r1570: merging changes from 3.0.5
[tprouty/samba.git] / source / smbd / reply.c
index 5c1d7915c26cc73f92b8f16960a1578dddcd0b0f..f3ab709df48e8be0601ed4a012d6fcc0492fecc0 100644 (file)
@@ -3,6 +3,7 @@
    Main SMB reply routines
    Copyright (C) Andrew Tridgell 1992-1998
    Copyright (C) Andrew Bartlett      2001
+   Copyright (C) Jeremy Allison 1992-2004.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -30,9 +31,6 @@ extern int Protocol;
 extern int max_send;
 extern int max_recv;
 extern char magic_char;
-extern BOOL case_sensitive;
-extern BOOL case_preserve;
-extern BOOL short_case_preserve;
 extern int global_oplock_break;
 unsigned int smb_echo_count = 0;
 
@@ -40,28 +38,144 @@ extern BOOL global_encrypted_passwords_negotiated;
 
 /****************************************************************************
  Ensure we check the path in *exactly* the same way as W2K.
+ We're assuming here that '/' is not the second byte in any multibyte char
+ set (a safe assumption). '\\' *may* be the second byte in a multibyte char
+ set.
 ****************************************************************************/
 
-NTSTATUS check_path_syntax(const char *name)
+NTSTATUS check_path_syntax(pstring destname, const pstring srcname, BOOL allow_wcard_names)
 {
-       while (*name == '\\' || *name == '/')
-               name++;
-       if (name[0] == '.' && name[1] == '\0')
-               return NT_STATUS_OBJECT_NAME_INVALID;
-       else if (name[0] == '.' && name[1] == '.' &&
-                       (name[2] == '\\' || name [2] == '/' || name[2] == '\0'))
-               return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
-       return NT_STATUS_OK;
+       char *d = destname;
+       const char *s = srcname;
+       NTSTATUS ret = NT_STATUS_OK;
+
+       while (*s) {
+               if (IS_DIRECTORY_SEP(*s)) {
+                       /*
+                        * Safe to assume is not the second part of a mb char as this is handled below.
+                        */
+                       /* Eat multiple '/' or '\\' */
+                       while (IS_DIRECTORY_SEP(*s)) {
+                               s++;
+                       }
+                       if ((s[0] == '.') && (s[1] == '\0')) {
+                               ret = NT_STATUS_OBJECT_NAME_INVALID;
+                               break;
+                       }
+                       if ((d != destname) && (*s != '\0')) {
+                               /* We only care about non-leading or trailing '/' or '\\' */
+                               *d++ = '/';
+                       }
+               } else if ((s[0] == '.') && (s[1] == '.') && (IS_DIRECTORY_SEP(s[2]) || s[2] == '\0')) {
+                       /* Uh oh - "../" or "..\\"  or "..\0" ! */
+
+                       /*
+                        * No mb char starts with '.' so we're safe checking the directory separator here.
+                        */
+
+                       /* If we just added a '/', delete it. */
+
+                       if ((d > destname) && (*(d-1) == '/')) {
+                               *(d-1) = '\0';
+                               if (d == (destname + 1)) {
+                                       d--;
+                               } else {
+                                       d -= 2;
+                               }
+                       }
+                       /* Are we at the start ? Can't go back further if so. */
+                       if (d == destname) {
+                               ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
+                               break;
+                       }
+                       /* Go back one level... */
+                       /* We know this is safe as '/' cannot be part of a mb sequence. */
+                       /* NOTE - if this assumption is invalid we are not in good shape... */
+                       while (d > destname) {
+                               if (*d == '/')
+                                       break;
+                               d--;
+                       }
+                       s += 3;
+               } else if ((s[0] == '.') && (IS_DIRECTORY_SEP(s[1]) || (s[1] == '\0'))) {
+
+                       /*
+                        * No mb char starts with '.' so we're safe checking the directory separator here.
+                        */
+
+                       /* "./" or ".\\" fails with a different error depending on where it is... */
+
+                       if (s == srcname) {
+                               ret = NT_STATUS_OBJECT_NAME_INVALID;
+                               break;
+                       } else {
+                               if (s[1] != '\0' && s[2] == '\0') {
+                                       ret = NT_STATUS_INVALID_PARAMETER;
+                                       break;
+                               }
+                               ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                               break;
+                       }
+                       s++;
+               } else {
+                       if (!(*s & 0x80)) {
+                               if (allow_wcard_names) {
+                                       *d++ = *s++;
+                               } else {
+                                       switch (*s) {
+                                               case '*':
+                                               case '?':
+                                               case '<':
+                                               case '>':
+                                               case '"':
+                                                       return NT_STATUS_OBJECT_NAME_INVALID;
+                                               default:
+                                                       *d++ = *s++;
+                                                       break;
+                                       }
+                               }
+                       } else {
+                               switch(next_mb_char_size(s)) {
+                                       case 4:
+                                               *d++ = *s++;
+                                       case 3:
+                                               *d++ = *s++;
+                                       case 2:
+                                               *d++ = *s++;
+                                       case 1:
+                                               *d++ = *s++;
+                                               break;
+                                       default:
+                                               DEBUG(0,("check_path_syntax: character length assumptions invalid !\n"));
+                                               *d = '\0';
+                                               return NT_STATUS_INVALID_PARAMETER;
+                               }
+                       }
+               }
+       }
+       *d = '\0';
+       return ret;
 }
 
 /****************************************************************************
  Pull a string and check the path - provide for error return.
 ****************************************************************************/
 
-size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, int flags, NTSTATUS *err)
+size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags, NTSTATUS *err, BOOL allow_wcard_names)
 {
-       size_t ret = srvstr_pull_buf( inbuf, dest, src, dest_len, flags);
-       *err = check_path_syntax(dest);
+       pstring tmppath;
+       char *tmppath_ptr = tmppath;
+       size_t ret;
+#ifdef DEVELOPER
+       SMB_ASSERT(dest_len == sizeof(pstring));
+#endif
+
+       if (src_len == 0) {
+               ret = srvstr_pull_buf( inbuf, tmppath_ptr, src, dest_len, flags);
+       } else {
+               ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
+       }
+       *err = check_path_syntax(dest, tmppath, allow_wcard_names);
        return ret;
 }
 
