smbd: some write time fixes
[tprouty/samba.git] / source / smbd / nttrans.c
index 9d067956373a9e0672f8821e0d2fcbbbbc984f6d..0b48fa2c4d522104de041149bb013ccec8ead3b7 100644 (file)
@@ -1,7 +1,7 @@
 /*
    Unix SMB/CIFS implementation.
    SMB NT transaction handling
-   Copyright (C) Jeremy Allison                        1994-1998
+   Copyright (C) Jeremy Allison                        1994-2007
    Copyright (C) Stefan (metze) Metzmacher     2003
 
    This program is free software; you can redistribute it and/or modify
@@ -22,7 +22,6 @@
 
 extern int max_send;
 extern enum protocol_types Protocol;
-extern int smb_read_error;
 extern struct current_user current_user;
 
 static const char *known_nt_pipes[] = {
@@ -51,7 +50,7 @@ static char *nttrans_realloc(char **ptr, size_t size)
        if (ptr==NULL) {
                smb_panic("nttrans_realloc() called with NULL ptr");
        }
-               
+
        *ptr = (char *)SMB_REALLOC(*ptr, size);
        if(*ptr == NULL) {
                return NULL;
@@ -67,14 +66,10 @@ static char *nttrans_realloc(char **ptr, size_t size)
  HACK ! Always assumes smb_setup field is zero.
 ****************************************************************************/
 
-int send_nt_replies(const char *inbuf,
-                       char *outbuf,
-                       int bufsize,
-                       NTSTATUS nt_error,
-                       char *params,
-                       int paramsize,
-                       char *pdata,
-                       int datasize)
+void send_nt_replies(connection_struct *conn,
+                       struct smb_request *req, NTSTATUS nt_error,
+                    char *params, int paramsize,
+                    char *pdata, int datasize)
 {
        int data_to_send = datasize;
        int params_to_send = paramsize;
@@ -86,27 +81,14 @@ int send_nt_replies(const char *inbuf,
        int data_alignment_offset = 0;
 
        /*
-        * Initially set the wcnt area to be 18 - this is true for all
-        * transNT replies.
-        */
-
-       set_message(inbuf,outbuf,18,0,True);
-
-       if (NT_STATUS_V(nt_error)) {
-               ERROR_NT(nt_error);
-       }
-
-       /* 
         * If there genuinely are no parameters or data to send just send
         * the empty packet.
         */
 
        if(params_to_send == 0 && data_to_send == 0) {
-               show_msg(outbuf);
-               if (!send_smb(smbd_server_fd(),outbuf)) {
-                       exit_server_cleanly("send_nt_replies: send_smb failed.");
-               }
-               return 0;
+               reply_outbuf(req, 18, 0);
+               show_msg((char *)req->outbuf);
+               return;
        }
 
        /*
@@ -119,16 +101,17 @@ int send_nt_replies(const char *inbuf,
                data_alignment_offset = 4 - (params_to_send % 4);
        }
 
-       /* 
+       /*
         * Space is bufsize minus Netbios over TCP header minus SMB header.
         * The alignment_offset is to align the param bytes on a four byte
-        * boundary (2 bytes for data len, one byte pad). 
+        * boundary (2 bytes for data len, one byte pad).
         * NT needs this to work correctly.
         */
 
-       useable_space = bufsize - ((smb_buf(outbuf)+
-                               alignment_offset+data_alignment_offset) -
-                               outbuf);
+       useable_space = max_send - (smb_size
+                                   + 2 * 18 /* wct */
+                                   + alignment_offset
+                                   + data_alignment_offset);
 
        /*
         * useable_space can never be more than max_send minus the
@@ -148,22 +131,22 @@ int send_nt_replies(const char *inbuf,
                total_sent_thistime = params_to_send + data_to_send +
                                        alignment_offset + data_alignment_offset;
 
-               /* 
+               /*
                 * We can never send more than useable_space.
                 */
 
                total_sent_thistime = MIN(total_sent_thistime, useable_space);
 
-               set_message(inbuf,outbuf, 18, total_sent_thistime, True);
+               reply_outbuf(req, 18, total_sent_thistime);
 
                /*
                 * Set total params and data to be sent.
                 */
 
-               SIVAL(outbuf,smb_ntr_TotalParameterCount,paramsize);
-               SIVAL(outbuf,smb_ntr_TotalDataCount,datasize);
+               SIVAL(req->outbuf,smb_ntr_TotalParameterCount,paramsize);
+               SIVAL(req->outbuf,smb_ntr_TotalDataCount,datasize);
 
-               /* 
+               /*
                 * Calculate how many parameters and data we can fit into
                 * this packet. Parameters get precedence.
                 */
@@ -172,11 +155,12 @@ int send_nt_replies(const char *inbuf,
                data_sent_thistime = useable_space - params_sent_thistime;
                data_sent_thistime = MIN(data_sent_thistime,data_to_send);
 
-               SIVAL(outbuf,smb_ntr_ParameterCount,params_sent_thistime);
+               SIVAL(req->outbuf, smb_ntr_ParameterCount,
+                     params_sent_thistime);
 
                if(params_sent_thistime == 0) {
-                       SIVAL(outbuf,smb_ntr_ParameterOffset,0);
-                       SIVAL(outbuf,smb_ntr_ParameterDisplacement,0);
+                       SIVAL(req->outbuf,smb_ntr_ParameterOffset,0);
+                       SIVAL(req->outbuf,smb_ntr_ParameterDisplacement,0);
                } else {
                        /*
                         * smb_ntr_ParameterOffset is the offset from the start of the SMB header to the
@@ -185,41 +169,50 @@ int send_nt_replies(const char *inbuf,
                         * them from the calculation.
                         */
 
-                       SIVAL(outbuf,smb_ntr_ParameterOffset,
-                               ((smb_buf(outbuf)+alignment_offset) - smb_base(outbuf)));
-                       /* 
+                       SIVAL(req->outbuf,smb_ntr_ParameterOffset,
+                             ((smb_buf(req->outbuf)+alignment_offset)
+                              - smb_base(req->outbuf)));
+                       /*
                         * Absolute displacement of param bytes sent in this packet.
                         */
 
-                       SIVAL(outbuf,smb_ntr_ParameterDisplacement,pp - params);
+                       SIVAL(req->outbuf, smb_ntr_ParameterDisplacement,
+                             pp - params);
                }
 
                /*
                 * Deal with the data portion.
                 */
 
-               SIVAL(outbuf,smb_ntr_DataCount, data_sent_thistime);
+               SIVAL(req->outbuf, smb_ntr_DataCount, data_sent_thistime);
 
                if(data_sent_thistime == 0) {
-                       SIVAL(outbuf,smb_ntr_DataOffset,0);
-                       SIVAL(outbuf,smb_ntr_DataDisplacement, 0);
+                       SIVAL(req->outbuf,smb_ntr_DataOffset,0);
+                       SIVAL(req->outbuf,smb_ntr_DataDisplacement, 0);
                } else {
                        /*
                         * The offset of the data bytes is the offset of the
                         * parameter bytes plus the number of parameters being sent this time.
                         */
 
-                       SIVAL(outbuf,smb_ntr_DataOffset,((smb_buf(outbuf)+alignment_offset) -
-                               smb_base(outbuf)) + params_sent_thistime + data_alignment_offset);
-                               SIVAL(outbuf,smb_ntr_DataDisplacement, pd - pdata);
+                       SIVAL(req->outbuf, smb_ntr_DataOffset,
+                             ((smb_buf(req->outbuf)+alignment_offset) -
+                              smb_base(req->outbuf))
+                             + params_sent_thistime + data_alignment_offset);
+                       SIVAL(req->outbuf,smb_ntr_DataDisplacement, pd - pdata);
                }
 
-               /* 
+               /*
                 * Copy the param bytes into the packet.
                 */
 
                if(params_sent_thistime) {
-                       memcpy((smb_buf(outbuf)+alignment_offset),pp,params_sent_thistime);
+                       if (alignment_offset != 0) {
+                               memset(smb_buf(req->outbuf), 0,
+                                      alignment_offset);
+                       }
+                       memcpy((smb_buf(req->outbuf)+alignment_offset), pp,
+                              params_sent_thistime);
                }
 
                /*
@@ -227,24 +220,40 @@ int send_nt_replies(const char *inbuf,
                 */
 
                if(data_sent_thistime) {
-                       memcpy(smb_buf(outbuf)+alignment_offset+params_sent_thistime+
-                               data_alignment_offset,pd,data_sent_thistime);
+                       if (data_alignment_offset != 0) {
+                               memset((smb_buf(req->outbuf)+alignment_offset+
+                                       params_sent_thistime), 0,
+                                      data_alignment_offset);
+                       }
+                       memcpy(smb_buf(req->outbuf)+alignment_offset
+                              +params_sent_thistime+data_alignment_offset,
+                              pd,data_sent_thistime);
                }
-    
+
                DEBUG(9,("nt_rep: params_sent_thistime = %d, data_sent_thistime = %d, useable_space = %d\n",
                        params_sent_thistime, data_sent_thistime, useable_space));
                DEBUG(9,("nt_rep: params_to_send = %d, data_to_send = %d, paramsize = %d, datasize = %d\n",
                        params_to_send, data_to_send, paramsize, datasize));
-    
+
+               if (NT_STATUS_V(nt_error)) {
+                       error_packet_set((char *)req->outbuf,
+                                        0, 0, nt_error,
+                                        __LINE__,__FILE__);
+               }
+
                /* Send the packet */
-               show_msg(outbuf);
-               if (!send_smb(smbd_server_fd(),outbuf)) {
-                       exit_server_cleanly("send_nt_replies: send_smb failed.");
+               show_msg((char *)req->outbuf);
+               if (!srv_send_smb(smbd_server_fd(),
+                               (char *)req->outbuf,
+                               IS_CONN_ENCRYPTED(conn))) {
+                       exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
                }
-    
+
+               TALLOC_FREE(req->outbuf);
+
                pp += params_sent_thistime;
                pd += data_sent_thistime;
-    
+
                params_to_send -= params_sent_thistime;
                data_to_send -= data_sent_thistime;
 
@@ -255,36 +264,19 @@ int send_nt_replies(const char *inbuf,
                if(params_to_send < 0 || data_to_send < 0) {
                        DEBUG(0,("send_nt_replies failed sanity check pts = %d, dts = %d\n!!!",
                                params_to_send, data_to_send));
-                       return -1;
+                       return;
                }
-       } 
-
-       return 0;
-}
-
-void send_nt_replies_new(struct smb_request *req, NTSTATUS nt_error,
-                        char *params, int paramsize,
-                       char *pdata, int datasize)
-{
-       char *inbuf, *outbuf;
-       int length, bufsize;
-
-       if (!reply_prep_legacy(req, &inbuf, &outbuf, &length, &bufsize)) {
-               reply_nterror(req, NT_STATUS_NO_MEMORY);
-               return;
        }
-
-       reply_post_legacy(
-               req,
-               send_nt_replies(inbuf, outbuf, bufsize, nt_error,
-                               params, paramsize, pdata, datasize));
 }
 
 /****************************************************************************
  Is it an NTFS stream name ?
+ An NTFS file name is <path>.<extention>:<stream name>:<stream type>
+ $DATA can be used as both a stream name and a stream type. A missing stream
+ name or type implies $DATA.
 ****************************************************************************/
 
-BOOL is_ntfs_stream_name(const char *fname)
+bool is_ntfs_stream_name(const char *fname)
 {
        if (lp_posix_pathnames()) {
                return False;
@@ -292,52 +284,6 @@ BOOL is_ntfs_stream_name(const char *fname)
        return (strchr_m(fname, ':') != NULL) ? True : False;
 }
 
-struct case_semantics_state {
-       connection_struct *conn;
-       BOOL case_sensitive;
-       BOOL case_preserve;
-       BOOL short_case_preserve;
-};
-
-/****************************************************************************
- Restore case semantics.
-****************************************************************************/
-static int restore_case_semantics(struct case_semantics_state *state)
-{
-       state->conn->case_sensitive = state->case_sensitive;
-       state->conn->case_preserve = state->case_preserve;
-       state->conn->short_case_preserve = state->short_case_preserve;
-       return 0;
-}
-
-/****************************************************************************
- Save case semantics.
-****************************************************************************/
-static struct case_semantics_state *set_posix_case_semantics(TALLOC_CTX *mem_ctx,
-                                                            connection_struct *conn)
-{
-       struct case_semantics_state *result;
-
-       if (!(result = talloc(mem_ctx, struct case_semantics_state))) {
-               DEBUG(0, ("talloc failed\n"));
-               return NULL;
-       }
-
-       result->conn = conn;
-       result->case_sensitive = conn->case_sensitive;
-       result->case_preserve = conn->case_preserve;
-       result->short_case_preserve = conn->short_case_preserve;
-
-       /* Set to POSIX. */
-       conn->case_sensitive = True;
-       conn->case_preserve = True;
-       conn->short_case_preserve = True;
-
-       talloc_set_destructor(result, restore_case_semantics);
-
-       return result;
-}
-
 /****************************************************************************
  Reply to an NT create and X call on a pipe
 ****************************************************************************/
@@ -398,14 +344,20 @@ static void nt_open_pipe(char *fname, connection_struct *conn,
 static void do_ntcreate_pipe_open(connection_struct *conn,
                                  struct smb_request *req)
 {
-       pstring fname;
+       char *fname = NULL;
        int pnum = -1;
        char *p = NULL;
        uint32 flags = IVAL(req->inbuf,smb_ntcreate_Flags);
+       TALLOC_CTX *ctx = talloc_tos();
 
