source3/smbd/smbXsrv_client.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2014
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/filesys.h"
  22 #include <tevent.h>
  23 #include "lib/util/server_id.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "dbwrap/dbwrap.h"
  27 #include "dbwrap/dbwrap_rbt.h"
  28 #include "dbwrap/dbwrap_open.h"
  29 #include "dbwrap/dbwrap_watch.h"
  30 #include "session.h"
  31 #include "auth.h"
  32 #include "auth/gensec/gensec.h"
  33 #include "../lib/tsocket/tsocket.h"
  34 #include "../libcli/security/security.h"
  35 #include "messages.h"
  36 #include "lib/util/util_tdb.h"
  37 #include "librpc/gen_ndr/ndr_smbXsrv.h"
  38 #include "serverid.h"
  39 #include "lib/util/tevent_ntstatus.h"
  40 #include "lib/util/iov_buf.h"
  41 #include "lib/global_contexts.h"
  42
  43 struct smbXsrv_client_table {
  44         struct {
  45                 uint32_t max_clients;
  46                 uint32_t num_clients;
  47         } local;
  48         struct {
  49                 struct db_context *db_ctx;
  50         } global;
  51 };
  52
  53 static struct db_context *smbXsrv_client_global_db_ctx = NULL;
  54
  55 NTSTATUS smbXsrv_client_global_init(void)
  56 {
  57         const char *global_path = NULL;
  58         struct db_context *backend = NULL;
  59         struct db_context *db_ctx = NULL;
  60
  61         if (smbXsrv_client_global_db_ctx != NULL) {
  62                 return NT_STATUS_OK;
  63         }
  64
  65         /*
  66          * This contains secret information like client keys!
  67          */
  68         global_path = lock_path(talloc_tos(), "smbXsrv_client_global.tdb");
  69         if (global_path == NULL) {
  70                 return NT_STATUS_NO_MEMORY;
  71         }
  72
  73         backend = db_open(NULL, global_path,
  74                           0, /* hash_size */
  75                           TDB_DEFAULT |
  76                           TDB_CLEAR_IF_FIRST |
  77                           TDB_INCOMPATIBLE_HASH,
  78                           O_RDWR | O_CREAT, 0600,
  79                           DBWRAP_LOCK_ORDER_1,
  80                           DBWRAP_FLAG_NONE);
  81         if (backend == NULL) {
  82                 NTSTATUS status;
  83
  84                 status = map_nt_error_from_unix_common(errno);
  85
  86                 return status;
  87         }
  88
  89         db_ctx = db_open_watched(NULL, &backend, global_messaging_context());
  90         if (db_ctx == NULL) {
  91                 TALLOC_FREE(backend);
  92                 return NT_STATUS_NO_MEMORY;
  93         }
  94
  95         smbXsrv_client_global_db_ctx = db_ctx;
  96
  97         return NT_STATUS_OK;
  98 }
  99
 100 /*
 101  * NOTE:
 102  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
 103  * has the same result as integer comparison between the uint32_t
 104  * values.
 105  *
 106  * TODO: implement string based key
 107  */
 108
 109 #define SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE 16
 110
 111 static TDB_DATA smbXsrv_client_global_id_to_key(const struct GUID *client_guid,
 112                                                 uint8_t *key_buf)
 113 {
 114         TDB_DATA key = { .dsize = 0, };
 115         NTSTATUS status;
 116         struct GUID_ndr_buf buf = { .buf = {0}, };
 117
 118         status = GUID_to_ndr_buf(client_guid, &buf);
 119         if (!NT_STATUS_IS_OK(status)) {
 120                 return key;
 121         }
 122         memcpy(key_buf, buf.buf, SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE);
 123
 124         key = make_tdb_data(key_buf, SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE);
 125
 126         return key;
 127 }
 128
 129 static struct db_record *smbXsrv_client_global_fetch_locked(
 130                         struct db_context *db,
 131                         const struct GUID *client_guid,
 132                         TALLOC_CTX *mem_ctx)
 133 {
 134         TDB_DATA key;
 135         uint8_t key_buf[SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE];
 136         struct db_record *rec = NULL;
 137
 138         key = smbXsrv_client_global_id_to_key(client_guid, key_buf);
 139
 140         rec = dbwrap_fetch_locked(db, mem_ctx, key);
 141
 142         if (rec == NULL) {
 143                 struct GUID_txt_buf buf;
 144                 DBG_DEBUG("Failed to lock guid [%s], key '%s'\n",
 145                           GUID_buf_string(client_guid, &buf),
 146                           hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
 147         }
 148
 149         return rec;
 150 }
 151
 152 static NTSTATUS smbXsrv_client_table_create(TALLOC_CTX *mem_ctx,
 153                                             struct messaging_context *msg_ctx,
 154                                             uint32_t max_clients,
 155                                             struct smbXsrv_client_table **_table)
 156 {
 157         struct smbXsrv_client_table *table;
 158         NTSTATUS status;
 159
 160         if (max_clients > 1) {
 161                 return NT_STATUS_INTERNAL_ERROR;
 162         }
 163
 164         table = talloc_zero(mem_ctx, struct smbXsrv_client_table);
 165         if (table == NULL) {
 166                 return NT_STATUS_NO_MEMORY;
 167         }
 168
 169         table->local.max_clients = max_clients;
 170
 171         status = smbXsrv_client_global_init();
 172         if (!NT_STATUS_IS_OK(status)) {
 173                 TALLOC_FREE(table);
 174                 return status;
 175         }
 176
 177         table->global.db_ctx = smbXsrv_client_global_db_ctx;
 178
 179         *_table = table;
 180         return NT_STATUS_OK;
 181 }
 182
 183 static int smbXsrv_client_global_destructor(struct smbXsrv_client_global0 *global)
 184 {
 185         return 0;
 186 }
 187
 188 static void smbXsrv_client_global_verify_record(struct db_record *db_rec,
 189                                         bool *is_free,
 190                                         bool *was_free,
 191                                         TALLOC_CTX *mem_ctx,
 192                                         const struct server_id *dead_server_id,
 193                                         struct smbXsrv_client_global0 **_g,
 194                                         uint32_t *pseqnum)
 195 {
 196         TDB_DATA key;
 197         TDB_DATA val;
 198         DATA_BLOB blob;
 199         struct smbXsrv_client_globalB global_blob;
 200         enum ndr_err_code ndr_err;
 201         struct smbXsrv_client_global0 *global = NULL;
 202         bool dead = false;
 203         bool exists;
 204         TALLOC_CTX *frame = talloc_stackframe();
 205
 206         *is_free = false;
 207
 208         if (was_free) {
 209                 *was_free = false;
 210         }
 211         if (_g) {
 212                 *_g = NULL;
 213         }
 214         if (pseqnum) {
 215                 *pseqnum = 0;
 216         }
 217
 218         key = dbwrap_record_get_key(db_rec);
 219
 220         val = dbwrap_record_get_value(db_rec);
 221         if (val.dsize == 0) {
 222                 TALLOC_FREE(frame);
 223                 *is_free = true;
 224                 if (was_free) {
 225                         *was_free = true;
 226                 }
 227                 return;
 228         }
 229
 230         blob = data_blob_const(val.dptr, val.dsize);
 231
 232         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
 233                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_client_globalB);
 234         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 235                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 236                 DBG_WARNING("key '%s' ndr_pull_struct_blob - %s\n",
 237                             hex_encode_talloc(frame, key.dptr, key.dsize),
 238                             nt_errstr(status));
 239                 TALLOC_FREE(frame);
