X-Git-Url: https://wimlib.net/git/?p=wimlib;a=blobdiff_plain;f=src%2Fntfs-3g_capture.c;h=d9a7f2f6f1c1abadf8028e748fd32e267976a4d9;hp=c0bd9076afeb472801d555a2e53dff3f8d70fcf4;hb=58ccad75516dcb536515cfb672e150670f44b957;hpb=173bcff7f6950a89ee398d6058b4df8e67cf8675

diff --git a/src/ntfs-3g_capture.c b/src/ntfs-3g_capture.c
index c0bd9076..d9a7f2f6 100644
--- a/src/ntfs-3g_capture.c
+++ b/src/ntfs-3g_capture.c
@@ -48,6 +48,48 @@
 #include "wimlib/reparse.h"
 #include "wimlib/security.h"
 
+/* NTFS-3g 2013 renamed MS_RDONLY to NTFS_MNT_RDONLY.  We can't check for the
+ * existence of NTFS_MNT_RDONLY at compilation time because it's an enum.  We
+ * also can't check for MS_RDONLY being missing because it's also a system
+ * constant.  So check if the NTFS-3g specific MS_IGNORE_HIBERFILE is defined;
+ * if yes, then we need to use the old MS_RDONLY.  */
+#ifdef MS_IGNORE_HIBERFILE
+#  define NTFS_MNT_RDONLY MS_RDONLY
+#endif
+
+/* A reference-counted NTFS volume than is automatically unmounted when the
+ * reference count reaches 0  */
+struct ntfs_volume_wrapper {
+	ntfs_volume *vol;
+	size_t refcnt;
+};
+
+/* Description of where data is located in an NTFS volume  */
+struct ntfs_location {
+	struct ntfs_volume_wrapper *volume;
+	u64 mft_no;
+	ATTR_TYPES attr_type;
+	u32 attr_name_nchars;
+	ntfschar *attr_name;
+	u64 sort_key;
+};
+
+static struct ntfs_volume_wrapper *
+get_ntfs_volume(struct ntfs_volume_wrapper *volume)
+{
+	volume->refcnt++;
+	return volume;
+}
+
+static void
+put_ntfs_volume(struct ntfs_volume_wrapper *volume)
+{
+	if (--volume->refcnt == 0) {
+		ntfs_umount(volume->vol, FALSE);
+		FREE(volume);
+	}
+}
+
 static inline const ntfschar *
 attr_record_name(const ATTR_RECORD *record)
 {
@@ -60,9 +102,7 @@ open_ntfs_attr(ntfs_inode *ni, const struct ntfs_location *loc)
 {
 	ntfs_attr *na;
 
-	na = ntfs_attr_open(ni,
-			    (ATTR_TYPES)loc->attr_type,
-			    loc->attr_name,
+	na = ntfs_attr_open(ni, loc->attr_type, loc->attr_name,
 			    loc->attr_name_nchars);
 	if (!na) {
 		ERROR_WITH_ERRNO("Failed to open attribute of NTFS inode %"PRIu64,
@@ -73,10 +113,10 @@ open_ntfs_attr(ntfs_inode *ni, const struct ntfs_location *loc)
 
 int
 read_ntfs_attribute_prefix(const struct blob_descriptor *blob, u64 size,
-			   consume_data_callback_t cb, void *cb_ctx)
+			   const struct read_blob_callbacks *cbs)
 {
 	const struct ntfs_location *loc = blob->ntfs_loc;
-	ntfs_volume *vol = loc->ntfs_vol;
+	ntfs_volume *vol = loc->volume->vol;
 	ntfs_inode *ni;
 	ntfs_attr *na;
 	s64 pos;
@@ -110,7 +150,7 @@ read_ntfs_attribute_prefix(const struct blob_descriptor *blob, u64 size,
 		}
 		pos += to_read;
 		bytes_remaining -= to_read;
-		ret = cb(buf, to_read, cb_ctx);
+		ret = call_consume_chunk(buf, to_read, cbs);
 		if (ret)
 			goto out_close_ntfs_attr;
 	}
@@ -123,35 +163,69 @@ out:
 	return ret;
 }
 
+void
+free_ntfs_location(struct ntfs_location *loc)
+{
+	put_ntfs_volume(loc->volume);
+	if (loc->attr_name != AT_UNNAMED)
+		FREE(loc->attr_name);
+	FREE(loc);
+}
+
+struct ntfs_location *
+clone_ntfs_location(const struct ntfs_location *loc)
+{
+	struct ntfs_location *new = memdup(loc, sizeof(*loc));
+	if (!new)
+		goto err0;
+	if (loc->attr_name != AT_UNNAMED) {
+		new->attr_name = utf16le_dup(loc->attr_name);
+		if (!new->attr_name)
+			goto err1;
+	}
+	new->volume = get_ntfs_volume(loc->volume);
+	return new;
+
+err1:
+	FREE(new);
+err0:
+	return NULL;
+}
+
+int
+cmp_ntfs_locations(const struct ntfs_location *loc1,
+		   const struct ntfs_location *loc2)
+{
+	return cmp_u64(loc1->sort_key, loc2->sort_key);
+}
+
+/* Read rptag and rpreserved from the NTFS inode and save them in the WIM inode.
+ */
 static int
-read_reparse_tag(ntfs_inode *ni, struct ntfs_location *loc,
-		 u32 *reparse_tag_ret)
+read_reparse_header(ntfs_inode *ni, struct wim_inode *inode)
 {
-	int ret;
-	le32 reparse_tag;
+	struct {
+		le32 rptag;
+		le16 rpdatalen;
+		le16 rpreserved;
+	} hdr;
+	s64 res;
 	ntfs_attr *na;
 
