source3/smbd/smbXsrv_client.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2014
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/filesys.h"
  22 #include <tevent.h>
  23 #include "lib/util/server_id.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "dbwrap/dbwrap.h"
  27 #include "dbwrap/dbwrap_rbt.h"
  28 #include "dbwrap/dbwrap_open.h"
  29 #include "dbwrap/dbwrap_watch.h"
  30 #include "session.h"
  31 #include "auth.h"
  32 #include "auth/gensec/gensec.h"
  33 #include "../lib/tsocket/tsocket.h"
  34 #include "../libcli/security/security.h"
  35 #include "messages.h"
  36 #include "lib/util/util_tdb.h"
  37 #include "librpc/gen_ndr/ndr_smbXsrv.h"
  38 #include "serverid.h"
  39 #include "lib/util/tevent_ntstatus.h"
  40 #include "lib/util/iov_buf.h"
  41 #include "lib/global_contexts.h"
  42
  43 struct smbXsrv_client_table {
  44         struct {
  45                 uint32_t max_clients;
  46                 uint32_t num_clients;
  47         } local;
  48         struct {
  49                 struct db_context *db_ctx;
  50         } global;
  51 };
  52
  53 static struct db_context *smbXsrv_client_global_db_ctx = NULL;
  54
  55 NTSTATUS smbXsrv_client_global_init(void)
  56 {
  57         const char *global_path = NULL;
  58         struct db_context *backend = NULL;
  59         struct db_context *db_ctx = NULL;
  60
  61         if (smbXsrv_client_global_db_ctx != NULL) {
  62                 return NT_STATUS_OK;
  63         }
  64
  65         /*
  66          * This contains secret information like client keys!
  67          */
  68         global_path = lock_path(talloc_tos(), "smbXsrv_client_global.tdb");
  69         if (global_path == NULL) {
  70                 return NT_STATUS_NO_MEMORY;
  71         }
  72
  73         backend = db_open(NULL, global_path,
  74                           0, /* hash_size */
  75                           TDB_DEFAULT |
  76                           TDB_CLEAR_IF_FIRST |
  77                           TDB_INCOMPATIBLE_HASH,
  78                           O_RDWR | O_CREAT, 0600,
  79                           DBWRAP_LOCK_ORDER_1,
  80                           DBWRAP_FLAG_NONE);
  81         if (backend == NULL) {
  82                 NTSTATUS status;
  83
  84                 status = map_nt_error_from_unix_common(errno);
  85
  86                 return status;
  87         }
  88
  89         db_ctx = db_open_watched(NULL, &backend, global_messaging_context());
  90         if (db_ctx == NULL) {
  91                 TALLOC_FREE(backend);
  92                 return NT_STATUS_NO_MEMORY;
  93         }
  94
  95         smbXsrv_client_global_db_ctx = db_ctx;
  96
  97         return NT_STATUS_OK;
  98 }
  99
 100 /*
 101  * NOTE:
 102  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
 103  * has the same result as integer comparison between the uint32_t
 104  * values.
 105  *
 106  * TODO: implement string based key
 107  */
 108
 109 #define SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE 16
 110
 111 static TDB_DATA smbXsrv_client_global_id_to_key(const struct GUID *client_guid,
 112                                                 uint8_t *key_buf)
 113 {
 114         TDB_DATA key = { .dsize = 0, };
 115         NTSTATUS status;
 116         struct GUID_ndr_buf buf = { .buf = {0}, };
 117
 118         status = GUID_to_ndr_buf(client_guid, &buf);
 119         if (!NT_STATUS_IS_OK(status)) {
 120                 return key;
 121         }
 122         memcpy(key_buf, buf.buf, SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE);
 123
 124         key = make_tdb_data(key_buf, SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE);
 125
 126         return key;
 127 }
 128
 129 static struct db_record *smbXsrv_client_global_fetch_locked(
 130                         struct db_context *db,
 131                         const struct GUID *client_guid,
 132                         TALLOC_CTX *mem_ctx)
 133 {
 134         TDB_DATA key;
 135         uint8_t key_buf[SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE];
 136         struct db_record *rec = NULL;
 137
 138         key = smbXsrv_client_global_id_to_key(client_guid, key_buf);
 139
 140         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 141
 142         if (rec == NULL) {
 143                 struct GUID_txt_buf buf;
 144                 DBG_DEBUG("Failed to lock guid [%s], key '%s'\n",
 145                           GUID_buf_string(client_guid, &buf),
 146                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 147         }
 148
 149         return rec;
 150 }
 151
 152 static NTSTATUS smbXsrv_client_table_create(TALLOC_CTX *mem_ctx,
 153                                             struct messaging_context *msg_ctx,
 154                                             uint32_t max_clients,
 155                                             struct smbXsrv_client_table **_table)
 156 {
 157         struct smbXsrv_client_table *table;
 158         NTSTATUS status;
 159
 160         if (max_clients > 1) {
 161                 return NT_STATUS_INTERNAL_ERROR;
 162         }
 163
 164         table = talloc_zero(mem_ctx, struct smbXsrv_client_table);
 165         if (table == NULL) {
 166                 return NT_STATUS_NO_MEMORY;
 167         }
 168
 169         table->local.max_clients = max_clients;
 170
 171         status = smbXsrv_client_global_init();
 172         if (!NT_STATUS_IS_OK(status)) {
 173                 TALLOC_FREE(table);
 174                 return status;
 175         }
 176
 177         table->global.db_ctx = smbXsrv_client_global_db_ctx;
 178
 179         *_table = table;
 180         return NT_STATUS_OK;
 181 }
 182
 183 static int smbXsrv_client_global_destructor(struct smbXsrv_client_global0 *global)
 184 {
 185         return 0;
 186 }
 187
 188 static void smbXsrv_client_global_verify_record(struct db_record *db_rec,
 189                                         bool *is_free,
 190                                         bool *was_free,
 191                                         TALLOC_CTX *mem_ctx,
 192                                         struct smbXsrv_client_global0 **_g,
 193                                         uint32_t *pseqnum)
 194 {
 195         TDB_DATA key;
 196         TDB_DATA val;
 197         DATA_BLOB blob;
 198         struct smbXsrv_client_globalB global_blob;
 199         enum ndr_err_code ndr_err;
 200         struct smbXsrv_client_global0 *global = NULL;
 201         bool exists;
 202         TALLOC_CTX *frame = talloc_stackframe();
 203
 204         *is_free = false;
 205
 206         if (was_free) {
 207                 *was_free = false;
 208         }
 209         if (_g) {
 210                 *_g = NULL;
 211         }
 212         if (pseqnum) {
 213                 *pseqnum = 0;
 214         }
 215
 216         key = dbwrap_record_get_key(db_rec);
 217
 218         val = dbwrap_record_get_value(db_rec);
 219         if (val.dsize == 0) {
 220                 TALLOC_FREE(frame);
 221                 *is_free = true;
 222                 if (was_free) {
 223                         *was_free = true;
 224                 }
 225                 return;
 226         }
 227
 228         blob = data_blob_const(val.dptr, val.dsize);
 229
 230         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
 231                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_client_globalB);
