Merge branch 'v3-2-test' of ssh://git.samba.org/data/git/samba into v3-2-test

(This used to be commit 5a30f6377d37d8a5cadce4fb9a2fc19b78fc1709)

21 files changed, 1504 insertions, 540 deletions

diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c
index 994b10d6a8..bc1761b0fd 100644
--- a/source3/smbd/aio.c
+++ b/source3/smbd/aio.c
@@ -236,7 +236,7 @@ bool schedule_aio_read_and_X(connection_struct *conn,
 	}
 
 	construct_reply_common((char *)req->inbuf, aio_ex->outbuf);
-	set_message(aio_ex->outbuf, 12, 0, True);
+	srv_set_message(aio_ex->outbuf, 12, 0, True);
 	SCVAL(aio_ex->outbuf,smb_vwv0,0xFF); /* Never a chained reply. */
 
 	a = &aio_ex->acb;
@@ -356,8 +356,9 @@ bool schedule_aio_write_and_X(connection_struct *conn,
 	        SSVAL(aio_ex->outbuf,smb_vwv2,numtowrite);
                 SSVAL(aio_ex->outbuf,smb_vwv4,(numtowrite>>16)&1);
 		show_msg(aio_ex->outbuf);
-		if (!send_smb(smbd_server_fd(),aio_ex->outbuf)) {
-			exit_server_cleanly("handle_aio_write: send_smb "
+		if (!srv_send_smb(smbd_server_fd(),aio_ex->outbuf,
+				IS_CONN_ENCRYPTED(fsp->conn))) {
+			exit_server_cleanly("handle_aio_write: srv_send_smb "
 					    "failed.");
 		}
 		DEBUG(10,("schedule_aio_write_and_X: scheduled aio_write "
@@ -407,10 +408,11 @@ static int handle_aio_read_complete(struct aio_extra *aio_ex)
 			   "Error = %s\n",
 			   aio_ex->fsp->fsp_name, strerror(errno) ));
 
-		outsize = (UNIXERROR(ERRDOS,ERRnoaccess));
 		ret = errno;
+		ERROR_NT(map_nt_error_from_unix(ret));
+		outsize = srv_set_message(outbuf,0,0,true);
 	} else {
-		outsize = set_message(outbuf,12,nread,False);
+		outsize = srv_set_message(outbuf,12,nread,False);
 		SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be * -1. */
 		SSVAL(outbuf,smb_vwv5,nread);
 		SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
@@ -425,8 +427,9 @@ static int handle_aio_read_complete(struct aio_extra *aio_ex)
 	}
 	smb_setlen(outbuf,outsize - 4);
 	show_msg(outbuf);
-	if (!send_smb(smbd_server_fd(),outbuf)) {
-		exit_server_cleanly("handle_aio_read_complete: send_smb "
+	if (!srv_send_smb(smbd_server_fd(),outbuf,
+			IS_CONN_ENCRYPTED(aio_ex->fsp->conn))) {
+		exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
 				    "failed.");
 	}
 
@@ -448,6 +451,7 @@ static int handle_aio_write_complete(struct aio_extra *aio_ex)
 	int ret = 0;
 	files_struct *fsp = aio_ex->fsp;
 	char *outbuf = aio_ex->outbuf;
+	const char *inbuf = aio_ex->inbuf;
 	ssize_t numtowrite = aio_ex->acb.aio_nbytes;
 	ssize_t nwritten = SMB_VFS_AIO_RETURN(fsp,&aio_ex->acb);
 
@@ -492,8 +496,9 @@ static int handle_aio_write_complete(struct aio_extra *aio_ex)
 			return 0;
 		}
 
-		UNIXERROR(ERRHRD,ERRdiskfull);
 		ret = errno;
+		ERROR_BOTH(map_nt_error_from_unix(ret), ERRHRD, ERRdiskfull);
+		srv_set_message(outbuf,0,0,true);
         } else {
 		bool write_through = BITSETW(aio_ex->inbuf+smb_vwv7,0);
 		NTSTATUS status;
@@ -509,16 +514,18 @@ static int handle_aio_write_complete(struct aio_extra *aio_ex)
 			 fsp->fnum, (int)numtowrite, (int)nwritten));
 		status = sync_file(fsp->conn,fsp, write_through);
 		if (!NT_STATUS_IS_OK(status)) {
-			UNIXERROR(ERRHRD,ERRdiskfull);
 			ret = errno;
+			ERROR_BOTH(map_nt_error_from_unix(ret),
+				   ERRHRD, ERRdiskfull);
+			srv_set_message(outbuf,0,0,true);
                 	DEBUG(5,("handle_aio_write: sync_file for %s returned %s\n",
 				fsp->fsp_name, nt_errstr(status) ));
 		}
 	}
 
 	show_msg(outbuf);
-	if (!send_smb(smbd_server_fd(),outbuf)) {
-		exit_server_cleanly("handle_aio_write: send_smb failed.");
+	if (!srv_send_smb(smbd_server_fd(),outbuf,IS_CONN_ENCRYPTED(fsp->conn))) {
+		exit_server_cleanly("handle_aio_write: srv_send_smb failed.");
 	}
 
 	DEBUG(10,("handle_aio_write_complete: scheduled aio_write completed "
diff --git a/source3/smbd/blocking.c b/source3/smbd/blocking.c
index 0078bb7d13..4e0d5289f8 100644
--- a/source3/smbd/blocking.c
+++ b/source3/smbd/blocking.c
@@ -41,6 +41,7 @@ typedef struct _blocking_lock_record {
 	enum brl_type lock_type;
 	char *inbuf;
 	int length;
+	bool encrypted;
 } blocking_lock_record;
 
 /* dlink list we store pending lock records on. */
@@ -149,7 +150,7 @@ static bool recalc_brl_timeout(void)
 ****************************************************************************/
 
 bool push_blocking_lock_request( struct byte_range_lock *br_lck,
-		const char *inbuf, int length,
+		const struct smb_request *req,
 		files_struct *fsp,
 		int lock_timeout,
 		int lock_num,
@@ -161,6 +162,7 @@ bool push_blocking_lock_request( struct byte_range_lock *br_lck,
 		uint32 blocking_pid)
 {
 	static bool set_lock_msg;
+	size_t length = smb_len(req->inbuf)+4;
 	blocking_lock_record *blr;
 	NTSTATUS status;
 
@@ -188,7 +190,7 @@ bool push_blocking_lock_request( struct byte_range_lock *br_lck,
 		return False;
 	}
 
-	blr->com_type = CVAL(inbuf,smb_com);
+	blr->com_type = CVAL(req->inbuf,smb_com);
 	blr->fsp = fsp;
 	if (lock_timeout == -1) {
 		blr->expire_time.tv_sec = 0;
@@ -204,8 +206,9 @@ bool push_blocking_lock_request( struct byte_range_lock *br_lck,
 	blr->lock_type = lock_type;
 	blr->offset = offset;
 	blr->count = count;
-	memcpy(blr->inbuf, inbuf, length);
+	memcpy(blr->inbuf, req->inbuf, length);
 	blr->length = length;
+	blr->encrypted = req->encrypted;
 
 	/* Add a pending lock record for this. */
 	status = brl_lock(smbd_messaging_context(), br_lck,
@@ -235,14 +238,14 @@ bool push_blocking_lock_request( struct byte_range_lock *br_lck,
 		set_lock_msg = True;
 	}
 
-	DEBUG(3,("push_blocking_lock_request: lock request length=%d blocked with "
+	DEBUG(3,("push_blocking_lock_request: lock request length=%u blocked with "
 		"expiry time (%u sec. %u usec) (+%d msec) for fnum = %d, name = %s\n",
-		length, (unsigned int)blr->expire_time.tv_sec,
+		(unsigned int)length, (unsigned int)blr->expire_time.tv_sec,
 		(unsigned int)blr->expire_time.tv_usec, lock_timeout,
 		blr->fsp->fnum, blr->fsp->fsp_name ));
 
 	/* Push the MID of this packet on the signing queue. */
-	srv_defer_sign_response(SVAL(inbuf,smb_mid));
+	srv_defer_sign_response(SVAL(req->inbuf,smb_mid));
 
 	return True;
 }
@@ -259,7 +262,7 @@ static void reply_lockingX_success(blocking_lock_record *blr)
 		smb_panic("Could not allocate smb_request");
 	}
 
-	init_smb_request(req, (uint8 *)blr->inbuf, 0);
+	init_smb_request(req, (uint8 *)blr->inbuf, 0, blr->encrypted);
 	reply_outbuf(req, 2, 0);
 
 	/*
@@ -272,8 +275,10 @@ static void reply_lockingX_success(blocking_lock_record *blr)
 
 	chain_reply(req);
 
-	if (!send_smb(smbd_server_fd(),(char *)req->outbuf)) {
-		exit_server_cleanly("send_blocking_reply: send_smb failed.");
+	if (!srv_send_smb(smbd_server_fd(),
+			(char *)req->outbuf,
+			IS_CONN_ENCRYPTED(blr->fsp->conn))) {
+		exit_server_cleanly("send_blocking_reply: srv_send_smb failed.");
 	}
 }
 
@@ -298,19 +303,21 @@ static void generic_blocking_lock_error(blocking_lock_record *blr, NTSTATUS stat
 		/* Store the last lock error. */
 		files_struct *fsp = blr->fsp;
 
-		fsp->last_lock_failure.context.smbpid = blr->lock_pid;
-		fsp->last_lock_failure.context.tid = fsp->conn->cnum;
-		fsp->last_lock_failure.context.pid = procid_self();
-		fsp->last_lock_failure.start = blr->offset;
-		fsp->last_lock_failure.size = blr->count;
-		fsp->last_lock_failure.fnum = fsp->fnum;
-		fsp->last_lock_failure.lock_type = READ_LOCK; /* Don't care. */
-		fsp->last_lock_failure.lock_flav = blr->lock_flav;
+		if (fsp) {
+			fsp->last_lock_failure.context.smbpid = blr->lock_pid;
+			fsp->last_lock_failure.context.tid = fsp->conn->cnum;
+			fsp->last_lock_failure.context.pid = procid_self();
+			fsp->last_lock_failure.start = blr->offset;
+			fsp->last_lock_failure.size = blr->count;
+			fsp->last_lock_failure.fnum = fsp->fnum;
+			fsp->last_lock_failure.lock_type = READ_LOCK; /* Don't care. */
+			fsp->last_lock_failure.lock_flav = blr->lock_flav;
+		}
 	}
 
 	ERROR_NT(status);
-	if (!send_smb(smbd_server_fd(),outbuf)) {
-		exit_server_cleanly("generic_blocking_lock_error: send_smb failed.");
+	if (!srv_send_smb(smbd_server_fd(),outbuf, blr->encrypted)) {
+		exit_server_cleanly("generic_blocking_lock_error: srv_send_smb failed.");
 	}
 }
 
@@ -388,8 +395,10 @@ static void blocking_lock_reply_error(blocking_lock_record *blr, NTSTATUS status
 			 */
 			SCVAL(outbuf,smb_com,SMBtrans2);
 			ERROR_NT(status);
-			if (!send_smb(smbd_server_fd(),outbuf)) {
-				exit_server_cleanly("blocking_lock_reply_error: send_smb failed.");
+			if (!srv_send_smb(smbd_server_fd(),
+					outbuf,
+					IS_CONN_ENCRYPTED(blr->fsp->conn))) {
+				exit_server_cleanly("blocking_lock_reply_error: srv_send_smb failed.");
 			}
 			break;
 		}
@@ -531,12 +540,12 @@ static bool process_trans2(blocking_lock_record *blr)
 		return True;
 	}
 
-	init_smb_request(req, (uint8 *)blr->inbuf, 0);
+	init_smb_request(req, (uint8 *)blr->inbuf, 0, blr->encrypted);
 
 	SCVAL(req->inbuf, smb_com, SMBtrans2);
 	SSVAL(params,0,0);
 	/* Fake up max_data_bytes here - we know it fits. */
-	send_trans2_replies(req, params, 2, NULL, 0, 0xffff);
+	send_trans2_replies(blr->fsp->conn, req, params, 2, NULL, 0, 0xffff);
 	return True;
 }
 
@@ -597,6 +606,9 @@ file %s fnum = %d\n", blr->com_type, fsp->fsp_name, fsp->fnum ));
 					locktype,
 					NT_STATUS_RANGE_NOT_LOCKED);
 			}
+			/* We're closing the file fsp here, so ensure
+			 * we don't have a dangling pointer. */
+			blr->fsp = NULL;
 		}
 	}
 }
diff --git a/source3/smbd/dosmode.c b/source3/smbd/dosmode.c
index 8e3c9b4c91..a96f80ee0e 100644
--- a/source3/smbd/dosmode.c
+++ b/source3/smbd/dosmode.c
@@ -438,12 +438,19 @@ int file_set_dosmode(connection_struct *conn, const char *fname,
 	dosmode &= SAMBA_ATTRIBUTES_MASK;
 
 	DEBUG(10,("file_set_dosmode: setting dos mode 0x%x on file %s\n", dosmode, fname));
-	if (!st || (st && !VALID_STAT(*st))) {
+
+	if (st == NULL) {
+		SET_STAT_INVALID(st1);
 		st = &st1;
+	}
+
+	if (!VALID_STAT(*st)) {
 		if (SMB_VFS_STAT(conn,fname,st))
 			return(-1);
 	}
 
+	unixmode = st->st_mode;
+
 	get_acl_group_bits(conn, fname, &st->st_mode);
 
 	if (S_ISDIR(st->st_mode))
@@ -451,8 +458,10 @@ int file_set_dosmode(connection_struct *conn, const char *fname,
 	else
 		dosmode &= ~aDIR;
 
-	if (dos_mode(conn,fname,st) == dosmode)
+	if (dos_mode(conn,fname,st) == dosmode) {
+		st->st_mode = unixmode;
 		return(0);
+	}
 
 	/* Store the DOS attributes in an EA by preference. */
 	if (set_ea_dos_attribute(conn, fname, st, dosmode)) {
@@ -460,6 +469,7 @@ int file_set_dosmode(connection_struct *conn, const char *fname,
 			notify_fname(conn, NOTIFY_ACTION_MODIFIED,
 				FILE_NOTIFY_CHANGE_ATTRIBUTES, fname);
 		}
+		st->st_mode = unixmode;
 		return 0;
 	}
 
@@ -500,6 +510,7 @@ int file_set_dosmode(connection_struct *conn, const char *fname,
 			notify_fname(conn, NOTIFY_ACTION_MODIFIED,
 				FILE_NOTIFY_CHANGE_ATTRIBUTES, fname);
 		}
+		st->st_mode = unixmode;
 		return 0;
 	}
 
@@ -534,6 +545,9 @@ int file_set_dosmode(connection_struct *conn, const char *fname,
 			notify_fname(conn, NOTIFY_ACTION_MODIFIED,
 				FILE_NOTIFY_CHANGE_ATTRIBUTES, fname);
 		}
+		if (ret == 0) {
+			st->st_mode = unixmode;
+		}
 	}
 
 	return( ret );
diff --git a/source3/smbd/error.c b/source3/smbd/error.c
index 12eff42023..de2de088ec 100644
--- a/source3/smbd/error.c
+++ b/source3/smbd/error.c
@@ -24,34 +24,6 @@ extern struct unix_error_map unix_dos_nt_errmap[];
 
 extern uint32 global_client_caps;
 
-/****************************************************************************
- Create an error packet from errno.
-****************************************************************************/
-
-int unix_error_packet(char *outbuf,int def_class,uint32 def_code, NTSTATUS def_status, int line, const char *file)
-{
-	int eclass=def_class;
-	int ecode=def_code;
-	NTSTATUS ntstatus = def_status;
-	int i=0;
-
-	if (errno != 0) {
-		DEBUG(3,("unix_error_packet: error string = %s\n",strerror(errno)));
-  
-		while (unix_dos_nt_errmap[i].dos_class != 0) {
-			if (unix_dos_nt_errmap[i].unix_error == errno) {
-				eclass = unix_dos_nt_errmap[i].dos_class;
-				ecode = unix_dos_nt_errmap[i].dos_code;
-				ntstatus = unix_dos_nt_errmap[i].nt_error;
-				break;
-			}
-			i++;
-		}
-	}
-
-	return error_packet(outbuf,eclass,ecode,ntstatus,line,file);
-}
-
 bool use_nt_status(void)
 {
 	return lp_nt_status_support() && (global_client_caps & CAP_STATUS32);
@@ -111,7 +83,7 @@ void error_packet_set(char *outbuf, uint8 eclass, uint32 ecode, NTSTATUS ntstatu
 
 int error_packet(char *outbuf, uint8 eclass, uint32 ecode, NTSTATUS ntstatus, int line, const char *file)
 {
-	int outsize = set_message(outbuf,0,0,True);
+	int outsize = srv_set_message(outbuf,0,0,True);
 	error_packet_set(outbuf, eclass, ecode, ntstatus, line, file);
 	return outsize;
 }
@@ -150,8 +122,24 @@ void reply_both_error(struct smb_request *req, uint8 eclass, uint32 ecode,
 			 line, file);
 }
 
+void reply_openerror(struct smb_request *req, NTSTATUS status)
+{
+	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
+		/*
+		 * We hit an existing file, and if we're returning DOS
+		 * error codes OBJECT_NAME_COLLISION would map to
+		 * ERRDOS/183, we need to return ERRDOS/80, see bug
+		 * 4852.
+		 */
+		reply_botherror(req, NT_STATUS_OBJECT_NAME_COLLISION,
+			ERRDOS, ERRfilexists);
+	} else {
+		reply_nterror(req, status);
+	}
+}
+
 void reply_unix_error(struct smb_request *req, uint8 defclass, uint32 defcode,
-		      NTSTATUS defstatus, int line, const char *file)
+			NTSTATUS defstatus, int line, const char *file)
 {
 	int eclass=defclass;
 	int ecode=defcode;
@@ -163,7 +151,7 @@ void reply_unix_error(struct smb_request *req, uint8 defclass, uint32 defcode,
 
 	if (errno != 0) {
 		DEBUG(3,("unix_error_packet: error string = %s\n",
-			 strerror(errno)));
+			strerror(errno)));
 
 		while (unix_dos_nt_errmap[i].dos_class != 0) {
 			if (unix_dos_nt_errmap[i].unix_error == errno) {
@@ -177,22 +165,5 @@ void reply_unix_error(struct smb_request *req, uint8 defclass, uint32 defcode,
 	}
 
 	error_packet_set((char *)req->outbuf, eclass, ecode, ntstatus,
-			 line, file);
+		line, file);
 }
-
-void reply_openerror(struct smb_request *req, NTSTATUS status)
-{
-	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
-		/*
-		 * We hit an existing file, and if we're returning DOS
-		 * error codes OBJECT_NAME_COLLISION would map to
-		 * ERRDOS/183, we need to return ERRDOS/80, see bug
-		 * 4852.
-		 */
-		reply_botherror(req, NT_STATUS_OBJECT_NAME_COLLISION,
-			ERRDOS, ERRfilexists);
-	} else {
-		reply_nterror(req, status);
-	}
-}
-
diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index f28016ccb3..68a13d692f 100644
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -30,7 +30,7 @@ extern int max_send;
 
