuf, size_t smb_maxcnt)
        SCVAL(outbuf,smb_vwv0,0xFF);
        SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
        SSVAL(outbuf,smb_vwv5,smb_maxcnt);
-       SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
+       SSVAL(outbuf,smb_vwv6,
+             req_wct_ofs(req)
+             + 1               /* the wct field */
+             + 12 * sizeof(uint16_t) /* vwv */
+             + 2);             /* the buflen field */
        SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
-       SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
+       SSVAL(outbuf,smb_vwv11,smb_maxcnt);
        /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
        _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
        return outsize;
@@ -3095,20 +3377,29 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
 {
        SMB_STRUCT_STAT sbuf;
        ssize_t nread = -1;
+       struct lock_struct lock;
 
        if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
                reply_unixerror(req, ERRDOS, ERRnoaccess);
                return;
        }
 
-       if (startpos > sbuf.st_size) {
-               smb_maxcnt = 0;
-       } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
-               smb_maxcnt = (sbuf.st_size - startpos);
+       init_strict_lock_struct(fsp, (uint32)req->smbpid,
+           (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
+           &lock);
+
+       if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+               reply_doserror(req, ERRDOS, ERRlock);
+               return;
        }
 
-       if (smb_maxcnt == 0) {
-               goto normal_read;
+       if (!S_ISREG(sbuf.st_mode) || (startpos > sbuf.st_size)
+           || (smb_maxcnt > (sbuf.st_size - startpos))) {
+               /*
+                * We already know that we would do a short read, so don't
+                * try the sendfile() path.
+                */
+               goto nosendfile_read;
        }
 
 #if defined(WITH_SENDFILE)
@@ -3118,9 +3409,10 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
         * on a train in Germany :-). JRA.
         */
 
-       if ((chain_size == 0) && (CVAL(req->inbuf,smb_vwv0) == 0xFF) &&
+       if (!req_is_in_chain(req) &&
            !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
-           lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
+           (fsp->wcp == NULL) &&
+           lp_use_sendfile(SNUM(conn), smbd_server_conn->signing_state) ) {
                uint8 headerbuf[smb_size + 12 * 2];
                DATA_BLOB header;
 
@@ -3132,13 +3424,13 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
 
                header = data_blob_const(headerbuf, sizeof(headerbuf));
 
-               construct_reply_common((char *)req->inbuf, (char *)headerbuf);
-               setup_readX_header((char *)headerbuf, smb_maxcnt);
+               construct_reply_common_req(req, (char *)headerbuf);
+               setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
 
                if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
-                       /* Returning ENOSYS or EINVAL means no data at all was sent. 
+                       /* Returning ENOSYS means no data at all was sent.
                           Do this as a normal read. */
-                       if (errno == ENOSYS || errno == EINVAL) {
+                       if (errno == ENOSYS) {
                                goto normal_read;
                        }
 
@@ -3162,30 +3454,48 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
                                DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
                                        fsp->fnum, (int)smb_maxcnt, (int)nread ) );
                                /* No outbuf here means successful sendfile. */
-                               TALLOC_FREE(req->outbuf);
-                               return;
+                               goto strict_unlock;
                        }
 
                        DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
                                fsp->fsp_name, strerror(errno) ));
                        exit_server_cleanly("send_file_readX sendfile failed");
+               } else if (nread == 0) {
+                       /*
+                        * Some sendfile implementations return 0 to indicate
+                        * that there was a short read, but nothing was
+                        * actually written to the socket.  In this case,
+                        * fallback to the normal read path so the header gets
+                        * the correct byte count.
+                        */
+                       DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
+                                 "falling back to the normal read: %s\n",
+                                 fsp->fsp_name));
+                       goto normal_read;
                }
 
                DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
                        fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+
+               /* Deal with possible short send. */
+               if (nread != smb_maxcnt + sizeof(headerbuf)) {
+                       sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
+               }
                /* No outbuf here means successful sendfile. */
-               TALLOC_FREE(req->outbuf);
-               return;
+               SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
+               SMB_PERFCOUNT_END(&req->pcd);
+               goto strict_unlock;
        }
-#endif
 
 normal_read:
 
+#endif
+
        if ((smb_maxcnt & 0xFF0000) > 0x10000) {
                uint8 headerbuf[smb_size + 2*12];
 
-               construct_reply_common((char *)req->inbuf, (char *)headerbuf);
-               setup_readX_header((char *)headerbuf, smb_maxcnt);
+               construct_reply_common_req(req, (char *)headerbuf);
+               setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
 
                /* Send out the header. */
                if (write_data(smbd_server_fd(), (char *)headerbuf,
@@ -3200,24 +3510,34 @@ normal_read:
                                fsp->fsp_name, strerror(errno) ));
                        exit_server_cleanly("send_file_readX: fake_sendfile failed");
                }
-               TALLOC_FREE(req->outbuf);
-               return;
+               goto strict_unlock;
        }
 
+nosendfile_read:
+
        reply_outbuf(req, 12, smb_maxcnt);
 
        nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
+
+       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+
        if (nread < 0) {
                reply_unixerror(req, ERRDOS, ERRnoaccess);
                return;
        }
 
-       setup_readX_header((char *)req->outbuf, nread);
+       setup_readX_header(req, (char *)req->outbuf, nread);
 
        DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
                    fsp->fnum, (int)smb_maxcnt, (int)nread ) );
 
        chain_reply(req);
+       return;
+
+ strict_unlock:
+       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+       TALLOC_FREE(req->outbuf);
+       return;
 }
 
 /****************************************************************************
@@ -3232,7 +3552,7 @@ void reply_read_and_X(struct smb_request *req)
        size_t smb_maxcnt;
        bool big_readX = False;
 #if 0
-       size_t smb_mincnt = SVAL(req->inbuf,smb_vwv6);
+       size_t smb_mincnt = SVAL(req->vwv+6, 0);
 #endif
 
        START_PROFILE(SMBreadX);
@@ -3242,9 +3562,9 @@ void reply_read_and_X(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv2));
-       startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
-       smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
+       fsp = file_fsp(req, SVAL(req->vwv+2, 0));
+       startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
+       smb_maxcnt = SVAL(req->vwv+5, 0);
 
        /* If it's an IPC, pass off the pipe handler. */
        if (IS_IPC(conn)) {
@@ -3258,24 +3578,25 @@ void reply_read_and_X(struct smb_request *req)
                return;
        }
 
-       if (!CHECK_READ(fsp,req->inbuf)) {
+       if (!CHECK_READ(fsp,req)) {
                reply_doserror(req, ERRDOS,ERRbadaccess);
                END_PROFILE(SMBreadX);
                return;
        }
 
        if (global_client_caps & CAP_LARGE_READX) {
-               size_t upper_size = SVAL(req->inbuf,smb_vwv7);
+               size_t upper_size = SVAL(req->vwv+7, 0);
                smb_maxcnt |= (upper_size<<16);
                if (upper_size > 1) {
                        /* Can't do this on a chained packet. */
-                       if ((CVAL(req->inbuf,smb_vwv0) != 0xFF)) {
+                       if ((CVAL(req->vwv+0, 0) != 0xFF)) {
                                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
                                END_PROFILE(SMBreadX);
                                return;
                        }
                        /* We currently don't do this on signed or sealed data. */
-                       if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
+                       if (srv_is_signing_active(smbd_server_conn) ||
+                           is_encrypted_packet(req->inbuf)) {
                                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
                                END_PROFILE(SMBreadX);
                                return;
@@ -3296,7 +3617,7 @@ void reply_read_and_X(struct smb_request *req)
                /*
                 * This is a large offset (64 bit) read.
                 */
-               startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv10)) << 32);
+               startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
 
 #else /* !LARGE_SMB_OFF_T */
 
@@ -3304,10 +3625,10 @@ void reply_read_and_X(struct smb_request *req)
                 * Ensure we haven't been sent a >32 bit offset.
                 */
 
-               if(IVAL(req->inbuf,smb_vwv10) != 0) {
+               if(IVAL(req->vwv+10, 0) != 0) {
                        DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
                                 "used and we don't support 64 bit offsets.\n",
-                                (unsigned int)IVAL(req->inbuf,smb_vwv10) ));
+                                (unsigned int)IVAL(req->vwv+10, 0) ));
                        END_PROFILE(SMBreadX);
                        reply_doserror(req, ERRDOS, ERRbadaccess);
                        return;
@@ -3317,21 +3638,14 @@ void reply_read_and_X(struct smb_request *req)
 
