make sure we initialise query_maximal_access
[kai/samba.git] / source / smb_server / smb / reply.c
index 5e1f707aad11a46593d534070944ac9d20f64a59..9c4ee993d20129d445ccec18ab45cd9b4d34e8c2 100644 (file)
@@ -3,10 +3,11 @@
    Main SMB reply routines
    Copyright (C) Andrew Tridgell 1992-2003
    Copyright (C) James J Myers 2003 <myersjj@samba.org>
+   Copyright (C) Stefan Metzmacher 2006
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 /*
    This file handles most of the reply_ calls that the server
-   makes to handle specific protocols
+   makes to handle specific SMB commands
 */
 
 #include "includes.h"
 #include "smb_server/smb_server.h"
 #include "ntvfs/ntvfs.h"
+#include "librpc/gen_ndr/ndr_nbt.h"
 
 
-/* useful way of catching wct errors with file and line number */
-#define REQ_CHECK_WCT(req, wcount) do { \
-       if ((req)->in.wct != (wcount)) { \
-               DEBUG(1,("Unexpected WCT %d at %s(%d) - expected %d\n", \
-                        (req)->in.wct, __FILE__, __LINE__, wcount)); \
-               req_reply_dos_error(req, ERRSRV, ERRerror); \
-               return; \
-       }} while (0)
-
-/* check req->async_states->status and if not OK then send an error reply */
-#define CHECK_ASYNC_STATUS do { \
-       if (!NT_STATUS_IS_OK(req->async_states->status)) { \
-               req_reply_error(req, req->async_states->status); \
-               return; \
-       }} while (0)
-       
-/* useful wrapper for talloc with NO_MEMORY reply */
-#define REQ_TALLOC(ptr, size) do { \
-       ptr = talloc_size(req, size); \
-       if (!ptr) { \
-               req_reply_error(req, NT_STATUS_NO_MEMORY); \
-               return; \
-       }} while (0)
-
-/* 
-   check if the backend wants to handle the request asynchronously.
-   if it wants it handled synchronously then call the send function
-   immediately
-*/
-#define REQ_ASYNC_TAIL do { \
-       if (!(req->async_states->state & NTVFS_ASYNC_STATE_ASYNC)) { \
-               req->async_states->send_fn(req); \
-       }} while (0)
-
-/* zero out some reserved fields in a reply */
-#define REQ_VWV_RESERVED(start, count) memset(req->out.vwv + VWV(start), 0, (count)*2)
-
 /****************************************************************************
  Reply to a simple request (async send)
 ****************************************************************************/
-static void reply_simple_send(struct smbsrv_request *req)
+static void reply_simple_send(struct ntvfs_request *ntvfs)
 {
-       CHECK_ASYNC_STATUS;
+       struct smbsrv_request *req;
 
-       req_setup_reply(req, 0, 0);
-       req_send_reply(req);
+       SMBSRV_CHECK_ASYNC_STATUS_SIMPLE;
+
+       smbsrv_setup_reply(req, 0, 0);
+       smbsrv_send_reply(req);
 }
 
 
 /****************************************************************************
  Reply to a tcon.
 ****************************************************************************/
-void reply_tcon(struct smbsrv_request *req)
+void smbsrv_reply_tcon(struct smbsrv_request *req)
 {
        union smb_tcon con;
        NTSTATUS status;
        uint8_t *p;
        
        /* parse request */
-       REQ_CHECK_WCT(req, 0);
+       SMBSRV_CHECK_WCT(req, 0);
 
        con.tcon.level = RAW_TCON_TCON;
 
        p = req->in.data;       
-       p += req_pull_ascii4(req, &con.tcon.in.service, p, STR_TERMINATE);
-       p += req_pull_ascii4(req, &con.tcon.in.password, p, STR_TERMINATE);
-       p += req_pull_ascii4(req, &con.tcon.in.dev, p, STR_TERMINATE);
+       p += req_pull_ascii4(&req->in.bufinfo, &con.tcon.in.service, p, STR_TERMINATE);
+       p += req_pull_ascii4(&req->in.bufinfo, &con.tcon.in.password, p, STR_TERMINATE);
+       p += req_pull_ascii4(&req->in.bufinfo, &con.tcon.in.dev, p, STR_TERMINATE);
 
        if (!con.tcon.in.service || !con.tcon.in.password || !con.tcon.in.dev) {
-               req_reply_error(req, NT_STATUS_INVALID_PARAMETER);
+               smbsrv_send_error(req, NT_STATUS_INVALID_PARAMETER);
                return;
        }
 
        /* call backend */
-       status = tcon_backend(req, &con);
+       status = smbsrv_tcon_backend(req, &con);
 
        if (!NT_STATUS_IS_OK(status)) {
-               req_reply_error(req, status);
+               smbsrv_send_error(req, status);
                return;
        }
 
        /* construct reply */
-       req_setup_reply(req, 2, 0);
+       smbsrv_setup_reply(req, 2, 0);
 
        SSVAL(req->out.vwv, VWV(0), con.tcon.out.max_xmit);
        SSVAL(req->out.vwv, VWV(1), con.tcon.out.tid);
        SSVAL(req->out.hdr, HDR_TID, req->tcon->tid);
   
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 
 /****************************************************************************
  Reply to a tcon and X.
 ****************************************************************************/
-void reply_tcon_and_X(struct smbsrv_request *req)
+void smbsrv_reply_tcon_and_X(struct smbsrv_request *req)
 {
        NTSTATUS status;
        union smb_tcon con;
@@ -133,45 +99,45 @@ void reply_tcon_and_X(struct smbsrv_request *req)
        con.tconx.level = RAW_TCON_TCONX;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 4);
+       SMBSRV_CHECK_WCT(req, 4);
 
        con.tconx.in.flags  = SVAL(req->in.vwv, VWV(2));
        passlen             = SVAL(req->in.vwv, VWV(3));
 
        p = req->in.data;
 
-       if (!req_pull_blob(req, p, passlen, &con.tconx.in.password)) {
-               req_reply_error(req, NT_STATUS_ILL_FORMED_PASSWORD);
+       if (!req_pull_blob(&req->in.bufinfo, p, passlen, &con.tconx.in.password)) {
+               smbsrv_send_error(req, NT_STATUS_ILL_FORMED_PASSWORD);
                return;
        }
        p += passlen;
 
-       p += req_pull_string(req, &con.tconx.in.path, p, -1, STR_TERMINATE);
-       p += req_pull_string(req, &con.tconx.in.device, p, -1, STR_ASCII);
+       p += req_pull_string(&req->in.bufinfo, &con.tconx.in.path, p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &con.tconx.in.device, p, -1, STR_ASCII);
 
        if (!con.tconx.in.path || !con.tconx.in.device) {
-               req_reply_error(req, NT_STATUS_BAD_DEVICE_TYPE);
+               smbsrv_send_error(req, NT_STATUS_BAD_DEVICE_TYPE);
                return;
        }
 
        /* call backend */
-       status = tcon_backend(req, &con);
+       status = smbsrv_tcon_backend(req, &con);
 
        if (!NT_STATUS_IS_OK(status)) {
-               req_reply_error(req, status);
+               smbsrv_send_error(req, status);
                return;
        }
 
        /* construct reply - two variants */
        if (req->smb_conn->negotiate.protocol < PROTOCOL_NT1) {
-               req_setup_reply(req, 2, 0);
+               smbsrv_setup_reply(req, 2, 0);
 
                SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
                SSVAL(req->out.vwv, VWV(1), 0);
 
                req_push_str(req, NULL, con.tconx.out.dev_type, -1, STR_TERMINATE|STR_ASCII);
        } else {
-               req_setup_reply(req, 3, 0);
+               smbsrv_setup_reply(req, 3, 0);
 
                SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
                SSVAL(req->out.vwv, VWV(1), 0);
@@ -192,7 +158,7 @@ void reply_tcon_and_X(struct smbsrv_request *req)
 /****************************************************************************
  Reply to an unknown request
 ****************************************************************************/
-void reply_unknown(struct smbsrv_request *req)
+void smbsrv_reply_unknown(struct smbsrv_request *req)
 {
        int type;
 
@@ -200,277 +166,250 @@ void reply_unknown(struct smbsrv_request *req)
   
        DEBUG(0,("unknown command type %d (0x%X)\n", type, type));
 
-       req_reply_dos_error(req, ERRSRV, ERRunknownsmb);
+       smbsrv_send_error(req, NT_STATUS_DOS(ERRSRV, ERRunknownsmb));
 }
 
 
 /****************************************************************************
  Reply to an ioctl (async reply)
 ****************************************************************************/
-static void reply_ioctl_send(struct smbsrv_request *req)
+static void reply_ioctl_send(struct ntvfs_request *ntvfs)
 {
-       union smb_ioctl *io = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_ioctl *io;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(io, union smb_ioctl);
 
        /* the +1 is for nicer alignment */
-       req_setup_reply(req, 8, io->ioctl.out.blob.length+1);
+       smbsrv_setup_reply(req, 8, io->ioctl.out.blob.length+1);
        SSVAL(req->out.vwv, VWV(1), io->ioctl.out.blob.length);
        SSVAL(req->out.vwv, VWV(5), io->ioctl.out.blob.length);
        SSVAL(req->out.vwv, VWV(6), PTR_DIFF(req->out.data, req->out.hdr) + 1);
 
        memcpy(req->out.data+1, io->ioctl.out.blob.data, io->ioctl.out.blob.length);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to an ioctl.
 ****************************************************************************/
-void reply_ioctl(struct smbsrv_request *req)
+void smbsrv_reply_ioctl(struct smbsrv_request *req)
 {
        union smb_ioctl *io;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 3);
-       REQ_TALLOC(io, sizeof(*io));
-
-       io->ioctl.level = RAW_IOCTL_IOCTL;
-       io->ioctl.in.fnum     = req_fnum(req, req->in.vwv, VWV(0));
-       io->ioctl.in.request  = IVAL(req->in.vwv, VWV(1));
+       SMBSRV_CHECK_WCT(req, 3);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_ioctl);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_ioctl_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_ioctl_send;
-       req->async_states->private_data = io;
-
-       /* call backend */
-       req->async_states->status = ntvfs_ioctl(req, io);
+       io->ioctl.level         = RAW_IOCTL_IOCTL;
+       io->ioctl.in.file.ntvfs = smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
+       io->ioctl.in.request    = IVAL(req->in.vwv, VWV(1));
 
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE_ERROR(io->ioctl.in.file.ntvfs,
+                                      NT_STATUS_DOS(ERRSRV, ERRerror));
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_ioctl(req->ntvfs, io));
 }
 
 
 /****************************************************************************
  Reply to a chkpth.
 ****************************************************************************/
-void reply_chkpth(struct smbsrv_request *req)
+void smbsrv_reply_chkpth(struct smbsrv_request *req)
 {
-       struct smb_chkpath *io;
+       union smb_chkpath *io;
 
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_TALLOC_IO_PTR(io, union smb_chkpath);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       req_pull_ascii4(req, &io->in.path, req->in.data, STR_TERMINATE);
+       req_pull_ascii4(&req->in.bufinfo, &io->chkpath.in.path, req->in.data, STR_TERMINATE);
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       req->async_states->status = ntvfs_chkpath(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_chkpath(req->ntvfs, io));
 }
 
 /****************************************************************************
  Reply to a getatr (async reply)
 ****************************************************************************/
-static void reply_getatr_send(struct smbsrv_request *req)
+static void reply_getatr_send(struct ntvfs_request *ntvfs)
 {
-       union smb_fileinfo *st = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_fileinfo *st;
+
+       SMBSRV_CHECK_ASYNC_STATUS(st, union smb_fileinfo);
 
-       CHECK_ASYNC_STATUS;
-       
        /* construct reply */
-       req_setup_reply(req, 10, 0);
+       smbsrv_setup_reply(req, 10, 0);
 
        SSVAL(req->out.vwv,         VWV(0), st->getattr.out.attrib);
        srv_push_dos_date3(req->smb_conn, req->out.vwv, VWV(1), st->getattr.out.write_time);
        SIVAL(req->out.vwv,         VWV(3), st->getattr.out.size);
 
-       REQ_VWV_RESERVED(5, 5);
+       SMBSRV_VWV_RESERVED(5, 5);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 
 /****************************************************************************
  Reply to a getatr.
 ****************************************************************************/
-void reply_getatr(struct smbsrv_request *req)
+void smbsrv_reply_getatr(struct smbsrv_request *req)
 {
        union smb_fileinfo *st;
 
-       REQ_TALLOC(st, sizeof(*st));
+       SMBSRV_TALLOC_IO_PTR(st, union smb_fileinfo);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_getatr_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
        
        st->getattr.level = RAW_FILEINFO_GETATTR;
 
        /* parse request */
-       req_pull_ascii4(req, &st->getattr.in.fname, req->in.data, STR_TERMINATE);
-       if (!st->getattr.in.fname) {
-               req_reply_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
+       req_pull_ascii4(&req->in.bufinfo, &st->getattr.in.file.path, req->in.data, STR_TERMINATE);
+       if (!st->getattr.in.file.path) {
+               smbsrv_send_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_getatr_send;
-       req->async_states->private_data = st;
-
-       /* call backend */
-       req->async_states->status = ntvfs_qpathinfo(req, st);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_qpathinfo(req->ntvfs, st));
 }
 