 240                 return;
 241         }
 242
 243         DBG_DEBUG("client_global:\n");
 244         if (DEBUGLVL(DBGLVL_DEBUG)) {
 245                 NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 246         }
 247
 248         if (global_blob.version != SMBXSRV_VERSION_0) {
 249                 DBG_ERR("key '%s' use unsupported version %u\n",
 250                         hex_encode_talloc(frame, key.dptr, key.dsize),
 251                         global_blob.version);
 252                 NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 253                 TALLOC_FREE(frame);
 254                 return;
 255         }
 256
 257         global = global_blob.info.info0;
 258
 259         dead = server_id_equal(dead_server_id, &global->server_id);
 260         if (dead) {
 261                 struct server_id_buf tmp;
 262
 263                 DBG_NOTICE("key '%s' server_id %s is already dead.\n",
 264                            hex_encode_talloc(frame, key.dptr, key.dsize),
 265                            server_id_str_buf(global->server_id, &tmp));
 266                 if (DEBUGLVL(DBGLVL_NOTICE)) {
 267                         NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 268                 }
 269                 TALLOC_FREE(frame);
 270                 dbwrap_record_delete(db_rec);
 271                 *is_free = true;
 272                 return;
 273         }
 274
 275         exists = serverid_exists(&global->server_id);
 276         if (!exists) {
 277                 struct server_id_buf tmp;
 278
 279                 DBG_NOTICE("key '%s' server_id %s does not exist.\n",
 280                            hex_encode_talloc(frame, key.dptr, key.dsize),
 281                            server_id_str_buf(global->server_id, &tmp));
 282                 if (DEBUGLVL(DBGLVL_NOTICE)) {
 283                         NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 284                 }
 285                 TALLOC_FREE(frame);
 286                 dbwrap_record_delete(db_rec);
 287                 *is_free = true;
 288                 return;
 289         }
 290
 291         if (_g) {
 292                 *_g = talloc_move(mem_ctx, &global);
 293         }
 294         if (pseqnum) {
 295                 *pseqnum = global_blob.seqnum;
 296         }
 297         TALLOC_FREE(frame);
 298 }
 299
 300 static NTSTATUS smb2srv_client_connection_pass(struct smbd_smb2_request *smb2req,
 301                                                struct smbXsrv_client_global0 *global)
 302 {
 303         DATA_BLOB blob;
 304         enum ndr_err_code ndr_err;
 305         NTSTATUS status;
 306         struct smbXsrv_connection_pass0 pass_info0;
 307         struct smbXsrv_connection_passB pass_blob;
 308         ssize_t reqlen;
 309         struct iovec iov;
 310
 311         pass_info0 = (struct smbXsrv_connection_pass0) {
 312                 .client_guid = global->client_guid,
 313                 .src_server_id = smb2req->xconn->client->global->server_id,
 314                 .xconn_connect_time = smb2req->xconn->client->global->initial_connect_time,
 315                 .dst_server_id = global->server_id,
 316                 .client_connect_time = global->initial_connect_time,
 317         };
 318
 319         reqlen = iov_buflen(smb2req->in.vector, smb2req->in.vector_count);
 320         if (reqlen == -1) {
 321                 return NT_STATUS_INVALID_BUFFER_SIZE;
 322         }
 323
 324         pass_info0.negotiate_request.length = reqlen;
 325         pass_info0.negotiate_request.data = talloc_array(talloc_tos(), uint8_t,
 326                                                          reqlen);
 327         if (pass_info0.negotiate_request.data == NULL) {
 328                 return NT_STATUS_NO_MEMORY;
 329         }
 330         iov_buf(smb2req->in.vector, smb2req->in.vector_count,
 331                 pass_info0.negotiate_request.data,
 332                 pass_info0.negotiate_request.length);
 333
 334         ZERO_STRUCT(pass_blob);
 335         pass_blob.version = smbXsrv_version_global_current();
 336         pass_blob.info.info0 = &pass_info0;
 337
 338         if (DEBUGLVL(DBGLVL_DEBUG)) {
 339                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
 340         }
 341
 342         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &pass_blob,
 343                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_passB);
 344         data_blob_free(&pass_info0.negotiate_request);
 345         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 346                 status = ndr_map_error2ntstatus(ndr_err);
 347                 return status;
 348         }
 349
 350         iov.iov_base = blob.data;
 351         iov.iov_len = blob.length;
 352
 353         status = messaging_send_iov(smb2req->xconn->client->msg_ctx,
 354                                     global->server_id,
 355                                     MSG_SMBXSRV_CONNECTION_PASS,
 356                                     &iov, 1,
 357                                     &smb2req->xconn->transport.sock, 1);
 358         data_blob_free(&blob);
 359         if (!NT_STATUS_IS_OK(status)) {
 360                 return status;
 361         }
 362
 363         return NT_STATUS_OK;
 364 }
 365
 366 static NTSTATUS smb2srv_client_connection_drop(struct smbd_smb2_request *smb2req,
 367                                                struct smbXsrv_client_global0 *global)
 368 {
 369         DATA_BLOB blob;
 370         enum ndr_err_code ndr_err;
 371         NTSTATUS status;
 372         struct smbXsrv_connection_drop0 drop_info0;
 373         struct smbXsrv_connection_dropB drop_blob;
 374         struct iovec iov;
 375
 376         drop_info0 = (struct smbXsrv_connection_drop0) {
 377                 .client_guid = global->client_guid,
 378                 .src_server_id = smb2req->xconn->client->global->server_id,
 379                 .xconn_connect_time = smb2req->xconn->client->global->initial_connect_time,
 380                 .dst_server_id = global->server_id,
 381                 .client_connect_time = global->initial_connect_time,
 382         };
 383
 384         ZERO_STRUCT(drop_blob);
 385         drop_blob.version = smbXsrv_version_global_current();
 386         drop_blob.info.info0 = &drop_info0;
 387
 388         if (DEBUGLVL(DBGLVL_DEBUG)) {
 389                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
 390         }
 391
 392         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &drop_blob,
 393                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_dropB);
 394         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 395                 status = ndr_map_error2ntstatus(ndr_err);
 396                 return status;
 397         }
 398
 399         iov.iov_base = blob.data;
 400         iov.iov_len = blob.length;
 401
 402         status = messaging_send_iov(smb2req->xconn->client->msg_ctx,
 403                                     global->server_id,
 404                                     MSG_SMBXSRV_CONNECTION_DROP,
 405                                     &iov, 1,
 406                                     NULL, 0);
 407         data_blob_free(&blob);
 408         if (!NT_STATUS_IS_OK(status)) {
 409                 return status;
 410         }
 411
 412         return NT_STATUS_OK;
 413 }
 414
 415 static NTSTATUS smbXsrv_client_global_store(struct smbXsrv_client_global0 *global)
 416 {
 417         struct smbXsrv_client_globalB global_blob;
 418         DATA_BLOB blob = data_blob_null;
 419         TDB_DATA key;
 420         TDB_DATA val;
 421         NTSTATUS status;
 422         enum ndr_err_code ndr_err;
 423         bool saved_stored = global->stored;
 424
 425         /*
 426          * TODO: if we use other versions than '0'
 427          * we would add glue code here, that would be able to
 428          * store the information in the old format.