        }
 
-       if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)smb_maxcnt,
-                     (uint64_t)startpos, READ_LOCK)) {
-               END_PROFILE(SMBreadX);
-               reply_doserror(req, ERRDOS, ERRlock);
-               return;
-       }
-
        if (!big_readX &&
            schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
-               END_PROFILE(SMBreadX);
-               return;
+               goto out;
        }
 
        send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
 
+ out:
        END_PROFILE(SMBreadX);
        return;
 }
@@ -3366,6 +3680,7 @@ void reply_writebraw(struct smb_request *req)
        char *data=NULL;
        bool write_through;
        files_struct *fsp;
+       struct lock_struct lock;
        NTSTATUS status;
 
        START_PROFILE(SMBwritebraw);
@@ -3377,7 +3692,7 @@ void reply_writebraw(struct smb_request *req)
         */
        SCVAL(req->inbuf,smb_com,SMBwritec);
 
-       if (srv_is_signing_active()) {
+       if (srv_is_signing_active(smbd_server_conn)) {
                END_PROFILE(SMBwritebraw);
                exit_server_cleanly("reply_writebraw: SMB signing is active - "
                                "raw reads/writes are disallowed.");
@@ -3390,7 +3705,7 @@ void reply_writebraw(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
        if (!check_fsp(conn, req, fsp)) {
                error_to_writebrawerr(req);
                END_PROFILE(SMBwritebraw);
@@ -3404,9 +3719,9 @@ void reply_writebraw(struct smb_request *req)
                return;
        }
 
-       tcount = IVAL(req->inbuf,smb_vwv1);
-       startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
-       write_through = BITSETW(req->inbuf+smb_vwv7,0);
+       tcount = IVAL(req->vwv+1, 0);
+       startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
+       write_through = BITSETW(req->vwv+7,0);
 
        /* We have to deal with slightly different formats depending
                on whether we are using the core+ or lanman1.0 protocol */
@@ -3415,8 +3730,8 @@ void reply_writebraw(struct smb_request *req)
                numtowrite = SVAL(smb_buf(req->inbuf),-2);
                data = smb_buf(req->inbuf);
        } else {
-               numtowrite = SVAL(req->inbuf,smb_vwv10);
-               data = smb_base(req->inbuf) + SVAL(req->inbuf, smb_vwv11);
+               numtowrite = SVAL(req->vwv+10, 0);
+               data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
        }
 
        /* Ensure we don't write bytes past the end of this packet. */
@@ -3427,8 +3742,11 @@ void reply_writebraw(struct smb_request *req)
                return;
        }
 
-       if (is_locked(fsp,(uint32)req->smbpid,(uint64_t)tcount,
-                               (uint64_t)startpos, WRITE_LOCK)) {
+       init_strict_lock_struct(fsp, (uint32)req->smbpid,
+           (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
+           &lock);
+
+       if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
                reply_doserror(req, ERRDOS, ERRlock);
                error_to_writebrawerr(req);
                END_PROFILE(SMBwritebraw);
@@ -3447,8 +3765,7 @@ void reply_writebraw(struct smb_request *req)
        if (nwritten < (ssize_t)numtowrite)  {
                reply_unixerror(req, ERRHRD, ERRdiskfull);
                error_to_writebrawerr(req);
-               END_PROFILE(SMBwritebraw);
-               return;
+               goto strict_unlock;
        }
 
        total_written = nwritten;
@@ -3458,8 +3775,7 @@ void reply_writebraw(struct smb_request *req)
        if (!buf) {
                reply_doserror(req, ERRDOS, ERRnomem);
                error_to_writebrawerr(req);
-               END_PROFILE(SMBwritebraw);
-               return;
+               goto strict_unlock;
        }
 
        /* Return a SMBwritebraw message to the redirector to tell
@@ -3471,8 +3787,10 @@ void reply_writebraw(struct smb_request *req)
        SSVALS(buf,smb_vwv0,0xFFFF);
        show_msg(buf);
        if (!srv_send_smb(smbd_server_fd(),
-                       buf,
-                       IS_CONN_ENCRYPTED(conn))) {
+                         buf,
+                         false, 0, /* no signing */
+                         IS_CONN_ENCRYPTED(conn),
+                         &req->pcd)) {
                exit_server_cleanly("reply_writebraw: srv_send_smb "
                        "failed.");
        }
@@ -3516,8 +3834,7 @@ void reply_writebraw(struct smb_request *req)
                        TALLOC_FREE(buf);
                        reply_unixerror(req, ERRHRD, ERRdiskfull);
                        error_to_writebrawerr(req);
-                       END_PROFILE(SMBwritebraw);
-                       return;
+                       goto strict_unlock;
                }
 
                if (nwritten < (ssize_t)numtowrite) {
@@ -3539,8 +3856,7 @@ void reply_writebraw(struct smb_request *req)
                        fsp->fsp_name, nt_errstr(status) ));
                reply_nterror(req, status);
                error_to_writebrawerr(req);
-               END_PROFILE(SMBwritebraw);
-               return;
+               goto strict_unlock;
        }
 
        DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
@@ -3548,6 +3864,8 @@ void reply_writebraw(struct smb_request *req)
                fsp->fnum, (double)startpos, (int)numtowrite,
                (int)total_written));
 
+       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+
        /* We won't return a status if write through is not selected - this
         * follows what WfWg does */
        END_PROFILE(SMBwritebraw);
@@ -3568,6 +3886,12 @@ void reply_writebraw(struct smb_request *req)
                TALLOC_FREE(req->outbuf);
        }
        return;
+
+strict_unlock:
+       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+
+       END_PROFILE(SMBwritebraw);
+       return;
 }
 
 #undef DBGC_CLASS
@@ -3586,6 +3910,7 @@ void reply_writeunlock(struct smb_request *req)
        const char *data;
        NTSTATUS status = NT_STATUS_OK;
        files_struct *fsp;
+       struct lock_struct lock;
 
        START_PROFILE(SMBwriteunlock);
 
@@ -3595,7 +3920,7 @@ void reply_writeunlock(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if (!check_fsp(conn, req, fsp)) {
                END_PROFILE(SMBwriteunlock);
@@ -3608,16 +3933,20 @@ void reply_writeunlock(struct smb_request *req)
                return;
        }
 
-       numtowrite = SVAL(req->inbuf,smb_vwv1);
-       startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
+       numtowrite = SVAL(req->vwv+1, 0);
+       startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
        data = (const char *)req->buf + 3;
 
-       if (numtowrite
-           && is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
-                        (uint64_t)startpos, WRITE_LOCK)) {
-               reply_doserror(req, ERRDOS, ERRlock);
-               END_PROFILE(SMBwriteunlock);
-               return;
+       if (numtowrite) {
+               init_strict_lock_struct(fsp, (uint32)req->smbpid,
+                   (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
+                   &lock);
+
+               if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+                       reply_doserror(req, ERRDOS, ERRlock);
+                       END_PROFILE(SMBwriteunlock);
+                       return;
+               }
        }
 
        /* The special X/Open SMB protocol handling of
@@ -3634,14 +3963,12 @@ void reply_writeunlock(struct smb_request *req)
                DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
                        fsp->fsp_name, nt_errstr(status) ));
                reply_nterror(req, status);
-               END_PROFILE(SMBwriteunlock);
-               return;
+               goto strict_unlock;
        }
 
        if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
                reply_unixerror(req, ERRHRD, ERRdiskfull);
-               END_PROFILE(SMBwriteunlock);
-               return;
+               goto strict_unlock;
        }
 
        if (numtowrite) {
@@ -3654,8 +3981,7 @@ void reply_writeunlock(struct smb_request *req)
 
                if (NT_STATUS_V(status)) {
                        reply_nterror(req, status);
-                       END_PROFILE(SMBwriteunlock);
-                       return;
+                       goto strict_unlock;
                }
        }
 
@@ -3666,6 +3992,11 @@ void reply_writeunlock(struct smb_request *req)
        DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
                 fsp->fnum, (int)numtowrite, (int)nwritten));
 
+strict_unlock:
+       if (numtowrite) {
+               SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+       }
+
        END_PROFILE(SMBwriteunlock);
        return;
 }
@@ -3685,6 +4016,7 @@ void reply_write(struct smb_request *req)
        SMB_OFF_T startpos;
        const char *data;
        files_struct *fsp;
+       struct lock_struct lock;
        NTSTATUS status;
 
        START_PROFILE(SMBwrite);
@@ -3702,7 +4034,7 @@ void reply_write(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if (!check_fsp(conn, req, fsp)) {
                END_PROFILE(SMBwrite);
@@ -3715,12 +4047,15 @@ void reply_write(struct smb_request *req)
                return;
        }
 
-       numtowrite = SVAL(req->inbuf,smb_vwv1);
-       startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
+       numtowrite = SVAL(req->vwv+1, 0);
+       startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
        data = (const char *)req->buf + 3;
 