-	na = open_ntfs_attr(ni, loc);
-	if (!na) {
-		ret = WIMLIB_ERR_NTFS_3G;
-		goto out;
-	}
+	na = ntfs_attr_open(ni, AT_REPARSE_POINT, AT_UNNAMED, 0);
+	if (!na)
+		return WIMLIB_ERR_NTFS_3G;
+
+	res = ntfs_attr_pread(na, 0, sizeof(hdr), &hdr);
 
-	if (ntfs_attr_pread(na, 0, sizeof(reparse_tag),
-			    &reparse_tag) != sizeof(reparse_tag))
-	{
-		ERROR_WITH_ERRNO("Error reading reparse data");
-		ret = WIMLIB_ERR_NTFS_3G;
-		goto out_close_ntfs_attr;
-	}
-	*reparse_tag_ret = le32_to_cpu(reparse_tag);
-	DEBUG("ReparseTag = %#x", *reparse_tag_ret);
-	ret = 0;
-out_close_ntfs_attr:
 	ntfs_attr_close(na);
-out:
-	return ret;
 
+	if (res != sizeof(hdr))
+		return WIMLIB_ERR_NTFS_3G;
+
+	inode->i_reparse_tag = le32_to_cpu(hdr.rptag);
+	inode->i_rp_reserved = le16_to_cpu(hdr.rpreserved);
+	return 0;
 }
 
 static int
@@ -192,22 +266,58 @@ set_attr_sort_key(ntfs_inode *ni, struct ntfs_location *loc)
 	return 0;
 }
 
+/*
+ * Add a new stream to the specified inode, with duplicate checking.
+ *
+ * This works around a problem where NTFS-3g can list multiple unnamed data
+ * streams for a single file.  In this case we can only keep one.  We'll prefer
+ * one that is nonempty.
+ */
+static int
+add_stream(struct wim_inode *inode, const char *path, int stream_type,
+	   const utf16lechar *stream_name, struct blob_descriptor **blob_p,
+	   struct list_head *unhashed_blobs)
+{
+	struct blob_descriptor *blob = *blob_p;
+	struct wim_inode_stream *strm;
+
+	strm = inode_get_stream(inode, stream_type, stream_name);
+	if (unlikely(strm)) {
+		/* Stream already existed.  */
+		if (!blob)
+			return 0;
+		if (stream_blob_resolved(strm)) {
+			WARNING("\"%s\" has multiple nonempty streams "
+				"with the same type and name!  Only the first "
+				"will be saved.", path);
+			return 0;
+		}
+		inode_replace_stream_blob(inode, strm, blob, NULL);
+	} else {
+		strm = inode_add_stream(inode, stream_type, stream_name, blob);
+		if (unlikely(!strm))
+			return WIMLIB_ERR_NOMEM;
+	}
+	prepare_unhashed_blob(blob, inode, strm->stream_id, unhashed_blobs);
+	*blob_p = NULL;
+	return 0;
+
+}
+
 /* Save information about an NTFS attribute (stream) to a WIM inode.  */
 static int
 scan_ntfs_attr(struct wim_inode *inode,
 	       ntfs_inode *ni,
 	       const char *path,
-	       size_t path_len,
 	       struct list_head *unhashed_blobs,
-	       ntfs_volume *vol,
+	       struct ntfs_volume_wrapper *volume,
 	       ATTR_TYPES type,
 	       const ATTR_RECORD *record)
 {
-	const u64 data_size = ntfs_get_attribute_value_length(record);
-	const size_t name_nchars = record->name_length;
+	u64 data_size = ntfs_get_attribute_value_length(record);
+	const u32 name_nchars = record->name_length;
 	struct blob_descriptor *blob = NULL;
-	utf16lechar *stream_name = NULL;
-	struct wim_inode_stream *strm;
+	utf16lechar *stream_name = (utf16lechar *)NO_STREAM_NAME;
 	int ret;
 
 	if (unlikely(name_nchars)) {
@@ -220,6 +330,23 @@ scan_ntfs_attr(struct wim_inode *inode,
 		}
 	}
 
