source3/smbd/smbXsrv_client.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2014
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/filesys.h"
  22 #include <tevent.h>
  23 #include "lib/util/server_id.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "dbwrap/dbwrap.h"
  27 #include "dbwrap/dbwrap_rbt.h"
  28 #include "dbwrap/dbwrap_open.h"
  29 #include "dbwrap/dbwrap_watch.h"
  30 #include "session.h"
  31 #include "auth.h"
  32 #include "auth/gensec/gensec.h"
  33 #include "../lib/tsocket/tsocket.h"
  34 #include "../libcli/security/security.h"
  35 #include "messages.h"
  36 #include "lib/util/util_tdb.h"
  37 #include "librpc/gen_ndr/ndr_smbXsrv.h"
  38 #include "serverid.h"
  39 #include "lib/util/tevent_ntstatus.h"
  40 #include "lib/util/iov_buf.h"
  41 #include "lib/global_contexts.h"
  42 #include "source3/include/util_tdb.h"
  43
  44 struct smbXsrv_client_table {
  45         struct {
  46                 uint32_t max_clients;
  47                 uint32_t num_clients;
  48         } local;
  49         struct {
  50                 struct db_context *db_ctx;
  51         } global;
  52 };
  53
  54 static struct db_context *smbXsrv_client_global_db_ctx = NULL;
  55
  56 NTSTATUS smbXsrv_client_global_init(void)
  57 {
  58         const char *global_path = NULL;
  59         struct db_context *backend = NULL;
  60         struct db_context *db_ctx = NULL;
  61
  62         if (smbXsrv_client_global_db_ctx != NULL) {
  63                 return NT_STATUS_OK;
  64         }
  65
  66         /*
  67          * This contains secret information like client keys!
  68          */
  69         global_path = lock_path(talloc_tos(), "smbXsrv_client_global.tdb");
  70         if (global_path == NULL) {
  71                 return NT_STATUS_NO_MEMORY;
  72         }
  73
  74         backend = db_open(NULL, global_path,
  75                           0, /* hash_size */
  76                           TDB_DEFAULT |
  77                           TDB_CLEAR_IF_FIRST |
  78                           TDB_INCOMPATIBLE_HASH,
  79                           O_RDWR | O_CREAT, 0600,
  80                           DBWRAP_LOCK_ORDER_1,
  81                           DBWRAP_FLAG_NONE);
  82         if (backend == NULL) {
  83                 NTSTATUS status;
  84
  85                 status = map_nt_error_from_unix_common(errno);
  86
  87                 return status;
  88         }
  89
  90         db_ctx = db_open_watched(NULL, &backend, global_messaging_context());
  91         if (db_ctx == NULL) {
  92                 TALLOC_FREE(backend);
  93                 return NT_STATUS_NO_MEMORY;
  94         }
  95
  96         smbXsrv_client_global_db_ctx = db_ctx;
  97
  98         return NT_STATUS_OK;
  99 }
 100
 101 /*
 102  * NOTE:
 103  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
 104  * has the same result as integer comparison between the uint32_t
 105  * values.
 106  *
 107  * TODO: implement string based key
 108  */
 109
 110 #define SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE 16
 111
 112 static TDB_DATA smbXsrv_client_global_id_to_key(const struct GUID *client_guid,
 113                                                 uint8_t *key_buf)
 114 {
 115         TDB_DATA key = { .dsize = 0, };
 116         NTSTATUS status;
 117         struct GUID_ndr_buf buf = { .buf = {0}, };
 118
 119         status = GUID_to_ndr_buf(client_guid, &buf);
 120         if (!NT_STATUS_IS_OK(status)) {
 121                 return key;
 122         }
 123         memcpy(key_buf, buf.buf, SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE);
 124
 125         key = make_tdb_data(key_buf, SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE);
 126
 127         return key;
 128 }
 129
 130 static struct db_record *smbXsrv_client_global_fetch_locked(
 131                         struct db_context *db,
 132                         const struct GUID *client_guid,
 133                         TALLOC_CTX *mem_ctx)
 134 {
 135         TDB_DATA key;
 136         uint8_t key_buf[SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE];
 137         struct db_record *rec = NULL;
 138
 139         key = smbXsrv_client_global_id_to_key(client_guid, key_buf);
 140
 141         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 142
 143         if (rec == NULL) {
 144                 struct GUID_txt_buf buf;
 145                 DBG_DEBUG("Failed to lock guid [%s], key '%s'\n",
 146                           GUID_buf_string(client_guid, &buf),
 147                           tdb_data_dbg(key));
 148         }
 149
 150         return rec;
 151 }
 152
 153 static NTSTATUS smbXsrv_client_table_create(TALLOC_CTX *mem_ctx,
 154                                             struct messaging_context *msg_ctx,
 155                                             uint32_t max_clients,
 156                                             struct smbXsrv_client_table **_table)
 157 {
 158         struct smbXsrv_client_table *table;
 159         NTSTATUS status;
 160
 161         if (max_clients > 1) {
 162                 return NT_STATUS_INTERNAL_ERROR;
 163         }
 164
 165         table = talloc_zero(mem_ctx, struct smbXsrv_client_table);
 166         if (table == NULL) {
 167                 return NT_STATUS_NO_MEMORY;
 168         }
 169
 170         table->local.max_clients = max_clients;
 171
 172         status = smbXsrv_client_global_init();
 173         if (!NT_STATUS_IS_OK(status)) {
 174                 TALLOC_FREE(table);
 175                 return status;
 176         }
 177
 178         table->global.db_ctx = smbXsrv_client_global_db_ctx;
 179
 180         *_table = table;
 181         return NT_STATUS_OK;
 182 }
 183
 184 static int smbXsrv_client_global_destructor(struct smbXsrv_client_global0 *global)
 185 {
 186         return 0;
 187 }
 188
 189 static void smbXsrv_client_global_verify_record(struct db_record *db_rec,
 190                                         bool *is_free,
 191                                         bool *was_free,
 192                                         TALLOC_CTX *mem_ctx,
 193                                         const struct server_id *dead_server_id,
 194                                         struct smbXsrv_client_global0 **_g,
 195                                         uint32_t *pseqnum)
 196 {
 197         TDB_DATA key;
 198         TDB_DATA val;
 199         DATA_BLOB blob;
 200         struct smbXsrv_client_globalB global_blob;
 201         enum ndr_err_code ndr_err;
 202         struct smbXsrv_client_global0 *global = NULL;
 203         bool dead = false;
 204         bool exists;
 205         TALLOC_CTX *frame = talloc_stackframe();
 206
 207         *is_free = false;
 208
 209         if (was_free) {
 210                 *was_free = false;
 211         }
 212         if (_g) {
 213                 *_g = NULL;
 214         }
 215         if (pseqnum) {
 216                 *pseqnum = 0;
 217         }
 218
 219         key = dbwrap_record_get_key(db_rec);
 220
 221         val = dbwrap_record_get_value(db_rec);
 222         if (val.dsize == 0) {
 223                 TALLOC_FREE(frame);
 224                 *is_free = true;
 225                 if (was_free) {
 226                         *was_free = true;
 227                 }
 228                 return;
 229         }
 230
 231         blob = data_blob_const(val.dptr, val.dsize);
 232
 233         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
 234                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_client_globalB);
 235         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 236                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 237                 DBG_WARNING("key '%s' ndr_pull_struct_blob - %s\n",
 238                             tdb_data_dbg(key),
 239                             nt_errstr(status));