 
 /****************************************************************************
  Reply to a setatr.
 ****************************************************************************/
-void reply_setatr(struct smbsrv_request *req)
+void smbsrv_reply_setatr(struct smbsrv_request *req)
 {
        union smb_setfileinfo *st;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 8);
-       REQ_TALLOC(st, sizeof(*st));
+       SMBSRV_CHECK_WCT(req, 8);
+       SMBSRV_TALLOC_IO_PTR(st, union smb_setfileinfo);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        st->setattr.level = RAW_SFILEINFO_SETATTR;
        st->setattr.in.attrib     = SVAL(req->in.vwv, VWV(0));
        st->setattr.in.write_time = srv_pull_dos_date3(req->smb_conn, req->in.vwv + VWV(1));
        
-       req_pull_ascii4(req, &st->setattr.file.fname, req->in.data, STR_TERMINATE);
+       req_pull_ascii4(&req->in.bufinfo, &st->setattr.in.file.path, req->in.data, STR_TERMINATE);
 
-       if (!st->setattr.file.fname) {
-               req_reply_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
+       if (!st->setattr.in.file.path) {
+               smbsrv_send_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                return;
        }
        
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_setpathinfo(req, st);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_setpathinfo(req->ntvfs, st));
 }
 
 
 /****************************************************************************
  Reply to a dskattr (async reply)
 ****************************************************************************/
-static void reply_dskattr_send(struct smbsrv_request *req)
+static void reply_dskattr_send(struct ntvfs_request *ntvfs)
 {
-       union smb_fsinfo *fs = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_fsinfo *fs;
+
+       SMBSRV_CHECK_ASYNC_STATUS(fs, union smb_fsinfo);
 
-       CHECK_ASYNC_STATUS;
-       
        /* construct reply */
-       req_setup_reply(req, 5, 0);
+       smbsrv_setup_reply(req, 5, 0);
 
        SSVAL(req->out.vwv, VWV(0), fs->dskattr.out.units_total);
        SSVAL(req->out.vwv, VWV(1), fs->dskattr.out.blocks_per_unit);
        SSVAL(req->out.vwv, VWV(2), fs->dskattr.out.block_size);
        SSVAL(req->out.vwv, VWV(3), fs->dskattr.out.units_free);
 
-       REQ_VWV_RESERVED(4, 1);
+       SMBSRV_VWV_RESERVED(4, 1);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 
 /****************************************************************************
  Reply to a dskattr.
 ****************************************************************************/
-void reply_dskattr(struct smbsrv_request *req)
+void smbsrv_reply_dskattr(struct smbsrv_request *req)
 {
        union smb_fsinfo *fs;
 
-       REQ_TALLOC(fs, sizeof(*fs));
+       SMBSRV_TALLOC_IO_PTR(fs, union smb_fsinfo);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_dskattr_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
        
        fs->dskattr.level = RAW_QFS_DSKATTR;
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_dskattr_send;
-       req->async_states->private_data = fs;
-
-       /* call backend */
-       req->async_states->status = ntvfs_fsinfo(req, fs);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_fsinfo(req->ntvfs, fs));
 }
 
 
-
 /****************************************************************************
  Reply to an open (async reply)
 ****************************************************************************/
-static void reply_open_send(struct smbsrv_request *req)
+static void reply_open_send(struct ntvfs_request *ntvfs)
 {
-       union smb_open *oi = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_open *oi;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(oi, union smb_open);
 
        /* construct reply */
-       req_setup_reply(req, 7, 0);
+       smbsrv_setup_reply(req, 7, 0);
 
-       SSVAL(req->out.vwv, VWV(0), oi->openold.out.fnum);
+       smbsrv_push_fnum(req->out.vwv, VWV(0), oi->openold.out.file.ntvfs);
        SSVAL(req->out.vwv, VWV(1), oi->openold.out.attrib);
        srv_push_dos_date3(req->smb_conn, req->out.vwv, VWV(2), oi->openold.out.write_time);
        SIVAL(req->out.vwv, VWV(4), oi->openold.out.size);
        SSVAL(req->out.vwv, VWV(6), oi->openold.out.rmode);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to an open.
 ****************************************************************************/
-void reply_open(struct smbsrv_request *req)
+void smbsrv_reply_open(struct smbsrv_request *req)
 {
        union smb_open *oi;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 2);
-       REQ_TALLOC(oi, sizeof(*oi));
+       SMBSRV_CHECK_WCT(req, 2);
+       SMBSRV_TALLOC_IO_PTR(oi, union smb_open);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_open_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        oi->openold.level = RAW_OPEN_OPEN;
        oi->openold.in.open_mode = SVAL(req->in.vwv, VWV(0));
        oi->openold.in.search_attrs = SVAL(req->in.vwv, VWV(1));
 
-       req_pull_ascii4(req, &oi->openold.in.fname, req->in.data, STR_TERMINATE);
+       req_pull_ascii4(&req->in.bufinfo, &oi->openold.in.fname, req->in.data, STR_TERMINATE);
 
        if (!oi->openold.in.fname) {
-               req_reply_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
+               smbsrv_send_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_open_send;
-       req->async_states->private_data = oi;
-       
-       /* call backend */
-       req->async_states->status = ntvfs_openfile(req, oi);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_open(req->ntvfs, oi));
 }
 
 
 /****************************************************************************
  Reply to an open and X (async reply)
 ****************************************************************************/
-static void reply_open_and_X_send(struct smbsrv_request *req)
+static void reply_open_and_X_send(struct ntvfs_request *ntvfs)
 {
-       union smb_open *oi = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_open *oi;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(oi, union smb_open);
 
        /* build the reply */
        if (oi->openx.in.flags & OPENX_FLAGS_EXTENDED_RETURN) {
-               req_setup_reply(req, 19, 0);
+               smbsrv_setup_reply(req, 19, 0);
        } else {
-               req_setup_reply(req, 15, 0);
+               smbsrv_setup_reply(req, 15, 0);
        }
 
        SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
        SSVAL(req->out.vwv, VWV(1), 0);
-       SSVAL(req->out.vwv, VWV(2), oi->openx.out.fnum);
+       smbsrv_push_fnum(req->out.vwv, VWV(2), oi->openx.out.file.ntvfs);
        SSVAL(req->out.vwv, VWV(3), oi->openx.out.attrib);
        srv_push_dos_date3(req->smb_conn, req->out.vwv, VWV(4), oi->openx.out.write_time);
        SIVAL(req->out.vwv, VWV(6), oi->openx.out.size);
@@ -482,10 +421,10 @@ static void reply_open_and_X_send(struct smbsrv_request *req)
        SSVAL(req->out.vwv, VWV(14),0); /* reserved */
        if (oi->openx.in.flags & OPENX_FLAGS_EXTENDED_RETURN) {
                SIVAL(req->out.vwv, VWV(15),oi->openx.out.access_mask);
-               REQ_VWV_RESERVED(17, 2);
+               SMBSRV_VWV_RESERVED(17, 2);
        }
 
-       req->chained_fnum = oi->openx.out.fnum;
+       req->chained_fnum = SVAL(req->out.vwv, VWV(2));
 
        smbsrv_chain_reply(req);
 }
@@ -494,13 +433,14 @@ static void reply_open_and_X_send(struct smbsrv_request *req)
 /****************************************************************************
  Reply to an open and X.
 ****************************************************************************/
-void reply_open_and_X(struct smbsrv_request *req)
+void smbsrv_reply_open_and_X(struct smbsrv_request *req)
 {
        union smb_open *oi;
 
        /* parse the request */
-       REQ_CHECK_WCT(req, 15);
-       REQ_TALLOC(oi, sizeof(*oi));
+       SMBSRV_CHECK_WCT(req, 15);
+       SMBSRV_TALLOC_IO_PTR(oi, union smb_open);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_open_and_X_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        oi->openx.level = RAW_OPEN_OPENX;
        oi->openx.in.flags        = SVAL(req->in.vwv, VWV(2));
@@ -512,52 +452,47 @@ void reply_open_and_X(struct smbsrv_request *req)
        oi->openx.in.size         = IVAL(req->in.vwv, VWV(9));
        oi->openx.in.timeout      = IVAL(req->in.vwv, VWV(11));
 
-       req_pull_ascii4(req, &oi->openx.in.fname, req->in.data, STR_TERMINATE);
+       req_pull_ascii4(&req->in.bufinfo, &oi->openx.in.fname, req->in.data, STR_TERMINATE);
 
        if (!oi->openx.in.fname) {
-               req_reply_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
+               smbsrv_send_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_open_and_X_send;
-       req->async_states->private_data = oi;
-
-       /* call the backend */
-       req->async_states->status = ntvfs_openfile(req, oi);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_open(req->ntvfs, oi));
 }
 
 
 /****************************************************************************
  Reply to a mknew or a create.
 ****************************************************************************/
-static void reply_mknew_send(struct smbsrv_request *req)
+static void reply_mknew_send(struct ntvfs_request *ntvfs)
 {
-       union smb_open *oi = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_open *oi;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(oi, union smb_open);
 
        /* build the reply */
-       req_setup_reply(req, 1, 0);
+       smbsrv_setup_reply(req, 1, 0);
 
-       SSVAL(req->out.vwv, VWV(0), oi->mknew.out.fnum);
+       smbsrv_push_fnum(req->out.vwv, VWV(0), oi->mknew.out.file.ntvfs);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 
 /****************************************************************************
  Reply to a mknew or a create.
 ****************************************************************************/
-void reply_mknew(struct smbsrv_request *req)
+void smbsrv_reply_mknew(struct smbsrv_request *req)
 {
        union smb_open *oi;
 
        /* parse the request */
-       REQ_CHECK_WCT(req, 3);
-       REQ_TALLOC(oi, sizeof(*oi));
+       SMBSRV_CHECK_WCT(req, 3);
+       SMBSRV_TALLOC_IO_PTR(oi, union smb_open);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_mknew_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        if (CVAL(req->in.hdr, HDR_COM) == SMBmknew) {
                oi->mknew.level = RAW_OPEN_MKNEW;
@@ -567,53 +502,48 @@ void reply_mknew(struct smbsrv_request *req)
        oi->mknew.in.attrib  = SVAL(req->in.vwv, VWV(0));
        oi->mknew.in.write_time  = srv_pull_dos_date3(req->smb_conn, req->in.vwv + VWV(1));
 
-       req_pull_ascii4(req, &oi->mknew.in.fname, req->in.data, STR_TERMINATE);
+       req_pull_ascii4(&req->in.bufinfo, &oi->mknew.in.fname, req->in.data, STR_TERMINATE);
 
        if (!oi->mknew.in.fname) {
-               req_reply_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
+               smbsrv_send_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_mknew_send;
-       req->async_states->private_data = oi;
-
-       /* call the backend */
-       req->async_states->status = ntvfs_openfile(req, oi);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_open(req->ntvfs, oi));
 }
 
 /****************************************************************************
  Reply to a create temporary file (async reply)
 ****************************************************************************/
-static void reply_ctemp_send(struct smbsrv_request *req)
+static void reply_ctemp_send(struct ntvfs_request *ntvfs)
 {
-       union smb_open *oi = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_open *oi;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(oi, union smb_open);
 
        /* build the reply */
-       req_setup_reply(req, 1, 0);
+       smbsrv_setup_reply(req, 1, 0);
 
-       SSVAL(req->out.vwv, VWV(0), oi->ctemp.out.fnum);
+       smbsrv_push_fnum(req->out.vwv, VWV(0), oi->ctemp.out.file.ntvfs);
 
        /* the returned filename is relative to the directory */
        req_push_str(req, NULL, oi->ctemp.out.name, -1, STR_TERMINATE | STR_ASCII);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a create temporary file.
 ****************************************************************************/
-void reply_ctemp(struct smbsrv_request *req)
+void smbsrv_reply_ctemp(struct smbsrv_request *req)
 {
        union smb_open *oi;
 
        /* parse the request */
-       REQ_CHECK_WCT(req, 3);
-       REQ_TALLOC(oi, sizeof(*oi));
+       SMBSRV_CHECK_WCT(req, 3);
+       SMBSRV_TALLOC_IO_PTR(oi, union smb_open);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_ctemp_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        oi->ctemp.level = RAW_OPEN_CTEMP;
        oi->ctemp.in.attrib = SVAL(req->in.vwv, VWV(0));
@@ -621,46 +551,34 @@ void reply_ctemp(struct smbsrv_request *req)
 
        /* the filename is actually a directory name, the server provides a filename
           in that directory */
-       req_pull_ascii4(req, &oi->ctemp.in.directory, req->in.data, STR_TERMINATE);
+       req_pull_ascii4(&req->in.bufinfo, &oi->ctemp.in.directory, req->in.data, STR_TERMINATE);
 
        if (!oi->ctemp.in.directory) {
-               req_reply_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
+               smbsrv_send_error(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_ctemp_send;
-       req->async_states->private_data = oi;
-
-       /* call the backend */
-       req->async_states->status = ntvfs_openfile(req, oi);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_open(req->ntvfs, oi));
 }
 