-       srvstr_pull_buf((char *)req->inbuf, req->flags2, fname,
-                       smb_buf(req->inbuf), sizeof(fname), STR_TERMINATE);
+       srvstr_pull_buf_talloc(ctx, (char *)req->inbuf, req->flags2, &fname,
+                       smb_buf(req->inbuf), STR_TERMINATE);
 
+       if (!fname) {
+               reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
+                               ERRDOS, ERRbadpipe);
+               return;
+       }
        nt_open_pipe(fname, conn, req, &pnum);
 
        if (req->outbuf) {
@@ -415,7 +367,7 @@ static void do_ntcreate_pipe_open(connection_struct *conn,
 
        /*
         * Deal with pipe return.
-        */  
+        */
 
        if (flags & EXTENDED_RESPONSE_REQUIRED) {
                /* This is very strange. We
@@ -447,7 +399,7 @@ static void do_ntcreate_pipe_open(connection_struct *conn,
        if (flags & EXTENDED_RESPONSE_REQUIRED) {
                p += 25;
                SIVAL(p,0,FILE_GENERIC_ALL);
-               /* 
+               /*
                 * For pipes W2K3 seems to return
                 * 0x12019B next.
                 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
@@ -457,52 +409,17 @@ static void do_ntcreate_pipe_open(connection_struct *conn,
 
        DEBUG(5,("do_ntcreate_pipe_open: open pipe = %s\n", fname));
 
-       chain_reply_new(req);
-}
-
-/****************************************************************************
- Reply to an NT create and X call for a quota file.
-****************************************************************************/
-
-static void reply_ntcreate_and_X_quota(connection_struct *conn,
-                                      struct smb_request *req,
-                                      enum FAKE_FILE_TYPE fake_file_type,
-                                      const char *fname)
-{
-       char *p;
-       uint32 desired_access = IVAL(req->inbuf,smb_ntcreate_DesiredAccess);
-       files_struct *fsp;
-       NTSTATUS status;
-
-       status = open_fake_file(conn, fake_file_type, fname, desired_access,
-                               &fsp);
-
-       if (!NT_STATUS_IS_OK(status)) {
-               reply_nterror(req, status);
-               return;
-       }
-
-       reply_outbuf(req, 34, 0);
-       
-       p = (char *)req->outbuf + smb_vwv2;
-       
-       /* SCVAL(p,0,NO_OPLOCK_RETURN); */
-       p++;
-       SSVAL(p,0,fsp->fnum);
-
-       DEBUG(5,("reply_ntcreate_and_X_quota: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
-
-       chain_reply_new(req);
+       chain_reply(req);
 }
 
 /****************************************************************************
  Reply to an NT create and X call.
 ****************************************************************************/
 
-void reply_ntcreate_and_X(connection_struct *conn,
-                         struct smb_request *req)
-{  
-       pstring fname;
+void reply_ntcreate_and_X(struct smb_request *req)
+{
+       connection_struct *conn = req->conn;
+       char *fname = NULL;
        uint32 flags;
        uint32 access_mask;
        uint32 file_attributes;
@@ -513,7 +430,6 @@ void reply_ntcreate_and_X(connection_struct *conn,
        SMB_BIG_UINT allocation_size;
        /* Breakout the oplock request bits so we can set the
           reply bits separately. */
-       int oplock_request = 0;
        uint32 fattr=0;
        SMB_OFF_T file_len = 0;
        SMB_STRUCT_STAT sbuf;
@@ -523,9 +439,10 @@ void reply_ntcreate_and_X(connection_struct *conn,
        struct timespec c_timespec;
        struct timespec a_timespec;
        struct timespec m_timespec;
-       BOOL extended_oplock_granted = False;
        NTSTATUS status;
-       struct case_semantics_state *case_state = NULL;
+       int oplock_request;
+       uint8_t oplock_granted = NO_OPLOCK_RETURN;
+       TALLOC_CTX *ctx = talloc_tos();
 
        START_PROFILE(SMBntcreateX);
 
@@ -542,22 +459,41 @@ void reply_ntcreate_and_X(connection_struct *conn,
        create_options = IVAL(req->inbuf,smb_ntcreate_CreateOptions);
        root_dir_fid = (uint16)IVAL(req->inbuf,smb_ntcreate_RootDirectoryFid);
 
-       allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,smb_ntcreate_AllocationSize);
+       allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,
+                                            smb_ntcreate_AllocationSize);
 #ifdef LARGE_SMB_OFF_T
-       allocation_size |= (((SMB_BIG_UINT)IVAL(req->inbuf,smb_ntcreate_AllocationSize + 4)) << 32);
+       allocation_size |= (((SMB_BIG_UINT)IVAL(
+                                    req->inbuf,
+                                    smb_ntcreate_AllocationSize + 4)) << 32);
 #endif
 
+       srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
+                       smb_buf(req->inbuf), 0, STR_TERMINATE, &status);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
+               END_PROFILE(SMBntcreateX);
+               return;
+       }
+
        DEBUG(10,("reply_ntcreate_and_X: flags = 0x%x, access_mask = 0x%x "
                  "file_attributes = 0x%x, share_access = 0x%x, "
                  "create_disposition = 0x%x create_options = 0x%x "
-                 "root_dir_fid = 0x%x\n",
+                 "root_dir_fid = 0x%x, fname = %s\n",
                        (unsigned int)flags,
                        (unsigned int)access_mask,
                        (unsigned int)file_attributes,
                        (unsigned int)share_access,
                        (unsigned int)create_disposition,
                        (unsigned int)create_options,
-                       (unsigned int)root_dir_fid ));
+                       (unsigned int)root_dir_fid,
+                       fname));
+
+       /*
+        * we need to remove ignored bits when they come directly from the client
+        * because we reuse some of them for internal stuff
+        */
+       create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
 
        /*
         * If it's an IPC, use the pipe handler.
@@ -568,142 +504,31 @@ void reply_ntcreate_and_X(connection_struct *conn,
                        do_ntcreate_pipe_open(conn, req);
                        END_PROFILE(SMBntcreateX);
                        return;
-               } else {
-                       reply_doserror(req, ERRDOS, ERRnoaccess);
-                       END_PROFILE(SMBntcreateX);
-                       return;
                }
-       }
-
-       if (create_options & FILE_OPEN_BY_FILE_ID) {
-               reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+               reply_doserror(req, ERRDOS, ERRnoaccess);
                END_PROFILE(SMBntcreateX);
                return;
        }
 
-       /*
-        * Get the file name.
-        */
-
-       if(root_dir_fid != 0) {
-               /*
-                * This filename is relative to a directory fid.
-                */
-               pstring rel_fname;
-               files_struct *dir_fsp = file_fsp(
-                       SVAL(req->inbuf, smb_ntcreate_RootDirectoryFid));
-               size_t dir_name_len;
-
-               if(!dir_fsp) {
-                       reply_doserror(req, ERRDOS, ERRbadfid);
-                       END_PROFILE(SMBntcreateX);
-                       return;
-               }
-
-               if(!dir_fsp->is_directory) {
-
-                       srvstr_get_path((char *)req->inbuf, req->flags2, fname,
-                                       smb_buf(req->inbuf), sizeof(fname), 0,
-                                       STR_TERMINATE, &status);
-                       if (!NT_STATUS_IS_OK(status)) {
-                               reply_nterror(req, status);
-                               END_PROFILE(SMBntcreateX);
-                               return;
-                       }
-
-                       /*
-                        * Check to see if this is a mac fork of some kind.
-                        */
-
-                       if( is_ntfs_stream_name(fname)) {
-                               reply_nterror(
-                                       req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
-                               END_PROFILE(SMBntcreateX);
-                               return;
-                       }
-
-                       /*
-                         we need to handle the case when we get a
-                         relative open relative to a file and the
-                         pathname is blank - this is a reopen!
-                         (hint from demyn plantenberg)
-                       */
-
-                       reply_doserror(req, ERRDOS, ERRbadfid);
-                       END_PROFILE(SMBntcreateX);
-                       return;
-               }
-
-               /*
-                * Copy in the base directory name.
-                */
-
-               pstrcpy( fname, dir_fsp->fsp_name );
-               dir_name_len = strlen(fname);
-
-               /*
-                * Ensure it ends in a '\'.
-                */
-
-               if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
-                       pstrcat(fname, "/");
-                       dir_name_len++;
-               }
-
-               srvstr_get_path((char *)req->inbuf, req->flags2, rel_fname,
-                               smb_buf(req->inbuf), sizeof(rel_fname), 0,
-                               STR_TERMINATE, &status);
-               if (!NT_STATUS_IS_OK(status)) {
-                       reply_nterror(req, status);
-                       END_PROFILE(SMBntcreateX);
-                       return;
-               }
-               pstrcat(fname, rel_fname);
-       } else {
-               srvstr_get_path((char *)req->inbuf, req->flags2, fname,
-                               smb_buf(req->inbuf), sizeof(fname), 0,
-                               STR_TERMINATE, &status);
-               if (!NT_STATUS_IS_OK(status)) {
-                       reply_nterror(req, status);
-                       END_PROFILE(SMBntcreateX);
-                       return;
-               }
+       oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
+       if (oplock_request) {
+               oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
+                       ? BATCH_OPLOCK : 0;
+       }
 
-               /*
-                * Check to see if this is a mac fork of some kind.
-                */
+       status = create_file(conn, req, root_dir_fid, fname,
+                            access_mask, share_access, create_disposition,
+                            create_options, file_attributes, oplock_request,
+                            allocation_size, NULL, NULL, &fsp, &info, &sbuf);
 
-               if( is_ntfs_stream_name(fname)) {
-                       enum FAKE_FILE_TYPE fake_file_type = is_fake_file(fname);
-                       if (fake_file_type!=FAKE_FILE_TYPE_NONE) {
-                               /*
-                                * Here we go! support for changing the disk quotas --metze
-                                *
-                                * We need to fake up to open this MAGIC QUOTA file 
-                                * and return a valid FID.
-                                *
-                                * w2k close this file directly after openening
-                                * xp also tries a QUERY_FILE_INFO on the file and then close it
-                                */
-                               reply_ntcreate_and_X_quota(conn, req,
-                                                         fake_file_type, fname);
-                       } else {
-                               reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
-                       }
+       if (!NT_STATUS_IS_OK(status)) {
+               if (open_was_deferred(req->mid)) {
+                       /* We have re-scheduled this call, no error. */
                        END_PROFILE(SMBntcreateX);
                        return;
                }
-       }
-       
-       /*
-        * Now contruct the smb_open_mode value from the filename, 
-        * desired access and the share access.
-        */
-       status = resolve_dfspath(conn, req->flags2 & FLAGS2_DFS_PATHNAMES, fname);
-       if (!NT_STATUS_IS_OK(status)) {
-               if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-                       reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
-                                       ERRSRV, ERRbadpath);
+               if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
+                       reply_botherror(req, status, ERRDOS, ERRfilexists);
                }
                else {
                        reply_nterror(req, status);
@@ -712,250 +537,35 @@ void reply_ntcreate_and_X(connection_struct *conn,
                return;
        }
 
-       oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
-       if (oplock_request) {
-               oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
-       }
-
        /*
-        * Ordinary file or directory.
-        */
-               
-       /*
-        * Check if POSIX semantics are wanted.
-        */
-               
-       if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
-               case_state = set_posix_case_semantics(NULL, conn);
-               file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
-       }
-               
-       status = unix_convert(conn, fname, False, NULL, &sbuf);
-       if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(case_state);
-               reply_nterror(req, status);
-               END_PROFILE(SMBntcreateX);
-               return;
-       }
-       /* All file access must go through check_name() */
-       status = check_name(conn, fname);
-       if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(case_state);
-               reply_nterror(req, status);
-               END_PROFILE(SMBntcreateX);
-               return;
-       }
-
-       /* This is the correct thing to do (check every time) but can_delete is
-          expensive (it may have to read the parent directory permissions). So
-          for now we're not doing it unless we have a strong hint the client
-          is really going to delete this file. If the client is forcing FILE_CREATE
-          let the filesystem take care of the permissions. */
-
-       /* Setting FILE_SHARE_DELETE is the hint. */
-
-       if (lp_acl_check_permissions(SNUM(conn))
-           && (create_disposition != FILE_CREATE)
-           && (share_access & FILE_SHARE_DELETE)
-           && (access_mask & DELETE_ACCESS)) {
-               if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) ||
-                               !can_delete_file_in_directory(conn, fname)) {
-                       TALLOC_FREE(case_state);
-                       reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-                       END_PROFILE(SMBntcreateX);
-                       return;
-               }
-       }
-
-#if 0
-       /* We need to support SeSecurityPrivilege for this. */
-       if ((access_mask & SEC_RIGHT_SYSTEM_SECURITY) &&
-                       !user_has_privileges(current_user.nt_user_token,
-                               &se_security)) {
-               TALLOC_FREE(case_state);
-               END_PROFILE(SMBntcreateX);
-               return ERROR_NT(NT_STATUS_PRIVILEGE_NOT_HELD);
-       }
-#endif
-
-       /*
-        * If it's a request for a directory open, deal with it separately.
+        * If the caller set the extended oplock request bit
+        * and we granted one (by whatever means) - set the
+        * correct bit for extended oplock reply.
         */
 