 429          */
 430
 431         SMB_ASSERT(global->local_address != NULL);
 432         SMB_ASSERT(global->remote_address != NULL);
 433         SMB_ASSERT(global->remote_name != NULL);
 434
 435         if (global->db_rec == NULL) {
 436                 return NT_STATUS_INTERNAL_ERROR;
 437         }
 438
 439         key = dbwrap_record_get_key(global->db_rec);
 440         val = dbwrap_record_get_value(global->db_rec);
 441
 442         ZERO_STRUCT(global_blob);
 443         global_blob.version = smbXsrv_version_global_current();
 444         if (val.dsize >= 8) {
 445                 global_blob.seqnum = IVAL(val.dptr, 4);
 446         }
 447         global_blob.seqnum += 1;
 448         global_blob.info.info0 = global;
 449
 450         global->stored = true;
 451         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
 452                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_client_globalB);
 453         global->stored = saved_stored;
 454         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 455                 status = ndr_map_error2ntstatus(ndr_err);
 456                 DBG_WARNING("key '%s' ndr_push - %s\n",
 457                         hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 458                         nt_errstr(status));
 459                 TALLOC_FREE(global->db_rec);
 460                 return status;
 461         }
 462
 463         val = make_tdb_data(blob.data, blob.length);
 464         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
 465         if (!NT_STATUS_IS_OK(status)) {
 466                 DBG_WARNING("key '%s' store - %s\n",
 467                         hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 468                         nt_errstr(status));
 469                 TALLOC_FREE(global->db_rec);
 470                 return status;
 471         }
 472
 473         global->stored = true;
 474
 475         if (DEBUGLVL(DBGLVL_DEBUG)) {
 476                 DBG_DEBUG("key '%s' stored\n",
 477                         hex_encode_talloc(global->db_rec, key.dptr, key.dsize));
 478                 NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
 479         }
 480
 481         TALLOC_FREE(global->db_rec);
 482
 483         return NT_STATUS_OK;
 484 }
 485
 486 struct smb2srv_client_mc_negprot_state {
 487         struct tevent_context *ev;
 488         struct smbd_smb2_request *smb2req;
 489         struct db_record *db_rec;
 490         uint64_t watch_instance;
 491         uint32_t last_seqnum;
 492         struct tevent_req *filter_subreq;
 493 };
 494
 495 static void smb2srv_client_mc_negprot_cleanup(struct tevent_req *req,
 496                                               enum tevent_req_state req_state)
 497 {
 498         struct smb2srv_client_mc_negprot_state *state =
 499                 tevent_req_data(req,
 500                 struct smb2srv_client_mc_negprot_state);
 501
 502         if (state->db_rec != NULL) {
 503                 dbwrap_watched_watch_remove_instance(state->db_rec,
 504                                                      state->watch_instance);
 505                 state->watch_instance = 0;
 506                 TALLOC_FREE(state->db_rec);
 507         }
 508 }
 509
 510 static void smb2srv_client_mc_negprot_next(struct tevent_req *req);
 511 static bool smb2srv_client_mc_negprot_filter(struct messaging_rec *rec, void *private_data);
 512 static void smb2srv_client_mc_negprot_done(struct tevent_req *subreq);
 513 static void smb2srv_client_mc_negprot_watched(struct tevent_req *subreq);
 514
 515 struct tevent_req *smb2srv_client_mc_negprot_send(TALLOC_CTX *mem_ctx,
 516                                                   struct tevent_context *ev,
 517                                                   struct smbd_smb2_request *smb2req)
 518 {
 519         struct tevent_req *req = NULL;
 520         struct smb2srv_client_mc_negprot_state *state = NULL;
 521
 522         req = tevent_req_create(mem_ctx, &state,
 523                                 struct smb2srv_client_mc_negprot_state);
 524         if (req == NULL) {
 525                 return NULL;
 526         }
 527         state->ev = ev;
 528         state->smb2req = smb2req;
 529
 530         tevent_req_set_cleanup_fn(req, smb2srv_client_mc_negprot_cleanup);
 531
 532         smb2srv_client_mc_negprot_next(req);
 533
 534         if (!tevent_req_is_in_progress(req)) {
 535                 return tevent_req_post(req, ev);
 536         }
 537
 538         return req;
 539 }
 540
 541 static void smb2srv_client_mc_negprot_next(struct tevent_req *req)
 542 {
 543         struct smb2srv_client_mc_negprot_state *state =
 544                 tevent_req_data(req,
 545                 struct smb2srv_client_mc_negprot_state);
 546         struct smbXsrv_connection *xconn = state->smb2req->xconn;
 547         struct smbXsrv_client *client = xconn->client;
 548         struct smbXsrv_client_table *table = client->table;
 549         struct GUID client_guid = xconn->smb2.client.guid;
 550         struct smbXsrv_client_global0 *global = NULL;
 551         bool is_free = false;
 552         struct tevent_req *subreq = NULL;
 553         NTSTATUS status;
 554         uint32_t seqnum = 0;
 555         struct server_id last_server_id = { .pid = 0, };
 556
 557         TALLOC_FREE(state->filter_subreq);
 558         SMB_ASSERT(state->db_rec == NULL);
 559         state->db_rec = smbXsrv_client_global_fetch_locked(table->global.db_ctx,
 560                                                            &client_guid,
 561                                                            state);
 562         if (state->db_rec == NULL) {
 563                 tevent_req_nterror(req, NT_STATUS_INTERNAL_DB_ERROR);
 564                 return;
 565         }
 566
 567 verify_again:
 568         TALLOC_FREE(global);
 569
 570         smbXsrv_client_global_verify_record(state->db_rec,