 240                 TALLOC_FREE(frame);
 241                 return;
 242         }
 243
 244         DBG_DEBUG("client_global:\n");
 245         if (DEBUGLVL(DBGLVL_DEBUG)) {
 246                 NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 247         }
 248
 249         if (global_blob.version != SMBXSRV_VERSION_0) {
 250                 DBG_ERR("key '%s' use unsupported version %u\n",
 251                         tdb_data_dbg(key),
 252                         global_blob.version);
 253                 NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 254                 TALLOC_FREE(frame);
 255                 return;
 256         }
 257
 258         global = global_blob.info.info0;
 259
 260         dead = server_id_equal(dead_server_id, &global->server_id);
 261         if (dead) {
 262                 struct server_id_buf tmp;
 263
 264                 DBG_NOTICE("key '%s' server_id %s is already dead.\n",
 265                            tdb_data_dbg(key),
 266                            server_id_str_buf(global->server_id, &tmp));
 267                 if (DEBUGLVL(DBGLVL_NOTICE)) {
 268                         NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 269                 }
 270                 TALLOC_FREE(frame);
 271                 dbwrap_record_delete(db_rec);
 272                 *is_free = true;
 273                 return;
 274         }
 275
 276         exists = serverid_exists(&global->server_id);
 277         if (!exists) {
 278                 struct server_id_buf tmp;
 279
 280                 DBG_NOTICE("key '%s' server_id %s does not exist.\n",
 281                            tdb_data_dbg(key),
 282                            server_id_str_buf(global->server_id, &tmp));
 283                 if (DEBUGLVL(DBGLVL_NOTICE)) {
 284                         NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 285                 }
 286                 TALLOC_FREE(frame);
 287                 dbwrap_record_delete(db_rec);
 288                 *is_free = true;
 289                 return;
 290         }
 291
 292         if (_g) {
 293                 *_g = talloc_move(mem_ctx, &global);
 294         }
 295         if (pseqnum) {
 296                 *pseqnum = global_blob.seqnum;
 297         }
 298         TALLOC_FREE(frame);
 299 }
 300
 301 static NTSTATUS smb2srv_client_connection_pass(struct smbd_smb2_request *smb2req,
 302                                                struct smbXsrv_client_global0 *global)
 303 {
 304         DATA_BLOB blob;
 305         enum ndr_err_code ndr_err;
 306         NTSTATUS status;
 307         struct smbXsrv_connection_pass0 pass_info0;
 308         struct smbXsrv_connection_passB pass_blob;
 309         ssize_t reqlen;
 310         struct iovec iov;
 311
 312         pass_info0 = (struct smbXsrv_connection_pass0) {
 313                 .client_guid = global->client_guid,
 314                 .src_server_id = smb2req->xconn->client->global->server_id,
 315                 .xconn_connect_time = smb2req->xconn->client->global->initial_connect_time,
 316                 .dst_server_id = global->server_id,
 317                 .client_connect_time = global->initial_connect_time,
 318         };
 319
 320         reqlen = iov_buflen(smb2req->in.vector, smb2req->in.vector_count);
 321         if (reqlen == -1) {
 322                 return NT_STATUS_INVALID_BUFFER_SIZE;
 323         }
 324
 325         pass_info0.negotiate_request.length = reqlen;
 326         pass_info0.negotiate_request.data = talloc_array(talloc_tos(), uint8_t,
 327                                                          reqlen);
 328         if (pass_info0.negotiate_request.data == NULL) {
 329                 return NT_STATUS_NO_MEMORY;
 330         }
 331         iov_buf(smb2req->in.vector, smb2req->in.vector_count,
 332                 pass_info0.negotiate_request.data,
 333                 pass_info0.negotiate_request.length);
 334
 335         ZERO_STRUCT(pass_blob);
 336         pass_blob.version = smbXsrv_version_global_current();
 337         pass_blob.info.info0 = &pass_info0;
 338
 339         if (DEBUGLVL(DBGLVL_DEBUG)) {
 340                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
 341         }
 342
 343         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &pass_blob,
 344                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_passB);
 345         data_blob_free(&pass_info0.negotiate_request);
 346         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 347                 status = ndr_map_error2ntstatus(ndr_err);
 348                 return status;
 349         }
 350
 351         iov.iov_base = blob.data;
 352         iov.iov_len = blob.length;
 353
 354         status = messaging_send_iov(smb2req->xconn->client->msg_ctx,
 355                                     global->server_id,
 356                                     MSG_SMBXSRV_CONNECTION_PASS,
 357                                     &iov, 1,
 358                                     &smb2req->xconn->transport.sock, 1);
 359         data_blob_free(&blob);
 360         if (!NT_STATUS_IS_OK(status)) {
 361                 return status;
 362         }
 363
 364         return NT_STATUS_OK;
 365 }
 366
 367 static NTSTATUS smb2srv_client_connection_drop(struct smbd_smb2_request *smb2req,
 368                                                struct smbXsrv_client_global0 *global)
 369 {
 370         DATA_BLOB blob;
 371         enum ndr_err_code ndr_err;
 372         NTSTATUS status;
 373         struct smbXsrv_connection_drop0 drop_info0;
 374         struct smbXsrv_connection_dropB drop_blob;
 375         struct iovec iov;
 376
 377         drop_info0 = (struct smbXsrv_connection_drop0) {
 378                 .client_guid = global->client_guid,
 379                 .src_server_id = smb2req->xconn->client->global->server_id,
 380                 .xconn_connect_time = smb2req->xconn->client->global->initial_connect_time,
 381                 .dst_server_id = global->server_id,
 382                 .client_connect_time = global->initial_connect_time,
 383         };
 384
 385         ZERO_STRUCT(drop_blob);
 386         drop_blob.version = smbXsrv_version_global_current();
 387         drop_blob.info.info0 = &drop_info0;
 388
 389         if (DEBUGLVL(DBGLVL_DEBUG)) {
 390                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
 391         }
 392
 393         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &drop_blob,
 394                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_dropB);
 395         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 396                 status = ndr_map_error2ntstatus(ndr_err);
 397                 return status;
 398         }
 399
 400         iov.iov_base = blob.data;
 401         iov.iov_len = blob.length;
 402
 403         status = messaging_send_iov(smb2req->xconn->client->msg_ctx,
 404                                     global->server_id,
 405                                     MSG_SMBXSRV_CONNECTION_DROP,
 406                                     &iov, 1,
 407                                     NULL, 0);
 408         data_blob_free(&blob);
 409         if (!NT_STATUS_IS_OK(status)) {
 410                 return status;
 411         }
 412
 413         return NT_STATUS_OK;
 414 }
 415
 416 static NTSTATUS smbXsrv_client_global_store(struct smbXsrv_client_global0 *global)
 417 {
 418         struct smbXsrv_client_globalB global_blob;
 419         DATA_BLOB blob = data_blob_null;
 420         TDB_DATA key;
 421         TDB_DATA val;
 422         NTSTATUS status;
 423         enum ndr_err_code ndr_err;
 424         bool saved_stored = global->stored;
 425
 426         /*
 427          * TODO: if we use other versions than '0'
 428          * we would add glue code here, that would be able to
 429          * store the information in the old format.
