Adding upstream version 2:4.17.12+dfsg.upstream/2%4.17.12+dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1458 insertions, 0 deletions

diff --git a/source3/smbd/smbXsrv_client.c b/source3/smbd/smbXsrv_client.c
new file mode 100644
index 0000000..90322c5
--- /dev/null
+++ b/source3/smbd/smbXsrv_client.c
@@ -0,0 +1,1458 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Copyright (C) Stefan Metzmacher 2014
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "system/filesys.h"
+#include <tevent.h>
+#include "lib/util/server_id.h"
+#include "smbd/smbd.h"
+#include "smbd/globals.h"
+#include "dbwrap/dbwrap.h"
+#include "dbwrap/dbwrap_rbt.h"
+#include "dbwrap/dbwrap_open.h"
+#include "dbwrap/dbwrap_watch.h"
+#include "session.h"
+#include "auth.h"
+#include "auth/gensec/gensec.h"
+#include "../lib/tsocket/tsocket.h"
+#include "../libcli/security/security.h"
+#include "messages.h"
+#include "lib/util/util_tdb.h"
+#include "librpc/gen_ndr/ndr_smbXsrv.h"
+#include "serverid.h"
+#include "lib/util/tevent_ntstatus.h"
+#include "lib/util/iov_buf.h"
+#include "lib/global_contexts.h"
+
+struct smbXsrv_client_table {
+	struct {
+		uint32_t max_clients;
+		uint32_t num_clients;
+	} local;
+	struct {
+		struct db_context *db_ctx;
+	} global;
+};
+
+static struct db_context *smbXsrv_client_global_db_ctx = NULL;
+
+NTSTATUS smbXsrv_client_global_init(void)
+{
+	const char *global_path = NULL;
+	struct db_context *backend = NULL;
+	struct db_context *db_ctx = NULL;
+
+	if (smbXsrv_client_global_db_ctx != NULL) {
+		return NT_STATUS_OK;
+	}
+
+	/*
+	 * This contains secret information like client keys!
+	 */
+	global_path = lock_path(talloc_tos(), "smbXsrv_client_global.tdb");
+	if (global_path == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	backend = db_open(NULL, global_path,
+			  0, /* hash_size */
+			  TDB_DEFAULT |
+			  TDB_CLEAR_IF_FIRST |
+			  TDB_INCOMPATIBLE_HASH,
+			  O_RDWR | O_CREAT, 0600,
+			  DBWRAP_LOCK_ORDER_1,
+			  DBWRAP_FLAG_NONE);
+	if (backend == NULL) {
+		NTSTATUS status;
+
+		status = map_nt_error_from_unix_common(errno);
+
+		return status;
+	}
+
+	db_ctx = db_open_watched(NULL, &backend, global_messaging_context());
+	if (db_ctx == NULL) {
+		TALLOC_FREE(backend);
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	smbXsrv_client_global_db_ctx = db_ctx;
+
+	return NT_STATUS_OK;
+}
+
+/*
+ * NOTE:
+ * We need to store the keys in big endian so that dbwrap_rbt's memcmp
+ * has the same result as integer comparison between the uint32_t
+ * values.
+ *
+ * TODO: implement string based key
+ */
+
+#define SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE 16
+
+static TDB_DATA smbXsrv_client_global_id_to_key(const struct GUID *client_guid,
+						uint8_t *key_buf)
+{
+	TDB_DATA key = { .dsize = 0, };
+	NTSTATUS status;
+	struct GUID_ndr_buf buf = { .buf = {0}, };
+
+	status = GUID_to_ndr_buf(client_guid, &buf);
+	if (!NT_STATUS_IS_OK(status)) {
+		return key;
+	}
+	memcpy(key_buf, buf.buf, SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE);
+
+	key = make_tdb_data(key_buf, SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE);
+
+	return key;
+}
+
+static struct db_record *smbXsrv_client_global_fetch_locked(
+			struct db_context *db,
+			const struct GUID *client_guid,
+			TALLOC_CTX *mem_ctx)
+{
+	TDB_DATA key;
+	uint8_t key_buf[SMBXSRV_CLIENT_GLOBAL_TDB_KEY_SIZE];
+	struct db_record *rec = NULL;
+
+	key = smbXsrv_client_global_id_to_key(client_guid, key_buf);
+
+	rec = dbwrap_fetch_locked(db, mem_ctx, key);
+
+	if (rec == NULL) {
+		struct GUID_txt_buf buf;
+		DBG_DEBUG("Failed to lock guid [%s], key '%s'\n",
+			  GUID_buf_string(client_guid, &buf),
+			  hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
+	}
+
+	return rec;
+}
+
+static NTSTATUS smbXsrv_client_table_create(TALLOC_CTX *mem_ctx,
+					    struct messaging_context *msg_ctx,
+					    uint32_t max_clients,
+					    struct smbXsrv_client_table **_table)
+{
+	struct smbXsrv_client_table *table;
+	NTSTATUS status;
+
+	if (max_clients > 1) {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	table = talloc_zero(mem_ctx, struct smbXsrv_client_table);
+	if (table == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	table->local.max_clients = max_clients;
+
+	status = smbXsrv_client_global_init();
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(table);
+		return status;
+	}
+
+	table->global.db_ctx = smbXsrv_client_global_db_ctx;
+
+	*_table = table;
+	return NT_STATUS_OK;
+}
+
+static int smbXsrv_client_global_destructor(struct smbXsrv_client_global0 *global)
+{
+	return 0;
+}
+
+static void smbXsrv_client_global_verify_record(struct db_record *db_rec,