-       if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
-                     (uint64_t)startpos, WRITE_LOCK)) {
+       init_strict_lock_struct(fsp, (uint32)req->smbpid,
+           (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
+           &lock);
+
+       if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
                reply_doserror(req, ERRDOS, ERRlock);
                END_PROFILE(SMBwrite);
                return;
@@ -3739,14 +4074,12 @@ void reply_write(struct smb_request *req)
                nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
                if (nwritten < 0) {
                        reply_nterror(req, NT_STATUS_DISK_FULL);
-                       END_PROFILE(SMBwrite);
-                       return;
+                       goto strict_unlock;
                }
                nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
                if (nwritten < 0) {
                        reply_nterror(req, NT_STATUS_DISK_FULL);
-                       END_PROFILE(SMBwrite);
-                       return;
+                       goto strict_unlock;
                }
                trigger_write_time_update_immediate(fsp);
        } else {
@@ -3758,14 +4091,12 @@ void reply_write(struct smb_request *req)
                DEBUG(5,("reply_write: sync_file for %s returned %s\n",
                        fsp->fsp_name, nt_errstr(status) ));
                reply_nterror(req, status);
-               END_PROFILE(SMBwrite);
-               return;
+               goto strict_unlock;
        }
 
        if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
                reply_unixerror(req, ERRHRD, ERRdiskfull);
-               END_PROFILE(SMBwrite);
-               return;
+               goto strict_unlock;
        }
 
        reply_outbuf(req, 1, 0);
@@ -3779,6 +4110,9 @@ void reply_write(struct smb_request *req)
 
        DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
 
+strict_unlock:
+       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+
        END_PROFILE(SMBwrite);
        return;
 }
@@ -3824,6 +4158,10 @@ bool is_valid_writeX_buffer(const uint8_t *inbuf)
                DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
                return false;
        }
+       if (IS_PRINT(conn)) {
+               DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
+               return false;
+       }
        doff = SVAL(inbuf,smb_vwv11);
 
        numtowrite = SVAL(inbuf,smb_vwv10);
@@ -3872,6 +4210,7 @@ void reply_write_and_X(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
        files_struct *fsp;
+       struct lock_struct lock;
        SMB_OFF_T startpos;
        size_t numtowrite;
        bool write_through;
@@ -3889,14 +4228,14 @@ void reply_write_and_X(struct smb_request *req)
                return;
        }
 
-       numtowrite = SVAL(req->inbuf,smb_vwv10);
-       smb_doff = SVAL(req->inbuf,smb_vwv11);
+       numtowrite = SVAL(req->vwv+10, 0);
+       smb_doff = SVAL(req->vwv+11, 0);
        smblen = smb_len(req->inbuf);
 
        if (req->unread_bytes > 0xFFFF ||
                        (smblen > smb_doff &&
                                smblen - smb_doff > 0xFFFF)) {
-               numtowrite |= (((size_t)SVAL(req->inbuf,smb_vwv9))<<16);
+               numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
        }
 
        if (req->unread_bytes) {
@@ -3932,9 +4271,9 @@ void reply_write_and_X(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv2));
-       startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
-       write_through = BITSETW(req->inbuf+smb_vwv7,0);
+       fsp = file_fsp(req, SVAL(req->vwv+2, 0));
+       startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
+       write_through = BITSETW(req->vwv+7,0);
 
        if (!check_fsp(conn, req, fsp)) {
                END_PROFILE(SMBwriteX);
@@ -3954,7 +4293,7 @@ void reply_write_and_X(struct smb_request *req)
                /*
                 * This is a large offset (64 bit) write.
                 */
-               startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv12)) << 32);
+               startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
 
 #else /* !LARGE_SMB_OFF_T */
 
@@ -3962,10 +4301,10 @@ void reply_write_and_X(struct smb_request *req)
                 * Ensure we haven't been sent a >32 bit offset.
                 */
 
-               if(IVAL(req->inbuf,smb_vwv12) != 0) {
+               if(IVAL(req->vwv+12, 0) != 0) {
                        DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
                                 "used and we don't support 64 bit offsets.\n",
-                                (unsigned int)IVAL(req->inbuf,smb_vwv12) ));
+                                (unsigned int)IVAL(req->vwv+12, 0) ));
                        reply_doserror(req, ERRDOS, ERRbadaccess);
                        END_PROFILE(SMBwriteX);
                        return;
@@ -3974,9 +4313,11 @@ void reply_write_and_X(struct smb_request *req)
 #endif /* LARGE_SMB_OFF_T */
        }
 
-       if (is_locked(fsp,(uint32)req->smbpid,
-                     (uint64_t)numtowrite,
-                     (uint64_t)startpos, WRITE_LOCK)) {
+       init_strict_lock_struct(fsp, (uint32)req->smbpid,
+           (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
+           &lock);
+
+       if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
                reply_doserror(req, ERRDOS, ERRlock);
                END_PROFILE(SMBwriteX);
                return;
@@ -3994,8 +4335,7 @@ void reply_write_and_X(struct smb_request *req)
                if ((req->unread_bytes == 0) &&
                    schedule_aio_write_and_X(conn, req, fsp, data, startpos,
                                             numtowrite)) {
-                       END_PROFILE(SMBwriteX);
-                       return;
+                       goto strict_unlock;
                }
 
                nwritten = write_file(req,fsp,data,startpos,numtowrite);
@@ -4003,8 +4343,7 @@ void reply_write_and_X(struct smb_request *req)
 
        if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
                reply_unixerror(req, ERRHRD, ERRdiskfull);
-               END_PROFILE(SMBwriteX);
-               return;
+               goto strict_unlock;
        }
 
        reply_outbuf(req, 6, 0);
@@ -4024,13 +4363,20 @@ void reply_write_and_X(struct smb_request *req)
                DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
                        fsp->fsp_name, nt_errstr(status) ));
                reply_nterror(req, status);
-               END_PROFILE(SMBwriteX);
-               return;
+               goto strict_unlock;
        }
 
+       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+
        END_PROFILE(SMBwriteX);
        chain_reply(req);
        return;
+
+strict_unlock:
+       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+
+       END_PROFILE(SMBwriteX);
+       return;
 }
 
 /****************************************************************************
@@ -4053,7 +4399,7 @@ void reply_lseek(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if (!check_fsp(conn, req, fsp)) {
                return;
@@ -4061,9 +4407,9 @@ void reply_lseek(struct smb_request *req)
 
        flush_write_cache(fsp, SEEK_FLUSH);
 
-       mode = SVAL(req->inbuf,smb_vwv1) & 3;
+       mode = SVAL(req->vwv+1, 0) & 3;
        /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
-       startpos = (SMB_OFF_T)IVALS(req->inbuf,smb_vwv2);
+       startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
 
        switch (mode) {
                case 0:
@@ -4138,7 +4484,7 @@ void reply_flush(struct smb_request *req)
                return;
        }
 
-       fnum = SVAL(req->inbuf,smb_vwv0);
+       fnum = SVAL(req->vwv+0, 0);
        fsp = file_fsp(req, fnum);
 
        if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
@@ -4201,7 +4547,7 @@ void reply_close(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        /*
         * We can only use check_fsp if we know it's not a directory.
@@ -4233,7 +4579,7 @@ void reply_close(struct smb_request *req)
                 * Take care of any time sent in the close.
                 */
 
-               t = srv_make_unix_date3(req->inbuf+smb_vwv1);
+               t = srv_make_unix_date3(req->vwv+1);
                set_close_write_time(fsp, convert_time_t_to_timespec(t));
 
                /*
@@ -4270,6 +4616,7 @@ void reply_writeclose(struct smb_request *req)
        const char *data;
        struct timespec mtime;
        files_struct *fsp;
+       struct lock_struct lock;
 
        START_PROFILE(SMBwriteclose);
 
@@ -4279,7 +4626,7 @@ void reply_writeclose(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if (!check_fsp(conn, req, fsp)) {
                END_PROFILE(SMBwriteclose);
@@ -4291,18 +4638,21 @@ void reply_writeclose(struct smb_request *req)
                return;
        }
 
-       numtowrite = SVAL(req->inbuf,smb_vwv1);
-       startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
-       mtime = convert_time_t_to_timespec(srv_make_unix_date3(
-                                                  req->inbuf+smb_vwv4));
+       numtowrite = SVAL(req->vwv+1, 0);
+       startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
+       mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
        data = (const char *)req->buf + 1;
 