+	if (unlikely(type == AT_REPARSE_POINT)) {
+		if (data_size < REPARSE_DATA_OFFSET) {
+			ERROR("Reparse point attribute of \"%s\" "
+			      "is too short!", path);
+			ret = WIMLIB_ERR_INVALID_REPARSE_DATA;
+			goto out_cleanup;
+		}
+		data_size -= REPARSE_DATA_OFFSET;
+
+		ret = read_reparse_header(ni, inode);
+		if (ret) {
+			ERROR_WITH_ERRNO("Error reading reparse point header "
+					 "of \"%s\"", path);
+			goto out_cleanup;
+		}
+	}
+
 	/* If the stream is non-empty, set up a blob descriptor for it.  */
 	if (data_size != 0) {
 		blob = new_blob_descriptor();
@@ -228,7 +355,7 @@ scan_ntfs_attr(struct wim_inode *inode,
 			goto out_cleanup;
 		}
 
-		blob->ntfs_loc = CALLOC(1, sizeof(struct ntfs_location));
+		blob->ntfs_loc = MALLOC(sizeof(struct ntfs_location));
 		if (unlikely(!blob->ntfs_loc)) {
 			ret = WIMLIB_ERR_NOMEM;
 			goto out_cleanup;
@@ -236,53 +363,33 @@ scan_ntfs_attr(struct wim_inode *inode,
 
 		blob->blob_location = BLOB_IN_NTFS_VOLUME;
 		blob->size = data_size;
-		blob->ntfs_loc->ntfs_vol = vol;
-		blob->ntfs_loc->attr_type = type;
+		blob->ntfs_loc->volume = get_ntfs_volume(volume);
 		blob->ntfs_loc->mft_no = ni->mft_no;
+		blob->ntfs_loc->attr_type = type;
 
 		if (unlikely(name_nchars)) {
+			blob->ntfs_loc->attr_name_nchars = name_nchars;
 			blob->ntfs_loc->attr_name = utf16le_dup(stream_name);
 			if (!blob->ntfs_loc->attr_name) {
 				ret = WIMLIB_ERR_NOMEM;
 				goto out_cleanup;
 			}
-			blob->ntfs_loc->attr_name_nchars = name_nchars;
+		} else {
+			blob->ntfs_loc->attr_name_nchars = 0;
+			blob->ntfs_loc->attr_name = AT_UNNAMED;
 		}
 
 		ret = set_attr_sort_key(ni, blob->ntfs_loc);
 		if (ret)
 			goto out_cleanup;
-
-		if (unlikely(type == AT_REPARSE_POINT)) {
-			if (blob->size < REPARSE_DATA_OFFSET) {
-				ERROR("Reparse data of \"%s\" "
-				      "is invalid (only %"PRIu64" bytes)!",
-				      path, data_size);
-				ret = WIMLIB_ERR_INVALID_REPARSE_DATA;
-				goto out_cleanup;
-			}
-			blob->size -= REPARSE_DATA_OFFSET;
-			ret = read_reparse_tag(ni, blob->ntfs_loc,
-					       &inode->i_reparse_tag);
-			if (ret)
-				goto out_cleanup;
-		}
 	}
 
-	strm = inode_add_stream(inode,
-				attr_type_to_wimlib_stream_type(type),
-				stream_name ? stream_name : NO_STREAM_NAME,
-				blob);
-	if (unlikely(!strm)) {
-		ret = WIMLIB_ERR_NOMEM;
-		goto out_cleanup;
-	}
-	prepare_unhashed_blob(blob, inode, strm->stream_id, unhashed_blobs);
-	blob = NULL;
-	ret = 0;
+	ret = add_stream(inode, path, attr_type_to_wimlib_stream_type(type),
+			 stream_name, &blob, unhashed_blobs);
 out_cleanup:
 	free_blob_descriptor(blob);
-	FREE(stream_name);
+	if (stream_name != NO_STREAM_NAME)
+		FREE(stream_name);
 	return ret;
 }
 
@@ -290,17 +397,14 @@ out_cleanup:
 static int
 scan_ntfs_attrs_with_type(struct wim_inode *inode,
 			  ntfs_inode *ni,
-			  char *path,
-			  size_t path_len,
+			  const char *path,
 			  struct list_head *unhashed_blobs,
-			  ntfs_volume *vol,
+			  struct ntfs_volume_wrapper *volume,
 			  ATTR_TYPES type)
 {
 	ntfs_attr_search_ctx *actx;
 	int ret;
 
-	DEBUG("Scanning NTFS attributes from \"%s\"", path);
-
 	actx = ntfs_attr_get_search_ctx(ni, NULL);
 	if (!actx) {
 		ERROR_WITH_ERRNO("Failed to get NTFS attribute search "
@@ -314,9 +418,8 @@ scan_ntfs_attrs_with_type(struct wim_inode *inode,
 		ret = scan_ntfs_attr(inode,
 				     ni,
 				     path,
-				     path_len,
 				     unhashed_blobs,
-				     vol,
+				     volume,
 				     type,
 				     actx->attr);
 		if (ret)
@@ -333,6 +436,52 @@ out_put_actx:
 	return ret;
 }
 