@@ -74,7 +188,7 @@ int reply_special(char *inbuf,char *outbuf)
        int outsize = 4;
        int msg_type = CVAL(inbuf,0);
        int msg_flags = CVAL(inbuf,1);
-       pstring name1,name2;
+       fstring name1,name2;
        char name_type = 0;
        
        static BOOL already_got_session = False;
@@ -389,7 +503,9 @@ int reply_ioctl(connection_struct *conn,
                        }
                        SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
                        srvstr_push(outbuf, p+2, global_myname(), 15, STR_TERMINATE|STR_ASCII);
-                       srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII);
+                       if (conn) {
+                               srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII);
+                       }
                        break;
                }
        }
@@ -414,7 +530,7 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 
        START_PROFILE(SMBchkpth);
 
-       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBchkpth);
                return ERROR_NT(status);
@@ -423,6 +539,10 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
 
        unix_convert(name,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBchkpth);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
 
        mode = SVAL(inbuf,smb_vwv0);
 
@@ -446,18 +566,11 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                         * the parent directory is valid but not the
                         * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
                         * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
-                        * if the path is invalid.
+                        * if the path is invalid. This is different from set_bad_path_error()
+                        * in the non-NT error case.
                         */
-                       if (bad_path) {
-                               END_PROFILE(SMBchkpth);
-                               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
-                       } else {
-                               END_PROFILE(SMBchkpth);
-                               return ERROR_NT(NT_STATUS_OBJECT_NAME_NOT_FOUND);
-                       }
-               } else if (errno == ENOTDIR) {
                        END_PROFILE(SMBchkpth);
-                       return ERROR_NT(NT_STATUS_NOT_A_DIRECTORY);
+                       return ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpath);
                }
 
                END_PROFILE(SMBchkpth);
@@ -492,7 +605,7 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        START_PROFILE(SMBgetatr);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), STR_TERMINATE,&status);
+       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBgetatr);
                return ERROR_NT(status);
@@ -511,6 +624,10 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                ok = True;
        } else {
                unix_convert(fname,conn,0,&bad_path,&sbuf);
+               if (bad_path) {
+                       END_PROFILE(SMBgetatr);
+                       return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+               }
                if (check_name(fname,conn)) {
                        if (VALID_STAT(sbuf) || SMB_VFS_STAT(conn,fname,&sbuf) == 0) {
                                mode = dos_mode(conn,fname,&sbuf);
@@ -567,13 +684,17 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        START_PROFILE(SMBsetatr);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), STR_TERMINATE,&status);
+       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBsetatr);
                return ERROR_NT(status);
        }
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBsetatr);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
 
        mode = SVAL(inbuf,smb_vwv0);
        mtime = make_unix_date3(inbuf+smb_vwv1);
@@ -584,8 +705,9 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                else
                        mode &= ~aDIR;
 
-               if (check_name(fname,conn))
-                       ok =  (file_chmod(conn,fname,mode,NULL) == 0);
+               if (check_name(fname,conn)) {
+                       ok = (file_set_dosmode(conn,fname,mode,NULL) == 0);
+               }
        } else {
                ok = True;
        }
@@ -669,10 +791,9 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        time_t date;
        int dirtype;
        int outsize = 0;
-       int numentries = 0;
+       unsigned int numentries = 0;
+       unsigned int maxentries = 0;
        BOOL finished = False;
-       int maxentries;
-       int i;
        char *p;
        BOOL ok = False;
        int status_len;
@@ -696,7 +817,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        maxentries = SVAL(inbuf,smb_vwv0); 
        dirtype = SVAL(inbuf,smb_vwv1);
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, path, p, sizeof(path), STR_TERMINATE,&nt_status);
+       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &nt_status, True);
        if (!NT_STATUS_IS_OK(nt_status)) {
                END_PROFILE(SMBsearch);
                return ERROR_NT(nt_status);
@@ -778,7 +899,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                if (ok) {
                        if ((dirtype&0x1F) == aVOLID) {   
                                memcpy(p,status,21);
-                               make_dir_struct(p,"???????????",volume_label(SNUM(conn)),0,aVOLID,0);
+                               make_dir_struct(p,"???????????",volume_label(SNUM(conn)),0,aVOLID,0,conn->case_sensitive);
                                dptr_fill(p+12,dptr_num);
                                if (dptr_zero(p+12) && (status_len==0))
                                        numentries = 1;
@@ -786,6 +907,9 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                        numentries = 0;
                                p += DIR_STRUCT_SIZE;
                        } else {
+                               unsigned int i;
+                               maxentries = MIN(maxentries, ((BUFFER_SIZE - (p - outbuf))/DIR_STRUCT_SIZE));
+
                                DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
                                conn->dirpath,lp_dontdescend(SNUM(conn))));
                                if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True))
@@ -795,7 +919,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                        finished = !get_dir_entry(conn,mask,dirtype,fname,&size,&mode,&date,check_descend);
                                        if (!finished) {
                                                memcpy(p,status,21);
-                                               make_dir_struct(p,mask,fname,size,mode,date);
+                                               make_dir_struct(p,mask,fname,size,mode,date,conn->case_sensitive);
                                                dptr_fill(p+12,dptr_num);
                                                numentries++;
                                        }
@@ -845,7 +969,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        if ((! *directory) && dptr_path(dptr_num))
                slprintf(directory, sizeof(directory)-1, "(%s)",dptr_path(dptr_num));
 
-       DEBUG( 4, ( "%s mask=%s path=%s dtype=%d nument=%d of %d\n",
+       DEBUG( 4, ( "%s mask=%s path=%s dtype=%d nument=%u of %u\n",
                smb_fn_name(CVAL(inbuf,smb_com)), 
                mask, directory, dirtype, numentries, maxentries ) );
 
@@ -871,7 +995,7 @@ int reply_fclose(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 
        outsize = set_message(outbuf,1,0,True);
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, path, p, sizeof(path), STR_TERMINATE,&err);
+       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &err, True);
        if (!NT_STATUS_IS_OK(err)) {
                END_PROFILE(SMBfclose);
                return ERROR_NT(err);
@@ -912,18 +1036,18 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        int share_mode;
        SMB_OFF_T size = 0;
        time_t mtime=0;
-       mode_t unixmode;
        int rmode=0;
        SMB_STRUCT_STAT sbuf;
        BOOL bad_path = False;
        files_struct *fsp;
        int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
+       uint16 dos_attr = SVAL(inbuf,smb_vwv1);
        NTSTATUS status;
        START_PROFILE(SMBopen);
  
        share_mode = SVAL(inbuf,smb_vwv0);
 