 #define NERR_notsupported 50
 
-static void api_no_reply(struct smb_request *req);
+static void api_no_reply(connection_struct *conn, struct smb_request *req);
 
 /*******************************************************************
  copies parameters and data, as needed, into the smb buffer
@@ -81,7 +81,8 @@ static void copy_trans_params_and_data(char *outbuf, int align,
  Send a trans reply.
  ****************************************************************************/
 
-void send_trans_reply(struct smb_request *req,
+void send_trans_reply(connection_struct *conn,
+			struct smb_request *req,
 		      char *rparam, int rparam_len,
 		      char *rdata, int rdata_len,
 		      bool buffer_too_large)
@@ -129,8 +130,10 @@ void send_trans_reply(struct smb_request *req,
 	}
 
 	show_msg((char *)req->outbuf);
-	if (!send_smb(smbd_server_fd(),(char *)req->outbuf))
-		exit_server_cleanly("send_trans_reply: send_smb failed.");
+	if (!srv_send_smb(smbd_server_fd(),
+			(char *)req->outbuf,
+			IS_CONN_ENCRYPTED(conn)))
+		exit_server_cleanly("send_trans_reply: srv_send_smb failed.");
 
 	TALLOC_FREE(req->outbuf);
 
@@ -175,8 +178,10 @@ void send_trans_reply(struct smb_request *req,
 		}
 
 		show_msg((char *)req->outbuf);
-		if (!send_smb(smbd_server_fd(), (char *)req->outbuf))
-			exit_server_cleanly("send_trans_reply: send_smb failed.");
+		if (!srv_send_smb(smbd_server_fd(),
+				(char *)req->outbuf,
+				IS_CONN_ENCRYPTED(conn)))
+			exit_server_cleanly("send_trans_reply: srv_send_smb failed.");
 
 		tot_data_sent  += this_ldata;
 		tot_param_sent += this_lparam;
@@ -188,7 +193,7 @@ void send_trans_reply(struct smb_request *req,
  Start the first part of an RPC reply which began with an SMBtrans request.
 ****************************************************************************/
 
-static void api_rpc_trans_reply(struct smb_request *req, smb_np_struct *p)
+static void api_rpc_trans_reply(connection_struct *conn, struct smb_request *req, smb_np_struct *p)
 {
 	bool is_data_outstanding;
 	char *rdata = (char *)SMB_MALLOC(p->max_trans_reply);
@@ -203,11 +208,11 @@ static void api_rpc_trans_reply(struct smb_request *req, smb_np_struct *p)
 	if((data_len = read_from_pipe( p, rdata, p->max_trans_reply,
 					&is_data_outstanding)) < 0) {
 		SAFE_FREE(rdata);
-		api_no_reply(req);
+		api_no_reply(conn,req);
 		return;
 	}
 
-	send_trans_reply(req, NULL, 0, rdata, data_len, is_data_outstanding);
+	send_trans_reply(conn, req, NULL, 0, rdata, data_len, is_data_outstanding);
 	SAFE_FREE(rdata);
 	return;
 }
@@ -216,7 +221,7 @@ static void api_rpc_trans_reply(struct smb_request *req, smb_np_struct *p)
  WaitNamedPipeHandleState 
 ****************************************************************************/
 
-static void api_WNPHS(struct smb_request *req, smb_np_struct *p,
+static void api_WNPHS(connection_struct *conn, struct smb_request *req, smb_np_struct *p,
 		      char *param, int param_len)
 {
 	uint16 priority;
@@ -231,10 +236,10 @@ static void api_WNPHS(struct smb_request *req, smb_np_struct *p,
 
 	if (wait_rpc_pipe_hnd_state(p, priority)) {
 		/* now send the reply */
-		send_trans_reply(req, NULL, 0, NULL, 0, False);
+		send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 		return;
 	}
-	api_no_reply(req);
+	api_no_reply(conn,req);
 }
 
 
@@ -242,7 +247,7 @@ static void api_WNPHS(struct smb_request *req, smb_np_struct *p,
  SetNamedPipeHandleState 
 ****************************************************************************/
 
-static void api_SNPHS(struct smb_request *req, smb_np_struct *p,
+static void api_SNPHS(connection_struct *conn, struct smb_request *req, smb_np_struct *p,
 		      char *param, int param_len)
 {
 	uint16 id;
@@ -257,10 +262,10 @@ static void api_SNPHS(struct smb_request *req, smb_np_struct *p,
 
 	if (set_rpc_pipe_hnd_state(p, id)) {
 		/* now send the reply */
-		send_trans_reply(req, NULL, 0, NULL, 0, False);
+		send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 		return;
 	}
-	api_no_reply(req);
+	api_no_reply(conn,req);
 }
 
 
@@ -268,7 +273,7 @@ static void api_SNPHS(struct smb_request *req, smb_np_struct *p,
  When no reply is generated, indicate unsupported.
  ****************************************************************************/
 
-static void api_no_reply(struct smb_request *req)
+static void api_no_reply(connection_struct *conn, struct smb_request *req)
 {
 	char rparam[4];
 
@@ -279,7 +284,7 @@ static void api_no_reply(struct smb_request *req)
 	DEBUG(3,("Unsupported API fd command\n"));
 
 	/* now send the reply */
-	send_trans_reply(req, rparam, 4, NULL, 0, False);
+	send_trans_reply(conn, req, rparam, 4, NULL, 0, False);
 
 	return;
 }
@@ -321,7 +326,7 @@ static void api_fd_reply(connection_struct *conn, uint16 vuid,
 			/* Win9x does this call with a unicode pipe name, not a pnum. */
 			/* Just return success for now... */
 			DEBUG(3,("Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name\n"));
-			send_trans_reply(req, NULL, 0, NULL, 0, False);
+			send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 			return;
 		}
 
@@ -349,18 +354,18 @@ static void api_fd_reply(connection_struct *conn, uint16 vuid,
 		/* dce/rpc command */
 		reply = write_to_pipe(p, data, tdscnt);
 		if (!reply) {
-			api_no_reply(req);
+			api_no_reply(conn, req);
 			return;
 		}
-		api_rpc_trans_reply(req, p);
+		api_rpc_trans_reply(conn, req, p);
 		break;
 	case TRANSACT_WAITNAMEDPIPEHANDLESTATE:
 		/* Wait Named Pipe Handle state */
-		api_WNPHS(req, p, params, tpscnt);
+		api_WNPHS(conn, req, p, params, tpscnt);
 		break;
 	case TRANSACT_SETNAMEDPIPEHANDLESTATE:
 		/* Set Named Pipe Handle state */
-		api_SNPHS(req, p, params, tpscnt);
+		api_SNPHS(conn, req, p, params, tpscnt);
 		break;
 	default:
 		reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -472,8 +477,10 @@ static void handle_trans(connection_struct *conn, struct smb_request *req,
 		   state->max_data_return,
 		   state->max_param_return);
 
-	if (state->close_on_completion)
+	if (state->close_on_completion) {
 		close_cnum(conn,state->vuid);
+		req->conn = NULL;
+	}
 
 	return;
 }
@@ -482,8 +489,9 @@ static void handle_trans(connection_struct *conn, struct smb_request *req,
  Reply to a SMBtrans.
  ****************************************************************************/
 
-void reply_trans(connection_struct *conn, struct smb_request *req)
+void reply_trans(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	unsigned int dsoff;
 	unsigned int dscnt;
 	unsigned int psoff;
@@ -662,8 +670,9 @@ void reply_trans(connection_struct *conn, struct smb_request *req)
  Reply to a secondary SMBtrans.
  ****************************************************************************/
 
-void reply_transs(connection_struct *conn, struct smb_request *req)
+void reply_transs(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
 	struct trans_state *state;
 	int size;
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 3ab216c062..5a6df1f139 100644
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -4605,7 +4605,7 @@ void api_reply(connection_struct *conn, uint16 vuid,
 
 	/* If api_Unsupported returns false we can't return anything. */
 	if (reply) {
-		send_trans_reply(req, rparam, rparam_len,
+		send_trans_reply(conn, req, rparam, rparam_len,
 				 rdata, rdata_len, False);
 	}
 
diff --git a/source3/smbd/mangle_hash.c b/source3/smbd/mangle_hash.c
index c369f6eda4..1dc9c67dcc 100644
--- a/source3/smbd/mangle_hash.c
+++ b/source3/smbd/mangle_hash.c
@@ -57,8 +57,7 @@ static char magic_char = '~';
 static const char basechars[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%";
 #define MANGLE_BASE       (sizeof(basechars)/sizeof(char)-1)
 
-static unsigned char chartest[256]  = { 0 };
-static bool          ct_initialized = False;
+static unsigned char *chartest;
 
 #define mangle(V) ((char)(basechars[(V) % MANGLE_BASE]))
 #define BASECHAR_MASK 0xf0
@@ -334,13 +333,13 @@ static void init_chartest( void )
 {
 	const unsigned char *s;
 
-	memset( (char *)chartest, '\0', 256 );
+	chartest = SMB_MALLOC_ARRAY(unsigned char, 256);
+
+	SMB_ASSERT(chartest != NULL);
 
 	for( s = (const unsigned char *)basechars; *s; s++ ) {
 		chartest[*s] |= BASECHAR_MASK;
 	}
-
-	ct_initialized = True;
 }
 
 /* ************************************************************************** **
@@ -367,8 +366,9 @@ static bool is_mangled(const char *s, const struct share_params *p)
 
 	magic_char = lp_magicchar(p);
 
-	if( !ct_initialized )
+	if (chartest == NULL) {
 		init_chartest();
+	}
 
 	magic = strchr_m( s, magic_char );
 	while( magic && magic[1] && magic[2] ) {         /* 3 chars, 1st is magic. */
diff --git a/source3/smbd/message.c b/source3/smbd/message.c
index d0b524da0e..a870f03df9 100644
--- a/source3/smbd/message.c
+++ b/source3/smbd/message.c
@@ -137,7 +137,7 @@ static void msg_deliver(struct msg_state *state)
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_sends(connection_struct *conn, struct smb_request *req)
+void reply_sends(struct smb_request *req)
 {
 	struct msg_state *state;
 	int len;
@@ -190,7 +190,7 @@ void reply_sends(connection_struct *conn, struct smb_request *req)
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_sendstrt(connection_struct *conn, struct smb_request *req)
+void reply_sendstrt(struct smb_request *req)
 {
 	char *p;
 
@@ -234,7 +234,7 @@ void reply_sendstrt(connection_struct *conn, struct smb_request *req)
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_sendtxt(connection_struct *conn, struct smb_request *req)
+void reply_sendtxt(struct smb_request *req)
 {
 	int len;
 	char *msg;
@@ -287,7 +287,7 @@ void reply_sendtxt(connection_struct *conn, struct smb_request *req)
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_sendend(connection_struct *conn, struct smb_request *req)
+void reply_sendend(struct smb_request *req)
 {
 	START_PROFILE(SMBsendend);
 
diff --git a/source3/smbd/negprot.c b/source3/smbd/negprot.c
index 02f752fd67..9f56949eeb 100644
--- a/source3/smbd/negprot.c
+++ b/source3/smbd/negprot.c
@@ -505,7 +505,7 @@ static const struct {
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_negprot(connection_struct *conn, struct smb_request *req)
+void reply_negprot(struct smb_request *req)
 {
 	size_t size = smb_len(req->inbuf) + 4;
 	int choice= -1;
diff --git a/source3/smbd/notify.c b/source3/smbd/notify.c
index 0dd7fbb20e..7287210802 100644
--- a/source3/smbd/notify.c
+++ b/source3/smbd/notify.c
@@ -128,7 +128,8 @@ static bool notify_marshall_changes(int num_changes,
  Setup the common parts of the return packet and send it.
 *****************************************************************************/
 
-static void change_notify_reply_packet(const uint8 *request_buf,
+static void change_notify_reply_packet(connection_struct *conn,
+				const uint8 *request_buf,
 				       NTSTATUS error_code)
 {
 	char outbuf[smb_size+38];
@@ -142,15 +143,18 @@ static void change_notify_reply_packet(const uint8 *request_buf,
 	 * Seems NT needs a transact command with an error code
 	 * in it. This is a longer packet than a simple error.
 	 */
-	set_message(outbuf,18,0,False);
+	srv_set_message(outbuf,18,0,False);
 
 	show_msg(outbuf);
-	if (!send_smb(smbd_server_fd(),outbuf))
-		exit_server_cleanly("change_notify_reply_packet: send_smb "
+	if (!srv_send_smb(smbd_server_fd(),
+			outbuf,
+			IS_CONN_ENCRYPTED(conn)))
+		exit_server_cleanly("change_notify_reply_packet: srv_send_smb "
 				    "failed.");
 }
 
-void change_notify_reply(const uint8 *request_buf, uint32 max_param,
+void change_notify_reply(connection_struct *conn,
+			const uint8 *request_buf, uint32 max_param,
 			 struct notify_change_buf *notify_buf)
 {
 	prs_struct ps;
@@ -158,7 +162,7 @@ void change_notify_reply(const uint8 *request_buf, uint32 max_param,
 	uint8 tmp_request[smb_size];
 
 	if (notify_buf->num_changes == -1) {
-		change_notify_reply_packet(request_buf, NT_STATUS_OK);
+		change_notify_reply_packet(conn, request_buf, NT_STATUS_OK);
 		notify_buf->num_changes = 0;
 		return;
 	}
@@ -171,12 +175,12 @@ void change_notify_reply(const uint8 *request_buf, uint32 max_param,
 		 * We exceed what the client is willing to accept. Send
 		 * nothing.
 		 */
-		change_notify_reply_packet(request_buf, NT_STATUS_OK);
+		change_notify_reply_packet(conn, request_buf, NT_STATUS_OK);
 		goto done;
 	}
 
 	if (!(req = talloc(talloc_tos(), struct smb_request))) {
-		change_notify_reply_packet(request_buf, NT_STATUS_NO_MEMORY);
+		change_notify_reply_packet(conn, request_buf, NT_STATUS_NO_MEMORY);
 		goto done;
 	}
 
@@ -189,9 +193,9 @@ void change_notify_reply(const uint8 *request_buf, uint32 max_param,
 	smb_setlen((char *)tmp_request, smb_size);
 	SCVAL(tmp_request, smb_wct, 0);
 
-	init_smb_request(req, tmp_request,0);
+	init_smb_request(req, tmp_request,0, conn->encrypted_tid);
 
-	send_nt_replies(req, NT_STATUS_OK, prs_data_p(&ps),
+	send_nt_replies(conn, req, NT_STATUS_OK, prs_data_p(&ps),
 			prs_offset(&ps), NULL, 0);
 
  done:
@@ -242,9 +246,10 @@ NTSTATUS change_notify_create(struct files_struct *fsp, uint32 filter,
 	return status;
 }
 
-NTSTATUS change_notify_add_request(const uint8 *inbuf, uint32 max_param,
-				   uint32 filter, bool recursive,
-				   struct files_struct *fsp)
+NTSTATUS change_notify_add_request(const struct smb_request *req,
+				uint32 max_param,
+				uint32 filter, bool recursive,
+				struct files_struct *fsp)
 {
 	struct notify_change_request *request = NULL;
 	struct notify_mid_map *map = NULL;
@@ -258,7 +263,7 @@ NTSTATUS change_notify_add_request(const uint8 *inbuf, uint32 max_param,
 	request->mid_map = map;
 	map->req = request;
 
-	memcpy(request->request_buf, inbuf, sizeof(request->request_buf));
+	memcpy(request->request_buf, req->inbuf, sizeof(request->request_buf));
 	request->max_param = max_param;
 	request->filter = filter;
 	request->fsp = fsp;
@@ -267,11 +272,11 @@ NTSTATUS change_notify_add_request(const uint8 *inbuf, uint32 max_param,
 	DLIST_ADD_END(fsp->notify->requests, request,
 		      struct notify_change_request *);
 
-	map->mid = SVAL(inbuf, smb_mid);
+	map->mid = SVAL(req->inbuf, smb_mid);
 	DLIST_ADD(notify_changes_by_mid, map);
 
 	/* Push the MID of this packet on the signing queue. */
-	srv_defer_sign_response(SVAL(inbuf,smb_mid));
+	srv_defer_sign_response(SVAL(req->inbuf,smb_mid));
 
 	return NT_STATUS_OK;
 }
@@ -324,7 +329,8 @@ void remove_pending_change_notify_requests_by_mid(uint16 mid)
 		return;
 	}
 
-	change_notify_reply_packet(map->req->request_buf, NT_STATUS_CANCELLED);
+	change_notify_reply_packet(map->req->fsp->conn,
+			map->req->request_buf, NT_STATUS_CANCELLED);
 	change_notify_remove_request(map->req);
 }
 
@@ -340,7 +346,7 @@ void remove_pending_change_notify_requests_by_fid(files_struct *fsp,
 	}
 
 	while (fsp->notify->requests != NULL) {
-		change_notify_reply_packet(
+		change_notify_reply_packet(fsp->conn,
 			fsp->notify->requests->request_buf, status);
 		change_notify_remove_request(fsp->notify->requests);
 	}
@@ -434,7 +440,8 @@ static void notify_fsp(files_struct *fsp, uint32 action, const char *name)
 	 * TODO: do we have to walk the lists of requests pending?
 	 */
 
-	change_notify_reply(fsp->notify->requests->request_buf,
+	change_notify_reply(fsp->conn,
+			fsp->notify->requests->request_buf,
 			    fsp->notify->requests->max_param,
 			    fsp->notify);
 
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index cb98a8139c..a51f3afd82 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -66,7 +66,8 @@ static char *nttrans_realloc(char **ptr, size_t size)
  HACK ! Always assumes smb_setup field is zero.
 ****************************************************************************/
 
-void send_nt_replies(struct smb_request *req, NTSTATUS nt_error,
+void send_nt_replies(connection_struct *conn,
+			struct smb_request *req, NTSTATUS nt_error,
 		     char *params, int paramsize,
 		     char *pdata, int datasize)
 {
@@ -242,8 +243,10 @@ void send_nt_replies(struct smb_request *req, NTSTATUS nt_error,
 
 		/* Send the packet */
 		show_msg((char *)req->outbuf);
-		if (!send_smb(smbd_server_fd(),(char *)req->outbuf)) {
-			exit_server_cleanly("send_nt_replies: send_smb failed.");
+		if (!srv_send_smb(smbd_server_fd(),
+				(char *)req->outbuf,
+				IS_CONN_ENCRYPTED(conn))) {
+			exit_server_cleanly("send_nt_replies: srv_send_smb failed.");
 		}
 
