1 files changed, 161 insertions, 173 deletions

diff --git a/source/smbd/reply.c b/source/smbd/reply.c
index 41970c4040f..fc77a5424f4 100644
--- a/source/smbd/reply.c
+++ b/source/smbd/reply.c
@@ -114,9 +114,8 @@ int reply_special(char *inbuf,char *outbuf)
 			break;
 		}
 
-		/* only add the client's machine name to the list
-		   of possibly valid usernames if we are operating
-		   in share mode security */
+		/* add it as a possible user name if we 
+		   are in share mode security */
 		if (lp_security() == SEC_SHARE) {
 			add_session_user(remote_machine);
 		}
@@ -167,6 +166,41 @@ static int connection_error(char *inbuf,char *outbuf,int ecode)
 }
 
 
+
+/****************************************************************************
+  parse a share descriptor string
+****************************************************************************/
+static void parse_connect(char *p,char *service,char *user,
+			  char *password,int *pwlen,char *dev)
+{
+  char *p2;
+
+  DEBUG(4,("parsing connect string %s\n",p));
+    
+  p2 = strrchr(p,'\\');
+  if (p2 == NULL)
+    fstrcpy(service,p);
+  else
+    fstrcpy(service,p2+1);
+  
+  p += strlen(p) + 2;
+  
+  fstrcpy(password,p);
+  *pwlen = strlen(password);
+
+  p += strlen(p) + 2;
+
+  fstrcpy(dev,p);
+  
+  *user = 0;
+  p = strchr(service,'%');
+  if (p != NULL)
+    {
+      *p = 0;
+      fstrcpy(user,p+1);
+    }
+}
+
 /****************************************************************************
  Reply to a tcon.
 ****************************************************************************/
@@ -183,34 +217,17 @@ int reply_tcon(connection_struct *conn,
 	uint16 vuid = SVAL(inbuf,smb_uid);
 	int pwlen=0;
 	int ecode = -1;
-	char *p;
-
 	START_PROFILE(SMBtcon);
 
 	*service = *user = *password = *dev = 0;
 
-	p = smb_buf(inbuf)+1;
-	p += srvstr_pull(inbuf, service, p, sizeof(service), -1, STR_TERMINATE|STR_CONVERT) + 1;
-	p += srvstr_pull(inbuf, password, p, sizeof(password), -1, STR_TERMINATE|STR_CONVERT) + 1;
-	p += srvstr_pull(inbuf, dev, p, sizeof(dev), -1, STR_TERMINATE|STR_CONVERT) + 1;
+	parse_connect(smb_buf(inbuf)+1,service,user,password,&pwlen,dev);
 
-	*user = 0;
-	p = strchr(service,'%');
-	if (p != NULL) {
-		*p = 0;
-		fstrcpy(user,p+1);
-	}
-
-	p = strrchr(service,'\\');
-	if (p) {
-		pstrcpy(service, p+1);
-	}
+    /*
+     * Ensure the user and password names are in UNIX codepage format.
+     */
 
-	/*
-	 * Ensure the user and password names are in UNIX codepage format.
-	 */
-	
-	dos_to_unix(user,True);
+    dos_to_unix(user,True);
 	if (!doencrypt)
     	dos_to_unix(password,True);
 
@@ -254,11 +271,12 @@ int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
 	pstring user;
 	pstring password;
 	pstring devicename;
+	BOOL doencrypt = SMBENCRYPT();
 	int ecode = -1;
 	uint16 vuid = SVAL(inbuf,smb_uid);
 	int passlen = SVAL(inbuf,smb_vwv3);
-	pstring path;
-	char *p, *q;
+	char *path;
+	char *p;
 	START_PROFILE(SMBtconX);
 	
 	*service = *user = *password = *devicename = 0;
@@ -274,8 +292,7 @@ int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
  
 	memcpy(password,smb_buf(inbuf),passlen);
 	password[passlen]=0;    
-	p = smb_buf(inbuf) + passlen;
-	p += srvstr_pull(inbuf, path, p, sizeof(path), -1, STR_TERMINATE|STR_CONVERT);
+	path = smb_buf(inbuf) + passlen;
 
 	if (passlen != 24) {
 		if (strequal(password," "))
@@ -283,22 +300,29 @@ int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
 		passlen = strlen(password);
 	}
 	