 571                                             &is_free,
 572                                             NULL,
 573                                             state,
 574                                             &last_server_id,
 575                                             &global,
 576                                             &seqnum);
 577         if (is_free) {
 578                 dbwrap_watched_watch_remove_instance(state->db_rec,
 579                                                      state->watch_instance);
 580                 state->watch_instance = 0;
 581
 582                 /*
 583                  * This stores the new client information in
 584                  * smbXsrv_client_global.tdb
 585                  */
 586                 client->global->client_guid = xconn->smb2.client.guid;
 587
 588                 client->global->db_rec = state->db_rec;
 589                 state->db_rec = NULL;
 590                 status = smbXsrv_client_global_store(client->global);
 591                 SMB_ASSERT(client->global->db_rec == NULL);
 592                 if (!NT_STATUS_IS_OK(status)) {
 593                         struct GUID_txt_buf buf;
 594                         DBG_ERR("client_guid[%s] store failed - %s\n",
 595                                 GUID_buf_string(&client->global->client_guid,
 596                                                 &buf),
 597                                 nt_errstr(status));
 598                         tevent_req_nterror(req, status);
 599                         return;
 600                 }
 601
 602                 if (DEBUGLVL(DBGLVL_DEBUG)) {
 603                         struct smbXsrv_clientB client_blob = {
 604                                 .version = SMBXSRV_VERSION_0,
 605                                 .info.info0 = client,
 606                         };
 607                         struct GUID_txt_buf buf;
 608
 609                         DBG_DEBUG("client_guid[%s] stored\n",
 610                                   GUID_buf_string(&client->global->client_guid,
 611                                                   &buf));
 612                         NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
 613                 }
 614
 615                 xconn->smb2.client.guid_verified = true;
 616                 tevent_req_done(req);
 617                 return;
 618         }
 619
 620         if (global == NULL) {
 621                 /*
 622                  * most likely ndr_pull_struct_blob() failed
 623                  */
 624                 tevent_req_nterror(req, NT_STATUS_INTERNAL_DB_CORRUPTION);
 625                 return;
 626         }
 627
 628         /*
 629          * If last_server_id is set, we expect
 630          * smbXsrv_client_global_verify_record()
 631          * to detect the already dead global->server_id
 632          * as state->db_rec is still locked and its
 633          * value didn't change.
 634          */
 635         SMB_ASSERT(last_server_id.pid == 0);
 636         last_server_id = global->server_id;
 637
 638         if (procid_is_local(&global->server_id)) {
 639                 subreq = messaging_filtered_read_send(state,
 640                                                       state->ev,
 641                                                       client->msg_ctx,
 642                                                       smb2srv_client_mc_negprot_filter,
 643                                                       NULL);
 644                 if (tevent_req_nomem(subreq, req)) {
 645                         return;
 646                 }
 647                 tevent_req_set_callback(subreq, smb2srv_client_mc_negprot_done, req);
 648                 state->filter_subreq = subreq;
 649         }
 650
 651         if (procid_is_local(&global->server_id)) {
 652                 status = smb2srv_client_connection_pass(state->smb2req,
 653                                                         global);
 654                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 655                         /*
 656                          * We remembered last_server_id = global->server_id
 657                          * above, so we'll treat it as dead in the
 658                          * next round to smbXsrv_client_global_verify_record().
 659                          */
 660                         goto verify_again;
 661                 }
 662                 if (tevent_req_nterror(req, status)) {
 663                         return;
 664                 }
 665         } else {
 666                 status = smb2srv_client_connection_drop(state->smb2req,
 667                                                         global);
 668                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 669                         /*
 670                          * We remembered last_server_id = global->server_id
 671                          * above, so we'll treat it as dead in the
 672                          * next round to smbXsrv_client_global_verify_record().
 673                          */
 674                         goto verify_again;
 675                 }
 676                 if (tevent_req_nterror(req, status)) {
 677                         return;
 678                 }
 679         }
 680
 681         /*
 682          * If the record changed, but we are not happy with the change yet,
 683          * we better remove ourself from the waiter list
 684          * (most likely the first position)
 685          * and re-add us at the end of the list.
 686          *
 687          * This gives other waiters a change
 688          * to make progress.
 689          *
 690          * Otherwise we'll keep our waiter instance alive,
 691          * keep waiting (most likely at first position).
 692          * It means the order of watchers stays fair.