-       if(create_options & FILE_DIRECTORY_FILE) {
-
-               /* Can't open a temp directory. IFS kit test. */
-               if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
-                       TALLOC_FREE(case_state);
-                       reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                       END_PROFILE(SMBntcreateX);
-                       return;
-               }
-
-               oplock_request = 0;
-               status = open_directory(conn, req, fname, &sbuf,
-                                       access_mask,
-                                       share_access,
-                                       create_disposition,
-                                       create_options,
-                                       file_attributes,
-                                       &info, &fsp);
-
-               TALLOC_FREE(case_state);
-
-               if(!NT_STATUS_IS_OK(status)) {
-                       if (!use_nt_status() && NT_STATUS_EQUAL(
-                                   status, NT_STATUS_OBJECT_NAME_COLLISION)) {
-                               status = NT_STATUS_DOS(ERRDOS, ERRfilexists);
-                       }
-                       reply_nterror(req, status);
-                       END_PROFILE(SMBntcreateX);
-                       return;
-               }
-
-       } else {
+       if (oplock_request &&
+           (lp_fake_oplocks(SNUM(conn))
+            || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
 
                /*
-                * Ordinary file case.
+                * Exclusive oplock granted
                 */
 
-               /* NB. We have a potential bug here. If we
-                * cause an oplock break to ourselves, then we
-                * could end up processing filename related
-                * SMB requests whilst we await the oplock
-                * break response. As we may have changed the
-                * filename case semantics to be POSIX-like,
-                * this could mean a filename request could
-                * fail when it should succeed. This is a rare
-                * condition, but eventually we must arrange
-                * to restore the correct case semantics
-                * before issuing an oplock break request to
-                * our client. JRA.  */
-
-               status = open_file_ntcreate(conn, req, fname, &sbuf,
-                                       access_mask,
-                                       share_access,
-                                       create_disposition,
-                                       create_options,
-                                       file_attributes,
-                                       oplock_request,
-                                       &info, &fsp);
-
-               if (!NT_STATUS_IS_OK(status)) { 
-                       /* We cheat here. There are two cases we
-                        * care about. One is a directory rename,
-                        * where the NT client will attempt to
-                        * open the source directory for
-                        * DELETE access. Note that when the
-                        * NT client does this it does *not*
-                        * set the directory bit in the
-                        * request packet. This is translated
-                        * into a read/write open
-                        * request. POSIX states that any open
-                        * for write request on a directory
-                        * will generate an EISDIR error, so
-                        * we can catch this here and open a
-                        * pseudo handle that is flagged as a
-                        * directory. The second is an open
-                        * for a permissions read only, which
-                        * we handle in the open_file_stat case. JRA.
-                        */
-
-                       if (NT_STATUS_EQUAL(status,
-                                           NT_STATUS_FILE_IS_A_DIRECTORY)) {
-
-                               /*
-                                * Fail the open if it was explicitly a non-directory file.
-                                */
-
-                               if (create_options & FILE_NON_DIRECTORY_FILE) {
-                                       TALLOC_FREE(case_state);
-                                       reply_force_nterror(req, NT_STATUS_FILE_IS_A_DIRECTORY);
-                                       END_PROFILE(SMBntcreateX);
-                                       return;
-                               }
-       
-                               oplock_request = 0;
-                               status = open_directory(conn, req, fname,
-                                                       &sbuf,
-                                                       access_mask,
-                                                       share_access,
-                                                       create_disposition,
-                                                       create_options,
-                                                       file_attributes,
-                                                       &info, &fsp);
-
-                               if(!NT_STATUS_IS_OK(status)) {
-                                       TALLOC_FREE(case_state);
-                                       if (!use_nt_status() && NT_STATUS_EQUAL(
-                                                   status, NT_STATUS_OBJECT_NAME_COLLISION)) {
-                                               status = NT_STATUS_DOS(ERRDOS, ERRfilexists);
-                                       }
-                                       reply_nterror(req, status);
-                                       END_PROFILE(SMBntcreateX);
-                                       return;
-                               }
-                       } else {
-                               TALLOC_FREE(case_state);
-                               END_PROFILE(SMBntcreateX);
-                               if (open_was_deferred(req->mid)) {
-                                       /* We have re-scheduled this call. */
-                                       return;
-                               }
-                               reply_nterror(req, status);
-                               return;
-                       }
-               } 
-       }
-               
-       TALLOC_FREE(case_state);
-
-       file_len = sbuf.st_size;
-       fattr = dos_mode(conn,fname,&sbuf);
-       if(fattr == 0) {
-               fattr = FILE_ATTRIBUTE_NORMAL;
-       }
-       if (!fsp->is_directory && (fattr & aDIR)) {
-               close_file(fsp,ERROR_CLOSE);
-               reply_doserror(req, ERRDOS, ERRnoaccess);
-               END_PROFILE(SMBntcreateX);
-               return;
-       } 
-       
-       /* Save the requested allocation size. */
-       if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
-               if (allocation_size && (allocation_size > (SMB_BIG_UINT)file_len)) {
-                       fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
-                       if (fsp->is_directory) {
-                               close_file(fsp,ERROR_CLOSE);
-                               /* Can't set allocation size on a directory. */
-                               reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-                               END_PROFILE(SMBntcreateX);
-                               return;
-                       }
-                       if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
-                               close_file(fsp,ERROR_CLOSE);
-                               reply_nterror(req, NT_STATUS_DISK_FULL);
-                               END_PROFILE(SMBntcreateX);
-                               return;
-                       }
+               if (flags & REQUEST_BATCH_OPLOCK) {
+                       oplock_granted = BATCH_OPLOCK_RETURN;
                } else {
-                       fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)file_len);
+                       oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
                }
+       } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
+               oplock_granted = LEVEL_II_OPLOCK_RETURN;
+       } else {
+               oplock_granted = NO_OPLOCK_RETURN;
        }
 
-       /* 
-        * If the caller set the extended oplock request bit
-        * and we granted one (by whatever means) - set the
-        * correct bit for extended oplock reply.
-        */
-
-       if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
-               extended_oplock_granted = True;
-       }
-
-       if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
-               extended_oplock_granted = True;
+       file_len = sbuf.st_size;
+       fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
+       if (fattr == 0) {
+               fattr = FILE_ATTRIBUTE_NORMAL;
        }
 
        if (flags & EXTENDED_RESPONSE_REQUIRED) {
@@ -971,28 +581,14 @@ void reply_ntcreate_and_X(connection_struct *conn,
        }
 
        p = (char *)req->outbuf + smb_vwv2;
-       
-       /*
-        * Currently as we don't support level II oplocks we just report
-        * exclusive & batch here.
-        */
 
-       if (extended_oplock_granted) {
-               if (flags & REQUEST_BATCH_OPLOCK) {
-                       SCVAL(p,0, BATCH_OPLOCK_RETURN);
-               } else {
-                       SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
-               }
-       } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
-               SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
-       } else {
-               SCVAL(p,0,NO_OPLOCK_RETURN);
-       }
-       
+       SCVAL(p, 0, oplock_granted);
+
        p++;
        SSVAL(p,0,fsp->fnum);
        p += 2;
-       if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
+       if ((create_disposition == FILE_SUPERSEDE)
+           && (info == FILE_WAS_OVERWRITTEN)) {
                SIVAL(p,0,FILE_WAS_SUPERSEDED);
        } else {
                SIVAL(p,0,info);
@@ -1000,7 +596,8 @@ void reply_ntcreate_and_X(connection_struct *conn,
        p += 4;
 
        /* Create time. */
-       c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
+       c_timespec = get_create_timespec(
+               &sbuf,lp_fake_dir_create_times(SNUM(conn)));
        a_timespec = get_atimespec(&sbuf);
        m_timespec = get_mtimespec(&sbuf);
 
@@ -1033,7 +630,8 @@ void reply_ntcreate_and_X(connection_struct *conn,
        if (flags & EXTENDED_RESPONSE_REQUIRED) {
                uint32 perms = 0;
                p += 25;
-               if (fsp->is_directory || can_write_to_file(conn, fname, &sbuf)) {
+               if (fsp->is_directory
+                   || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
                        perms = FILE_GENERIC_ALL;
                } else {
                        perms = FILE_GENERIC_READ|FILE_EXECUTE;
@@ -1041,9 +639,10 @@ void reply_ntcreate_and_X(connection_struct *conn,
                SIVAL(p,0,perms);
        }
 
-       DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n", fsp->fnum, fsp->fsp_name));
+       DEBUG(5,("reply_ntcreate_and_X: fnum = %d, open name = %s\n",
+                fsp->fnum, fsp->fsp_name));
 
-       chain_reply_new(req);
+       chain_reply(req);
        END_PROFILE(SMBntcreateX);
        return;
 }
@@ -1058,13 +657,14 @@ static void do_nt_transact_create_pipe(connection_struct *conn,
                                       char **ppparams, uint32 parameter_count,
                                       char **ppdata, uint32 data_count)
 {
-       pstring fname;
+       char *fname = NULL;
        char *params = *ppparams;
        int pnum = -1;
        char *p = NULL;
        NTSTATUS status;
        size_t param_len;
        uint32 flags;
+       TALLOC_CTX *ctx = talloc_tos();
 
        /*
         * Ensure minimum number of parameters sent.
@@ -1078,8 +678,8 @@ static void do_nt_transact_create_pipe(connection_struct *conn,
 
        flags = IVAL(params,0);
 
-       srvstr_get_path(params, req->flags2, fname, params+53,
-                       sizeof(fname), parameter_count-53, STR_TERMINATE,
+       srvstr_get_path(ctx, params, req->flags2, &fname, params+53,
+                       parameter_count-53, STR_TERMINATE,
                        &status);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
@@ -1092,7 +692,7 @@ static void do_nt_transact_create_pipe(connection_struct *conn,
                /* Error return */
                return;
        }
-       
+
        /* Realloc the size of parameters and data we will return */
        if (flags & EXTENDED_RESPONSE_REQUIRED) {
                /* Extended response is 32 more byyes. */
@@ -1105,16 +705,16 @@ static void do_nt_transact_create_pipe(connection_struct *conn,
                reply_doserror(req, ERRDOS, ERRnomem);
                return;
        }
-       
+
        p = params;
        SCVAL(p,0,NO_OPLOCK_RETURN);
-       
+
        p += 2;
        SSVAL(p,0,pnum);
        p += 2;
        SIVAL(p,0,FILE_WAS_OPENED);
        p += 8;
-       
+
        p += 32;
        SIVAL(p,0,FILE_ATTRIBUTE_NORMAL); /* File Attributes. */
        p += 20;
@@ -1123,11 +723,11 @@ static void do_nt_transact_create_pipe(connection_struct *conn,
        /* Device state. */
        SSVAL(p,2, 0x5FF); /* ? */
        p += 4;
-       
+
        if (flags & EXTENDED_RESPONSE_REQUIRED) {
                p += 25;
                SIVAL(p,0,FILE_GENERIC_ALL);
-               /* 
+               /*
                 * For pipes W2K3 seems to return
                 * 0x12019B next.
                 * This is ((FILE_GENERIC_READ|FILE_GENERIC_WRITE) & ~FILE_APPEND_DATA)
@@ -1136,10 +736,10 @@ static void do_nt_transact_create_pipe(connection_struct *conn,
        }
 
        DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
-       
+
        /* Send the required number of replies */
-       send_nt_replies_new(req, NT_STATUS_OK, params, param_len, *ppdata, 0);
-       
+       send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
+
        return;
 }
 
@@ -1147,48 +747,22 @@ static void do_nt_transact_create_pipe(connection_struct *conn,
  Internal fn to set security descriptors.
 ****************************************************************************/
 
-static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 security_info_sent)
+static NTSTATUS set_sd(files_struct *fsp, uint8 *data, uint32 sd_len,
+                      uint32 security_info_sent)
 {
-       prs_struct pd;
        SEC_DESC *psd = NULL;
-       TALLOC_CTX *mem_ctx;
        NTSTATUS status;
-       
+
        if (sd_len == 0 || !lp_nt_acl_support(SNUM(fsp->conn))) {
                return NT_STATUS_OK;
        }
 
-       /*
-        * Init the parse struct we will unmarshall from.
-        */
+       status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
 
-       if ((mem_ctx = talloc_init("set_sd")) == NULL) {
-               DEBUG(0,("set_sd: talloc_init failed.\n"));
-               return NT_STATUS_NO_MEMORY;
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
        }
 