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), STR_TERMINATE,&status);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopen);
                return ERROR_NT(status);
@@ -932,14 +1056,21 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBopen);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
     
-       unixmode = unix_mode(conn,aARCH,fname);
-      
        fsp = open_file_shared(conn,fname,&sbuf,share_mode,(FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),
-                       unixmode, oplock_request,&rmode,NULL);
+                       (uint32)dos_attr, oplock_request,&rmode,NULL);
 
        if (!fsp) {
                END_PROFILE(SMBopen);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
 
@@ -993,7 +1124,6 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        uint32 smb_time = make_unix_date3(inbuf+smb_vwv6);
 #endif
        int smb_ofun = SVAL(inbuf,smb_vwv8);
-       mode_t unixmode;
        SMB_OFF_T size=0;
        int fmode=0,mtime=0,rmode=0;
        SMB_STRUCT_STAT sbuf;
@@ -1015,7 +1145,7 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        }
 
        /* XXXX we need to handle passed times, sattr and flags */
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), STR_TERMINATE,&status);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopenX);
                return ERROR_NT(status);
@@ -1024,14 +1154,21 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBopenX);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
     
-       unixmode = unix_mode(conn,smb_attr | aARCH, fname);
-      
-       fsp = open_file_shared(conn,fname,&sbuf,smb_mode,smb_ofun,unixmode,
+       fsp = open_file_shared(conn,fname,&sbuf,smb_mode,smb_ofun,(uint32)smb_attr,
                        oplock_request, &rmode,&smb_action);
       
        if (!fsp) {
                END_PROFILE(SMBopenX);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
 
@@ -1119,7 +1256,6 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        int com;
        int outsize = 0;
        int createmode;
-       mode_t unixmode;
        int ofun = 0;
        BOOL bad_path = False;
        files_struct *fsp;
@@ -1131,7 +1267,7 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        com = SVAL(inbuf,smb_com);
 
        createmode = SVAL(inbuf,smb_vwv0);
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), STR_TERMINATE,&status);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcreate);
                return ERROR_NT(status);
@@ -1140,12 +1276,14 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBcreate);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
 
        if (createmode & aVOLID)
                DEBUG(0,("Attempt to create file (%s) with volid set - please report this\n",fname));
   
-       unixmode = unix_mode(conn,createmode,fname);
-  
        if(com == SMBmknew) {
                /* We should fail if file exists. */
                ofun = FILE_CREATE_IF_NOT_EXIST;
@@ -1156,10 +1294,15 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
        /* Open file in dos compatibility share mode. */
        fsp = open_file_shared(conn,fname,&sbuf,SET_DENY_MODE(DENY_FCB)|SET_OPEN_MODE(DOS_OPEN_FCB), 
-                       ofun, unixmode, oplock_request, NULL, NULL);
+                       ofun, (uint32)createmode, oplock_request, NULL, NULL);
   
        if (!fsp) {
                END_PROFILE(SMBcreate);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
  
@@ -1173,7 +1316,7 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
  
        DEBUG( 2, ( "new file %s\n", fname ) );
-       DEBUG( 3, ( "mknew %s fd=%d dmode=%d umode=%o\n", fname, fsp->fd, createmode, (int)unixmode ) );
+       DEBUG( 3, ( "mknew %s fd=%d dmode=%d\n", fname, fsp->fd, createmode ) );
 
        END_PROFILE(SMBcreate);
        return(outsize);
@@ -1187,8 +1330,7 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 {
        pstring fname;
        int outsize = 0;
-       int createmode;
-       mode_t unixmode;
+       int createattr;
        BOOL bad_path = False;
        files_struct *fsp;
        int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
@@ -1196,22 +1338,29 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        SMB_STRUCT_STAT sbuf;
        char *p, *s;
        NTSTATUS status;
+       unsigned int namelen;
 
        START_PROFILE(SMBctemp);
 
-       createmode = SVAL(inbuf,smb_vwv0);
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), STR_TERMINATE,&status);
+       createattr = SVAL(inbuf,smb_vwv0);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBctemp);
                return ERROR_NT(status);
        }
-       pstrcat(fname,"\\TMXXXXXX");
+       if (*fname) {
+               pstrcat(fname,"/TMXXXXXX");
+       } else {
+               pstrcat(fname,"TMXXXXXX");
+       }
 
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
-  
-       unixmode = unix_mode(conn,createmode,fname);
+       if (bad_path) {
+               END_PROFILE(SMBctemp);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
   
        tmpfd = smb_mkstemp(fname);
        if (tmpfd == -1) {
@@ -1226,13 +1375,18 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        fsp = open_file_shared(conn,fname,&sbuf,
                SET_DENY_MODE(DENY_FCB)|SET_OPEN_MODE(DOS_OPEN_FCB),
                FILE_EXISTS_OPEN|FILE_FAIL_IF_NOT_EXIST,
-               unixmode, oplock_request, NULL, NULL);
+               (uint32)createattr, oplock_request, NULL, NULL);
 
        /* close fd from smb_mkstemp() */
        close(tmpfd);
 
        if (!fsp) {
                END_PROFILE(SMBctemp);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
 
@@ -1247,10 +1401,13 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                s++;
 
        p = smb_buf(outbuf);
+#if 0
+       /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
+          thing in the byte section. JRA */
        SSVALS(p, 0, -1); /* what is this? not in spec */
-       SSVAL(p, 2, strlen(s));
-       p += 4;
-       p += srvstr_push(outbuf, p, s, -1, STR_ASCII);
+#endif
+       namelen = srvstr_push(outbuf, p, s, -1, STR_ASCII|STR_TERMINATE);
+       p += namelen;
        outsize = set_message_end(outbuf, p);
 
        if (oplock_request && lp_fake_oplocks(SNUM(conn)))
@@ -1260,8 +1417,8 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
 