-	q = strchr(path+2,'\\');
-	if (!q) {
+	p = strchr(path+2,'\\');
+	if (!p) {
 		END_PROFILE(SMBtconX);
 		return(ERROR(ERRDOS,ERRnosuchshare));
 	}
-	fstrcpy(service,q+1);
-	q = strchr(service,'%');
-	if (q) {
-		*q++ = 0;
-		fstrcpy(user,q);
+	fstrcpy(service,p+1);
+	p = strchr(service,'%');
+	if (p) {
+		*p++ = 0;
+		fstrcpy(user,p);
 	}
-	p += srvstr_pull(inbuf, devicename, p, sizeof(devicename), 6, STR_CONVERT|STR_ASCII);
-
+	StrnCpy(devicename,path + strlen(path) + 1,6);
 	DEBUG(4,("Got device type %s\n",devicename));
 
 	/*
+	 * Ensure the user and password names are in UNIX codepage format.
+	 */
+
+	dos_to_unix(user,True);
+	if (!doencrypt)
+		dos_to_unix(password,True);
+
+	/*
 	 * Pass the user through the NT -> unix user mapping
 	 * function.
 	 */
@@ -318,24 +342,18 @@ int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
 	}
 
 	if (Protocol < PROTOCOL_NT1) {
-		set_message(outbuf,2,0,True);
-		p = smb_buf(outbuf);
-		p += srvstr_push(outbuf, p, devicename, -1, 
-				 STR_CONVERT|STR_TERMINATE|STR_ASCII);
-		set_message_end(outbuf,p);
+		set_message(outbuf,2,strlen(devicename)+1,True);
+		pstrcpy(smb_buf(outbuf),devicename);
 	} else {
-		/* NT sets the fstype of IPC$ to the null string */
-		char *fsname = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
+		char *fsname = lp_fstype(SNUM(conn));
 
-		set_message(outbuf,3,0,True);
+		set_message(outbuf,3,3,True);
 
 		p = smb_buf(outbuf);
-		p += srvstr_push(outbuf, p, devicename, -1, 
-				 STR_CONVERT|STR_TERMINATE|STR_ASCII);
-		p += srvstr_push(outbuf, p, fsname, -1, 
-				 STR_CONVERT|STR_TERMINATE);
+		pstrcpy(p,devicename); p = skip_string(p,1); /* device name */
+		pstrcpy(p,fsname); p = skip_string(p,1); /* filesystem type e.g NTFS */
 		
-		set_message_end(outbuf,p);
+		set_message(outbuf,3,PTR_DIFF(p,smb_buf(outbuf)),False);
 		
 		/* what does setting this bit do? It is set by NT4 and
 		   may affect the ability to autorun mounted cdroms */
@@ -408,8 +426,8 @@ int reply_ioctl(connection_struct *conn,
 	{
 	    case IOCTL_QUERY_JOB_INFO:		    
 		SSVAL(p,0,fsp->print_jobid);             /* Job number */
-		srvstr_push(outbuf, p+2, global_myname, 15, STR_TERMINATE|STR_CONVERT|STR_ASCII);
-		srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_CONVERT|STR_ASCII);
+		StrnCpy(p+2, global_myname, 15);         /* Our NetBIOS name */
+		StrnCpy(p+18, lp_servicename(SNUM(conn)), 13); /* Service name */
 		break;
 	}
 
@@ -424,66 +442,54 @@ static int session_trust_account(connection_struct *conn, char *inbuf, char *out
                                 char *smb_passwd, int smb_passlen,
                                 char *smb_nt_passwd, int smb_nt_passlen)
 {
-  /* check if trust account exists */
-  SAM_ACCOUNT 	*sam_trust_acct = NULL; 
-  uint16	acct_ctrl;
-  BOOL ret;
-  
-  pdb_init_sam(&sam_trust_acct);
-
+  struct smb_passwd *smb_trust_acct = NULL; /* check if trust account exists */
   if (lp_security() == SEC_USER) {
-    ret = pdb_getsampwnam(sam_trust_acct, user);
+    smb_trust_acct = getsmbpwnam(user);
   } else {
     DEBUG(0,("session_trust_account: Trust account %s only supported with security = user\n", user));
-    SSVAL(outbuf, smb_flg2, SVAL(outbuf, smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
-    pdb_free_sam(sam_trust_acct);
+    SSVAL(outbuf, smb_flg2, FLAGS2_32_BIT_ERROR_CODES);
     return(ERROR(0, NT_STATUS_LOGON_FAILURE));
   }
 