 
 /****************************************************************************
  Reply to a unlink
 ****************************************************************************/
-void reply_unlink(struct smbsrv_request *req)
+void smbsrv_reply_unlink(struct smbsrv_request *req)
 {
-       struct smb_unlink *unl;
+       union smb_unlink *unl;
 
        /* parse the request */
-       REQ_CHECK_WCT(req, 1);
-       REQ_TALLOC(unl, sizeof(*unl));
+       SMBSRV_CHECK_WCT(req, 1);
+       SMBSRV_TALLOC_IO_PTR(unl, union smb_unlink);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
        
-       unl->in.attrib = SVAL(req->in.vwv, VWV(0));
+       unl->unlink.in.attrib = SVAL(req->in.vwv, VWV(0));
 
-       req_pull_ascii4(req, &unl->in.pattern, req->in.data, STR_TERMINATE);
+       req_pull_ascii4(&req->in.bufinfo, &unl->unlink.in.pattern, req->in.data, STR_TERMINATE);
        
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_unlink(req, unl);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_unlink(req->ntvfs, unl));
 }
 
 
@@ -670,7 +588,7 @@ void reply_unlink(struct smbsrv_request *req)
  only the 4 byte NBT header
  This command must be replied to synchronously
 ****************************************************************************/
-void reply_readbraw(struct smbsrv_request *req)
+void smbsrv_reply_readbraw(struct smbsrv_request *req)
 {
        NTSTATUS status;
        union smb_read io;
@@ -682,12 +600,16 @@ void reply_readbraw(struct smbsrv_request *req)
                goto failed;
        }
 
-       io.readbraw.in.fnum    = req_fnum(req, req->in.vwv, VWV(0));
+       io.readbraw.in.file.ntvfs = smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
        io.readbraw.in.offset  = IVAL(req->in.vwv, VWV(1));
        io.readbraw.in.maxcnt  = SVAL(req->in.vwv, VWV(3));
        io.readbraw.in.mincnt  = SVAL(req->in.vwv, VWV(4));
        io.readbraw.in.timeout = IVAL(req->in.vwv, VWV(5));
 
+       if (!io.readbraw.in.file.ntvfs) {
+               goto failed;
+       }
+
        /* the 64 bit variant */
        if (req->in.wct == 10) {
                uint32_t offset_high = IVAL(req->in.vwv, VWV(8));
@@ -706,16 +628,25 @@ void reply_readbraw(struct smbsrv_request *req)
        /* tell the backend where to put the data */
        io.readbraw.out.data = req->out.buffer + NBT_HDR_SIZE;
 
-       /* call the backend */
-       status = ntvfs_read(req, &io);
+       /* prepare the ntvfs request */
+       req->ntvfs = ntvfs_request_create(req->tcon->ntvfs, req,
+                                         req->session->session_info,
+                                         SVAL(req->in.hdr,HDR_PID),
+                                         req->request_time,
+                                         req, NULL, 0);
+       if (!req->ntvfs) {
+               goto failed;
+       }
 
+       /* call the backend */
+       status = ntvfs_read(req->ntvfs, &io);
        if (!NT_STATUS_IS_OK(status)) {
                goto failed;
        }
 
        req->out.size = io.readbraw.out.nread + NBT_HDR_SIZE;
 
-       req_send_reply_nosign(req);
+       smbsrv_send_reply_nosign(req);
        return;
 
 failed:
@@ -724,18 +655,19 @@ failed:
        req->out.buffer = talloc_size(req, req->out.size);
        SIVAL(req->out.buffer, 0, 0); /* init NBT header */
 
-       req_send_reply_nosign(req);
+       smbsrv_send_reply_nosign(req);
 }
 
 
 /****************************************************************************
  Reply to a lockread (async reply)
 ****************************************************************************/
-static void reply_lockread_send(struct smbsrv_request *req)
+static void reply_lockread_send(struct ntvfs_request *ntvfs)
 {
-       union smb_read *io = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_read *io;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(io, union smb_read);
 
        /* trim packet */
        io->lockread.out.nread = MIN(io->lockread.out.nread,
@@ -744,12 +676,12 @@ static void reply_lockread_send(struct smbsrv_request *req)
 
        /* construct reply */
        SSVAL(req->out.vwv, VWV(0), io->lockread.out.nread);
-       REQ_VWV_RESERVED(1, 4);
+       SMBSRV_VWV_RESERVED(1, 4);
 
        SCVAL(req->out.data, 0, SMB_DATA_BLOCK);
        SSVAL(req->out.data, 1, io->lockread.out.nread);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 
@@ -757,34 +689,29 @@ static void reply_lockread_send(struct smbsrv_request *req)
  Reply to a lockread (core+ protocol).
  note that the lock is a write lock, not a read lock!
 ****************************************************************************/
-void reply_lockread(struct smbsrv_request *req)
+void smbsrv_reply_lockread(struct smbsrv_request *req)
 {
        union smb_read *io;
        
        /* parse request */
-       REQ_CHECK_WCT(req, 5);
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_CHECK_WCT(req, 5);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_read);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_lockread_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        io->lockread.level = RAW_READ_LOCKREAD;
-       io->lockread.in.fnum      = req_fnum(req, req->in.vwv, VWV(0));
+       io->lockread.in.file.ntvfs= smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
        io->lockread.in.count     = SVAL(req->in.vwv, VWV(1));
        io->lockread.in.offset    = IVAL(req->in.vwv, VWV(2));
        io->lockread.in.remaining = SVAL(req->in.vwv, VWV(4));
-       
+
        /* setup the reply packet assuming the maximum possible read */
-       req_setup_reply(req, 5, 3 + io->lockread.in.count);
+       smbsrv_setup_reply(req, 5, 3 + io->lockread.in.count);
 
        /* tell the backend where to put the data */
        io->lockread.out.data = req->out.data + 3;
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_lockread_send;
-       req->async_states->private_data = io;
-
-       /* call backend */
-       req->async_states->status = ntvfs_read(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->lockread.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_read(req->ntvfs, io));
 }
 
 
@@ -792,11 +719,12 @@ void reply_lockread(struct smbsrv_request *req)
 /****************************************************************************
  Reply to a read (async reply)
 ****************************************************************************/
-static void reply_read_send(struct smbsrv_request *req)
+static void reply_read_send(struct ntvfs_request *ntvfs)
 {
-       union smb_read *io = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_read *io;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(io, union smb_read);
 
        /* trim packet */
        io->read.out.nread = MIN(io->read.out.nread,
@@ -805,60 +733,54 @@ static void reply_read_send(struct smbsrv_request *req)
 
        /* construct reply */
        SSVAL(req->out.vwv, VWV(0), io->read.out.nread);
-       REQ_VWV_RESERVED(1, 4);
+       SMBSRV_VWV_RESERVED(1, 4);
 
        SCVAL(req->out.data, 0, SMB_DATA_BLOCK);
        SSVAL(req->out.data, 1, io->read.out.nread);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a read.
 ****************************************************************************/
-void reply_read(struct smbsrv_request *req)
+void smbsrv_reply_read(struct smbsrv_request *req)
 {
        union smb_read *io;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 5);
-       REQ_TALLOC(io, sizeof(*io));
-       
+       SMBSRV_CHECK_WCT(req, 5);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_read);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_read_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
+
        io->read.level = RAW_READ_READ;
-       io->read.in.fnum          = req_fnum(req, req->in.vwv, VWV(0));
+       io->read.in.file.ntvfs    = smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
        io->read.in.count         = SVAL(req->in.vwv, VWV(1));
        io->read.in.offset        = IVAL(req->in.vwv, VWV(2));
        io->read.in.remaining     = SVAL(req->in.vwv, VWV(4));
-       
+
        /* setup the reply packet assuming the maximum possible read */
-       req_setup_reply(req, 5, 3 + io->read.in.count);
+       smbsrv_setup_reply(req, 5, 3 + io->read.in.count);
 
        /* tell the backend where to put the data */
        io->read.out.data = req->out.data + 3;
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_read_send;
-       req->async_states->private_data = io;
-
-       /* call backend */
-       req->async_states->status = ntvfs_read(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->read.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_read(req->ntvfs, io));
 }
 
-
-
 /****************************************************************************
  Reply to a read and X (async reply)
 ****************************************************************************/
-static void reply_read_and_X_send(struct smbsrv_request *req)
+static void reply_read_and_X_send(struct ntvfs_request *ntvfs)
 {
-       union smb_read *io = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_read *io;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(io, union smb_read);
 
        /* readx reply packets can be over-sized */
-       req->control_flags |= REQ_CONTROL_LARGE;
+       req->control_flags |= SMBSRV_REQ_CONTROL_LARGE;
        if (io->readx.in.maxcnt != 0xFFFF &&
            io->readx.in.mincnt != 0xFFFF) {
                req_grow_data(req, 1 + io->readx.out.nread);
@@ -872,10 +794,10 @@ static void reply_read_and_X_send(struct smbsrv_request *req)
        SSVAL(req->out.vwv, VWV(1), 0);
        SSVAL(req->out.vwv, VWV(2), io->readx.out.remaining);
        SSVAL(req->out.vwv, VWV(3), io->readx.out.compaction_mode);
-       REQ_VWV_RESERVED(4, 1);
+       SMBSRV_VWV_RESERVED(4, 1);
        SSVAL(req->out.vwv, VWV(5), io->readx.out.nread);
        SSVAL(req->out.vwv, VWV(6), PTR_DIFF(io->readx.out.data, req->out.hdr));
-       REQ_VWV_RESERVED(7, 5);
+       SMBSRV_VWV_RESERVED(7, 5);
 
        smbsrv_chain_reply(req);
 }
@@ -883,23 +805,29 @@ static void reply_read_and_X_send(struct smbsrv_request *req)
 /****************************************************************************
  Reply to a read and X.
 ****************************************************************************/
-void reply_read_and_X(struct smbsrv_request *req)
+void smbsrv_reply_read_and_X(struct smbsrv_request *req)
 {
        union smb_read *io;
 
        /* parse request */
        if (req->in.wct != 12) {
-               REQ_CHECK_WCT(req, 10);
+               SMBSRV_CHECK_WCT(req, 10);
        }
 
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_TALLOC_IO_PTR(io, union smb_read);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_read_and_X_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        io->readx.level = RAW_READ_READX;
-       io->readx.in.fnum          = req_fnum(req, req->in.vwv, VWV(2));
+       io->readx.in.file.ntvfs    = smbsrv_pull_fnum(req, req->in.vwv, VWV(2));
        io->readx.in.offset        = IVAL(req->in.vwv, VWV(3));
        io->readx.in.maxcnt        = SVAL(req->in.vwv, VWV(5));
        io->readx.in.mincnt        = SVAL(req->in.vwv, VWV(6));
        io->readx.in.remaining     = SVAL(req->in.vwv, VWV(9));
+       if (req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) {
+               io->readx.in.read_for_execute = true;
+       } else {
+               io->readx.in.read_for_execute = false;
+       }
 
        if (req->smb_conn->negotiate.client_caps & CAP_LARGE_READX) {
                uint32_t high_part = IVAL(req->in.vwv, VWV(7));
@@ -915,7 +843,7 @@ void reply_read_and_X(struct smbsrv_request *req)
        }
 
        /* setup the reply packet assuming the maximum possible read */
-       req_setup_reply(req, 12, 1 + io->readx.in.maxcnt);
+       smbsrv_setup_reply(req, 12, 1 + io->readx.in.maxcnt);
 
        /* tell the backend where to put the data. Notice the pad byte. */
        if (io->readx.in.maxcnt != 0xFFFF &&
@@ -925,55 +853,51 @@ void reply_read_and_X(struct smbsrv_request *req)
                io->readx.out.data = req->out.data;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_read_and_X_send;
-       req->async_states->private_data = io;
-
-       /* call backend */
-       req->async_states->status = ntvfs_read(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->readx.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_read(req->ntvfs, io));
 }
 
 
 /****************************************************************************
  Reply to a writebraw (core+ or LANMAN1.0 protocol).
 ****************************************************************************/
-void reply_writebraw(struct smbsrv_request *req)
+void smbsrv_reply_writebraw(struct smbsrv_request *req)
 {
-       req_reply_dos_error(req, ERRSRV, ERRuseSTD);
+       smbsrv_send_error(req, NT_STATUS_DOS(ERRSRV, ERRuseSTD));
 }
 
 
 /****************************************************************************
  Reply to a writeunlock (async reply)
 ****************************************************************************/
-static void reply_writeunlock_send(struct smbsrv_request *req)
+static void reply_writeunlock_send(struct ntvfs_request *ntvfs)
 {
-       union smb_write *io = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_write *io;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(io, union smb_write);
 
        /* construct reply */
-       req_setup_reply(req, 1, 0);
+       smbsrv_setup_reply(req, 1, 0);
 