 232         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 233                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 234                 DBG_WARNING("key '%s' ndr_pull_struct_blob - %s\n",
 235                             hex_encode_talloc(frame, key.dptr, key.dsize),
 236                             nt_errstr(status));
 237                 TALLOC_FREE(frame);
 238                 return;
 239         }
 240
 241         DBG_DEBUG("client_global:\n");
 242         if (DEBUGLVL(DBGLVL_DEBUG)) {
 243                 NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 244         }
 245
 246         if (global_blob.version != SMBXSRV_VERSION_0) {
 247                 DBG_ERR("key '%s' use unsupported version %u\n",
 248                         hex_encode_talloc(frame, key.dptr, key.dsize),
 249                         global_blob.version);
 250                 NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 251                 TALLOC_FREE(frame);
 252                 return;
 253         }
 254
 255         global = global_blob.info.info0;
 256
 257         exists = serverid_exists(&global->server_id);
 258         if (!exists) {
 259                 struct server_id_buf tmp;
 260
 261                 DBG_NOTICE("key '%s' server_id %s does not exist.\n",
 262                            hex_encode_talloc(frame, key.dptr, key.dsize),
 263                            server_id_str_buf(global->server_id, &tmp));
 264                 if (DEBUGLVL(DBGLVL_NOTICE)) {
 265                         NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 266                 }
 267                 TALLOC_FREE(frame);
 268                 dbwrap_record_delete(db_rec);
 269                 *is_free = true;
 270                 return;
 271         }
 272
 273         if (_g) {
 274                 *_g = talloc_move(mem_ctx, &global);
 275         }
 276         if (pseqnum) {
 277                 *pseqnum = global_blob.seqnum;
 278         }
 279         TALLOC_FREE(frame);
 280 }
 281
 282 static NTSTATUS smb2srv_client_connection_pass(struct smbd_smb2_request *smb2req,
 283                                                struct smbXsrv_client_global0 *global)
 284 {
 285         DATA_BLOB blob;
 286         enum ndr_err_code ndr_err;
 287         NTSTATUS status;
 288         struct smbXsrv_connection_pass0 pass_info0;
 289         struct smbXsrv_connection_passB pass_blob;
 290         ssize_t reqlen;
 291         struct iovec iov;
 292
 293         pass_info0 = (struct smbXsrv_connection_pass0) {
 294                 .client_guid = global->client_guid,
 295                 .src_server_id = smb2req->xconn->client->global->server_id,
 296                 .xconn_connect_time = smb2req->xconn->client->global->initial_connect_time,
 297                 .dst_server_id = global->server_id,
 298                 .client_connect_time = global->initial_connect_time,
 299         };
 300
 301         reqlen = iov_buflen(smb2req->in.vector, smb2req->in.vector_count);
 302         if (reqlen == -1) {
 303                 return NT_STATUS_INVALID_BUFFER_SIZE;
 304         }
 305
 306         pass_info0.negotiate_request.length = reqlen;
 307         pass_info0.negotiate_request.data = talloc_array(talloc_tos(), uint8_t,
 308                                                          reqlen);
 309         if (pass_info0.negotiate_request.data == NULL) {
 310                 return NT_STATUS_NO_MEMORY;
 311         }
 312         iov_buf(smb2req->in.vector, smb2req->in.vector_count,
 313                 pass_info0.negotiate_request.data,
 314                 pass_info0.negotiate_request.length);
 315
 316         ZERO_STRUCT(pass_blob);
 317         pass_blob.version = smbXsrv_version_global_current();
 318         pass_blob.info.info0 = &pass_info0;
 319
 320         if (DEBUGLVL(DBGLVL_DEBUG)) {
 321                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
 322         }
 323
 324         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &pass_blob,
 325                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_passB);
 326         data_blob_free(&pass_info0.negotiate_request);
 327         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 328                 status = ndr_map_error2ntstatus(ndr_err);
 329                 return status;
 330         }
 331
 332         iov.iov_base = blob.data;
 333         iov.iov_len = blob.length;
 334
 335         status = messaging_send_iov(smb2req->xconn->client->msg_ctx,
 336                                     global->server_id,
 337                                     MSG_SMBXSRV_CONNECTION_PASS,
 338                                     &iov, 1,
 339                                     &smb2req->xconn->transport.sock, 1);
 340         data_blob_free(&blob);
 341         if (!NT_STATUS_IS_OK(status)) {
 342                 return status;
 343         }
 344
 345         return NT_STATUS_OK;
 346 }
 347
 348 static NTSTATUS smb2srv_client_connection_drop(struct smbd_smb2_request *smb2req,
 349                                                struct smbXsrv_client_global0 *global)
 350 {
 351         DATA_BLOB blob;
 352         enum ndr_err_code ndr_err;
 353         NTSTATUS status;
 354         struct smbXsrv_connection_drop0 drop_info0;
 355         struct smbXsrv_connection_dropB drop_blob;
 356         struct iovec iov;
 357
 358         drop_info0 = (struct smbXsrv_connection_drop0) {
 359                 .client_guid = global->client_guid,
 360                 .src_server_id = smb2req->xconn->client->global->server_id,
 361                 .xconn_connect_time = smb2req->xconn->client->global->initial_connect_time,
 362                 .dst_server_id = global->server_id,
 363                 .client_connect_time = global->initial_connect_time,
 364         };
 365
 366         ZERO_STRUCT(drop_blob);
 367         drop_blob.version = smbXsrv_version_global_current();
 368         drop_blob.info.info0 = &drop_info0;
 369
 370         if (DEBUGLVL(DBGLVL_DEBUG)) {
 371                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
 372         }
 373
 374         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &drop_blob,
 375                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_dropB);
 376         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 377                 status = ndr_map_error2ntstatus(ndr_err);
 378                 return status;
 379         }
 380
 381         iov.iov_base = blob.data;
 382         iov.iov_len = blob.length;
 383
 384         status = messaging_send_iov(smb2req->xconn->client->msg_ctx,
 385                                     global->server_id,
 386                                     MSG_SMBXSRV_CONNECTION_DROP,
 387                                     &iov, 1,
 388                                     NULL, 0);
 389         data_blob_free(&blob);
 390         if (!NT_STATUS_IS_OK(status)) {
 391                 return status;
 392         }
 393
 394         return NT_STATUS_OK;
 395 }
 396
 397 static NTSTATUS smbXsrv_client_global_store(struct smbXsrv_client_global0 *global)
 398 {
 399         struct smbXsrv_client_globalB global_blob;
 400         DATA_BLOB blob = data_blob_null;
 401         TDB_DATA key;
 402         TDB_DATA val;
 403         NTSTATUS status;
 404         enum ndr_err_code ndr_err;
 405         bool saved_stored = global->stored;
 406
 407         /*
 408          * TODO: if we use other versions than '0'
 409          * we would add glue code here, that would be able to
 410          * store the information in the old format.