-  if (ret == False) {
+  if (smb_trust_acct == NULL) {
     /* lkclXXXX: workstation entry doesn't exist */
     DEBUG(0,("session_trust_account: Trust account %s user doesn't exist\n",user));
-    SSVAL(outbuf, smb_flg2, SVAL(outbuf, smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
-    pdb_free_sam(sam_trust_acct);
+    SSVAL(outbuf, smb_flg2, FLAGS2_32_BIT_ERROR_CODES);
     return(ERROR(0, NT_STATUS_NO_SUCH_USER));
   } else {
     if ((smb_passlen != 24) || (smb_nt_passlen != 24)) {
       DEBUG(0,("session_trust_account: Trust account %s - password length wrong.\n", user));
-      SSVAL(outbuf, smb_flg2, SVAL(outbuf, smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
-     pdb_free_sam(sam_trust_acct);
-     return(ERROR(0, NT_STATUS_LOGON_FAILURE));
+      SSVAL(outbuf, smb_flg2, FLAGS2_32_BIT_ERROR_CODES);
+      return(ERROR(0, NT_STATUS_LOGON_FAILURE));
     }
 
-    if (!smb_password_ok(sam_trust_acct, NULL, (unsigned char *)smb_passwd, (unsigned char *)smb_nt_passwd)) {
+    if (!smb_password_ok(smb_trust_acct, NULL, (unsigned char *)smb_passwd, (unsigned char *)smb_nt_passwd)) {
       DEBUG(0,("session_trust_account: Trust Account %s - password failed\n", user));
-      SSVAL(outbuf, smb_flg2, SVAL(outbuf, smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
-    pdb_free_sam(sam_trust_acct);
+      SSVAL(outbuf, smb_flg2, FLAGS2_32_BIT_ERROR_CODES);
       return(ERROR(0, NT_STATUS_LOGON_FAILURE));
     }
 
-    acct_ctrl = pdb_get_acct_ctrl(sam_trust_acct);
-    pdb_free_sam(sam_trust_acct);
-    if (acct_ctrl & ACB_DOMTRUST) {
+    if (smb_trust_acct->acct_ctrl & ACB_DOMTRUST) {
       DEBUG(0,("session_trust_account: Domain trust account %s denied by server\n",user));
-      SSVAL(outbuf, smb_flg2, SVAL(outbuf, smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
+      SSVAL(outbuf, smb_flg2, FLAGS2_32_BIT_ERROR_CODES);
       return(ERROR(0, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT));
     }
 
-    if (acct_ctrl & ACB_SVRTRUST) {
+    if (smb_trust_acct->acct_ctrl & ACB_SVRTRUST) {
       DEBUG(0,("session_trust_account: Server trust account %s denied by server\n",user));
-      SSVAL(outbuf, smb_flg2, SVAL(outbuf, smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
+      SSVAL(outbuf, smb_flg2, FLAGS2_32_BIT_ERROR_CODES);
       return(ERROR(0, NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT));
     }
 
-    if (acct_ctrl & ACB_WSTRUST) {
+    if (smb_trust_acct->acct_ctrl & ACB_WSTRUST) {
       DEBUG(4,("session_trust_account: Wksta trust account %s denied by server\n", user));
-      SSVAL(outbuf, smb_flg2, SVAL(outbuf, smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
+      SSVAL(outbuf, smb_flg2, FLAGS2_32_BIT_ERROR_CODES);
       return(ERROR(0, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT));
     }
   }
 
   /* don't know what to do: indicate logon failure */
-  SSVAL(outbuf, smb_flg2, SVAL(outbuf, smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
+  SSVAL(outbuf, smb_flg2, FLAGS2_32_BIT_ERROR_CODES);
   return(ERROR(0, NT_STATUS_LOGON_FAILURE));
 }
 
@@ -564,7 +570,7 @@ static BOOL check_server_security(char *orig_user, char *domain, char *unix_user
                             smb_apasswd, smb_apasslen, 
                             smb_ntpasswd, smb_ntpasslen);
   if(ret) {
-    struct passwd *pwd=NULL;
+    struct passwd *pwd = NULL;
 