+/* Load the security descriptor of an NTFS inode into the corresponding WIM
+ * inode and the WIM image's security descriptor set.  */
+static noinline_for_stack int
+get_security_descriptor(ntfs_inode *ni, struct wim_inode *inode,
+			ntfs_volume *vol, struct wim_sd_set *sd_set)
+{
+	struct SECURITY_CONTEXT scx = {.vol = vol};
+	char _buf[4096];
+	char *buf = _buf;
+	size_t avail_size = sizeof(_buf);
+	int ret;
+
+retry:
+	ret = ntfs_get_ntfs_acl(&scx, ni, buf, avail_size);
+	if (unlikely(ret < 0)) {
+		ret = WIMLIB_ERR_NTFS_3G;
+		goto out;
+	}
+
+	if (unlikely(ret > avail_size)) {
+		if (unlikely(buf != _buf))
+			FREE(buf);
+		buf = MALLOC(ret);
+		if (!buf) {
+			ret = WIMLIB_ERR_NOMEM;
+			goto out;
+		}
+		avail_size = ret;
+		goto retry;
+	}
+
+	if (likely(ret > 0)) {
+		inode->i_security_id = sd_set_add_sd(sd_set, buf, ret);
+		if (unlikely(inode->i_security_id < 0)) {
+			ret = WIMLIB_ERR_NOMEM;
+			goto out;
+		}
+	}
+
+	ret = 0;
+out:
+	if (unlikely(buf != _buf))
+		FREE(buf);
+	return ret;
+}
+
 /* Binary tree that maps NTFS inode numbers to DOS names */
 struct dos_name_map {
 	struct avl_tree_node *root;
@@ -342,7 +491,7 @@ struct dos_name_node {
 	struct avl_tree_node index_node;
 	char dos_name[24];
 	int name_nbytes;
-	le64 ntfs_ino;
+	u64 ntfs_ino;
 };
 
 #define DOS_NAME_NODE(avl_node) \
@@ -359,11 +508,10 @@ _avl_cmp_by_ntfs_ino(const struct avl_tree_node *n1,
 /* Inserts a new DOS name into the map */
 static int
 insert_dos_name(struct dos_name_map *map, const ntfschar *dos_name,
-		size_t name_nbytes, le64 ntfs_ino)
+		size_t name_nbytes, u64 ntfs_ino)
 {
 	struct dos_name_node *new_node;
 
-	DEBUG("DOS name_len = %zu", name_nbytes);
 	new_node = MALLOC(sizeof(struct dos_name_node));
 	if (!new_node)
 		return WIMLIB_ERR_NOMEM;
@@ -382,15 +530,12 @@ insert_dos_name(struct dos_name_map *map, const ntfschar *dos_name,
 	if (avl_tree_insert(&map->root, &new_node->index_node,
 			    _avl_cmp_by_ntfs_ino))
 	{
-		/* This should be impossible since an NTFS inode cannot
-		 * have multiple DOS names, and we only should get each
-		 * DOS name entry once from the ntfs_readdir() calls. */
-		ERROR("NTFS inode %"PRIu64" has multiple DOS names",
-			le64_to_cpu(ntfs_ino));
+		/* This should be impossible since an NTFS inode cannot have
+		 * multiple DOS names, and we only should get each DOS name
+		 * entry once from the ntfs_readdir() calls. */
+		WARNING("NTFS inode %"PRIu64" has multiple DOS names", ntfs_ino);
 		FREE(new_node);
-		return WIMLIB_ERR_NOMEM;
 	}
-	DEBUG("Inserted DOS name for inode %"PRIu64, le64_to_cpu(ntfs_ino));
 	return 0;
 }
 
@@ -402,7 +547,7 @@ lookup_dos_name(const struct dos_name_map *map, u64 ntfs_ino)
 	struct dos_name_node dummy;
 	struct avl_tree_node *res;
 
-	dummy.ntfs_ino = cpu_to_le64(ntfs_ino);
+	dummy.ntfs_ino = ntfs_ino;
 
 	res = avl_tree_lookup_node(map->root, &dummy.index_node,
 				   _avl_cmp_by_ntfs_ino);
@@ -416,16 +561,14 @@ set_dentry_dos_name(struct wim_dentry *dentry, const struct dos_name_map *map)
 {
 	const struct dos_name_node *node;
 