-       if (numtowrite
-           && is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
-                        (uint64_t)startpos, WRITE_LOCK)) {
-               reply_doserror(req, ERRDOS,ERRlock);
-               END_PROFILE(SMBwriteclose);
-               return;
+       if (numtowrite) {
+               init_strict_lock_struct(fsp, (uint32)req->smbpid,
+                   (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
+                   &lock);
+
+               if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+                       reply_doserror(req, ERRDOS,ERRlock);
+                       END_PROFILE(SMBwriteclose);
+                       return;
+               }
        }
 
        nwritten = write_file(req,fsp,data,startpos,numtowrite);
@@ -4326,19 +4676,23 @@ void reply_writeclose(struct smb_request *req)
 
        if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
                reply_doserror(req, ERRHRD, ERRdiskfull);
-               END_PROFILE(SMBwriteclose);
-               return;
+               goto strict_unlock;
        }
 
        if(!NT_STATUS_IS_OK(close_status)) {
                reply_nterror(req, close_status);
-               END_PROFILE(SMBwriteclose);
-               return;
+               goto strict_unlock;
        }
 
        reply_outbuf(req, 1, 0);
 
        SSVAL(req->outbuf,smb_vwv0,nwritten);
+
+strict_unlock:
+       if (numtowrite) {
+               SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+       }
+
        END_PROFILE(SMBwriteclose);
        return;
 }
@@ -4366,17 +4720,15 @@ void reply_lock(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if (!check_fsp(conn, req, fsp)) {
                END_PROFILE(SMBlock);
                return;
        }
 
-       release_level_2_oplocks_on_change(fsp);
-
-       count = (uint64_t)IVAL(req->inbuf,smb_vwv1);
-       offset = (uint64_t)IVAL(req->inbuf,smb_vwv3);
+       count = (uint64_t)IVAL(req->vwv+1, 0);
+       offset = (uint64_t)IVAL(req->vwv+3, 0);
 
        DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
                 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
@@ -4390,6 +4742,7 @@ void reply_lock(struct smb_request *req)
                        WINDOWS_LOCK,
                        False, /* Non-blocking lock. */
                        &status,
+                       NULL,
                        NULL);
 
        TALLOC_FREE(br_lck);
@@ -4425,15 +4778,15 @@ void reply_unlock(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if (!check_fsp(conn, req, fsp)) {
                END_PROFILE(SMBunlock);
                return;
        }
 
-       count = (uint64_t)IVAL(req->inbuf,smb_vwv1);
-       offset = (uint64_t)IVAL(req->inbuf,smb_vwv3);
+       count = (uint64_t)IVAL(req->vwv+1, 0);
+       offset = (uint64_t)IVAL(req->vwv+3, 0);
 
        status = do_unlock(smbd_messaging_context(),
                        fsp,
@@ -4495,18 +4848,22 @@ void reply_tdis(struct smb_request *req)
 void reply_echo(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
+       struct smb_perfcount_data local_pcd;
+       struct smb_perfcount_data *cur_pcd;
        int smb_reverb;
        int seq_num;
 
        START_PROFILE(SMBecho);
 
+       smb_init_perfcount_data(&local_pcd);
+
        if (req->wct < 1) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                END_PROFILE(SMBecho);
                return;
        }
 
-       smb_reverb = SVAL(req->inbuf,smb_vwv0);
+       smb_reverb = SVAL(req->vwv+0, 0);
 
        reply_outbuf(req, 1, req->buflen);
 
@@ -4520,13 +4877,24 @@ void reply_echo(struct smb_request *req)
                smb_reverb = 100;
        }
 
-       for (seq_num =1 ; seq_num <= smb_reverb ; seq_num++) {
+       for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
+
+               /* this makes sure we catch the request pcd */
+               if (seq_num == smb_reverb) {
+                       cur_pcd = &req->pcd;
+               } else {
+                       SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
+                       cur_pcd = &local_pcd;
+               }
+
                SSVAL(req->outbuf,smb_vwv0,seq_num);
 
                show_msg((char *)req->outbuf);
                if (!srv_send_smb(smbd_server_fd(),
                                (char *)req->outbuf,
-                               IS_CONN_ENCRYPTED(conn)||req->encrypted))
+                               true, req->seqnum+1,
+                               IS_CONN_ENCRYPTED(conn)||req->encrypted,
+                               cur_pcd))
                        exit_server_cleanly("reply_echo: srv_send_smb failed.");
        }
 
@@ -4546,6 +4914,7 @@ void reply_printopen(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
        files_struct *fsp;
+       SMB_STRUCT_STAT sbuf;
        NTSTATUS status;
 
        START_PROFILE(SMBsplopen);
@@ -4562,8 +4931,15 @@ void reply_printopen(struct smb_request *req)
                return;
        }
 
+       status = file_new(req, conn, &fsp);
+       if(!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
+               END_PROFILE(SMBsplopen);
+               return;
+       }
+
        /* Open for exclusive use, write only. */
-       status = print_fsp_open(req, conn, NULL, req->vuid, &fsp);
+       status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
 
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
@@ -4599,7 +4975,7 @@ void reply_printclose(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if (!check_fsp(conn, req, fsp)) {
                END_PROFILE(SMBsplclose);
@@ -4647,8 +5023,8 @@ void reply_printqueue(struct smb_request *req)
                return;
        }
 
-       max_count = SVAL(req->inbuf,smb_vwv0);
-       start_index = SVAL(req->inbuf,smb_vwv1);
+       max_count = SVAL(req->vwv+0, 0);
+       start_index = SVAL(req->vwv+1, 0);
 
        /* we used to allow the client to get the cnum wrong, but that
           is really quite gross and only worked when there was only
@@ -4741,7 +5117,7 @@ void reply_printwrite(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if (!check_fsp(conn, req, fsp)) {
                END_PROFILE(SMBsplwr);
@@ -4789,9 +5165,9 @@ void reply_printwrite(struct smb_request *req)
 void reply_mkdir(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
+       struct smb_filename *smb_dname = NULL;
        char *directory = NULL;
        NTSTATUS status;
-       SMB_STRUCT_STAT sbuf;
        TALLOC_CTX *ctx = talloc_tos();
 
        START_PROFILE(SMBmkdir);
@@ -4800,8 +5176,7 @@ void reply_mkdir(struct smb_request *req)
                            STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBmkdir);
-               return;
+               goto out;
        }
 
        status = resolve_dfspath(ctx, conn,
@@ -4812,26 +5187,28 @@ void reply_mkdir(struct smb_request *req)
                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
                                        ERRSRV, ERRbadpath);
-                       END_PROFILE(SMBmkdir);
-                       return;
+                       goto out;
                }
                reply_nterror(req, status);
-               END_PROFILE(SMBmkdir);
-               return;
+               goto out;
        }
 
-       status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
+       status = unix_convert(ctx, conn, directory, &smb_dname, 0);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBmkdir);
-               return;
+               goto out;
+       }
+
+       status = get_full_smb_filename(ctx, smb_dname, &directory);
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
+               goto out;
        }
 
        status = check_name(conn, directory);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBmkdir);
-               return;
+               goto out;
        }
 
        status = create_directory(conn, req, directory);
@@ -4852,14 +5229,14 @@ void reply_mkdir(struct smb_request *req)
                }
 
                reply_nterror(req, status);
-               END_PROFILE(SMBmkdir);
-               return;
+               goto out;
        }
 
        reply_outbuf(req, 0, 0);
 
        DEBUG( 3, ( "mkdir %s\n", directory ) );
-
+ out:
+       TALLOC_FREE(smb_dname);
        END_PROFILE(SMBmkdir);
        return;
 }
@@ -4876,15 +5253,15 @@ static bool recursive_rmdir(TALLOC_CTX *ctx,
        const char *dname = NULL;
        bool ret = True;
        long offset = 0;
+       SMB_STRUCT_STAT st;
        struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
                                          NULL, 0);
 
        if(dir_hnd == NULL)
                return False;
 
-       while((dname = ReadDirName(dir_hnd, &offset))) {
+       while((dname = ReadDirName(dir_hnd, &offset, &st))) {
                char *fullname = NULL;
-               SMB_STRUCT_STAT st;
 
                if (ISDOT(dname) || ISDOTDOT(dname)) {
                        continue;
@@ -4981,7 +5358,7 @@ NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
                        goto err;
                }
 
-               while ((dname = ReadDirName(dir_hnd,&dirpos))) {
+               while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
                        if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
                                continue;
                        if (!is_visible_file(conn, directory, dname, &st, False))
@@ -4993,10 +5370,18 @@ NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
                        }
                }
 
-               /* We only have veto files/directories. Recursive delete. */
+               /* We only have veto files/directories.
+                * Are we allowed to delete them ? */
+
+               if(!lp_recursive_veto_delete(SNUM(conn))) {
+                       TALLOC_FREE(dir_hnd);
+                       errno = ENOTEMPTY;
+                       goto err;
+               }
 