 		TALLOC_FREE(req->outbuf);
@@ -410,8 +413,9 @@ static void do_ntcreate_pipe_open(connection_struct *conn,
  Reply to an NT create and X call.
 ****************************************************************************/
 
-void reply_ntcreate_and_X(connection_struct *conn, struct smb_request *req)
+void reply_ntcreate_and_X(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *fname = NULL;
 	uint32 flags;
 	uint32 access_mask;
@@ -726,7 +730,7 @@ static void do_nt_transact_create_pipe(connection_struct *conn,
 	DEBUG(5,("do_nt_transact_create_pipe: open name = %s\n", fname));
 
 	/* Send the required number of replies */
-	send_nt_replies(req, NT_STATUS_OK, params, param_len, *ppdata, 0);
+	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
 
 	return;
 }
@@ -1080,7 +1084,7 @@ static void call_nt_transact_create(connection_struct *conn,
 	DEBUG(5,("call_nt_transact_create: open name = %s\n", fname));
 
 	/* Send the required number of replies */
-	send_nt_replies(req, NT_STATUS_OK, params, param_len, *ppdata, 0);
+	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len, *ppdata, 0);
 
 	return;
 }
@@ -1090,7 +1094,7 @@ static void call_nt_transact_create(connection_struct *conn,
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_ntcancel(connection_struct *conn, struct smb_request *req)
+void reply_ntcancel(struct smb_request *req)
 {
 	/*
 	 * Go through and cancel any pending change notifies.
@@ -1252,8 +1256,9 @@ static NTSTATUS copy_internals(TALLOC_CTX *ctx,
  Reply to a NT rename request.
 ****************************************************************************/
 
-void reply_ntrename(connection_struct *conn, struct smb_request *req)
+void reply_ntrename(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *oldname = NULL;
 	char *newname = NULL;
 	char *p;
@@ -1474,7 +1479,7 @@ static void call_nt_transact_notify_change(connection_struct *conn,
 		 * here.
 		 */
 
-		change_notify_reply(req->inbuf, max_param_count, fsp->notify);
+		change_notify_reply(fsp->conn, req->inbuf, max_param_count, fsp->notify);
 
 		/*
 		 * change_notify_reply() above has independently sent its
@@ -1487,7 +1492,9 @@ static void call_nt_transact_notify_change(connection_struct *conn,
 	 * No changes pending, queue the request
 	 */
 
-	status = change_notify_add_request(req->inbuf, max_param_count, filter,
+	status = change_notify_add_request(req,
+			max_param_count,
+			filter,
 			recursive, fsp);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
@@ -1554,7 +1561,7 @@ static void call_nt_transact_rename(connection_struct *conn,
 	/*
 	 * Rename was successful.
 	 */
-	send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
 
 	DEBUG(3,("nt transact rename from = %s, to = %s succeeded.\n",
 		 fsp->fsp_name, new_name));
@@ -1650,14 +1657,14 @@ static void call_nt_transact_query_security_desc(connection_struct *conn,
 		return;
 	}
 
-	sd_size = sec_desc_size(psd);
+	sd_size = ndr_size_security_descriptor(psd, 0);
 
 	DEBUG(3,("call_nt_transact_query_security_desc: sd_size = %lu.\n",(unsigned long)sd_size));
 
 	SIVAL(params,0,(uint32)sd_size);
 
 	if (max_data_count < sd_size) {
-		send_nt_replies(req, NT_STATUS_BUFFER_TOO_SMALL,
+		send_nt_replies(conn, req, NT_STATUS_BUFFER_TOO_SMALL,
 				params, 4, *ppdata, 0);
 		TALLOC_FREE(frame);
 		return;
@@ -1686,7 +1693,7 @@ static void call_nt_transact_query_security_desc(connection_struct *conn,
 	SMB_ASSERT(sd_size == blob.length);
 	memcpy(data, blob.data, sd_size);
 
-	send_nt_replies(req, NT_STATUS_OK, params, 4, data, (int)sd_size);
+	send_nt_replies(conn, req, NT_STATUS_OK, params, 4, data, (int)sd_size);
 
 	TALLOC_FREE(frame);
 	return;
@@ -1744,7 +1751,7 @@ static void call_nt_transact_set_security_desc(connection_struct *conn,
 	}
 
   done:
-	send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+	send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
 	return;
 }
 
@@ -1793,7 +1800,7 @@ static void call_nt_transact_ioctl(connection_struct *conn,
 		   so we can know if we need to pre-allocate or not */
 
 		DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum));
-		send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+		send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
 		return;
 
 	case FSCTL_CREATE_OR_GET_OBJECT_ID:
@@ -1819,7 +1826,7 @@ static void call_nt_transact_ioctl(connection_struct *conn,
 		push_file_id_16(pdata, &fsp->file_id);
 		memcpy(pdata+16,create_volume_objectid(conn,objid),16);
 		push_file_id_16(pdata+32, &fsp->file_id);
-		send_nt_replies(req, NT_STATUS_OK, NULL, 0,
+		send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
 				pdata, data_count);
 		return;
 	}
@@ -1964,7 +1971,7 @@ static void call_nt_transact_ioctl(connection_struct *conn,
 
 		talloc_destroy(shadow_data->mem_ctx);
 
-		send_nt_replies(req, NT_STATUS_OK, NULL, 0,
+		send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
 				pdata, data_count);
 
 		return;
@@ -2020,7 +2027,7 @@ static void call_nt_transact_ioctl(connection_struct *conn,
 		 */
 
 		/* this works for now... */
-		send_nt_replies(req, NT_STATUS_OK, NULL, 0, NULL, 0);
+		send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
 		return;
 	}
 	default:
@@ -2174,7 +2181,8 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
 			for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)<max_data_count));
 				tmp_list=tmp_list->next,entry+=entry_len,qt_len+=entry_len) {
 
-				sid_len = sid_size(&tmp_list->quotas->sid);
+				sid_len = ndr_size_dom_sid(
+					&tmp_list->quotas->sid, 0);
 				entry_len = 40 + sid_len;
 
 				/* nextoffset entry 4 bytes */
@@ -2305,7 +2313,7 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
 			break;
 	}
 
-	send_nt_replies(req, nt_status, params, param_len,
+	send_nt_replies(conn, req, nt_status, params, param_len,
 			pdata, data_len);
 }
 
@@ -2435,7 +2443,7 @@ static void call_nt_transact_set_user_quota(connection_struct *conn,
 		return;
 	}
 
-	send_nt_replies(req, NT_STATUS_OK, params, param_len,
+	send_nt_replies(conn, req, NT_STATUS_OK, params, param_len,
 			pdata, data_len);
 }
 #endif /* HAVE_SYS_QUOTAS */
@@ -2572,8 +2580,9 @@ static void handle_nttrans(connection_struct *conn,
  Reply to a SMBNTtrans.
 ****************************************************************************/
 
-void reply_nttrans(connection_struct *conn, struct smb_request *req)
+void reply_nttrans(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	uint32 pscnt;
 	uint32 psoff;
 	uint32 dscnt;
@@ -2763,8 +2772,9 @@ void reply_nttrans(connection_struct *conn, struct smb_request *req)
  Reply to a SMBnttranss
  ****************************************************************************/
 
-void reply_nttranss(connection_struct *conn, struct smb_request *req)
+void reply_nttranss(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
 	struct trans_state *state;
 
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 9428b47b6a..f178102fdd 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -1405,7 +1405,7 @@ NTSTATUS open_file_ntcreate(connection_struct *conn,
 	}
 #endif /* O_SYNC */
   
-	if (posix_open & (access_mask & FILE_APPEND_DATA)) {
+	if (posix_open && (access_mask & FILE_APPEND_DATA)) {
 		flags2 |= O_APPEND;
 	}
 
@@ -1864,10 +1864,15 @@ NTSTATUS open_file_ntcreate(connection_struct *conn,
 		if (lp_map_archive(SNUM(conn)) ||
 		    lp_store_dos_attributes(SNUM(conn))) {
 			if (!posix_open) {
-				file_set_dosmode(conn, fname,
-					 new_dos_attributes | aARCH, NULL,
-					 parent_dir,
-					 true);
+				SMB_STRUCT_STAT tmp_sbuf;
+				SET_STAT_INVALID(tmp_sbuf);
+				if (file_set_dosmode(
+					    conn, fname,
+					    new_dos_attributes | aARCH,
+					    &tmp_sbuf, parent_dir,
+					    true) == 0) {
+					unx_mode = tmp_sbuf.st_mode;
+				}
 			}
 		}
 	}
@@ -2262,7 +2267,7 @@ NTSTATUS open_directory(connection_struct *conn,
 	return NT_STATUS_OK;
 }
 
-NTSTATUS create_directory(connection_struct *conn, const char *directory)
+NTSTATUS create_directory(connection_struct *conn, struct smb_request *req, const char *directory)
 {
 	NTSTATUS status;
 	SMB_STRUCT_STAT sbuf;
@@ -2270,7 +2275,7 @@ NTSTATUS create_directory(connection_struct *conn, const char *directory)
 
 	SET_STAT_INVALID(sbuf);
 	
-	status = open_directory(conn, NULL, directory, &sbuf,
+	status = open_directory(conn, req, directory, &sbuf,
 				FILE_READ_ATTRIBUTES, /* Just a stat open */
 				FILE_SHARE_NONE, /* Ignored for stat opens */
 				FILE_CREATE,
@@ -2601,16 +2606,16 @@ NTSTATUS create_file_unixpath(connection_struct *conn,
 		uint32_t sec_info_sent = ALL_SECURITY_INFORMATION;
 		uint32_t saved_access_mask = fsp->access_mask;
 
-		if (sd->owner_sid==0) {
+		if (sd->owner_sid == NULL) {
 			sec_info_sent &= ~OWNER_SECURITY_INFORMATION;
 		}
-		if (sd->group_sid==0) {
+		if (sd->group_sid == NULL) {
 			sec_info_sent &= ~GROUP_SECURITY_INFORMATION;
 		}
-		if (sd->sacl==0) {
+		if (sd->sacl == NULL) {
 			sec_info_sent &= ~SACL_SECURITY_INFORMATION;
 		}
-		if (sd->dacl==0) {
+		if (sd->dacl == NULL) {
 			sec_info_sent &= ~DACL_SECURITY_INFORMATION;
 		}
 
@@ -2667,7 +2672,12 @@ NTSTATUS create_file_unixpath(connection_struct *conn,
 		*pinfo = info;
 	}
 	if (psbuf != NULL) {
-		*psbuf = sbuf;
+		if ((fsp->fh == NULL) || (fsp->fh->fd == -1)) {
+			*psbuf = sbuf;
+		}
+		else {
+			SMB_VFS_FSTAT(fsp, fsp->fh->fd, psbuf);
+		}
 	}
 	return NT_STATUS_OK;
 
diff --git a/source3/smbd/oplock.c b/source3/smbd/oplock.c
index 961abd277b..277e07c178 100644
--- a/source3/smbd/oplock.c
+++ b/source3/smbd/oplock.c
@@ -252,7 +252,7 @@ static char *new_break_smb_message(TALLOC_CTX *mem_ctx,
 	}
 
 	memset(result,'\0',smb_size);
-	set_message(result,8,0,True);
+	srv_set_message(result,8,0,true);
 	SCVAL(result,smb_com,SMBlockingX);
 	SSVAL(result,smb_tid,fsp->conn->cnum);
 	SSVAL(result,smb_pid,0xFFFF);
@@ -449,8 +449,10 @@ static void process_oplock_async_level2_break_message(struct messaging_context *
 	sign_state = srv_oplock_set_signing(False);
 
 	show_msg(break_msg);
-	if (!send_smb(smbd_server_fd(), break_msg)) {
-		exit_server_cleanly("oplock_break: send_smb failed.");
+	if (!srv_send_smb(smbd_server_fd(),
+			break_msg,
+			IS_CONN_ENCRYPTED(fsp->conn))) {
+		exit_server_cleanly("oplock_break: srv_send_smb failed.");
 	}
 
 	/* Restore the sign state to what it was. */
@@ -554,8 +556,10 @@ static void process_oplock_break_message(struct messaging_context *msg_ctx,
 	sign_state = srv_oplock_set_signing(False);
 
 	show_msg(break_msg);
-	if (!send_smb(smbd_server_fd(), break_msg)) {
-		exit_server_cleanly("oplock_break: send_smb failed.");
+	if (!srv_send_smb(smbd_server_fd(),
+			break_msg,
+			IS_CONN_ENCRYPTED(fsp->conn))) {
+		exit_server_cleanly("oplock_break: srv_send_smb failed.");
 	}
 
 	/* Restore the sign state to what it was. */
@@ -631,8 +635,10 @@ static void process_kernel_oplock_break(struct messaging_context *msg_ctx,
 	sign_state = srv_oplock_set_signing(False);
 
 	show_msg(break_msg);
-	if (!send_smb(smbd_server_fd(), break_msg)) {
-		exit_server_cleanly("oplock_break: send_smb failed.");
+	if (!srv_send_smb(smbd_server_fd(),
+			break_msg,
+			IS_CONN_ENCRYPTED(fsp->conn))) {
+		exit_server_cleanly("oplock_break: srv_send_smb failed.");
 	}
 
 	/* Restore the sign state to what it was. */
diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c
index 0ddc00c767..6b4b83d97d 100644
--- a/source3/smbd/pipes.c
+++ b/source3/smbd/pipes.c
@@ -291,7 +291,7 @@ void reply_pipe_read_and_X(struct smb_request *req)
 		return;
 	}
 
-	set_message((char *)req->outbuf, 12, nread, False);
+	srv_set_message((char *)req->outbuf, 12, nread, False);
   
 	SSVAL(req->outbuf,smb_vwv5,nread);
 	SSVAL(req->outbuf,smb_vwv6,smb_offset(data,req->outbuf));
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index ee76f90bf5..fe32d57ff7 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -50,6 +50,73 @@ enum smb_read_errors *get_srv_read_error(void)
 	return &smb_read_error;
 }
 
+/****************************************************************************
+ Send an smb to a fd.
+****************************************************************************/
+
+bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
+{
+	size_t len;
+	size_t nwritten=0;
+	ssize_t ret;
+	char *buf_out = buffer;
+
+	/* Sign the outgoing packet if required. */
+	srv_calculate_sign_mac(buf_out);
+
+	if (do_encrypt) {
+		NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(0, ("send_smb: SMB encryption failed "
+				"on outgoing packet! Error %s\n",
+				nt_errstr(status) ));
+			return false;
+		}
+	}
+
+	len = smb_len(buf_out) + 4;
+
+	while (nwritten < len) {
+		ret = write_data(fd,buf_out+nwritten,len - nwritten);
+		if (ret <= 0) {
+			DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
+				(int)len,(int)ret, strerror(errno) ));
+			srv_free_enc_buffer(buf_out);
+			return false;
+		}
+		nwritten += ret;
+	}
+
+	srv_free_enc_buffer(buf_out);
+	return true;
+}
+
+/*******************************************************************
+ Setup the word count and byte count for a smb message.
+********************************************************************/
+
+int srv_set_message(char *buf,
+                        int num_words,
+                        int num_bytes,
+                        bool zero)
+{
+	if (zero && (num_words || num_bytes)) {
+		memset(buf + smb_size,'\0',num_words*2 + num_bytes);
+	}
+	SCVAL(buf,smb_wct,num_words);
+	SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
+	smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
+	return (smb_size + num_words*2 + num_bytes);
+}
+
+static bool valid_smb_header(const uint8_t *inbuf)
+{
+	if (is_encrypted_packet(inbuf)) {
+		return true;
+	}
+	return (strncmp(smb_base(inbuf),"\377SMB",4) == 0);
+}
+
 /* Socket functions for smbd packet processing. */
 
 static bool valid_packet_size(size_t len)
@@ -125,7 +192,7 @@ static ssize_t read_packet_remainder(int fd,
 				(2*14) + /* word count (including bcc) */ \
 				1 /* pad byte */)
 
-ssize_t receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
+static ssize_t receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 					const char lenbuf[4],
 					int fd,
 					char **buffer,
@@ -165,7 +232,7 @@ ssize_t receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 	 * valid writeX call.
 	 */
 
-	if (is_valid_writeX_buffer(writeX_header)) {
+	if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 		/*
 		 * If the data offset is beyond what
 		 * we've read, drain the extra bytes.
@@ -273,7 +340,7 @@ static ssize_t receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 		return -1;
 	}
 
-	if (CVAL(lenbuf,0) != SMBkeepalive &&
+	if (CVAL(lenbuf,0) == 0 &&
 			min_recv_size &&
 			smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
 			!srv_is_signing_active()) {
@@ -313,17 +380,36 @@ static ssize_t receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 	return len + 4;
 }
 
-ssize_t receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd, char **buffer,
-			   unsigned int timeout, size_t *p_unread)
+static ssize_t receive_smb_talloc(TALLOC_CTX *mem_ctx,
+				int fd,
+				char **buffer,
+				unsigned int timeout,
+				size_t *p_unread,
+				bool *p_encrypted)
 {
 	ssize_t len;
 
+	*p_encrypted = false;
+
 	len = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout, p_unread);
 
 	if (len < 0) {
 		return -1;
 	}
 
+	if (is_encrypted_packet((uint8_t *)*buffer)) {
+		NTSTATUS status = srv_decrypt_buffer(*buffer);
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
+				"incoming packet! Error %s\n",
+				nt_errstr(status) ));
+			cond_set_smb_read_error(get_srv_read_error(),
+					SMB_READ_BAD_DECRYPT);
+			return -1;
+		}
+		*p_encrypted = true;
+	}
+
 	/* Check the incoming SMB signature. */
 	if (!srv_check_sign_mac(*buffer, true)) {
 		DEBUG(0, ("receive_smb: SMB Signature verification failed on "
@@ -341,7 +427,8 @@ ssize_t receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd, char **buffer,
 
 void init_smb_request(struct smb_request *req,
 			const uint8 *inbuf,
-			size_t unread_bytes)
+			size_t unread_bytes,
+			bool encrypted)
 {
 	size_t req_size = smb_len(inbuf) + 4;
 	/* Ensure we have at least smb_size bytes. */
@@ -357,6 +444,8 @@ void init_smb_request(struct smb_request *req,
 	req->tid    = SVAL(inbuf, smb_tid);
 	req->wct    = CVAL(inbuf, smb_wct);
 	req->unread_bytes = unread_bytes;
+	req->encrypted = encrypted;
+	req->conn = conn_find(req->tid);
 