 430          */
 431
 432         SMB_ASSERT(global->local_address != NULL);
 433         SMB_ASSERT(global->remote_address != NULL);
 434         SMB_ASSERT(global->remote_name != NULL);
 435
 436         if (global->db_rec == NULL) {
 437                 return NT_STATUS_INTERNAL_ERROR;
 438         }
 439
 440         key = dbwrap_record_get_key(global->db_rec);
 441         val = dbwrap_record_get_value(global->db_rec);
 442
 443         ZERO_STRUCT(global_blob);
 444         global_blob.version = smbXsrv_version_global_current();
 445         if (val.dsize >= 8) {
 446                 global_blob.seqnum = IVAL(val.dptr, 4);
 447         }
 448         global_blob.seqnum += 1;
 449         global_blob.info.info0 = global;
 450
 451         global->stored = true;
 452         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
 453                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_client_globalB);
 454         global->stored = saved_stored;
 455         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 456                 status = ndr_map_error2ntstatus(ndr_err);
 457                 DBG_WARNING("key '%s' ndr_push - %s\n",
 458                         tdb_data_dbg(key),
 459                         nt_errstr(status));
 460                 TALLOC_FREE(global->db_rec);
 461                 return status;
 462         }
 463
 464         val = make_tdb_data(blob.data, blob.length);
 465         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
 466         if (!NT_STATUS_IS_OK(status)) {
 467                 DBG_WARNING("key '%s' store - %s\n",
 468                         tdb_data_dbg(key),
 469                         nt_errstr(status));
 470                 TALLOC_FREE(global->db_rec);
 471                 return status;
 472         }
 473
 474         global->stored = true;
 475
 476         if (DEBUGLVL(DBGLVL_DEBUG)) {
 477                 DBG_DEBUG("key '%s' stored\n",
 478                           tdb_data_dbg(key));
 479                 NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 480         }
 481
 482         TALLOC_FREE(global->db_rec);
 483
 484         return NT_STATUS_OK;
 485 }
 486
 487 struct smb2srv_client_mc_negprot_state {
 488         struct tevent_context *ev;
 489         struct smbd_smb2_request *smb2req;
 490         struct db_record *db_rec;
 491         uint64_t watch_instance;
 492         uint32_t last_seqnum;
 493         struct tevent_req *filter_subreq;
 494 };
 495
 496 static void smb2srv_client_mc_negprot_cleanup(struct tevent_req *req,
 497                                               enum tevent_req_state req_state)
 498 {
 499         struct smb2srv_client_mc_negprot_state *state =
 500                 tevent_req_data(req,
 501                 struct smb2srv_client_mc_negprot_state);
 502
 503         if (state->db_rec != NULL) {
 504                 dbwrap_watched_watch_remove_instance(state->db_rec,
 505                                                      state->watch_instance);
 506                 state->watch_instance = 0;
 507                 TALLOC_FREE(state->db_rec);
 508         }
 509 }
 510
 511 static void smb2srv_client_mc_negprot_next(struct tevent_req *req);
 512 static bool smb2srv_client_mc_negprot_filter(struct messaging_rec *rec, void *private_data);
 513 static void smb2srv_client_mc_negprot_done(struct tevent_req *subreq);
 514 static void smb2srv_client_mc_negprot_watched(struct tevent_req *subreq);
 515
 516 struct tevent_req *smb2srv_client_mc_negprot_send(TALLOC_CTX *mem_ctx,
 517                                                   struct tevent_context *ev,
 518                                                   struct smbd_smb2_request *smb2req)
 519 {
 520         struct tevent_req *req = NULL;
 521         struct smb2srv_client_mc_negprot_state *state = NULL;
 522
 523         req = tevent_req_create(mem_ctx, &state,
 524                                 struct smb2srv_client_mc_negprot_state);
 525         if (req == NULL) {
 526                 return NULL;
 527         }
 528         state->ev = ev;
 529         state->smb2req = smb2req;
 530
 531         tevent_req_set_cleanup_fn(req, smb2srv_client_mc_negprot_cleanup);
 532
 533         smb2srv_client_mc_negprot_next(req);
 534
 535         if (!tevent_req_is_in_progress(req)) {
 536                 return tevent_req_post(req, ev);
 537         }
 538
 539         return req;
 540 }
 541
 542 static void smb2srv_client_mc_negprot_next(struct tevent_req *req)
 543 {
 544         struct smb2srv_client_mc_negprot_state *state =
 545                 tevent_req_data(req,
 546                 struct smb2srv_client_mc_negprot_state);
 547         struct smbXsrv_connection *xconn = state->smb2req->xconn;
 548         struct smbXsrv_client *client = xconn->client;
 549         struct smbXsrv_client_table *table = client->table;
 550         struct GUID client_guid = xconn->smb2.client.guid;
 551         struct smbXsrv_client_global0 *global = NULL;
 552         bool is_free = false;
 553         struct tevent_req *subreq = NULL;
 554         NTSTATUS status;
 555         uint32_t seqnum = 0;
 556         struct server_id last_server_id = { .pid = 0, };
 557
 558         TALLOC_FREE(state->filter_subreq);
 559         SMB_ASSERT(state->db_rec == NULL);
 560         state->db_rec = smbXsrv_client_global_fetch_locked(table->global.db_ctx,
 561                                                            &client_guid,
 562                                                            state);
 563         if (state->db_rec == NULL) {
 564                 tevent_req_nterror(req, NT_STATUS_INTERNAL_DB_ERROR);
 565                 return;
 566         }
 567
 568 verify_again:
 569         TALLOC_FREE(global);
 570
 571         smbXsrv_client_global_verify_record(state->db_rec,