+               /* Do a recursive delete. */
                RewindDir(dir_hnd,&dirpos);
-               while ((dname = ReadDirName(dir_hnd,&dirpos))) {
+               while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
                        char *fullname = NULL;
 
                        if (ISDOT(dname) || ISDOTDOT(dname)) {
@@ -5020,9 +5405,8 @@ NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
                                break;
                        }
                        if(st.st_mode & S_IFDIR) {
-                               if(lp_recursive_veto_delete(SNUM(conn))) {
-                                       if(!recursive_rmdir(ctx, conn, fullname))
-                                               break;
+                               if(!recursive_rmdir(ctx, conn, fullname)) {
+                                       break;
                                }
                                if(SMB_VFS_RMDIR(conn,fullname) != 0) {
                                        break;
@@ -5059,8 +5443,8 @@ NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
 void reply_rmdir(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
+       struct smb_filename *smb_dname = NULL;
        char *directory = NULL;
-       SMB_STRUCT_STAT sbuf;
        NTSTATUS status;
        TALLOC_CTX *ctx = talloc_tos();
 
@@ -5070,8 +5454,7 @@ void reply_rmdir(struct smb_request *req)
                            STR_TERMINATE, &status);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBrmdir);
-               return;
+               goto out;
        }
 
        status = resolve_dfspath(ctx, conn,
@@ -5082,41 +5465,42 @@ void reply_rmdir(struct smb_request *req)
                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
                                        ERRSRV, ERRbadpath);
-                       END_PROFILE(SMBrmdir);
-                       return;
+                       goto out;
                }
                reply_nterror(req, status);
-               END_PROFILE(SMBrmdir);
-               return;
+               goto out;
        }
 
-       status = unix_convert(ctx, conn, directory, False, &directory,
-                       NULL, &sbuf);
+       status = unix_convert(ctx, conn, directory, &smb_dname, 0);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBrmdir);
-               return;
+               goto out;
+       }
+
+       status = get_full_smb_filename(ctx, smb_dname, &directory);
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
+               goto out;
        }
 
        status = check_name(conn, directory);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBrmdir);
-               return;
+               goto out;
        }
 
        dptr_closepath(directory, req->smbpid);
        status = rmdir_internals(ctx, conn, directory);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBrmdir);
-               return;
+               goto out;
        }
 
        reply_outbuf(req, 0, 0);
 
        DEBUG( 3, ( "rmdir %s\n", directory ) );
-
+ out:
+       TALLOC_FREE(smb_dname);
        END_PROFILE(SMBrmdir);
        return;
 }
@@ -5329,8 +5713,8 @@ static void notify_rename(connection_struct *conn, bool is_dir,
        mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
                : FILE_NOTIFY_CHANGE_FILE_NAME;
 
-       if (!parent_dirname_talloc(NULL, oldpath, &olddir, &oldname)
-           || !parent_dirname_talloc(NULL, newpath, &newdir, &newname)) {
+       if (!parent_dirname(talloc_tos(), oldpath, &olddir, &oldname)
+           || !parent_dirname(talloc_tos(), newpath, &newdir, &newname)) {
                TALLOC_FREE(olddir);
                return;
        }
@@ -5372,7 +5756,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn,
        SMB_STRUCT_STAT sbuf, sbuf1;
        NTSTATUS status = NT_STATUS_OK;
        struct share_mode_lock *lck = NULL;
-       bool dst_exists;
+       bool dst_exists, old_is_stream, new_is_stream;
 
        ZERO_STRUCT(sbuf);
 
@@ -5441,6 +5825,18 @@ NTSTATUS rename_internals_fsp(connection_struct *conn,
                return NT_STATUS_OK;
        }
 
+       old_is_stream = is_ntfs_stream_name(fsp->fsp_name);
+       new_is_stream = is_ntfs_stream_name(newname);
+
+       /* Return the correct error code if both names aren't streams. */
+       if (!old_is_stream && new_is_stream) {
+               return NT_STATUS_OBJECT_NAME_INVALID;
+       }
+
+       if (old_is_stream && !new_is_stream) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
        /*
         * Have vfs_object_exist also fill sbuf1
         */
@@ -5455,7 +5851,8 @@ NTSTATUS rename_internals_fsp(connection_struct *conn,
        if (dst_exists) {
                struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
                files_struct *dst_fsp = file_find_di_first(fileid);
-               if (dst_fsp) {
+               /* The file can be open when renaming a stream */
+               if (dst_fsp && !new_is_stream) {
                        DEBUG(3, ("rename_internals_fsp: Target file open\n"));
                        return NT_STATUS_ACCESS_DENIED;
                }
@@ -5467,7 +5864,13 @@ NTSTATUS rename_internals_fsp(connection_struct *conn,
                        return map_nt_error_from_unix(errno);
                }
        } else {
-               if (SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf) == -1) {
+               int ret = -1;
+               if (fsp->posix_open) {
+                       ret = SMB_VFS_LSTAT(conn,fsp->fsp_name,&sbuf);
+               } else {
+                       ret = SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf);
+               }
+               if (ret == -1) {
                        return map_nt_error_from_unix(errno);
                }
        }
@@ -5515,8 +5918,6 @@ NTSTATUS rename_internals_fsp(connection_struct *conn,
                 * depends on these semantics. JRA.
                 */
 
-               set_allow_initial_delete_on_close(lck, fsp, True);
-
                if (create_options & FILE_DELETE_ON_CLOSE) {
                        status = can_set_delete_on_close(fsp, True, 0);
 
@@ -5560,33 +5961,42 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                        bool dest_has_wild,
                        uint32_t access_mask)
 {
+       struct smb_filename *smb_fname = NULL;
+       struct smb_filename *smb_fname_new = NULL;
        char *directory = NULL;
        char *mask = NULL;
-       char *last_component_src = NULL;
-       char *last_component_dest = NULL;
        char *name = NULL;
        char *newname = NULL;
        char *p;
        int count=0;
        NTSTATUS status = NT_STATUS_OK;
-       SMB_STRUCT_STAT sbuf1, sbuf2;
        struct smb_Dir *dir_hnd = NULL;
        const char *dname;
        long offset = 0;
+       int create_options = 0;
+       bool posix_pathnames = lp_posix_pathnames();
 
-       ZERO_STRUCT(sbuf1);
-       ZERO_STRUCT(sbuf2);
+       status = unix_convert(ctx, conn, name_in, &smb_fname,
+                             src_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto out;
+       }
 
-       status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
-                       &last_component_src, &sbuf1);
+       status = get_full_smb_filename(ctx, smb_fname, &name);
        if (!NT_STATUS_IS_OK(status)) {
-               return status;
+               goto out;
        }
 
-       status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
-                       &last_component_dest, &sbuf2);
+       status = unix_convert(ctx, conn, newname_in, &smb_fname_new,
+                             (UCF_SAVE_LCOMP |
+                              (dest_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0)));
        if (!NT_STATUS_IS_OK(status)) {
-               return status;
+               goto out;
+       }
+
+       status = get_full_smb_filename(ctx, smb_fname_new, &newname);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto out;
        }
 
        /*
@@ -5602,14 +6012,16 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
        if (!p) {
                directory = talloc_strdup(ctx, ".");
                if (!directory) {
-                       return NT_STATUS_NO_MEMORY;
+                       status = NT_STATUS_NO_MEMORY;
+                       goto out;
                }
                mask = name;
        } else {
                *p = 0;
                directory = talloc_strdup(ctx, name);
                if (!directory) {
-                       return NT_STATUS_NO_MEMORY;
+                       status = NT_STATUS_NO_MEMORY;
+                       goto out;
                }
                mask = p+1;
                *p = '/'; /* Replace needed for exceptional test below. */
@@ -5624,7 +6036,7 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
 
-       if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
+       if (!VALID_STAT(smb_fname->st) && mangle_is_mangled(mask, conn->params)) {
                char *new_mask = NULL;
                mangle_lookup_name_from_8_3(ctx,
                                        mask,
@@ -5641,14 +6053,13 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                /*
                 * No wildcards - just process the one file.
                 */
-               bool is_short_name = mangle_is_8_3(name, True, conn->params);
-
                /* Add a terminating '/' to the directory name. */
                directory = talloc_asprintf_append(directory,
                                "/%s",
                                mask);
                if (!directory) {
-                       return NT_STATUS_NO_MEMORY;
+                       status = NT_STATUS_NO_MEMORY;
+                       goto out;
                }
 
                /* Ensure newname contains a '/' also */
@@ -5657,17 +6068,18 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                                                "./%s",
                                                newname);
                        if (!newname) {
-                               return NT_STATUS_NO_MEMORY;
+                               status = NT_STATUS_NO_MEMORY;
+                               goto out;
                        }
                }
 