 411          */
 412
 413         SMB_ASSERT(global->local_address != NULL);
 414         SMB_ASSERT(global->remote_address != NULL);
 415         SMB_ASSERT(global->remote_name != NULL);
 416
 417         if (global->db_rec == NULL) {
 418                 return NT_STATUS_INTERNAL_ERROR;
 419         }
 420
 421         key = dbwrap_record_get_key(global->db_rec);
 422         val = dbwrap_record_get_value(global->db_rec);
 423
 424         ZERO_STRUCT(global_blob);
 425         global_blob.version = smbXsrv_version_global_current();
 426         if (val.dsize >= 8) {
 427                 global_blob.seqnum = IVAL(val.dptr, 4);
 428         }
 429         global_blob.seqnum += 1;
 430         global_blob.info.info0 = global;
 431
 432         global->stored = true;
 433         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
 434                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_client_globalB);
 435         global->stored = saved_stored;
 436         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 437                 status = ndr_map_error2ntstatus(ndr_err);
 438                 DBG_WARNING("key '%s' ndr_push - %s\n",
 439                         hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 440                         nt_errstr(status));
 441                 TALLOC_FREE(global->db_rec);
 442                 return status;
 443         }
 444
 445         val = make_tdb_data(blob.data, blob.length);
 446         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
 447         if (!NT_STATUS_IS_OK(status)) {
 448                 DBG_WARNING("key '%s' store - %s\n",
 449                         hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 450                         nt_errstr(status));
 451                 TALLOC_FREE(global->db_rec);
 452                 return status;
 453         }
 454
 455         global->stored = true;
 456
 457         if (DEBUGLVL(DBGLVL_DEBUG)) {
 458                 DBG_DEBUG("key '%s' stored\n",
 459                         hex_encode_talloc(global->db_rec, key.dptr, key.dsize));
 460                 NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 461         }
 462
 463         TALLOC_FREE(global->db_rec);
 464
 465         return NT_STATUS_OK;
 466 }
 467
 468 struct smb2srv_client_mc_negprot_state {
 469         struct tevent_context *ev;
 470         struct smbd_smb2_request *smb2req;
 471         struct db_record *db_rec;
 472         uint64_t watch_instance;
 473         uint32_t last_seqnum;
 474         struct tevent_req *filter_subreq;
 475 };
 476
 477 static void smb2srv_client_mc_negprot_cleanup(struct tevent_req *req,
 478                                               enum tevent_req_state req_state)
 479 {
 480         struct smb2srv_client_mc_negprot_state *state =
 481                 tevent_req_data(req,
 482                 struct smb2srv_client_mc_negprot_state);
 483
 484         if (state->db_rec != NULL) {
 485                 dbwrap_watched_watch_remove_instance(state->db_rec,
 486                                                      state->watch_instance);
 487                 state->watch_instance = 0;
 488                 TALLOC_FREE(state->db_rec);
 489         }
 490 }
 491
 492 static void smb2srv_client_mc_negprot_next(struct tevent_req *req);
 493 static bool smb2srv_client_mc_negprot_filter(struct messaging_rec *rec, void *private_data);
 494 static void smb2srv_client_mc_negprot_done(struct tevent_req *subreq);
 495 static void smb2srv_client_mc_negprot_watched(struct tevent_req *subreq);
 496
 497 struct tevent_req *smb2srv_client_mc_negprot_send(TALLOC_CTX *mem_ctx,
 498                                                   struct tevent_context *ev,
 499                                                   struct smbd_smb2_request *smb2req)
 500 {
 501         struct tevent_req *req = NULL;
 502         struct smb2srv_client_mc_negprot_state *state = NULL;
 503
 504         req = tevent_req_create(mem_ctx, &state,
 505                                 struct smb2srv_client_mc_negprot_state);
 506         if (req == NULL) {
 507                 return NULL;
 508         }
 509         state->ev = ev;
 510         state->smb2req = smb2req;
 511
 512         tevent_req_set_cleanup_fn(req, smb2srv_client_mc_negprot_cleanup);
 513
 514         smb2srv_client_mc_negprot_next(req);
 515
 516         if (!tevent_req_is_in_progress(req)) {
 517                 return tevent_req_post(req, ev);
 518         }
 519
 520         return req;
 521 }
 522
 523 static void smb2srv_client_mc_negprot_next(struct tevent_req *req)
 524 {
 525         struct smb2srv_client_mc_negprot_state *state =
 526                 tevent_req_data(req,
 527                 struct smb2srv_client_mc_negprot_state);
 528         struct smbXsrv_connection *xconn = state->smb2req->xconn;
 529         struct smbXsrv_client *client = xconn->client;
 530         struct smbXsrv_client_table *table = client->table;
 531         struct GUID client_guid = xconn->smb2.client.guid;
 532         struct smbXsrv_client_global0 *global = NULL;
 533         bool is_free = false;
 534         struct tevent_req *subreq = NULL;
 535         NTSTATUS status;
 536         uint32_t seqnum = 0;
 537
 538         TALLOC_FREE(state->filter_subreq);
 539         SMB_ASSERT(state->db_rec == NULL);
 540         state->db_rec = smbXsrv_client_global_fetch_locked(table->global.db_ctx,
 541                                                            &client_guid,
 542                                                            state);
 543         if (state->db_rec == NULL) {
 544                 tevent_req_nterror(req, NT_STATUS_INTERNAL_DB_ERROR);
 545                 return;
 546         }
 547
 548         smbXsrv_client_global_verify_record(state->db_rec,
 549                                             &is_free,
 550                                             NULL,
 551                                             state,
 552                                             &global,
 553                                             &seqnum);
 554         if (is_free) {
 555                 dbwrap_watched_watch_remove_instance(state->db_rec,
 556                                                      state->watch_instance);
 557                 state->watch_instance = 0;
 558
 559                 /*
 560                  * This stores the new client information in
 561                  * smbXsrv_client_global.tdb
 562                  */
 563                 client->global->client_guid = xconn->smb2.client.guid;
 564
 565                 client->global->db_rec = state->db_rec;
 566                 state->db_rec = NULL;
 567                 status = smbXsrv_client_global_store(client->global);
 568                 SMB_ASSERT(client->global->db_rec == NULL);
 569                 if (!NT_STATUS_IS_OK(status)) {
 570                         struct GUID_txt_buf buf;