 693          */
 694         if (state->last_seqnum != seqnum) {
 695                 state->last_seqnum = seqnum;
 696                 dbwrap_watched_watch_remove_instance(state->db_rec,
 697                                                      state->watch_instance);
 698                 state->watch_instance =
 699                         dbwrap_watched_watch_add_instance(state->db_rec);
 700         }
 701
 702         subreq = dbwrap_watched_watch_send(state,
 703                                            state->ev,
 704                                            state->db_rec,
 705                                            state->watch_instance,
 706                                            global->server_id);
 707         if (tevent_req_nomem(subreq, req)) {
 708                 return;
 709         }
 710         tevent_req_set_callback(subreq, smb2srv_client_mc_negprot_watched, req);
 711
 712         TALLOC_FREE(global);
 713         TALLOC_FREE(state->db_rec);
 714         return;
 715 }
 716
 717 static bool smb2srv_client_mc_negprot_filter(struct messaging_rec *rec, void *private_data)
 718 {
 719         if (rec->msg_type != MSG_SMBXSRV_CONNECTION_PASSED) {
 720                 return false;
 721         }
 722
 723         if (rec->num_fds != 0) {
 724                 return false;
 725         }
 726
 727         return true;
 728 }
 729
 730 static void smb2srv_client_mc_negprot_done(struct tevent_req *subreq)
 731 {
 732         struct tevent_req *req =
 733                 tevent_req_callback_data(subreq,
 734                 struct tevent_req);
 735         struct smb2srv_client_mc_negprot_state *state =
 736                 tevent_req_data(req,
 737                 struct smb2srv_client_mc_negprot_state);
 738         struct smbXsrv_connection *xconn = state->smb2req->xconn;
 739         struct smbXsrv_client *client = xconn->client;
 740         struct messaging_rec *rec = NULL;
 741         struct smbXsrv_connection_passB passed_blob;
 742         enum ndr_err_code ndr_err;
 743         struct smbXsrv_connection_pass0 *passed_info0 = NULL;
 744         NTSTATUS status;
 745         int ret;
 746
 747         SMB_ASSERT(state->filter_subreq == subreq);
 748         state->filter_subreq = NULL;
 749
 750         ret = messaging_filtered_read_recv(subreq, state, &rec);
 751         TALLOC_FREE(subreq);
 752         if (ret != 0) {
 753                 status = map_nt_error_from_unix_common(ret);
 754                 DBG_ERR("messaging_filtered_read_recv() - %s\n",
 755                         nt_errstr(status));
 756                 tevent_req_nterror(req, status);
 757                 return;
 758         }
 759
 760         DBG_DEBUG("MSG_SMBXSRV_CONNECTION_PASSED: received...\n");
 761
 762         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &passed_blob,
 763                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_passB);
 764         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 765                 status = ndr_map_error2ntstatus(ndr_err);
 766                 DBG_ERR("ndr_pull_struct_blob - %s\n", nt_errstr(status));
 767                 tevent_req_nterror(req, status);
 768                 return;
 769         }
 770
 771         if (DEBUGLVL(DBGLVL_DEBUG)) {
 772                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 773         }
 774
 775         if (passed_blob.version != SMBXSRV_VERSION_0) {
 776                 DBG_ERR("ignore invalid version %u\n", passed_blob.version);
 777                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 778                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 779                 return;
 780         }
 781
 782         passed_info0 = passed_blob.info.info0;
 783         if (passed_info0 == NULL) {
 784                 DBG_ERR("ignore NULL info %u\n", passed_blob.version);
 785                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 786                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 787                 return;
 788         }
 789
 790         if (!GUID_equal(&xconn->smb2.client.guid, &passed_info0->client_guid)) {
 791                 struct GUID_txt_buf buf1, buf2;
 792
 793                 DBG_ERR("client's client_guid [%s] != passed guid [%s]\n",
 794                         GUID_buf_string(&xconn->smb2.client.guid,
 795                                         &buf1),
 796                         GUID_buf_string(&passed_info0->client_guid,
 797                                         &buf2));
 798                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 799                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 800                 return;
 801         }
 802
 803         if (client->global->initial_connect_time !=
 804             passed_info0->xconn_connect_time)
 805         {
 806                 DBG_ERR("client's initial connect time [%s] (%llu) != "
 807                         "passed xconn connect time [%s] (%llu)\n",
 808                         nt_time_string(talloc_tos(),
 809                                        client->global->initial_connect_time),
 810                         (unsigned long long)client->global->initial_connect_time,
 811                         nt_time_string(talloc_tos(),
 812                                        passed_info0->xconn_connect_time),
 813                         (unsigned long long)passed_info0->xconn_connect_time);
 814                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 815                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 816                 return;
 817         }
 818
 819         if (passed_info0->negotiate_request.length != 0) {
 820                 DBG_ERR("negotiate_request.length[%zu]\n",
 821                         passed_info0->negotiate_request.length);
 822                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
 823                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 824                 return;
 825         }
 826
 827         tevent_req_nterror(req, NT_STATUS_MESSAGE_RETRIEVED);
 828 }
 829
 830 static void smb2srv_client_mc_negprot_watched(struct tevent_req *subreq)
 831 {
 832         struct tevent_req *req =
 833                 tevent_req_callback_data(subreq,
 834                 struct tevent_req);
 835         struct smb2srv_client_mc_negprot_state *state =
 836                 tevent_req_data(req,
 837                 struct smb2srv_client_mc_negprot_state);
 838         NTSTATUS status;
 839         uint64_t instance = 0;
 840
 841         status = dbwrap_watched_watch_recv(subreq, &instance, NULL, NULL);
 842         TALLOC_FREE(subreq);
 843         if (tevent_req_nterror(req, status)) {
 844                 return;
 845         }
 846
 847         state->watch_instance = instance;
 848
 849         smb2srv_client_mc_negprot_next(req);
 850 }
 851
 852 NTSTATUS smb2srv_client_mc_negprot_recv(struct tevent_req *req)
 853 {
 854         return tevent_req_simple_recv_ntstatus(req);
 855 }
 856
 857 static NTSTATUS smbXsrv_client_global_remove(struct smbXsrv_client_global0 *global)
 858 {
 859         TDB_DATA key;
 860         NTSTATUS status;
 861
 862         /*
 863          * TODO: if we use other versions than '0'
 864          * we would add glue code here, that would be able to
 865          * store the information in the old format.