                DEBUG(3, ("rename_internals: case_sensitive = %d, "
                          "case_preserve = %d, short case preserve = %d, "
                          "directory = %s, newname = %s, "
-                         "last_component_dest = %s, is_8_3 = %d\n",
+                         "last_component_dest = %s\n",
                          conn->case_sensitive, conn->case_preserve,
                          conn->short_case_preserve, directory,
-                         newname, last_component_dest, is_short_name));
+                         newname, smb_fname_new->original_lcomp));
 
                /* The dest name still may have wildcards. */
                if (dest_has_wild) {
@@ -5678,34 +6090,51 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                                        "%s %s failed\n",
                                        directory,
                                        newname));
-                               return NT_STATUS_NO_MEMORY;
+                               status = NT_STATUS_NO_MEMORY;
+                               goto out;
                        }
                        newname = mod_newname;
                }
 
-               ZERO_STRUCT(sbuf1);
-               SMB_VFS_STAT(conn, directory, &sbuf1);
-
-               status = S_ISDIR(sbuf1.st_mode) ?
-                       open_directory(conn, req, directory, &sbuf1,
-                                      access_mask,
-                                      FILE_SHARE_READ|FILE_SHARE_WRITE,
-                                      FILE_OPEN, 0, 0, NULL,
-                                      &fsp)
-                       : open_file_ntcreate(conn, req, directory, &sbuf1,
-                                            access_mask,
-                                            FILE_SHARE_READ|FILE_SHARE_WRITE,
-                                            FILE_OPEN, 0, 0, 0, NULL,
-                                            &fsp);
+               ZERO_STRUCT(smb_fname->st);
+               if (posix_pathnames) {
+                       SMB_VFS_LSTAT(conn, directory, &smb_fname->st);
+               } else {
+                       SMB_VFS_STAT(conn, directory, &smb_fname->st);
+               }
+
+               if (S_ISDIR(smb_fname->st.st_mode)) {
+                       create_options |= FILE_DIRECTORY_FILE;
+               }
+
+               status = SMB_VFS_CREATE_FILE(
+                       conn,                           /* conn */
+                       req,                            /* req */
+                       0,                              /* root_dir_fid */
+                       directory,                      /* fname */
+                       0,                              /* create_file_flags */
+                       access_mask,                    /* access_mask */
+                       (FILE_SHARE_READ |              /* share_access */
+                           FILE_SHARE_WRITE),
+                       FILE_OPEN,                      /* create_disposition*/
+                       create_options,                 /* create_options */
+                       posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
+                       0,                              /* oplock_request */
+                       0,                              /* allocation_size */
+                       NULL,                           /* sd */
+                       NULL,                           /* ea_list */
+                       &fsp,                           /* result */
+                       NULL,                           /* pinfo */
+                       &smb_fname->st);                /* psbuf */
 
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(3, ("Could not open rename source %s: %s\n",
                                  directory, nt_errstr(status)));
-                       return status;
+                       goto out;
                }
 
                status = rename_internals_fsp(conn, fsp, newname,
-                                             last_component_dest,
+                                             smb_fname_new->original_lcomp,
                                              attrs, replace_if_exists);
 
                close_file(req, fsp, NORMAL_CLOSE);
@@ -5713,7 +6142,7 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
                          nt_errstr(status), directory,newname));
 
-               return status;
+               goto out;
        }
 
        /*
@@ -5726,12 +6155,13 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
 
        status = check_name(conn, directory);
        if (!NT_STATUS_IS_OK(status)) {
-               return status;
+               goto out;
        }
 
        dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
        if (dir_hnd == NULL) {
-               return map_nt_error_from_unix(errno);
+               status = map_nt_error_from_unix(errno);
+               goto out;
        }
 
        status = NT_STATUS_NO_SUCH_FILE;
@@ -5740,7 +6170,7 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
         * - gentest fix. JRA
         */
 
-       while ((dname = ReadDirName(dir_hnd, &offset))) {
+       while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname->st))) {
                files_struct *fsp = NULL;
                char *fname = NULL;
                char *destname = NULL;
@@ -5755,7 +6185,8 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                        }
                }
 
-               if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
+               if (!is_visible_file(conn, directory, dname, &smb_fname->st,
+                                    False)) {
                        continue;
                }
 
@@ -5773,7 +6204,8 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                                directory,
                                dname);
                if (!fname) {
-                       return NT_STATUS_NO_MEMORY;
+                       status = NT_STATUS_NO_MEMORY;
+                       goto out;
                }
 
                if (!resolve_wildcards(ctx,
@@ -5784,26 +6216,45 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                        continue;
                }
                if (!destname) {
-                       return NT_STATUS_NO_MEMORY;
+                       status = NT_STATUS_NO_MEMORY;
+                       goto out;
                }
 
-               ZERO_STRUCT(sbuf1);
-               SMB_VFS_STAT(conn, fname, &sbuf1);
-
-               status = S_ISDIR(sbuf1.st_mode) ?
-                       open_directory(conn, req, fname, &sbuf1,
-                                      access_mask,
-                                      FILE_SHARE_READ|FILE_SHARE_WRITE,
-                                      FILE_OPEN, 0, 0, NULL,
-                                      &fsp)
-                       : open_file_ntcreate(conn, req, fname, &sbuf1,
-                                            access_mask,
-                                            FILE_SHARE_READ|FILE_SHARE_WRITE,
-                                            FILE_OPEN, 0, 0, 0, NULL,
-                                            &fsp);
+               ZERO_STRUCT(smb_fname->st);
+               if (posix_pathnames) {
+                       SMB_VFS_LSTAT(conn, fname, &smb_fname->st);
+               } else {
+                       SMB_VFS_STAT(conn, fname, &smb_fname->st);
+               }
+
+               create_options = 0;
+
+               if (S_ISDIR(smb_fname->st.st_mode)) {
+                       create_options |= FILE_DIRECTORY_FILE;
+               }
+
+               status = SMB_VFS_CREATE_FILE(
+                       conn,                           /* conn */
+                       req,                            /* req */
+                       0,                              /* root_dir_fid */
+                       fname,                          /* fname */
+                       0,                              /* create_file_flags */
+                       access_mask,                    /* access_mask */
+                       (FILE_SHARE_READ |              /* share_access */
+                           FILE_SHARE_WRITE),
+                       FILE_OPEN,                      /* create_disposition*/
+                       create_options,                 /* create_options */
+                       posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
+                       0,                              /* oplock_request */
+                       0,                              /* allocation_size */
+                       NULL,                           /* sd */
+                       NULL,                           /* ea_list */
+                       &fsp,                           /* result */
+                       NULL,                           /* pinfo */
+                       &smb_fname->st);                /* psbuf */
 
                if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(3,("rename_internals: open_file_ntcreate "
+                       DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
                                 "returned %s rename %s -> %s\n",
                                 nt_errstr(status), directory, newname));
                        break;
@@ -5835,6 +6286,9 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                status = map_nt_error_from_unix(errno);
        }
 
+ out:
+       TALLOC_FREE(smb_fname);
+       TALLOC_FREE(smb_fname_new);
        return status;
 }
 
@@ -5862,7 +6316,7 @@ void reply_mv(struct smb_request *req)
                return;
        }
 
-       attrs = SVAL(req->inbuf,smb_vwv0);
+       attrs = SVAL(req->vwv+0, 0);
 
        p = (const char *)req->buf + 1;
        p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
@@ -5994,14 +6448,24 @@ NTSTATUS copy_file(TALLOC_CTX *ctx,
                }
        }
 
-       status = open_file_ntcreate(conn, NULL, src, &src_sbuf,
-                       FILE_GENERIC_READ,
-                       FILE_SHARE_READ|FILE_SHARE_WRITE,
-                       FILE_OPEN,
-                       0,
-                       FILE_ATTRIBUTE_NORMAL,
-                       INTERNAL_OPEN_ONLY,
-                       NULL, &fsp1);
+       status = SMB_VFS_CREATE_FILE(
+               conn,                                   /* conn */
+               NULL,                                   /* req */
+               0,                                      /* root_dir_fid */
+               src,                                    /* fname */
+               0,                                      /* create_file_flags */
+               FILE_GENERIC_READ,                      /* access_mask */
+               FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
+               FILE_OPEN,                              /* create_disposition*/
+               0,                                      /* create_options */
+               FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
+               INTERNAL_OPEN_ONLY,                     /* oplock_request */
+               0,                                      /* allocation_size */
+               NULL,                                   /* sd */
+               NULL,                                   /* ea_list */
+               &fsp1,                                  /* result */
+               NULL,                                   /* pinfo */
+               &src_sbuf);                             /* psbuf */
 
        if (!NT_STATUS_IS_OK(status)) {
                TALLOC_FREE(dest);
@@ -6013,14 +6477,24 @@ NTSTATUS copy_file(TALLOC_CTX *ctx,
                ZERO_STRUCTP(&sbuf2);
        }
 