        SSVAL(req->out.vwv, VWV(0), io->writeunlock.out.nwritten);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a writeunlock (core+).
 ****************************************************************************/
-void reply_writeunlock(struct smbsrv_request *req)
+void smbsrv_reply_writeunlock(struct smbsrv_request *req)
 {
        union smb_write *io;
 
-       REQ_CHECK_WCT(req, 5);
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_CHECK_WCT(req, 5);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_write);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_writeunlock_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        io->writeunlock.level = RAW_WRITE_WRITEUNLOCK;
-       io->writeunlock.in.fnum        = req_fnum(req, req->in.vwv, VWV(0));
+       io->writeunlock.in.file.ntvfs  = smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
        io->writeunlock.in.count       = SVAL(req->in.vwv, VWV(1));
        io->writeunlock.in.offset      = IVAL(req->in.vwv, VWV(2));
        io->writeunlock.in.remaining   = SVAL(req->in.vwv, VWV(4));
@@ -981,24 +905,18 @@ void reply_writeunlock(struct smbsrv_request *req)
 
        /* make sure they gave us the data they promised */
        if (io->writeunlock.in.count+3 > req->in.data_size) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
        /* make sure the data block is big enough */
        if (SVAL(req->in.data, 1) < io->writeunlock.in.count) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_writeunlock_send;
-       req->async_states->private_data = io;
-
-       /* call backend */
-       req->async_states->status = ntvfs_write(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->writeunlock.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_write(req->ntvfs, io));
 }
 
 
@@ -1006,78 +924,75 @@ void reply_writeunlock(struct smbsrv_request *req)
 /****************************************************************************
  Reply to a write (async reply)
 ****************************************************************************/
-static void reply_write_send(struct smbsrv_request *req)
+static void reply_write_send(struct ntvfs_request *ntvfs)
 {
-       union smb_write *io = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_write *io;
        
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(io, union smb_write);
 
        /* construct reply */
-       req_setup_reply(req, 1, 0);
+       smbsrv_setup_reply(req, 1, 0);
 
        SSVAL(req->out.vwv, VWV(0), io->write.out.nwritten);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a write
 ****************************************************************************/
-void reply_write(struct smbsrv_request *req)
+void smbsrv_reply_write(struct smbsrv_request *req)
 {
        union smb_write *io;
 
-       REQ_CHECK_WCT(req, 5);
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_CHECK_WCT(req, 5);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_write);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_write_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        io->write.level = RAW_WRITE_WRITE;
-       io->write.in.fnum        = req_fnum(req, req->in.vwv, VWV(0));
+       io->write.in.file.ntvfs  = smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
        io->write.in.count       = SVAL(req->in.vwv, VWV(1));
        io->write.in.offset      = IVAL(req->in.vwv, VWV(2));
        io->write.in.remaining   = SVAL(req->in.vwv, VWV(4));
        io->write.in.data        = req->in.data + 3;
 
        /* make sure they gave us the data they promised */
-       if (req_data_oob(req, io->write.in.data, io->write.in.count)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (req_data_oob(&req->in.bufinfo, io->write.in.data, io->write.in.count)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
        /* make sure the data block is big enough */
        if (SVAL(req->in.data, 1) < io->write.in.count) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_write_send;
-       req->async_states->private_data = io;
-
-       /* call backend */
-       req->async_states->status = ntvfs_write(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->write.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_write(req->ntvfs, io));
 }
 
 
 /****************************************************************************
  Reply to a write and X (async reply)
 ****************************************************************************/
-static void reply_write_and_X_send(struct smbsrv_request *req)
+static void reply_write_and_X_send(struct ntvfs_request *ntvfs)
 {
-       union smb_write *io = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_write *io;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(io, union smb_write);
 
        /* construct reply */
-       req_setup_reply(req, 6, 0);
+       smbsrv_setup_reply(req, 6, 0);
 
        SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
        SSVAL(req->out.vwv, VWV(1), 0);
        SSVAL(req->out.vwv, VWV(2), io->writex.out.nwritten & 0xFFFF);
        SSVAL(req->out.vwv, VWV(3), io->writex.out.remaining);
        SSVAL(req->out.vwv, VWV(4), io->writex.out.nwritten >> 16);
-       REQ_VWV_RESERVED(5, 1);
+       SMBSRV_VWV_RESERVED(5, 1);
 
        smbsrv_chain_reply(req);
 }
@@ -1085,18 +1000,19 @@ static void reply_write_and_X_send(struct smbsrv_request *req)
 /****************************************************************************
  Reply to a write and X.
 ****************************************************************************/
-void reply_write_and_X(struct smbsrv_request *req)
+void smbsrv_reply_write_and_X(struct smbsrv_request *req)
 {
        union smb_write *io;
        
        if (req->in.wct != 14) {
-               REQ_CHECK_WCT(req, 12);
+               SMBSRV_CHECK_WCT(req, 12);
        }
 
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_TALLOC_IO_PTR(io, union smb_write);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_write_and_X_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        io->writex.level = RAW_WRITE_WRITEX;
-       io->writex.in.fnum      = req_fnum(req, req->in.vwv, VWV(2));
+       io->writex.in.file.ntvfs= smbsrv_pull_fnum(req, req->in.vwv, VWV(2));
        io->writex.in.offset    = IVAL(req->in.vwv, VWV(3));
        io->writex.in.wmode     = SVAL(req->in.vwv, VWV(7));
        io->writex.in.remaining = SVAL(req->in.vwv, VWV(8));
@@ -1111,262 +1027,222 @@ void reply_write_and_X(struct smbsrv_request *req)
        }
 
        /* make sure the data is in bounds */
-       if (req_data_oob(req, io->writex.in.data, io->writex.in.count)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (req_data_oob(&req->in.bufinfo, io->writex.in.data, io->writex.in.count)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
-       } 
-
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_write_and_X_send;
-       req->async_states->private_data = io;
-
-       /* call backend */
-       req->async_states->status = ntvfs_write(req, io);
+       }
 
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->writex.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_write(req->ntvfs, io));
 }
 
 
 /****************************************************************************
  Reply to a lseek (async reply)
 ****************************************************************************/
-static void reply_lseek_send(struct smbsrv_request *req)
+static void reply_lseek_send(struct ntvfs_request *ntvfs)
 {
-       struct smb_seek *io = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_seek *io;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(io, union smb_seek);
 
        /* construct reply */
-       req_setup_reply(req, 2, 0);
+       smbsrv_setup_reply(req, 2, 0);
 
-       SIVALS(req->out.vwv, VWV(0), io->out.offset);
+       SIVALS(req->out.vwv, VWV(0), io->lseek.out.offset);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a lseek.
 ****************************************************************************/
-void reply_lseek(struct smbsrv_request *req)
+void smbsrv_reply_lseek(struct smbsrv_request *req)
 {
-       struct smb_seek *io;
-
-       REQ_CHECK_WCT(req, 4);
-       REQ_TALLOC(io, sizeof(*io));
+       union smb_seek *io;
 
-       io->in.fnum   = req_fnum(req, req->in.vwv,  VWV(0));
-       io->in.mode   = SVAL(req->in.vwv,  VWV(1));
-       io->in.offset = IVALS(req->in.vwv, VWV(2));
+       SMBSRV_CHECK_WCT(req, 4);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_seek);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_lseek_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_lseek_send;
-       req->async_states->private_data = io;
-       
-       /* call backend */
-       req->async_states->status = ntvfs_seek(req, io);
+       io->lseek.in.file.ntvfs = smbsrv_pull_fnum(req, req->in.vwv,  VWV(0));
+       io->lseek.in.mode       = SVAL(req->in.vwv,  VWV(1));
+       io->lseek.in.offset     = IVALS(req->in.vwv, VWV(2));
 
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->lseek.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_seek(req->ntvfs, io));
 }
 
 /****************************************************************************
  Reply to a flush.
 ****************************************************************************/
-void reply_flush(struct smbsrv_request *req)
+void smbsrv_reply_flush(struct smbsrv_request *req)
 {
-       struct smb_flush *io;
+       union smb_flush *io;
+       uint16_t fnum;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 1);
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_CHECK_WCT(req, 1);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_flush);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       io->in.fnum   = req_fnum(req, req->in.vwv,  VWV(0));
-       
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_flush(req, io);
-       
-       REQ_ASYNC_TAIL;
-}
-
-
-/****************************************************************************
- Reply to a exit. This closes all files open by a smbpid
-****************************************************************************/
-void reply_exit(struct smbsrv_request *req)
-{
-       NTSTATUS status;
-       struct smbsrv_tcon *tcon;
-       REQ_CHECK_WCT(req, 0);
-
-       for (tcon=req->smb_conn->smb_tcons.list;tcon;tcon=tcon->next) {
-               req->tcon = tcon;
-               status = ntvfs_exit(req);
-               req->tcon = NULL;
-               if (!NT_STATUS_IS_OK(status)) {
-                       req_reply_error(req, status);
-                       return;
-               }
+       fnum = SVAL(req->in.vwv,  VWV(0));
+       if (fnum == 0xFFFF) {
+               io->flush_all.level     = RAW_FLUSH_ALL;
+       } else {
+               io->flush.level         = RAW_FLUSH_FLUSH;
+               io->flush.in.file.ntvfs = smbsrv_pull_fnum(req, req->in.vwv,  VWV(0));
+               SMBSRV_CHECK_FILE_HANDLE(io->flush.in.file.ntvfs);
        }
 
-       req_setup_reply(req, 0, 0);
-       req_send_reply(req);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_flush(req->ntvfs, io));
 }
 
-
 /****************************************************************************
  Reply to a close 
 
  Note that this has to deal with closing a directory opened by NT SMB's.
 ****************************************************************************/
-void reply_close(struct smbsrv_request *req)
+void smbsrv_reply_close(struct smbsrv_request *req)
 {
        union smb_close *io;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 3);
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_CHECK_WCT(req, 3);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_close);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        io->close.level = RAW_CLOSE_CLOSE;
-       io->close.in.fnum  = req_fnum(req, req->in.vwv,  VWV(0));
+       io->close.in.file.ntvfs = smbsrv_pull_fnum(req, req->in.vwv,  VWV(0));
        io->close.in.write_time = srv_pull_dos_date3(req->smb_conn, req->in.vwv + VWV(1));
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_close(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->close.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_close(req->ntvfs, io));
 }
 
 
-
 /****************************************************************************
  Reply to a writeclose (async reply)
 ****************************************************************************/
-static void reply_writeclose_send(struct smbsrv_request *req)
+static void reply_writeclose_send(struct ntvfs_request *ntvfs)
 {
-       union smb_write *io = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_write *io;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(io, union smb_write);
 
        /* construct reply */
-       req_setup_reply(req, 1, 0);
+       smbsrv_setup_reply(req, 1, 0);
 
        SSVAL(req->out.vwv, VWV(0), io->write.out.nwritten);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a writeclose (Core+ protocol).
 ****************************************************************************/
-void reply_writeclose(struct smbsrv_request *req)
+void smbsrv_reply_writeclose(struct smbsrv_request *req)
 {
        union smb_write *io;
 
        /* this one is pretty weird - the wct can be 6 or 12 */
        if (req->in.wct != 12) {
-               REQ_CHECK_WCT(req, 6);
+               SMBSRV_CHECK_WCT(req, 6);
        }
 
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_TALLOC_IO_PTR(io, union smb_write);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_writeclose_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       io->writeclose.level = RAW_WRITE_WRITECLOSE;
-       io->writeclose.in.fnum   = req_fnum(req, req->in.vwv, VWV(0));
-       io->writeclose.in.count  = SVAL(req->in.vwv, VWV(1));
-       io->writeclose.in.offset = IVAL(req->in.vwv, VWV(2));
-       io->writeclose.in.mtime  = srv_pull_dos_date3(req->smb_conn, req->in.vwv + VWV(4));
-       io->writeclose.in.data   = req->in.data + 1;
+       io->writeclose.level            = RAW_WRITE_WRITECLOSE;
+       io->writeclose.in.file.ntvfs    = smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
+       io->writeclose.in.count         = SVAL(req->in.vwv, VWV(1));
+       io->writeclose.in.offset        = IVAL(req->in.vwv, VWV(2));
+       io->writeclose.in.mtime         = srv_pull_dos_date3(req->smb_conn, req->in.vwv + VWV(4));
+       io->writeclose.in.data          = req->in.data + 1;
 
        /* make sure they gave us the data they promised */
-       if (req_data_oob(req, io->writeclose.in.data, io->writeclose.in.count)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (req_data_oob(&req->in.bufinfo, io->writeclose.in.data, io->writeclose.in.count)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_writeclose_send;
-       req->async_states->private_data = io;
-
-       /* call backend */
-       req->async_states->status = ntvfs_write(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->writeclose.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_write(req->ntvfs, io));
 }
 