 	/* Ensure we have at least wct words and 2 bytes of bcc. */
 	if (smb_size + req->wct*2 > req_size) {
@@ -414,6 +503,7 @@ static bool push_queued_message(struct smb_request *req,
 
 	msg->request_time = request_time;
 	msg->end_time = end_time;
+	msg->encrypted = req->encrypted;
 
 	if (private_data) {
 		msg->private_data = data_blob_talloc(msg, private_data,
@@ -689,7 +779,8 @@ static bool receive_message_or_smb(TALLOC_CTX *mem_ctx,
 				char **buffer,
 				size_t *buffer_len,
 				int timeout,
-				size_t *p_unread)
+				size_t *p_unread,
+				bool *p_encrypted)
 {
 	fd_set r_fds, w_fds;
 	int selrtn;
@@ -756,6 +847,7 @@ static bool receive_message_or_smb(TALLOC_CTX *mem_ctx,
 				return False;
 			}
 			*buffer_len = msg->buf.length;
+			*p_encrypted = msg->encrypted;
 
 			/* We leave this message on the queue so the open code can
 			   know this is a retry. */
@@ -872,7 +964,8 @@ static bool receive_message_or_smb(TALLOC_CTX *mem_ctx,
 		goto again;
 	}
 
-	len = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0, p_unread);
+	len = receive_smb_talloc(mem_ctx, smbd_server_fd(),
+				buffer, 0, p_unread, p_encrypted);
 
 	if (len == -1) {
 		return False;
@@ -952,7 +1045,7 @@ force write permissions on print services.
 */
 static const struct smb_message_struct {
 	const char *name;
-	void (*fn_new)(connection_struct *conn, struct smb_request *req);
+	void (*fn_new)(struct smb_request *req);
 	int flags;
 } smb_messages[256] = {
 
@@ -1239,7 +1332,7 @@ void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
 	}
 
 	construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
-	set_message((char *)req->outbuf, num_words, num_bytes, False);
+	srv_set_message((char *)req->outbuf, num_words, num_bytes, false);
 	/*
 	 * Zero out the word area, the caller has to take care of the bcc area
 	 * himself
@@ -1297,11 +1390,11 @@ static void smb_dump(const char *name, int type, const char *data, ssize_t len)
  find.
 ****************************************************************************/
 
-static void switch_message(uint8 type, struct smb_request *req, int size)
+static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
 {
 	int flags;
 	uint16 session_tag;
-	connection_struct *conn;
+	connection_struct *conn = NULL;
 
 	static uint16 last_session_tag = UID_FIELD_INVALID;
 
@@ -1309,7 +1402,7 @@ static void switch_message(uint8 type, struct smb_request *req, int size)
 
 	/* Make sure this is an SMB packet. smb_size contains NetBIOS header
 	 * so subtract 4 from it. */
-	if ((strncmp(smb_base(req->inbuf),"\377SMB",4) != 0)
+	if (!valid_smb_header(req->inbuf)
 	    || (size < (smb_size - 4))) {
 		DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
 			 smb_len(req->inbuf)));
@@ -1320,7 +1413,7 @@ static void switch_message(uint8 type, struct smb_request *req, int size)
 		DEBUG(0,("Unknown message type %d!\n",type));
 		smb_dump("Unknown", 1, (char *)req->inbuf, size);
 		reply_unknown_new(req, type);
-		return;
+		return NULL;
 	}
 
 	flags = smb_messages[type].flags;
@@ -1328,7 +1421,7 @@ static void switch_message(uint8 type, struct smb_request *req, int size)
 	/* In share mode security we must ignore the vuid. */
 	session_tag = (lp_security() == SEC_SHARE)
 		? UID_FIELD_INVALID : req->vuid;
-	conn = conn_find(req->tid);
+	conn = req->conn;
 
 	DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
 		 (int)sys_getpid(), (unsigned long)conn));
@@ -1373,12 +1466,12 @@ static void switch_message(uint8 type, struct smb_request *req, int size)
 			} else {
 				reply_doserror(req, ERRSRV, ERRinvnid);
 			}
-			return;
+			return NULL;
 		}
 
 		if (!change_to_user(conn,session_tag)) {
 			reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
-			return;
+			return conn;
 		}
 
 		/* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
@@ -1386,13 +1479,13 @@ static void switch_message(uint8 type, struct smb_request *req, int size)
 		/* Does it need write permission? */
 		if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
 			reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
-			return;
+			return conn;
 		}
 
 		/* IPC services are limited */
 		if (IS_IPC(conn) && !(flags & CAN_IPC)) {
 			reply_doserror(req, ERRSRV,ERRaccess);
-			return;
+			return conn;
 		}
 	} else {
 		/* This call needs to be run as root */
@@ -1401,11 +1494,24 @@ static void switch_message(uint8 type, struct smb_request *req, int size)
 
 	/* load service specific parameters */
 	if (conn) {
+		if (req->encrypted) {
+			conn->encrypted_tid = true;
+			/* encrypted required from now on. */
+			conn->encrypt_level = Required;
+		} else if (ENCRYPTION_REQUIRED(conn)) {
+			uint8 com = CVAL(req->inbuf,smb_com);
+			if (com != SMBtrans2 && com != SMBtranss2) {
+				exit_server_cleanly("encryption required "
+					"on connection");
+				return conn;
+			}
+		}
+
 		if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
 					 (flags & (AS_USER|DO_CHDIR)
 					  ?True:False))) {
 			reply_doserror(req, ERRSRV, ERRaccess);
-			return;
+			return conn;
 		}
 		conn->num_smb_operations++;
 	}
@@ -1416,19 +1522,21 @@ static void switch_message(uint8 type, struct smb_request *req, int size)
 		!check_access(smbd_server_fd(), lp_hostsallow(-1),
 			      lp_hostsdeny(-1)))) {
 		reply_doserror(req, ERRSRV, ERRaccess);
-		return;
+		return conn;
 	}
 
-	smb_messages[type].fn_new(conn, req);
+	smb_messages[type].fn_new(req);
+	return req->conn;
 }
 
 /****************************************************************************
  Construct a reply to the incoming packet.
 ****************************************************************************/
 
-static void construct_reply(char *inbuf, int size, size_t unread_bytes)
+static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
 {
 	uint8 type = CVAL(inbuf,smb_com);
+	connection_struct *conn;
 	struct smb_request *req;
 
 	chain_size = 0;
@@ -1438,9 +1546,9 @@ static void construct_reply(char *inbuf, int size, size_t unread_bytes)
 	if (!(req = talloc(talloc_tos(), struct smb_request))) {
 		smb_panic("could not allocate smb_request");
 	}
-	init_smb_request(req, (uint8 *)inbuf, unread_bytes);
+	init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
 
-	switch_message(type, req, size);
+	conn = switch_message(type, req, size);
 
 	if (req->unread_bytes) {
 		/* writeX failed. drain socket. */
@@ -1459,8 +1567,10 @@ static void construct_reply(char *inbuf, int size, size_t unread_bytes)
 		show_msg((char *)req->outbuf);
 	}
 
-	if (!send_smb(smbd_server_fd(), (char *)req->outbuf)) {
-		exit_server_cleanly("construct_reply: send_smb failed.");
+	if (!srv_send_smb(smbd_server_fd(),
+			(char *)req->outbuf,
+			IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
+		exit_server_cleanly("construct_reply: srv_send_smb failed.");
 	}
 
 	TALLOC_FREE(req);
@@ -1472,7 +1582,7 @@ static void construct_reply(char *inbuf, int size, size_t unread_bytes)
  Process an smb from the client
 ****************************************************************************/
 
-static void process_smb(char *inbuf, size_t nread, size_t unread_bytes)
+static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
 {
 	static int trans_num;
 	int msg_type = CVAL(inbuf,0);
@@ -1493,7 +1603,7 @@ static void process_smb(char *inbuf, size_t nread, size_t unread_bytes)
 			static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
 			DEBUG( 1, ( "Connection denied from %s\n",
 				client_addr(get_client_fd(),addr,sizeof(addr)) ) );
-			(void)send_smb(smbd_server_fd(),(char *)buf);
+			(void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
 			exit_server_cleanly("connection denied");
 		}
 	}
@@ -1514,7 +1624,7 @@ static void process_smb(char *inbuf, size_t nread, size_t unread_bytes)
 
 	show_msg(inbuf);
 
-	construct_reply(inbuf,nread,unread_bytes);
+	construct_reply(inbuf,nread,unread_bytes,encrypted);
 
 	trans_num++;
 }
@@ -1551,7 +1661,7 @@ void remove_from_common_flags2(uint32 v)
 
 void construct_reply_common(const char *inbuf, char *outbuf)
 {
-	set_message(outbuf,0,0,False);
+	srv_set_message(outbuf,0,0,false);
 	
 	SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
 	SIVAL(outbuf,smb_rcls,0);
@@ -1674,7 +1784,7 @@ void chain_reply(struct smb_request *req)
 	if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
 		smb_panic("could not allocate smb_request");
 	}
-	init_smb_request(req2, (uint8 *)inbuf2,0);
+	init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
 
 	/* process the request */
 	switch_message(smb_com2, req2, new_size);
@@ -1960,6 +2070,7 @@ void smbd_process(void)
 		int num_echos;
 		char *inbuf;
 		size_t inbuf_len;
+		bool encrypted = false;
 		TALLOC_CTX *frame = talloc_stackframe();
 
 		errno = 0;
@@ -1975,7 +2086,9 @@ void smbd_process(void)
 		run_events(smbd_event_context(), 0, NULL, NULL);
 
 		while (!receive_message_or_smb(NULL, &inbuf, &inbuf_len,
-					       select_timeout, &unread_bytes)) {
+						select_timeout,
+						&unread_bytes,
+						&encrypted)) {
 			if(!timeout_processing(&select_timeout,
 					       &last_timeout_processing_time))
 				return;
@@ -1994,7 +2107,7 @@ void smbd_process(void)
 		 */
 		num_echos = smb_echo_count;
 
-		process_smb(inbuf, inbuf_len, unread_bytes);
+		process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
 
 		TALLOC_FREE(inbuf);
 
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 575ca13ff6..d5e683ca3c 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -391,7 +391,7 @@ void reply_special(char *inbuf)
 
 	/*
 	 * We only really use 4 bytes of the outbuf, but for the smb_setlen
-	 * calculation & friends (send_smb uses that) we need the full smb
+	 * calculation & friends (srv_send_smb uses that) we need the full smb
 	 * header.
 	 */
 	char outbuf[smb_size];
@@ -470,7 +470,7 @@ void reply_special(char *inbuf)
 	DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 		    msg_type, msg_flags));
 
-	send_smb(smbd_server_fd(), outbuf);
+	srv_send_smb(smbd_server_fd(), outbuf, false);
 	return;
 }
 
@@ -479,8 +479,9 @@ void reply_special(char *inbuf)
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_tcon(connection_struct *conn, struct smb_request *req)
+void reply_tcon(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	const char *service;
 	char *service_buf = NULL;
 	char *password = NULL;
@@ -523,6 +524,7 @@ void reply_tcon(connection_struct *conn, struct smb_request *req)
 	password_blob = data_blob(password, pwlen+1);
 
 	conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
+	req->conn = conn;
 
 	data_blob_clear_free(&password_blob);
 
@@ -549,8 +551,9 @@ void reply_tcon(connection_struct *conn, struct smb_request *req)
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_tcon_and_X(connection_struct *conn, struct smb_request *req)
+void reply_tcon_and_X(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *service = NULL;
 	DATA_BLOB password;
 	TALLOC_CTX *ctx = talloc_tos();
@@ -578,6 +581,8 @@ void reply_tcon_and_X(connection_struct *conn, struct smb_request *req)
 	/* we might have to close an old one */
 	if ((tcon_flags & 0x1) && conn) {
 		close_cnum(conn,req->vuid);
+		req->conn = NULL;
+		conn = NULL;
 	}
 
 	if ((passlen > MAX_PASS_LEN) || (passlen >= smb_buflen(req->inbuf))) {
@@ -646,6 +651,7 @@ void reply_tcon_and_X(connection_struct *conn, struct smb_request *req)
 
 	conn = make_connection(service, password, client_devicetype,
 			       req->vuid, &nt_status);
+	req->conn =conn;
 
 	data_blob_clear_free(&password);
 
@@ -731,17 +737,6 @@ void reply_tcon_and_X(connection_struct *conn, struct smb_request *req)
  Reply to an unknown type.
 ****************************************************************************/
 
-int reply_unknown(char *inbuf,char *outbuf)
-{
-	int type;
-	type = CVAL(inbuf,smb_com);
-  
-	DEBUG(0,("unknown command type (%s): type=%d (0x%X)\n",
-		 smb_fn_name(type), type, type));
-  
-	return(ERROR_DOS(ERRSRV,ERRunknownsmb));
-}
-
 void reply_unknown_new(struct smb_request *req, uint8 type)
 {
 	DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
@@ -755,8 +750,9 @@ void reply_unknown_new(struct smb_request *req, uint8 type)
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_ioctl(connection_struct *conn, struct smb_request *req)
+void reply_ioctl(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	uint16 device;
 	uint16 function;
 	uint32 ioctl_code;
@@ -844,8 +840,9 @@ static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
  Reply to a checkpath.
 ****************************************************************************/
 
-void reply_checkpath(connection_struct *conn, struct smb_request *req)
+void reply_checkpath(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *name = NULL;
 	SMB_STRUCT_STAT sbuf;
 	NTSTATUS status;
@@ -938,8 +935,9 @@ void reply_checkpath(connection_struct *conn, struct smb_request *req)
  Reply to a getatr.
 ****************************************************************************/
 
-void reply_getatr(connection_struct *conn, struct smb_request *req)
+void reply_getatr(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *fname = NULL;
 	SMB_STRUCT_STAT sbuf;
 	int mode=0;
@@ -1039,8 +1037,9 @@ void reply_getatr(connection_struct *conn, struct smb_request *req)
  Reply to a setatr.
 ****************************************************************************/
 
-void reply_setatr(connection_struct *conn, struct smb_request *req)
+void reply_setatr(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *fname = NULL;
 	int mode;
 	time_t mtime;
@@ -1139,8 +1138,9 @@ void reply_setatr(connection_struct *conn, struct smb_request *req)
  Reply to a dskattr.
 ****************************************************************************/
 
-void reply_dskattr(connection_struct *conn, struct smb_request *req)
+void reply_dskattr(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	SMB_BIG_UINT dfree,dsize,bsize;
 	START_PROFILE(SMBdskattr);
 
@@ -1191,8 +1191,9 @@ void reply_dskattr(connection_struct *conn, struct smb_request *req)
  Can be called from SMBsearch, SMBffirst or SMBfunique.
 ****************************************************************************/
 
-void reply_search(connection_struct *conn, struct smb_request *req)
+void reply_search(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *mask = NULL;
 	char *directory = NULL;
 	char *fname = NULL;
@@ -1493,7 +1494,7 @@ void reply_search(connection_struct *conn, struct smb_request *req)
  Reply to a fclose (stop directory search).
 ****************************************************************************/
 
-void reply_fclose(connection_struct *conn, struct smb_request *req)
+void reply_fclose(struct smb_request *req)
 {
 	int status_len;
 	char status[21];
@@ -1557,8 +1558,9 @@ void reply_fclose(connection_struct *conn, struct smb_request *req)
  Reply to an open.
 ****************************************************************************/
 
-void reply_open(connection_struct *conn, struct smb_request *req)
+void reply_open(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *fname = NULL;
 	uint32 fattr=0;
 	SMB_OFF_T size = 0;
@@ -1597,51 +1599,30 @@ void reply_open(connection_struct *conn, struct smb_request *req)
 		return;
 	}
 
-	status = resolve_dfspath(ctx, conn,
-				req->flags2 & FLAGS2_DFS_PATHNAMES,
-				fname,
-				&fname);
-	if (!NT_STATUS_IS_OK(status)) {
-		if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-			reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
-					ERRSRV, ERRbadpath);
-			END_PROFILE(SMBopen);
-			return;
-		}
-		reply_nterror(req, status);
-		END_PROFILE(SMBopen);
-		return;
-	}
-
-	status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
-	if (!NT_STATUS_IS_OK(status)) {
-		reply_nterror(req, status);
-		END_PROFILE(SMBopen);
-		return;
-	}
-
-	status = check_name(conn, fname);
-	if (!NT_STATUS_IS_OK(status)) {
-		reply_nterror(req, status);
-		END_PROFILE(SMBopen);
-		return;
-	}
-
-	if (!map_open_params_to_ntcreate(fname, deny_mode, OPENX_FILE_EXISTS_OPEN,
-			&access_mask, &share_mode, &create_disposition, &create_options)) {
+	if (!map_open_params_to_ntcreate(
+		    fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
+		    &share_mode, &create_disposition, &create_options)) {
 		reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
 		END_PROFILE(SMBopen);
 		return;
 	}
 
-	status = open_file_ntcreate(conn, req, fname, &sbuf,
-			access_mask,
-			share_mode,
-			create_disposition,
-			create_options,
-			dos_attr,
-			oplock_request,
-			&info, &fsp);
+	status = create_file(conn,			/* conn */
+			     req,			/* req */
+			     0,				/* root_dir_fid */
+			     fname,			/* fname */
+			     access_mask,		/* access_mask */
+			     share_mode,		/* share_access */
+			     create_disposition,	/* create_disposition*/
+			     create_options,		/* create_options */
+			     dos_attr,			/* file_attributes */
+			     oplock_request,		/* oplock_request */
+			     0,				/* allocation_size */
+			     NULL,			/* sd */
+			     NULL,			/* ea_list */
+			     &fsp,			/* result */
+			     &info,			/* pinfo */
+			     &sbuf);			/* psbuf */
 
 	if (!NT_STATUS_IS_OK(status)) {
 		if (open_was_deferred(req->mid)) {
@@ -1694,8 +1675,9 @@ void reply_open(connection_struct *conn, struct smb_request *req)
  Reply to an open and X.
 ****************************************************************************/
 
-void reply_open_and_X(connection_struct *conn, struct smb_request *req)
+void reply_open_and_X(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *fname = NULL;
 	uint16 open_flags;
 	int deny_mode;
@@ -1762,53 +1744,30 @@ void reply_open_and_X(connection_struct *conn, struct smb_request *req)
 		return;
 	}
 
-	status = resolve_dfspath(ctx, conn,
-				req->flags2 & FLAGS2_DFS_PATHNAMES,
-				fname,
-				&fname);
-	if (!NT_STATUS_IS_OK(status)) {
-		END_PROFILE(SMBopenX);
-		if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-			reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
-					ERRSRV, ERRbadpath);
-			return;
-		}
-		reply_nterror(req, status);
-		return;
-	}
-
-	status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
-	if (!NT_STATUS_IS_OK(status)) {
-		reply_nterror(req, status);
-		END_PROFILE(SMBopenX);
-		return;
-	}
-
-	status = check_name(conn, fname);
-	if (!NT_STATUS_IS_OK(status)) {
-		reply_nterror(req, status);
-		END_PROFILE(SMBopenX);
-		return;
-	}
-
-	if (!map_open_params_to_ntcreate(fname, deny_mode, smb_ofun,
-				&access_mask,
-				&share_mode,
-				&create_disposition,
-				&create_options)) {
+	if (!map_open_params_to_ntcreate(
+		    fname, deny_mode, smb_ofun, &access_mask,
+		    &share_mode, &create_disposition, &create_options)) {
 		reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
 		END_PROFILE(SMBopenX);
 		return;
 	}
 