 572                                             &is_free,
 573                                             NULL,
 574                                             state,
 575                                             &last_server_id,
 576                                             &global,
 577                                             &seqnum);
 578         if (is_free) {
 579                 dbwrap_watched_watch_remove_instance(state->db_rec,
 580                                                      state->watch_instance);
 581                 state->watch_instance = 0;
 582
 583                 /*
 584                  * This stores the new client information in
 585                  * smbXsrv_client_global.tdb
 586                  */
 587                 client->global->client_guid = xconn->smb2.client.guid;
 588
 589                 client->global->db_rec = state->db_rec;
 590                 state->db_rec = NULL;
 591                 status = smbXsrv_client_global_store(client->global);
 592                 SMB_ASSERT(client->global->db_rec == NULL);
 593                 if (!NT_STATUS_IS_OK(status)) {
 594                         struct GUID_txt_buf buf;
 595                         DBG_ERR("client_guid[%s] store failed - %s\n",
 596                                 GUID_buf_string(&client->global->client_guid,
 597                                                 &buf),
 598                                 nt_errstr(status));
 599                         tevent_req_nterror(req, status);
 600                         return;
 601                 }
 602
 603                 if (DEBUGLVL(DBGLVL_DEBUG)) {
 604                         struct smbXsrv_clientB client_blob = {
 605                                 .version = SMBXSRV_VERSION_0,
 606                                 .info.info0 = client,
 607                         };
 608                         struct GUID_txt_buf buf;
 609
 610                         DBG_DEBUG("client_guid[%s] stored\n",
 611                                   GUID_buf_string(&client->global->client_guid,
 612                                                   &buf));
 613                         NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
 614                 }
 615
 616                 xconn->smb2.client.guid_verified = true;
 617                 tevent_req_done(req);
 618                 return;
 619         }
 620
 621         if (global == NULL) {
 622                 /*
 623                  * most likely ndr_pull_struct_blob() failed
 624                  */
 625                 tevent_req_nterror(req, NT_STATUS_INTERNAL_DB_CORRUPTION);
 626                 return;
 627         }
 628
 629         /*
 630          * If last_server_id is set, we expect
 631          * smbXsrv_client_global_verify_record()
 632          * to detect the already dead global->server_id
 633          * as state->db_rec is still locked and its
 634          * value didn't change.
 635          */
 636         SMB_ASSERT(last_server_id.pid == 0);
 637         last_server_id = global->server_id;
 638
 639         if (procid_is_local(&global->server_id)) {
 640                 subreq = messaging_filtered_read_send(state,
 641                                                       state->ev,
 642                                                       client->msg_ctx,
 643                                                       smb2srv_client_mc_negprot_filter,
 644                                                       NULL);
 645                 if (tevent_req_nomem(subreq, req)) {
 646                         return;
 647                 }
 648                 tevent_req_set_callback(subreq, smb2srv_client_mc_negprot_done, req);
 649                 state->filter_subreq = subreq;
 650         }
 651
 652         if (procid_is_local(&global->server_id)) {
 653                 status = smb2srv_client_connection_pass(state->smb2req,
 654                                                         global);
 655                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 656                         /*
 657                          * We remembered last_server_id = global->server_id
 658                          * above, so we'll treat it as dead in the
 659                          * next round to smbXsrv_client_global_verify_record().
 660                          */
 661                         goto verify_again;
 662                 }
 663                 if (tevent_req_nterror(req, status)) {
 664                         return;
 665                 }
 666         } else {
 667                 status = smb2srv_client_connection_drop(state->smb2req,
 668                                                         global);
 669                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 670                         /*
 671                          * We remembered last_server_id = global->server_id
 672                          * above, so we'll treat it as dead in the
 673                          * next round to smbXsrv_client_global_verify_record().
 674                          */
 675                         goto verify_again;
 676                 }
 677                 if (tevent_req_nterror(req, status)) {
 678                         return;
 679                 }
 680         }
 681
 682         /*
 683          * If the record changed, but we are not happy with the change yet,
 684          * we better remove ourself from the waiter list
 685          * (most likely the first position)
 686          * and re-add us at the end of the list.
 687          *
 688          * This gives other waiters a change
 689          * to make progress.
 690          *
 691          * Otherwise we'll keep our waiter instance alive,
 692          * keep waiting (most likely at first position).
 693          * It means the order of watchers stays fair.