-	if (dentry->is_win32_name) {
+	if (dentry->d_is_win32_name) {
 		node = lookup_dos_name(map, dentry->d_inode->i_ino);
 		if (node) {
-			dentry->short_name = utf16le_dupz(node->dos_name,
-							  node->name_nbytes);
-			if (!dentry->short_name)
+			dentry->d_short_name = utf16le_dupz(node->dos_name,
+							    node->name_nbytes);
+			if (!dentry->d_short_name)
 				return WIMLIB_ERR_NOMEM;
-			dentry->short_name_nbytes = node->name_nbytes;
-			DEBUG("Assigned DOS name to ino %"PRIu64,
-			      dentry->d_inode->i_ino);
+			dentry->d_short_name_nbytes = node->name_nbytes;
 		} else {
 			WARNING("NTFS inode %"PRIu64" has Win32 name with no "
 				"corresponding DOS name",
@@ -435,135 +578,152 @@ set_dentry_dos_name(struct wim_dentry *dentry, const struct dos_name_map *map)
 	return 0;
 }
 
-static void
-free_dos_name_tree(struct avl_tree_node *node) {
-	if (node) {
-		free_dos_name_tree(node->left);
-		free_dos_name_tree(node->right);
-		FREE(DOS_NAME_NODE(node));
-	}
-}
-
 static void
 destroy_dos_name_map(struct dos_name_map *map)
 {
-	free_dos_name_tree(map->root);
+	struct dos_name_node *node;
+	avl_tree_for_each_in_postorder(node, map->root,
+				       struct dos_name_node, index_node)
+		FREE(node);
 }
 
 struct readdir_ctx {
 	struct wim_dentry *parent;
 	char *path;
 	size_t path_len;
-	struct dos_name_map *dos_name_map;
-	ntfs_volume *vol;
+	struct dos_name_map dos_name_map;
+	struct ntfs_volume_wrapper *volume;
 	struct capture_params *params;
 	int ret;
 };
 
 static int
-build_dentry_tree_ntfs_recursive(struct wim_dentry **root_p,
-				 ntfs_inode *ni,
-				 char *path,
-				 size_t path_len,
-				 int name_type,
-				 ntfs_volume *ntfs_vol,
-				 struct capture_params *params);
+ntfs_3g_build_dentry_tree_recursive(struct wim_dentry **root_p,
+				    const MFT_REF mref,
+				    char *path,
+				    size_t path_len,
+				    int name_type,
+				    struct ntfs_volume_wrapper *volume,
+				    struct capture_params *params);
 
 static int
-wim_ntfs_capture_filldir(void *dirent, const ntfschar *name,
-			 const int name_nchars, const int name_type,
-			 const s64 pos, const MFT_REF mref,
-			 const unsigned dt_type)
+filldir(void *_ctx, const ntfschar *name, const int name_nchars,
+	const int name_type, const s64 pos, const MFT_REF mref,
+	const unsigned dt_type)
 {
-	struct readdir_ctx *ctx;
-	size_t mbs_name_nbytes;
+	struct readdir_ctx *ctx = _ctx;
+	const size_t name_nbytes = name_nchars * sizeof(ntfschar);
 	char *mbs_name;
+	size_t mbs_name_nbytes;
+	size_t path_len;
 	struct wim_dentry *child;
 	int ret;
-	size_t path_len;
-	size_t name_nbytes = name_nchars * sizeof(ntfschar);
 
-	ctx = dirent;
 	if (name_type & FILE_NAME_DOS) {
 		/* If this is the entry for a DOS name, store it for later. */
-		ret = insert_dos_name(ctx->dos_name_map, name,
-				      name_nbytes, mref & MFT_REF_MASK_CPU);
+		ret = insert_dos_name(&ctx->dos_name_map, name,
+				      name_nbytes, MREF(mref));
 
 		/* Return now if an error occurred or if this is just a DOS name
 		 * and not a Win32+DOS name. */
 		if (ret != 0 || name_type == FILE_NAME_DOS)
 			goto out;
 	}
-	ret = utf16le_to_tstr(name, name_nbytes,
-			      &mbs_name, &mbs_name_nbytes);
+
+	ret = utf16le_to_tstr(name, name_nbytes, &mbs_name, &mbs_name_nbytes);
 	if (ret)
 		goto out;
 
-	if (mbs_name[0] == '.' &&
-	     (mbs_name[1] == '\0' ||
-	      (mbs_name[1] == '.' && mbs_name[2] == '\0'))) {
-		/* . or .. entries
-		 *
-		 * note: name_type is POSIX for these, so DOS names will not
-		 * have been inserted for them.  */
-		ret = 0;
+	if (should_ignore_filename(mbs_name, mbs_name_nbytes))
 		goto out_free_mbs_name;
-	}
 