 571                         DBG_ERR("client_guid[%s] store failed - %s\n",
 572                                 GUID_buf_string(&client->global->client_guid,
 573                                                 &buf),
 574                                 nt_errstr(status));
 575                         tevent_req_nterror(req, status);
 576                         return;
 577                 }
 578
 579                 if (DEBUGLVL(DBGLVL_DEBUG)) {
 580                         struct smbXsrv_clientB client_blob = {
 581                                 .version = SMBXSRV_VERSION_0,
 582                                 .info.info0 = client,
 583                         };
 584                         struct GUID_txt_buf buf;
 585
 586                         DBG_DEBUG("client_guid[%s] stored\n",
 587                                   GUID_buf_string(&client->global->client_guid,
 588                                                   &buf));
 589                         NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
 590                 }
 591
 592                 xconn->smb2.client.guid_verified = true;
 593                 tevent_req_done(req);
 594                 return;
 595         }
 596
 597         if (global == NULL) {
 598                 /*
 599                  * most likely ndr_pull_struct_blob() failed
 600                  */
 601                 tevent_req_nterror(req, NT_STATUS_INTERNAL_DB_CORRUPTION);
 602                 return;
 603         }
 604
 605         if (procid_is_local(&global->server_id)) {
 606                 subreq = messaging_filtered_read_send(state,
 607                                                       state->ev,
 608                                                       client->msg_ctx,
 609                                                       smb2srv_client_mc_negprot_filter,
 610                                                       NULL);
 611                 if (tevent_req_nomem(subreq, req)) {
 612                         return;
 613                 }
 614                 tevent_req_set_callback(subreq, smb2srv_client_mc_negprot_done, req);
 615                 state->filter_subreq = subreq;
 616         }
 617
 618         if (procid_is_local(&global->server_id)) {
 619                 status = smb2srv_client_connection_pass(state->smb2req,
 620                                                         global);
 621                 if (tevent_req_nterror(req, status)) {
 622                         return;
 623                 }
 624         } else {
 625                 status = smb2srv_client_connection_drop(state->smb2req,
 626                                                         global);
 627                 if (tevent_req_nterror(req, status)) {
 628                         return;
 629                 }
 630         }
 631
 632         /*
 633          * If the record changed, but we are not happy with the change yet,
 634          * we better remove ourself from the waiter list
 635          * (most likely the first position)
 636          * and re-add us at the end of the list.
 637          *
 638          * This gives other waiters a change
 639          * to make progress.
 640          *
 641          * Otherwise we'll keep our waiter instance alive,
 642          * keep waiting (most likely at first position).
 643          * It means the order of watchers stays fair.
 644          */
 645         if (state->last_seqnum != seqnum) {
 646                 state->last_seqnum = seqnum;
 647                 dbwrap_watched_watch_remove_instance(state->db_rec,
 648                                                      state->watch_instance);
 649                 state->watch_instance =
 650                         dbwrap_watched_watch_add_instance(state->db_rec);
 651         }
 652
 653         subreq = dbwrap_watched_watch_send(state,
 654                                            state->ev,
 655                                            state->db_rec,
 656                                            state->watch_instance,
 657                                            global->server_id);
 658         if (tevent_req_nomem(subreq, req)) {
 659                 return;
 660         }
 661         tevent_req_set_callback(subreq, smb2srv_client_mc_negprot_watched, req);
 662
 663         TALLOC_FREE(global);
 664         TALLOC_FREE(state->db_rec);
 665         return;
 666 }
 667
 668 static bool smb2srv_client_mc_negprot_filter(struct messaging_rec *rec, void *private_data)
 669 {
 670         if (rec->msg_type != MSG_SMBXSRV_CONNECTION_PASSED) {
 671                 return false;
 672         }
 673
 674         if (rec->num_fds != 0) {
 675                 return false;
 676         }
 677
 678         return true;
 679 }
 680
 681 static void smb2srv_client_mc_negprot_done(struct tevent_req *subreq)
 682 {
 683         struct tevent_req *req =
 684                 tevent_req_callback_data(subreq,
 685                 struct tevent_req);
 686         struct smb2srv_client_mc_negprot_state *state =
 687                 tevent_req_data(req,
 688                 struct smb2srv_client_mc_negprot_state);
 689         struct smbXsrv_connection *xconn = state->smb2req->xconn;
 690         struct smbXsrv_client *client = xconn->client;
 691         struct messaging_rec *rec = NULL;
 692         struct smbXsrv_connection_passB passed_blob;
 693         enum ndr_err_code ndr_err;
 694         struct smbXsrv_connection_pass0 *passed_info0 = NULL;
 695         NTSTATUS status;
 696         int ret;
 697
 698         SMB_ASSERT(state->filter_subreq == subreq);
 699         state->filter_subreq = NULL;
 700
 701         ret = messaging_filtered_read_recv(subreq, state, &rec);
 702         TALLOC_FREE(subreq);
 703         if (ret != 0) {
 704                 status = map_nt_error_from_unix_common(ret);
 705                 DBG_ERR("messaging_filtered_read_recv() - %s\n",
 706                         nt_errstr(status));
 707                 tevent_req_nterror(req, status);
 708                 return;
 709         }
 710
 711         DBG_DEBUG("MSG_SMBXSRV_CONNECTION_PASSED: received...\n");
 712
 713         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &passed_blob,
 714                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_passB);
 715         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 716                 status = ndr_map_error2ntstatus(ndr_err);
 717                 DBG_ERR("ndr_pull_struct_blob - %s\n", nt_errstr(status));
 718                 tevent_req_nterror(req, status);
 719                 return;
 720         }
 721
 722         if (DEBUGLVL(DBGLVL_DEBUG)) {
 723                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 724         }
 725
 726         if (passed_blob.version != SMBXSRV_VERSION_0) {
 727                 DBG_ERR("ignore invalid version %u\n", passed_blob.version);