+					bool *is_free,
+					bool *was_free,
+					TALLOC_CTX *mem_ctx,
+					const struct server_id *dead_server_id,
+					struct smbXsrv_client_global0 **_g,
+					uint32_t *pseqnum)
+{
+	TDB_DATA key;
+	TDB_DATA val;
+	DATA_BLOB blob;
+	struct smbXsrv_client_globalB global_blob;
+	enum ndr_err_code ndr_err;
+	struct smbXsrv_client_global0 *global = NULL;
+	bool dead = false;
+	bool exists;
+	TALLOC_CTX *frame = talloc_stackframe();
+
+	*is_free = false;
+
+	if (was_free) {
+		*was_free = false;
+	}
+	if (_g) {
+		*_g = NULL;
+	}
+	if (pseqnum) {
+		*pseqnum = 0;
+	}
+
+	key = dbwrap_record_get_key(db_rec);
+
+	val = dbwrap_record_get_value(db_rec);
+	if (val.dsize == 0) {
+		TALLOC_FREE(frame);
+		*is_free = true;
+		if (was_free) {
+			*was_free = true;
+		}
+		return;
+	}
+
+	blob = data_blob_const(val.dptr, val.dsize);
+
+	ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
+			(ndr_pull_flags_fn_t)ndr_pull_smbXsrv_client_globalB);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
+		DBG_WARNING("key '%s' ndr_pull_struct_blob - %s\n",
+			    hex_encode_talloc(frame, key.dptr, key.dsize),
+			    nt_errstr(status));
+		TALLOC_FREE(frame);
+		return;
+	}
+
+	DBG_DEBUG("client_global:\n");
+	if (DEBUGLVL(DBGLVL_DEBUG)) {
+		NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
+	}
+
+	if (global_blob.version != SMBXSRV_VERSION_0) {
+		DBG_ERR("key '%s' use unsupported version %u\n",
+			hex_encode_talloc(frame, key.dptr, key.dsize),
+			global_blob.version);
+		NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
+		TALLOC_FREE(frame);
+		return;
+	}
+
+	global = global_blob.info.info0;
+
+	dead = server_id_equal(dead_server_id, &global->server_id);
+	if (dead) {
+		struct server_id_buf tmp;
+
+		DBG_NOTICE("key '%s' server_id %s is already dead.\n",
+			   hex_encode_talloc(frame, key.dptr, key.dsize),
+			   server_id_str_buf(global->server_id, &tmp));
+		if (DEBUGLVL(DBGLVL_NOTICE)) {
+			NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
+		}
+		TALLOC_FREE(frame);
+		dbwrap_record_delete(db_rec);
+		*is_free = true;
+		return;
+	}
+
+	exists = serverid_exists(&global->server_id);
+	if (!exists) {
+		struct server_id_buf tmp;
+
+		DBG_NOTICE("key '%s' server_id %s does not exist.\n",
+			   hex_encode_talloc(frame, key.dptr, key.dsize),
+			   server_id_str_buf(global->server_id, &tmp));
+		if (DEBUGLVL(DBGLVL_NOTICE)) {
+			NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
+		}
+		TALLOC_FREE(frame);
+		dbwrap_record_delete(db_rec);
+		*is_free = true;
+		return;
+	}
+
+	if (_g) {
+		*_g = talloc_move(mem_ctx, &global);
+	}
+	if (pseqnum) {
+		*pseqnum = global_blob.seqnum;
+	}
+	TALLOC_FREE(frame);
+}
+
+static NTSTATUS smb2srv_client_connection_pass(struct smbd_smb2_request *smb2req,
+					       struct smbXsrv_client_global0 *global)
+{
+	DATA_BLOB blob;
+	enum ndr_err_code ndr_err;
+	NTSTATUS status;
+	struct smbXsrv_connection_pass0 pass_info0;
+	struct smbXsrv_connection_passB pass_blob;
+	ssize_t reqlen;
+	struct iovec iov;
+
+	pass_info0 = (struct smbXsrv_connection_pass0) {
+		.client_guid = global->client_guid,
+		.src_server_id = smb2req->xconn->client->global->server_id,
+		.xconn_connect_time = smb2req->xconn->client->global->initial_connect_time,
+		.dst_server_id = global->server_id,
+		.client_connect_time = global->initial_connect_time,
+	};
+
+	reqlen = iov_buflen(smb2req->in.vector, smb2req->in.vector_count);
+	if (reqlen == -1) {
+		return NT_STATUS_INVALID_BUFFER_SIZE;
+	}
+
+	pass_info0.negotiate_request.length = reqlen;
+	pass_info0.negotiate_request.data = talloc_array(talloc_tos(), uint8_t,
+							 reqlen);
+	if (pass_info0.negotiate_request.data == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	iov_buf(smb2req->in.vector, smb2req->in.vector_count,
+		pass_info0.negotiate_request.data,
+		pass_info0.negotiate_request.length);
+
+	ZERO_STRUCT(pass_blob);
+	pass_blob.version = smbXsrv_version_global_current();
+	pass_blob.info.info0 = &pass_info0;
+
+	if (DEBUGLVL(DBGLVL_DEBUG)) {
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
+	}
+
+	ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &pass_blob,
+			(ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_passB);
+	data_blob_free(&pass_info0.negotiate_request);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		return status;
+	}
+
+	iov.iov_base = blob.data;
+	iov.iov_len = blob.length;
+
+	status = messaging_send_iov(smb2req->xconn->client->msg_ctx,
+				    global->server_id,
+				    MSG_SMBXSRV_CONNECTION_PASS,
+				    &iov, 1,
+				    &smb2req->xconn->transport.sock, 1);
+	data_blob_free(&blob);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS smb2srv_client_connection_drop(struct smbd_smb2_request *smb2req,