-       status = open_file_ntcreate(conn, NULL, dest, &sbuf2,
-                       FILE_GENERIC_WRITE,
-                       FILE_SHARE_READ|FILE_SHARE_WRITE,
-                       new_create_disposition,
-                       0,
-                       dosattrs,
-                       INTERNAL_OPEN_ONLY,
-                       NULL, &fsp2);
+       status = SMB_VFS_CREATE_FILE(
+               conn,                                   /* conn */
+               NULL,                                   /* req */
+               0,                                      /* root_dir_fid */
+               dest,                                   /* fname */
+               0,                                      /* create_file_flags */
+               FILE_GENERIC_WRITE,                     /* access_mask */
+               FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
+               new_create_disposition,                 /* create_disposition*/
+               0,                                      /* create_options */
+               dosattrs,                               /* file_attributes */
+               INTERNAL_OPEN_ONLY,                     /* oplock_request */
+               0,                                      /* allocation_size */
+               NULL,                                   /* sd */
+               NULL,                                   /* ea_list */
+               &fsp2,                                  /* result */
+               NULL,                                   /* pinfo */
+               &sbuf2);                                /* psbuf */
 
        TALLOC_FREE(dest);
 
@@ -6075,6 +6549,8 @@ NTSTATUS copy_file(TALLOC_CTX *ctx,
 void reply_copy(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
+       struct smb_filename *smb_fname = NULL;
+       struct smb_filename *smb_fname_new = NULL;
        char *name = NULL;
        char *newname = NULL;
        char *directory = NULL;
@@ -6090,7 +6566,6 @@ void reply_copy(struct smb_request *req)
        bool target_is_directory=False;
        bool source_has_wild = False;
        bool dest_has_wild = False;
-       SMB_STRUCT_STAT sbuf1, sbuf2;
        NTSTATUS status;
        TALLOC_CTX *ctx = talloc_tos();
 
@@ -6098,28 +6573,25 @@ void reply_copy(struct smb_request *req)
 
        if (req->wct < 3) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
-       tid2 = SVAL(req->inbuf,smb_vwv0);
-       ofun = SVAL(req->inbuf,smb_vwv1);
-       flags = SVAL(req->inbuf,smb_vwv2);
+       tid2 = SVAL(req->vwv+0, 0);
+       ofun = SVAL(req->vwv+1, 0);
+       flags = SVAL(req->vwv+2, 0);
 
        p = (const char *)req->buf;
        p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
                                       &status, &source_has_wild);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
        p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
                                       &status, &dest_has_wild);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
        DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
@@ -6128,8 +6600,7 @@ void reply_copy(struct smb_request *req)
                /* can't currently handle inter share copies XXXX */
                DEBUG(3,("Rejecting inter-share copy\n"));
                reply_doserror(req, ERRSRV, ERRinvdevice);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
        status = resolve_dfspath_wcard(ctx, conn,
@@ -6141,12 +6612,10 @@ void reply_copy(struct smb_request *req)
                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
                                        ERRSRV, ERRbadpath);
-                       END_PROFILE(SMBcopy);
-                       return;
+                       goto out;
                }
                reply_nterror(req, status);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
        status = resolve_dfspath_wcard(ctx, conn,
@@ -6158,50 +6627,55 @@ void reply_copy(struct smb_request *req)
                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
                                        ERRSRV, ERRbadpath);
-                       END_PROFILE(SMBcopy);
-                       return;
+                       goto out;
                }
                reply_nterror(req, status);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
-       status = unix_convert(ctx, conn, name, source_has_wild,
-                       &name, NULL, &sbuf1);
+       status = unix_convert(ctx, conn, name, &smb_fname,
+                             source_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
-       status = unix_convert(ctx, conn, newname, dest_has_wild,
-                       &newname, NULL, &sbuf2);
+       status = get_full_smb_filename(ctx, smb_fname, &name);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
+       }
+
+       status = unix_convert(ctx, conn, newname, &smb_fname_new,
+                             dest_has_wild ? UCF_ALLOW_WCARD_LCOMP : 0);
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
+               goto out;
+       }
+
+       status = get_full_smb_filename(ctx, smb_fname_new, &newname);
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
+               goto out;
        }
 
-       target_is_directory = VALID_STAT_OF_DIR(sbuf2);
+       target_is_directory = VALID_STAT_OF_DIR(smb_fname_new->st);
 
        if ((flags&1) && target_is_directory) {
                reply_doserror(req, ERRDOS, ERRbadfile);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
        if ((flags&2) && !target_is_directory) {
                reply_doserror(req, ERRDOS, ERRbadpath);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
-       if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
+       if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname->st)) {
                /* wants a tree copy! XXXX */
                DEBUG(3,("Rejecting tree copy\n"));
                reply_doserror(req, ERRSRV, ERRerror);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
        p = strrchr_m(name,'/');
@@ -6215,8 +6689,7 @@ void reply_copy(struct smb_request *req)
 
        if (!directory) {
                reply_nterror(req, NT_STATUS_NO_MEMORY);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
        /*
@@ -6228,7 +6701,8 @@ void reply_copy(struct smb_request *req)
         * Tine Smukavec <valentin.smukavec@hermes.si>.
         */
 
-       if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
+       if (!VALID_STAT(smb_fname->st) &&
+           mangle_is_mangled(mask, conn->params)) {
                char *new_mask = NULL;
                mangle_lookup_name_from_8_3(ctx,
                                        mask,
@@ -6248,8 +6722,7 @@ void reply_copy(struct smb_request *req)
                        if (!resolve_wildcards(ctx,
                                        directory,newname,&mod_newname)) {
                                reply_nterror(req, NT_STATUS_NO_MEMORY);
-                               END_PROFILE(SMBcopy);
-                               return;
+                               goto out;
                        }
                        newname = mod_newname;
                }
@@ -6257,15 +6730,13 @@ void reply_copy(struct smb_request *req)
                status = check_name(conn, directory);
                if (!NT_STATUS_IS_OK(status)) {
                        reply_nterror(req, status);
-                       END_PROFILE(SMBcopy);
-                       return;
+                       goto out;
                }
 
                status = check_name(conn, newname);
                if (!NT_STATUS_IS_OK(status)) {
                        reply_nterror(req, status);
-                       END_PROFILE(SMBcopy);
-                       return;
+                       goto out;
                }
 
                status = copy_file(ctx,conn,directory,newname,ofun,
@@ -6273,8 +6744,7 @@ void reply_copy(struct smb_request *req)
 
                if(!NT_STATUS_IS_OK(status)) {
                        reply_nterror(req, status);
-                       END_PROFILE(SMBcopy);
-                       return;
+                       goto out;
                } else {
                        count++;
                }
@@ -6290,21 +6760,20 @@ void reply_copy(struct smb_request *req)
                status = check_name(conn, directory);
                if (!NT_STATUS_IS_OK(status)) {
                        reply_nterror(req, status);
-                       END_PROFILE(SMBcopy);
-                       return;
+                       goto out;
                }
 
                dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
                if (dir_hnd == NULL) {
                        status = map_nt_error_from_unix(errno);
                        reply_nterror(req, status);
-                       END_PROFILE(SMBcopy);
-                       return;
+                       goto out;
                }
 
                error = ERRbadfile;
 
-               while ((dname = ReadDirName(dir_hnd, &offset))) {
+               while ((dname = ReadDirName(dir_hnd, &offset,
+                                           &smb_fname->st))) {
                        char *destname = NULL;
                        char *fname = NULL;
 
@@ -6312,7 +6781,8 @@ void reply_copy(struct smb_request *req)
                                continue;
                        }
 
-                       if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
+                       if (!is_visible_file(conn, directory, dname,
+                                            &smb_fname->st, False)) {
                                continue;
                        }
 
@@ -6328,8 +6798,7 @@ void reply_copy(struct smb_request *req)
                        if (!fname) {
                                TALLOC_FREE(dir_hnd);
                                reply_nterror(req, NT_STATUS_NO_MEMORY);
-                               END_PROFILE(SMBcopy);
-                               return;
+                               goto out;
                        }
 
                        if (!resolve_wildcards(ctx,
@@ -6339,24 +6808,21 @@ void reply_copy(struct smb_request *req)
                        if (!destname) {
                                TALLOC_FREE(dir_hnd);
                                reply_nterror(req, NT_STATUS_NO_MEMORY);
-                               END_PROFILE(SMBcopy);
-                               return;
+                               goto out;
                        }
 