-	status = open_file_ntcreate(conn, req, fname, &sbuf,
-			access_mask,
-			share_mode,
-			create_disposition,
-			create_options,
-			smb_attr,
-			oplock_request,
-			&smb_action, &fsp);
+	status = create_file(conn,			/* conn */
+			     req,			/* req */
+			     0,				/* root_dir_fid */
+			     fname,			/* fname */
+			     access_mask,		/* access_mask */
+			     share_mode,		/* share_access */
+			     create_disposition,	/* create_disposition*/
+			     create_options,		/* create_options */
+			     smb_attr,			/* file_attributes */
+			     oplock_request,		/* oplock_request */
+			     0,				/* allocation_size */
+			     NULL,			/* sd */
+			     NULL,			/* ea_list */
+			     &fsp,			/* result */
+			     &smb_action,		/* pinfo */
+			     &sbuf);			/* psbuf */
 
 	if (!NT_STATUS_IS_OK(status)) {
 		END_PROFILE(SMBopenX);
@@ -1905,10 +1864,9 @@ void reply_open_and_X(connection_struct *conn, struct smb_request *req)
 
 /****************************************************************************
  Reply to a SMBulogoffX.
- conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_ulogoffX(connection_struct *conn, struct smb_request *req)
+void reply_ulogoffX(struct smb_request *req)
 {
 	user_struct *vuser;
 
@@ -1941,8 +1899,9 @@ void reply_ulogoffX(connection_struct *conn, struct smb_request *req)
  Reply to a mknew or a create.
 ****************************************************************************/
 
-void reply_mknew(connection_struct *conn, struct smb_request *req)
+void reply_mknew(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *fname = NULL;
 	int com;
 	uint32 fattr = 0;
@@ -1982,35 +1941,6 @@ void reply_mknew(connection_struct *conn, struct smb_request *req)
 		return;
 	}
 
-	status = resolve_dfspath(ctx, conn,
-			req->flags2 & FLAGS2_DFS_PATHNAMES,
-			fname,
-			&fname);
-	if (!NT_STATUS_IS_OK(status)) {
-		END_PROFILE(SMBcreate);
-		if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-			reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
-					ERRSRV, ERRbadpath);
-			return;
-		}
-		reply_nterror(req, status);
-		return;
-	}
-
-	status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
-	if (!NT_STATUS_IS_OK(status)) {
-		reply_nterror(req, status);
-		END_PROFILE(SMBcreate);
-		return;
-	}
-
-	status = check_name(conn, fname);
-	if (!NT_STATUS_IS_OK(status)) {
-		reply_nterror(req, status);
-		END_PROFILE(SMBcreate);
-		return;
-	}
-
 	if (fattr & aVOLID) {
 		DEBUG(0,("Attempt to create file (%s) with volid set - "
 			"please report this\n", fname));
@@ -2024,15 +1954,22 @@ void reply_mknew(connection_struct *conn, struct smb_request *req)
 		create_disposition = FILE_OVERWRITE_IF;
 	}
 
-	/* Open file using ntcreate. */
-	status = open_file_ntcreate(conn, req, fname, &sbuf,
-				access_mask,
-				share_mode,
-				create_disposition,
-				create_options,
-				fattr,
-				oplock_request,
-				NULL, &fsp);
+	status = create_file(conn,			/* conn */
+			     req,			/* req */
+			     0,				/* root_dir_fid */
+			     fname,			/* fname */
+			     access_mask,		/* access_mask */
+			     share_mode,		/* share_access */
+			     create_disposition,	/* create_disposition*/
+			     create_options,		/* create_options */
+			     fattr,			/* file_attributes */
+			     oplock_request,		/* oplock_request */
+			     0,				/* allocation_size */
+			     NULL,			/* sd */
+			     NULL,			/* ea_list */
+			     &fsp,			/* result */
+			     NULL,			/* pinfo */
+			     &sbuf);			/* psbuf */
 
 	if (!NT_STATUS_IS_OK(status)) {
 		END_PROFILE(SMBcreate);
@@ -2072,8 +2009,9 @@ void reply_mknew(connection_struct *conn, struct smb_request *req)
  Reply to a create temporary file.
 ****************************************************************************/
 
-void reply_ctemp(connection_struct *conn, struct smb_request *req)
+void reply_ctemp(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *fname = NULL;
 	uint32 fattr;
 	files_struct *fsp;
@@ -2538,8 +2476,9 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
  Reply to a unlink
 ****************************************************************************/
 
-void reply_unlink(connection_struct *conn, struct smb_request *req)
+void reply_unlink(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *name = NULL;
 	uint32 dirtype;
 	NTSTATUS status;
@@ -2780,8 +2719,9 @@ normal_readbraw:
  Reply to a readbraw (core+ protocol).
 ****************************************************************************/
 
-void reply_readbraw(connection_struct *conn, struct smb_request *req)
+void reply_readbraw(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	ssize_t maxcount,mincount;
 	size_t nread = 0;
 	SMB_OFF_T startpos;
@@ -2791,8 +2731,8 @@ void reply_readbraw(connection_struct *conn, struct smb_request *req)
 
 	START_PROFILE(SMBreadbraw);
 
-	if (srv_is_signing_active()) {
-		exit_server_cleanly("reply_readbraw: SMB signing is active - "
+	if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
+		exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
 			"raw reads/writes are disallowed.");
 	}
 
@@ -2930,8 +2870,9 @@ void reply_readbraw(connection_struct *conn, struct smb_request *req)
  Reply to a lockread (core+ protocol).
 ****************************************************************************/
 
-void reply_lockread(connection_struct *conn, struct smb_request *req)
+void reply_lockread(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	ssize_t nread = -1;
 	char *data;
 	SMB_OFF_T startpos;
@@ -3017,7 +2958,7 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 		return;
 	}
 	
-	set_message((char *)req->outbuf, 5, nread+3, False);
+	srv_set_message((char *)req->outbuf, 5, nread+3, False);
 
 	SSVAL(req->outbuf,smb_vwv0,nread);
 	SSVAL(req->outbuf,smb_vwv5,nread+3);
@@ -3039,8 +2980,9 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
  Reply to a read.
 ****************************************************************************/
 
-void reply_read(connection_struct *conn, struct smb_request *req)
+void reply_read(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	size_t numtoread;
 	ssize_t nread = 0;
 	char *data;
@@ -3104,7 +3046,7 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 		return;
 	}
 
-	set_message((char *)req->outbuf, 5, nread+3, False);
+	srv_set_message((char *)req->outbuf, 5, nread+3, False);
 
 	SSVAL(req->outbuf,smb_vwv0,nread);
 	SSVAL(req->outbuf,smb_vwv5,nread+3);
@@ -3127,7 +3069,7 @@ static int setup_readX_header(char *outbuf, size_t smb_maxcnt)
 	int outsize;
 	char *data;
 
-	outsize = set_message(outbuf,12,smb_maxcnt,False);
+	outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
 	data = smb_buf(outbuf);
 
 	memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
@@ -3177,6 +3119,7 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
 	 */
 
 	if ((chain_size == 0) && (CVAL(req->inbuf,smb_vwv0) == 0xFF) &&
+	    !is_encrypted_packet(req->inbuf) &&
 	    lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
 		uint8 headerbuf[smb_size + 12 * 2];
 		DATA_BLOB header;
@@ -3283,8 +3226,9 @@ normal_read:
  Reply to a read and X.
 ****************************************************************************/
 
-void reply_read_and_X(connection_struct *conn, struct smb_request *req)
+void reply_read_and_X(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	files_struct *fsp;
 	SMB_OFF_T startpos;
 	size_t smb_maxcnt;
@@ -3332,8 +3276,8 @@ void reply_read_and_X(connection_struct *conn, struct smb_request *req)
 				END_PROFILE(SMBreadX);
 				return;
 			}
-			/* We currently don't do this on signed data. */
-			if (srv_is_signing_active()) {
+			/* We currently don't do this on signed or sealed data. */
+			if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
 				reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
 				END_PROFILE(SMBreadX);
 				return;
@@ -3412,8 +3356,9 @@ void error_to_writebrawerr(struct smb_request *req)
  Reply to a writebraw (core+ or LANMAN1.0 protocol).
 ****************************************************************************/
 
-void reply_writebraw(connection_struct *conn, struct smb_request *req)
+void reply_writebraw(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	int outsize = 0;
 	char *buf = NULL;
 	ssize_t nwritten=0;
@@ -3524,13 +3469,15 @@ void reply_writebraw(connection_struct *conn, struct smb_request *req)
 	 * it to send more bytes */
 
 	memcpy(buf, req->inbuf, smb_size);
-	outsize = set_message(buf,
+	outsize = srv_set_message(buf,
 			Protocol>PROTOCOL_COREPLUS?1:0,0,True);
 	SCVAL(buf,smb_com,SMBwritebraw);
 	SSVALS(buf,smb_vwv0,0xFFFF);
 	show_msg(buf);
-	if (!send_smb(smbd_server_fd(),buf)) {
-		exit_server_cleanly("reply_writebraw: send_smb "
+	if (!srv_send_smb(smbd_server_fd(),
+			buf,
+			IS_CONN_ENCRYPTED(conn))) {
+		exit_server_cleanly("reply_writebraw: srv_send_smb "
 			"failed.");
 	}
 
@@ -3639,8 +3586,9 @@ void reply_writebraw(connection_struct *conn, struct smb_request *req)
  Reply to a writeunlock (core+).
 ****************************************************************************/
 
-void reply_writeunlock(connection_struct *conn, struct smb_request *req)
+void reply_writeunlock(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	ssize_t nwritten = -1;
 	size_t numtowrite;
 	SMB_OFF_T startpos;
@@ -3738,8 +3686,9 @@ void reply_writeunlock(connection_struct *conn, struct smb_request *req)
  Reply to a write.
 ****************************************************************************/
 
-void reply_write(connection_struct *conn, struct smb_request *req)
+void reply_write(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	size_t numtowrite;
 	ssize_t nwritten = -1;
 	SMB_OFF_T startpos;
@@ -3849,13 +3798,19 @@ void reply_write(connection_struct *conn, struct smb_request *req)
 						(2*14) + /* word count (including bcc) */ \
 						1 /* pad byte */)
 
-bool is_valid_writeX_buffer(const char *inbuf)
+bool is_valid_writeX_buffer(const uint8_t *inbuf)
 {
 	size_t numtowrite;
 	connection_struct *conn = NULL;
 	unsigned int doff = 0;
 	size_t len = smb_len_large(inbuf);
 
+	if (is_encrypted_packet(inbuf)) {
+		/* Can't do this on encrypted
+		 * connections. */
+		return false;
+	}
+
 	if (CVAL(inbuf,smb_com) != SMBwriteX) {
 		return false;
 	}
@@ -3920,8 +3875,9 @@ bool is_valid_writeX_buffer(const char *inbuf)
  Reply to a write and X.
 ****************************************************************************/
 
-void reply_write_and_X(connection_struct *conn, struct smb_request *req)
+void reply_write_and_X(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	files_struct *fsp;
 	SMB_OFF_T startpos;
 	size_t numtowrite;
@@ -4088,8 +4044,9 @@ void reply_write_and_X(connection_struct *conn, struct smb_request *req)
  Reply to a lseek.
 ****************************************************************************/
 
-void reply_lseek(connection_struct *conn, struct smb_request *req)
+void reply_lseek(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	SMB_OFF_T startpos;
 	SMB_OFF_T res= -1;
 	int mode,umode;
@@ -4175,8 +4132,9 @@ void reply_lseek(connection_struct *conn, struct smb_request *req)
  Reply to a flush.
 ****************************************************************************/
 
-void reply_flush(connection_struct *conn, struct smb_request *req)
+void reply_flush(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	uint16 fnum;
 	files_struct *fsp;
 
@@ -4219,7 +4177,7 @@ void reply_flush(connection_struct *conn, struct smb_request *req)
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_exit(connection_struct *conn, struct smb_request *req)
+void reply_exit(struct smb_request *req)
 {
 	START_PROFILE(SMBexit);
 
@@ -4237,8 +4195,9 @@ void reply_exit(connection_struct *conn, struct smb_request *req)
  Reply to a close - has to deal with closing a directory opened by NT SMB's.
 ****************************************************************************/
 
-void reply_close(connection_struct *conn, struct smb_request *req)
+void reply_close(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	NTSTATUS status = NT_STATUS_OK;
 	files_struct *fsp = NULL;
 	START_PROFILE(SMBclose);
@@ -4315,8 +4274,9 @@ void reply_close(connection_struct *conn, struct smb_request *req)
  Reply to a writeclose (Core+ protocol).
 ****************************************************************************/
 
-void reply_writeclose(connection_struct *conn, struct smb_request *req)
+void reply_writeclose(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	size_t numtowrite;
 	ssize_t nwritten = -1;
 	NTSTATUS close_status = NT_STATUS_OK;
@@ -4404,8 +4364,9 @@ void reply_writeclose(connection_struct *conn, struct smb_request *req)
  Reply to a lock.
 ****************************************************************************/
 
-void reply_lock(connection_struct *conn, struct smb_request *req)
+void reply_lock(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	SMB_BIG_UINT count,offset;
 	NTSTATUS status;
 	files_struct *fsp;
@@ -4463,8 +4424,9 @@ void reply_lock(connection_struct *conn, struct smb_request *req)
  Reply to a unlock.
 ****************************************************************************/
 
-void reply_unlock(connection_struct *conn, struct smb_request *req)
+void reply_unlock(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	SMB_BIG_UINT count,offset;
 	NTSTATUS status;
 	files_struct *fsp;
@@ -4517,8 +4479,9 @@ void reply_unlock(connection_struct *conn, struct smb_request *req)
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_tdis(connection_struct *conn, struct smb_request *req)
+void reply_tdis(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	START_PROFILE(SMBtdis);
 
 	if (!conn) {
@@ -4531,6 +4494,7 @@ void reply_tdis(connection_struct *conn, struct smb_request *req)
 	conn->used = False;
 
 	close_cnum(conn,req->vuid);
+	req->conn = NULL;
 
 	reply_outbuf(req, 0, 0);
 	END_PROFILE(SMBtdis);
@@ -4542,8 +4506,9 @@ void reply_tdis(connection_struct *conn, struct smb_request *req)
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-void reply_echo(connection_struct *conn, struct smb_request *req)
+void reply_echo(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	int smb_reverb;
 	int seq_num;
 	unsigned int data_len = smb_buflen(req->inbuf);
@@ -4581,8 +4546,10 @@ void reply_echo(connection_struct *conn, struct smb_request *req)
 		SSVAL(req->outbuf,smb_vwv0,seq_num);
 
 		show_msg((char *)req->outbuf);
-		if (!send_smb(smbd_server_fd(),(char *)req->outbuf))
-			exit_server_cleanly("reply_echo: send_smb failed.");
+		if (!srv_send_smb(smbd_server_fd(),
+				(char *)req->outbuf,
+				IS_CONN_ENCRYPTED(conn)||req->encrypted))
+			exit_server_cleanly("reply_echo: srv_send_smb failed.");
 	}
 
 	DEBUG(3,("echo %d times\n", smb_reverb));
@@ -4599,8 +4566,9 @@ void reply_echo(connection_struct *conn, struct smb_request *req)
  Reply to a printopen.
 ****************************************************************************/
 
-void reply_printopen(connection_struct *conn, struct smb_request *req)
+void reply_printopen(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	files_struct *fsp;
 	NTSTATUS status;
 	
@@ -4641,8 +4609,9 @@ void reply_printopen(connection_struct *conn, struct smb_request *req)
  Reply to a printclose.
 ****************************************************************************/
 
-void reply_printclose(connection_struct *conn, struct smb_request *req)
+void reply_printclose(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	files_struct *fsp;
 	NTSTATUS status;
 
@@ -4686,8 +4655,9 @@ void reply_printclose(connection_struct *conn, struct smb_request *req)
  Reply to a printqueue.
 ****************************************************************************/
 
-void reply_printqueue(connection_struct *conn, struct smb_request *req)
+void reply_printqueue(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	int max_count;
 	int start_index;
 
@@ -4778,8 +4748,9 @@ void reply_printqueue(connection_struct *conn, struct smb_request *req)
  Reply to a printwrite.
 ****************************************************************************/
 
-void reply_printwrite(connection_struct *conn, struct smb_request *req)
+void reply_printwrite(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	int numtowrite;
 	char *data;
 	files_struct *fsp;
@@ -4837,8 +4808,9 @@ void reply_printwrite(connection_struct *conn, struct smb_request *req)
  Reply to a mkdir.
 ****************************************************************************/
 
-void reply_mkdir(connection_struct *conn, struct smb_request *req)
+void reply_mkdir(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *directory = NULL;
 	NTSTATUS status;
 	SMB_STRUCT_STAT sbuf;
@@ -4885,7 +4857,7 @@ void reply_mkdir(connection_struct *conn, struct smb_request *req)
 		return;
 	}
 
-	status = create_directory(conn, directory);
+	status = create_directory(conn, req, directory);
 
 	DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
 
@@ -5105,8 +5077,9 @@ NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
  Reply to a rmdir.
 ****************************************************************************/
 
-void reply_rmdir(connection_struct *conn, struct smb_request *req)
+void reply_rmdir(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *directory = NULL;
 	SMB_STRUCT_STAT sbuf;
 	NTSTATUS status;
@@ -5889,8 +5862,9 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
  Reply to a mv.
 ****************************************************************************/
 
-void reply_mv(connection_struct *conn, struct smb_request *req)
+void reply_mv(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *name = NULL;
 	char *newname = NULL;
 	char *p;
@@ -6120,8 +6094,9 @@ NTSTATUS copy_file(TALLOC_CTX *ctx,
  Reply to a file copy.
 ****************************************************************************/
 
-void reply_copy(connection_struct *conn, struct smb_request *req)
+void reply_copy(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	char *name = NULL;
 	char *newname = NULL;
 	char *directory = NULL;
@@ -6583,8 +6558,9 @@ SMB_BIG_UINT get_lock_offset( char *data, int data_offset, bool large_file_forma
  Reply to a lockingX request.
 ****************************************************************************/
 
-void reply_lockingX(connection_struct *conn, struct smb_request *req)
+void reply_lockingX(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	files_struct *fsp;
 	unsigned char locktype;
 	unsigned char oplocklevel;
@@ -6858,8 +6834,7 @@ void reply_lockingX(connection_struct *conn, struct smb_request *req)
 				 * onto the blocking lock queue.
 				 */
 				if(push_blocking_lock_request(br_lck,
-							(char *)req->inbuf,
-							smb_len(req->inbuf)+4,
+							req,
 							fsp,
 							lock_timeout,
 							i,
@@ -6942,7 +6917,7 @@ void reply_lockingX(connection_struct *conn, struct smb_request *req)
  please contact vl@samba.org
 ****************************************************************************/
 