     /*
      * User validated ok against Domain controller.
@@ -605,7 +611,7 @@ static BOOL check_domain_security(char *orig_user, char *domain, char *unix_user
 {
   BOOL ret = False;
   BOOL user_exists = True;
-  struct passwd *pwd=NULL;
+  struct passwd *pwd = NULL;
 
   if(lp_security() != SEC_DOMAIN)
     return False;
@@ -666,7 +672,7 @@ static int bad_password_error(char *inbuf,char *outbuf)
 
   if(((ra_type == RA_WINNT) || (ra_type == RA_WIN2K)) &&
       (global_client_caps & (CAP_NT_SMBS | CAP_STATUS32 ))) {
-    SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) | FLAGS2_32_BIT_ERROR_CODES);
+    SSVAL(outbuf,smb_flg2,FLAGS2_32_BIT_ERROR_CODES);
     return(ERROR(0,NT_STATUS_LOGON_FAILURE));
   }
 
@@ -691,12 +697,10 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf,int
   BOOL valid_lm_password = False;
   pstring user;
   pstring orig_user;
-  fstring domain;
-  fstring native_os;
-  fstring native_lanman;
   BOOL guest=False;
   static BOOL done_sesssetup = False;
   BOOL doencrypt = SMBENCRYPT();
+  char *domain = "";
   START_PROFILE(SMBsesssetupX);
 
   *smb_apasswd = 0;
@@ -711,7 +715,12 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf,int
 
     memcpy(smb_apasswd,smb_buf(inbuf),smb_apasslen);
     smb_apasswd[smb_apasslen] = 0;
-    srvstr_pull(inbuf, user, smb_buf(inbuf)+smb_apasslen, sizeof(user), -1, STR_TERMINATE|STR_CONVERT);
+    pstrcpy(user,smb_buf(inbuf)+smb_apasslen);
+    /*
+     * Incoming user is in DOS codepage format. Convert
+     * to UNIX.
+     */
+    dos_to_unix(user,True);
   
     if (!doencrypt && (lp_security() != SEC_SERVER)) {
       smb_apasslen = strlen(smb_apasswd);
@@ -820,19 +829,17 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf,int
     }
     
     p += passlen1 + passlen2;
-    p += srvstr_pull(inbuf, user, p, sizeof(user), -1, STR_CONVERT|STR_TERMINATE);
+    fstrcpy(user,p);
+    p = skip_string(p,1);
     /*
      * Incoming user and domain are in DOS codepage format. Convert
      * to UNIX.
      */
-    p += srvstr_pull(inbuf, domain, p, sizeof(domain), 
-		     -1, STR_CONVERT|STR_TERMINATE);
-    p += srvstr_pull(inbuf, native_os, p, sizeof(native_os), 
-		     -1, STR_CONVERT|STR_TERMINATE);
-    p += srvstr_pull(inbuf, native_lanman, p, sizeof(native_lanman),
-		     -1, STR_CONVERT|STR_TERMINATE);
+    dos_to_unix(user,True);
+    domain = p;
+    dos_to_unix(domain, True);
     DEBUG(3,("Domain=[%s]  NativeOS=[%s] NativeLanMan=[%s]\n",
-	     domain,native_os,native_lanman));
+	     domain,skip_string(p,1),skip_string(p,2)));
   }
 
   DEBUG(3,("sesssetupX:name=[%s]\n",user));
@@ -887,10 +894,7 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf,int
      that */
   if (!sys_getpwnam(user)) {
 	  pstring user2;
-
-	  slprintf(user2,sizeof(user2)-1,"%s%s%s", dos_to_unix(domain,False), 
-		   lp_winbind_separator(), user);
-
+	  slprintf(user2,sizeof(user2)-1,"%s%s%s", dos_to_unix(domain,False), lp_winbind_separator(), user);
 	  if (sys_getpwnam(user2)) {
 		  DEBUG(3,("Using unix username %s\n", user2));
 		  pstrcpy(user, user2);
@@ -1014,12 +1018,12 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf,int
     set_message(outbuf,3,0,True);
   } else {
     char *p;
-    set_message(outbuf,3,0,True);
+    set_message(outbuf,3,3,True);
     p = smb_buf(outbuf);
-    p += srvstr_push(outbuf, p, "Unix", -1, STR_TERMINATE|STR_CONVERT);
-    p += srvstr_push(outbuf, p, "Samba", -1, STR_TERMINATE|STR_CONVERT);
-    p += srvstr_push(outbuf, p, global_myworkgroup, -1, STR_TERMINATE|STR_CONVERT);
-    set_message_end(outbuf,p);
+    pstrcpy(p,"Unix"); p = skip_string(p,1);
+    pstrcpy(p,"Samba "); pstrcat(p,VERSION); p = skip_string(p,1);
+    pstrcpy(p,global_myworkgroup); unix_to_dos(p, True); p = skip_string(p,1);
+    set_message(outbuf,3,PTR_DIFF(p,smb_buf(outbuf)),False);
     /* perhaps grab OS version here?? */
   }
 