 728                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 729                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 730                 return;
 731         }
 732
 733         passed_info0 = passed_blob.info.info0;
 734         if (passed_info0 == NULL) {
 735                 DBG_ERR("ignore NULL info %u\n", passed_blob.version);
 736                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 737                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 738                 return;
 739         }
 740
 741         if (!GUID_equal(&xconn->smb2.client.guid, &passed_info0->client_guid)) {
 742                 struct GUID_txt_buf buf1, buf2;
 743
 744                 DBG_ERR("client's client_guid [%s] != passed guid [%s]\n",
 745                         GUID_buf_string(&xconn->smb2.client.guid,
 746                                         &buf1),
 747                         GUID_buf_string(&passed_info0->client_guid,
 748                                         &buf2));
 749                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 750                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 751                 return;
 752         }
 753
 754         if (client->global->initial_connect_time !=
 755             passed_info0->xconn_connect_time)
 756         {
 757                 DBG_ERR("client's initial connect time [%s] (%llu) != "
 758                         "passed xconn connect time [%s] (%llu)\n",
 759                         nt_time_string(talloc_tos(),
 760                                        client->global->initial_connect_time),
 761                         (unsigned long long)client->global->initial_connect_time,
 762                         nt_time_string(talloc_tos(),
 763                                        passed_info0->xconn_connect_time),
 764                         (unsigned long long)passed_info0->xconn_connect_time);
 765                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 766                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 767                 return;
 768         }
 769
 770         if (passed_info0->negotiate_request.length != 0) {
 771                 DBG_ERR("negotiate_request.length[%zu]\n",
 772                         passed_info0->negotiate_request.length);
 773                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 774                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 775                 return;
 776         }
 777
 778         tevent_req_nterror(req, NT_STATUS_MESSAGE_RETRIEVED);
 779 }
 780
 781 static void smb2srv_client_mc_negprot_watched(struct tevent_req *subreq)
 782 {
 783         struct tevent_req *req =
 784                 tevent_req_callback_data(subreq,
 785                 struct tevent_req);
 786         struct smb2srv_client_mc_negprot_state *state =
 787                 tevent_req_data(req,
 788                 struct smb2srv_client_mc_negprot_state);
 789         NTSTATUS status;
 790         uint64_t instance = 0;
 791
 792         status = dbwrap_watched_watch_recv(subreq, &instance, NULL, NULL);
 793         TALLOC_FREE(subreq);
 794         if (tevent_req_nterror(req, status)) {
 795                 return;
 796         }
 797
 798         state->watch_instance = instance;
 799
 800         smb2srv_client_mc_negprot_next(req);
 801 }
 802
 803 NTSTATUS smb2srv_client_mc_negprot_recv(struct tevent_req *req)
 804 {
 805         return tevent_req_simple_recv_ntstatus(req);
 806 }
 807
 808 static NTSTATUS smbXsrv_client_global_remove(struct smbXsrv_client_global0 *global)
 809 {
 810         TDB_DATA key;
 811         NTSTATUS status;
 812
 813         /*
 814          * TODO: if we use other versions than '0'
 815          * we would add glue code here, that would be able to
 816          * store the information in the old format.
 817          */
 818
 819         if (global->db_rec == NULL) {
 820                 return NT_STATUS_INTERNAL_ERROR;
 821         }
 822
 823         key = dbwrap_record_get_key(global->db_rec);
 824
 825         status = dbwrap_record_delete(global->db_rec);
 826         if (!NT_STATUS_IS_OK(status)) {
 827                 DBG_WARNING("key '%s' delete - %s\n",
 828                         hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 829                         nt_errstr(status));
 830                 TALLOC_FREE(global->db_rec);
 831                 return status;
 832         }
 833         global->stored = false;
 834         DBG_DEBUG("key '%s' delete\n",
 835                   hex_encode_talloc(global->db_rec, key.dptr, key.dsize));
 836
 837         TALLOC_FREE(global->db_rec);
 838
 839         return NT_STATUS_OK;
 840 }
 841
 842 static int smbXsrv_client_destructor(struct smbXsrv_client *client)
 843 {
 844         NTSTATUS status;
 845
 846         status = smbXsrv_client_remove(client);
 847         if (!NT_STATUS_IS_OK(status)) {
 848                 DBG_ERR("smbXsrv_client_remove() failed: %s\n",
 849                         nt_errstr(status));
 850         }
 851
 852         TALLOC_FREE(client->global);
 853
 854         return 0;
 855 }
 856
 857 static bool smbXsrv_client_connection_pass_filter(struct messaging_rec *rec, void *private_data);
 858 static void smbXsrv_client_connection_pass_loop(struct tevent_req *subreq);
 859 static bool smbXsrv_client_connection_drop_filter(struct messaging_rec *rec, void *private_data);
 860 static void smbXsrv_client_connection_drop_loop(struct tevent_req *subreq);
 861
 862 NTSTATUS smbXsrv_client_create(TALLOC_CTX *mem_ctx,
 863                                struct tevent_context *ev_ctx,
 864                                struct messaging_context *msg_ctx,
 865                                NTTIME now,
 866                                struct smbXsrv_client **_client)
 867 {
 868         struct smbXsrv_client_table *table;
 869         struct smbXsrv_client *client = NULL;
 870         struct smbXsrv_client_global0 *global = NULL;
 871         NTSTATUS status;
 872         struct tevent_req *subreq = NULL;
 873
 874         status = smbXsrv_client_table_create(mem_ctx,
 875                                              msg_ctx,
 876                                              1, /* max_clients */
 877                                              &table);
 878         if (!NT_STATUS_IS_OK(status)) {
 879                 return status;
 880         }
 881
 882         if (table->local.num_clients >= table->local.max_clients) {
 883                 TALLOC_FREE(table);
 884                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 885         }
 886
 887         client = talloc_zero(mem_ctx, struct smbXsrv_client);
 888         if (client == NULL) {
 889                 TALLOC_FREE(table);
 890                 return NT_STATUS_NO_MEMORY;
 891         }
 892         client->raw_ev_ctx = ev_ctx;