+					       struct smbXsrv_client_global0 *global)
+{
+	DATA_BLOB blob;
+	enum ndr_err_code ndr_err;
+	NTSTATUS status;
+	struct smbXsrv_connection_drop0 drop_info0;
+	struct smbXsrv_connection_dropB drop_blob;
+	struct iovec iov;
+
+	drop_info0 = (struct smbXsrv_connection_drop0) {
+		.client_guid = global->client_guid,
+		.src_server_id = smb2req->xconn->client->global->server_id,
+		.xconn_connect_time = smb2req->xconn->client->global->initial_connect_time,
+		.dst_server_id = global->server_id,
+		.client_connect_time = global->initial_connect_time,
+	};
+
+	ZERO_STRUCT(drop_blob);
+	drop_blob.version = smbXsrv_version_global_current();
+	drop_blob.info.info0 = &drop_info0;
+
+	if (DEBUGLVL(DBGLVL_DEBUG)) {
+		NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
+	}
+
+	ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &drop_blob,
+			(ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_dropB);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		return status;
+	}
+
+	iov.iov_base = blob.data;
+	iov.iov_len = blob.length;
+
+	status = messaging_send_iov(smb2req->xconn->client->msg_ctx,
+				    global->server_id,
+				    MSG_SMBXSRV_CONNECTION_DROP,
+				    &iov, 1,
+				    NULL, 0);
+	data_blob_free(&blob);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS smbXsrv_client_global_store(struct smbXsrv_client_global0 *global)
+{
+	struct smbXsrv_client_globalB global_blob;
+	DATA_BLOB blob = data_blob_null;
+	TDB_DATA key;
+	TDB_DATA val;
+	NTSTATUS status;
+	enum ndr_err_code ndr_err;
+	bool saved_stored = global->stored;
+
+	/*
+	 * TODO: if we use other versions than '0'
+	 * we would add glue code here, that would be able to
+	 * store the information in the old format.
+	 */
+
+	SMB_ASSERT(global->local_address != NULL);
+	SMB_ASSERT(global->remote_address != NULL);
+	SMB_ASSERT(global->remote_name != NULL);
+
+	if (global->db_rec == NULL) {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	key = dbwrap_record_get_key(global->db_rec);
+	val = dbwrap_record_get_value(global->db_rec);
+
+	ZERO_STRUCT(global_blob);
+	global_blob.version = smbXsrv_version_global_current();
+	if (val.dsize >= 8) {
+		global_blob.seqnum = IVAL(val.dptr, 4);
+	}
+	global_blob.seqnum += 1;
+	global_blob.info.info0 = global;
+
+	global->stored = true;
+	ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
+			(ndr_push_flags_fn_t)ndr_push_smbXsrv_client_globalB);
+	global->stored = saved_stored;
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DBG_WARNING("key '%s' ndr_push - %s\n",
+			hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
+			nt_errstr(status));
+		TALLOC_FREE(global->db_rec);
+		return status;
+	}
+
+	val = make_tdb_data(blob.data, blob.length);
+	status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
+	if (!NT_STATUS_IS_OK(status)) {
+		DBG_WARNING("key '%s' store - %s\n",
+			hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
+			nt_errstr(status));
+		TALLOC_FREE(global->db_rec);
+		return status;
+	}
+
+	global->stored = true;
+
+	if (DEBUGLVL(DBGLVL_DEBUG)) {
+		DBG_DEBUG("key '%s' stored\n",
+			hex_encode_talloc(global->db_rec, key.dptr, key.dsize));
+		NDR_PRINT_DEBUG(smbXsrv_client_globalB, &global_blob);
+	}
+
+	TALLOC_FREE(global->db_rec);
+
+	return NT_STATUS_OK;
+}
+
+struct smb2srv_client_mc_negprot_state {
+	struct tevent_context *ev;
+	struct smbd_smb2_request *smb2req;
+	struct db_record *db_rec;
+	struct server_id sent_server_id;
+	uint64_t watch_instance;
+	uint32_t last_seqnum;
+	struct tevent_req *filter_subreq;
+};
+
+static void smb2srv_client_mc_negprot_cleanup(struct tevent_req *req,
+					      enum tevent_req_state req_state)
+{
+	struct smb2srv_client_mc_negprot_state *state =
+		tevent_req_data(req,
+		struct smb2srv_client_mc_negprot_state);
+
+	if (state->db_rec != NULL) {
+		dbwrap_watched_watch_remove_instance(state->db_rec,
+						     state->watch_instance);
+		state->watch_instance = 0;
+		TALLOC_FREE(state->db_rec);
+	}
+}
+
+static void smb2srv_client_mc_negprot_next(struct tevent_req *req);
+static bool smb2srv_client_mc_negprot_filter(struct messaging_rec *rec, void *private_data);
+static void smb2srv_client_mc_negprot_done(struct tevent_req *subreq);
+static void smb2srv_client_mc_negprot_watched(struct tevent_req *subreq);
+
+struct tevent_req *smb2srv_client_mc_negprot_send(TALLOC_CTX *mem_ctx,
+						  struct tevent_context *ev,
+						  struct smbd_smb2_request *smb2req)
+{
+	struct tevent_req *req = NULL;
+	struct smb2srv_client_mc_negprot_state *state = NULL;
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct smb2srv_client_mc_negprot_state);