 866          */
 867
 868         if (global->db_rec == NULL) {
 869                 return NT_STATUS_INTERNAL_ERROR;
 870         }
 871
 872         key = dbwrap_record_get_key(global->db_rec);
 873
 874         status = dbwrap_record_delete(global->db_rec);
 875         if (!NT_STATUS_IS_OK(status)) {
 876                 DBG_WARNING("key '%s' delete - %s\n",
 877                         hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 878                         nt_errstr(status));
 879                 TALLOC_FREE(global->db_rec);
 880                 return status;
 881         }
 882         global->stored = false;
 883         DBG_DEBUG("key '%s' delete\n",
 884                   hex_encode_talloc(global->db_rec, key.dptr, key.dsize));
 885
 886         TALLOC_FREE(global->db_rec);
 887
 888         return NT_STATUS_OK;
 889 }
 890
 891 static int smbXsrv_client_destructor(struct smbXsrv_client *client)
 892 {
 893         NTSTATUS status;
 894
 895         status = smbXsrv_client_remove(client);
 896         if (!NT_STATUS_IS_OK(status)) {
 897                 DBG_ERR("smbXsrv_client_remove() failed: %s\n",
 898                         nt_errstr(status));
 899         }
 900
 901         TALLOC_FREE(client->global);
 902
 903         return 0;
 904 }
 905
 906 static bool smbXsrv_client_connection_pass_filter(struct messaging_rec *rec, void *private_data);
 907 static void smbXsrv_client_connection_pass_loop(struct tevent_req *subreq);
 908 static bool smbXsrv_client_connection_drop_filter(struct messaging_rec *rec, void *private_data);
 909 static void smbXsrv_client_connection_drop_loop(struct tevent_req *subreq);
 910
 911 NTSTATUS smbXsrv_client_create(TALLOC_CTX *mem_ctx,
 912                                struct tevent_context *ev_ctx,
 913                                struct messaging_context *msg_ctx,
 914                                NTTIME now,
 915                                struct smbXsrv_client **_client)
 916 {
 917         struct smbXsrv_client_table *table;
 918         struct smbXsrv_client *client = NULL;
 919         struct smbXsrv_client_global0 *global = NULL;
 920         NTSTATUS status;
 921         struct tevent_req *subreq = NULL;
 922
 923         status = smbXsrv_client_table_create(mem_ctx,
 924                                              msg_ctx,
 925                                              1, /* max_clients */
 926                                              &table);
 927         if (!NT_STATUS_IS_OK(status)) {
 928                 return status;
 929         }
 930
 931         if (table->local.num_clients >= table->local.max_clients) {
 932                 TALLOC_FREE(table);
 933                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 934         }
 935
 936         client = talloc_zero(mem_ctx, struct smbXsrv_client);
 937         if (client == NULL) {
 938                 TALLOC_FREE(table);
 939                 return NT_STATUS_NO_MEMORY;
 940         }
 941         client->raw_ev_ctx = ev_ctx;
 942         client->msg_ctx = msg_ctx;
 943
 944         client->server_multi_channel_enabled =
 945                 smbXsrv_server_multi_channel_enabled();
 946         if (client->server_multi_channel_enabled) {
 947                 client->next_channel_id = 1;
 948         }
 949         client->table = talloc_move(client, &table);
 950         table = client->table;
 951
 952         global = talloc_zero(client, struct smbXsrv_client_global0);
 953         if (global == NULL) {
 954                 TALLOC_FREE(client);
 955                 return NT_STATUS_NO_MEMORY;
 956         }
 957         talloc_set_destructor(global, smbXsrv_client_global_destructor);
 958         client->global = global;
 959
 960         global->initial_connect_time = now;
 961
 962         global->server_id = messaging_server_id(client->msg_ctx);
 963
 964         table->local.num_clients += 1;
 965
 966         talloc_set_destructor(client, smbXsrv_client_destructor);
 967
 968         if (DEBUGLVL(DBGLVL_DEBUG)) {
 969                 struct smbXsrv_clientB client_blob = {
 970                         .version = SMBXSRV_VERSION_0,
 971                         .info.info0 = client,
 972                 };
 973                 struct GUID_txt_buf buf;
 974
 975                 DBG_DEBUG("client_guid[%s] created\n",
 976                           GUID_buf_string(&global->client_guid, &buf));
 977                 NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
 978         }
 979
 980         subreq = messaging_filtered_read_send(client,
 981                                         client->raw_ev_ctx,
 982                                         client->msg_ctx,
 983                                         smbXsrv_client_connection_pass_filter,
 984                                         client);
 985         if (subreq == NULL) {
 986                 TALLOC_FREE(client);
 987                 return NT_STATUS_NO_MEMORY;
 988         }
 989         tevent_req_set_callback(subreq, smbXsrv_client_connection_pass_loop, client);
 990         client->connection_pass_subreq = subreq;
 991
 992         subreq = messaging_filtered_read_send(client,
 993                                         client->raw_ev_ctx,
 994                                         client->msg_ctx,
 995                                         smbXsrv_client_connection_drop_filter,
 996                                         client);
 997         if (subreq == NULL) {
 998                 TALLOC_FREE(client);
 999                 return NT_STATUS_NO_MEMORY;
1000         }
1001         tevent_req_set_callback(subreq, smbXsrv_client_connection_drop_loop, client);
1002         client->connection_drop_subreq = subreq;
1003
1004         *_client = client;
1005         return NT_STATUS_OK;
1006 }
1007
1008 static NTSTATUS smb2srv_client_connection_passed(struct smbXsrv_client *client,
1009                                 const struct smbXsrv_connection_pass0 *recv_info0)
1010 {
1011         DATA_BLOB blob;
1012         enum ndr_err_code ndr_err;
1013         NTSTATUS status;
1014         struct smbXsrv_connection_pass0 passed_info0;
1015         struct smbXsrv_connection_passB passed_blob;
1016         struct iovec iov;
1017
1018         /*
1019          * We echo back the message with a cleared negotiate_request
1020          */
1021         passed_info0 = *recv_info0;
1022         passed_info0.negotiate_request = data_blob_null;
1023
1024         ZERO_STRUCT(passed_blob);
1025         passed_blob.version = smbXsrv_version_global_current();
1026         passed_blob.info.info0 = &passed_info0;
1027
1028         if (DEBUGLVL(DBGLVL_DEBUG)) {
1029                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
1030         }
1031
1032         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &passed_blob,
1033                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_passB);
1034         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1035                 status = ndr_map_error2ntstatus(ndr_err);
1036                 return status;
1037         }
1038
1039         iov.iov_base = blob.data;
1040         iov.iov_len = blob.length;
1041
1042         status = messaging_send_iov(client->msg_ctx,
1043                                     recv_info0->src_server_id,
1044                                     MSG_SMBXSRV_CONNECTION_PASSED,
1045                                     &iov, 1,
1046                                     NULL, 0);
1047         data_blob_free(&blob);
1048         if (!NT_STATUS_IS_OK(status)) {
1049                 return status;
1050         }
1051
1052         return NT_STATUS_OK;
1053 }
1054
1055 static bool smbXsrv_client_connection_pass_filter(struct messaging_rec *rec, void *private_data)
1056 {
1057         if (rec->msg_type != MSG_SMBXSRV_CONNECTION_PASS) {
1058                 return false;
1059         }
1060