-       prs_init(&pd, 0, mem_ctx, UNMARSHALL);
-
-       /*
-        * Setup the prs_struct to point at the memory we just
-        * allocated.
-        */
-       
-       prs_give_memory( &pd, data, sd_len, False);
-
-       /*
-        * Finally, unmarshall from the data buffer.
-        */
-
-       if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
-               DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
-               /*
-                * Return access denied for want of a better error message..
-                */ 
-               talloc_destroy(mem_ctx);
-               return NT_STATUS_NO_MEMORY;
-       }
-       
        if (psd->owner_sid==0) {
                security_info_sent &= ~OWNER_SECURITY_INFORMATION;
        }
@@ -1201,17 +775,24 @@ static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 secu
        if (psd->dacl==0) {
                security_info_sent &= ~DACL_SECURITY_INFORMATION;
        }
-       
-       status = SMB_VFS_FSET_NT_ACL( fsp, fsp->fh->fd, security_info_sent, psd);
-       
-       talloc_destroy(mem_ctx);
+
+       if (fsp->fh->fd != -1) {
+               status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
+       }
+       else {
+               status = SMB_VFS_SET_NT_ACL(fsp, fsp->fsp_name,
+                                           security_info_sent, psd);
+       }
+
+       TALLOC_FREE(psd);
+
        return status;
 }
 
 /****************************************************************************
  Read a list of EA names and data from an incoming data buffer. Create an ea_list with them.
 ****************************************************************************/
-                                                                                                                             
+
 static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
 {
        struct ea_list *ea_list_head = NULL;
@@ -1235,7 +816,7 @@ static struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata,
                }
                offset += next_offset;
        }
-                                                                                                                             
+
        return ea_list_head;
 }
 
@@ -1250,18 +831,16 @@ static void call_nt_transact_create(connection_struct *conn,
                                    char **ppdata, uint32 data_count,
                                    uint32 max_data_count)
 {
-       pstring fname;
+       char *fname = NULL;
        char *params = *ppparams;
        char *data = *ppdata;
        /* Breakout the oplock request bits so we can set the reply bits separately. */
-       int oplock_request = 0;
        uint32 fattr=0;
        SMB_OFF_T file_len = 0;
        SMB_STRUCT_STAT sbuf;
        int info = 0;
        files_struct *fsp = NULL;
        char *p = NULL;
-       BOOL extended_oplock_granted = False;
        uint32 flags;
        uint32 access_mask;
        uint32 file_attributes;
@@ -1269,17 +848,19 @@ static void call_nt_transact_create(connection_struct *conn,
        uint32 create_disposition;
        uint32 create_options;
        uint32 sd_len;
+       struct security_descriptor *sd = NULL;
        uint32 ea_len;
        uint16 root_dir_fid;
        struct timespec c_timespec;
        struct timespec a_timespec;
        struct timespec m_timespec;
        struct ea_list *ea_list = NULL;
-       TALLOC_CTX *ctx = NULL;
-       char *pdata = NULL;
        NTSTATUS status;
        size_t param_len;
-       struct case_semantics_state *case_state = NULL;
+       SMB_BIG_UINT allocation_size;
+       int oplock_request;
+       uint8_t oplock_granted;
+       TALLOC_CTX *ctx = talloc_tos();
 
        DEBUG(5,("call_nt_transact_create\n"));
 
@@ -1295,10 +876,9 @@ static void call_nt_transact_create(connection_struct *conn,
                                ppparams, parameter_count,
                                ppdata, data_count);
                        return;
-               } else {
-                       reply_doserror(req, ERRDOS, ERRnoaccess);
-                       return;
                }
+               reply_doserror(req, ERRDOS, ERRnoaccess);
+               return;
        }
 
        /*
@@ -1320,392 +900,126 @@ static void call_nt_transact_create(connection_struct *conn,
        sd_len = IVAL(params,36);
        ea_len = IVAL(params,40);
        root_dir_fid = (uint16)IVAL(params,4);
+       allocation_size = (SMB_BIG_UINT)IVAL(params,12);
+#ifdef LARGE_SMB_OFF_T
+       allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
+#endif
+
+       /*
+        * we need to remove ignored bits when they come directly from the client
+        * because we reuse some of them for internal stuff
+        */
+       create_options &= ~NTCREATEX_OPTIONS_MUST_IGNORE_MASK;
 
        /* Ensure the data_len is correct for the sd and ea values given. */
-       if ((ea_len + sd_len > data_count) ||
-                       (ea_len > data_count) || (sd_len > data_count) ||
-                       (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
-               DEBUG(10,("call_nt_transact_create - ea_len = %u, sd_len = %u, data_count = %u\n",
-                       (unsigned int)ea_len, (unsigned int)sd_len, (unsigned int)data_count ));
+       if ((ea_len + sd_len > data_count)
+           || (ea_len > data_count) || (sd_len > data_count)
+           || (ea_len + sd_len < ea_len) || (ea_len + sd_len < sd_len)) {
+               DEBUG(10, ("call_nt_transact_create - ea_len = %u, sd_len = "
+                          "%u, data_count = %u\n", (unsigned int)ea_len,
+                          (unsigned int)sd_len, (unsigned int)data_count));
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                return;
        }
 
-       if (ea_len) {
-               if (!lp_ea_support(SNUM(conn))) {
-                       DEBUG(10,("call_nt_transact_create - ea_len = %u but EA's not supported.\n",
-                               (unsigned int)ea_len ));
-                       reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
-                       return;
-               }
-
-               if (ea_len < 10) {
-                       DEBUG(10,("call_nt_transact_create - ea_len = %u - too small (should be more than 10)\n",
-                               (unsigned int)ea_len ));
-                       reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                       return;
-               }
-       }
-
-       if (create_options & FILE_OPEN_BY_FILE_ID) {
-               reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
-               return;
-       }
-
-       /*
-        * Get the file name.
-        */
-
-       if(root_dir_fid != 0) {
-               /*
-                * This filename is relative to a directory fid.
-                */
-               files_struct *dir_fsp = file_fsp(SVAL(params,4));
-               size_t dir_name_len;
+       if (sd_len) {
+               DEBUG(10, ("call_nt_transact_create - sd_len = %d\n",
+                          sd_len));
 
-               if(!dir_fsp) {
-                       reply_doserror(req, ERRDOS, ERRbadfid);
-                       return;
-               }
-
-               if(!dir_fsp->is_directory) {
-                       srvstr_get_path(params, req->flags2, fname,
-                                       params+53, sizeof(fname),
-                                       parameter_count-53, STR_TERMINATE,
-                                       &status);
-                       if (!NT_STATUS_IS_OK(status)) {
-                               reply_nterror(req, status);
-                               return;
-                       }
-
-                       /*
-                        * Check to see if this is a mac fork of some kind.
-                        */
-
-                       if( is_ntfs_stream_name(fname)) {
-                               reply_nterror(req,
-                                             NT_STATUS_OBJECT_PATH_NOT_FOUND);
-                               return;
-                       }
-
-                       reply_doserror(req, ERRDOS, ERRbadfid);
-                       return;
-               }
-
-               /*
-                * Copy in the base directory name.
-                */
-
-               pstrcpy( fname, dir_fsp->fsp_name );
-               dir_name_len = strlen(fname);
-
-               /*
-                * Ensure it ends in a '\'.
-                */
-
-               if((fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) {
-                       pstrcat(fname, "/");
-                       dir_name_len++;
-               }
-
-               {
-                       pstring tmpname;
-                       srvstr_get_path(params, req->flags2, tmpname,
-                                       params+53, sizeof(tmpname),
-                                       parameter_count-53, STR_TERMINATE,
-                                       &status);
-                       if (!NT_STATUS_IS_OK(status)) {
-                               reply_nterror(req, status);
-                               return;
-                       }
-                       pstrcat(fname, tmpname);
-               }
-       } else {
-               srvstr_get_path(params, req->flags2, fname, params+53,
-                               sizeof(fname), parameter_count-53,
-                               STR_TERMINATE, &status);
+               status = unmarshall_sec_desc(ctx, (uint8_t *)data, sd_len,
+                                            &sd);
                if (!NT_STATUS_IS_OK(status)) {
+                       DEBUG(10, ("call_nt_transact_create: "
+                                  "unmarshall_sec_desc failed: %s\n",
+                                  nt_errstr(status)));
                        reply_nterror(req, status);
                        return;
                }
-
-               /*
-                * Check to see if this is a mac fork of some kind.
-                */
-
-               if( is_ntfs_stream_name(fname)) {
-                       reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
-                       return;
-               }
        }
 
-       oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
-       if (oplock_request) {
-               oplock_request |= (flags & REQUEST_BATCH_OPLOCK) ? BATCH_OPLOCK : 0;
-       }
-
-       /*
-        * Ordinary file or directory.
-        */
-               
-       /*
-        * Check if POSIX semantics are wanted.
-        */
-
-       if (file_attributes & FILE_FLAG_POSIX_SEMANTICS) {
-               case_state = set_posix_case_semantics(NULL, conn);
-               file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
-       }
-               
-       status = resolve_dfspath(conn, req->flags2 & FLAGS2_DFS_PATHNAMES,
-                                fname);
-       if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(case_state);
-               if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-                       reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
-                                       ERRSRV, ERRbadpath);
+       if (ea_len) {
+               if (!lp_ea_support(SNUM(conn))) {
+                       DEBUG(10, ("call_nt_transact_create - ea_len = %u but "
+                                  "EA's not supported.\n",
+                                  (unsigned int)ea_len));
+                       reply_nterror(req, NT_STATUS_EAS_NOT_SUPPORTED);
                        return;
                }
-               reply_nterror(req, status);
-               return;
-       }
 
-       status = unix_convert(conn, fname, False, NULL, &sbuf);
-       if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(case_state);
-               reply_nterror(req, status);
-               return;
-       }
-       /* All file access must go through check_name() */
-       status = check_name(conn, fname);
-       if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(case_state);
-               reply_nterror(req, status);
-               return;
-       }
-
-       /* This is the correct thing to do (check every time) but can_delete is
-          expensive (it may have to read the parent directory permissions). So
-          for now we're not doing it unless we have a strong hint the client
-          is really going to delete this file. If the client is forcing FILE_CREATE
-          let the filesystem take care of the permissions. */
-
-       /* Setting FILE_SHARE_DELETE is the hint. */
-
-       if (lp_acl_check_permissions(SNUM(conn))
-           && (create_disposition != FILE_CREATE)
-           && (share_access & FILE_SHARE_DELETE)
-           && (access_mask & DELETE_ACCESS)) {
-               if ((dos_mode(conn, fname, &sbuf) & FILE_ATTRIBUTE_READONLY) ||
-                               !can_delete_file_in_directory(conn, fname)) {
-                       TALLOC_FREE(case_state);
-                       reply_nterror(req, NT_STATUS_ACCESS_DENIED);
+               if (ea_len < 10) {
+                       DEBUG(10,("call_nt_transact_create - ea_len = %u - "
+                                 "too small (should be more than 10)\n",
+                                 (unsigned int)ea_len ));
+                       reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                        return;
                }
-       }
-
-#if 0
-       /* We need to support SeSecurityPrivilege for this. */
-       if ((access_mask & SEC_RIGHT_SYSTEM_SECURITY) &&
-                       !user_has_privileges(current_user.nt_user_token,
-                               &se_security)) {
-               TALLOC_FREE(case_state);
-               reply_nterror(req, NT_STATUS_PRIVILEGE_NOT_HELD);
-               return;
-       }
-#endif
-
-       if (ea_len) {
-               pdata = data + sd_len;
 
                /* We have already checked that ea_len <= data_count here. */
-               ea_list = read_nttrans_ea_list(tmp_talloc_ctx(), pdata,
+               ea_list = read_nttrans_ea_list(talloc_tos(), data + sd_len,
                                               ea_len);
-               if (!ea_list ) {
-                       TALLOC_FREE(case_state);
-                       reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                       return;
-               }
-       }
-
-       /*
-        * If it's a request for a directory open, deal with it separately.
-        */
-
-       if(create_options & FILE_DIRECTORY_FILE) {
-
-               /* Can't open a temp directory. IFS kit test. */
-               if (file_attributes & FILE_ATTRIBUTE_TEMPORARY) {
-                       TALLOC_FREE(case_state);
+               if (ea_list == NULL) {
                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                        return;
                }
-
-               /*
-                * We will get a create directory here if the Win32
-                * app specified a security descriptor in the 
-                * CreateDirectory() call.
-                */
-
-               oplock_request = 0;
-               status = open_directory(conn, req, fname, &sbuf,
-                                       access_mask,
-                                       share_access,
-                                       create_disposition,
-                                       create_options,
-                                       file_attributes,
-                                       &info, &fsp);
-               if(!NT_STATUS_IS_OK(status)) {
-                       TALLOC_FREE(case_state);
-                       reply_nterror(req, status);
-                       return;
-               }
-
-       } else {
-
-               /*
-                * Ordinary file case.
-                */
-
-               status = open_file_ntcreate(conn,req,fname,&sbuf,
-                                       access_mask,
-                                       share_access,
-                                       create_disposition,
-                                       create_options,
-                                       file_attributes,
-                                       oplock_request,
-                                       &info, &fsp);
-
-               if (!NT_STATUS_IS_OK(status)) { 
-                       if (NT_STATUS_EQUAL(status,
-                                           NT_STATUS_FILE_IS_A_DIRECTORY)) {
-
-                               /*
-                                * Fail the open if it was explicitly a non-directory file.
-                                */
-
-                               if (create_options & FILE_NON_DIRECTORY_FILE) {
-                                       TALLOC_FREE(case_state);
-                                       reply_force_nterror(
-                                               req,
-                                               NT_STATUS_FILE_IS_A_DIRECTORY);
-                                       return;
-                               }
-       
-                               oplock_request = 0;
-                               status = open_directory(conn, req, fname,
-                                                       &sbuf,
-                                                       access_mask,
-                                                       share_access,
-                                                       create_disposition,
-                                                       create_options,
-                                                       file_attributes,
-                                                       &info, &fsp);
-                               if(!NT_STATUS_IS_OK(status)) {
-                                       TALLOC_FREE(case_state);
-                                       reply_nterror(req, status);
-                                       return;
-                               }
-                       } else {
-                               TALLOC_FREE(case_state);
-                               if (open_was_deferred(req->mid)) {
-                                       /* We have re-scheduled this call. */
-                                       return;
-                               }
-                               reply_nterror(req, status);
-                               return;
-                       }
-               } 
        }
 