 893         client->msg_ctx = msg_ctx;
 894
 895         client->server_multi_channel_enabled =
 896                 smbXsrv_server_multi_channel_enabled();
 897         if (client->server_multi_channel_enabled) {
 898                 client->next_channel_id = 1;
 899         }
 900         client->table = talloc_move(client, &table);
 901         table = client->table;
 902
 903         global = talloc_zero(client, struct smbXsrv_client_global0);
 904         if (global == NULL) {
 905                 TALLOC_FREE(client);
 906                 return NT_STATUS_NO_MEMORY;
 907         }
 908         talloc_set_destructor(global, smbXsrv_client_global_destructor);
 909         client->global = global;
 910
 911         global->initial_connect_time = now;
 912
 913         global->server_id = messaging_server_id(client->msg_ctx);
 914
 915         table->local.num_clients += 1;
 916
 917         talloc_set_destructor(client, smbXsrv_client_destructor);
 918
 919         if (DEBUGLVL(DBGLVL_DEBUG)) {
 920                 struct smbXsrv_clientB client_blob = {
 921                         .version = SMBXSRV_VERSION_0,
 922                         .info.info0 = client,
 923                 };
 924                 struct GUID_txt_buf buf;
 925
 926                 DBG_DEBUG("client_guid[%s] created\n",
 927                           GUID_buf_string(&global->client_guid, &buf));
 928                 NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
 929         }
 930
 931         subreq = messaging_filtered_read_send(client,
 932                                         client->raw_ev_ctx,
 933                                         client->msg_ctx,
 934                                         smbXsrv_client_connection_pass_filter,
 935                                         client);
 936         if (subreq == NULL) {
 937                 TALLOC_FREE(client);
 938                 return NT_STATUS_NO_MEMORY;
 939         }
 940         tevent_req_set_callback(subreq, smbXsrv_client_connection_pass_loop, client);
 941         client->connection_pass_subreq = subreq;
 942
 943         subreq = messaging_filtered_read_send(client,
 944                                         client->raw_ev_ctx,
 945                                         client->msg_ctx,
 946                                         smbXsrv_client_connection_drop_filter,
 947                                         client);
 948         if (subreq == NULL) {
 949                 TALLOC_FREE(client);
 950                 return NT_STATUS_NO_MEMORY;
 951         }
 952         tevent_req_set_callback(subreq, smbXsrv_client_connection_drop_loop, client);
 953         client->connection_drop_subreq = subreq;
 954
 955         *_client = client;
 956         return NT_STATUS_OK;
 957 }
 958
 959 static NTSTATUS smb2srv_client_connection_passed(struct smbXsrv_client *client,
 960                                 const struct smbXsrv_connection_pass0 *recv_info0)
 961 {
 962         DATA_BLOB blob;
 963         enum ndr_err_code ndr_err;
 964         NTSTATUS status;
 965         struct smbXsrv_connection_pass0 passed_info0;
 966         struct smbXsrv_connection_passB passed_blob;
 967         struct iovec iov;
 968
 969         /*
 970          * We echo back the message with a cleared negotiate_request
 971          */
 972         passed_info0 = *recv_info0;
 973         passed_info0.negotiate_request = data_blob_null;
 974
 975         ZERO_STRUCT(passed_blob);
 976         passed_blob.version = smbXsrv_version_global_current();
 977         passed_blob.info.info0 = &passed_info0;
 978
 979         if (DEBUGLVL(DBGLVL_DEBUG)) {
 980                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 981         }
 982
 983         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &passed_blob,
 984                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_passB);
 985         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 986                 status = ndr_map_error2ntstatus(ndr_err);
 987                 return status;
 988         }
 989
 990         iov.iov_base = blob.data;
 991         iov.iov_len = blob.length;
 992
 993         status = messaging_send_iov(client->msg_ctx,
 994                                     recv_info0->src_server_id,
 995                                     MSG_SMBXSRV_CONNECTION_PASSED,
 996                                     &iov, 1,
 997                                     NULL, 0);
 998         data_blob_free(&blob);
 999         if (!NT_STATUS_IS_OK(status)) {
1000                 return status;
1001         }
1002
1003         return NT_STATUS_OK;
1004 }
1005
1006 static bool smbXsrv_client_connection_pass_filter(struct messaging_rec *rec, void *private_data)
1007 {
1008         if (rec->msg_type != MSG_SMBXSRV_CONNECTION_PASS) {
1009                 return false;
1010         }
1011
1012         if (rec->num_fds != 1) {
1013                 return false;
1014         }
1015
1016         return true;
1017 }
1018
1019 static void smbXsrv_client_connection_pass_loop(struct tevent_req *subreq)
1020 {
1021         struct smbXsrv_client *client =
1022                 tevent_req_callback_data(subreq,
1023                 struct smbXsrv_client);
1024         struct smbXsrv_connection *xconn = NULL;
1025         int ret;
1026         struct messaging_rec *rec = NULL;
1027         struct smbXsrv_connection_passB pass_blob;
1028         enum ndr_err_code ndr_err;
1029         struct smbXsrv_connection_pass0 *pass_info0 = NULL;
1030         NTSTATUS status;
1031         int sock_fd = -1;
1032         uint64_t seq_low;
1033
1034         client->connection_pass_subreq = NULL;
1035
1036         ret = messaging_filtered_read_recv(subreq, talloc_tos(), &rec);
1037         TALLOC_FREE(subreq);
1038         if (ret != 0) {
1039                 goto next;
1040         }
1041
1042         if (rec->num_fds != 1) {
1043                 DBG_ERR("MSG_SMBXSRV_CONNECTION_PASS: num_fds[%u]\n",
1044                         rec->num_fds);
1045                 goto next;
1046         }
1047
1048         sock_fd = rec->fds[0];
1049         DBG_DEBUG("MSG_SMBXSRV_CONNECTION_PASS: got sock_fd[%d]\n", sock_fd);
1050
1051         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &pass_blob,
1052                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_passB);
1053         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1054                 status = ndr_map_error2ntstatus(ndr_err);
1055                 DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status));
1056                 goto next;
1057         }
1058
1059         if (DEBUGLVL(DBGLVL_DEBUG)) {
1060                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1061         }
1062
1063         if (pass_blob.version != SMBXSRV_VERSION_0) {
1064                 DBG_ERR("ignore invalid version %u\n", pass_blob.version);