-	/* Open the inode for this directory entry and recursively capture the
-	 * directory tree rooted at it */
-	ntfs_inode *ni = ntfs_inode_open(ctx->vol, mref);
-	if (!ni) {
-		/* XXX This used to be treated as an error, but NTFS-3g seemed
-		 * to be unable to read some inodes on a Windows 8 image for
-		 * some reason. */
-		WARNING_WITH_ERRNO("Failed to open NTFS file \"%s/%s\"",
-				   ctx->path, mbs_name);
-		ret = 0;
-		goto out_free_mbs_name;
-	}
 	path_len = ctx->path_len;
 	if (path_len != 1)
 		ctx->path[path_len++] = '/';
 	memcpy(ctx->path + path_len, mbs_name, mbs_name_nbytes + 1);
 	path_len += mbs_name_nbytes;
 	child = NULL;
-	ret = build_dentry_tree_ntfs_recursive(&child, ni, ctx->path,
-					       path_len, name_type,
-					       ctx->vol, ctx->params);
-	path_len -= mbs_name_nbytes + 1;
-	if (child)
-		dentry_add_child(ctx->parent, child);
-	ntfs_inode_close(ni);
+	ret = ntfs_3g_build_dentry_tree_recursive(&child, mref, ctx->path,
+						  path_len, name_type,
+						  ctx->volume, ctx->params);
+	attach_scanned_tree(ctx->parent, child, ctx->params->blob_table);
 out_free_mbs_name:
 	FREE(mbs_name);
 out:
-	ctx->path[ctx->path_len] = '\0';
 	ctx->ret = ret;
 	return ret;
 }
 
-/* Recursive scan routine for NTFS volumes  */
 static int
-build_dentry_tree_ntfs_recursive(struct wim_dentry **root_ret,
-				 ntfs_inode *ni,
-				 char *path,
-				 size_t path_len,
-				 int name_type,
-				 ntfs_volume *vol,
-				 struct capture_params *params)
+ntfs_3g_recurse_directory(ntfs_inode *ni, char *path, size_t path_len,
+			  struct wim_dentry *parent,
+			  struct ntfs_volume_wrapper *volume,
+			  struct capture_params *params)
+{
+	int ret;
+	s64 pos = 0;
+	struct readdir_ctx ctx = {
+		.parent          = parent,
+		.path            = path,
+		.path_len        = path_len,
+		.dos_name_map    = { .root = NULL },
+		.volume          = volume,
+		.params          = params,
+		.ret		 = 0,
+	};
+	ret = ntfs_readdir(ni, &pos, &ctx, filldir);
+	path[path_len] = '\0';
+	if (unlikely(ret)) {
+		if (ctx.ret) {
+			/* wimlib error  */
+			ret = ctx.ret;
+		} else {
+			/* error from ntfs_readdir() itself  */
+			ERROR_WITH_ERRNO("Error reading directory \"%s\"", path);
+			ret = WIMLIB_ERR_NTFS_3G;
+		}
+	} else {
+		struct wim_dentry *child;
+
+		ret = 0;
+		for_dentry_child(child, parent) {
+			ret = set_dentry_dos_name(child, &ctx.dos_name_map);
+			if (ret)
+				break;
+		}
+	}
+	destroy_dos_name_map(&ctx.dos_name_map);
+	return ret;
+}
+
+static int
+ntfs_3g_build_dentry_tree_recursive(struct wim_dentry **root_ret,
+				    const MFT_REF mref,
+				    char *path,
+				    size_t path_len,
+				    int name_type,
+				    struct ntfs_volume_wrapper *volume,
+				    struct capture_params *params)
 {
 	u32 attributes;
 	int ret;
 	struct wim_dentry *root = NULL;
 	struct wim_inode *inode = NULL;
+	ntfs_inode *ni = NULL;
 
-	ret = try_exclude(path, path_len, params);
-	if (ret < 0) /* Excluded? */
+	ret = try_exclude(path, params);
+	if (unlikely(ret < 0)) /* Excluded? */
 		goto out_progress;
-	if (ret > 0) /* Error? */
+	if (unlikely(ret > 0)) /* Error? */
 		goto out;
 
+	ni = ntfs_inode_open(volume->vol, mref);
+	if (!ni) {
+		ERROR_WITH_ERRNO("Failed to open NTFS file \"%s\"", path);
+		ret = WIMLIB_ERR_NTFS_3G;
+		goto out;
+	}
+
 	/* Get file attributes */
 	ret = ntfs_get_ntfs_attrib(ni, (char*)&attributes, sizeof(attributes));
 	if (ret != sizeof(attributes)) {
@@ -572,7 +732,7 @@ build_dentry_tree_ntfs_recursive(struct wim_dentry **root_ret,
 		goto out;
 	}
 
-	if (attributes & FILE_ATTRIBUTE_ENCRYPTED) {
+	if (unlikely(attributes & FILE_ATTRIBUTE_ENCRYPTED)) {
 		if (params->add_flags & WIMLIB_ADD_FLAG_NO_UNSUPPORTED_EXCLUDE)
 		{
 			ERROR("Can't archive \"%s\" because NTFS-3g capture mode "
@@ -593,7 +753,7 @@ build_dentry_tree_ntfs_recursive(struct wim_dentry **root_ret,
 		goto out;
 
 	if (name_type & FILE_NAME_WIN32) /* Win32 or Win32+DOS name (rather than POSIX) */
-		root->is_win32_name = 1;
+		root->d_is_win32_name = 1;
 
 	inode = root->d_inode;
 