1061         if (rec->num_fds != 1) {
1062                 return false;
1063         }
1064
1065         return true;
1066 }
1067
1068 static void smbXsrv_client_connection_pass_loop(struct tevent_req *subreq)
1069 {
1070         struct smbXsrv_client *client =
1071                 tevent_req_callback_data(subreq,
1072                 struct smbXsrv_client);
1073         struct smbXsrv_connection *xconn = NULL;
1074         int ret;
1075         struct messaging_rec *rec = NULL;
1076         struct smbXsrv_connection_passB pass_blob;
1077         enum ndr_err_code ndr_err;
1078         struct smbXsrv_connection_pass0 *pass_info0 = NULL;
1079         NTSTATUS status;
1080         int sock_fd = -1;
1081         uint64_t seq_low;
1082
1083         client->connection_pass_subreq = NULL;
1084
1085         ret = messaging_filtered_read_recv(subreq, talloc_tos(), &rec);
1086         TALLOC_FREE(subreq);
1087         if (ret != 0) {
1088                 goto next;
1089         }
1090
1091         if (rec->num_fds != 1) {
1092                 DBG_ERR("MSG_SMBXSRV_CONNECTION_PASS: num_fds[%u]\n",
1093                         rec->num_fds);
1094                 goto next;
1095         }
1096
1097         sock_fd = rec->fds[0];
1098         DBG_DEBUG("MSG_SMBXSRV_CONNECTION_PASS: got sock_fd[%d]\n", sock_fd);
1099
1100         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &pass_blob,
1101                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_passB);
1102         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1103                 status = ndr_map_error2ntstatus(ndr_err);
1104                 DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status));
1105                 goto next;
1106         }
1107
1108         if (DEBUGLVL(DBGLVL_DEBUG)) {
1109                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1110         }
1111
1112         if (pass_blob.version != SMBXSRV_VERSION_0) {
1113                 DBG_ERR("ignore invalid version %u\n", pass_blob.version);
1114                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1115                 goto next;
1116         }
1117
1118         pass_info0 = pass_blob.info.info0;
1119         if (pass_info0 == NULL) {
1120                 DBG_ERR("ignore NULL info %u\n", pass_blob.version);
1121                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1122                 goto next;
1123         }
1124
1125         if (!GUID_equal(&client->global->client_guid, &pass_info0->client_guid))
1126         {
1127                 struct GUID_txt_buf buf1, buf2;
1128
1129                 DBG_WARNING("client's client_guid [%s] != passed guid [%s]\n",
1130                             GUID_buf_string(&client->global->client_guid,
1131                                             &buf1),
1132                             GUID_buf_string(&pass_info0->client_guid,
1133                                             &buf2));
1134                 if (DEBUGLVL(DBGLVL_WARNING)) {
1135                         NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1136                 }
1137                 goto next;
1138         }
1139
1140         if (client->global->initial_connect_time !=
1141             pass_info0->client_connect_time)
1142         {
1143                 DBG_WARNING("client's initial connect time [%s] (%llu) != "
1144                         "passed initial connect time [%s] (%llu)\n",
1145                         nt_time_string(talloc_tos(),
1146                                        client->global->initial_connect_time),
1147                         (unsigned long long)client->global->initial_connect_time,
1148                         nt_time_string(talloc_tos(),
1149                                        pass_info0->client_connect_time),
1150                         (unsigned long long)pass_info0->client_connect_time);
1151                 if (DEBUGLVL(DBGLVL_WARNING)) {
1152                         NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1153                 }
1154                 goto next;
1155         }
1156
1157         if (pass_info0->negotiate_request.length < SMB2_HDR_BODY) {
1158                 DBG_WARNING("negotiate_request.length[%zu]\n",
1159                             pass_info0->negotiate_request.length);
1160                 if (DEBUGLVL(DBGLVL_WARNING)) {
1161                         NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1162                 }
1163                 goto next;
1164         }
1165
1166         status = smb2srv_client_connection_passed(client, pass_info0);
1167         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1168                 /*
1169                  * We hit a race where, the client dropped the connection
1170                  * while the socket was passed to us and the origin
1171                  * process already existed.
1172                  */
1173                 DBG_DEBUG("smb2srv_client_connection_passed() ignore %s\n",
1174                           nt_errstr(status));
1175                 status = NT_STATUS_OK;
1176         }
1177         if (!NT_STATUS_IS_OK(status)) {
1178                 const char *r = "smb2srv_client_connection_passed() failed";
1179                 DBG_ERR("%s => %s\n", r, nt_errstr(status));
1180                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1181                 exit_server_cleanly(r);
1182                 return;
1183         }
1184
1185         status = smbd_add_connection(client,
1186                                      sock_fd,
1187                                      pass_info0->xconn_connect_time,
1188                                      &xconn);
1189         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
1190                 rec->num_fds = 0;
1191                 smbd_server_connection_terminate(xconn, nt_errstr(status));
1192         }
1193         if (!NT_STATUS_IS_OK(status)) {
1194                 DBG_ERR("smbd_add_connection => %s\n", nt_errstr(status));
1195                 NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
1196                 goto next;
1197         }
1198         rec->num_fds = 0;
1199
1200         /*
1201          * Set seq_low to mid received in negprot
1202          */
1203         seq_low = BVAL(pass_info0->negotiate_request.data,
1204                        SMB2_HDR_MESSAGE_ID);
1205
1206         xconn->smb2.client.guid_verified = true;
1207         smbd_smb2_process_negprot(xconn, seq_low,
1208                                   pass_info0->negotiate_request.data,
1209                                   pass_info0->negotiate_request.length);
1210
1211 next:
1212         if (rec != NULL) {
1213                 uint8_t fd_idx;
1214
1215                 for (fd_idx = 0; fd_idx < rec->num_fds; fd_idx++) {
1216                         sock_fd = rec->fds[fd_idx];
1217                         close(sock_fd);
1218                 }
1219                 rec->num_fds = 0;
1220
1221                 TALLOC_FREE(rec);
1222         }
1223
1224         subreq = messaging_filtered_read_send(client,
1225                                         client->raw_ev_ctx,
1226                                         client->msg_ctx,
1227                                         smbXsrv_client_connection_pass_filter,
1228                                         client);
1229         if (subreq == NULL) {
1230                 const char *r;
1231                 r = "messaging_read_send(MSG_SMBXSRV_CONNECTION_PASS failed";
1232                 exit_server_cleanly(r);
1233                 return;
1234         }
1235         tevent_req_set_callback(subreq, smbXsrv_client_connection_pass_loop, client);
1236         client->connection_pass_subreq = subreq;
1237 }
1238
1239 static bool smbXsrv_client_connection_drop_filter(struct messaging_rec *rec, void *private_data)
1240 {
1241         if (rec->msg_type != MSG_SMBXSRV_CONNECTION_DROP) {