+	if (req == NULL) {
+		return NULL;
+	}
+	state->ev = ev;
+	state->smb2req = smb2req;
+
+	tevent_req_set_cleanup_fn(req, smb2srv_client_mc_negprot_cleanup);
+
+	server_id_set_disconnected(&state->sent_server_id);
+
+	smb2srv_client_mc_negprot_next(req);
+
+	if (!tevent_req_is_in_progress(req)) {
+		return tevent_req_post(req, ev);
+	}
+
+	return req;
+}
+
+static void smb2srv_client_mc_negprot_next(struct tevent_req *req)
+{
+	struct smb2srv_client_mc_negprot_state *state =
+		tevent_req_data(req,
+		struct smb2srv_client_mc_negprot_state);
+	struct smbXsrv_connection *xconn = state->smb2req->xconn;
+	struct smbXsrv_client *client = xconn->client;
+	struct smbXsrv_client_table *table = client->table;
+	struct GUID client_guid = xconn->smb2.client.guid;
+	struct smbXsrv_client_global0 *global = NULL;
+	bool is_free = false;
+	struct tevent_req *subreq = NULL;
+	NTSTATUS status;
+	uint32_t seqnum = 0;
+	struct server_id last_server_id = { .pid = 0, };
+
+	SMB_ASSERT(state->db_rec == NULL);
+	state->db_rec = smbXsrv_client_global_fetch_locked(table->global.db_ctx,
+							   &client_guid,
+							   state);
+	if (state->db_rec == NULL) {
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_DB_ERROR);
+		return;
+	}
+
+verify_again:
+	TALLOC_FREE(global);
+
+	smbXsrv_client_global_verify_record(state->db_rec,
+					    &is_free,
+					    NULL,
+					    state,
+					    &last_server_id,
+					    &global,
+					    &seqnum);
+	if (is_free) {
+		dbwrap_watched_watch_remove_instance(state->db_rec,
+						     state->watch_instance);
+		state->watch_instance = 0;
+
+		/*
+		 * This stores the new client information in
+		 * smbXsrv_client_global.tdb
+		 */
+		client->global->client_guid = xconn->smb2.client.guid;
+
+		client->global->db_rec = state->db_rec;
+		state->db_rec = NULL;
+		status = smbXsrv_client_global_store(client->global);
+		SMB_ASSERT(client->global->db_rec == NULL);
+		if (!NT_STATUS_IS_OK(status)) {
+			struct GUID_txt_buf buf;
+			DBG_ERR("client_guid[%s] store failed - %s\n",
+				GUID_buf_string(&client->global->client_guid,
+						&buf),
+				nt_errstr(status));
+			tevent_req_nterror(req, status);
+			return;
+		}
+
+		if (DEBUGLVL(DBGLVL_DEBUG)) {
+			struct smbXsrv_clientB client_blob = {
+				.version = SMBXSRV_VERSION_0,
+				.info.info0 = client,
+			};
+			struct GUID_txt_buf buf;
+
+			DBG_DEBUG("client_guid[%s] stored\n",
+				  GUID_buf_string(&client->global->client_guid,
+						  &buf));
+			NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
+		}
+
+		xconn->smb2.client.guid_verified = true;
+		tevent_req_done(req);
+		return;
+	}
+
+	if (global == NULL) {
+		/*
+		 * most likely ndr_pull_struct_blob() failed
+		 */
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_DB_CORRUPTION);
+		return;
+	}
+
+	if (server_id_equal(&state->sent_server_id, &global->server_id)) {
+		/*
+		 * We hit a race with other concurrent connections,
+		 * which have woken us.
+		 *
+		 * We already sent the pass or drop message to
+		 * the process, so we need to wait for a
+		 * response and not pass the connection
+		 * again! Otherwise the process would
+		 * receive the same tcp connection via
+		 * more than one file descriptor and
+		 * create more than one smbXsrv_connection
+		 * structure for the same tcp connection,
+		 * which means the client would see more
+		 * than one SMB2 negprot response to its
+		 * single SMB2 netprot request and we
+		 * as server get the session keys and
+		 * message id validation wrong
+		 */
+		goto watch_again;
+	}
+
+	server_id_set_disconnected(&state->sent_server_id);
+
+	/*
+	 * If last_server_id is set, we expect
+	 * smbXsrv_client_global_verify_record()
+	 * to detect the already dead global->server_id
+	 * as state->db_rec is still locked and its
+	 * value didn't change.
+	 */
+	SMB_ASSERT(last_server_id.pid == 0);
+	last_server_id = global->server_id;
+
+	TALLOC_FREE(state->filter_subreq);
+	if (procid_is_local(&global->server_id)) {
+		subreq = messaging_filtered_read_send(state,
+						      state->ev,
+						      client->msg_ctx,
+						      smb2srv_client_mc_negprot_filter,
+						      NULL);
+		if (tevent_req_nomem(subreq, req)) {
+			return;
+		}
+		tevent_req_set_callback(subreq, smb2srv_client_mc_negprot_done, req);
+		state->filter_subreq = subreq;
+	}
+
+	if (procid_is_local(&global->server_id)) {
+		status = smb2srv_client_connection_pass(state->smb2req,
+							global);
+		if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+			/*
+			 * We remembered last_server_id = global->server_id
+			 * above, so we'll treat it as dead in the
+			 * next round to smbXsrv_client_global_verify_record().