 /****************************************************************************
  Reply to a lock.
 ****************************************************************************/
-void reply_lock(struct smbsrv_request *req)
+void smbsrv_reply_lock(struct smbsrv_request *req)
 {
        union smb_lock *lck;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 5);
-       REQ_TALLOC(lck, sizeof(*lck));
+       SMBSRV_CHECK_WCT(req, 5);
+       SMBSRV_TALLOC_IO_PTR(lck, union smb_lock);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       lck->lock.level     = RAW_LOCK_LOCK;
-       lck->lock.in.fnum   = req_fnum(req, req->in.vwv, VWV(0));
-       lck->lock.in.count  = IVAL(req->in.vwv, VWV(1));
-       lck->lock.in.offset = IVAL(req->in.vwv, VWV(3));
+       lck->lock.level         = RAW_LOCK_LOCK;
+       lck->lock.in.file.ntvfs = smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
+       lck->lock.in.count      = IVAL(req->in.vwv, VWV(1));
+       lck->lock.in.offset     = IVAL(req->in.vwv, VWV(3));
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_lock(req, lck);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(lck->lock.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_lock(req->ntvfs, lck));
 }
 
 
 /****************************************************************************
  Reply to a unlock.
 ****************************************************************************/
-void reply_unlock(struct smbsrv_request *req)
+void smbsrv_reply_unlock(struct smbsrv_request *req)
 {
        union smb_lock *lck;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 5);
-       REQ_TALLOC(lck, sizeof(*lck));
+       SMBSRV_CHECK_WCT(req, 5);
+       SMBSRV_TALLOC_IO_PTR(lck, union smb_lock);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       lck->unlock.level = RAW_LOCK_UNLOCK;
-       lck->unlock.in.fnum   = req_fnum(req, req->in.vwv, VWV(0));
-       lck->unlock.in.count  = IVAL(req->in.vwv, VWV(1));
-       lck->unlock.in.offset = IVAL(req->in.vwv, VWV(3));
-
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_lock(req, lck);
+       lck->unlock.level               = RAW_LOCK_UNLOCK;
+       lck->unlock.in.file.ntvfs       = smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
+       lck->unlock.in.count            = IVAL(req->in.vwv, VWV(1));
+       lck->unlock.in.offset           = IVAL(req->in.vwv, VWV(3));
 
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(lck->unlock.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_lock(req->ntvfs, lck));
 }
 
 
 /****************************************************************************
  Reply to a tdis.
 ****************************************************************************/
-void reply_tdis(struct smbsrv_request *req)
+void smbsrv_reply_tdis(struct smbsrv_request *req)
 {
-       REQ_CHECK_WCT(req, 0);
+       struct smbsrv_handle *h, *nh;
 
-       if (req->tcon == NULL) {
-               req_reply_error(req, NT_STATUS_INVALID_HANDLE);
-               return;
+       SMBSRV_CHECK_WCT(req, 0);
+
+       /*
+        * TODO: cancel all pending requests on this tcon
+        */
+
+       /*
+        * close all handles on this tcon
+        */
+       for (h=req->tcon->handles.list; h; h=nh) {
+               nh = h->next;
+               talloc_free(h);
        }
 
+       /* finally destroy the tcon */
        talloc_free(req->tcon);
+       req->tcon = NULL;
 
-       /* construct reply */
-       req_setup_reply(req, 0, 0);
-
-       req_send_reply(req);
+       smbsrv_setup_reply(req, 0, 0);
+       smbsrv_send_reply(req);
 }
 
 
@@ -1374,16 +1250,16 @@ void reply_tdis(struct smbsrv_request *req)
  Reply to a echo. This is one of the few calls that is handled directly (the
  backends don't see it at all)
 ****************************************************************************/
-void reply_echo(struct smbsrv_request *req)
+void smbsrv_reply_echo(struct smbsrv_request *req)
 {
        uint16_t count;
        int i;
 
-       REQ_CHECK_WCT(req, 0);
+       SMBSRV_CHECK_WCT(req, 1);
 
        count = SVAL(req->in.vwv, VWV(0));
 
-       req_setup_reply(req, 1, req->in.data_size);
+       smbsrv_setup_reply(req, 1, req->in.data_size);
 
        memcpy(req->out.data, req->in.data, req->in.data_size);
 
@@ -1391,13 +1267,13 @@ void reply_echo(struct smbsrv_request *req)
                struct smbsrv_request *this_req;
                
                if (i != count) {
-                       this_req = req_setup_secondary(req);
+                       this_req = smbsrv_setup_secondary_request(req);
                } else {
                        this_req = req;
                }
 
                SSVAL(this_req->out.vwv, VWV(0), i);
-               req_send_reply(this_req);
+               smbsrv_send_reply(this_req);
        }
 }
 
@@ -1406,83 +1282,75 @@ void reply_echo(struct smbsrv_request *req)
 /****************************************************************************
  Reply to a printopen (async reply)
 ****************************************************************************/
-static void reply_printopen_send(struct smbsrv_request *req)
+static void reply_printopen_send(struct ntvfs_request *ntvfs)
 {
-       union smb_open *oi = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_open *oi;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(oi, union smb_open);
 
        /* construct reply */
-       req_setup_reply(req, 1, 0);
+       smbsrv_setup_reply(req, 1, 0);
 
-       SSVAL(req->out.vwv, VWV(0), oi->openold.out.fnum);
+       smbsrv_push_fnum(req->out.vwv, VWV(0), oi->openold.out.file.ntvfs);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a printopen.
 ****************************************************************************/
-void reply_printopen(struct smbsrv_request *req)
+void smbsrv_reply_printopen(struct smbsrv_request *req)
 {
        union smb_open *oi;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 2);
-       REQ_TALLOC(oi, sizeof(*oi));
+       SMBSRV_CHECK_WCT(req, 2);
+       SMBSRV_TALLOC_IO_PTR(oi, union smb_open);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_printopen_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        oi->splopen.level = RAW_OPEN_SPLOPEN;
        oi->splopen.in.setup_length = SVAL(req->in.vwv, VWV(0));
        oi->splopen.in.mode         = SVAL(req->in.vwv, VWV(1));
 
-       req_pull_ascii4(req, &oi->splopen.in.ident, req->in.data, STR_TERMINATE);
-
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_printopen_send;
-       req->async_states->private_data = oi;
+       req_pull_ascii4(&req->in.bufinfo, &oi->splopen.in.ident, req->in.data, STR_TERMINATE);
 
-       /* call backend */
-       req->async_states->status = ntvfs_openfile(req, oi);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_open(req->ntvfs, oi));
 }
 
 /****************************************************************************
  Reply to a printclose.
 ****************************************************************************/
-void reply_printclose(struct smbsrv_request *req)
+void smbsrv_reply_printclose(struct smbsrv_request *req)
 {
        union smb_close *io;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 3);
-       REQ_TALLOC(io, sizeof(*io));
-
-       io->splclose.level = RAW_CLOSE_SPLCLOSE;
-       io->splclose.in.fnum = req_fnum(req, req->in.vwv,  VWV(0));
+       SMBSRV_CHECK_WCT(req, 3);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_close);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
+       io->splclose.level              = RAW_CLOSE_SPLCLOSE;
+       io->splclose.in.file.ntvfs      = smbsrv_pull_fnum(req, req->in.vwv,  VWV(0));
 
-       /* call backend */
-       req->async_states->status = ntvfs_close(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->splclose.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_close(req->ntvfs, io));
 }
 
 /****************************************************************************
  Reply to a printqueue.
 ****************************************************************************/
-void reply_printqueue_send(struct smbsrv_request *req)
+static void reply_printqueue_send(struct ntvfs_request *ntvfs)
 {
-       union smb_lpq *lpq = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_lpq *lpq;
        int i, maxcount;
-       const uint_t el_size = 28;      
+       const uint_t el_size = 28;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(lpq,union smb_lpq);
 
        /* construct reply */
-       req_setup_reply(req, 2, 0);
+       smbsrv_setup_reply(req, 2, 0);
 
        /* truncate the returned list to fit in the negotiated buffer size */
        maxcount = (req_max_data(req) - 3) / el_size;
@@ -1512,165 +1380,140 @@ void reply_printqueue_send(struct smbsrv_request *req)
                req->out.ptr += el_size;
        }
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a printqueue.
 ****************************************************************************/
-void reply_printqueue(struct smbsrv_request *req)
+void smbsrv_reply_printqueue(struct smbsrv_request *req)
 {
        union smb_lpq *lpq;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 2);
-       REQ_TALLOC(lpq, sizeof(*lpq));
+       SMBSRV_CHECK_WCT(req, 2);
+       SMBSRV_TALLOC_IO_PTR(lpq, union smb_lpq);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_printqueue_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        lpq->retq.level = RAW_LPQ_RETQ;
        lpq->retq.in.maxcount = SVAL(req->in.vwv,  VWV(0));
        lpq->retq.in.startidx = SVAL(req->in.vwv,  VWV(1));
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_printqueue_send;
-       req->async_states->private_data = lpq;
-
-       /* call backend */
-       req->async_states->status = ntvfs_lpq(req, lpq);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_lpq(req->ntvfs, lpq));
 }
 
 
 /****************************************************************************
  Reply to a printwrite.
 ****************************************************************************/
-void reply_printwrite(struct smbsrv_request *req)
+void smbsrv_reply_printwrite(struct smbsrv_request *req)
 {
        union smb_write *io;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 1);
-       REQ_TALLOC(io, sizeof(*io));
-
-       io->splwrite.level = RAW_WRITE_SPLWRITE;
+       SMBSRV_CHECK_WCT(req, 1);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_write);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        if (req->in.data_size < 3) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
-       io->splwrite.in.fnum  = req_fnum(req, req->in.vwv, VWV(0));
-       io->splwrite.in.count = SVAL(req->in.data, 1);
-       io->splwrite.in.data  = req->in.data + 3;
+       io->splwrite.level              = RAW_WRITE_SPLWRITE;
+       io->splwrite.in.file.ntvfs      = smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
+       io->splwrite.in.count           = SVAL(req->in.data, 1);
+       io->splwrite.in.data            = req->in.data + 3;
 
        /* make sure they gave us the data they promised */
-       if (req_data_oob(req, io->splwrite.in.data, io->splwrite.in.count)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (req_data_oob(&req->in.bufinfo, io->splwrite.in.data, io->splwrite.in.count)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_write(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(io->splwrite.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_write(req->ntvfs, io));
 }
 
 
 /****************************************************************************
  Reply to a mkdir.
 ****************************************************************************/
-void reply_mkdir(struct smbsrv_request *req)
+void smbsrv_reply_mkdir(struct smbsrv_request *req)
 {
        union smb_mkdir *io;
 
        /* parse the request */
-       REQ_CHECK_WCT(req, 0);
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_CHECK_WCT(req, 0);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_mkdir);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        io->generic.level = RAW_MKDIR_MKDIR;
-       req_pull_ascii4(req, &io->mkdir.in.path, req->in.data, STR_TERMINATE);
+       req_pull_ascii4(&req->in.bufinfo, &io->mkdir.in.path, req->in.data, STR_TERMINATE);
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_mkdir(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_mkdir(req->ntvfs, io));
 }
 
 
 /****************************************************************************
  Reply to a rmdir.
 ****************************************************************************/
-void reply_rmdir(struct smbsrv_request *req)
+void smbsrv_reply_rmdir(struct smbsrv_request *req)
 {
        struct smb_rmdir *io;
  
        /* parse the request */
-       REQ_CHECK_WCT(req, 0);
-       REQ_TALLOC(io, sizeof(*io));
-
-       req_pull_ascii4(req, &io->in.path, req->in.data, STR_TERMINATE);
-
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
+       SMBSRV_CHECK_WCT(req, 0);
+       SMBSRV_TALLOC_IO_PTR(io, struct smb_rmdir);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       /* call backend */
-       req->async_states->status = ntvfs_rmdir(req, io);
+       req_pull_ascii4(&req->in.bufinfo, &io->in.path, req->in.data, STR_TERMINATE);
 
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_rmdir(req->ntvfs, io));
 }
 
 
 /****************************************************************************
  Reply to a mv.
 ****************************************************************************/
-void reply_mv(struct smbsrv_request *req)
+void smbsrv_reply_mv(struct smbsrv_request *req)
 {
        union smb_rename *io;
        uint8_t *p;
  
        /* parse the request */
-       REQ_CHECK_WCT(req, 1);
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_CHECK_WCT(req, 1);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_rename);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        io->generic.level = RAW_RENAME_RENAME;
        io->rename.in.attrib = SVAL(req->in.vwv, VWV(0));
 
        p = req->in.data;
-       p += req_pull_ascii4(req, &io->rename.in.pattern1, p, STR_TERMINATE);
-       p += req_pull_ascii4(req, &io->rename.in.pattern2, p, STR_TERMINATE);
+       p += req_pull_ascii4(&req->in.bufinfo, &io->rename.in.pattern1, p, STR_TERMINATE);
+       p += req_pull_ascii4(&req->in.bufinfo, &io->rename.in.pattern2, p, STR_TERMINATE);
 
        if (!io->rename.in.pattern1 || !io->rename.in.pattern2) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_rename(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_rename(req->ntvfs, io));
 }
 
 
 /****************************************************************************
  Reply to an NT rename.
 ****************************************************************************/
-void reply_ntrename(struct smbsrv_request *req)
+void smbsrv_reply_ntrename(struct smbsrv_request *req)
 {
        union smb_rename *io;
        uint8_t *p;
  