1242                 return false;
1243         }
1244
1245         if (rec->num_fds != 0) {
1246                 return false;
1247         }
1248
1249         return true;
1250 }
1251
1252 static void smbXsrv_client_connection_drop_loop(struct tevent_req *subreq)
1253 {
1254         struct smbXsrv_client *client =
1255                 tevent_req_callback_data(subreq,
1256                 struct smbXsrv_client);
1257         int ret;
1258         struct messaging_rec *rec = NULL;
1259         struct smbXsrv_connection_dropB drop_blob;
1260         enum ndr_err_code ndr_err;
1261         struct smbXsrv_connection_drop0 *drop_info0 = NULL;
1262         struct server_id_buf src_server_id_buf = {};
1263         NTSTATUS status;
1264
1265         client->connection_drop_subreq = NULL;
1266
1267         ret = messaging_filtered_read_recv(subreq, talloc_tos(), &rec);
1268         TALLOC_FREE(subreq);
1269         if (ret != 0) {
1270                 goto next;
1271         }
1272
1273         if (rec->num_fds != 0) {
1274                 DBG_ERR("MSG_SMBXSRV_CONNECTION_DROP: num_fds[%u]\n",
1275                         rec->num_fds);
1276                 goto next;
1277         }
1278
1279         ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &drop_blob,
1280                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_dropB);
1281         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1282                 status = ndr_map_error2ntstatus(ndr_err);
1283                 DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status));
1284                 goto next;
1285         }
1286
1287         if (DEBUGLVL(DBGLVL_DEBUG)) {
1288                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1289         }
1290
1291         if (drop_blob.version != SMBXSRV_VERSION_0) {
1292                 DBG_ERR("ignore invalid version %u\n", drop_blob.version);
1293                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1294                 goto next;
1295         }
1296
1297         drop_info0 = drop_blob.info.info0;
1298         if (drop_info0 == NULL) {
1299                 DBG_ERR("ignore NULL info %u\n", drop_blob.version);
1300                 NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1301                 goto next;
1302         }
1303
1304         if (!GUID_equal(&client->global->client_guid, &drop_info0->client_guid))
1305         {
1306                 struct GUID_txt_buf buf1, buf2;
1307
1308                 DBG_WARNING("client's client_guid [%s] != dropped guid [%s]\n",
1309                             GUID_buf_string(&client->global->client_guid,
1310                                             &buf1),
1311                             GUID_buf_string(&drop_info0->client_guid,
1312                                             &buf2));
1313                 if (DEBUGLVL(DBGLVL_WARNING)) {
1314                         NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1315                 }
1316                 goto next;
1317         }
1318
1319         if (client->global->initial_connect_time !=
1320             drop_info0->client_connect_time)
1321         {
1322                 DBG_WARNING("client's initial connect time [%s] (%llu) != "
1323                         "dropped initial connect time [%s] (%llu)\n",
1324                         nt_time_string(talloc_tos(),
1325                                        client->global->initial_connect_time),
1326                         (unsigned long long)client->global->initial_connect_time,
1327                         nt_time_string(talloc_tos(),
1328                                        drop_info0->client_connect_time),
1329                         (unsigned long long)drop_info0->client_connect_time);
1330                 if (DEBUGLVL(DBGLVL_WARNING)) {
1331                         NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
1332                 }
1333                 goto next;
1334         }
1335
1336         /*
1337          * Disconnect all client connections, which means we will tear down all
1338          * sessions, tcons and non-durable opens. At the end we will remove our
1339          * smbXsrv_client_global.tdb record, which will wake up the watcher on
1340          * the other node in order to let it take over the client.
1341          *
1342          * The client will have to reopen all sessions, tcons and durable opens.
1343          */
1344         smbd_server_disconnect_client(client,
1345                 server_id_str_buf(drop_info0->src_server_id, &src_server_id_buf));
1346         return;
1347
1348 next:
1349         if (rec != NULL) {
1350                 int sock_fd;
1351                 uint8_t fd_idx;
1352
1353                 for (fd_idx = 0; fd_idx < rec->num_fds; fd_idx++) {
1354                         sock_fd = rec->fds[fd_idx];
1355                         close(sock_fd);
1356                 }
1357                 rec->num_fds = 0;
1358
1359                 TALLOC_FREE(rec);
1360         }
1361
1362         subreq = messaging_filtered_read_send(client,
1363                                         client->raw_ev_ctx,
1364                                         client->msg_ctx,
1365                                         smbXsrv_client_connection_drop_filter,
1366                                         client);
1367         if (subreq == NULL) {
1368                 const char *r;
1369                 r = "messaging_read_send(MSG_SMBXSRV_CONNECTION_DROP failed";
1370                 exit_server_cleanly(r);
1371                 return;
1372         }
1373         tevent_req_set_callback(subreq, smbXsrv_client_connection_drop_loop, client);
1374         client->connection_drop_subreq = subreq;
1375 }
1376
1377 NTSTATUS smbXsrv_client_remove(struct smbXsrv_client *client)
1378 {
1379         struct smbXsrv_client_table *table = client->table;
1380         NTSTATUS status;
1381
1382         if (client->global->db_rec != NULL) {
1383                 struct GUID_txt_buf buf;
1384                 DBG_ERR("client_guid[%s]: Called with db_rec != NULL'\n",
1385                         GUID_buf_string(&client->global->client_guid,
1386                                         &buf));
1387                 return NT_STATUS_INTERNAL_ERROR;
1388         }
1389
1390         if (!client->global->stored) {
1391                 return NT_STATUS_OK;
1392         }
1393
1394         TALLOC_FREE(client->connection_pass_subreq);
1395         TALLOC_FREE(client->connection_drop_subreq);
1396
1397         client->global->db_rec = smbXsrv_client_global_fetch_locked(
1398                                         table->global.db_ctx,
1399                                         &client->global->client_guid,
1400                                         client->global /* TALLOC_CTX */);
1401         if (client->global->db_rec == NULL) {
1402                 return NT_STATUS_INTERNAL_DB_ERROR;
1403         }
1404
1405         status = smbXsrv_client_global_remove(client->global);
1406         if (!NT_STATUS_IS_OK(status)) {
1407                 struct GUID_txt_buf buf;
1408                 DBG_ERR("client_guid[%s] store failed - %s\n",
1409                         GUID_buf_string(&client->global->client_guid, &buf),
1410                         nt_errstr(status));
1411                 return status;
1412         }
1413
1414         if (DEBUGLVL(DBGLVL_DEBUG)) {
1415                 struct smbXsrv_clientB client_blob = {
1416                         .version = SMBXSRV_VERSION_0,
1417                         .info.info0 = client,
1418                 };
1419                 struct GUID_txt_buf buf;
1420
1421                 DBG_DEBUG("client_guid[%s] stored\n",
1422                           GUID_buf_string(&client->global->client_guid, &buf));
1423                 NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
1424         }
1425
1426         return NT_STATUS_OK;
1427 }