+			 */
+			goto verify_again;
+		}
+		state->sent_server_id = global->server_id;
+		if (tevent_req_nterror(req, status)) {
+			return;
+		}
+	} else {
+		status = smb2srv_client_connection_drop(state->smb2req,
+							global);
+		if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+			/*
+			 * We remembered last_server_id = global->server_id
+			 * above, so we'll treat it as dead in the
+			 * next round to smbXsrv_client_global_verify_record().
+			 */
+			goto verify_again;
+		}
+		state->sent_server_id = global->server_id;
+		if (tevent_req_nterror(req, status)) {
+			return;
+		}
+	}
+
+watch_again:
+
+	/*
+	 * If the record changed, but we are not happy with the change yet,
+	 * we better remove ourself from the waiter list
+	 * (most likely the first position)
+	 * and re-add us at the end of the list.
+	 *
+	 * This gives other waiters a change
+	 * to make progress.
+	 *
+	 * Otherwise we'll keep our waiter instance alive,
+	 * keep waiting (most likely at first position).
+	 * It means the order of watchers stays fair.
+	 */
+	if (state->last_seqnum != seqnum) {
+		state->last_seqnum = seqnum;
+		dbwrap_watched_watch_remove_instance(state->db_rec,
+						     state->watch_instance);
+		state->watch_instance =
+			dbwrap_watched_watch_add_instance(state->db_rec);
+	}
+
+	subreq = dbwrap_watched_watch_send(state,
+					   state->ev,
+					   state->db_rec,
+					   state->watch_instance,
+					   global->server_id);
+	if (tevent_req_nomem(subreq, req)) {
+		return;
+	}
+	tevent_req_set_callback(subreq, smb2srv_client_mc_negprot_watched, req);
+
+	TALLOC_FREE(global);
+	TALLOC_FREE(state->db_rec);
+	return;
+}
+
+static bool smb2srv_client_mc_negprot_filter(struct messaging_rec *rec, void *private_data)
+{
+	if (rec->msg_type != MSG_SMBXSRV_CONNECTION_PASSED) {
+		return false;
+	}
+
+	if (rec->num_fds != 0) {
+		return false;
+	}
+
+	return true;
+}
+
+static void smb2srv_client_mc_negprot_done(struct tevent_req *subreq)
+{
+	struct tevent_req *req =
+		tevent_req_callback_data(subreq,
+		struct tevent_req);
+	struct smb2srv_client_mc_negprot_state *state =
+		tevent_req_data(req,
+		struct smb2srv_client_mc_negprot_state);
+	struct smbXsrv_connection *xconn = state->smb2req->xconn;
+	struct smbXsrv_client *client = xconn->client;
+	struct messaging_rec *rec = NULL;
+	struct smbXsrv_connection_passB passed_blob;
+	enum ndr_err_code ndr_err;
+	struct smbXsrv_connection_pass0 *passed_info0 = NULL;
+	NTSTATUS status;
+	int ret;
+
+	SMB_ASSERT(state->filter_subreq == subreq);
+	state->filter_subreq = NULL;
+
+	ret = messaging_filtered_read_recv(subreq, state, &rec);
+	TALLOC_FREE(subreq);
+	if (ret != 0) {
+		status = map_nt_error_from_unix_common(ret);
+		DBG_ERR("messaging_filtered_read_recv() - %s\n",
+			nt_errstr(status));
+		tevent_req_nterror(req, status);
+		return;
+	}
+
+	DBG_DEBUG("MSG_SMBXSRV_CONNECTION_PASSED: received...\n");
+
+	ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &passed_blob,
+			(ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_passB);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DBG_ERR("ndr_pull_struct_blob - %s\n", nt_errstr(status));
+		tevent_req_nterror(req, status);
+		return;
+	}
+
+	if (DEBUGLVL(DBGLVL_DEBUG)) {
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
+	}
+
+	if (passed_blob.version != SMBXSRV_VERSION_0) {
+		DBG_ERR("ignore invalid version %u\n", passed_blob.version);
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	passed_info0 = passed_blob.info.info0;
+	if (passed_info0 == NULL) {
+		DBG_ERR("ignore NULL info %u\n", passed_blob.version);
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	if (!GUID_equal(&xconn->smb2.client.guid, &passed_info0->client_guid)) {
+		struct GUID_txt_buf buf1, buf2;
+
+		DBG_ERR("client's client_guid [%s] != passed guid [%s]\n",
+			GUID_buf_string(&xconn->smb2.client.guid,
+					&buf1),
+			GUID_buf_string(&passed_info0->client_guid,
+					&buf2));
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	if (client->global->initial_connect_time !=
+	    passed_info0->xconn_connect_time)
+	{
+		DBG_ERR("client's initial connect time [%s] (%llu) != "
+			"passed xconn connect time [%s] (%llu)\n",
+			nt_time_string(talloc_tos(),
+				       client->global->initial_connect_time),
+			(unsigned long long)client->global->initial_connect_time,
+			nt_time_string(talloc_tos(),
+				       passed_info0->xconn_connect_time),
+			(unsigned long long)passed_info0->xconn_connect_time);
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	if (passed_info0->negotiate_request.length != 0) {
+		DBG_ERR("negotiate_request.length[%zu]\n",
+			passed_info0->negotiate_request.length);
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	tevent_req_nterror(req, NT_STATUS_MESSAGE_RETRIEVED);
+}
+
+static void smb2srv_client_mc_negprot_watched(struct tevent_req *subreq)
+{
+	struct tevent_req *req =
+		tevent_req_callback_data(subreq,
+		struct tevent_req);
+	struct smb2srv_client_mc_negprot_state *state =
+		tevent_req_data(req,
+		struct smb2srv_client_mc_negprot_state);
+	NTSTATUS status;
+	uint64_t instance = 0;
+
+	status = dbwrap_watched_watch_recv(subreq, &instance, NULL, NULL);
+	TALLOC_FREE(subreq);
+	if (tevent_req_nterror(req, status)) {
+		return;
+	}
+
+	state->watch_instance = instance;
+
+	smb2srv_client_mc_negprot_next(req);
+}
+
+NTSTATUS smb2srv_client_mc_negprot_recv(struct tevent_req *req)
+{
+	return tevent_req_simple_recv_ntstatus(req);
+}
+
+static NTSTATUS smbXsrv_client_global_remove(struct smbXsrv_client_global0 *global)
+{
+	TDB_DATA key;
+	NTSTATUS status;
+
+	/*
+	 * TODO: if we use other versions than '0'
+	 * we would add glue code here, that would be able to
+	 * store the information in the old format.