-       /*
-        * According to the MS documentation, the only time the security
-        * descriptor is applied to the opened file is iff we *created* the
-        * file; an existing file stays the same.
-        * 
-        * Also, it seems (from observation) that you can open the file with
-        * any access mask but you can still write the sd. We need to override
-        * the granted access before we call set_sd
-        * Patch for bug #2242 from Tom Lackemann <cessnatomny@yahoo.com>.
-        */
-
-       if (lp_nt_acl_support(SNUM(conn)) && sd_len && info == FILE_WAS_CREATED) {
-               uint32 saved_access_mask = fsp->access_mask;
-
-               /* We have already checked that sd_len <= data_count here. */
-
-               fsp->access_mask = FILE_GENERIC_ALL;
-
-               status = set_sd( fsp, data, sd_len, ALL_SECURITY_INFORMATION);
-               if (!NT_STATUS_IS_OK(status)) {
-                       talloc_destroy(ctx);
-                       close_file(fsp,ERROR_CLOSE);
-                       TALLOC_FREE(case_state);
-                       reply_nterror(req, status);
-                       return;
-               }
-               fsp->access_mask = saved_access_mask;
-       }
-       
-       if (ea_len && (info == FILE_WAS_CREATED)) {
-               status = set_ea(conn, fsp, fname, ea_list);
-               if (!NT_STATUS_IS_OK(status)) {
-                       close_file(fsp,ERROR_CLOSE);
-                       TALLOC_FREE(case_state);
-                       reply_nterror(req, status);
-                       return;
-               }
-       }
-
-       TALLOC_FREE(case_state);
-
-       file_len = sbuf.st_size;
-       fattr = dos_mode(conn,fname,&sbuf);
-       if(fattr == 0) {
-               fattr = FILE_ATTRIBUTE_NORMAL;
-       }
-       if (!fsp->is_directory && (fattr & aDIR)) {
-               close_file(fsp,ERROR_CLOSE);
-               reply_doserror(req, ERRDOS, ERRnoaccess);
-               return;
-       } 
-       
-       /* Save the requested allocation size. */
-       if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
-               SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)IVAL(params,12);
-#ifdef LARGE_SMB_OFF_T
-               allocation_size |= (((SMB_BIG_UINT)IVAL(params,16)) << 32);
-#endif
-               if (allocation_size && (allocation_size > file_len)) {
-                       fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
-                       if (fsp->is_directory) {
-                               close_file(fsp,ERROR_CLOSE);
-                               /* Can't set allocation size on a directory. */
-                               reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-                               return;
-                       }
-                       if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
-                               close_file(fsp,ERROR_CLOSE);
-                               reply_nterror(req, NT_STATUS_DISK_FULL);
-                               return;
-                       }
-               } else {
-                       fsp->initial_allocation_size = smb_roundup(fsp->conn, (SMB_BIG_UINT)file_len);
+       srvstr_get_path(ctx, params, req->flags2, &fname,
+                       params+53, parameter_count-53,
+                       STR_TERMINATE, &status);
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
+               return;
+       }
+
+       oplock_request = (flags & REQUEST_OPLOCK) ? EXCLUSIVE_OPLOCK : 0;
+       if (oplock_request) {
+               oplock_request |= (flags & REQUEST_BATCH_OPLOCK)
+                       ? BATCH_OPLOCK : 0;
+       }
+
+       status = create_file(conn, req, root_dir_fid, fname,
+                            access_mask, share_access, create_disposition,
+                            create_options, file_attributes, oplock_request,
+                            allocation_size, sd, ea_list, &fsp, &info, &sbuf);
+
+       if(!NT_STATUS_IS_OK(status)) {
+               if (open_was_deferred(req->mid)) {
+                       /* We have re-scheduled this call, no error. */
+                       return;
                }
+               reply_openerror(req, status);
+               return;
        }
 
-       /* 
+       /*
         * If the caller set the extended oplock request bit
         * and we granted one (by whatever means) - set the
         * correct bit for extended oplock reply.
         */
 
-       if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
-               extended_oplock_granted = True;
+       if (oplock_request &&
+           (lp_fake_oplocks(SNUM(conn))
+            || EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))) {
+
+               /*
+                * Exclusive oplock granted
+                */
+
+               if (flags & REQUEST_BATCH_OPLOCK) {
+                       oplock_granted = BATCH_OPLOCK_RETURN;
+               } else {
+                       oplock_granted = EXCLUSIVE_OPLOCK_RETURN;
+               }
+       } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
+               oplock_granted = LEVEL_II_OPLOCK_RETURN;
+       } else {
+               oplock_granted = NO_OPLOCK_RETURN;
        }
 
-       if(oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
-               extended_oplock_granted = True;
+       file_len = sbuf.st_size;
+       fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
+       if (fattr == 0) {
+               fattr = FILE_ATTRIBUTE_NORMAL;
        }
 
        /* Realloc the size of parameters and data we will return */
@@ -1722,22 +1036,13 @@ static void call_nt_transact_create(connection_struct *conn,
        }
 
        p = params;
-       if (extended_oplock_granted) {
-               if (flags & REQUEST_BATCH_OPLOCK) {
-                       SCVAL(p,0, BATCH_OPLOCK_RETURN);
-               } else {
-                       SCVAL(p,0, EXCLUSIVE_OPLOCK_RETURN);
-               }
-       } else if (fsp->oplock_type == LEVEL_II_OPLOCK) {
-               SCVAL(p,0, LEVEL_II_OPLOCK_RETURN);
-       } else {
-               SCVAL(p,0,NO_OPLOCK_RETURN);
-       }
-       
+       SCVAL(p, 0, oplock_granted);
+
        p += 2;
        SSVAL(p,0,fsp->fnum);
        p += 2;
-       if ((create_disposition == FILE_SUPERSEDE) && (info == FILE_WAS_OVERWRITTEN)) {
+       if ((create_disposition == FILE_SUPERSEDE)
+           && (info == FILE_WAS_OVERWRITTEN)) {
                SIVAL(p,0,FILE_WAS_SUPERSEDED);
        } else {
                SIVAL(p,0,info);
@@ -1745,7 +1050,8 @@ static void call_nt_transact_create(connection_struct *conn,
        p += 8;
 
        /* Create time. */
-       c_timespec = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
+       c_timespec = get_create_timespec(
+               &sbuf,lp_fake_dir_create_times(SNUM(conn)));
        a_timespec = get_atimespec(&sbuf);
        m_timespec = get_mtimespec(&sbuf);
 
@@ -1778,7 +1084,8 @@ static void call_nt_transact_create(connection_struct *conn,
        if (flags & EXTENDED_RESPONSE_REQUIRED) {
                uint32 perms = 0;
                p += 25;
-               if (fsp->is_directory || can_write_to_file(conn, fname, &sbuf)) {
+               if (fsp->is_directory
+                   || can_write_to_file(conn, fsp->fsp_name, &sbuf)) {
                        perms = FILE_GENERIC_ALL;
                } else {
                        perms = FILE_GENERIC_READ|FILE_EXECUTE;
@@ -1786,10 +1093,10 @@ static void call_nt_transact_create(connection_struct *conn,
                SIVAL(p,0,perms);
        }
 
-       DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
+       DEBUG(5,("call_nt_transact_create: open name = %s\n", fsp->fsp_name));
 
        /* Send the required number of replies */
-       send_nt_replies_new(req, NT_STATUS_OK, params, param_len, *ppdata, 0);
+       send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
 
        return;
 }
@@ -1799,17 +1106,17 @@ static void call_nt_transact_create(connection_struct *conn,
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_ntcancel(connection_struct *conn, struct smb_request *req)
+void reply_ntcancel(struct smb_request *req)
 {
        /*
         * Go through and cancel any pending change notifies.
         */
-       
+
        START_PROFILE(SMBntcancel);
        remove_pending_change_notify_requests_by_mid(req->mid);
        remove_pending_lock_requests_by_mid(req->mid);
        srv_cancel_sign_response(req->mid);
-       
+
        DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));
 
        END_PROFILE(SMBntcancel);
@@ -1820,13 +1127,18 @@ void reply_ntcancel(connection_struct *conn, struct smb_request *req)
  Copy a file.
 ****************************************************************************/
 
-static NTSTATUS copy_internals(connection_struct *conn,
-                              struct smb_request *req,
-                              char *oldname, char *newname, uint32 attrs)
+static NTSTATUS copy_internals(TALLOC_CTX *ctx,
+                               connection_struct *conn,
+                               struct smb_request *req,
+                               const char *oldname_in,
+                               const char *newname_in,
+                               uint32 attrs)
 {
        SMB_STRUCT_STAT sbuf1, sbuf2;
-       pstring last_component_oldname;
-       pstring last_component_newname;
+       char *oldname = NULL;
+       char *newname = NULL;
+       char *last_component_oldname = NULL;
+       char *last_component_newname = NULL;
        files_struct *fsp1,*fsp2;
        uint32 fattr;
        int info;
@@ -1840,7 +1152,8 @@ static NTSTATUS copy_internals(connection_struct *conn,
                return NT_STATUS_MEDIA_WRITE_PROTECTED;
        }
 
-       status = unix_convert(conn, oldname, False, last_component_oldname, &sbuf1);
+       status = unix_convert(ctx, conn, oldname_in, False, &oldname,
+                       &last_component_oldname, &sbuf1);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -1860,7 +1173,8 @@ static NTSTATUS copy_internals(connection_struct *conn,
                return NT_STATUS_NO_SUCH_FILE;
        }
 
-       status = unix_convert(conn, newname, False, last_component_newname, &sbuf2);
+       status = unix_convert(ctx, conn, newname_in, False, &newname,
+                       &last_component_newname, &sbuf2);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -1886,7 +1200,8 @@ static NTSTATUS copy_internals(connection_struct *conn,
                return status;
        }
 
-       DEBUG(10,("copy_internals: doing file copy %s to %s\n", oldname, newname));
+       DEBUG(10,("copy_internals: doing file copy %s to %s\n",
+                               oldname, newname));
 
         status = open_file_ntcreate(conn, req, oldname, &sbuf1,
                        FILE_READ_DATA, /* Read-only. */
@@ -1928,7 +1243,7 @@ static NTSTATUS copy_internals(connection_struct *conn,
        close_file(fsp1,NORMAL_CLOSE);
 
        /* Ensure the modtime is set correctly on the destination file. */
-       fsp_set_pending_modtime(fsp2, get_mtimespec(&sbuf1));
+       set_close_write_time(fsp2, get_mtimespec(&sbuf1));
 
        status = close_file(fsp2,NORMAL_CLOSE);
 
@@ -1936,7 +1251,7 @@ static NTSTATUS copy_internals(connection_struct *conn,
           creates the file. This isn't the correct thing to do in the copy
           case. JRA */
        file_set_dosmode(conn, newname, fattr, &sbuf2,
-                        parent_dirname(newname));
+                        parent_dirname(newname),false);
 
        if (ret < (SMB_OFF_T)sbuf1.st_size) {
                return NT_STATUS_DISK_FULL;
@@ -1953,85 +1268,112 @@ static NTSTATUS copy_internals(connection_struct *conn,
  Reply to a NT rename request.
 ****************************************************************************/
 
-int reply_ntrename(connection_struct *conn,
-                  char *inbuf,char *outbuf,int length,int bufsize)
+void reply_ntrename(struct smb_request *req)
 {
-       int outsize = 0;
-       pstring oldname;
-       pstring newname;
+       connection_struct *conn = req->conn;
+       char *oldname = NULL;
+       char *newname = NULL;
        char *p;
        NTSTATUS status;
-       BOOL src_has_wcard = False;
-       BOOL dest_has_wcard = False;
-       uint32 attrs = SVAL(inbuf,smb_vwv0);
-       uint16 rename_type = SVAL(inbuf,smb_vwv1);
-       struct smb_request req;
+       bool src_has_wcard = False;
+       bool dest_has_wcard = False;
+       uint32 attrs;
+       uint16 rename_type;
+       TALLOC_CTX *ctx = talloc_tos();
 
        START_PROFILE(SMBntrename);
 
-       init_smb_request(&req, (uint8 *)inbuf);
+       if (req->wct < 4) {
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               END_PROFILE(SMBntrename);
+               return;
+       }
 