        DEBUG( 2, ( "created temp file %s\n", fname ) );
-       DEBUG( 3, ( "ctemp %s fd=%d dmode=%d umode=%o\n",
-                       fname, fsp->fd, createmode, (int)unixmode ) );
+       DEBUG( 3, ( "ctemp %s fd=%d umode=%o\n",
+                       fname, fsp->fd, sbuf.st_mode ) );
 
        END_PROFILE(SMBctemp);
        return(outsize);
@@ -1271,15 +1428,20 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
  Check if a user is allowed to rename a file.
 ********************************************************************/
 
-static NTSTATUS can_rename(char *fname,connection_struct *conn, SMB_STRUCT_STAT *pst)
+static NTSTATUS can_rename(char *fname,connection_struct *conn, uint16 dirtype, SMB_STRUCT_STAT *pst)
 {
        int smb_action;
        int access_mode;
        files_struct *fsp;
+       uint16 fmode;
 
        if (!CAN_WRITE(conn))
                return NT_STATUS_MEDIA_WRITE_PROTECTED;
-       
+
+       fmode = dos_mode(conn,fname,pst);
+       if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM))
+               return NT_STATUS_NO_SUCH_FILE;
+
        if (S_ISDIR(pst->st_mode))
                return NT_STATUS_OK;
 
@@ -1288,7 +1450,7 @@ static NTSTATUS can_rename(char *fname,connection_struct *conn, SMB_STRUCT_STAT
        unix_ERR_code = 0;
 
        fsp = open_file_shared1(conn, fname, pst, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
-               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), 0, 0, &access_mode, &smb_action);
+               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
 
        if (!fsp) {
                NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
@@ -1307,7 +1469,7 @@ static NTSTATUS can_rename(char *fname,connection_struct *conn, SMB_STRUCT_STAT
  Check if a user is allowed to delete a file.
 ********************************************************************/
 
-static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype)
+static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype, BOOL bad_path)
 {
        SMB_STRUCT_STAT sbuf;
        int fmode;
@@ -1321,8 +1483,15 @@ static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype)
        if (!CAN_WRITE(conn))
                return NT_STATUS_MEDIA_WRITE_PROTECTED;
 
-       if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0)
-               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+       if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
+               if(errno == ENOENT) {
+                       if (bad_path)
+                               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                       else
+                               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+               }
+               return map_nt_error_from_unix(errno);
+       }
 
        fmode = dos_mode(conn,fname,&sbuf);
 
@@ -1346,7 +1515,7 @@ static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype)
        unix_ERR_code = 0;
 
        fsp = open_file_shared1(conn, fname, &sbuf, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
-               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), 0, 0, &access_mode, &smb_action);
+               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
 
        if (!fsp) {
                NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
@@ -1414,12 +1583,12 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
         */
        
        if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask );
+               mangle_check_cache( mask, sizeof(pstring)-1 );
        
        if (!has_wild) {
                pstrcat(directory,"/");
                pstrcat(directory,mask);
-               error = can_delete(directory,conn,dirtype);
+               error = can_delete(directory,conn,dirtype,bad_path);
                if (!NT_STATUS_IS_OK(error))
                        return error;
 
@@ -1446,15 +1615,35 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
 
                        while ((dname = ReadDirName(dirptr))) {
                                pstring fname;
+                               BOOL sys_direntry = False;
                                pstrcpy(fname,dname);
-                               
-                               if(!mask_match(fname, mask, case_sensitive))
+
+                               /* Quick check for "." and ".." */
+                               if (fname[0] == '.') {
+                                       if (!fname[1] || (fname[1] == '.' && !fname[2])) {
+                                               if ((dirtype & FILE_ATTRIBUTE_DIRECTORY) && (dirtype & FILE_ATTRIBUTE_SYSTEM)) {
+                                                       sys_direntry = True;
+                                               } else {
+                                                       continue;
+                                               }
+                                       }
+                               }
+
+                               if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
                                
+                               if (sys_direntry) {
+                                       error = NT_STATUS_OBJECT_NAME_INVALID;
+                                       DEBUG(3,("unlink_internals: system directory delete denied [%s] mask [%s]\n",
+                                               fname, mask));
+                                       break;
+                               }
+
                                slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
-                               error = can_delete(fname,conn,dirtype);
-                               if (!NT_STATUS_IS_OK(error))
+                               error = can_delete(fname,conn,dirtype,bad_path);
+                               if (!NT_STATUS_IS_OK(error)) {
                                        continue;
+                               }
                                if (SMB_VFS_UNLINK(conn,fname) == 0)
                                        count++;
                                DEBUG(3,("unlink_internals: succesful unlink [%s]\n",fname));
@@ -1485,7 +1674,7 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        
        dirtype = SVAL(inbuf,smb_vwv0);
        
-       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), STR_TERMINATE,&status);
+       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBunlink);
                return ERROR_NT(status);
@@ -1496,8 +1685,14 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        DEBUG(3,("reply_unlink : %s\n",name));
        
        status = unlink_internals(conn, dirtype, name);
-       if (!NT_STATUS_IS_OK(status))
+       if (!NT_STATUS_IS_OK(status)) {
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return ERROR_NT(status);
+       }
 
        /*
         * Win2k needs a changenotify request response before it will
@@ -1534,12 +1729,13 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
 
 #if defined(WITH_SENDFILE)
        /*
-        * We can only use sendfile on a non-chained packet and on a file
-        * that is exclusively oplocked. reply_readbraw has already checked the length.
+        * We can only use sendfile on a non-chained packet 
+        * but we can use on a non-oplocked file. tridge proved this
+        * on a train in Germany :-). JRA.
+        * reply_readbraw has already checked the length.
         */
 
-       if ((nread > 0) && (lp_write_cache_size(SNUM(conn)) == 0) &&
-                       EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type) && lp_use_sendfile(SNUM(conn)) ) {
+       if ((nread > 0) && (lp_write_cache_size(SNUM(conn)) == 0) && lp_use_sendfile(SNUM(conn)) ) {
                DATA_BLOB header;
 
                _smb_setlen(outbuf,nread);
@@ -1775,7 +1971,12 @@ int reply_lockread(connection_struct *conn, char *inbuf,char *outbuf, int length
         * However the requested READ size IS affected by max_recv. Insanity.... JRA.
         */
 