-void reply_readbmpx(connection_struct *conn, struct smb_request *req)
+void reply_readbmpx(struct smb_request *req)
 {
 	START_PROFILE(SMBreadBmpx);
 	reply_doserror(req, ERRSRV, ERRuseSTD);
@@ -6956,7 +6931,7 @@ void reply_readbmpx(connection_struct *conn, struct smb_request *req)
  please contact vl@samba.org
 ****************************************************************************/
 
-void reply_readbs(connection_struct *conn, struct smb_request *req)
+void reply_readbs(struct smb_request *req)
 {
 	START_PROFILE(SMBreadBs);
 	reply_doserror(req, ERRSRV, ERRuseSTD);
@@ -6968,8 +6943,9 @@ void reply_readbs(connection_struct *conn, struct smb_request *req)
  Reply to a SMBsetattrE.
 ****************************************************************************/
 
-void reply_setattrE(connection_struct *conn, struct smb_request *req)
+void reply_setattrE(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	struct timespec ts[2];
 	files_struct *fsp;
 
@@ -7046,7 +7022,7 @@ void reply_setattrE(connection_struct *conn, struct smb_request *req)
  please contact vl@samba.org
 ****************************************************************************/
 
-void reply_writebmpx(connection_struct *conn, struct smb_request *req)
+void reply_writebmpx(struct smb_request *req)
 {
 	START_PROFILE(SMBwriteBmpx);
 	reply_doserror(req, ERRSRV, ERRuseSTD);
@@ -7060,7 +7036,7 @@ void reply_writebmpx(connection_struct *conn, struct smb_request *req)
  please contact vl@samba.org
 ****************************************************************************/
 
-void reply_writebs(connection_struct *conn, struct smb_request *req)
+void reply_writebs(struct smb_request *req)
 {
 	START_PROFILE(SMBwriteBs);
 	reply_doserror(req, ERRSRV, ERRuseSTD);
@@ -7072,8 +7048,9 @@ void reply_writebs(connection_struct *conn, struct smb_request *req)
  Reply to a SMBgetattrE.
 ****************************************************************************/
 
-void reply_getattrE(connection_struct *conn, struct smb_request *req)
+void reply_getattrE(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	SMB_STRUCT_STAT sbuf;
 	int mode;
 	files_struct *fsp;
diff --git a/source3/smbd/seal.c b/source3/smbd/seal.c
new file mode 100644
index 0000000000..21fca73fea
--- /dev/null
+++ b/source3/smbd/seal.c
@@ -0,0 +1,726 @@
+/* 
+   Unix SMB/CIFS implementation.
+   SMB Transport encryption (sealing) code - server code.
+   Copyright (C) Jeremy Allison 2007.
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+
+/******************************************************************************
+ Server side encryption.
+******************************************************************************/
+
+/******************************************************************************
+ Global server state.
+******************************************************************************/
+
+struct smb_srv_trans_enc_ctx {
+	struct smb_trans_enc_state *es;
+	AUTH_NTLMSSP_STATE *auth_ntlmssp_state; /* Must be kept in sync with pointer in ec->ntlmssp_state. */
+};
+
+static struct smb_srv_trans_enc_ctx *partial_srv_trans_enc_ctx;
+static struct smb_srv_trans_enc_ctx *srv_trans_enc_ctx;
+
+/******************************************************************************
+ Return global enc context - this must change if we ever do multiple contexts.
+******************************************************************************/
+
+uint16_t srv_enc_ctx(void)
+{
+	return srv_trans_enc_ctx->es->enc_ctx_num;
+}
+
+/******************************************************************************
+ Is this an incoming encrypted packet ?
+******************************************************************************/
+
+bool is_encrypted_packet(const uint8_t *inbuf)
+{
+	NTSTATUS status;
+	uint16_t enc_num;
+
+	/* Ignore non-session messages. */
+	if(CVAL(inbuf,0)) {
+		return false;
+	}
+
+	status = get_enc_ctx_num(inbuf, &enc_num);
+	if (!NT_STATUS_IS_OK(status)) {
+		return false;
+	}
+
+	if (srv_trans_enc_ctx && enc_num == srv_enc_ctx()) {
+		return true;
+	}
+	return false;
+}
+
+/******************************************************************************
+ Create an auth_ntlmssp_state and ensure pointer copy is correct.
+******************************************************************************/
+
+static NTSTATUS make_auth_ntlmssp(struct smb_srv_trans_enc_ctx *ec)
+{
+	NTSTATUS status = auth_ntlmssp_start(&ec->auth_ntlmssp_state);
+	if (!NT_STATUS_IS_OK(status)) {
+		return nt_status_squash(status);
+	}
+
+	/*
+	 * We must remember to update the pointer copy for the common
+	 * functions after any auth_ntlmssp_start/auth_ntlmssp_end.
+	 */
+	ec->es->s.ntlmssp_state = ec->auth_ntlmssp_state->ntlmssp_state;
+	return status;
+}
+
+/******************************************************************************
+ Destroy an auth_ntlmssp_state and ensure pointer copy is correct.
+******************************************************************************/
+
+static void destroy_auth_ntlmssp(struct smb_srv_trans_enc_ctx *ec)
+{
+	/*
+	 * We must remember to update the pointer copy for the common
+	 * functions after any auth_ntlmssp_start/auth_ntlmssp_end.
+	 */
+
+	if (ec->auth_ntlmssp_state) {
+		auth_ntlmssp_end(&ec->auth_ntlmssp_state);
+		/* The auth_ntlmssp_end killed this already. */
+		ec->es->s.ntlmssp_state = NULL;
+	}
+}
+
+#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
+
+/******************************************************************************
+ Import a name.
+******************************************************************************/
+
+static NTSTATUS get_srv_gss_creds(const char *service,
+				const char *name,
+				gss_cred_usage_t cred_type,
+				gss_cred_id_t *p_srv_cred)
+{
+	OM_uint32 ret;
+	OM_uint32 min;
+	gss_name_t srv_name;
+	gss_buffer_desc input_name;
+	char *host_princ_s = NULL;
+	NTSTATUS status = NT_STATUS_OK;
+
+	gss_OID_desc nt_hostbased_service =
+	{10, CONST_DISCARD(char *,"\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x04")};
+
+	asprintf(&host_princ_s, "%s@%s", service, name);
+	if (host_princ_s == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	input_name.value = host_princ_s;
+	input_name.length = strlen(host_princ_s) + 1;
+
+	ret = gss_import_name(&min,
+				&input_name,
+				&nt_hostbased_service,
+				&srv_name);
+
+	DEBUG(10,("get_srv_gss_creds: imported name %s\n",
+		host_princ_s ));
+
+	if (ret != GSS_S_COMPLETE) {
+		SAFE_FREE(host_princ_s);
+		return map_nt_error_from_gss(ret, min);
+	}
+
+	/*
+	 * We're accessing the krb5.keytab file here.
+ 	 * ensure we have permissions to do so.
+ 	 */
+	become_root();
+
+	ret = gss_acquire_cred(&min,
+				srv_name,
+				GSS_C_INDEFINITE,
+				GSS_C_NULL_OID_SET,
+				cred_type,
+				p_srv_cred,
+				NULL,
+				NULL);
+	unbecome_root();
+
+	if (ret != GSS_S_COMPLETE) {
+		ADS_STATUS adss = ADS_ERROR_GSS(ret, min);
+		DEBUG(10,("get_srv_gss_creds: gss_acquire_cred failed with %s\n",
+			ads_errstr(adss)));
+		status = map_nt_error_from_gss(ret, min);
+	}
+
+	SAFE_FREE(host_princ_s);
+	gss_release_name(&min, &srv_name);
+	return status;
+}
+
+/******************************************************************************
+ Create a gss state.
+ Try and get the cifs/server@realm principal first, then fall back to
+ host/server@realm.
+******************************************************************************/
+
+static NTSTATUS make_auth_gss(struct smb_srv_trans_enc_ctx *ec)
+{
+	NTSTATUS status;
+	gss_cred_id_t srv_cred;
+	fstring fqdn;
+
+	name_to_fqdn(fqdn, global_myname());
+	strlower_m(fqdn);
+
+	status = get_srv_gss_creds("cifs", fqdn, GSS_C_ACCEPT, &srv_cred);
+	if (!NT_STATUS_IS_OK(status)) {
+		status = get_srv_gss_creds("host", fqdn, GSS_C_ACCEPT, &srv_cred);
+		if (!NT_STATUS_IS_OK(status)) {
+			return nt_status_squash(status);
+		}
+	}
+
+	ec->es->s.gss_state = SMB_MALLOC_P(struct smb_tran_enc_state_gss);
+	if (!ec->es->s.gss_state) {
+		OM_uint32 min;
+		gss_release_cred(&min, &srv_cred);
+		return NT_STATUS_NO_MEMORY;
+	}
+	ZERO_STRUCTP(ec->es->s.gss_state);
+	ec->es->s.gss_state->creds = srv_cred;
+
+	/* No context yet. */
+	ec->es->s.gss_state->gss_ctx = GSS_C_NO_CONTEXT;
+
+	return NT_STATUS_OK;
+}
+#endif
+
+/******************************************************************************
+ Shutdown a server encryption context.
+******************************************************************************/
+
+static void srv_free_encryption_context(struct smb_srv_trans_enc_ctx **pp_ec)
+{
+	struct smb_srv_trans_enc_ctx *ec = *pp_ec;
+
+	if (!ec) {
+		return;
+	}
+
+	if (ec->es) {
+		switch (ec->es->smb_enc_type) {
+			case SMB_TRANS_ENC_NTLM:
+				destroy_auth_ntlmssp(ec);
+				break;
+#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
+			case SMB_TRANS_ENC_GSS:
+				break;
+#endif
+		}
+		common_free_encryption_state(&ec->es);
+	}
+
+	SAFE_FREE(ec);
+	*pp_ec = NULL;
+}
+
+/******************************************************************************
+ Create a server encryption context.
+******************************************************************************/
+
+static NTSTATUS make_srv_encryption_context(enum smb_trans_enc_type smb_enc_type, struct smb_srv_trans_enc_ctx **pp_ec)
+{
+	struct smb_srv_trans_enc_ctx *ec;
+
+	*pp_ec = NULL;
+
+	ec = SMB_MALLOC_P(struct smb_srv_trans_enc_ctx);
+	if (!ec) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	ZERO_STRUCTP(partial_srv_trans_enc_ctx);
+	ec->es = SMB_MALLOC_P(struct smb_trans_enc_state);
+	if (!ec->es) {
+		SAFE_FREE(ec);
+		return NT_STATUS_NO_MEMORY;
+	}
+	ZERO_STRUCTP(ec->es);
+	ec->es->smb_enc_type = smb_enc_type;
+	switch (smb_enc_type) {
+		case SMB_TRANS_ENC_NTLM:
+			{
+				NTSTATUS status = make_auth_ntlmssp(ec);
+				if (!NT_STATUS_IS_OK(status)) {
+					srv_free_encryption_context(&ec);
+					return status;
+				}
+			}
+			break;
+
+#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
+		case SMB_TRANS_ENC_GSS:
+			/* Acquire our credentials by calling gss_acquire_cred here. */
+			{
+				NTSTATUS status = make_auth_gss(ec);
+				if (!NT_STATUS_IS_OK(status)) {
+					srv_free_encryption_context(&ec);
+					return status;
+				}
+			}
+			break;
+#endif
+		default:
+			srv_free_encryption_context(&ec);
+			return NT_STATUS_INVALID_PARAMETER;
+	}
+	*pp_ec = ec;
+	return NT_STATUS_OK;
+}
+
+/******************************************************************************
+ Free an encryption-allocated buffer.
+******************************************************************************/
+
+void srv_free_enc_buffer(char *buf)
+{
+	/* We know this is an smb buffer, and we
+	 * didn't malloc, only copy, for a keepalive,
+	 * so ignore non-session messages. */
+
+	if(CVAL(buf,0)) {
+		return;
+	}
+
+	if (srv_trans_enc_ctx) {
+		common_free_enc_buffer(srv_trans_enc_ctx->es, buf);
+	}
+}
+
+/******************************************************************************
+ Decrypt an incoming buffer.
+******************************************************************************/
+
+NTSTATUS srv_decrypt_buffer(char *buf)
+{
+	/* Ignore non-session messages. */
+	if(CVAL(buf,0)) {
+		return NT_STATUS_OK;
+	}
+
+	if (srv_trans_enc_ctx) {
+		return common_decrypt_buffer(srv_trans_enc_ctx->es, buf);
+	}
+
+	return NT_STATUS_OK;
+}
+
+/******************************************************************************
+ Encrypt an outgoing buffer. Return the encrypted pointer in buf_out.
+******************************************************************************/
+
+NTSTATUS srv_encrypt_buffer(char *buf, char **buf_out)
+{
+	*buf_out = buf;
+
+	/* Ignore non-session messages. */
+	if(CVAL(buf,0)) {
+		return NT_STATUS_OK;
+	}
+
+	if (srv_trans_enc_ctx) {
+		return common_encrypt_buffer(srv_trans_enc_ctx->es, buf, buf_out);
+	}
+	/* Not encrypting. */
+	return NT_STATUS_OK;
+}
+
+/******************************************************************************
+ Do the gss encryption negotiation. Parameters are in/out.
+ Until success we do everything on the partial enc ctx.
+******************************************************************************/
+
+#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
+static NTSTATUS srv_enc_spnego_gss_negotiate(unsigned char **ppdata, size_t *p_data_size, DATA_BLOB secblob)
+{
+	OM_uint32 ret;
+	OM_uint32 min;
+	OM_uint32 flags = 0;
+	gss_buffer_desc in_buf, out_buf;
+	struct smb_tran_enc_state_gss *gss_state;
+	DATA_BLOB auth_reply = data_blob_null;
+	DATA_BLOB response = data_blob_null;
+	NTSTATUS status;
+
+	if (!partial_srv_trans_enc_ctx) {
+		status = make_srv_encryption_context(SMB_TRANS_ENC_GSS, &partial_srv_trans_enc_ctx);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+	}
+
+	gss_state = partial_srv_trans_enc_ctx->es->s.gss_state;
+
+	in_buf.value = secblob.data;
+	in_buf.length = secblob.length;
+
+	out_buf.value = NULL;
+	out_buf.length = 0;
+
+	become_root();
+
+	ret = gss_accept_sec_context(&min,
+				&gss_state->gss_ctx,
+				gss_state->creds,
+				&in_buf,
+				GSS_C_NO_CHANNEL_BINDINGS,
+				NULL,
+				NULL,		/* Ignore oids. */
+				&out_buf,	/* To return. */
+				&flags,
+				NULL,		/* Ingore time. */
+				NULL);		/* Ignore delegated creds. */
+	unbecome_root();
+
+	status = gss_err_to_ntstatus(ret, min);
+	if (ret != GSS_S_COMPLETE && ret != GSS_S_CONTINUE_NEEDED) {
+		return status;
+	}
+
+	/* Ensure we've got sign+seal available. */
+	if (ret == GSS_S_COMPLETE) {
+		if ((flags & (GSS_C_INTEG_FLAG|GSS_C_CONF_FLAG|GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG)) !=
+				(GSS_C_INTEG_FLAG|GSS_C_CONF_FLAG|GSS_C_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG)) {
+			DEBUG(0,("srv_enc_spnego_gss_negotiate: quality of service not good enough "
+				"for SMB sealing.\n"));
+			gss_release_buffer(&min, &out_buf);
+			return NT_STATUS_ACCESS_DENIED;
+		}
+	}
+
+	auth_reply = data_blob(out_buf.value, out_buf.length);
+	gss_release_buffer(&min, &out_buf);
+
+	/* Wrap in SPNEGO. */
+	response = spnego_gen_auth_response(&auth_reply, status, OID_KERBEROS5);
+	data_blob_free(&auth_reply);
+
+	SAFE_FREE(*ppdata);
+	*ppdata = response.data;
+	*p_data_size = response.length;
+
+	return status;
+}
+#endif
+
+/******************************************************************************
+ Do the NTLM SPNEGO (or raw) encryption negotiation. Parameters are in/out.
+ Until success we do everything on the partial enc ctx.
+******************************************************************************/
+
+static NTSTATUS srv_enc_ntlm_negotiate(unsigned char **ppdata, size_t *p_data_size, DATA_BLOB secblob, bool spnego_wrap)
+{
+	NTSTATUS status;
+	DATA_BLOB chal = data_blob_null;
+	DATA_BLOB response = data_blob_null;
+
+	status = make_srv_encryption_context(SMB_TRANS_ENC_NTLM, &partial_srv_trans_enc_ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	status = auth_ntlmssp_update(partial_srv_trans_enc_ctx->auth_ntlmssp_state, secblob, &chal);
+
+	/* status here should be NT_STATUS_MORE_PROCESSING_REQUIRED
+	 * for success ... */
+
+	if (spnego_wrap) {
+		response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
+		data_blob_free(&chal);
+	} else {
+		/* Return the raw blob. */
+		response = chal;
+	}
+
+	SAFE_FREE(*ppdata);
+	*ppdata = response.data;
+	*p_data_size = response.length;
+	return status;
+}
+
+/******************************************************************************
+ Do the SPNEGO encryption negotiation. Parameters are in/out.
+ Based off code in smbd/sesssionsetup.c
+ Until success we do everything on the partial enc ctx.
+******************************************************************************/
+
+static NTSTATUS srv_enc_spnego_negotiate(connection_struct *conn,
+					unsigned char **ppdata,
+					size_t *p_data_size,
+					unsigned char **pparam,
+					size_t *p_param_size)
+{
+	NTSTATUS status;
+	DATA_BLOB blob = data_blob_null;
+	DATA_BLOB secblob = data_blob_null;
+	bool got_kerberos_mechanism = false;
+
+	blob = data_blob_const(*ppdata, *p_data_size);
+
+	status = parse_spnego_mechanisms(blob, &secblob, &got_kerberos_mechanism);
+	if (!NT_STATUS_IS_OK(status)) {
+		return nt_status_squash(status);
+	}
+
+	/* We should have no partial context at this point. */
+
+	srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+
+#if defined(HAVE_GSSAPI) && defined(HAVE_KRB5)
+	if (got_kerberos_mechanism && lp_use_kerberos_keytab() ) {
+		status = srv_enc_spnego_gss_negotiate(ppdata, p_data_size, secblob);
+	} else 
+#endif
+	{
+		status = srv_enc_ntlm_negotiate(ppdata, p_data_size, secblob, true);
+	}
+
+	data_blob_free(&secblob);
+
+	if (!NT_STATUS_EQUAL(status,NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
+		srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+		return nt_status_squash(status);
+	}
+
+	if (NT_STATUS_IS_OK(status)) {
+		/* Return the context we're using for this encryption state. */
+		if (!(*pparam = SMB_MALLOC_ARRAY(unsigned char, 2))) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		SSVAL(*pparam,0,partial_srv_trans_enc_ctx->es->enc_ctx_num);
+		*p_param_size = 2;
+	}
+
+	return status;
+}
+
+/******************************************************************************
+ Complete a SPNEGO encryption negotiation. Parameters are in/out.
+ We only get this for a NTLM auth second stage.
+******************************************************************************/
+
+static NTSTATUS srv_enc_spnego_ntlm_auth(connection_struct *conn,
+					unsigned char **ppdata,
+					size_t *p_data_size,
+					unsigned char **pparam,
+					size_t *p_param_size)
+{
+	NTSTATUS status;
+	DATA_BLOB blob = data_blob_null;
+	DATA_BLOB auth = data_blob_null;
+	DATA_BLOB auth_reply = data_blob_null;
+	DATA_BLOB response = data_blob_null;
+	struct smb_srv_trans_enc_ctx *ec = partial_srv_trans_enc_ctx;
+
+	/* We must have a partial context here. */
+
+	if (!ec || !ec->es || ec->auth_ntlmssp_state == NULL || ec->es->smb_enc_type != SMB_TRANS_ENC_NTLM) {
+		srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	blob = data_blob_const(*ppdata, *p_data_size);
+	if (!spnego_parse_auth(blob, &auth)) {
+		srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	status = auth_ntlmssp_update(ec->auth_ntlmssp_state, auth, &auth_reply);
+	data_blob_free(&auth);
+
+	response = spnego_gen_auth_response(&auth_reply, status, OID_NTLMSSP);
+	data_blob_free(&auth_reply);
+
+	if (NT_STATUS_IS_OK(status)) {
+		/* Return the context we're using for this encryption state. */
+		if (!(*pparam = SMB_MALLOC_ARRAY(unsigned char, 2))) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		SSVAL(*pparam,0,ec->es->enc_ctx_num);
+		*p_param_size = 2;
+	}
+
+	SAFE_FREE(*ppdata);
+	*ppdata = response.data;
+	*p_data_size = response.length;
+	return status;
+}
+
+/******************************************************************************
+ Raw NTLM encryption negotiation. Parameters are in/out.
+ This function does both steps.
+******************************************************************************/
+
+static NTSTATUS srv_enc_raw_ntlm_auth(connection_struct *conn,
+					unsigned char **ppdata,
+					size_t *p_data_size,
+					unsigned char **pparam,
+					size_t *p_param_size)
+{
+	NTSTATUS status;
+	DATA_BLOB blob = data_blob_const(*ppdata, *p_data_size);
+	DATA_BLOB response = data_blob_null;
+	struct smb_srv_trans_enc_ctx *ec;
+
+	if (!partial_srv_trans_enc_ctx) {
+		/* This is the initial step. */
+		status = srv_enc_ntlm_negotiate(ppdata, p_data_size, blob, false);
+		if (!NT_STATUS_EQUAL(status,NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
+			srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+			return nt_status_squash(status);
+		}
+		return status;
+	}
+
+	ec = partial_srv_trans_enc_ctx;
+	if (!ec || !ec->es || ec->auth_ntlmssp_state == NULL || ec->es->smb_enc_type != SMB_TRANS_ENC_NTLM) {
+		srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	/* Second step. */
+	status = auth_ntlmssp_update(partial_srv_trans_enc_ctx->auth_ntlmssp_state, blob, &response);
+
+	if (NT_STATUS_IS_OK(status)) {
+		/* Return the context we're using for this encryption state. */
+		if (!(*pparam = SMB_MALLOC_ARRAY(unsigned char, 2))) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		SSVAL(*pparam,0,ec->es->enc_ctx_num);
+		*p_param_size = 2;
+	}
+
+	/* Return the raw blob. */
+	SAFE_FREE(*ppdata);
+	*ppdata = response.data;
+	*p_data_size = response.length;
+	return status;
+}
+
+/******************************************************************************
+ Do the SPNEGO encryption negotiation. Parameters are in/out.
+******************************************************************************/
+
+NTSTATUS srv_request_encryption_setup(connection_struct *conn,
+					unsigned char **ppdata,
+					size_t *p_data_size,
+					unsigned char **pparam,
+					size_t *p_param_size)
+{
+	unsigned char *pdata = *ppdata;
+
+	SAFE_FREE(*pparam);
+	*p_param_size = 0;
+
+	if (*p_data_size < 1) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (pdata[0] == ASN1_APPLICATION(0)) {
+		/* its a negTokenTarg packet */
+		return srv_enc_spnego_negotiate(conn, ppdata, p_data_size, pparam, p_param_size);
+	}
+
+	if (pdata[0] == ASN1_CONTEXT(1)) {
+		/* It's an auth packet */
+		return srv_enc_spnego_ntlm_auth(conn, ppdata, p_data_size, pparam, p_param_size);
+	}
+
+	/* Maybe it's a raw unwrapped auth ? */
+	if (*p_data_size < 7) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (strncmp((char *)pdata, "NTLMSSP", 7) == 0) {
+		return srv_enc_raw_ntlm_auth(conn, ppdata, p_data_size, pparam, p_param_size);
+	}
+
+	DEBUG(1,("srv_request_encryption_setup: Unknown packet\n"));
+
+	return NT_STATUS_LOGON_FAILURE;
+}
+
+/******************************************************************************
+ Negotiation was successful - turn on server-side encryption.
+******************************************************************************/
+
+static NTSTATUS check_enc_good(struct smb_srv_trans_enc_ctx *ec)
+{
+	if (!ec || !ec->es) {
+		return NT_STATUS_LOGON_FAILURE;
+	}
+
+	if (ec->es->smb_enc_type == SMB_TRANS_ENC_NTLM) {
+		if ((ec->es->s.ntlmssp_state->neg_flags & (NTLMSSP_NEGOTIATE_SIGN|NTLMSSP_NEGOTIATE_SEAL)) !=
+				(NTLMSSP_NEGOTIATE_SIGN|NTLMSSP_NEGOTIATE_SEAL)) {
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+	}
+	/* Todo - check gssapi case. */
+
+	return NT_STATUS_OK;
+}
+
+/******************************************************************************
+ Negotiation was successful - turn on server-side encryption.
+******************************************************************************/
+
+NTSTATUS srv_encryption_start(connection_struct *conn)
+{
+	NTSTATUS status;
+
+	/* Check that we are really doing sign+seal. */
+	status = check_enc_good(partial_srv_trans_enc_ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	/* Throw away the context we're using currently (if any). */
+	srv_free_encryption_context(&srv_trans_enc_ctx);
+
+	/* Steal the partial pointer. Deliberate shallow copy. */
+	srv_trans_enc_ctx = partial_srv_trans_enc_ctx;
+	srv_trans_enc_ctx->es->enc_on = true;
+
+	partial_srv_trans_enc_ctx = NULL;
+
+	return NT_STATUS_OK;
+}
+
+/******************************************************************************
+ Shutdown all server contexts.
+******************************************************************************/
+
+void server_encryption_shutdown(void)
+{
+	srv_free_encryption_context(&partial_srv_trans_enc_ctx);
+	srv_free_encryption_context(&srv_trans_enc_ctx);
+}
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 8e69a3b381..65fc818144 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -795,6 +795,8 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser,
 	conn->case_preserve = lp_preservecase(snum);
 	conn->short_case_preserve = lp_shortpreservecase(snum);
 