@@ -609,9 +769,9 @@ build_dentry_tree_ntfs_recursive(struct wim_dentry **root_ret,
 
 	if (attributes & FILE_ATTRIBUTE_REPARSE_POINT) {
 		/* Scan the reparse point stream.  */
-		ret = scan_ntfs_attrs_with_type(inode, ni, path, path_len,
+		ret = scan_ntfs_attrs_with_type(inode, ni, path,
 						params->unhashed_blobs,
-						vol, AT_REPARSE_POINT);
+						volume, AT_REPARSE_POINT);
 		if (ret)
 			goto out;
 	}
@@ -622,95 +782,33 @@ build_dentry_tree_ntfs_recursive(struct wim_dentry **root_ret,
 	 * may have named data streams.  Nondirectories (including reparse
 	 * points) can have an unnamed data stream as well as named data
 	 * streams.  */
-	ret = scan_ntfs_attrs_with_type(inode, ni, path, path_len,
-					params->unhashed_blobs, vol, AT_DATA);
+	ret = scan_ntfs_attrs_with_type(inode, ni, path, params->unhashed_blobs,
+					volume, AT_DATA);
 	if (ret)
 		goto out;
 
-	if (inode_is_directory(inode)) {
-
-		/* Recurse to directory children */
-		s64 pos = 0;
-		struct dos_name_map dos_name_map = { .root = NULL };
-		struct readdir_ctx ctx = {
-			.parent          = root,
-			.path            = path,
-			.path_len        = path_len,
-			.dos_name_map    = &dos_name_map,
-			.vol             = vol,
-			.params          = params,
-			.ret		 = 0,
-		};
-		ret = ntfs_readdir(ni, &pos, &ctx, wim_ntfs_capture_filldir);
-		if (ret) {
-			if (ctx.ret) {
-				/* wimlib error  */
-				ret = ctx.ret;
-			} else {
-				/* error from ntfs_readdir() itself  */
-				ERROR_WITH_ERRNO("Error reading directory \"%s\"", path);
-				ret = WIMLIB_ERR_NTFS_3G;
-			}
-		} else {
-			struct wim_dentry *child;
-
-			ret = 0;
-			for_dentry_child(child, root) {
-				ret = set_dentry_dos_name(child, &dos_name_map);
-				if (ret)
-					break;
-			}
-		}
-		destroy_dos_name_map(&dos_name_map);
-		if (ret)
-			goto out;
-	}
-	path[path_len] = '\0';
-
 	/* Reparse-point fixups are a no-op because in NTFS-3g capture mode we
 	 * only allow capturing an entire volume. */
 	if (params->add_flags & WIMLIB_ADD_FLAG_RPFIX &&
 	    inode_is_symlink(inode))
-		inode->i_not_rpfixed = 0;
+		inode->i_rp_flags &= ~WIM_RP_FLAG_NOT_FIXED;
 
 	if (!(params->add_flags & WIMLIB_ADD_FLAG_NO_ACLS)) {
-		struct SECURITY_CONTEXT sec_ctx;
-		char _sd[4096];
-		char *sd;
-
-		/* Get security descriptor */
-		memset(&sec_ctx, 0, sizeof(sec_ctx));
-		sec_ctx.vol = vol;
-
-		errno = 0;
-		sd = _sd;
-		ret = ntfs_get_ntfs_acl(&sec_ctx, ni, sd, sizeof(_sd));
-		if (ret > sizeof(_sd)) {
-			sd = alloca(ret);
-			ret = ntfs_get_ntfs_acl(&sec_ctx, ni, sd, ret);
-		}
-		if (ret > 0) {
-			inode->i_security_id = sd_set_add_sd(params->sd_set,
-							     sd, ret);
-			if (inode->i_security_id == -1) {
-				ERROR("Out of memory");
-				ret = WIMLIB_ERR_NOMEM;
-				goto out;
-			}
-			DEBUG("Added security ID = %u for `%s'",
-			      inode->i_security_id, path);
-			ret = 0;
-		} else if (ret < 0) {
-			ERROR_WITH_ERRNO("Failed to get security information from "
-					 "`%s'", path);
-			ret = WIMLIB_ERR_NTFS_3G;
-		} else {
-			inode->i_security_id = -1;
-			DEBUG("No security ID for `%s'", path);
+		ret = get_security_descriptor(ni, inode, volume->vol,
+					      params->sd_set);
+		if (ret) {
+			ERROR_WITH_ERRNO("Error reading security descriptor "
+					 "of \"%s\"", path);
+			goto out;
 		}
 	}
-	if (ret)
-		goto out;
+
+	if (inode_is_directory(inode)) {
+		ret = ntfs_3g_recurse_directory(ni, path, path_len, root,
+						volume, params);
+		if (ret)
+			goto out;
+	}
 
 out_progress:
 	params->progress.scan.cur_path = path;
@@ -719,6 +817,8 @@ out_progress:
 	else
 		ret = do_capture_progress(params, WIMLIB_SCAN_DENTRY_OK, inode);
 out:
+	if (ni)
+		ntfs_inode_close(ni);
 	if (unlikely(ret)) {
 		free_dentry_tree(root, params->blob_table);
 		root = NULL;
@@ -728,50 +828,31 @@ out:
 	return ret;
 }
 