-       p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path_wcard(inbuf, SVAL(inbuf,smb_flg2), oldname, p,
-                                  sizeof(oldname), 0, STR_TERMINATE, &status,
+       attrs = SVAL(req->inbuf,smb_vwv0);
+       rename_type = SVAL(req->inbuf,smb_vwv1);
+
+       p = smb_buf(req->inbuf) + 1;
+       p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &oldname, p,
+                                  0, STR_TERMINATE, &status,
                                   &src_has_wcard);
        if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
                END_PROFILE(SMBntrename);
-               return ERROR_NT(status);
+               return;
        }
 
        if( is_ntfs_stream_name(oldname)) {
                /* Can't rename a stream. */
+               reply_nterror(req, NT_STATUS_ACCESS_DENIED);
                END_PROFILE(SMBntrename);
-               return ERROR_NT(NT_STATUS_ACCESS_DENIED);
+               return;
        }
 
        if (ms_has_wild(oldname)) {
+               reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
                END_PROFILE(SMBntrename);
-               return ERROR_NT(NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
+               return;
        }
 
        p++;
-       p += srvstr_get_path_wcard(inbuf, SVAL(inbuf,smb_flg2), newname, p,
-                                  sizeof(newname), 0, STR_TERMINATE, &status,
+       p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
+                                  0, STR_TERMINATE, &status,
                                   &dest_has_wcard);
        if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
                END_PROFILE(SMBntrename);
-               return ERROR_NT(status);
+               return;
        }
-       
-       status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, oldname);
+
+       status = resolve_dfspath(ctx, conn,
+                               req->flags2 & FLAGS2_DFS_PATHNAMES,
+                               oldname,
+                               &oldname);
        if (!NT_STATUS_IS_OK(status)) {
-               END_PROFILE(SMBntrename);
                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-                       return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
+                       reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
+                                       ERRSRV, ERRbadpath);
+                       END_PROFILE(SMBntrename);
+                       return;
                }
-               return ERROR_NT(status);
+               reply_nterror(req, status);
+               END_PROFILE(SMBntrename);
+               return;
        }
 
-       status = resolve_dfspath(conn, SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES, newname);
+       status = resolve_dfspath(ctx, conn,
+                               req->flags2 & FLAGS2_DFS_PATHNAMES,
+                               newname,
+                               &newname);
        if (!NT_STATUS_IS_OK(status)) {
-               END_PROFILE(SMBntrename);
                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-                       return ERROR_BOTH(NT_STATUS_PATH_NOT_COVERED, ERRSRV, ERRbadpath);
+                       reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
+                                       ERRSRV, ERRbadpath);
+                       END_PROFILE(SMBntrename);
+                       return;
                }
-               return ERROR_NT(status);
+               reply_nterror(req, status);
+               END_PROFILE(SMBntrename);
+               return;
        }
 
        DEBUG(3,("reply_ntrename : %s -> %s\n",oldname,newname));
-       
+
        switch(rename_type) {
                case RENAME_FLAG_RENAME:
-                       status = rename_internals(conn, &req, oldname, newname,
-                                                 attrs, False, src_has_wcard,
-                                                 dest_has_wcard);
+                       status = rename_internals(ctx, conn, req, oldname,
+                                       newname, attrs, False, src_has_wcard,
+                                       dest_has_wcard, DELETE_ACCESS);
                        break;
                case RENAME_FLAG_HARD_LINK:
                        if (src_has_wcard || dest_has_wcard) {
                                /* No wildcards. */
                                status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
                        } else {
-                               status = hardlink_internals(conn, oldname, newname);
+                               status = hardlink_internals(ctx,
+                                               conn,
+                                               oldname,
+                                               newname);
                        }
                        break;
                case RENAME_FLAG_COPY:
@@ -2039,7 +1381,7 @@ int reply_ntrename(connection_struct *conn,
                                /* No wildcards. */
                                status = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
                        } else {
-                               status = copy_internals(conn, &req, oldname,
+                               status = copy_internals(ctx, conn, req, oldname,
                                                        newname, attrs);
                        }
                        break;
@@ -2052,43 +1394,47 @@ int reply_ntrename(connection_struct *conn,
        }
 
        if (!NT_STATUS_IS_OK(status)) {
-               END_PROFILE(SMBntrename);
-               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+               if (open_was_deferred(req->mid)) {
                        /* We have re-scheduled this call. */
-                       return -1;
+                       END_PROFILE(SMBntrename);
+                       return;
                }
-               return ERROR_NT(status);
+
+               reply_nterror(req, status);
+               END_PROFILE(SMBntrename);
+               return;
        }
 
-       outsize = set_message(inbuf,outbuf,0,0,False);
-  
+       reply_outbuf(req, 0, 0);
+
        END_PROFILE(SMBntrename);
-       return(outsize);
+       return;
 }
 
 /****************************************************************************
- Reply to a notify change - queue the request and 
+ Reply to a notify change - queue the request and
  don't allow a directory to be opened.
 ****************************************************************************/
 
-static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf,
-                                         char *outbuf, int length,
-                                         int bufsize, 
-                                         uint16 **ppsetup, uint32 setup_count,
-                                         char **ppparams,
-                                         uint32 parameter_count,
-                                         char **ppdata, uint32 data_count,
-                                         uint32 max_data_count,
-                                         uint32 max_param_count)
+static void call_nt_transact_notify_change(connection_struct *conn,
+                                          struct smb_request *req,
+                                          uint16 **ppsetup,
+                                          uint32 setup_count,
+                                          char **ppparams,
+                                          uint32 parameter_count,
+                                          char **ppdata, uint32 data_count,
+                                          uint32 max_data_count,
+                                          uint32 max_param_count)
 {
        uint16 *setup = *ppsetup;
        files_struct *fsp;
        uint32 filter;
        NTSTATUS status;
-       BOOL recursive;
+       bool recursive;
 
        if(setup_count < 6) {
-               return ERROR_DOS(ERRDOS,ERRbadfunc);
+               reply_doserror(req, ERRDOS, ERRbadfunc);
+               return;
        }
 
        fsp = file_fsp(SVAL(setup,4));
@@ -2098,14 +1444,16 @@ static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf,
        DEBUG(3,("call_nt_transact_notify_change\n"));
 
        if(!fsp) {
-               return ERROR_DOS(ERRDOS,ERRbadfid);
+               reply_doserror(req, ERRDOS, ERRbadfid);
+               return;
        }
 
        {
                char *filter_string;
 
                if (!(filter_string = notify_filter_string(NULL, filter))) {
-                       return ERROR_NT(NT_STATUS_NO_MEMORY);
+                       reply_nterror(req,NT_STATUS_NO_MEMORY);
+                       return;
                }
 
                DEBUG(3,("call_nt_transact_notify_change: notify change "
@@ -2116,7 +1464,8 @@ static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf,
        }
 
        if((!fsp->is_directory) || (conn != fsp->conn)) {
-               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               return;
        }
 
        if (fsp->notify == NULL) {
@@ -2126,7 +1475,8 @@ static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf,
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(10, ("change_notify_create returned %s\n",
                                   nt_errstr(status)));
-                       return ERROR_NT(status);
+                       reply_nterror(req, status);
+                       return;
                }
        }
 
@@ -2141,98 +1491,91 @@ static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf,
                 * here.
                 */
 
-               change_notify_reply(inbuf, max_param_count, fsp->notify);
+               change_notify_reply(fsp->conn, req->inbuf, max_param_count, fsp->notify);
 
                /*
                 * change_notify_reply() above has independently sent its
                 * results
                 */
-               return -1;
+               return;
        }
 
        /*
         * No changes pending, queue the request
         */
 
-       status = change_notify_add_request(inbuf, max_param_count, filter,
+       status = change_notify_add_request(req,
+                       max_param_count,
+                       filter,
                        recursive, fsp);
        if (!NT_STATUS_IS_OK(status)) {
-               return ERROR_NT(status);
+               reply_nterror(req, status);
        }
-
-       return -1;
+       return;
 }
 
 /****************************************************************************
  Reply to an NT transact rename command.
 ****************************************************************************/
 
-static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize,
-                                  uint16 **ppsetup, uint32 setup_count,
-                                 char **ppparams, uint32 parameter_count,
-                                 char **ppdata, uint32 data_count, uint32 max_data_count)
+static void call_nt_transact_rename(connection_struct *conn,
+                                   struct smb_request *req,
+                                   uint16 **ppsetup, uint32 setup_count,
+                                   char **ppparams, uint32 parameter_count,
+                                   char **ppdata, uint32 data_count,
+                                   uint32 max_data_count)
 {
        char *params = *ppparams;
-       pstring new_name;
+       char *new_name = NULL;
        files_struct *fsp = NULL;
-       BOOL replace_if_exists = False;
-       BOOL dest_has_wcard = False;
+       bool dest_has_wcard = False;
        NTSTATUS status;
-       struct smb_request req;
-
-       init_smb_request(&req, (uint8 *)inbuf);
+       TALLOC_CTX *ctx = talloc_tos();
 
         if(parameter_count < 5) {
-               return ERROR_DOS(ERRDOS,ERRbadfunc);
+               reply_doserror(req, ERRDOS, ERRbadfunc);
+               return;
        }
 
        fsp = file_fsp(SVAL(params, 0));
-       replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False;
-       CHECK_FSP(fsp, conn);
-       srvstr_get_path_wcard(inbuf, SVAL(inbuf,smb_flg2), new_name, params+4,
-                             sizeof(new_name), parameter_count - 4,
-                             STR_TERMINATE, &status, &dest_has_wcard);
-       if (!NT_STATUS_IS_OK(status)) {
-               return ERROR_NT(status);
+       if (!check_fsp(conn, req, fsp, &current_user)) {
+               return;
        }
-
-       status = rename_internals(conn, &req, fsp->fsp_name,
-                                 new_name, 0, replace_if_exists, False, dest_has_wcard);
-
+       srvstr_get_path_wcard(ctx, params, req->flags2, &new_name, params+4,
+                             parameter_count - 4,
+                             STR_TERMINATE, &status, &dest_has_wcard);
        if (!NT_STATUS_IS_OK(status)) {
-               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
-                       /* We have re-scheduled this call. */
-                       return -1;
-               }
-               return ERROR_NT(status);
+               reply_nterror(req, status);
+               return;
        }
 
        /*
-        * Rename was successful.
+        * W2K3 ignores this request as the RAW-RENAME test
+        * demonstrates, so we do.
         */
-       send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
-       
-       DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n", 
+       send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
+
+       DEBUG(3,("nt transact rename from = %s, to = %s ignored!\n",
                 fsp->fsp_name, new_name));
-       
-       return -1;
+
+       return;
 }
 
 /******************************************************************************
  Fake up a completely empty SD.
 *******************************************************************************/
 
-static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
+static NTSTATUS get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd)
 {
        size_t sd_size;
 
        *ppsd = make_standard_sec_desc( mem_ctx, &global_sid_World, &global_sid_World, NULL, &sd_size);
        if(!*ppsd) {
                DEBUG(0,("get_null_nt_acl: Unable to malloc space for security descriptor.\n"));
-               sd_size = 0;
+               return NT_STATUS_NO_MEMORY;
        }
 
-       return sd_size;
+       return NT_STATUS_OK;
 }
 
 /****************************************************************************
@@ -2251,12 +1594,12 @@ static void call_nt_transact_query_security_desc(connection_struct *conn,
 {
        char *params = *ppparams;
        char *data = *ppdata;
-       prs_struct pd;
        SEC_DESC *psd = NULL;
        size_t sd_size;
        uint32 security_info_wanted;
-       TALLOC_CTX *mem_ctx;
        files_struct *fsp = NULL;
+       NTSTATUS status;
+       DATA_BLOB blob;
 
         if(parameter_count < 8) {
                reply_doserror(req, ERRDOS, ERRbadfunc);
@@ -2280,37 +1623,37 @@ static void call_nt_transact_query_security_desc(connection_struct *conn,
                return;
        }
 
-       if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) {
-               DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
-               reply_doserror(req, ERRDOS, ERRnomem);
-               return;
-       }
-
        /*
         * Get the permissions to return.
         */
 
        if (!lp_nt_acl_support(SNUM(conn))) {
-               sd_size = get_null_nt_acl(mem_ctx, &psd);
+               status = get_null_nt_acl(talloc_tos(), &psd);
        } else {
-               sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fh->fd, security_info_wanted, &psd);
+               if (fsp->fh->fd != -1) {
+                       status = SMB_VFS_FGET_NT_ACL(
+                               fsp, security_info_wanted, &psd);
+               }
+               else {
+                       status = SMB_VFS_GET_NT_ACL(
+                               conn, fsp->fsp_name, security_info_wanted, &psd);
+               }
        }
 
-       if (sd_size == 0) {
-               talloc_destroy(mem_ctx);
-               reply_unixerror(req, ERRDOS, ERRnoaccess);
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
                return;
        }
 
+       sd_size = ndr_size_security_descriptor(psd, 0);
+
        DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
 
        SIVAL(params,0,(uint32)sd_size);
 