@@ -1078,8 +1082,8 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
   BOOL bad_path = False;
   SMB_STRUCT_STAT sbuf;
   START_PROFILE(SMBchkpth);
-
-  srvstr_pull(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), -1, STR_TERMINATE);
+ 
+  pstrcpy(name,smb_buf(inbuf) + 1);
 
   RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
 
@@ -1140,11 +1144,9 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
   SMB_OFF_T size=0;
   time_t mtime=0;
   BOOL bad_path = False;
-  char *p;
   START_PROFILE(SMBgetatr);
-
-  p = smb_buf(inbuf) + 1;
-  p += srvstr_pull(inbuf, fname, p, sizeof(fname), -1, STR_TERMINATE);
+ 
+  pstrcpy(fname,smb_buf(inbuf) + 1);
 
   RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
   
@@ -1201,7 +1203,11 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
   SIVAL(outbuf,smb_vwv3,(uint32)size);
 
   if (Protocol >= PROTOCOL_NT1) {
-	  SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) | 0x40); /* IS_LONG_NAME */
+    char *p = strrchr(fname,'/');
+    uint16 flg2 = SVAL(outbuf,smb_flg2);
+    if (!p) p = fname;
+    if (!is_8_3(fname, True))
+      SSVAL(outbuf,smb_flg2,flg2 | 0x40); /* IS_LONG_NAME */
   }
   
   DEBUG( 3, ( "getatr name=%s mode=%d size=%d\n", fname, mode, (uint32)size ) );
@@ -1223,12 +1229,9 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
   time_t mtime;
   SMB_STRUCT_STAT sbuf;
   BOOL bad_path = False;
-  char *p;
-
   START_PROFILE(SMBsetatr);
-
-  p = smb_buf(inbuf) + 1;
-  p += srvstr_pull(inbuf, fname, p, sizeof(fname), -1, STR_TERMINATE);
+ 
+  pstrcpy(fname,smb_buf(inbuf) + 1);
   unix_convert(fname,conn,0,&bad_path,&sbuf);
 
   mode = SVAL(inbuf,smb_vwv0);
@@ -1308,7 +1311,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
   char *p;
   BOOL ok = False;
   int status_len;
-  pstring path;
+  char *path;
   char status[21];
   int dptr_num= -1;
   BOOL check_descend = False;
@@ -1326,11 +1329,9 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
   outsize = set_message(outbuf,1,3,True);
   maxentries = SVAL(inbuf,smb_vwv0); 
   dirtype = SVAL(inbuf,smb_vwv1);
-  p = smb_buf(inbuf) + 1;
-  p += srvstr_pull(inbuf, path, p, sizeof(path), -1, STR_TERMINATE);
-  p++;
-  status_len = SVAL(p, 0);
-  p += 2;
+  path = smb_buf(inbuf) + 1;
+  status_len = SVAL(smb_buf(inbuf),3 + strlen(path));
+
   
   /* dirtype &= ~aDIR; */
   
@@ -1339,8 +1340,8 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
     SMB_STRUCT_STAT sbuf;
     pstring dir2;
 
-    pstrcpy(directory,path);
-    pstrcpy(dir2,path);
+    pstrcpy(directory,smb_buf(inbuf)+1);
+    pstrcpy(dir2,smb_buf(inbuf)+1);
     unix_convert(directory,conn,0,&bad_path,&sbuf);
     unix_format(dir2);
 