 694          */
 695         if (state->last_seqnum != seqnum) {
 696                 state->last_seqnum = seqnum;
 697                 dbwrap_watched_watch_remove_instance(state->db_rec,
 698                                                      state->watch_instance);
 699                 state->watch_instance =
 700                         dbwrap_watched_watch_add_instance(state->db_rec);
 701         }
 702
 703         subreq = dbwrap_watched_watch_send(state,
 704                                            state->ev,
 705                                            state->db_rec,
 706                                            state->watch_instance,
 707                                            global->server_id);
 708         if (tevent_req_nomem(subreq, req)) {
 709                 return;
 710         }
 711         tevent_req_set_callback(subreq, smb2srv_client_mc_negprot_watched, req);
 712
 713         TALLOC_FREE(global);
 714         TALLOC_FREE(state->db_rec);
 715         return;
 716 }
 717
 718 static bool smb2srv_client_mc_negprot_filter(struct messaging_rec *rec, void *private_data)
 719 {
 720         if (rec->msg_type != MSG_SMBXSRV_CONNECTION_PASSED) {
 721                 return false;
 722         }
 723
 724         if (rec->num_fds != 0) {
 725                 return false;
 726         }
 727
 728         return true;
 729 }
 730
 731 static void smb2srv_client_mc_negprot_done(struct tevent_req *subreq)
 732 {
 733         struct tevent_req *req =
 734                 tevent_req_callback_data(subreq,
 735                 struct tevent_req);
 736         struct smb2srv_client_mc_negprot_state *state =
 737                 tevent_req_data(req,
 738                 struct smb2srv_client_mc_negprot_state);
 739         struct smbXsrv_connection *xconn = state->smb2req->xconn;
 740         struct smbXsrv_client *client = xconn->client;
 741         struct messaging_rec *rec = NULL;
 742         struct smbXsrv_connection_passB passed_blob;
 743         enum ndr_err_code ndr_err;
 744         struct smbXsrv_connection_pass0 *passed_info0 = NULL;
 745         NTSTATUS status;
 746         int ret;
 747
 748         SMB_ASSERT(state->filter_subreq == subreq);
 749         state->filter_subreq = NULL;
 750
 751         ret = messaging_filtered_read_recv(subreq, state, &rec);
 752         TALLOC_FREE(subreq);
 753         if (ret != 0) {
 754                 status = map_nt_error_from_unix_common(ret);
 755                 DBG_ERR("messaging_filtered_read_recv() - %s\n",
 756                         nt_errstr(status));
 757                 tevent_req_nterror(req, status);
 758                 return;
 759         }
 760
 761         DBG_DEBUG("MSG_SMBXSRV_CONNECTION_PASSED: received...\n");
 762
 763         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &passed_blob,
 764                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_passB);
 765         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 766                 status = ndr_map_error2ntstatus(ndr_err);
 767                 DBG_ERR("ndr_pull_struct_blob - %s\n", nt_errstr(status));
 768                 tevent_req_nterror(req, status);
 769                 return;
 770         }
 771
 772         if (DEBUGLVL(DBGLVL_DEBUG)) {
 773                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 774         }
 775
 776         if (passed_blob.version != SMBXSRV_VERSION_0) {
 777                 DBG_ERR("ignore invalid version %u\n", passed_blob.version);
 778                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 779                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 780                 return;
 781         }
 782
 783         passed_info0 = passed_blob.info.info0;
 784         if (passed_info0 == NULL) {
 785                 DBG_ERR("ignore NULL info %u\n", passed_blob.version);
 786                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 787                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 788                 return;
 789         }
 790
 791         if (!GUID_equal(&xconn->smb2.client.guid, &passed_info0->client_guid)) {
 792                 struct GUID_txt_buf buf1, buf2;
 793
 794                 DBG_ERR("client's client_guid [%s] != passed guid [%s]\n",
 795                         GUID_buf_string(&xconn->smb2.client.guid,
 796                                         &buf1),
 797                         GUID_buf_string(&passed_info0->client_guid,
 798                                         &buf2));
 799                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 800                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 801                 return;
 802         }
 803
 804         if (client->global->initial_connect_time !=
 805             passed_info0->xconn_connect_time)
 806         {
 807                 DBG_ERR("client's initial connect time [%s] (%llu) != "
 808                         "passed xconn connect time [%s] (%llu)\n",
 809                         nt_time_string(talloc_tos(),
 810                                        client->global->initial_connect_time),
 811                         (unsigned long long)client->global->initial_connect_time,
 812                         nt_time_string(talloc_tos(),
 813                                        passed_info0->xconn_connect_time),
 814                         (unsigned long long)passed_info0->xconn_connect_time);
 815                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 816                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 817                 return;
 818         }
 819
 820         if (passed_info0->negotiate_request.length != 0) {
 821                 DBG_ERR("negotiate_request.length[%zu]\n",
 822                         passed_info0->negotiate_request.length);
 823                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 824                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 825                 return;
 826         }
 827
 828         tevent_req_nterror(req, NT_STATUS_MESSAGE_RETRIEVED);
 829 }
 830
 831 static void smb2srv_client_mc_negprot_watched(struct tevent_req *subreq)
 832 {
 833         struct tevent_req *req =
 834                 tevent_req_callback_data(subreq,
 835                 struct tevent_req);
 836         struct smb2srv_client_mc_negprot_state *state =
 837                 tevent_req_data(req,
 838                 struct smb2srv_client_mc_negprot_state);
 839         NTSTATUS status;
 840         uint64_t instance = 0;
 841
 842         status = dbwrap_watched_watch_recv(subreq, &instance, NULL, NULL);
 843         TALLOC_FREE(subreq);
 844         if (tevent_req_nterror(req, status)) {
 845                 return;
 846         }
 847
 848         state->watch_instance = instance;
 849
 850         smb2srv_client_mc_negprot_next(req);
 851 }
 852
 853 NTSTATUS smb2srv_client_mc_negprot_recv(struct tevent_req *req)
 854 {
 855         return tevent_req_simple_recv_ntstatus(req);
 856 }
 857
 858 static NTSTATUS smbXsrv_client_global_remove(struct smbXsrv_client_global0 *global)
 859 {
 860         TDB_DATA key;
 861         NTSTATUS status;
 862
 863         /*
 864          * TODO: if we use other versions than '0'
 865          * we would add glue code here, that would be able to
 866          * store the information in the old format.