+	 */
+
+	if (global->db_rec == NULL) {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	key = dbwrap_record_get_key(global->db_rec);
+
+	status = dbwrap_record_delete(global->db_rec);
+	if (!NT_STATUS_IS_OK(status)) {
+		DBG_WARNING("key '%s' delete - %s\n",
+			hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
+			nt_errstr(status));
+		TALLOC_FREE(global->db_rec);
+		return status;
+	}
+	global->stored = false;
+	DBG_DEBUG("key '%s' delete\n",
+		  hex_encode_talloc(global->db_rec, key.dptr, key.dsize));
+
+	TALLOC_FREE(global->db_rec);
+
+	return NT_STATUS_OK;
+}
+
+static int smbXsrv_client_destructor(struct smbXsrv_client *client)
+{
+	NTSTATUS status;
+
+	status = smbXsrv_client_remove(client);
+	if (!NT_STATUS_IS_OK(status)) {
+		DBG_ERR("smbXsrv_client_remove() failed: %s\n",
+			nt_errstr(status));
+	}
+
+	TALLOC_FREE(client->global);
+
+	return 0;
+}
+
+static bool smbXsrv_client_connection_pass_filter(struct messaging_rec *rec, void *private_data);
+static void smbXsrv_client_connection_pass_loop(struct tevent_req *subreq);
+static bool smbXsrv_client_connection_drop_filter(struct messaging_rec *rec, void *private_data);
+static void smbXsrv_client_connection_drop_loop(struct tevent_req *subreq);
+
+NTSTATUS smbXsrv_client_create(TALLOC_CTX *mem_ctx,
+			       struct tevent_context *ev_ctx,
+			       struct messaging_context *msg_ctx,
+			       NTTIME now,
+			       struct smbXsrv_client **_client)
+{
+	struct smbXsrv_client_table *table;
+	struct smbXsrv_client *client = NULL;
+	struct smbXsrv_client_global0 *global = NULL;
+	NTSTATUS status;
+	struct tevent_req *subreq = NULL;
+
+	status = smbXsrv_client_table_create(mem_ctx,
+					     msg_ctx,
+					     1, /* max_clients */
+					     &table);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	if (table->local.num_clients >= table->local.max_clients) {
+		TALLOC_FREE(table);
+		return NT_STATUS_INSUFFICIENT_RESOURCES;
+	}
+
+	client = talloc_zero(mem_ctx, struct smbXsrv_client);
+	if (client == NULL) {
+		TALLOC_FREE(table);
+		return NT_STATUS_NO_MEMORY;
+	}
+	client->raw_ev_ctx = ev_ctx;
+	client->msg_ctx = msg_ctx;
+
+	client->server_multi_channel_enabled =
+		smbXsrv_server_multi_channel_enabled();
+	if (client->server_multi_channel_enabled) {
+		client->next_channel_id = 1;
+	}
+	client->table = talloc_move(client, &table);
+	table = client->table;
+
+	global = talloc_zero(client, struct smbXsrv_client_global0);
+	if (global == NULL) {
+		TALLOC_FREE(client);
+		return NT_STATUS_NO_MEMORY;
+	}
+	talloc_set_destructor(global, smbXsrv_client_global_destructor);
+	client->global = global;
+
+	global->initial_connect_time = now;
+
+	global->server_id = messaging_server_id(client->msg_ctx);
+
+	table->local.num_clients += 1;
+
+	talloc_set_destructor(client, smbXsrv_client_destructor);
+
+	if (DEBUGLVL(DBGLVL_DEBUG)) {
+		struct smbXsrv_clientB client_blob = {
+			.version = SMBXSRV_VERSION_0,
+			.info.info0 = client,
+		};
+		struct GUID_txt_buf buf;
+
+		DBG_DEBUG("client_guid[%s] created\n",
+			  GUID_buf_string(&global->client_guid, &buf));
+		NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
+	}
+
+	subreq = messaging_filtered_read_send(client,
+					client->raw_ev_ctx,
+					client->msg_ctx,
+					smbXsrv_client_connection_pass_filter,
+					client);
+	if (subreq == NULL) {
+		TALLOC_FREE(client);
+		return NT_STATUS_NO_MEMORY;
+	}
+	tevent_req_set_callback(subreq, smbXsrv_client_connection_pass_loop, client);
+	client->connection_pass_subreq = subreq;
+
+	subreq = messaging_filtered_read_send(client,
+					client->raw_ev_ctx,
+					client->msg_ctx,
+					smbXsrv_client_connection_drop_filter,
+					client);
+	if (subreq == NULL) {
+		TALLOC_FREE(client);
+		return NT_STATUS_NO_MEMORY;
+	}
+	tevent_req_set_callback(subreq, smbXsrv_client_connection_drop_loop, client);
+	client->connection_drop_subreq = subreq;
+
+	*_client = client;
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS smb2srv_client_connection_passed(struct smbXsrv_client *client,
+				const struct smbXsrv_connection_pass0 *recv_info0)
+{
+	DATA_BLOB blob;
+	enum ndr_err_code ndr_err;
+	NTSTATUS status;
+	struct smbXsrv_connection_pass0 passed_info0;
+	struct smbXsrv_connection_passB passed_blob;
+	struct iovec iov;
+
+	/*