-       if(max_data_count < sd_size) {
-
-               send_nt_replies_new(req, NT_STATUS_BUFFER_TOO_SMALL,
-                                   params, 4, *ppdata, 0);
-               talloc_destroy(mem_ctx);
+       if (max_data_count < sd_size) {
+               send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
+                               params, 4, *ppdata, 0);
                return;
        }
 
@@ -2320,47 +1663,23 @@ static void call_nt_transact_query_security_desc(connection_struct *conn,
 
        data = nttrans_realloc(ppdata, sd_size);
        if(data == NULL) {
-               talloc_destroy(mem_ctx);
                reply_doserror(req, ERRDOS, ERRnomem);
                return;
        }
 
-       /*
-        * Init the parse struct we will marshall into.
-        */
-
-       prs_init(&pd, 0, mem_ctx, MARSHALL);
-
-       /*
-        * Setup the prs_struct to point at the memory we just
-        * allocated.
-        */
-
-       prs_give_memory( &pd, data, (uint32)sd_size, False);
-
-       /*
-        * Finally, linearize into the outgoing buffer.
-        */
+       status = marshall_sec_desc(talloc_tos(), psd,
+                                  &blob.data, &blob.length);
 
-       if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
-               DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
-security descriptor.\n"));
-               /*
-                * Return access denied for want of a better error message..
-                */ 
-               talloc_destroy(mem_ctx);
-               reply_unixerror(req, ERRDOS, ERRnoaccess);
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
                return;
        }
 
-       /*
-        * Now we can delete the security descriptor.
-        */
+       SMB_ASSERT(sd_size == blob.length);
+       memcpy(data, blob.data, sd_size);
 
-       talloc_destroy(mem_ctx);
+       send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
 
-       send_nt_replies_new(req, NT_STATUS_OK, params, 4, data,
-                           (int)sd_size);
        return;
 }
 
@@ -2382,7 +1701,7 @@ static void call_nt_transact_set_security_desc(connection_struct *conn,
        char *data = *ppdata;
        files_struct *fsp = NULL;
        uint32 security_info_sent = 0;
-       NTSTATUS nt_status;
+       NTSTATUS status;
 
        if(parameter_count < 8) {
                reply_doserror(req, ERRDOS, ERRbadfunc);
@@ -2408,17 +1727,18 @@ static void call_nt_transact_set_security_desc(connection_struct *conn,
                return;
        }
 
-       if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) {
-               reply_nterror(req, nt_status);
+       status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
                return;
        }
 
   done:
-
-       send_nt_replies_new(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+       send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
        return;
 }
-   
+
 /****************************************************************************
  Reply to NT IOCTL
 ****************************************************************************/
@@ -2435,7 +1755,7 @@ static void call_nt_transact_ioctl(connection_struct *conn,
        files_struct *fsp;
        uint8 isFSctl;
        uint8 compfilter;
-       static BOOL logged_message;
+       static bool logged_message;
        char *pdata = *ppdata;
 
        if (setup_count != 8) {
@@ -2464,9 +1784,9 @@ static void call_nt_transact_ioctl(connection_struct *conn,
                   so we can know if we need to pre-allocate or not */
 
                DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
-               send_nt_replies_new(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+               send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
                return;
-       
+
        case FSCTL_CREATE_OR_GET_OBJECT_ID:
        {
                unsigned char objid[16];
@@ -2490,8 +1810,8 @@ static void call_nt_transact_ioctl(connection_struct *conn,
                push_file_id_16(pdata, &fsp->file_id);
                memcpy(pdata+16,create_volume_objectid(conn,objid),16);
                push_file_id_16(pdata+32, &fsp->file_id);
-               send_nt_replies_new(req, NT_STATUS_OK, NULL, 0,
-                                   pdata, data_count);
+               send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
+                               pdata, data_count);
                return;
        }
 
@@ -2512,7 +1832,7 @@ static void call_nt_transact_ioctl(connection_struct *conn,
                DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
                reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
                return;
-                       
+
        case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
        {
                /*
@@ -2527,7 +1847,7 @@ static void call_nt_transact_ioctl(connection_struct *conn,
                 */
                SHADOW_COPY_DATA *shadow_data = NULL;
                TALLOC_CTX *shadow_mem_ctx = NULL;
-               BOOL labels = False;
+               bool labels = False;
                uint32 labels_data_count = 0;
                uint32 i;
                char *cur_pdata;
@@ -2561,9 +1881,9 @@ static void call_nt_transact_ioctl(connection_struct *conn,
                        reply_nterror(req, NT_STATUS_NO_MEMORY);
                        return;
                }
-               
+
                shadow_data->mem_ctx = shadow_mem_ctx;
-               
+
                /*
                 * Call the VFS routine to actually do the work.
                 */
@@ -2603,7 +1923,7 @@ static void call_nt_transact_ioctl(connection_struct *conn,
                        talloc_destroy(shadow_data->mem_ctx);
                        reply_nterror(req, NT_STATUS_NO_MEMORY);
                        return;
-               }               
+               }
 
                cur_pdata = pdata;
 
@@ -2635,16 +1955,16 @@ static void call_nt_transact_ioctl(connection_struct *conn,
 
                talloc_destroy(shadow_data->mem_ctx);
 
-               send_nt_replies_new(req, NT_STATUS_OK, NULL, 0,
-                                   pdata, data_count);
+               send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
+                               pdata, data_count);
 
                return;
         }
-        
+
        case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
        {
-               /* pretend this succeeded - 
-                * 
+               /* pretend this succeeded -
+                *
                 * we have to send back a list with all files owned by this SID
                 *
                 * but I have to check that --metze
@@ -2652,7 +1972,7 @@ static void call_nt_transact_ioctl(connection_struct *conn,
                DOM_SID sid;
                uid_t uid;
                size_t sid_len = MIN(data_count-4,SID_MAX_SIZE);
-               
+
                DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
 
                if (!fsp_belongs_conn(conn, req, fsp, &current_user)) {
@@ -2661,16 +1981,17 @@ static void call_nt_transact_ioctl(connection_struct *conn,
 
                /* unknown 4 bytes: this is not the length of the sid :-(  */
                /*unknown = IVAL(pdata,0);*/
-               
+
                sid_parse(pdata+4,sid_len,&sid);
-               DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
+               DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
 
                if (!sid_to_uid(&sid, &uid)) {
                        DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
-                               sid_string_static(&sid),(unsigned long)sid_len));
+                                sid_string_dbg(&sid),
+                                (unsigned long)sid_len));
                        uid = (-1);
                }
-               
+
                /* we can take a look at the find source :-)
                 *
                 * find ./ -uid $uid  -name '*'   is what we need here
@@ -2683,16 +2004,16 @@ static void call_nt_transact_ioctl(connection_struct *conn,
                 * (maybe we can hang the result anywhere in the fsp struct)
                 *
                 * we don't send all files at once
-                * and at the next we should *not* start from the beginning, 
-                * so we have to cache the result 
+                * and at the next we should *not* start from the beginning,
+                * so we have to cache the result
                 *
                 * --metze
                 */
-               
+
                /* this works for now... */
-               send_nt_replies_new(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+               send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
                return;
-       }       
+       }
        default:
                if (!logged_message) {
                        logged_message = True; /* Only print this once... */
@@ -2707,7 +2028,7 @@ static void call_nt_transact_ioctl(connection_struct *conn,
 
 #ifdef HAVE_SYS_QUOTAS
 /****************************************************************************
- Reply to get user quota 
+ Reply to get user quota
 ****************************************************************************/
 
 static void call_nt_transact_get_user_quota(connection_struct *conn,
@@ -2731,7 +2052,7 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
        uint16 level = 0;
        size_t sid_len;
        DOM_SID sid;
-       BOOL start_enum = True;
+       bool start_enum = True;
        SMB_NTQUOTA_STRUCT qt;
        SMB_NTQUOTA_LIST *tmp_list;
        SMB_NTQUOTA_HANDLE *qt_handle = NULL;
@@ -2755,7 +2076,7 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
                reply_doserror(req, ERRDOS, ERRinvalidparam);
                return;
        }
-       
+
        /* maybe we can check the quota_fnum */
        fsp = file_fsp(SVAL(params,0));
        if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
@@ -2770,16 +2091,16 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
        qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd;
 
        level = SVAL(params,2);
-       
-       /* unknown 12 bytes leading in params */ 
-       
+
+       /* unknown 12 bytes leading in params */
+
        switch (level) {
                case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE:
                        /* seems that we should continue with the enum here --metze */
 
-                       if (qt_handle->quota_list!=NULL && 
+                       if (qt_handle->quota_list!=NULL &&
                            qt_handle->tmp_list==NULL) {
-               
+
                                /* free the list */
                                free_ntquota_list(&(qt_handle->quota_list));
 
@@ -2821,7 +2142,7 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
 
                        /* we should not trust the value in max_data_count*/
                        max_data_count = MIN(max_data_count,2048);
-                       
+
                        pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/
                        if(pdata == NULL) {
                                reply_doserror(req, ERRDOS, ERRnomem);
@@ -2832,7 +2153,7 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
 
                        /* set params Size of returned Quota Data 4 bytes*/
                        /* but set it later when we know it */
-               
+
                        /* for each entry push the data */
 
                        if (start_enum) {
@@ -2844,33 +2165,34 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
                        for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
                                tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
 
-                               sid_len = sid_size(&tmp_list->quotas->sid);
+                               sid_len = ndr_size_dom_sid(
+                                       &tmp_list->quotas->sid, 0);
                                entry_len = 40 + sid_len;
 
                                /* nextoffset entry 4 bytes */
                                SIVAL(entry,0,entry_len);
-               
+
                                /* then the len of the SID 4 bytes */
                                SIVAL(entry,4,sid_len);
-                               
+
                                /* unknown data 8 bytes SMB_BIG_UINT */
                                SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/
-                               
+
                                /* the used disk space 8 bytes SMB_BIG_UINT */
                                SBIG_UINT(entry,16,tmp_list->quotas->usedspace);
-                               
+
                                /* the soft quotas 8 bytes SMB_BIG_UINT */
                                SBIG_UINT(entry,24,tmp_list->quotas->softlim);
-                               
+
                                /* the hard quotas 8 bytes SMB_BIG_UINT */
                                SBIG_UINT(entry,32,tmp_list->quotas->hardlim);
-                               
+
                                /* and now the SID */
                                sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid);
                        }
-                       
+
                        qt_handle->tmp_list = tmp_list;
-                       
+
                        /* overwrite the offset of the last entry */
                        SIVAL(entry-entry_len,0,0);
 
@@ -2881,9 +2203,9 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
                        break;
 
                case TRANSACT_GET_USER_QUOTA_FOR_SID:
-                       
-                       /* unknown 4 bytes IVAL(pdata,0) */     
-                       
+
+                       /* unknown 4 bytes IVAL(pdata,0) */
+
                        if (data_count < 8) {
                                DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8));
                                reply_doserror(req, ERRDOS, ERRunknownlevel);
@@ -2916,11 +2238,11 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
                        }
 
                        sid_parse(pdata+8,sid_len,&sid);
-               
+
                        if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
                                ZERO_STRUCT(qt);
-                               /* 
-                                * we have to return zero's in all fields 
+                               /*
+                                * we have to return zero's in all fields
                                 * instead of returning an error here
                                 * --metze
                                 */
@@ -2944,25 +2266,25 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
 
                        /* set params Size of returned Quota Data 4 bytes*/
                        SIVAL(params,0,data_len);
-       
+
                        /* nextoffset entry 4 bytes */
                        SIVAL(entry,0,0);
-       
+
                        /* then the len of the SID 4 bytes */
                        SIVAL(entry,4,sid_len);
-                       
+
                        /* unknown data 8 bytes SMB_BIG_UINT */
                        SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/
-                       
+
                        /* the used disk space 8 bytes SMB_BIG_UINT */
                        SBIG_UINT(entry,16,qt.usedspace);
-                       
+
                        /* the soft quotas 8 bytes SMB_BIG_UINT */
                        SBIG_UINT(entry,24,qt.softlim);
-                       
+
                        /* the hard quotas 8 bytes SMB_BIG_UINT */
                        SBIG_UINT(entry,32,qt.hardlim);
-                       
+
                        /* and now the SID */
                        sid_linearize(entry+40, sid_len, &sid);
 
@@ -2975,18 +2297,23 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
                        break;
        }
 
-       send_nt_replies_new(req, nt_status, params, param_len,
-                           pdata, data_len);
+       send_nt_replies(conn, req, nt_status, params, param_len,
+                       pdata, data_len);
 }
 
 /****************************************************************************
  Reply to set user quota
 ****************************************************************************/
 
-static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, 
-                                  uint16 **ppsetup, uint32 setup_count,
-                                 char **ppparams, uint32 parameter_count,
-                                 char **ppdata, uint32 data_count, uint32 max_data_count)
+static void call_nt_transact_set_user_quota(connection_struct *conn,
+                                           struct smb_request *req,
+                                           uint16 **ppsetup,
+                                           uint32 setup_count,
+                                           char **ppparams,
+                                           uint32 parameter_count,
+                                           char **ppdata,
+                                           uint32 data_count,
+                                           uint32 max_data_count)
 {
        char *params = *ppparams;
        char *pdata = *ppdata;
@@ -3002,7 +2329,8 @@ static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf,
        if (current_user.ut.uid != 0) {
                DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n",
                        lp_servicename(SNUM(conn)),conn->user));
-               return ERROR_DOS(ERRDOS,ERRnoaccess);
+               reply_doserror(req, ERRDOS, ERRnoaccess);
+               return;
        }
 