+	conn->encrypt_level = lp_smb_encrypt(snum);
+
 	conn->veto_list = NULL;
 	conn->hide_list = NULL;
 	conn->veto_oplock_list = NULL;
diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index 8ca012ff24..bc1d26faca 100644
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -118,8 +118,7 @@ static void sessionsetup_start_signing_engine(
  Send a security blob via a session setup reply.
 ****************************************************************************/
 
-static void reply_sesssetup_blob(connection_struct *conn,
-				 struct smb_request *req,
+static void reply_sesssetup_blob(struct smb_request *req,
 				 DATA_BLOB blob,
 				 NTSTATUS nt_status)
 {
@@ -139,7 +138,7 @@ static void reply_sesssetup_blob(connection_struct *conn,
 	}
 
 	show_msg((char *)req->outbuf);
-	send_smb(smbd_server_fd(),(char *)req->outbuf);
+	srv_send_smb(smbd_server_fd(),(char *)req->outbuf,req->encrypted);
 	TALLOC_FREE(req->outbuf);
 }
 
@@ -247,8 +246,7 @@ static bool make_krb5_skew_error(DATA_BLOB *pblob_out)
  Reply to a session setup spnego negotiate packet for kerberos.
 ****************************************************************************/
 
-static void reply_spnego_kerberos(connection_struct *conn,
-				  struct smb_request *req,
+static void reply_spnego_kerberos(struct smb_request *req,
 				  DATA_BLOB *secblob,
 				  uint16 vuid,
 				  bool *p_invalidate_vuid)
@@ -539,7 +537,9 @@ static void reply_spnego_kerberos(connection_struct *conn,
 		}
 	}
 
-	server_info->was_mapped |= username_was_mapped;
+	if (username_was_mapped) {
+		server_info->was_mapped = username_was_mapped;
+	}
 
 	/* we need to build the token for the user. make_server_info_guest()
 	   already does this */
@@ -605,7 +605,7 @@ static void reply_spnego_kerberos(connection_struct *conn,
 	}
 	response = spnego_gen_auth_response(&ap_rep_wrapped, ret,
 			OID_KERBEROS5_OLD);
-	reply_sesssetup_blob(conn, req, response, ret);
+	reply_sesssetup_blob(req, response, ret);
 
 	data_blob_free(&ap_rep);
 	data_blob_free(&ap_rep_wrapped);
@@ -623,8 +623,7 @@ static void reply_spnego_kerberos(connection_struct *conn,
  leg of the NTLM auth steps.
 ***************************************************************************/
 
-static void reply_spnego_ntlmssp(connection_struct *conn,
-				 struct smb_request *req,
+static void reply_spnego_ntlmssp(struct smb_request *req,
 				 uint16 vuid,
 				 AUTH_NTLMSSP_STATE **auth_ntlmssp_state,
 				 DATA_BLOB *ntlmssp_blob, NTSTATUS nt_status,
@@ -693,7 +692,7 @@ static void reply_spnego_ntlmssp(connection_struct *conn,
 		response = *ntlmssp_blob;
 	}
 
-	reply_sesssetup_blob(conn, req, response, nt_status);
+	reply_sesssetup_blob(req, response, nt_status);
 	if (wrap) {
 		data_blob_free(&response);
 	}
@@ -756,8 +755,7 @@ NTSTATUS parse_spnego_mechanisms(DATA_BLOB blob_in, DATA_BLOB *pblob_out,
  Reply to a session setup spnego negotiate packet.
 ****************************************************************************/
 
-static void reply_spnego_negotiate(connection_struct *conn,
-				   struct smb_request *req,
+static void reply_spnego_negotiate(struct smb_request *req,
 				   uint16 vuid,
 				   DATA_BLOB blob1,
 				   AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
@@ -783,7 +781,7 @@ static void reply_spnego_negotiate(connection_struct *conn,
 	if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) ||
 				lp_use_kerberos_keytab()) ) {
 		bool destroy_vuid = True;
-		reply_spnego_kerberos(conn, req, &secblob, vuid,
+		reply_spnego_kerberos(req, &secblob, vuid,
 				      &destroy_vuid);
 		data_blob_free(&secblob);
 		if (destroy_vuid) {
@@ -811,7 +809,7 @@ static void reply_spnego_negotiate(connection_struct *conn,
 
 	data_blob_free(&secblob);
 
-	reply_spnego_ntlmssp(conn, req, vuid, auth_ntlmssp_state,
+	reply_spnego_ntlmssp(req, vuid, auth_ntlmssp_state,
 			     &chal, status, True);
 
 	data_blob_free(&chal);
@@ -824,8 +822,7 @@ static void reply_spnego_negotiate(connection_struct *conn,
  Reply to a session setup spnego auth packet.
 ****************************************************************************/
 
-static void reply_spnego_auth(connection_struct *conn,
-			      struct smb_request *req,
+static void reply_spnego_auth(struct smb_request *req,
 			      uint16 vuid,
 			      DATA_BLOB blob1,
 			      AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
@@ -860,7 +857,7 @@ static void reply_spnego_auth(connection_struct *conn,
 			if ( got_krb5_mechanism && ((lp_security()==SEC_ADS) ||
 						lp_use_kerberos_keytab()) ) {
 				bool destroy_vuid = True;
-				reply_spnego_kerberos(conn, req, &secblob,
+				reply_spnego_kerberos(req, &secblob,
 						      vuid, &destroy_vuid);
 				data_blob_free(&secblob);
 				data_blob_free(&auth);
@@ -892,7 +889,7 @@ static void reply_spnego_auth(connection_struct *conn,
 
 	data_blob_free(&auth);
 
-	reply_spnego_ntlmssp(conn, req, vuid,
+	reply_spnego_ntlmssp(req, vuid,
 			     auth_ntlmssp_state,
 			     &auth_reply, status, True);
 
@@ -1104,8 +1101,7 @@ static NTSTATUS check_spnego_blob_complete(uint16 smbpid, uint16 vuid,
  conn POINTER CAN BE NULL HERE !
 ****************************************************************************/
 
-static void reply_sesssetup_and_X_spnego(connection_struct *conn,
-					 struct smb_request *req)
+static void reply_sesssetup_and_X_spnego(struct smb_request *req)
 {
 	uint8 *p;
 	DATA_BLOB blob1;
@@ -1225,7 +1221,7 @@ static void reply_sesssetup_and_X_spnego(connection_struct *conn,
 
 		/* its a negTokenTarg packet */
 
-		reply_spnego_negotiate(conn, req, vuid, blob1,
+		reply_spnego_negotiate(req, vuid, blob1,
 				       &vuser->auth_ntlmssp_state);
 		data_blob_free(&blob1);
 		return;
@@ -1235,7 +1231,7 @@ static void reply_sesssetup_and_X_spnego(connection_struct *conn,
 
 		/* its a auth packet */
 
-		reply_spnego_auth(conn, req, vuid, blob1,
+		reply_spnego_auth(req, vuid, blob1,
 				  &vuser->auth_ntlmssp_state);
 		data_blob_free(&blob1);
 		return;
@@ -1260,7 +1256,7 @@ static void reply_sesssetup_and_X_spnego(connection_struct *conn,
 
 		data_blob_free(&blob1);
 
-		reply_spnego_ntlmssp(conn, req, vuid,
+		reply_spnego_ntlmssp(req, vuid,
 				     &vuser->auth_ntlmssp_state,
 				     &chal, status, False);
 		data_blob_free(&chal);
@@ -1326,7 +1322,7 @@ static void setup_new_vc_session(void)
  Reply to a session setup command.
 ****************************************************************************/
 
-void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
+void reply_sesssetup_and_X(struct smb_request *req)
 {
 	int sess_vuid;
 	int smb_bufsize;
@@ -1377,7 +1373,7 @@ void reply_sesssetup_and_X(connection_struct *conn, struct smb_request *req)
 			setup_new_vc_session();
 		}
 
-		reply_sesssetup_and_X_spnego(conn, req);
+		reply_sesssetup_and_X_spnego(req);
 		END_PROFILE(SMBsesssetupX);
 		return;
 	}
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index e37f6ffbfd..c3b5f9fa2f 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -575,7 +575,8 @@ static struct ea_list *ea_list_union(struct ea_list *name_list, struct ea_list *
   HACK ! Always assumes smb_setup field is zero.
 ****************************************************************************/
 
-void send_trans2_replies(struct smb_request *req,
+void send_trans2_replies(connection_struct *conn,
+			struct smb_request *req,
 			 const char *params,
 			 int paramsize,
 			 const char *pdata,
@@ -737,8 +738,10 @@ void send_trans2_replies(struct smb_request *req,
 
 		/* Send the packet */
 		show_msg((char *)req->outbuf);
-		if (!send_smb(smbd_server_fd(),(char *)req->outbuf))
-			exit_server_cleanly("send_trans2_replies: send_smb failed.");
+		if (!srv_send_smb(smbd_server_fd(),
+				(char *)req->outbuf,
+				IS_CONN_ENCRYPTED(conn)))
+			exit_server_cleanly("send_trans2_replies: srv_send_smb failed.");
 
 		TALLOC_FREE(req->outbuf);
 
@@ -841,20 +844,6 @@ static void call_trans2open(connection_struct *conn,
 		fname, (unsigned int)deny_mode, (unsigned int)open_attr,
 		(unsigned int)open_ofun, open_size));
 
-	/* XXXX we need to handle passed times, sattr and flags */
-
-	status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
-	if (!NT_STATUS_IS_OK(status)) {
-		reply_nterror(req, status);
-		return;
-	}
-
-	status = check_name(conn, fname);
-	if (!NT_STATUS_IS_OK(status)) {
-		reply_nterror(req, status);
-		return;
-	}
-
 	if (open_ofun == 0) {
 		reply_nterror(req, NT_STATUS_OBJECT_NAME_COLLISION);
 		return;
@@ -899,14 +888,22 @@ static void call_trans2open(connection_struct *conn,
 		return;
 	}
 
-	status = open_file_ntcreate(conn, req, fname, &sbuf,
-		access_mask,
-		share_mode,
-		create_disposition,
-		create_options,
-		open_attr,
-		oplock_request,
-		&smb_action, &fsp);
+	status = create_file(conn,			/* conn */
+			     req,			/* req */
+			     0,				/* root_dir_fid */
+			     fname,			/* fname */
+			     access_mask,		/* access_mask */
+			     share_mode,		/* share_access */
+			     create_disposition,	/* create_disposition*/
+			     create_options,		/* create_options */
+			     open_attr,			/* file_attributes */
+			     oplock_request,		/* oplock_request */
+			     open_size,			/* allocation_size */
+			     NULL,			/* sd */
+			     ea_list,			/* ea_list */
+			     &fsp,			/* result */
+			     &smb_action,		/* pinfo */
+			     &sbuf);			/* psbuf */
 
 	if (!NT_STATUS_IS_OK(status)) {
 		if (open_was_deferred(req->mid)) {
@@ -927,41 +924,6 @@ static void call_trans2open(connection_struct *conn,
 		return;
 	}
 
-	/* Save the requested allocation size. */
-	/* Allocate space for the file if a size hint is supplied */
-	if ((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) {
-		SMB_BIG_UINT allocation_size = (SMB_BIG_UINT)open_size;
-		if (allocation_size && (allocation_size > (SMB_BIG_UINT)size)) {
-                        fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
-                        if (fsp->is_directory) {
-                                close_file(fsp,ERROR_CLOSE);
-                                /* Can't set allocation size on a directory. */
-				reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-				return;
-                        }
-                        if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
-                                close_file(fsp,ERROR_CLOSE);
-				reply_nterror(req, NT_STATUS_DISK_FULL);
-				return;
-                        }
-
-			/* Adjust size here to return the right size in the reply.
-			   Windows does it this way. */
-			size = fsp->initial_allocation_size;
-                } else {
-                        fsp->initial_allocation_size = smb_roundup(fsp->conn,(SMB_BIG_UINT)size);
-                }
-	}
-
-	if (ea_list && smb_action == FILE_WAS_CREATED) {
-		status = set_ea(conn, fsp, fname, ea_list);
-		if (!NT_STATUS_IS_OK(status)) {
-			close_file(fsp,ERROR_CLOSE);
-			reply_nterror(req, status);
-			return;
-		}
-	}
-
 	/* Realloc the size of parameters and data we will return */
 	*pparams = (char *)SMB_REALLOC(*pparams, 30);
 	if(*pparams == NULL ) {
@@ -997,7 +959,7 @@ static void call_trans2open(connection_struct *conn,
 	}
 