+	 * We echo back the message with a cleared negotiate_request
+	 */
+	passed_info0 = *recv_info0;
+	passed_info0.negotiate_request = data_blob_null;
+
+	ZERO_STRUCT(passed_blob);
+	passed_blob.version = smbXsrv_version_global_current();
+	passed_blob.info.info0 = &passed_info0;
+
+	if (DEBUGLVL(DBGLVL_DEBUG)) {
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &passed_blob);
+	}
+
+	ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &passed_blob,
+			(ndr_push_flags_fn_t)ndr_push_smbXsrv_connection_passB);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		return status;
+	}
+
+	iov.iov_base = blob.data;
+	iov.iov_len = blob.length;
+
+	status = messaging_send_iov(client->msg_ctx,
+				    recv_info0->src_server_id,
+				    MSG_SMBXSRV_CONNECTION_PASSED,
+				    &iov, 1,
+				    NULL, 0);
+	data_blob_free(&blob);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	return NT_STATUS_OK;
+}
+
+static bool smbXsrv_client_connection_pass_filter(struct messaging_rec *rec, void *private_data)
+{
+	if (rec->msg_type != MSG_SMBXSRV_CONNECTION_PASS) {
+		return false;
+	}
+
+	if (rec->num_fds != 1) {
+		return false;
+	}
+
+	return true;
+}
+
+static void smbXsrv_client_connection_pass_loop(struct tevent_req *subreq)
+{
+	struct smbXsrv_client *client =
+		tevent_req_callback_data(subreq,
+		struct smbXsrv_client);
+	struct smbXsrv_connection *xconn = NULL;
+	int ret;
+	struct messaging_rec *rec = NULL;
+	struct smbXsrv_connection_passB pass_blob;
+	enum ndr_err_code ndr_err;
+	struct smbXsrv_connection_pass0 *pass_info0 = NULL;
+	NTSTATUS status;
+	int sock_fd = -1;
+	uint64_t seq_low;
+
+	client->connection_pass_subreq = NULL;
+
+	ret = messaging_filtered_read_recv(subreq, talloc_tos(), &rec);
+	TALLOC_FREE(subreq);
+	if (ret != 0) {
+		goto next;
+	}
+
+	if (rec->num_fds != 1) {
+		DBG_ERR("MSG_SMBXSRV_CONNECTION_PASS: num_fds[%u]\n",
+			rec->num_fds);
+		goto next;
+	}
+
+	sock_fd = rec->fds[0];
+	DBG_DEBUG("MSG_SMBXSRV_CONNECTION_PASS: got sock_fd[%d]\n", sock_fd);
+
+	ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &pass_blob,
+			(ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_passB);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status));
+		goto next;
+	}
+
+	if (DEBUGLVL(DBGLVL_DEBUG)) {
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
+	}
+
+	if (pass_blob.version != SMBXSRV_VERSION_0) {
+		DBG_ERR("ignore invalid version %u\n", pass_blob.version);
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
+		goto next;
+	}
+
+	pass_info0 = pass_blob.info.info0;
+	if (pass_info0 == NULL) {
+		DBG_ERR("ignore NULL info %u\n", pass_blob.version);
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
+		goto next;
+	}
+
+	if (!GUID_equal(&client->global->client_guid, &pass_info0->client_guid))
+	{
+		struct GUID_txt_buf buf1, buf2;
+
+		DBG_WARNING("client's client_guid [%s] != passed guid [%s]\n",
+			    GUID_buf_string(&client->global->client_guid,
+					    &buf1),
+			    GUID_buf_string(&pass_info0->client_guid,
+					    &buf2));
+		if (DEBUGLVL(DBGLVL_WARNING)) {
+			NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
+		}
+		goto next;
+	}
+
+	if (client->global->initial_connect_time !=
+	    pass_info0->client_connect_time)
+	{
+		DBG_WARNING("client's initial connect time [%s] (%llu) != "
+			"passed initial connect time [%s] (%llu)\n",
+			nt_time_string(talloc_tos(),
+				       client->global->initial_connect_time),
+			(unsigned long long)client->global->initial_connect_time,
+			nt_time_string(talloc_tos(),
+				       pass_info0->client_connect_time),
+			(unsigned long long)pass_info0->client_connect_time);
+		if (DEBUGLVL(DBGLVL_WARNING)) {
+			NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
+		}
+		goto next;
+	}
+
+	if (pass_info0->negotiate_request.length < SMB2_HDR_BODY) {
+		DBG_WARNING("negotiate_request.length[%zu]\n",
+			    pass_info0->negotiate_request.length);
+		if (DEBUGLVL(DBGLVL_WARNING)) {
+			NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
+		}
+		goto next;
+	}
+
+	status = smb2srv_client_connection_passed(client, pass_info0);
+	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+		/*
+		 * We hit a race where, the client dropped the connection
+		 * while the socket was passed to us and the origin
+		 * process already existed.
