this.aces = new ACE[numAces];
            for ( int i = 0; i < numAces; i++ ) {
                this.aces[ i ] = new ACE();
                bufferIndex += this.aces[ i ].decode(buffer, bufferIndex, len - bufferIndex);
            }
        }
        else {
            this.aces = null;
        }

        return bufferIndex - start;
    }

    boolean allow;
    int flags;
    int access;
    SID sid;

    /**
     * Returns true if this ACE is an allow ACE and false if it is a deny ACE.
     */
    public boolean isAllow() {
        return allow;
    }
    /**
     * Returns true if this ACE is an inherited ACE and false if it is a direct ACE.
     * <p>
     * Note: For reasons not fully understood, <tt>FLAGS_INHERITED</tt> may

                throw new IOException( "Invalid SecurityDescriptor" );

            aces = new ACE[numAces];
            for (int i = 0; i < numAces; i++) {
                aces[i] = new ACE();
                bufferIndex += aces[i].decode(buffer, bufferIndex);
            }
        } else {
            aces = null;
        }

        return bufferIndex - start;
    }
    public String toString() {

     * 
     * @return whether this is an inherited ACE
     */
    boolean isInherited ();


    /**
     * Returns true if this ACE is an allow ACE and false if it is a deny ACE.
     * 
     * @return whether this in an allow ACE
     */
    boolean isAllow ();

 * available online).
 * <p>
 * Direct ACEs are evaluated first in order. The SID of the user performing
 * the operation and the desired access bits are compared to the SID
 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access
 * mask of the ACE, the whole access check fails. If the ACE is an "allow"

        try {
            final ACE[] aces = file.getSecurity(resolveSids);
            if (aces != null) {
                final Set<SID> sidAllowSet = new HashSet<>();
                final Set<SID> sidDenySet = new HashSet<>();
                for (final ACE ace : aces) {
                    if (logger.isDebugEnabled()) {
                        logger.debug("ACE:{}", ace);
                    }

    }

    private void processAces(ACE[] aces, boolean resolveSids) throws IOException {
        String server = getServerWithDfs();
        int ai;

        if (resolveSids) {
            SID[] sids = new SID[aces.length];
            String[] names = null;

            for (ai = 0; ai < aces.length; ai++) {
                sids[ai] = aces[ai].sid;
            }

        try {
            final ACE[] aces = file.getSecurity(resolveSids);
            if (aces != null) {
                responseData.addMetaData(SMB_ACCESS_CONTROL_ENTRIES, aces); // backward compatibility
                final Set<SID> sidAllowSet = new HashSet<>();
                final Set<SID> sidDenySet = new HashSet<>();
                for (final ACE ace : aces) {
                    if (logger.isDebugEnabled()) {

                    throw new SmbException(rpc.retval, true);
                }
                aces = rpc.getSecurity();
                if ( aces != null ) {
                    processAces(aces, resolveSids);
                }
            }
            return aces;
        }
    }

        flags = DCERPC_FIRST_FRAG | DCERPC_LAST_FRAG;
    }

    public ACE[] getSecurity() throws IOException {
        srvsvc.ShareInfo502 info502 = (srvsvc.ShareInfo502)info;
        if (info502.security_descriptor != null) {
            SecurityDescriptor sd;
            sd = new SecurityDescriptor(info502.security_descriptor, 0, info502.sd_size);
            return sd.aces;
        }
        return null;
    }