-       numtoread = MIN(numtoread,max_recv);
+       if (numtoread > max_recv) {
+               DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
+Returning short read of maximum allowed for compatibility with Windows 2000.\n",
+                       (unsigned int)numtoread, (unsigned int)max_recv ));
+               numtoread = MIN(numtoread,max_recv);
+       }
        nread = read_file(fsp,data,startpos,numtoread);
 
        if (nread < 0) {
@@ -1820,7 +2021,12 @@ int reply_read(connection_struct *conn, char *inbuf,char *outbuf, int size, int
        /*
         * The requested read size cannot be greater than max_recv. JRA.
         */
-       numtoread = MIN(numtoread,max_recv);
+       if (numtoread > max_recv) {
+               DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
+Returning short read of maximum allowed for compatibility with Windows 2000.\n",
+                       (unsigned int)numtoread, (unsigned int)max_recv ));
+               numtoread = MIN(numtoread,max_recv);
+       }
 
        data = smb_buf(outbuf) + 3;
   
@@ -1862,12 +2068,13 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
 
 #if defined(WITH_SENDFILE)
        /*
-        * We can only use sendfile on a non-chained packet and on a file
-        * that is exclusively oplocked.
+        * We can only use sendfile on a non-chained packet 
+        * but we can use on a non-oplocked file. tridge proved this
+        * on a train in Germany :-). JRA.
         */
 
-       if ((CVAL(inbuf,smb_vwv0) == 0xFF) && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type) &&
-                       lp_use_sendfile(SNUM(conn)) && (lp_write_cache_size(SNUM(conn)) == 0) ) {
+       if ((CVAL(inbuf,smb_vwv0) == 0xFF) && lp_use_sendfile(SNUM(conn)) &&
+                       (lp_write_cache_size(SNUM(conn)) == 0) ) {
                SMB_STRUCT_STAT sbuf;
                DATA_BLOB header;
 
@@ -2149,7 +2356,7 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        size_t numtowrite;
        SMB_OFF_T startpos;
        char *data;
-       NTSTATUS status;
+       NTSTATUS status = NT_STATUS_OK;
        files_struct *fsp = file_fsp(inbuf,smb_vwv0);
        int outsize = 0;
        START_PROFILE(SMBwriteunlock);
@@ -2161,7 +2368,7 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
        data = smb_buf(inbuf) + 3;
   
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, 
+       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, 
                      WRITE_LOCK,False)) {
                END_PROFILE(SMBwriteunlock);
                return ERROR_DOS(ERRDOS,ERRlock);
@@ -2183,11 +2390,13 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
                return(UNIXERROR(ERRHRD,ERRdiskfull));
        }
 
-       status = do_unlock(fsp, conn, SVAL(inbuf,smb_pid), (SMB_BIG_UINT)numtowrite, 
-                          (SMB_BIG_UINT)startpos);
-       if (NT_STATUS_V(status)) {
-               END_PROFILE(SMBwriteunlock);
-               return ERROR_NT(status);
+       if (numtowrite) {
+               status = do_unlock(fsp, conn, SVAL(inbuf,smb_pid), (SMB_BIG_UINT)numtowrite, 
+                                  (SMB_BIG_UINT)startpos);
+               if (NT_STATUS_V(status)) {
+                       END_PROFILE(SMBwriteunlock);
+                       return ERROR_NT(status);
+               }
        }
        
        outsize = set_message(outbuf,1,0,True);
@@ -2610,7 +2819,7 @@ int reply_writeclose(connection_struct *conn,
        mtime = make_unix_date3(inbuf+smb_vwv4);
        data = smb_buf(inbuf) + 1;
   
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
                END_PROFILE(SMBwriteclose);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2619,7 +2828,16 @@ int reply_writeclose(connection_struct *conn,
 
        set_filetime(conn, fsp->fsp_name,mtime);
   
-       close_err = close_file(fsp,True);
+       /*
+        * More insanity. W2K only closes the file if writelen > 0.
+        * JRA.
+        */
+
+       if (numtowrite) {
+               DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
+                       fsp->fsp_name ));
+               close_err = close_file(fsp,True);
+       }
 
        DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
                 fsp->fnum, (int)numtowrite, (int)nwritten,
@@ -2670,6 +2888,8 @@ int reply_lock(connection_struct *conn,
 
        status = do_lock_spin(fsp, conn, SVAL(inbuf,smb_pid), count, offset, WRITE_LOCK, &my_lock_ctx);
        if (NT_STATUS_V(status)) {
+#if 0
+               /* Tests using Samba4 against W2K show this call never creates a blocking lock. */
                if (lp_blocking_locks(SNUM(conn)) && !my_lock_ctx && ERROR_WAS_LOCK_DENIED(status)) {
                        /*
                         * A blocking lock was requested. Package up
@@ -2681,6 +2901,7 @@ int reply_lock(connection_struct *conn,
                                return -1;
                        }
                }
+#endif
                END_PROFILE(SMBlock);
                return ERROR_NT(status);
        }
@@ -2760,7 +2981,11 @@ int reply_echo(connection_struct *conn,
        int outsize = set_message(outbuf,1,data_len,True);
        START_PROFILE(SMBecho);
 
-       data_len = MIN(data_len, (sizeof(inbuf)-(smb_buf(inbuf)-inbuf)));
+       if (data_len > BUFFER_SIZE) {
+               DEBUG(0,("reply_echo: data_len too large.\n"));
+               END_PROFILE(SMBecho);
+               return -1;
+       }
 
        /* copy any incoming data back out */
        if (data_len > 0)
@@ -2975,27 +3200,25 @@ NTSTATUS mkdir_internal(connection_struct *conn, pstring directory)
        
        unix_convert(directory,conn,0,&bad_path,&sbuf);
 
+       if( strchr_m(directory, ':')) {
+               return NT_STATUS_NOT_A_DIRECTORY;
+       }
+
        if (ms_has_wild(directory)) {
                return NT_STATUS_OBJECT_NAME_INVALID;
        }
 