-
-int
-do_ntfs_umount(struct _ntfs_volume *vol)
-{
-	DEBUG("Unmounting NTFS volume");
-	if (ntfs_umount(vol, FALSE))
-		return WIMLIB_ERR_NTFS_3G;
-	else
-		return 0;
-}
-
 int
-build_dentry_tree_ntfs(struct wim_dentry **root_p,
-		       const char *device,
-		       struct capture_params *params)
+ntfs_3g_build_dentry_tree(struct wim_dentry **root_ret,
+			  const char *device,
+			  struct capture_params *params)
 {
+	struct ntfs_volume_wrapper *volume;
 	ntfs_volume *vol;
-	ntfs_inode *root_ni;
+	char *path;
 	int ret;
 
-	DEBUG("Mounting NTFS volume `%s' read-only", device);
+	volume = MALLOC(sizeof(struct ntfs_volume_wrapper));
+	if (!volume)
+		return WIMLIB_ERR_NOMEM;
 
-/* NTFS-3g 2013 renamed the "read-only" mount flag from MS_RDONLY to
- * NTFS_MNT_RDONLY.
- *
- * Unfortunately we can't check for defined(NTFS_MNT_RDONLY) because
- * NTFS_MNT_RDONLY is an enumerated constant.  Also, the NTFS-3g headers don't
- * seem to contain any explicit version information.  So we have to rely on a
- * test done at configure time to detect whether NTFS_MNT_RDONLY should be used.
- * */
-#ifdef HAVE_NTFS_MNT_RDONLY
-	/* NTFS-3g 2013 */
 	vol = ntfs_mount(device, NTFS_MNT_RDONLY);
-#elif defined(MS_RDONLY)
-	/* NTFS-3g 2011, 2012 */
-	vol = ntfs_mount(device, MS_RDONLY);
-#else
-  #error "Can't find NTFS_MNT_RDONLY or MS_RDONLY flags"
-#endif
 	if (!vol) {
-		ERROR_WITH_ERRNO("Failed to mount NTFS volume `%s' read-only",
+		ERROR_WITH_ERRNO("Failed to mount NTFS volume \"%s\" read-only",
 				 device);
+		FREE(volume);
 		return WIMLIB_ERR_NTFS_3G;
 	}
+
+	volume->vol = vol;
+	volume->refcnt = 1;
+
 	ntfs_open_secure(vol);
 
 	/* We don't want to capture the special NTFS files such as $Bitmap.  Not
@@ -779,46 +860,25 @@ build_dentry_tree_ntfs(struct wim_dentry **root_p,
 	 * that we do need to capture.  */
 	NVolClearShowSysFiles(vol);
 
-	DEBUG("Opening root NTFS dentry");
-	root_ni = ntfs_inode_open(vol, FILE_root);
-	if (!root_ni) {
-		ERROR_WITH_ERRNO("Failed to open root inode of NTFS volume "
-				 "`%s'", device);
-		ret = WIMLIB_ERR_NTFS_3G;
-		goto out;
-	}
-
 	/* Currently we assume that all the paths fit into this length and there
-	 * is no check for overflow. */
-	char *path = MALLOC(32768);
+	 * is no check for overflow.  */
+	path = MALLOC(32768);
 	if (!path) {
-		ERROR("Could not allocate memory for NTFS pathname");
 		ret = WIMLIB_ERR_NOMEM;
-		goto out_cleanup;
+		goto out_put_ntfs_volume;
 	}
 
 	path[0] = '/';
 	path[1] = '\0';
-	ret = build_dentry_tree_ntfs_recursive(root_p, root_ni, path, 1,
-					       FILE_NAME_POSIX, vol, params);
-out_cleanup:
+	ret = ntfs_3g_build_dentry_tree_recursive(root_ret, FILE_root, path, 1,
+						  FILE_NAME_POSIX, volume,
+						  params);
 	FREE(path);
-	ntfs_inode_close(root_ni);
-out:
+out_put_ntfs_volume:
 	ntfs_index_ctx_put(vol->secure_xsii);
 	ntfs_index_ctx_put(vol->secure_xsdh);
 	ntfs_inode_close(vol->secure_ni);
-
-	if (ret) {
-		if (do_ntfs_umount(vol)) {
-			ERROR_WITH_ERRNO("Failed to unmount NTFS volume `%s'",
-					 device);
-		}
-	} else {
-		/* We need to leave the NTFS volume mounted so that we can read
-		 * the NTFS files again when we are actually writing the WIM */
-		*(ntfs_volume**)params->extra_arg = vol;
-	}
+	put_ntfs_volume(volume);
 	return ret;
 }
 #endif /* WITH_NTFS_3G */