1065                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1066                 goto next;
1067         }
1068
1069         pass_info0 = pass_blob.info.info0;
1070         if (pass_info0 == NULL) {
1071                 DBG_ERR("ignore NULL info %u\n", pass_blob.version);
1072                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1073                 goto next;
1074         }
1075
1076         if (!GUID_equal(&client->global->client_guid, &pass_info0->client_guid))
1077         {
1078                 struct GUID_txt_buf buf1, buf2;
1079
1080                 DBG_WARNING("client's client_guid [%s] != passed guid [%s]\n",
1081                             GUID_buf_string(&client->global->client_guid,
1082                                             &buf1),
1083                             GUID_buf_string(&pass_info0->client_guid,
1084                                             &buf2));
1085                 if (DEBUGLVL(DBGLVL_WARNING)) {
1086                         NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1087                 }
1088                 goto next;
1089         }
1090
1091         if (client->global->initial_connect_time !=
1092             pass_info0->client_connect_time)
1093         {
1094                 DBG_WARNING("client's initial connect time [%s] (%llu) != "
1095                         "passed initial connect time [%s] (%llu)\n",
1096                         nt_time_string(talloc_tos(),
1097                                        client->global->initial_connect_time),
1098                         (unsigned long long)client->global->initial_connect_time,
1099                         nt_time_string(talloc_tos(),
1100                                        pass_info0->client_connect_time),
1101                         (unsigned long long)pass_info0->client_connect_time);
1102                 if (DEBUGLVL(DBGLVL_WARNING)) {
1103                         NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1104                 }
1105                 goto next;
1106         }
1107
1108         if (pass_info0->negotiate_request.length < SMB2_HDR_BODY) {
1109                 DBG_WARNING("negotiate_request.length[%zu]\n",
1110                             pass_info0->negotiate_request.length);
1111                 if (DEBUGLVL(DBGLVL_WARNING)) {
1112                         NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1113                 }
1114                 goto next;
1115         }
1116
1117         status = smb2srv_client_connection_passed(client, pass_info0);
1118         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1119                 /*
1120                  * We hit a race where, the client dropped the connection
1121                  * while the socket was passed to us and the origin
1122                  * process already existed.
1123                  */
1124                 DBG_DEBUG("smb2srv_client_connection_passed() ignore %s\n",
1125                           nt_errstr(status));
1126                 status = NT_STATUS_OK;
1127         }
1128         if (!NT_STATUS_IS_OK(status)) {
1129                 const char *r = "smb2srv_client_connection_passed() failed";
1130                 DBG_ERR("%s => %s\n", r, nt_errstr(status));
1131                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1132                 exit_server_cleanly(r);
1133                 return;
1134         }
1135
1136         status = smbd_add_connection(client,
1137                                      sock_fd,
1138                                      pass_info0->xconn_connect_time,
1139                                      &xconn);
1140         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
1141                 rec->num_fds = 0;
1142                 smbd_server_connection_terminate(xconn, nt_errstr(status));
1143         }
1144         if (!NT_STATUS_IS_OK(status)) {
1145                 DBG_ERR("smbd_add_connection => %s\n", nt_errstr(status));
1146                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1147                 goto next;
1148         }
1149         rec->num_fds = 0;
1150
1151         /*
1152          * Set seq_low to mid received in negprot
1153          */
1154         seq_low = BVAL(pass_info0->negotiate_request.data,
1155                        SMB2_HDR_MESSAGE_ID);
1156
1157         xconn->smb2.client.guid_verified = true;
1158         smbd_smb2_process_negprot(xconn, seq_low,
1159                                   pass_info0->negotiate_request.data,
1160                                   pass_info0->negotiate_request.length);
1161
1162 next:
1163         if (rec != NULL) {
1164                 uint8_t fd_idx;
1165
1166                 for (fd_idx = 0; fd_idx < rec->num_fds; fd_idx++) {
1167                         sock_fd = rec->fds[fd_idx];
1168                         close(sock_fd);
1169                 }
1170                 rec->num_fds = 0;
1171
1172                 TALLOC_FREE(rec);
1173         }
1174
1175         subreq = messaging_filtered_read_send(client,
1176                                         client->raw_ev_ctx,
1177                                         client->msg_ctx,
1178                                         smbXsrv_client_connection_pass_filter,
1179                                         client);
1180         if (subreq == NULL) {
1181                 const char *r;
1182                 r = "messaging_read_send(MSG_SMBXSRV_CONNECTION_PASS failed";
1183                 exit_server_cleanly(r);
1184                 return;
1185         }
1186         tevent_req_set_callback(subreq, smbXsrv_client_connection_pass_loop, client);
1187         client->connection_pass_subreq = subreq;
1188 }
1189
1190 static bool smbXsrv_client_connection_drop_filter(struct messaging_rec *rec, void *private_data)
1191 {
1192         if (rec->msg_type != MSG_SMBXSRV_CONNECTION_DROP) {
1193                 return false;
1194         }
1195
1196         if (rec->num_fds != 0) {
1197                 return false;
1198         }
1199
1200         return true;
1201 }
1202
1203 static void smbXsrv_client_connection_drop_loop(struct tevent_req *subreq)
1204 {
1205         struct smbXsrv_client *client =
1206                 tevent_req_callback_data(subreq,
1207                 struct smbXsrv_client);
1208         int ret;
1209         struct messaging_rec *rec = NULL;
1210         struct smbXsrv_connection_dropB drop_blob;
1211         enum ndr_err_code ndr_err;
1212         struct smbXsrv_connection_drop0 *drop_info0 = NULL;
1213         struct server_id_buf src_server_id_buf = {};
1214         NTSTATUS status;
1215
1216         client->connection_drop_subreq = NULL;
1217
1218         ret = messaging_filtered_read_recv(subreq, talloc_tos(), &rec);
1219         TALLOC_FREE(subreq);
1220         if (ret != 0) {
1221                 goto next;
1222         }
1223