 	/* Send the required number of replies */
-	send_trans2_replies(req, params, 30, *ppdata, 0, max_data_bytes);
+	send_trans2_replies(conn, req, params, 30, *ppdata, 0, max_data_bytes);
 }
 
 /*********************************************************
@@ -2067,7 +2029,7 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 	SSVAL(params,6,0); /* Never an EA error */
 	SSVAL(params,8,last_entry_off);
 
-	send_trans2_replies(req, params, 10, pdata, PTR_DIFF(p,pdata),
+	send_trans2_replies(conn, req, params, 10, pdata, PTR_DIFF(p,pdata),
 			    max_data_bytes);
 
 	if ((! *directory) && dptr_path(dptr_num)) {
@@ -2391,7 +2353,7 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 	SSVAL(params,4,0); /* Never an EA error */
 	SSVAL(params,6,last_entry_off);
 
-	send_trans2_replies(req, params, 8, pdata, PTR_DIFF(p,pdata),
+	send_trans2_replies(conn, req, params, 8, pdata, PTR_DIFF(p,pdata),
 			    max_data_bytes);
 
 	return;
@@ -2430,6 +2392,27 @@ static void call_trans2qfsinfo(connection_struct *conn,
 
 	info_level = SVAL(params,0);
 
+	if (IS_IPC(conn)) {
+		if (info_level != SMB_QUERY_CIFS_UNIX_INFO) {
+			DEBUG(0,("call_trans2qfsinfo: not an allowed "
+				"info level (0x%x) on IPC$.\n",
+				(unsigned int)info_level));
+			reply_nterror(req, NT_STATUS_ACCESS_DENIED);
+			return;
+		}
+	}
+
+	if (ENCRYPTION_REQUIRED(conn) && !req->encrypted) {
+		if (info_level != SMB_QUERY_CIFS_UNIX_INFO) {
+			DEBUG(0,("call_trans2qfsinfo: encryption required "
+				"and info level 0x%x sent.\n",
+				(unsigned int)info_level));
+			exit_server_cleanly("encryption required "
+				"on connection");
+			return;
+		}
+	}
+
 	DEBUG(3,("call_trans2qfsinfo: level = %d\n", info_level));
 
 	if(SMB_VFS_STAT(conn,".",&st)!=0) {
@@ -2729,22 +2712,45 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
 		{
 			bool large_write = lp_min_receive_file_size() &&
 						!srv_is_signing_active();
+			bool large_read = !srv_is_signing_active();
+			int encrypt_caps = 0;
 
 			if (!lp_unix_extensions()) {
 				reply_nterror(req, NT_STATUS_INVALID_LEVEL);
 				return;
 			}
+
+			switch (conn->encrypt_level) {
+			case 0:
+				encrypt_caps = 0;
+				break;
+			case 1:
+			case Auto:
+				encrypt_caps = CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP;
+				break;
+			case Required:
+				encrypt_caps = CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP|
+						CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP;
+				large_write = false;
+				large_read = false;
+				break;
+			}
+
 			data_len = 12;
 			SSVAL(pdata,0,CIFS_UNIX_MAJOR_VERSION);
 			SSVAL(pdata,2,CIFS_UNIX_MINOR_VERSION);
-			/* We have POSIX ACLs, pathname and locking capability. */
+
+			/* We have POSIX ACLs, pathname, encryption, 
+			 * large read/write, and locking capability. */
+
 			SBIG_UINT(pdata,4,((SMB_BIG_UINT)(
 					CIFS_UNIX_POSIX_ACLS_CAP|
 					CIFS_UNIX_POSIX_PATHNAMES_CAP|
 					CIFS_UNIX_FCNTL_LOCKS_CAP|
 					CIFS_UNIX_EXTATTR_CAP|
 					CIFS_UNIX_POSIX_PATH_OPERATIONS_CAP|
-					CIFS_UNIX_LARGE_READ_CAP|
+					encrypt_caps|
+					(large_read ? CIFS_UNIX_LARGE_READ_CAP : 0) |
 					(large_write ?
 					CIFS_UNIX_LARGE_WRITE_CAP : 0))));
 			break;
@@ -2864,8 +2870,8 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
 			 */
 			for (i = 0, sid_bytes = 0;
 			    i < current_user.nt_user_token->num_sids; ++i) {
-				sid_bytes +=
-				    sid_size(&current_user.nt_user_token->user_sids[i]);
+				sid_bytes += ndr_size_dom_sid(
+					&current_user.nt_user_token->user_sids[i], 0);
 			}
 
 			/* SID list byte count */
@@ -2885,8 +2891,8 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
 			/* SID list */
 			for (i = 0;
 			    i < current_user.nt_user_token->num_sids; ++i) {
-				int sid_len =
-				    sid_size(&current_user.nt_user_token->user_sids[i]);
+				int sid_len = ndr_size_dom_sid(
+					&current_user.nt_user_token->user_sids[i], 0);
 
 				sid_linearize(pdata + data_len, sid_len,
 				    &current_user.nt_user_token->user_sids[i]);
@@ -2913,7 +2919,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
 	}
 
 
-	send_trans2_replies(req, params, 0, pdata, data_len,
+	send_trans2_replies(conn, req, params, 0, pdata, data_len,
 			    max_data_bytes);
 
 	DEBUG( 4, ( "%s info_level = %d\n",
@@ -2948,6 +2954,28 @@ static void call_trans2setfsinfo(connection_struct *conn,
 
 	info_level = SVAL(params,2);
 
+	if (IS_IPC(conn)) {
+		if (info_level != SMB_REQUEST_TRANSPORT_ENCRYPTION &&
+				info_level != SMB_SET_CIFS_UNIX_INFO) {
+			DEBUG(0,("call_trans2setfsinfo: not an allowed "
+				"info level (0x%x) on IPC$.\n",
+				(unsigned int)info_level));
+			reply_nterror(req, NT_STATUS_ACCESS_DENIED);
+			return;
+		}
+	}
+
+	if (ENCRYPTION_REQUIRED(conn) && !req->encrypted) {
+		if (info_level != SMB_REQUEST_TRANSPORT_ENCRYPTION) {
+			DEBUG(0,("call_trans2setfsinfo: encryption required "
+				"and info level 0x%x sent.\n",
+				(unsigned int)info_level));
+			exit_server_cleanly("encryption required "
+				"on connection");
+			return;
+		}
+	}
+
 	switch(info_level) {
 		case SMB_SET_CIFS_UNIX_INFO:
 			{
@@ -2998,6 +3026,62 @@ cap_low = 0x%x, cap_high = 0x%x\n",
 				}
 				break;
 			}
+
+		case SMB_REQUEST_TRANSPORT_ENCRYPTION:
+			{
+				NTSTATUS status;
+				size_t param_len = 0;
+				size_t data_len = total_data;
+
+				if (!lp_unix_extensions()) {
+					reply_nterror(
+						req,
+						NT_STATUS_INVALID_LEVEL);
+					return;
+				}
+
+				if (lp_smb_encrypt(SNUM(conn)) == false) {
+					reply_nterror(
+						req,
+						NT_STATUS_NOT_SUPPORTED);
+					return;
+				}
+
+				DEBUG( 4,("call_trans2setfsinfo: "
+					"request transport encrption.\n"));
+
+				status = srv_request_encryption_setup(conn,
+								(unsigned char **)ppdata,
+								&data_len,
+								(unsigned char **)pparams,
+								&param_len);
+
+				if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
+						!NT_STATUS_IS_OK(status)) {
+					reply_nterror(req, status);
+					return;
+				}
+
+				send_trans2_replies(conn, req,
+						*pparams,
+						param_len,
+						*ppdata,
+						data_len,
+						max_data_bytes);
+
+				if (NT_STATUS_IS_OK(status)) {
+					/* Server-side transport
+					 * encryption is now *on*. */
+					status = srv_encryption_start(conn);
+					if (!NT_STATUS_IS_OK(status)) {
+						exit_server_cleanly(
+							"Failure in setting "
+							"up encrypted transport");
+					}
+				}
+				return;
+			}
+
 		case SMB_FS_QUOTA_INFORMATION:
 			{
 				files_struct *fsp = NULL;
@@ -3454,7 +3538,7 @@ static void call_trans2qpipeinfo(connection_struct *conn,
 			return;
 	}
 
-	send_trans2_replies(req, params, param_size, *ppdata, data_size,
+	send_trans2_replies(conn, req, params, param_size, *ppdata, data_size,
 			    max_data_bytes);
 
 	return;
@@ -4386,7 +4470,7 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 			return;
 	}
 
-	send_trans2_replies(req, params, param_size, *ppdata, data_size,
+	send_trans2_replies(conn, req, params, param_size, *ppdata, data_size,
 			    max_data_bytes);
 
 	return;
@@ -5090,8 +5174,7 @@ static NTSTATUS smb_set_posix_acl(connection_struct *conn,
 ****************************************************************************/
 
 static NTSTATUS smb_set_posix_lock(connection_struct *conn,
-				const uint8 *inbuf,
-				int length,
+				const struct smb_request *req,
 				const char *pdata,
 				int total_data,
 				files_struct *fsp)
@@ -5101,6 +5184,7 @@ static NTSTATUS smb_set_posix_lock(connection_struct *conn,
 	uint32 lock_pid;
 	bool blocking_lock = False;
 	enum brl_type lock_type;
+
 	NTSTATUS status = NT_STATUS_OK;
 
 	if (fsp == NULL || fsp->fh->fd == -1) {
@@ -5188,7 +5272,7 @@ static NTSTATUS smb_set_posix_lock(connection_struct *conn,
 			 * onto the blocking lock queue.
 			 */
 			if(push_blocking_lock_request(br_lck,
-						(char *)inbuf, length,
+						req,
 						fsp,
 						-1, /* infinite timeout. */
 						0,
@@ -6246,7 +6330,7 @@ static void call_trans2setfilepathinfo(connection_struct *conn,
 				DEBUG(3,("call_trans2setfilepathinfo: Cancelling print job (%s)\n", fsp->fsp_name ));
 
 				SSVAL(params,0,0);
-				send_trans2_replies(req, params, 2,
+				send_trans2_replies(conn, req, params, 2,
 						    *ppdata, 0,
 						    max_data_bytes);
 				return;
@@ -6536,8 +6620,7 @@ static void call_trans2setfilepathinfo(connection_struct *conn,
 				reply_nterror(req, NT_STATUS_INVALID_LEVEL);
 				return;
 			}
-			status = smb_set_posix_lock(conn, req->inbuf,
-						    smb_len(req->inbuf) + 4,
+			status = smb_set_posix_lock(conn, req,
 						    pdata, total_data, fsp);
 			break;
 		}
@@ -6605,7 +6688,7 @@ static void call_trans2setfilepathinfo(connection_struct *conn,
 	}
 
 	SSVAL(params,0,0);
-	send_trans2_replies(req, params, 2, *ppdata, data_return_size,
+	send_trans2_replies(conn, req, params, 2, *ppdata, data_return_size,
 			    max_data_bytes);
   
 	return;
@@ -6697,7 +6780,7 @@ static void call_trans2mkdir(connection_struct *conn, struct smb_request *req,
 		return;
 	}
 
-	status = create_directory(conn, directory);
+	status = create_directory(conn, req, directory);
 
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
@@ -6723,7 +6806,7 @@ static void call_trans2mkdir(connection_struct *conn, struct smb_request *req,
 
 	SSVAL(params,0,0);
 
-	send_trans2_replies(req, params, 2, *ppdata, 0, max_data_bytes);
+	send_trans2_replies(conn, req, params, 2, *ppdata, 0, max_data_bytes);
   
 	return;
 }
@@ -6777,7 +6860,7 @@ static void call_trans2findnotifyfirst(connection_struct *conn,
 	if(fnf_handle == 0)
 		fnf_handle = 257;
 
-	send_trans2_replies(req, params, 6, *ppdata, 0, max_data_bytes);
+	send_trans2_replies(conn, req, params, 6, *ppdata, 0, max_data_bytes);
   
 	return;
 }
@@ -6808,7 +6891,7 @@ static void call_trans2findnotifynext(connection_struct *conn,
 	SSVAL(params,0,0); /* No changes */
 	SSVAL(params,2,0); /* No EA errors */
 
-	send_trans2_replies(req, params, 4, *ppdata, 0, max_data_bytes);
+	send_trans2_replies(conn, req, params, 4, *ppdata, 0, max_data_bytes);
   
 	return;
 }
@@ -6858,7 +6941,7 @@ static void call_trans2getdfsreferral(connection_struct *conn,
 
 	SSVAL(req->inbuf, smb_flg2,
 	      SVAL(req->inbuf,smb_flg2) | FLAGS2_DFS_PATHNAMES);
-	send_trans2_replies(req,0,0,*ppdata,reply_size, max_data_bytes);
+	send_trans2_replies(conn, req,0,0,*ppdata,reply_size, max_data_bytes);
 
 	return;
 }
@@ -6905,7 +6988,7 @@ static void call_trans2ioctl(connection_struct *conn,
 		srvstr_push(pdata, req->flags2, pdata+18,
 			    lp_servicename(SNUM(conn)), 13,
 			    STR_ASCII|STR_TERMINATE); /* Service name */
-		send_trans2_replies(req, *pparams, 0, *ppdata, 32,
+		send_trans2_replies(conn, req, *pparams, 0, *ppdata, 32,
 				    max_data_bytes);
 		return;
 	}
@@ -6918,7 +7001,7 @@ static void call_trans2ioctl(connection_struct *conn,
  Reply to a SMBfindclose (stop trans2 directory search).
 ****************************************************************************/
 
-void reply_findclose(connection_struct *conn, struct smb_request *req)
+void reply_findclose(struct smb_request *req)
 {
 	int dptr_num;
 
@@ -6948,7 +7031,7 @@ void reply_findclose(connection_struct *conn, struct smb_request *req)
  Reply to a SMBfindnclose (stop FINDNOTIFYFIRST directory search).
 ****************************************************************************/
 
-void reply_findnclose(connection_struct *conn, struct smb_request *req)
+void reply_findnclose(struct smb_request *req)
 {
 	int dptr_num;
 
@@ -6984,6 +7067,17 @@ static void handle_trans2(connection_struct *conn, struct smb_request *req,
 		SSVAL(req->inbuf,smb_flg2,req->flags2);
 	}
 
+	if (conn->encrypt_level == Required && !req->encrypted) {
+		if (state->call != TRANSACT2_QFSINFO &&
+				state->call != TRANSACT2_SETFSINFO) {
+			DEBUG(0,("handle_trans2: encryption required "
+				"with call 0x%x\n",
+				(unsigned int)state->call));
+			reply_nterror(req, NT_STATUS_ACCESS_DENIED);
+			return;
+		}
+	}
+
 	/* Now we must call the relevant TRANS2 function */
 	switch(state->call)  {
 	case TRANSACT2_OPEN:
@@ -7131,8 +7225,9 @@ static void handle_trans2(connection_struct *conn, struct smb_request *req,
  Reply to a SMBtrans2.
  ****************************************************************************/
 
-void reply_trans2(connection_struct *conn, struct smb_request *req)
+void reply_trans2(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	unsigned int dsoff;
 	unsigned int dscnt;
 	unsigned int psoff;
@@ -7166,12 +7261,20 @@ void reply_trans2(connection_struct *conn, struct smb_request *req)
 		return;
 	}
 
-	if (IS_IPC(conn) && (tran_call != TRANSACT2_OPEN)
-            && (tran_call != TRANSACT2_GET_DFS_REFERRAL)
-            && (tran_call != TRANSACT2_QFILEINFO)) {
-		reply_doserror(req, ERRSRV, ERRaccess);
-		END_PROFILE(SMBtrans2);
-		return;
+	if (IS_IPC(conn)) {
+		switch (tran_call) {
+		/* List the allowed trans2 calls on IPC$ */
+		case TRANSACT2_OPEN:
+		case TRANSACT2_GET_DFS_REFERRAL:
+		case TRANSACT2_QFILEINFO:
+		case TRANSACT2_QFSINFO:
+		case TRANSACT2_SETFSINFO:
+			break;
+		default:
+			reply_doserror(req, ERRSRV, ERRaccess);
+			END_PROFILE(SMBtrans2);
+			return;
+		}
 	}
 
 	if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
@@ -7312,8 +7415,9 @@ void reply_trans2(connection_struct *conn, struct smb_request *req)
  Reply to a SMBtranss2
  ****************************************************************************/
 
-void reply_transs2(connection_struct *conn, struct smb_request *req)
+void reply_transs2(struct smb_request *req)
 {
+	connection_struct *conn = req->conn;
 	unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
 	struct trans_state *state;
 	int size;
diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c
index fefae38932..ed0406211d 100644
--- a/source3/smbd/vfs.c
+++ b/source3/smbd/vfs.c
@@ -31,7 +31,7 @@ static_decl_vfs;
 
 struct vfs_init_function_entry {
 	char *name;
- 	vfs_op_tuple *vfs_op_tuples;
+	const vfs_op_tuple *vfs_op_tuples;
 	struct vfs_init_function_entry *prev, *next;
 };
 
@@ -55,7 +55,7 @@ static struct vfs_init_function_entry *vfs_find_backend_entry(const char *name)
 	return NULL;
 }
 
-NTSTATUS smb_register_vfs(int version, const char *name, vfs_op_tuple *vfs_op_tuples)
+NTSTATUS smb_register_vfs(int version, const char *name, const vfs_op_tuple *vfs_op_tuples)
 {
 	struct vfs_init_function_entry *entry = backends;
 
@@ -110,13 +110,13 @@ static inline void vfs_set_operation(struct vfs_ops * vfs, vfs_op_type which,
 
 bool vfs_init_custom(connection_struct *conn, const char *vfs_object)
 {
-	vfs_op_tuple *ops;
+	const vfs_op_tuple *ops;
 	char *module_path = NULL;
 	char *module_name = NULL;
 	char *module_param = NULL, *p;
 	int i;
 	vfs_handle_struct *handle;
-	struct vfs_init_function_entry *entry;
+	const struct vfs_init_function_entry *entry;
 	
 	if (!conn||!vfs_object||!vfs_object[0]) {
 		DEBUG(0,("vfs_init_custon() called with NULL pointer or emtpy vfs_object!\n"));