 867          */
 868
 869         if (global->db_rec == NULL) {
 870                 return NT_STATUS_INTERNAL_ERROR;
 871         }
 872
 873         key = dbwrap_record_get_key(global->db_rec);
 874
 875         status = dbwrap_record_delete(global->db_rec);
 876         if (!NT_STATUS_IS_OK(status)) {
 877                 DBG_WARNING("key '%s' delete - %s\n",
 878                         tdb_data_dbg(key),
 879                         nt_errstr(status));
 880                 TALLOC_FREE(global->db_rec);
 881                 return status;
 882         }
 883         global->stored = false;
 884         DBG_DEBUG("key '%s' delete\n", tdb_data_dbg(key));
 885
 886         TALLOC_FREE(global->db_rec);
 887
 888         return NT_STATUS_OK;
 889 }
 890
 891 static int smbXsrv_client_destructor(struct smbXsrv_client *client)
 892 {
 893         NTSTATUS status;
 894
 895         status = smbXsrv_client_remove(client);
 896         if (!NT_STATUS_IS_OK(status)) {
 897                 DBG_ERR("smbXsrv_client_remove() failed: %s\n",
 898                         nt_errstr(status));
 899         }
 900
 901         TALLOC_FREE(client->global);
 902
 903         return 0;
 904 }
 905
 906 static bool smbXsrv_client_connection_pass_filter(struct messaging_rec *rec, void *private_data);
 907 static void smbXsrv_client_connection_pass_loop(struct tevent_req *subreq);
 908 static bool smbXsrv_client_connection_drop_filter(struct messaging_rec *rec, void *private_data);
 909 static void smbXsrv_client_connection_drop_loop(struct tevent_req *subreq);
 910
 911 NTSTATUS smbXsrv_client_create(TALLOC_CTX *mem_ctx,
 912                                struct tevent_context *ev_ctx,
 913                                struct messaging_context *msg_ctx,
 914                                NTTIME now,
 915                                struct smbXsrv_client **_client)
 916 {
 917         struct smbXsrv_client_table *table;
 918         struct smbXsrv_client *client = NULL;
 919         struct smbXsrv_client_global0 *global = NULL;
 920         NTSTATUS status;
 921         struct tevent_req *subreq = NULL;
 922
 923         status = smbXsrv_client_table_create(mem_ctx,
 924                                              msg_ctx,
 925                                              1, /* max_clients */
 926                                              &table);
 927         if (!NT_STATUS_IS_OK(status)) {
 928                 return status;
 929         }
 930
 931         if (table->local.num_clients >= table->local.max_clients) {
 932                 TALLOC_FREE(table);
 933                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 934         }
 935
 936         client = talloc_zero(mem_ctx, struct smbXsrv_client);
 937         if (client == NULL) {
 938                 TALLOC_FREE(table);
 939                 return NT_STATUS_NO_MEMORY;
 940         }
 941         client->raw_ev_ctx = ev_ctx;
 942         client->msg_ctx = msg_ctx;
 943
 944         client->server_multi_channel_enabled =
 945                 smbXsrv_server_multi_channel_enabled();
 946         if (client->server_multi_channel_enabled) {
 947                 client->next_channel_id = 1;
 948         }
 949         client->table = talloc_move(client, &table);
 950         table = client->table;
 951
 952         global = talloc_zero(client, struct smbXsrv_client_global0);
 953         if (global == NULL) {
 954                 TALLOC_FREE(client);
 955                 return NT_STATUS_NO_MEMORY;
 956         }
 957         talloc_set_destructor(global, smbXsrv_client_global_destructor);
 958         client->global = global;
 959
 960         global->initial_connect_time = now;
 961
 962         global->server_id = messaging_server_id(client->msg_ctx);
 963
 964         table->local.num_clients += 1;
 965
 966         talloc_set_destructor(client, smbXsrv_client_destructor);
 967
 968         if (DEBUGLVL(DBGLVL_DEBUG)) {
 969                 struct smbXsrv_clientB client_blob = {
 970                         .version = SMBXSRV_VERSION_0,
 971                         .info.info0 = client,
 972                 };
 973                 struct GUID_txt_buf buf;
 974
 975                 DBG_DEBUG("client_guid[%s] created\n",
 976                           GUID_buf_string(&global->client_guid, &buf));
 977                 NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
 978         }
 979
 980         subreq = messaging_filtered_read_send(client,
 981                                         client->raw_ev_ctx,
 982                                         client->msg_ctx,
 983                                         smbXsrv_client_connection_pass_filter,
 984                                         client);
 985         if (subreq == NULL) {
 986                 TALLOC_FREE(client);
 987                 return NT_STATUS_NO_MEMORY;
 988         }
 989         tevent_req_set_callback(subreq, smbXsrv_client_connection_pass_loop, client);
 990         client->connection_pass_subreq = subreq;
 991
 992         subreq = messaging_filtered_read_send(client,
 993                                         client->raw_ev_ctx,
 994                                         client->msg_ctx,
 995                                         smbXsrv_client_connection_drop_filter,
 996                                         client);
 997         if (subreq == NULL) {
 998                 TALLOC_FREE(client);
 999                 return NT_STATUS_NO_MEMORY;
1000         }
1001         tevent_req_set_callback(subreq, smbXsrv_client_connection_drop_loop, client);
1002         client->connection_drop_subreq = subreq;
1003
1004         *_client = client;
1005         return NT_STATUS_OK;
1006 }
1007
1008 static NTSTATUS smb2srv_client_connection_passed(struct smbXsrv_client *client,
1009                                 const struct smbXsrv_connection_pass0 *recv_info0)
1010 {
1011         DATA_BLOB blob;
1012         enum ndr_err_code ndr_err;
1013         NTSTATUS status;
1014         struct smbXsrv_connection_pass0 passed_info0;
1015         struct smbXsrv_connection_passB passed_blob;
1016         struct iovec iov;
1017
1018         /*
1019          * We echo back the message with a cleared negotiate_request
1020          */
1021         passed_info0 = *recv_info0;
1022         passed_info0.negotiate_request = data_blob_null;
1023
1024         ZERO_STRUCT(passed_blob);
1025         passed_blob.version = smbXsrv_version_global_current();
1026         passed_blob.info.info0 = &passed_info0;
1027
1028         if (DEBUGLVL(DBGLVL_DEBUG)) {
1029                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
1030         }
1031
1032         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &passed_blob,
1033                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_passB);
1034         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1035                 status = ndr_map_error2ntstatus(ndr_err);
1036                 return status;
1037         }
1038
1039         iov.iov_base = blob.data;
1040         iov.iov_len = blob.length;
1041
1042         status = messaging_send_iov(client->msg_ctx,
1043                                     recv_info0->src_server_id,
1044                                     MSG_SMBXSRV_CONNECTION_PASSED,
1045                                     &iov, 1,
1046                                     NULL, 0);
1047         data_blob_free(&blob);
1048         if (!NT_STATUS_IS_OK(status)) {
1049                 return status;
1050         }
1051
1052         return NT_STATUS_OK;
1053 }
1054
1055 static bool smbXsrv_client_connection_pass_filter(struct messaging_rec *rec, void *private_data)
1056 {
1057         if (rec->msg_type != MSG_SMBXSRV_CONNECTION_PASS) {
1058                 return false;
1059         }
1060
1061         if (rec->num_fds != 1) {
1062                 return false;