        /* parse the request */
-       REQ_CHECK_WCT(req, 4);
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_CHECK_WCT(req, 4);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_rename);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        io->generic.level = RAW_RENAME_NTRENAME;
        io->ntrename.in.attrib  = SVAL(req->in.vwv, VWV(0));
@@ -1678,93 +1521,83 @@ void reply_ntrename(struct smbsrv_request *req)
        io->ntrename.in.cluster_size = IVAL(req->in.vwv, VWV(2));
 
        p = req->in.data;
-       p += req_pull_ascii4(req, &io->ntrename.in.old_name, p, STR_TERMINATE);
-       p += req_pull_ascii4(req, &io->ntrename.in.new_name, p, STR_TERMINATE);
+       p += req_pull_ascii4(&req->in.bufinfo, &io->ntrename.in.old_name, p, STR_TERMINATE);
+       p += req_pull_ascii4(&req->in.bufinfo, &io->ntrename.in.new_name, p, STR_TERMINATE);
 
        if (!io->ntrename.in.old_name || !io->ntrename.in.new_name) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_rename(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_rename(req->ntvfs, io));
 }
 
 /****************************************************************************
  Reply to a file copy (async reply)
 ****************************************************************************/
-static void reply_copy_send(struct smbsrv_request *req)
+static void reply_copy_send(struct ntvfs_request *ntvfs)
 {
-       struct smb_copy *cp = req->async_states->private_data;
+       struct smbsrv_request *req;
+       struct smb_copy *cp;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(cp, struct smb_copy);
 
        /* build the reply */
-       req_setup_reply(req, 1, 0);
+       smbsrv_setup_reply(req, 1, 0);
 
        SSVAL(req->out.vwv, VWV(0), cp->out.count);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a file copy.
 ****************************************************************************/
-void reply_copy(struct smbsrv_request *req)
+void smbsrv_reply_copy(struct smbsrv_request *req)
 {
        struct smb_copy *cp;
        uint8_t *p;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 3);
-       REQ_TALLOC(cp, sizeof(*cp));
+       SMBSRV_CHECK_WCT(req, 3);
+       SMBSRV_TALLOC_IO_PTR(cp, struct smb_copy);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_copy_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        cp->in.tid2  = SVAL(req->in.vwv, VWV(0));
        cp->in.ofun  = SVAL(req->in.vwv, VWV(1));
        cp->in.flags = SVAL(req->in.vwv, VWV(2));
 
        p = req->in.data;
-       p += req_pull_ascii4(req, &cp->in.path1, p, STR_TERMINATE);
-       p += req_pull_ascii4(req, &cp->in.path2, p, STR_TERMINATE);
+       p += req_pull_ascii4(&req->in.bufinfo, &cp->in.path1, p, STR_TERMINATE);
+       p += req_pull_ascii4(&req->in.bufinfo, &cp->in.path2, p, STR_TERMINATE);
 
        if (!cp->in.path1 || !cp->in.path2) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_copy_send;
-       req->async_states->private_data = cp;
-
-       /* call backend */
-       req->async_states->status = ntvfs_copy(req, cp);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_copy(req->ntvfs, cp));
 }
 
 /****************************************************************************
  Reply to a lockingX request (async send)
 ****************************************************************************/
-static void reply_lockingX_send(struct smbsrv_request *req)
+static void reply_lockingX_send(struct ntvfs_request *ntvfs)
 {
-       union smb_lock *lck = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_lock *lck;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(lck, union smb_lock);
 
        /* if it was an oplock break ack then we only send a reply if
           there was an error */
        if (lck->lockx.in.ulock_cnt + lck->lockx.in.lock_cnt == 0) {
-               req_destroy(req);
+               talloc_free(req);
                return;
        }
 
        /* construct reply */
-       req_setup_reply(req, 2, 0);
+       smbsrv_setup_reply(req, 2, 0);
        
        SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
        SSVAL(req->out.vwv, VWV(1), 0);
@@ -1776,7 +1609,7 @@ static void reply_lockingX_send(struct smbsrv_request *req)
 /****************************************************************************
  Reply to a lockingX request.
 ****************************************************************************/
-void reply_lockingX(struct smbsrv_request *req)
+void smbsrv_reply_lockingX(struct smbsrv_request *req)
 {
        union smb_lock *lck;
        uint_t total_locks, i;
@@ -1784,11 +1617,12 @@ void reply_lockingX(struct smbsrv_request *req)
        uint8_t *p;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 8);
-       REQ_TALLOC(lck, sizeof(*lck));
+       SMBSRV_CHECK_WCT(req, 8);
+       SMBSRV_TALLOC_IO_PTR(lck, union smb_lock);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_lockingX_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        lck->lockx.level = RAW_LOCK_LOCKX;
-       lck->lockx.in.fnum      = req_fnum(req, req->in.vwv, VWV(2));
+       lck->lockx.in.file.ntvfs= smbsrv_pull_fnum(req, req->in.vwv, VWV(2));
        lck->lockx.in.mode      = SVAL(req->in.vwv, VWV(3));
        lck->lockx.in.timeout   = IVAL(req->in.vwv, VWV(4));
        lck->lockx.in.ulock_cnt = SVAL(req->in.vwv, VWV(6));
@@ -1804,14 +1638,19 @@ void reply_lockingX(struct smbsrv_request *req)
        }
 
        /* make sure we got the promised data */
-       if (req_data_oob(req, req->in.data, total_locks * lck_size)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (req_data_oob(&req->in.bufinfo, req->in.data, total_locks * lck_size)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
        /* allocate the locks array */
        if (total_locks) {
-               REQ_TALLOC(lck->lockx.in.locks, total_locks * sizeof(lck->lockx.in.locks[0]));
+               lck->lockx.in.locks = talloc_array(req, struct smb_lock_entry, 
+                                                  total_locks);
+               if (lck->lockx.in.locks == NULL) {
+                       smbsrv_send_error(req, NT_STATUS_NO_MEMORY);
+                       return;
+               }
        }
 
        p = req->in.data;
@@ -1838,68 +1677,58 @@ void reply_lockingX(struct smbsrv_request *req)
                p += lck_size;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_lockingX_send;
-       req->async_states->private_data = lck;
-
-       /* call backend */
-       req->async_states->status = ntvfs_lock(req, lck);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(lck->lockx.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_lock(req->ntvfs, lck));
 }
 
 /****************************************************************************
  Reply to a SMBreadbmpx (read block multiplex) request.
 ****************************************************************************/
-void reply_readbmpx(struct smbsrv_request *req)
+void smbsrv_reply_readbmpx(struct smbsrv_request *req)
 {
        /* tell the client to not use a multiplexed read - its too broken to use */
-       req_reply_dos_error(req, ERRSRV, ERRuseSTD);
+       smbsrv_send_error(req, NT_STATUS_DOS(ERRSRV, ERRuseSTD));
 }
 
 
 /****************************************************************************
  Reply to a SMBsetattrE.
 ****************************************************************************/
-void reply_setattrE(struct smbsrv_request *req)
+void smbsrv_reply_setattrE(struct smbsrv_request *req)
 {
        union smb_setfileinfo *info;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 7);
-       REQ_TALLOC(info, sizeof(*info));
+       SMBSRV_CHECK_WCT(req, 7);
+       SMBSRV_TALLOC_IO_PTR(info, union smb_setfileinfo);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        info->setattre.level = RAW_SFILEINFO_SETATTRE;
-       info->setattre.file.fnum =      req_fnum(req, req->in.vwv,    VWV(0));
+       info->setattre.in.file.ntvfs  = smbsrv_pull_fnum(req, req->in.vwv,    VWV(0));
        info->setattre.in.create_time = srv_pull_dos_date2(req->smb_conn, req->in.vwv + VWV(1));
        info->setattre.in.access_time = srv_pull_dos_date2(req->smb_conn, req->in.vwv + VWV(3));
        info->setattre.in.write_time  = srv_pull_dos_date2(req->smb_conn, req->in.vwv + VWV(5));
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_simple_send;
-
-       /* call backend */
-       req->async_states->status = ntvfs_setfileinfo(req, info);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CHECK_FILE_HANDLE(info->setattre.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_setfileinfo(req->ntvfs, info));
 }
 
 
 /****************************************************************************
  Reply to a SMBwritebmpx (write block multiplex primary) request.
 ****************************************************************************/
-void reply_writebmpx(struct smbsrv_request *req)
+void smbsrv_reply_writebmpx(struct smbsrv_request *req)
 {
-       req_reply_dos_error(req, ERRSRV, ERRuseSTD);
+       smbsrv_send_error(req, NT_STATUS_DOS(ERRSRV, ERRuseSTD));
 }
 
 
 /****************************************************************************
  Reply to a SMBwritebs (write block multiplex secondary) request.
 ****************************************************************************/
-void reply_writebs(struct smbsrv_request *req)
+void smbsrv_reply_writebs(struct smbsrv_request *req)
 {
-       req_reply_dos_error(req, ERRSRV, ERRuseSTD);
+       smbsrv_send_error(req, NT_STATUS_DOS(ERRSRV, ERRuseSTD));
 }
 
 
@@ -1907,14 +1736,15 @@ void reply_writebs(struct smbsrv_request *req)
 /****************************************************************************
  Reply to a SMBgetattrE (async reply)
 ****************************************************************************/
-static void reply_getattrE_send(struct smbsrv_request *req)
+static void reply_getattrE_send(struct ntvfs_request *ntvfs)
 {
-       union smb_fileinfo *info = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_fileinfo *info;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(info, union smb_fileinfo);
 
        /* setup reply */
-       req_setup_reply(req, 11, 0);
+       smbsrv_setup_reply(req, 11, 0);
 
        srv_push_dos_date2(req->smb_conn, req->out.vwv, VWV(0), info->getattre.out.create_time);
        srv_push_dos_date2(req->smb_conn, req->out.vwv, VWV(2), info->getattre.out.access_time);
@@ -1923,159 +1753,199 @@ static void reply_getattrE_send(struct smbsrv_request *req)
        SIVAL(req->out.vwv,         VWV(8), info->getattre.out.alloc_size);
        SSVAL(req->out.vwv,        VWV(10), info->getattre.out.attrib);
 
-       req_send_reply(req);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a SMBgetattrE.
 ****************************************************************************/
-void reply_getattrE(struct smbsrv_request *req)
+void smbsrv_reply_getattrE(struct smbsrv_request *req)
 {
        union smb_fileinfo *info;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 1);
-       REQ_TALLOC(info, sizeof(*info));
+       SMBSRV_CHECK_WCT(req, 1);
+       SMBSRV_TALLOC_IO_PTR(info, union smb_fileinfo);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_getattrE_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       info->getattr.level = RAW_FILEINFO_GETATTRE;
-       info->getattr.in.fnum = req_fnum(req, req->in.vwv, VWV(0));
+       info->getattr.level             = RAW_FILEINFO_GETATTRE;
+       info->getattr.in.file.ntvfs     = smbsrv_pull_fnum(req, req->in.vwv, VWV(0));
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_getattrE_send;
-       req->async_states->private_data = info;
+       SMBSRV_CHECK_FILE_HANDLE(info->getattr.in.file.ntvfs);
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_qfileinfo(req->ntvfs, info));
+}
 
-       /* call backend */
-       req->async_states->status = ntvfs_qfileinfo(req, info);
+void smbsrv_reply_sesssetup_send(struct smbsrv_request *req,
+                                union smb_sesssetup *io,
+                                NTSTATUS status)
+{
+       switch (io->old.level) {
+       case RAW_SESSSETUP_OLD:
+               if (!NT_STATUS_IS_OK(status)) {
+                       smbsrv_send_error(req, status);
+                       return;
+               }
 
-       REQ_ASYNC_TAIL;
-}
+               /* construct reply */
+               smbsrv_setup_reply(req, 3, 0);
+
+               SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
+               SSVAL(req->out.vwv, VWV(1), 0);
+               SSVAL(req->out.vwv, VWV(2), io->old.out.action);
+
+               SSVAL(req->out.hdr, HDR_UID, io->old.out.vuid);
+
+               smbsrv_chain_reply(req);
+               return;
+
+       case RAW_SESSSETUP_NT1:
+               if (!NT_STATUS_IS_OK(status)) {
+                       smbsrv_send_error(req, status);
+                       return;
+               }
+
+               /* construct reply */
+               smbsrv_setup_reply(req, 3, 0);
+
+               SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
+               SSVAL(req->out.vwv, VWV(1), 0);
+               SSVAL(req->out.vwv, VWV(2), io->nt1.out.action);
+
+               SSVAL(req->out.hdr, HDR_UID, io->nt1.out.vuid);
+
+               req_push_str(req, NULL, io->nt1.out.os, -1, STR_TERMINATE);
+               req_push_str(req, NULL, io->nt1.out.lanman, -1, STR_TERMINATE);
+               req_push_str(req, NULL, io->nt1.out.domain, -1, STR_TERMINATE);
+
+               smbsrv_chain_reply(req);
+               return;
+
+       case RAW_SESSSETUP_SPNEGO:
+               if (!NT_STATUS_IS_OK(status) && 
+                   !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+                       smbsrv_send_error(req, status);
+                       return;
+               }
+
+               /* construct reply */
+               smbsrv_setup_reply(req, 4, io->spnego.out.secblob.length);
+
+               if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+                       smbsrv_setup_error(req, status);
+               }
+
+               SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
+               SSVAL(req->out.vwv, VWV(1), 0);
+               SSVAL(req->out.vwv, VWV(2), io->spnego.out.action);
+               SSVAL(req->out.vwv, VWV(3), io->spnego.out.secblob.length);
+
+               SSVAL(req->out.hdr, HDR_UID, io->spnego.out.vuid);
+
+               memcpy(req->out.data, io->spnego.out.secblob.data, io->spnego.out.secblob.length);
+               req_push_str(req, NULL, io->spnego.out.os,        -1, STR_TERMINATE);
+               req_push_str(req, NULL, io->spnego.out.lanman,    -1, STR_TERMINATE);
+               req_push_str(req, NULL, io->spnego.out.workgroup, -1, STR_TERMINATE);
 