+       if (bad_path) {
+               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
+       }
+
        if (check_name(directory, conn))
                ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory));
        
        if (ret == -1) {
-               NTSTATUS nterr = NT_STATUS_OK;
                if(errno == ENOENT) {
-                       unix_ERR_class = ERRDOS;
-                       if (bad_path) {
-                               unix_ERR_code = ERRbadpath;
-                               nterr = NT_STATUS_OBJECT_PATH_NOT_FOUND;
-                       } else {
-                               unix_ERR_code = ERRbadfile;
-                               nterr = NT_STATUS_OBJECT_NAME_NOT_FOUND;
-                       }
+                       return NT_STATUS_OBJECT_NAME_NOT_FOUND;
                }
-               if (!NT_STATUS_IS_OK(nterr))
-                       return nterr;
                return map_nt_error_from_unix(errno);
        }
        
@@ -3013,7 +3236,7 @@ int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        NTSTATUS status;
        START_PROFILE(SMBmkdir);
  
-       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), STR_TERMINATE,&status);
+       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmkdir);
                return ERROR_NT(status);
@@ -3183,7 +3406,7 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        NTSTATUS status;
        START_PROFILE(SMBrmdir);
 
-       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), STR_TERMINATE,&status);
+       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBrmdir);
                return ERROR_NT(status);
@@ -3192,6 +3415,10 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        RESOLVE_DFSPATH(directory, conn, inbuf, outbuf)
 
        unix_convert(directory,conn, NULL,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBrmdir);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
   
        if (check_name(directory,conn)) {
                dptr_closepath(directory,SVAL(inbuf,smb_pid));
@@ -3213,14 +3440,18 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
 /*******************************************************************
  Resolve wildcards in a filename rename.
+ Note that name is in UNIX charset and thus potentially can be more
+ than fstring buffer (255 bytes) especially in default UTF-8 case.
+ Therefore, we use pstring inside and all calls should ensure that
+ name2 is at least pstring-long (they do already)
 ********************************************************************/
 
 static BOOL resolve_wildcards(const char *name1, char *name2)
 {
-       fstring root1,root2;
-       fstring ext1,ext2;
+       pstring root1,root2;
+       pstring ext1,ext2;
        char *p,*p2, *pname1, *pname2;
-       int available_space;
+       int available_space, actual_space;
        
 
        pname1 = strrchr_m(name1,'/');
@@ -3229,21 +3460,21 @@ static BOOL resolve_wildcards(const char *name1, char *name2)
        if (!pname1 || !pname2)
                return(False);
   
-       fstrcpy(root1,pname1);
-       fstrcpy(root2,pname2);
+       pstrcpy(root1,pname1);
+       pstrcpy(root2,pname2);
        p = strrchr_m(root1,'.');
        if (p) {
                *p = 0;
-               fstrcpy(ext1,p+1);
+               pstrcpy(ext1,p+1);
        } else {
-               fstrcpy(ext1,"");    
+               pstrcpy(ext1,"");    
        }
        p = strrchr_m(root2,'.');
        if (p) {
                *p = 0;
-               fstrcpy(ext2,p+1);
+               pstrcpy(ext2,p+1);
        } else {
-               fstrcpy(ext2,"");    
+               pstrcpy(ext2,"");    
        }
 
        p = root1;
@@ -3252,6 +3483,9 @@ static BOOL resolve_wildcards(const char *name1, char *name2)
                if (*p2 == '?') {
                        *p2 = *p;
                        p2++;
+               } else if (*p2 == '*') {
+                       pstrcpy(p2, p);
+                       break;
                } else {
                        p2++;
                }
@@ -3265,6 +3499,9 @@ static BOOL resolve_wildcards(const char *name1, char *name2)
                if (*p2 == '?') {
                        *p2 = *p;
                        p2++;
+               } else if (*p2 == '*') {
+                       pstrcpy(p2, p);
+                       break;
                } else {
                        p2++;
                }
@@ -3275,7 +3512,11 @@ static BOOL resolve_wildcards(const char *name1, char *name2)
        available_space = sizeof(pstring) - PTR_DIFF(pname2, name2);
        
        if (ext2[0]) {
-               snprintf(pname2, available_space - 1, "%s.%s", root2, ext2);
+               actual_space = snprintf(pname2, available_space - 1, "%s.%s", root2, ext2);
+               if (actual_space >= available_space - 1) {
+                       DEBUG(1,("resolve_wildcards: can't fit resolved name into specified buffer (overrun by %d bytes)\n",
+                               actual_space - available_space));
+               }
        } else {
                pstrcpy_base(pname2, root2, name2);
        }
@@ -3309,16 +3550,27 @@ static void rename_open_files(connection_struct *conn, SMB_DEV_T dev, SMB_INO_T
  Rename an open file - given an fsp.
 ****************************************************************************/
 
-NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, BOOL replace_if_exists)
+NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, uint16 attrs, BOOL replace_if_exists)
 {
        SMB_STRUCT_STAT sbuf;
        BOOL bad_path = False;
        pstring newname_last_component;
        NTSTATUS error = NT_STATUS_OK;
        BOOL dest_exists;
+       BOOL rcdest = True;
 
        ZERO_STRUCT(sbuf);
-       unix_convert(newname,conn,newname_last_component,&bad_path,&sbuf);
+       rcdest = unix_convert(newname,conn,newname_last_component,&bad_path,&sbuf);
+
+       /* Quick check for "." and ".." */
+       if (!bad_path && newname_last_component[0] == '.') {
+               if (!newname_last_component[1] || (newname_last_component[1] == '.' && !newname_last_component[2])) {
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+       }
+       if (!rcdest && bad_path) {
+               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
+       }
 
        /* Ensure newname contains a '/' */
        if(strrchr_m(newname,'/') == 0) {
@@ -3337,7 +3589,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
         * filename).
         */
 
-       if((case_sensitive == False) && (case_preserve == True) &&
+       if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
                        strequal(newname, fsp->fsp_name)) {
                char *p;
                pstring newname_modified_last_component;
@@ -3379,7 +3631,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
                return NT_STATUS_OBJECT_NAME_COLLISION;
        }
 
-       error = can_rename(newname,conn,&sbuf);
+       error = can_rename(newname,conn,attrs,&sbuf);
 
        if (dest_exists && !NT_STATUS_IS_OK(error)) {
                DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
@@ -3412,26 +3664,49 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
  code. 
 ****************************************************************************/
 
-NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, BOOL replace_if_exists)
+NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, uint16 attrs, BOOL replace_if_exists)
 {
        pstring directory;
        pstring mask;
-       pstring newname_last_component;
+       pstring last_component_src;
+       pstring last_component_dest;
        char *p;
        BOOL has_wild;
-       BOOL bad_path1 = False;
-       BOOL bad_path2 = False;
+       BOOL bad_path_src = False;
+       BOOL bad_path_dest = False;
        int count=0;
        NTSTATUS error = NT_STATUS_OK;
        BOOL rc = True;
+       BOOL rcdest = True;
        SMB_STRUCT_STAT sbuf1, sbuf2;
 
        *directory = *mask = 0;
 
        ZERO_STRUCT(sbuf1);
        ZERO_STRUCT(sbuf2);
-       rc = unix_convert(name,conn,0,&bad_path1,&sbuf1);
-       unix_convert(newname,conn,newname_last_component,&bad_path2,&sbuf2);
+
+       rc = unix_convert(name,conn,last_component_src,&bad_path_src,&sbuf1);
+       if (!rc && bad_path_src) {
+               if (ms_has_wild(last_component_src))
+                       return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
+       }
+
+       /* Quick check for "." and ".." */
+       if (last_component_src[0] == '.') {
+               if (!last_component_src[1] || (last_component_src[1] == '.' && !last_component_src[2])) {
+                       return NT_STATUS_OBJECT_NAME_INVALID;
+               }
+       }
+
+       rcdest = unix_convert(newname,conn,last_component_dest,&bad_path_dest,&sbuf2);
+
+       /* Quick check for "." and ".." */
+       if (last_component_dest[0] == '.') {
+               if (!last_component_dest[1] || (last_component_dest[1] == '.' && !last_component_dest[2])) {
+                       return NT_STATUS_OBJECT_NAME_INVALID;
+               }
+       }
 
        /*
         * Split the old name into directory and last component
@@ -3441,7 +3716,7 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, BO
         * name and newname contain a / character or neither of them do
         * as this is checked in resolve_wildcards().
         */
-       
+
        p = strrchr_m(name,'/');
        if (!p) {
                pstrcpy(directory,".");
@@ -3463,7 +3738,7 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, BO
         */
 
        if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask );
+               mangle_check_cache( mask, sizeof(pstring)-1 );
 
        has_wild = ms_has_wild(mask);
 
@@ -3487,9 +3762,9 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, BO
                }
                
                DEBUG(3,("rename_internals: case_sensitive = %d, case_preserve = %d, short case preserve = %d, \
-directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n", 
-                        case_sensitive, case_preserve, short_case_preserve, directory, 
-                        newname, newname_last_component, is_short_name));
+directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n", 
+                        conn->case_sensitive, conn->case_preserve, conn->short_case_preserve, directory, 
+                        newname, last_component_dest, is_short_name));
 
                /*
                 * Check for special case with case preserving and not
@@ -3499,13 +3774,13 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n",
                 * the rename (user is trying to change the case of the
                 * filename).
                 */
-               if((case_sensitive == False) && 
-                  (((case_preserve == True) && 
+               if((conn->case_sensitive == False) && 
+                  (((conn->case_preserve == True) && 
                     (is_short_name == False)) || 
-                   ((short_case_preserve == True) && 
+                   ((conn->short_case_preserve == True) && 
                     (is_short_name == True))) &&
                   strcsequal(directory, newname)) {
-                       pstring newname_modified_last_component;
+                       pstring modified_last_component;
 
                        /*
                         * Get the last component of the modified name.
@@ -3513,15 +3788,15 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n",
                         * character above.
                         */
                        p = strrchr_m(newname,'/');
-                       pstrcpy(newname_modified_last_component,p+1);
+                       pstrcpy(modified_last_component,p+1);
                        
-                       if(strcsequal(newname_modified_last_component, 
-                                     newname_last_component) == False) {
+                       if(strcsequal(modified_last_component, 
+                                     last_component_dest) == False) {
                                /*
                                 * Replace the modified last component with
                                 * the original.
                                 */
-                               pstrcpy(p+1, newname_last_component);
+                               pstrcpy(p+1, last_component_dest);
                        }
                }
        
@@ -3556,7 +3831,13 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n",
                        return error;
                }
 
-               error = can_rename(directory,conn,&sbuf1);
+               if (!rcdest && bad_path_dest) {
+                       if (ms_has_wild(last_component_dest))
+                               return NT_STATUS_OBJECT_NAME_INVALID;
+                       return NT_STATUS_OBJECT_PATH_NOT_FOUND;
+               }
+
+               error = can_rename(directory,conn,attrs,&sbuf1);
 
                if (!NT_STATUS_IS_OK(error)) {
                        DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
@@ -3609,19 +3890,37 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n",
                        dirptr = OpenDir(conn, directory, True);
                
                if (dirptr) {
-                       error = NT_STATUS_OBJECT_NAME_NOT_FOUND;
+                       error = NT_STATUS_NO_SUCH_FILE;
+/*                     Was error = NT_STATUS_OBJECT_NAME_NOT_FOUND; - gentest fix. JRA */
                        
                        if (strequal(mask,"????????.???"))
                                pstrcpy(mask,"*");
                        
                        while ((dname = ReadDirName(dirptr))) {
                                pstring fname;
+                               BOOL sysdir_entry = False;
 
                                pstrcpy(fname,dname);
                                
-                               if(!mask_match(fname, mask, case_sensitive))
+                               /* Quick check for "." and ".." */
+                               if (fname[0] == '.') {
+                                       if (!fname[1] || (fname[1] == '.' && !fname[2])) {
+                                               if (attrs & aDIR) {
+                                                       sysdir_entry = True;
+                                               } else {
+                                                       continue;
+                                               }
+                                       }
+                               }
+
+                               if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
                                