1063         }
1064
1065         return true;
1066 }
1067
1068 static void smbXsrv_client_connection_pass_loop(struct tevent_req *subreq)
1069 {
1070         struct smbXsrv_client *client =
1071                 tevent_req_callback_data(subreq,
1072                 struct smbXsrv_client);
1073         struct smbXsrv_connection *xconn = NULL;
1074         int ret;
1075         struct messaging_rec *rec = NULL;
1076         struct smbXsrv_connection_passB pass_blob;
1077         enum ndr_err_code ndr_err;
1078         struct smbXsrv_connection_pass0 *pass_info0 = NULL;
1079         NTSTATUS status;
1080         int sock_fd = -1;
1081         uint64_t seq_low;
1082
1083         client->connection_pass_subreq = NULL;
1084
1085         ret = messaging_filtered_read_recv(subreq, talloc_tos(), &rec);
1086         TALLOC_FREE(subreq);
1087         if (ret != 0) {
1088                 goto next;
1089         }
1090
1091         if (rec->num_fds != 1) {
1092                 DBG_ERR("MSG_SMBXSRV_CONNECTION_PASS: num_fds[%u]\n",
1093                         rec->num_fds);
1094                 goto next;
1095         }
1096
1097         sock_fd = rec->fds[0];
1098         DBG_DEBUG("MSG_SMBXSRV_CONNECTION_PASS: got sock_fd[%d]\n", sock_fd);
1099
1100         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &pass_blob,
1101                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_passB);
1102         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1103                 status = ndr_map_error2ntstatus(ndr_err);
1104                 DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status));
1105                 goto next;
1106         }
1107
1108         if (DEBUGLVL(DBGLVL_DEBUG)) {
1109                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1110         }
1111
1112         if (pass_blob.version != SMBXSRV_VERSION_0) {
1113                 DBG_ERR("ignore invalid version %u\n", pass_blob.version);
1114                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1115                 goto next;
1116         }
1117
1118         pass_info0 = pass_blob.info.info0;
1119         if (pass_info0 == NULL) {
1120                 DBG_ERR("ignore NULL info %u\n", pass_blob.version);
1121                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1122                 goto next;
1123         }
1124
1125         if (!GUID_equal(&client->global->client_guid, &pass_info0->client_guid))
1126         {
1127                 struct GUID_txt_buf buf1, buf2;
1128
1129                 DBG_WARNING("client's client_guid [%s] != passed guid [%s]\n",
1130                             GUID_buf_string(&client->global->client_guid,
1131                                             &buf1),
1132                             GUID_buf_string(&pass_info0->client_guid,
1133                                             &buf2));
1134                 if (DEBUGLVL(DBGLVL_WARNING)) {
1135                         NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1136                 }
1137                 goto next;
1138         }
1139
1140         if (client->global->initial_connect_time !=
1141             pass_info0->client_connect_time)
1142         {
1143                 DBG_WARNING("client's initial connect time [%s] (%llu) != "
1144                         "passed initial connect time [%s] (%llu)\n",
1145                         nt_time_string(talloc_tos(),
1146                                        client->global->initial_connect_time),
1147                         (unsigned long long)client->global->initial_connect_time,
1148                         nt_time_string(talloc_tos(),
1149                                        pass_info0->client_connect_time),
1150                         (unsigned long long)pass_info0->client_connect_time);
1151                 if (DEBUGLVL(DBGLVL_WARNING)) {
1152                         NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1153                 }
1154                 goto next;
1155         }
1156
1157         if (pass_info0->negotiate_request.length < SMB2_HDR_BODY) {
1158                 DBG_WARNING("negotiate_request.length[%zu]\n",
1159                             pass_info0->negotiate_request.length);
1160                 if (DEBUGLVL(DBGLVL_WARNING)) {
1161                         NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1162                 }
1163                 goto next;
1164         }
1165
1166         status = smb2srv_client_connection_passed(client, pass_info0);
1167         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1168                 /*
1169                  * We hit a race where, the client dropped the connection
1170                  * while the socket was passed to us and the origin
1171                  * process already existed.
1172                  */
1173                 DBG_DEBUG("smb2srv_client_connection_passed() ignore %s\n",
1174                           nt_errstr(status));
1175                 status = NT_STATUS_OK;
1176         }
1177         if (!NT_STATUS_IS_OK(status)) {
1178                 const char *r = "smb2srv_client_connection_passed() failed";
1179                 DBG_ERR("%s => %s\n", r, nt_errstr(status));
1180                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1181                 exit_server_cleanly(r);
1182                 return;
1183         }
1184
1185         status = smbd_add_connection(client,
1186                                      sock_fd,
1187                                      pass_info0->xconn_connect_time,
1188                                      &xconn);
1189         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
1190                 rec->num_fds = 0;
1191                 smbd_server_connection_terminate(xconn, nt_errstr(status));
1192         }
1193         if (!NT_STATUS_IS_OK(status)) {
1194                 DBG_ERR("smbd_add_connection => %s\n", nt_errstr(status));
1195                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1196                 goto next;
1197         }
1198         rec->num_fds = 0;
1199
1200         /*
1201          * Set seq_low to mid received in negprot
1202          */
1203         seq_low = BVAL(pass_info0->negotiate_request.data,
1204                        SMB2_HDR_MESSAGE_ID);
1205
1206         xconn->smb2.client.guid_verified = true;
1207         smbd_smb2_process_negprot(xconn, seq_low,
1208                                   pass_info0->negotiate_request.data,
1209                                   pass_info0->negotiate_request.length);
1210
1211 next:
1212         if (rec != NULL) {
1213                 uint8_t fd_idx;
1214
1215                 for (fd_idx = 0; fd_idx < rec->num_fds; fd_idx++) {
1216                         sock_fd = rec->fds[fd_idx];
1217                         close(sock_fd);
1218                 }
1219                 rec->num_fds = 0;
1220
1221                 TALLOC_FREE(rec);
1222         }
1223
1224         subreq = messaging_filtered_read_send(client,
1225                                         client->raw_ev_ctx,
1226                                         client->msg_ctx,
1227                                         smbXsrv_client_connection_pass_filter,
1228                                         client);
1229         if (subreq == NULL) {
1230                 const char *r;
1231                 r = "messaging_read_send(MSG_SMBXSRV_CONNECTION_PASS failed";
1232                 exit_server_cleanly(r);
1233                 return;
1234         }
1235         tevent_req_set_callback(subreq, smbXsrv_client_connection_pass_loop, client);
1236         client->connection_pass_subreq = subreq;
1237 }
1238
1239 static bool smbXsrv_client_connection_drop_filter(struct messaging_rec *rec, void *private_data)
1240 {
1241         if (rec->msg_type != MSG_SMBXSRV_CONNECTION_DROP) {
1242                 return false;