        /*
@@ -3011,19 +2339,22 @@ static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf,
 
        if (parameter_count < 2) {
                DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count));
-               return ERROR_DOS(ERRDOS,ERRinvalidparam);
+               reply_doserror(req, ERRDOS, ERRinvalidparam);
+               return;
        }
-       
+
        /* maybe we can check the quota_fnum */
        fsp = file_fsp(SVAL(params,0));
        if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
                DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
-               return ERROR_NT(NT_STATUS_INVALID_HANDLE);
+               reply_nterror(req, NT_STATUS_INVALID_HANDLE);
+               return;
        }
 
        if (data_count < 40) {
                DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40));
-               return ERROR_DOS(ERRDOS,ERRunknownlevel);               
+               reply_doserror(req, ERRDOS, ERRunknownlevel);
+               return;
        }
 
        /* offset to next quota record.
@@ -3036,10 +2367,11 @@ static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf,
 
        if (data_count < 40+sid_len) {
                DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %lu bytes data\n",data_count,(unsigned long)40+sid_len));
-               return ERROR_DOS(ERRDOS,ERRunknownlevel);               
+               reply_doserror(req, ERRDOS, ERRunknownlevel);
+               return;
        }
 
-       /* unknown 8 bytes in pdata 
+       /* unknown 8 bytes in pdata
         * maybe its the change time in NTTIME
         */
 
@@ -3052,7 +2384,8 @@ static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf,
                ((qt.usedspace != 0xFFFFFFFF)||
                (IVAL(pdata,20)!=0xFFFFFFFF))) {
                /* more than 32 bits? */
-               return ERROR_DOS(ERRDOS,ERRunknownlevel);
+               reply_doserror(req, ERRDOS, ERRunknownlevel);
+               return;
        }
 #endif /* LARGE_SMB_OFF_T */
 
@@ -3065,7 +2398,8 @@ static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf,
                ((qt.softlim != 0xFFFFFFFF)||
                (IVAL(pdata,28)!=0xFFFFFFFF))) {
                /* more than 32 bits? */
-               return ERROR_DOS(ERRDOS,ERRunknownlevel);
+               reply_doserror(req, ERRDOS, ERRunknownlevel);
+               return;
        }
 #endif /* LARGE_SMB_OFF_T */
 
@@ -3078,23 +2412,23 @@ static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf,
                ((qt.hardlim != 0xFFFFFFFF)||
                (IVAL(pdata,36)!=0xFFFFFFFF))) {
                /* more than 32 bits? */
-               return ERROR_DOS(ERRDOS,ERRunknownlevel);
+               reply_doserror(req, ERRDOS, ERRunknownlevel);
+               return;
        }
 #endif /* LARGE_SMB_OFF_T */
-       
+
        sid_parse(pdata+40,sid_len,&sid);
-       DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
+       DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
 
        /* 44 unknown bytes left... */
 
        if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
-               return ERROR_DOS(ERRSRV,ERRerror);      
+               reply_doserror(req, ERRSRV, ERRerror);
+               return;
        }
 
-       send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len,
+       send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
                        pdata, data_len);
-
-       return -1;
 }
 #endif /* HAVE_SYS_QUOTAS */
 
@@ -3150,56 +2484,27 @@ static void handle_nttrans(connection_struct *conn,
 
                case NT_TRANSACT_NOTIFY_CHANGE:
                {
-                       char *inbuf, *outbuf;
-                       int size, bufsize;
-
                        START_PROFILE(NT_transact_notify_change);
-
-                       if (!reply_prep_legacy(req, &inbuf, &outbuf, &size,
-                                              &bufsize)) {
-                               reply_nterror(req, NT_STATUS_NO_MEMORY);
-                               END_PROFILE(SMBnttrans);
-                               return;
-                       }
-
-                       reply_post_legacy(
-                               req,
-                               call_nt_transact_notify_change(
-                                       conn, inbuf, outbuf, size, bufsize,
-                                       &state->setup, state->setup_count,
-                                       &state->param, state->total_param,
-                                       &state->data, state->total_data,
-                                       state->max_data_return,
-                                       state->max_param_return));
-
+                       call_nt_transact_notify_change(
+                               conn, req,
+                               &state->setup, state->setup_count,
+                               &state->param, state->total_param,
+                               &state->data, state->total_data,
+                               state->max_data_return,
+                               state->max_param_return);
                        END_PROFILE(NT_transact_notify_change);
                        break;
                }
 
                case NT_TRANSACT_RENAME:
                {
-                       char *inbuf, *outbuf;
-                       int size, bufsize;
-
                        START_PROFILE(NT_transact_rename);
-
-                       if (!reply_prep_legacy(req, &inbuf, &outbuf, &size,
-                                              &bufsize)) {
-                               reply_nterror(req, NT_STATUS_NO_MEMORY);
-                               END_PROFILE(SMBnttrans);
-                               return;
-                       }
-
-                       reply_post_legacy(
-                               req,
-                               call_nt_transact_rename(
-                                       conn, inbuf, outbuf,
-                                       size, bufsize,
-                                       &state->setup, state->setup_count,
-                                       &state->param, state->total_param,
-                                       &state->data, state->total_data,
-                                       state->max_data_return));
-
+                       call_nt_transact_rename(
+                               conn, req,
+                               &state->setup, state->setup_count,
+                               &state->param, state->total_param,
+                               &state->data, state->total_data,
+                               state->max_data_return);
                        END_PROFILE(NT_transact_rename);
                        break;
                }
@@ -3233,30 +2538,15 @@ static void handle_nttrans(connection_struct *conn,
 
                case NT_TRANSACT_SET_USER_QUOTA:
                {
-                       char *inbuf, *outbuf;
-                       int size, bufsize;
-
                        START_PROFILE(NT_transact_set_user_quota);
-
-                       if (!reply_prep_legacy(req, &inbuf, &outbuf, &size,
-                                              &bufsize)) {
-                               reply_nterror(req, NT_STATUS_NO_MEMORY);
-                               END_PROFILE(SMBnttrans);
-                               return;
-                       }
-
-                       reply_post_legacy(
-                               req,
-                               call_nt_transact_set_user_quota(
-                                       conn, inbuf, outbuf,
-                                       size, bufsize,
-                                       &state->setup, state->setup_count,
-                                       &state->param, state->total_param,
-                                       &state->data, state->total_data,
-                                       state->max_data_return));
-
+                       call_nt_transact_set_user_quota(
+                               conn, req,
+                               &state->setup, state->setup_count,
+                               &state->param, state->total_param,
+                               &state->data, state->total_data,
+                               state->max_data_return);
                        END_PROFILE(NT_transact_set_user_quota);
-                       break;                                  
+                       break;
                }
 #endif /* HAVE_SYS_QUOTAS */
 
@@ -3274,16 +2564,18 @@ static void handle_nttrans(connection_struct *conn,
  Reply to a SMBNTtrans.
 ****************************************************************************/
 
-void reply_nttrans(connection_struct *conn, struct smb_request *req)
+void reply_nttrans(struct smb_request *req)
 {
-       uint32 pscnt;
-       uint32 psoff;
-       uint32 dscnt;
-       uint32 dsoff;
+       connection_struct *conn = req->conn;
+       uint32_t pscnt;
+       uint32_t psoff;
+       uint32_t dscnt;
+       uint32_t dsoff;
        uint16 function_code;
        NTSTATUS result;
        struct trans_state *state;
-       int size;
+       uint32_t size;
+       uint32_t av_size;
 
        START_PROFILE(SMBnttrans);
 
@@ -3294,6 +2586,7 @@ void reply_nttrans(connection_struct *conn, struct smb_request *req)
        }
 
        size = smb_len(req->inbuf) + 4;
+       av_size = smb_len(req->inbuf);
        pscnt = IVAL(req->inbuf,smb_nt_ParameterCount);
        psoff = IVAL(req->inbuf,smb_nt_ParameterOffset);
        dscnt = IVAL(req->inbuf,smb_nt_DataCount);
@@ -3336,7 +2629,7 @@ void reply_nttrans(connection_struct *conn, struct smb_request *req)
        state->setup = NULL;
        state->call = function_code;
 
-       /* 
+       /*
         * All nttrans messages we handle have smb_wct == 19 +
         * state->setup_count.  Ensure this is so as a sanity check.
         */
@@ -3368,13 +2661,18 @@ void reply_nttrans(connection_struct *conn, struct smb_request *req)
                        reply_doserror(req, ERRDOS, ERRnomem);
                        END_PROFILE(SMBnttrans);
                        return;
-               } 
-               if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
+               }
+
+               if (dscnt > state->total_data ||
+                               dsoff+dscnt < dsoff) {
                        goto bad_param;
-               if ((smb_base(req->inbuf)+dsoff+dscnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf)+dsoff+dscnt < smb_base(req->inbuf)))
+               }
+
+               if (dsoff > av_size ||
+                               dscnt > av_size ||
+                               dsoff+dscnt > av_size) {
                        goto bad_param;
+               }
 
                memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
        }
@@ -3390,13 +2688,18 @@ void reply_nttrans(connection_struct *conn, struct smb_request *req)
                        reply_doserror(req, ERRDOS, ERRnomem);
                        END_PROFILE(SMBnttrans);
                        return;
-               } 
-               if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
+               }
+
+               if (pscnt > state->total_param ||
+                               psoff+pscnt < psoff) {
                        goto bad_param;
-               if ((smb_base(req->inbuf)+psoff+pscnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf)+psoff+pscnt < smb_base(req->inbuf)))
+               }
+
+               if (psoff > av_size ||
+                               pscnt > av_size ||
+                               psoff+pscnt > av_size) {
                        goto bad_param;
+               }
 
                memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
        }
@@ -3460,17 +2763,18 @@ void reply_nttrans(connection_struct *conn, struct smb_request *req)
        END_PROFILE(SMBnttrans);
        return;
 }
-       
+
 /****************************************************************************
  Reply to a SMBnttranss
  ****************************************************************************/
 
-void reply_nttranss(connection_struct *conn, struct smb_request *req)
+void reply_nttranss(struct smb_request *req)
 {
-       unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
+       connection_struct *conn = req->conn;
+       uint32_t pcnt,poff,dcnt,doff,pdisp,ddisp;
        struct trans_state *state;
-
-       int size;
+       uint32_t av_size;
+       uint32_t size;
 
        START_PROFILE(SMBnttranss);
 
@@ -3507,6 +2811,7 @@ void reply_nttranss(connection_struct *conn, struct smb_request *req)
        }
 
        size = smb_len(req->inbuf) + 4;
+       av_size = smb_len(req->inbuf);
 
        pcnt = IVAL(req->inbuf,smb_nts_ParameterCount);
        poff = IVAL(req->inbuf, smb_nts_ParameterOffset);
@@ -3518,47 +2823,47 @@ void reply_nttranss(connection_struct *conn, struct smb_request *req)
 
        state->received_param += pcnt;
        state->received_data += dcnt;
-               
+
        if ((state->received_data > state->total_data) ||
            (state->received_param > state->total_param))
                goto bad_param;
 
        if (pcnt) {
-               if (pdisp+pcnt > state->total_param)
+               if (pdisp > state->total_param ||
+                               pcnt > state->total_param ||
+                               pdisp+pcnt > state->total_param ||
+                               pdisp+pcnt < pdisp) {
                        goto bad_param;
-               if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
-                       goto bad_param;
-               if (pdisp > state->total_param)
-                       goto bad_param;
-               if ((smb_base(req->inbuf) + poff + pcnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf) + poff + pcnt
-                    < smb_base(req->inbuf)))
-                       goto bad_param;
-               if (state->param + pdisp < state->param)
+               }
+
+               if (poff > av_size ||
+                               pcnt > av_size ||
+                               poff+pcnt > av_size ||
+                               poff+pcnt < poff) {
                        goto bad_param;
+               }
 
                memcpy(state->param+pdisp, smb_base(req->inbuf)+poff,
                       pcnt);
        }
 
        if (dcnt) {
-               if (ddisp+dcnt > state->total_data)
-                       goto bad_param;
-               if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
-                       goto bad_param;
-               if (ddisp > state->total_data)
+               if (ddisp > state->total_data ||
+                               dcnt > state->total_data ||
+                               ddisp+dcnt > state->total_data ||
+                               ddisp+dcnt < ddisp) {
                        goto bad_param;
-               if ((smb_base(req->inbuf) + doff + dcnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf) + doff + dcnt
-                    < smb_base(req->inbuf)))
-                       goto bad_param;
-               if (state->data + ddisp < state->data)
+               }
+
+               if (ddisp > av_size ||
+                               dcnt > av_size ||
+                               ddisp+dcnt > av_size ||
+                               ddisp+dcnt < ddisp) {
                        goto bad_param;
+               }
 
                memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
-                      dcnt);      
+                      dcnt);
        }
 
        if ((state->received_param < state->total_param) ||