+                               if (sysdir_entry) {
+                                       error = NT_STATUS_OBJECT_NAME_INVALID;
+                                       break;
+                               }
+
                                error = NT_STATUS_ACCESS_DENIED;
                                slprintf(fname,sizeof(fname)-1,"%s/%s",directory,dname);
                                if (!vfs_object_exist(conn, fname, &sbuf1)) {
@@ -3629,7 +3928,7 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n",
                                        DEBUG(6,("rename %s failed. Error %s\n", fname, nt_errstr(error)));
                                        continue;
                                }
-                               error = can_rename(fname,conn,&sbuf1);
+                               error = can_rename(fname,conn,attrs,&sbuf1);
                                if (!NT_STATUS_IS_OK(error)) {
                                        DEBUG(6,("rename %s refused\n", fname));
                                        continue;
@@ -3642,6 +3941,14 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n",
                                        continue;
                                }
                                
+                               if (strcsequal(fname,destname)) {
+                                       rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname);
+                                       DEBUG(3,("rename_internals: identical names in wildcard rename %s - success\n", fname));
+                                       count++;
+                                       error = NT_STATUS_OK;
+                                       continue;
+                               }
+
                                if (!replace_if_exists && 
                                     vfs_file_exist(conn,destname, NULL)) {
                                        DEBUG(6,("file_exist %s\n", destname));
@@ -3652,11 +3959,20 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n",
                                if (!SMB_VFS_RENAME(conn,fname,destname)) {
                                        rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname);
                                        count++;
+                                       error = NT_STATUS_OK;
                                }
                                DEBUG(3,("rename_internals: doing rename on %s -> %s\n",fname,destname));
                        }
                        CloseDir(dirptr);
                }
+
+               if (!NT_STATUS_EQUAL(error,NT_STATUS_NO_SUCH_FILE)) {
+                       if (!rcdest && bad_path_dest) {
+                               if (ms_has_wild(last_component_dest))
+                                       return NT_STATUS_OBJECT_NAME_INVALID;
+                               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                       }
+               }
        }
        
        if (count == 0 && NT_STATUS_IS_OK(error)) {
@@ -3677,18 +3993,19 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        pstring name;
        pstring newname;
        char *p;
+       uint16 attrs = SVAL(inbuf,smb_vwv0);
        NTSTATUS status;
 
        START_PROFILE(SMBmv);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, name, p, sizeof(name), STR_TERMINATE,&status);
+       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
                return ERROR_NT(status);
        }
        p++;
-       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), STR_TERMINATE,&status);
+       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
                return ERROR_NT(status);
@@ -3699,9 +4016,14 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        
        DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
        
-       status = rename_internals(conn, name, newname, False);
+       status = rename_internals(conn, name, newname, attrs, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return ERROR_NT(status);
        }
 
@@ -3728,7 +4050,8 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
        SMB_OFF_T ret=-1;
        files_struct *fsp1,*fsp2;
        pstring dest;
-  
+       uint32 dosattrs;
        *err_ret = 0;
 
        pstrcpy(dest,dest1);
@@ -3746,7 +4069,8 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
                return(False);
 
        fsp1 = open_file_shared(conn,src,&src_sbuf,SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_RDONLY),
-                                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),0,0,&Access,&action);
+                                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),FILE_ATTRIBUTE_NORMAL,INTERNAL_OPEN_ONLY,
+                                       &Access,&action);
 
        if (!fsp1)
                return(False);
@@ -3754,11 +4078,12 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
        if (!target_is_directory && count)
                ofun = FILE_EXISTS_OPEN;
 
+       dosattrs = dos_mode(conn, src, &src_sbuf);
        if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1)
                ZERO_STRUCTP(&sbuf2);
 
        fsp2 = open_file_shared(conn,dest,&sbuf2,SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_WRONLY),
-                       ofun,src_sbuf.st_mode,0,&Access,&action);
+                       ofun,dosattrs,INTERNAL_OPEN_ONLY,&Access,&action);
 
        if (!fsp2) {
                close_file(fsp1,False);
@@ -3826,12 +4151,12 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        *directory = *mask = 0;
 
        p = smb_buf(inbuf);
-       p += srvstr_get_path(inbuf, name, p, sizeof(name), STR_TERMINATE,&status);
+       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcopy);
                return ERROR_NT(status);
        }
-       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), STR_TERMINATE,&status);
+       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcopy);
                return ERROR_NT(status);
@@ -3891,7 +4216,7 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
         */
 
        if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask );
+               mangle_check_cache( mask, sizeof(pstring)-1 );
 
        has_wild = ms_has_wild(mask);
 
@@ -3927,7 +4252,7 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                                pstring fname;
                                pstrcpy(fname,dname);
     
-                               if(!mask_match(fname, mask, case_sensitive))
+                               if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
 
                                error = ERRnoaccess;
@@ -3991,7 +4316,7 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                return ERROR_DOS(ERRDOS,ERRnoaccess);
        }
 
-       srvstr_get_path(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), STR_TERMINATE,&status);
+       srvstr_get_path(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(pathworks_setdir);
                return ERROR_NT(status);
@@ -4265,7 +4590,7 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
 
        /* Setup the timeout in seconds. */
 
-       lock_timeout = ((lock_timeout == -1) ? -1 : (lock_timeout+499)/500);
+       lock_timeout = ((lock_timeout == -1) ? -1 : (lock_timeout+999)/1000);
        
        /* Now do any requested locks */
        data += ((large_file_format ? 20 : 10)*num_ulocks);
@@ -4293,7 +4618,14 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name));
                status = do_lock_spin(fsp,conn,lock_pid, count,offset, 
                                 ((locktype & 1) ? READ_LOCK : WRITE_LOCK), &my_lock_ctx);
                if (NT_STATUS_V(status)) {
-                       if ((lock_timeout != 0) && lp_blocking_locks(SNUM(conn)) && !my_lock_ctx && ERROR_WAS_LOCK_DENIED(status)) {
+                       /*
+                        * Interesting fact found by IFSTEST /t LockOverlappedTest...
+                        * Even if it's our own lock context, we need to wait here as
+                        * there may be an unlock on the way.
+                        * So I removed a "&& !my_lock_ctx" from the following
+                        * if statement. JRA.
+                        */
+                       if ((lock_timeout != 0) && lp_blocking_locks(SNUM(conn)) && ERROR_WAS_LOCK_DENIED(status)) {
                                /*
                                 * A blocking lock was requested. Package up
                                 * this smb into a queued request and push it