1243         }
1244
1245         if (rec->num_fds != 0) {
1246                 return false;
1247         }
1248
1249         return true;
1250 }
1251
1252 static void smbXsrv_client_connection_drop_loop(struct tevent_req *subreq)
1253 {
1254         struct smbXsrv_client *client =
1255                 tevent_req_callback_data(subreq,
1256                 struct smbXsrv_client);
1257         int ret;
1258         struct messaging_rec *rec = NULL;
1259         struct smbXsrv_connection_dropB drop_blob;
1260         enum ndr_err_code ndr_err;
1261         struct smbXsrv_connection_drop0 *drop_info0 = NULL;
1262         struct server_id_buf src_server_id_buf = {};
1263         NTSTATUS status;
1264
1265         client->connection_drop_subreq = NULL;
1266
1267         ret = messaging_filtered_read_recv(subreq, talloc_tos(), &rec);
1268         TALLOC_FREE(subreq);
1269         if (ret != 0) {
1270                 goto next;
1271         }
1272
1273         if (rec->num_fds != 0) {
1274                 DBG_ERR("MSG_SMBXSRV_CONNECTION_DROP: num_fds[%u]\n",
1275                         rec->num_fds);
1276                 goto next;
1277         }
1278
1279         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &drop_blob,
1280                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_dropB);
1281         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1282                 status = ndr_map_error2ntstatus(ndr_err);
1283                 DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status));
1284                 goto next;
1285         }
1286
1287         if (DEBUGLVL(DBGLVL_DEBUG)) {
1288                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1289         }
1290
1291         if (drop_blob.version != SMBXSRV_VERSION_0) {
1292                 DBG_ERR("ignore invalid version %u\n", drop_blob.version);
1293                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1294                 goto next;
1295         }
1296
1297         drop_info0 = drop_blob.info.info0;
1298         if (drop_info0 == NULL) {
1299                 DBG_ERR("ignore NULL info %u\n", drop_blob.version);
1300                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1301                 goto next;
1302         }
1303
1304         if (!GUID_equal(&client->global->client_guid, &drop_info0->client_guid))
1305         {
1306                 struct GUID_txt_buf buf1, buf2;
1307
1308                 DBG_WARNING("client's client_guid [%s] != dropped guid [%s]\n",
1309                             GUID_buf_string(&client->global->client_guid,
1310                                             &buf1),
1311                             GUID_buf_string(&drop_info0->client_guid,
1312                                             &buf2));
1313                 if (DEBUGLVL(DBGLVL_WARNING)) {
1314                         NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1315                 }
1316                 goto next;
1317         }
1318
1319         if (client->global->initial_connect_time !=
1320             drop_info0->client_connect_time)
1321         {
1322                 DBG_WARNING("client's initial connect time [%s] (%llu) != "
1323                         "dropped initial connect time [%s] (%llu)\n",
1324                         nt_time_string(talloc_tos(),
1325                                        client->global->initial_connect_time),
1326                         (unsigned long long)client->global->initial_connect_time,
1327                         nt_time_string(talloc_tos(),
1328                                        drop_info0->client_connect_time),
1329                         (unsigned long long)drop_info0->client_connect_time);
1330                 if (DEBUGLVL(DBGLVL_WARNING)) {
1331                         NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1332                 }
1333                 goto next;
1334         }
1335
1336         /*
1337          * Disconnect all client connections, which means we will tear down all
1338          * sessions, tcons and non-durable opens. At the end we will remove our
1339          * smbXsrv_client_global.tdb record, which will wake up the watcher on
1340          * the other node in order to let it take over the client.
1341          *
1342          * The client will have to reopen all sessions, tcons and durable opens.
1343          */
1344         smbd_server_disconnect_client(client,
1345                 server_id_str_buf(drop_info0->src_server_id, &src_server_id_buf));
1346         return;
1347
1348 next:
1349         if (rec != NULL) {
1350                 int sock_fd;
1351                 uint8_t fd_idx;
1352
1353                 for (fd_idx = 0; fd_idx < rec->num_fds; fd_idx++) {
1354                         sock_fd = rec->fds[fd_idx];
1355                         close(sock_fd);
1356                 }
1357                 rec->num_fds = 0;
1358
1359                 TALLOC_FREE(rec);
1360         }
1361
1362         subreq = messaging_filtered_read_send(client,
1363                                         client->raw_ev_ctx,
1364                                         client->msg_ctx,
1365                                         smbXsrv_client_connection_drop_filter,
1366                                         client);
1367         if (subreq == NULL) {
1368                 const char *r;
1369                 r = "messaging_read_send(MSG_SMBXSRV_CONNECTION_DROP failed";
1370                 exit_server_cleanly(r);
1371                 return;
1372         }
1373         tevent_req_set_callback(subreq, smbXsrv_client_connection_drop_loop, client);
1374         client->connection_drop_subreq = subreq;
1375 }
1376
1377 NTSTATUS smbXsrv_client_remove(struct smbXsrv_client *client)
1378 {
1379         struct smbXsrv_client_table *table = client->table;
1380         NTSTATUS status;
1381
1382         if (client->global->db_rec != NULL) {
1383                 struct GUID_txt_buf buf;
1384                 DBG_ERR("client_guid[%s]: Called with db_rec != NULL'\n",
1385                         GUID_buf_string(&client->global->client_guid,
1386                                         &buf));
1387                 return NT_STATUS_INTERNAL_ERROR;
1388         }
1389
1390         if (!client->global->stored) {
1391                 return NT_STATUS_OK;
1392         }
1393
1394         TALLOC_FREE(client->connection_pass_subreq);
1395         TALLOC_FREE(client->connection_drop_subreq);
1396
1397         client->global->db_rec = smbXsrv_client_global_fetch_locked(
1398                                         table->global.db_ctx,
1399                                         &client->global->client_guid,
1400                                         client->global /* TALLOC_CTX */);
1401         if (client->global->db_rec == NULL) {
1402                 return NT_STATUS_INTERNAL_DB_ERROR;
1403         }
1404
1405         status = smbXsrv_client_global_remove(client->global);
1406         if (!NT_STATUS_IS_OK(status)) {
1407                 struct GUID_txt_buf buf;
1408                 DBG_ERR("client_guid[%s] store failed - %s\n",
1409                         GUID_buf_string(&client->global->client_guid, &buf),
1410                         nt_errstr(status));
1411                 return status;
1412         }
1413
1414         if (DEBUGLVL(DBGLVL_DEBUG)) {
1415                 struct smbXsrv_clientB client_blob = {
1416                         .version = SMBXSRV_VERSION_0,
1417                         .info.info0 = client,
1418                 };
1419                 struct GUID_txt_buf buf;
1420
1421                 DBG_DEBUG("client_guid[%s] stored\n",
1422                           GUID_buf_string(&client->global->client_guid, &buf));
1423                 NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
1424         }
1425
1426         return NT_STATUS_OK;
1427 }