+               smbsrv_chain_reply(req);
+               return;
+
+       case RAW_SESSSETUP_SMB2:
+               break;
+       }
+
+       smbsrv_send_error(req, NT_STATUS_INTERNAL_ERROR);
+}
 
 /****************************************************************************
 reply to an old style session setup command
 ****************************************************************************/
 static void reply_sesssetup_old(struct smbsrv_request *req)
 {
-       NTSTATUS status;
-       union smb_sesssetup sess;
        uint8_t *p;
        uint16_t passlen;
+       union smb_sesssetup *io;
+
+       SMBSRV_TALLOC_IO_PTR(io, union smb_sesssetup);
 
-       sess.old.level = RAW_SESSSETUP_OLD;
+       io->old.level = RAW_SESSSETUP_OLD;
 
        /* parse request */
-       sess.old.in.bufsize = SVAL(req->in.vwv, VWV(2));
-       sess.old.in.mpx_max = SVAL(req->in.vwv, VWV(3));
-       sess.old.in.vc_num  = SVAL(req->in.vwv, VWV(4));
-       sess.old.in.sesskey = IVAL(req->in.vwv, VWV(5));
-       passlen             = SVAL(req->in.vwv, VWV(7));
+       io->old.in.bufsize = SVAL(req->in.vwv, VWV(2));
+       io->old.in.mpx_max = SVAL(req->in.vwv, VWV(3));
+       io->old.in.vc_num  = SVAL(req->in.vwv, VWV(4));
+       io->old.in.sesskey = IVAL(req->in.vwv, VWV(5));
+       passlen            = SVAL(req->in.vwv, VWV(7));
 
        /* check the request isn't malformed */
-       if (req_data_oob(req, req->in.data, passlen)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (req_data_oob(&req->in.bufinfo, req->in.data, passlen)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
        
        p = req->in.data;
-       if (!req_pull_blob(req, p, passlen, &sess.old.in.password)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (!req_pull_blob(&req->in.bufinfo, p, passlen, &io->old.in.password)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
        p += passlen;
        
-       p += req_pull_string(req, &sess.old.in.user,   p, -1, STR_TERMINATE);
-       p += req_pull_string(req, &sess.old.in.domain, p, -1, STR_TERMINATE);
-       p += req_pull_string(req, &sess.old.in.os,     p, -1, STR_TERMINATE);
-       p += req_pull_string(req, &sess.old.in.lanman, p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->old.in.user,   p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->old.in.domain, p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->old.in.os,     p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->old.in.lanman, p, -1, STR_TERMINATE);
 
        /* call the generic handler */
-       status = sesssetup_backend(req, &sess);
-
-       if (!NT_STATUS_IS_OK(status)) {
-               req_reply_error(req, status);
-               return;
-       }
-
-       /* construct reply */
-       req_setup_reply(req, 3, 0);
-
-       SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
-       SSVAL(req->out.vwv, VWV(1), 0);
-       SSVAL(req->out.vwv, VWV(2), sess.old.out.action);
-
-       SSVAL(req->out.hdr, HDR_UID, sess.old.out.vuid);
-
-       smbsrv_chain_reply(req);
+       smbsrv_sesssetup_backend(req, io);
 }
 
-
 /****************************************************************************
 reply to an NT1 style session setup command
 ****************************************************************************/
 static void reply_sesssetup_nt1(struct smbsrv_request *req)
 {
-       NTSTATUS status;
-       union smb_sesssetup sess;
        uint8_t *p;
        uint16_t passlen1, passlen2;
+       union smb_sesssetup *io;
+
+       SMBSRV_TALLOC_IO_PTR(io, union smb_sesssetup);
 
-       sess.nt1.level = RAW_SESSSETUP_NT1;
+       io->nt1.level = RAW_SESSSETUP_NT1;
 
        /* parse request */
-       sess.nt1.in.bufsize      = SVAL(req->in.vwv, VWV(2));
-       sess.nt1.in.mpx_max      = SVAL(req->in.vwv, VWV(3));
-       sess.nt1.in.vc_num       = SVAL(req->in.vwv, VWV(4));
-       sess.nt1.in.sesskey      = IVAL(req->in.vwv, VWV(5));
-       passlen1                 = SVAL(req->in.vwv, VWV(7));
-       passlen2                 = SVAL(req->in.vwv, VWV(8));
-       sess.nt1.in.capabilities = IVAL(req->in.vwv, VWV(11));
+       io->nt1.in.bufsize      = SVAL(req->in.vwv, VWV(2));
+       io->nt1.in.mpx_max      = SVAL(req->in.vwv, VWV(3));
+       io->nt1.in.vc_num       = SVAL(req->in.vwv, VWV(4));
+       io->nt1.in.sesskey      = IVAL(req->in.vwv, VWV(5));
+       passlen1                = SVAL(req->in.vwv, VWV(7));
+       passlen2                = SVAL(req->in.vwv, VWV(8));
+       io->nt1.in.capabilities = IVAL(req->in.vwv, VWV(11));
 
        /* check the request isn't malformed */
-       if (req_data_oob(req, req->in.data, passlen1) ||
-           req_data_oob(req, req->in.data + passlen1, passlen2)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (req_data_oob(&req->in.bufinfo, req->in.data, passlen1) ||
+           req_data_oob(&req->in.bufinfo, req->in.data + passlen1, passlen2)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
        
        p = req->in.data;
-       if (!req_pull_blob(req, p, passlen1, &sess.nt1.in.password1)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (!req_pull_blob(&req->in.bufinfo, p, passlen1, &io->nt1.in.password1)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
        p += passlen1;
-       if (!req_pull_blob(req, p, passlen2, &sess.nt1.in.password2)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (!req_pull_blob(&req->in.bufinfo, p, passlen2, &io->nt1.in.password2)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
        p += passlen2;
        
-       p += req_pull_string(req, &sess.nt1.in.user,   p, -1, STR_TERMINATE);
-       p += req_pull_string(req, &sess.nt1.in.domain, p, -1, STR_TERMINATE);
-       p += req_pull_string(req, &sess.nt1.in.os,     p, -1, STR_TERMINATE);
-       p += req_pull_string(req, &sess.nt1.in.lanman, p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->nt1.in.user,   p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->nt1.in.domain, p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->nt1.in.os,     p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->nt1.in.lanman, p, -1, STR_TERMINATE);
 
        /* call the generic handler */
-       status = sesssetup_backend(req, &sess);
-
-       if (!NT_STATUS_IS_OK(status)) {
-               req_reply_error(req, status);
-               return;
-       }
-
-       /* construct reply */
-       req_setup_reply(req, 3, 0);
-
-       SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
-       SSVAL(req->out.vwv, VWV(1), 0);
-       SSVAL(req->out.vwv, VWV(2), sess.nt1.out.action);
-
-       SSVAL(req->out.hdr, HDR_UID, sess.nt1.out.vuid);
-
-       req_push_str(req, NULL, sess.nt1.out.os, -1, STR_TERMINATE);
-       req_push_str(req, NULL, sess.nt1.out.lanman, -1, STR_TERMINATE);
-       req_push_str(req, NULL, sess.nt1.out.domain, -1, STR_TERMINATE);
-
-       smbsrv_chain_reply(req);
+       smbsrv_sesssetup_backend(req, io);
 }
 
 
@@ -2084,68 +1954,42 @@ reply to an SPNEGO style session setup command
 ****************************************************************************/
 static void reply_sesssetup_spnego(struct smbsrv_request *req)
 {
-       NTSTATUS status;
-       union smb_sesssetup sess;
        uint8_t *p;
        uint16_t blob_len;
+       union smb_sesssetup *io;
+
+       SMBSRV_TALLOC_IO_PTR(io, union smb_sesssetup);
 
-       sess.spnego.level = RAW_SESSSETUP_SPNEGO;
+       io->spnego.level = RAW_SESSSETUP_SPNEGO;
 
        /* parse request */
-       sess.spnego.in.bufsize      = SVAL(req->in.vwv, VWV(2));
-       sess.spnego.in.mpx_max      = SVAL(req->in.vwv, VWV(3));
-       sess.spnego.in.vc_num       = SVAL(req->in.vwv, VWV(4));
-       sess.spnego.in.sesskey      = IVAL(req->in.vwv, VWV(5));
-       blob_len                    = SVAL(req->in.vwv, VWV(7));
-       sess.spnego.in.capabilities = IVAL(req->in.vwv, VWV(10));
+       io->spnego.in.bufsize      = SVAL(req->in.vwv, VWV(2));
+       io->spnego.in.mpx_max      = SVAL(req->in.vwv, VWV(3));
+       io->spnego.in.vc_num       = SVAL(req->in.vwv, VWV(4));
+       io->spnego.in.sesskey      = IVAL(req->in.vwv, VWV(5));
+       blob_len                   = SVAL(req->in.vwv, VWV(7));
+       io->spnego.in.capabilities = IVAL(req->in.vwv, VWV(10));
 
        p = req->in.data;
-       if (!req_pull_blob(req, p, blob_len, &sess.spnego.in.secblob)) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+       if (!req_pull_blob(&req->in.bufinfo, p, blob_len, &io->spnego.in.secblob)) {
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
        p += blob_len;
        
-       p += req_pull_string(req, &sess.spnego.in.os,        p, -1, STR_TERMINATE);
-       p += req_pull_string(req, &sess.spnego.in.lanman,    p, -1, STR_TERMINATE);
-       p += req_pull_string(req, &sess.spnego.in.workgroup, p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->spnego.in.os,        p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->spnego.in.lanman,    p, -1, STR_TERMINATE);
+       p += req_pull_string(&req->in.bufinfo, &io->spnego.in.workgroup, p, -1, STR_TERMINATE);
 
        /* call the generic handler */
-       status = sesssetup_backend(req, &sess);
-
-       if (!NT_STATUS_IS_OK(status) && 
-           !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-               req_reply_error(req, status);
-               return;
-       }
-
-       /* construct reply */
-       req_setup_reply(req, 4, sess.spnego.out.secblob.length);
-
-       if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-               req_setup_error(req, status);
-       }
-
-       SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
-       SSVAL(req->out.vwv, VWV(1), 0);
-       SSVAL(req->out.vwv, VWV(2), sess.spnego.out.action);
-       SSVAL(req->out.vwv, VWV(3), sess.spnego.out.secblob.length);
-
-       SSVAL(req->out.hdr, HDR_UID, sess.spnego.out.vuid);
-
-       memcpy(req->out.data, sess.spnego.out.secblob.data, sess.spnego.out.secblob.length);
-       req_push_str(req, NULL, sess.spnego.out.os,        -1, STR_TERMINATE);
-       req_push_str(req, NULL, sess.spnego.out.lanman,    -1, STR_TERMINATE);
-       req_push_str(req, NULL, sess.spnego.out.workgroup, -1, STR_TERMINATE);
-
-       smbsrv_chain_reply(req);
+       smbsrv_sesssetup_backend(req, io);
 }
 
 
 /****************************************************************************
 reply to a session setup command
 ****************************************************************************/
-void reply_sesssetup(struct smbsrv_request *req)
+void smbsrv_reply_sesssetup(struct smbsrv_request *req)
 {
        switch (req->in.wct) {
        case 10:
@@ -2163,103 +2007,145 @@ void reply_sesssetup(struct smbsrv_request *req)
        }
 