1224         if (rec->num_fds != 0) {
1225                 DBG_ERR("MSG_SMBXSRV_CONNECTION_DROP: num_fds[%u]\n",
1226                         rec->num_fds);
1227                 goto next;
1228         }
1229
1230         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &drop_blob,
1231                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_dropB);
1232         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1233                 status = ndr_map_error2ntstatus(ndr_err);
1234                 DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status));
1235                 goto next;
1236         }
1237
1238         if (DEBUGLVL(DBGLVL_DEBUG)) {
1239                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1240         }
1241
1242         if (drop_blob.version != SMBXSRV_VERSION_0) {
1243                 DBG_ERR("ignore invalid version %u\n", drop_blob.version);
1244                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1245                 goto next;
1246         }
1247
1248         drop_info0 = drop_blob.info.info0;
1249         if (drop_info0 == NULL) {
1250                 DBG_ERR("ignore NULL info %u\n", drop_blob.version);
1251                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1252                 goto next;
1253         }
1254
1255         if (!GUID_equal(&client->global->client_guid, &drop_info0->client_guid))
1256         {
1257                 struct GUID_txt_buf buf1, buf2;
1258
1259                 DBG_WARNING("client's client_guid [%s] != droped guid [%s]\n",
1260                             GUID_buf_string(&client->global->client_guid,
1261                                             &buf1),
1262                             GUID_buf_string(&drop_info0->client_guid,
1263                                             &buf2));
1264                 if (DEBUGLVL(DBGLVL_WARNING)) {
1265                         NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1266                 }
1267                 goto next;
1268         }
1269
1270         if (client->global->initial_connect_time !=
1271             drop_info0->client_connect_time)
1272         {
1273                 DBG_WARNING("client's initial connect time [%s] (%llu) != "
1274                         "droped initial connect time [%s] (%llu)\n",
1275                         nt_time_string(talloc_tos(),
1276                                        client->global->initial_connect_time),
1277                         (unsigned long long)client->global->initial_connect_time,
1278                         nt_time_string(talloc_tos(),
1279                                        drop_info0->client_connect_time),
1280                         (unsigned long long)drop_info0->client_connect_time);
1281                 if (DEBUGLVL(DBGLVL_WARNING)) {
1282                         NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1283                 }
1284                 goto next;
1285         }
1286
1287         /*
1288          * Disconnect all client connections, which means we will tear down all
1289          * sessions, tcons and non-durable opens. At the end we will remove our
1290          * smbXsrv_client_global.tdb record, which will wake up the watcher on
1291          * the other node in order to let it take over the client.
1292          *
1293          * The client will have to reopen all sessions, tcons and durable opens.
1294          */
1295         smbd_server_disconnect_client(client,
1296                 server_id_str_buf(drop_info0->src_server_id, &src_server_id_buf));
1297         return;
1298
1299 next:
1300         if (rec != NULL) {
1301                 int sock_fd;
1302                 uint8_t fd_idx;
1303
1304                 for (fd_idx = 0; fd_idx < rec->num_fds; fd_idx++) {
1305                         sock_fd = rec->fds[fd_idx];
1306                         close(sock_fd);
1307                 }
1308                 rec->num_fds = 0;
1309
1310                 TALLOC_FREE(rec);
1311         }
1312
1313         subreq = messaging_filtered_read_send(client,
1314                                         client->raw_ev_ctx,
1315                                         client->msg_ctx,
1316                                         smbXsrv_client_connection_drop_filter,
1317                                         client);
1318         if (subreq == NULL) {
1319                 const char *r;
1320                 r = "messaging_read_send(MSG_SMBXSRV_CONNECTION_DROP failed";
1321                 exit_server_cleanly(r);
1322                 return;
1323         }
1324         tevent_req_set_callback(subreq, smbXsrv_client_connection_drop_loop, client);
1325         client->connection_drop_subreq = subreq;
1326 }
1327
1328 NTSTATUS smbXsrv_client_remove(struct smbXsrv_client *client)
1329 {
1330         struct smbXsrv_client_table *table = client->table;
1331         NTSTATUS status;
1332
1333         if (client->global->db_rec != NULL) {
1334                 struct GUID_txt_buf buf;
1335                 DBG_ERR("client_guid[%s]: Called with db_rec != NULL'\n",
1336                         GUID_buf_string(&client->global->client_guid,
1337                                         &buf));
1338                 return NT_STATUS_INTERNAL_ERROR;
1339         }
1340
1341         if (!client->global->stored) {
1342                 return NT_STATUS_OK;
1343         }
1344
1345         TALLOC_FREE(client->connection_pass_subreq);
1346         TALLOC_FREE(client->connection_drop_subreq);
1347
1348         client->global->db_rec = smbXsrv_client_global_fetch_locked(
1349                                         table->global.db_ctx,
1350                                         &client->global->client_guid,
1351                                         client->global /* TALLOC_CTX */);
1352         if (client->global->db_rec == NULL) {
1353                 return NT_STATUS_INTERNAL_DB_ERROR;
1354         }
1355
1356         status = smbXsrv_client_global_remove(client->global);
1357         if (!NT_STATUS_IS_OK(status)) {
1358                 struct GUID_txt_buf buf;
1359                 DBG_ERR("client_guid[%s] store failed - %s\n",
1360                         GUID_buf_string(&client->global->client_guid, &buf),
1361                         nt_errstr(status));
1362                 return status;
1363         }
1364
1365         if (DEBUGLVL(DBGLVL_DEBUG)) {
1366                 struct smbXsrv_clientB client_blob = {
1367                         .version = SMBXSRV_VERSION_0,
1368                         .info.info0 = client,
1369                 };
1370                 struct GUID_txt_buf buf;
1371
1372                 DBG_DEBUG("client_guid[%s] stored\n",
1373                           GUID_buf_string(&client->global->client_guid, &buf));
1374                 NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
1375         }
1376
1377         return NT_STATUS_OK;
1378 }