@@ -1372,7 +1373,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
   }
   else
   {
-    memcpy(status,p,21);
+    memcpy(status,smb_buf(inbuf) + 1 + strlen(path) + 4,21);
     dirtype = CVAL(status,0) & 0x1F;
     conn->dirptr = dptr_fetch(status+12,&dptr_num);      
     if (!conn->dirptr)
@@ -1479,7 +1480,8 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
   SSVAL(smb_buf(outbuf),1,numentries*DIR_STRUCT_SIZE);
 
   if (Protocol >= PROTOCOL_NT1) {
-    SSVAL(outbuf,smb_flg2,SVAL(outbuf, smb_flg2) | 0x40); /* IS_LONG_NAME */
+    uint16 flg2 = SVAL(outbuf,smb_flg2);
+    SSVAL(outbuf,smb_flg2,flg2 | 0x40); /* IS_LONG_NAME */
   }
   
   outsize += DIR_STRUCT_SIZE*numentries;
@@ -1504,26 +1506,22 @@ int reply_fclose(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 {
   int outsize = 0;
   int status_len;
-  pstring path;
+  char *path;
   char status[21];
   int dptr_num= -2;
-  char *p;
-
   START_PROFILE(SMBfclose);
 
   outsize = set_message(outbuf,1,0,True);
-  p = smb_buf(inbuf) + 1;
-  p += srvstr_pull(inbuf, path, p, sizeof(path), -1, STR_TERMINATE|STR_CONVERT);
-  p++;
-  status_len = SVAL(p,0);
-  p += 2;
+  path = smb_buf(inbuf) + 1;
+  status_len = SVAL(smb_buf(inbuf),3 + strlen(path));
 
+  
   if (status_len == 0) {
     END_PROFILE(SMBfclose);
     return(ERROR(ERRSRV,ERRsrverror));
   }
 
-  memcpy(status,p,21);
+  memcpy(status,smb_buf(inbuf) + 1 + strlen(path) + 4,21);
 
   if(dptr_fetch(status+12,&dptr_num)) {
     /*  Close the dptr - we know it's gone */
@@ -1561,7 +1559,7 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
  
   share_mode = SVAL(inbuf,smb_vwv0);
 
-  srvstr_pull(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), -1, STR_TERMINATE);
+  pstrcpy(fname,smb_buf(inbuf)+1);
 
   RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
@@ -1655,7 +1653,8 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
   }
 
   /* XXXX we need to handle passed times, sattr and flags */
-  srvstr_pull(inbuf, fname, smb_buf(inbuf), sizeof(fname), -1, STR_TERMINATE);
+
+  pstrcpy(fname,smb_buf(inbuf));
 
   RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
@@ -1778,7 +1777,7 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
   com = SVAL(inbuf,smb_com);
 
   createmode = SVAL(inbuf,smb_vwv0);
-  srvstr_pull(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), -1, STR_TERMINATE);
+  pstrcpy(fname,smb_buf(inbuf)+1);
 
   RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
@@ -1841,44 +1840,39 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 {
   pstring fname;
-  pstring fname2;
   int outsize = 0;
   int createmode;
-  mode_t unixmode;
+  mode_t unixmode = 0600;
   BOOL bad_path = False;
   files_struct *fsp;
   int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
   int tmpfd;
   SMB_STRUCT_STAT sbuf;
-  char *p;
 
   START_PROFILE(SMBctemp);
 
   createmode = SVAL(inbuf,smb_vwv0);
-  srvstr_pull(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), -1, STR_TERMINATE|STR_CONVERT);
+  pstrcpy(fname,smb_buf(inbuf)+1);
   pstrcat(fname,"/TMXXXXXX");
 
   RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
   unix_convert(fname,conn,0,&bad_path,&sbuf);
   
-  unixmode = unix_mode(conn,createmode,fname);
-  
   tmpfd = smb_mkstemp(fname);
   if (tmpfd == -1) {
-      END_PROFILE(SMBctemp);
-      return(UNIXERROR(ERRDOS,ERRnoaccess));
+	  END_PROFILE(SMBctemp);
+	  return(UNIXERROR(ERRDOS,ERRnoaccess));
   }
 
-  vfs_stat(conn,fname2,&sbuf);
+  vfs_stat(conn,fname,&sbuf);
 
   /* Open file in dos compatibility share mode. */
   /* We should fail if file does not exist. */
   fsp = open_file_shared(conn,fname,&sbuf,
-             SET_DENY_MODE(DENY_FCB)|SET_OPEN_MODE(DOS_OPEN_FCB),
-             FILE_FAIL_IF_NOT_EXIST,
-             unixmode, oplock_request, NULL, NULL);
-
+			 SET_DENY_MODE(DENY_FCB)|SET_OPEN_MODE(DOS_OPEN_FCB), 
+			 FILE_FAIL_IF_NOT_EXIST, 
+			 unixmode, oplock_request, NULL, NULL);
   /* close fd from smb_mkstemp() */
   close(tmpfd);
 