        /* unsupported variant */
-       req_reply_error(req, NT_STATUS_FOOBAR);
+       smbsrv_send_error(req, NT_STATUS_FOOBAR);
+}
+
+/****************************************************************************
+ Reply to a exit. This closes all files open by a smbpid
+****************************************************************************/
+void smbsrv_reply_exit(struct smbsrv_request *req)
+{
+       struct smbsrv_handle_session_item *i, *ni;
+       struct smbsrv_handle *h;
+       struct smbsrv_tcon *tcon;
+       uint16_t smbpid;
+
+       SMBSRV_CHECK_WCT(req, 0);
+
+       smbpid = SVAL(req->in.hdr,HDR_PID);
+
+       /* first destroy all handles, which have the same PID as the request */
+       for (i=req->session->handles; i; i=ni) {
+               ni = i->next;
+               h = i->handle;
+               if (h->smbpid != smbpid) continue;
+
+               talloc_free(h);
+       }
+
+       /*
+        * then let the ntvfs backends proxy the call if they want to,
+        * but we didn't check the return value of the backends,
+        * as for the SMB client the call succeed
+        */
+       for (tcon=req->smb_conn->smb_tcons.list;tcon;tcon=tcon->next) {
+               req->tcon = tcon;
+               SMBSRV_SETUP_NTVFS_REQUEST(NULL,0);
+               ntvfs_exit(req->ntvfs);
+               talloc_free(req->ntvfs);
+               req->ntvfs = NULL;
+               req->tcon = NULL;
+       }
+
+       smbsrv_setup_reply(req, 0, 0);
+       smbsrv_send_reply(req);
 }
 
 /****************************************************************************
  Reply to a SMBulogoffX.
 ****************************************************************************/
-void reply_ulogoffX(struct smbsrv_request *req)
+void smbsrv_reply_ulogoffX(struct smbsrv_request *req)
 {
+       struct smbsrv_handle_session_item *i, *ni;
+       struct smbsrv_handle *h;
        struct smbsrv_tcon *tcon;
-       NTSTATUS status;
 
-       if (!req->session) {
-               req_reply_error(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
-               return;
+       SMBSRV_CHECK_WCT(req, 2);
+
+       /*
+        * TODO: cancel all pending requests
+        */
+       
+
+       /* destroy all handles */
+       for (i=req->session->handles; i; i=ni) {
+               ni = i->next;
+               h = i->handle;
+               talloc_free(h);
        }
 
-       /* in user level security we are supposed to close any files
-          open by this user on all open tree connects */
+       /*
+        * then let the ntvfs backends proxy the call if they want to,
+        * but we didn't check the return value of the backends,
+        * as for the SMB client the call succeed
+        */
        for (tcon=req->smb_conn->smb_tcons.list;tcon;tcon=tcon->next) {
                req->tcon = tcon;
-               status = ntvfs_logoff(req);
+               SMBSRV_SETUP_NTVFS_REQUEST(NULL,0);
+               ntvfs_logoff(req->ntvfs);
+               talloc_free(req->ntvfs);
+               req->ntvfs = NULL;
                req->tcon = NULL;
-               if (!NT_STATUS_IS_OK(status)) {
-                       req_reply_error(req, status);
-                       return;
-               }
        }
 
        talloc_free(req->session);
        req->session = NULL; /* it is now invalid, don't use on 
                                any chained packets */
 
-       req_setup_reply(req, 2, 0);
+       smbsrv_setup_reply(req, 2, 0);
 
        SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
        SSVAL(req->out.vwv, VWV(1), 0); 
-       
+
        smbsrv_chain_reply(req);
 }
 
-
 /****************************************************************************
  Reply to an SMBfindclose request
 ****************************************************************************/
-void reply_findclose(struct smbsrv_request *req)
+void smbsrv_reply_findclose(struct smbsrv_request *req)
 {
-       NTSTATUS status;
-       union smb_search_close io;
-
-       io.findclose.level = RAW_FINDCLOSE_FINDCLOSE;
+       union smb_search_close *io;
 
        /* parse request */
-       REQ_CHECK_WCT(req, 1);
-
-       io.findclose.in.handle  = SVAL(req->in.vwv, VWV(0));
-       
-       /* call backend */
-       status = ntvfs_search_close(req, &io);
-
-       if (!NT_STATUS_IS_OK(status)) {
-               req_reply_error(req, status);
-               return;
-       }
+       SMBSRV_CHECK_WCT(req, 1);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_search_close);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_simple_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
-       /* construct reply */
-       req_setup_reply(req, 0, 0);
+       io->findclose.level     = RAW_FINDCLOSE_FINDCLOSE;
+       io->findclose.in.handle = SVAL(req->in.vwv, VWV(0));
 
-       req_send_reply(req);    
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_search_close(req->ntvfs, io));
 }
 
 /****************************************************************************
  Reply to an SMBfindnclose request
 ****************************************************************************/
-void reply_findnclose(struct smbsrv_request *req)
+void smbsrv_reply_findnclose(struct smbsrv_request *req)
 {
-       req_reply_error(req, NT_STATUS_FOOBAR);
+       smbsrv_send_error(req, NT_STATUS_FOOBAR);
 }
 
 
 /****************************************************************************
  Reply to an SMBntcreateX request (async send)
 ****************************************************************************/
-static void reply_ntcreate_and_X_send(struct smbsrv_request *req)
+static void reply_ntcreate_and_X_send(struct ntvfs_request *ntvfs)
 {
-       union smb_open *io = req->async_states->private_data;
+       struct smbsrv_request *req;
+       union smb_open *io;
 
-       CHECK_ASYNC_STATUS;
+       SMBSRV_CHECK_ASYNC_STATUS(io, union smb_open);
 
        /* construct reply */
-       req_setup_reply(req, 34, 0);
+       smbsrv_setup_reply(req, 34, 0);
 
        SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
        SSVAL(req->out.vwv, VWV(1), 0); 
        SCVAL(req->out.vwv, VWV(2), io->ntcreatex.out.oplock_level);
 
        /* the rest of the parameters are not aligned! */
-       SSVAL(req->out.vwv,        5, io->ntcreatex.out.fnum);
+       smbsrv_push_fnum(req->out.vwv, 5, io->ntcreatex.out.file.ntvfs);
        SIVAL(req->out.vwv,        7, io->ntcreatex.out.create_action);
        push_nttime(req->out.vwv, 11, io->ntcreatex.out.create_time);
        push_nttime(req->out.vwv, 19, io->ntcreatex.out.access_time);
@@ -2272,7 +2158,7 @@ static void reply_ntcreate_and_X_send(struct smbsrv_request *req)
        SSVAL(req->out.vwv,       65, io->ntcreatex.out.ipc_state);
        SCVAL(req->out.vwv,       67, io->ntcreatex.out.is_directory);
 
-       req->chained_fnum = io->ntcreatex.out.fnum;
+       req->chained_fnum = SVAL(req->out.vwv, 5);
 
        smbsrv_chain_reply(req);
 }
@@ -2280,14 +2166,15 @@ static void reply_ntcreate_and_X_send(struct smbsrv_request *req)
 /****************************************************************************
  Reply to an SMBntcreateX request
 ****************************************************************************/
-void reply_ntcreate_and_X(struct smbsrv_request *req)
+void smbsrv_reply_ntcreate_and_X(struct smbsrv_request *req)
 {
        union smb_open *io;
        uint16_t fname_len;
 
        /* parse the request */
-       REQ_CHECK_WCT(req, 24);
-       REQ_TALLOC(io, sizeof(*io));
+       SMBSRV_CHECK_WCT(req, 24);
+       SMBSRV_TALLOC_IO_PTR(io, union smb_open);
+       SMBSRV_SETUP_NTVFS_REQUEST(reply_ntcreate_and_X_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
        io->ntcreatex.level = RAW_OPEN_NTCREATEX;
 
@@ -2305,6 +2192,13 @@ void reply_ntcreate_and_X(struct smbsrv_request *req)
        io->ntcreatex.in.security_flags =   CVAL(req->in.vwv, 47);
        io->ntcreatex.in.ea_list          = NULL;
        io->ntcreatex.in.sec_desc         = NULL;
+       io->ntcreatex.in.query_maximal_access = false;
+
+       /* we use a couple of bits of the create options internally */
+       if (io->ntcreatex.in.create_options & NTCREATEX_OPTIONS_PRIVATE_MASK) {
+               smbsrv_send_error(req, NT_STATUS_INVALID_PARAMETER);
+               return;
+       }
 
        /* we need a neater way to handle this alignment */
        if ((req->flags2 & FLAGS2_UNICODE_STRINGS) && 
@@ -2312,66 +2206,48 @@ void reply_ntcreate_and_X(struct smbsrv_request *req)
                fname_len++;
        }
 
-       req_pull_string(req, &io->ntcreatex.in.fname, req->in.data, fname_len, STR_TERMINATE);
+       req_pull_string(&req->in.bufinfo, &io->ntcreatex.in.fname, req->in.data, fname_len, STR_TERMINATE);
        if (!io->ntcreatex.in.fname) {
-               req_reply_error(req, NT_STATUS_FOOBAR);
+               smbsrv_send_error(req, NT_STATUS_FOOBAR);
                return;
        }
 
-       req->async_states->state |= NTVFS_ASYNC_STATE_MAY_ASYNC;
-       req->async_states->send_fn = reply_ntcreate_and_X_send;
-       req->async_states->private_data = io;
-
-       /* call the backend */
-       req->async_states->status = ntvfs_openfile(req, io);
-
-       REQ_ASYNC_TAIL;
+       SMBSRV_CALL_NTVFS_BACKEND(ntvfs_open(req->ntvfs, io));
 }
 
 
 /****************************************************************************
  Reply to an SMBntcancel request
 ****************************************************************************/
-void reply_ntcancel(struct smbsrv_request *req)
+void smbsrv_reply_ntcancel(struct smbsrv_request *req)
 {
-       /* NOTE: this request does not generate a reply */
-       ntvfs_cancel(req);
-       req_destroy(req);
-}
+       struct smbsrv_request *r;
+       uint16_t tid = SVAL(req->in.hdr,HDR_TID);
+       uint16_t uid = SVAL(req->in.hdr,HDR_UID);
+       uint16_t mid = SVAL(req->in.hdr,HDR_MID);
+       uint16_t pid = SVAL(req->in.hdr,HDR_PID);
 
-/****************************************************************************
- Reply to an SMBsends request
-****************************************************************************/
-void reply_sends(struct smbsrv_request *req)
-{
-       req_reply_error(req, NT_STATUS_FOOBAR);
-}
+       for (r = req->smb_conn->requests; r; r = r->next) {
+               if (tid != SVAL(r->in.hdr,HDR_TID)) continue;
+               if (uid != SVAL(r->in.hdr,HDR_UID)) continue;
+               if (mid != SVAL(r->in.hdr,HDR_MID)) continue;
+               if (pid != SVAL(r->in.hdr,HDR_PID)) continue;
 
-/****************************************************************************
- Reply to an SMBsendstrt request
-****************************************************************************/
-void reply_sendstrt(struct smbsrv_request *req)
-{
-       req_reply_error(req, NT_STATUS_FOOBAR);
-}
+               SMBSRV_CHECK(ntvfs_cancel(r->ntvfs));
 
-/****************************************************************************
- Reply to an SMBsendend request
-****************************************************************************/
-void reply_sendend(struct smbsrv_request *req)
-{
-       req_reply_error(req, NT_STATUS_FOOBAR);
-}
+               /* NOTE: this request does not generate a reply */
+               talloc_free(req);
+               return;
+       }
 
-/****************************************************************************
- Reply to an SMBsendtxt request
-****************************************************************************/
-void reply_sendtxt(struct smbsrv_request *req)
-{
-       req_reply_error(req, NT_STATUS_FOOBAR);
+       /* TODO: workout the correct error code,
+        *       until we know how the smb signing works
+        *       for ntcancel replies, don't send an error
+        */
+       /*smbsrv_send_error(req, NT_STATUS_FOOBAR);*/
+       talloc_free(req);
 }
 
-
 /*
   parse the called/calling names from session request
 */
@@ -2403,7 +2279,7 @@ static NTSTATUS parse_session_request(struct smbsrv_request *req)
                                    req->smb_conn->negotiate.calling_name);
        NT_STATUS_NOT_OK_RETURN(status);
 
-       req->smb_conn->negotiate.done_nbt_session = True;
+       req->smb_conn->negotiate.done_nbt_session = true;
 
        return NT_STATUS_OK;
 }      
@@ -2413,7 +2289,7 @@ static NTSTATUS parse_session_request(struct smbsrv_request *req)
 /****************************************************************************
  Reply to a special message - a SMB packet with non zero NBT message type
 ****************************************************************************/
-void reply_special(struct smbsrv_request *req)
+void smbsrv_reply_special(struct smbsrv_request *req)
 {
        uint8_t msg_type;
        uint8_t *buf = talloc_zero_array(req, uint8_t, 4);
@@ -2438,7 +2314,7 @@ void reply_special(struct smbsrv_request *req)
 
                req->out.buffer = buf;
                req->out.size = 4;
-               req_send_reply_nosign(req);
+               smbsrv_send_reply_nosign(req);
                return;
                
        case 0x89: /* session keepalive request 
@@ -2447,15 +2323,15 @@ void reply_special(struct smbsrv_request *req)
                SCVAL(buf, 3, 0);
                req->out.buffer = buf;
                req->out.size = 4;
-               req_send_reply_nosign(req);
+               smbsrv_send_reply_nosign(req);
                return;
                
        case SMBkeepalive: 
                /* session keepalive - swallow it */
-               req_destroy(req);
+               talloc_free(req);
                return;
        }
 
        DEBUG(0,("Unexpected NBT session packet (%d)\n", msg_type));
-       req_destroy(req);
+       talloc_free(req);
 }