                        status = check_name(conn, fname);
                        if (!NT_STATUS_IS_OK(status)) {
                                TALLOC_FREE(dir_hnd);
                                reply_nterror(req, status);
-                               END_PROFILE(SMBcopy);
-                               return;
+                               goto out;
                        }
 
                        status = check_name(conn, destname);
                        if (!NT_STATUS_IS_OK(status)) {
                                TALLOC_FREE(dir_hnd);
                                reply_nterror(req, status);
-                               END_PROFILE(SMBcopy);
-                               return;
+                               goto out;
                        }
 
                        DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
@@ -6377,18 +6843,18 @@ void reply_copy(struct smb_request *req)
                        /* Error on close... */
                        errno = err;
                        reply_unixerror(req, ERRHRD, ERRgeneral);
-                       END_PROFILE(SMBcopy);
-                       return;
+                       goto out;
                }
 
                reply_doserror(req, ERRDOS, error);
-               END_PROFILE(SMBcopy);
-               return;
+               goto out;
        }
 
        reply_outbuf(req, 1, 0);
        SSVAL(req->outbuf,smb_vwv0,count);
-
+ out:
+       TALLOC_FREE(smb_fname);
+       TALLOC_FREE(smb_fname_new);
        END_PROFILE(SMBcopy);
        return;
 }
@@ -6561,12 +7027,12 @@ void reply_lockingX(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv2));
-       locktype = CVAL(req->inbuf,smb_vwv3);
-       oplocklevel = CVAL(req->inbuf,smb_vwv3+1);
-       num_ulocks = SVAL(req->inbuf,smb_vwv6);
-       num_locks = SVAL(req->inbuf,smb_vwv7);
-       lock_timeout = IVAL(req->inbuf,smb_vwv4);
+       fsp = file_fsp(req, SVAL(req->vwv+2, 0));
+       locktype = CVAL(req->vwv+3, 0);
+       oplocklevel = CVAL(req->vwv+3, 1);
+       num_ulocks = SVAL(req->vwv+6, 0);
+       num_locks = SVAL(req->vwv+7, 0);
+       lock_timeout = IVAL(req->vwv+4, 0);
        large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
 
        if (!check_fsp(conn, req, fsp)) {
@@ -6648,23 +7114,15 @@ void reply_lockingX(struct smb_request *req)
                if (num_locks == 0 && num_ulocks == 0) {
                        /* Sanity check - ensure a pure oplock break is not a
                           chained request. */
-                       if(CVAL(req->inbuf,smb_vwv0) != 0xff)
+                       if(CVAL(req->vwv+0, 0) != 0xff)
                                DEBUG(0,("reply_lockingX: Error : pure oplock "
                                         "break is a chained %d request !\n",
-                                        (unsigned int)CVAL(req->inbuf,
-                                                           smb_vwv0) ));
+                                        (unsigned int)CVAL(req->vwv+0, 0)));
                        END_PROFILE(SMBlockingX);
                        return;
                }
        }
 
-       /*
-        * We do this check *after* we have checked this is not a oplock break
-        * response message. JRA.
-        */
-
-       release_level_2_oplocks_on_change(fsp);
-
        if (req->buflen <
            (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -6699,6 +7157,9 @@ void reply_lockingX(struct smb_request *req)
                                offset,
                                WINDOWS_LOCK);
 
+               DEBUG(10, ("reply_lockingX: unlock returned %s\n",
+                   nt_errstr(status)));
+
                if (NT_STATUS_V(status)) {
                        END_PROFILE(SMBlockingX);
                        reply_nterror(req, status);
@@ -6740,19 +7201,22 @@ void reply_lockingX(struct smb_request *req)
                          fsp->fsp_name, (int)lock_timeout ));
 
                if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
+                       struct blocking_lock_record *blr = NULL;
+
                        if (lp_blocking_locks(SNUM(conn))) {
 
                                /* Schedule a message to ourselves to
                                   remove the blocking lock record and
                                   return the right error. */
 
-                               if (!blocking_lock_cancel(fsp,
+                               blr = blocking_lock_cancel(fsp,
                                                lock_pid,
                                                offset,
                                                count,
                                                WINDOWS_LOCK,
                                                locktype,
-                                               NT_STATUS_FILE_LOCK_CONFLICT)) {
+                                               NT_STATUS_FILE_LOCK_CONFLICT);
+                               if (blr == NULL) {
                                        END_PROFILE(SMBlockingX);
                                        reply_nterror(
                                                req,
@@ -6767,7 +7231,8 @@ void reply_lockingX(struct smb_request *req)
                                                lock_pid,
                                                count,
                                                offset,
-                                               WINDOWS_LOCK);
+                                               WINDOWS_LOCK,
+                                               blr);
                } else {
                        bool blocking_lock = lock_timeout ? True : False;
                        bool defer_lock = False;
@@ -6783,7 +7248,8 @@ void reply_lockingX(struct smb_request *req)
                                        WINDOWS_LOCK,
                                        blocking_lock,
                                        &status,
-                                       &block_smbpid);
+                                       &block_smbpid,
+                                       NULL);
 
                        if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
                                /* Windows internal resolution for blocking locks seems
@@ -6924,12 +7390,13 @@ void reply_readbs(struct smb_request *req)
 void reply_setattrE(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
-       struct timespec ts[2];
+       struct smb_file_time ft;
        files_struct *fsp;
        SMB_STRUCT_STAT sbuf;
        NTSTATUS status;
 
        START_PROFILE(SMBsetattrE);
+       ZERO_STRUCT(ft);
 
        if (req->wct < 7) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -6937,7 +7404,7 @@ void reply_setattrE(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if(!fsp || (fsp->conn != conn)) {
                reply_doserror(req, ERRDOS, ERRbadfid);
@@ -6947,14 +7414,15 @@ void reply_setattrE(struct smb_request *req)
 
 
        /*
-        * Convert the DOS times into unix times. Ignore create
-        * time as UNIX can't set this.
+        * Convert the DOS times into unix times.
         */
 
-       ts[0] = convert_time_t_to_timespec(
-               srv_make_unix_date2(req->inbuf+smb_vwv3)); /* atime. */
-       ts[1] = convert_time_t_to_timespec(
-               srv_make_unix_date2(req->inbuf+smb_vwv5)); /* mtime. */
+       ft.atime = convert_time_t_to_timespec(
+           srv_make_unix_date2(req->vwv+3));
+       ft.mtime = convert_time_t_to_timespec(
+           srv_make_unix_date2(req->vwv+5));
+       ft.create_time = convert_time_t_to_timespec(
+           srv_make_unix_date2(req->vwv+1));
 
        reply_outbuf(req, 0, 0);
 
@@ -6972,7 +7440,14 @@ void reply_setattrE(struct smb_request *req)
                        return;
                }
        } else {
-               if (SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf) == -1) {
+               int ret = -1;
+
+               if (fsp->posix_open) {
+                       ret = SMB_VFS_LSTAT(conn, fsp->fsp_name, &sbuf);
+               } else {
+                       ret = SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf);
+               }
+               if (ret == -1) {
                        status = map_nt_error_from_unix(errno);
                        reply_nterror(req, status);
                        END_PROFILE(SMBsetattrE);
@@ -6981,17 +7456,20 @@ void reply_setattrE(struct smb_request *req)
        }
 
        status = smb_set_file_time(conn, fsp, fsp->fsp_name,
-                                  &sbuf, ts, true);
+                                  &sbuf, &ft, true);
        if (!NT_STATUS_IS_OK(status)) {
                reply_doserror(req, ERRDOS, ERRnoaccess);
                END_PROFILE(SMBsetattrE);
                return;
        }
 
-       DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u\n",
+       DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
+              " createtime=%u\n",
                fsp->fnum,
-               (unsigned int)ts[0].tv_sec,
-               (unsigned int)ts[1].tv_sec));
+               (unsigned int)ft.atime.tv_sec,
+               (unsigned int)ft.mtime.tv_sec,
+               (unsigned int)ft.create_time.tv_sec
+               ));
 
        END_PROFILE(SMBsetattrE);
        return;
@@ -7048,7 +7526,7 @@ void reply_getattrE(struct smb_request *req)
                return;
        }
 
-       fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+       fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
        if(!fsp || (fsp->conn != conn)) {
                reply_doserror(req, ERRDOS, ERRbadfid);
@@ -7084,7 +7562,7 @@ void reply_getattrE(struct smb_request *req)
                SIVAL(req->outbuf, smb_vwv6, 0);
                SIVAL(req->outbuf, smb_vwv8, 0);
        } else {
-               uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
+               uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
                SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
                SIVAL(req->outbuf, smb_vwv8, allocation_size);
        }