@@ -1893,12 +1887,10 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
     return(UNIXERROR(ERRDOS,ERRnoaccess));
   }
 
-  outsize = set_message(outbuf,1,0,True);
+  outsize = set_message(outbuf,1,2 + strlen(fname),True);
   SSVAL(outbuf,smb_vwv0,fsp->fnum);
   CVAL(smb_buf(outbuf),0) = 4;
-  p = smb_buf(outbuf) + 1;
-  p += srvstr_push(outbuf, p, fname2, -1, STR_TERMINATE|STR_CONVERT);
-  set_message_end(outbuf, p);
+  pstrcpy(smb_buf(outbuf) + 1,fname);
 
   if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
     CVAL(outbuf,smb_flg) |= CORE_OPLOCK_GRANTED;
@@ -1907,9 +1899,9 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
   if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type))
     CVAL(outbuf,smb_flg) |= CORE_OPLOCK_GRANTED;
 
-  DEBUG( 2, ( "created temp file %s\n", fname2 ) );
+  DEBUG( 2, ( "created temp file %s\n", fname ) );
   DEBUG( 3, ( "ctemp %s fd=%d dmode=%d umode=%o\n",
-        fname2, fsp->fd, createmode, (int)unixmode ) );
+        fname, fsp->fd, createmode, (int)unixmode ) );
 
   END_PROFILE(SMBctemp);
   return(outsize);
@@ -2056,7 +2048,7 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 
   dirtype = SVAL(inbuf,smb_vwv0);
 
-  srvstr_pull(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), -1, STR_TERMINATE);
+  pstrcpy(name,smb_buf(inbuf) + 1);
 
   RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
 
@@ -3292,7 +3284,7 @@ int reply_printqueue(connection_struct *conn,
 			SSVAL(p,5, queue[i].job);
 			SIVAL(p,7,queue[i].size);
 			CVAL(p,11) = 0;
-			srvstr_push(outbuf, p+12, queue[i].user, 16, STR_CONVERT|STR_ASCII);
+			StrnCpy(p+12,queue[i].user,16);
 			p += 28;
 		}
 
@@ -3386,7 +3378,7 @@ int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
   int outsize;
   START_PROFILE(SMBmkdir);
  
-  srvstr_pull(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), -1, STR_TERMINATE);
+  pstrcpy(directory,smb_buf(inbuf) + 1);
 
   outsize=mkdir_internal(conn, inbuf, outbuf, directory);
   if(outsize == 0)
@@ -3561,7 +3553,7 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
   SMB_STRUCT_STAT sbuf;
   START_PROFILE(SMBrmdir);
 
-  srvstr_pull(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), -1, STR_TERMINATE);
+  pstrcpy(directory,smb_buf(inbuf) + 1);
 
   RESOLVE_DFSPATH(directory, conn, inbuf, outbuf)
 
@@ -3898,14 +3890,10 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, in
   int outsize = 0;
   pstring name;
   pstring newname;
-  char *p;
-
   START_PROFILE(SMBmv);
 
-  p = smb_buf(inbuf) + 1;
-  p += srvstr_pull(inbuf, name, p, sizeof(name), -1, STR_TERMINATE);
-  p++;
-  p += srvstr_pull(inbuf, newname, p, sizeof(newname), -1, STR_TERMINATE);
+  pstrcpy(name,smb_buf(inbuf) + 1);
+  pstrcpy(newname,smb_buf(inbuf) + 3 + strlen(name));
 
   RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
   RESOLVE_DFSPATH(newname, conn, inbuf, outbuf);
@@ -4033,9 +4021,8 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
   *directory = *mask = 0;
 
-  p = smb_buf(inbuf);
-  p += srvstr_pull(inbuf, name, p, sizeof(name), -1, STR_TERMINATE);
-  p += srvstr_pull(inbuf, newname, p, sizeof(newname), -1, STR_TERMINATE);
+  pstrcpy(name,smb_buf(inbuf));
+  pstrcpy(newname,smb_buf(inbuf) + 1 + strlen(name));
    
   DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
    
@@ -4186,8 +4173,9 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
     END_PROFILE(pathworks_setdir);
     return(ERROR(ERRDOS,ERRnoaccess));
   }
-
-  srvstr_pull(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), -1, STR_TERMINATE|STR_CONVERT);
+  
+  pstrcpy(newdir,smb_buf(inbuf) + 1);
+  strlower(newdir);
   
   if (strlen(newdir) == 0) {
 	  ok = True;