+		 */
+		DBG_DEBUG("smb2srv_client_connection_passed() ignore %s\n",
+			  nt_errstr(status));
+		status = NT_STATUS_OK;
+	}
+	if (!NT_STATUS_IS_OK(status)) {
+		const char *r = "smb2srv_client_connection_passed() failed";
+		DBG_ERR("%s => %s\n", r, nt_errstr(status));
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
+		exit_server_cleanly(r);
+		return;
+	}
+
+	status = smbd_add_connection(client,
+				     sock_fd,
+				     pass_info0->xconn_connect_time,
+				     &xconn);
+	if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
+		rec->num_fds = 0;
+		smbd_server_connection_terminate(xconn, nt_errstr(status));
+	}
+	if (!NT_STATUS_IS_OK(status)) {
+		DBG_ERR("smbd_add_connection => %s\n", nt_errstr(status));
+		NDR_PRINT_DEBUG(smbXsrv_connection_passB, &pass_blob);
+		goto next;
+	}
+	rec->num_fds = 0;
+
+	/*
+	 * Set seq_low to mid received in negprot
+	 */
+	seq_low = BVAL(pass_info0->negotiate_request.data,
+		       SMB2_HDR_MESSAGE_ID);
+
+	xconn->smb2.client.guid_verified = true;
+	smbd_smb2_process_negprot(xconn, seq_low,
+				  pass_info0->negotiate_request.data,
+				  pass_info0->negotiate_request.length);
+
+next:
+	if (rec != NULL) {
+		uint8_t fd_idx;
+
+		for (fd_idx = 0; fd_idx < rec->num_fds; fd_idx++) {
+			sock_fd = rec->fds[fd_idx];
+			close(sock_fd);
+		}
+		rec->num_fds = 0;
+
+		TALLOC_FREE(rec);
+	}
+
+	subreq = messaging_filtered_read_send(client,
+					client->raw_ev_ctx,
+					client->msg_ctx,
+					smbXsrv_client_connection_pass_filter,
+					client);
+	if (subreq == NULL) {
+		const char *r;
+		r = "messaging_read_send(MSG_SMBXSRV_CONNECTION_PASS failed";
+		exit_server_cleanly(r);
+		return;
+	}
+	tevent_req_set_callback(subreq, smbXsrv_client_connection_pass_loop, client);
+	client->connection_pass_subreq = subreq;
+}
+
+static bool smbXsrv_client_connection_drop_filter(struct messaging_rec *rec, void *private_data)
+{
+	if (rec->msg_type != MSG_SMBXSRV_CONNECTION_DROP) {
+		return false;
+	}
+
+	if (rec->num_fds != 0) {
+		return false;
+	}
+
+	return true;
+}
+
+static void smbXsrv_client_connection_drop_loop(struct tevent_req *subreq)
+{
+	struct smbXsrv_client *client =
+		tevent_req_callback_data(subreq,
+		struct smbXsrv_client);
+	int ret;
+	struct messaging_rec *rec = NULL;
+	struct smbXsrv_connection_dropB drop_blob;
+	enum ndr_err_code ndr_err;
+	struct smbXsrv_connection_drop0 *drop_info0 = NULL;
+	struct server_id_buf src_server_id_buf = {};
+	NTSTATUS status;
+
+	client->connection_drop_subreq = NULL;
+
+	ret = messaging_filtered_read_recv(subreq, talloc_tos(), &rec);
+	TALLOC_FREE(subreq);
+	if (ret != 0) {
+		goto next;
+	}
+
+	if (rec->num_fds != 0) {
+		DBG_ERR("MSG_SMBXSRV_CONNECTION_DROP: num_fds[%u]\n",
+			rec->num_fds);
+		goto next;
+	}
+
+	ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &drop_blob,
+			(ndr_pull_flags_fn_t)ndr_pull_smbXsrv_connection_dropB);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DBG_WARNING("ndr_pull_struct_blob - %s\n", nt_errstr(status));
+		goto next;
+	}
+
+	if (DEBUGLVL(DBGLVL_DEBUG)) {
+		NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
+	}
+
+	if (drop_blob.version != SMBXSRV_VERSION_0) {
+		DBG_ERR("ignore invalid version %u\n", drop_blob.version);
+		NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
+		goto next;
+	}
+
+	drop_info0 = drop_blob.info.info0;
+	if (drop_info0 == NULL) {
+		DBG_ERR("ignore NULL info %u\n", drop_blob.version);
+		NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
+		goto next;
+	}
+
+	if (!GUID_equal(&client->global->client_guid, &drop_info0->client_guid))
+	{
+		struct GUID_txt_buf buf1, buf2;
+
+		DBG_WARNING("client's client_guid [%s] != droped guid [%s]\n",
+			    GUID_buf_string(&client->global->client_guid,
+					    &buf1),
+			    GUID_buf_string(&drop_info0->client_guid,
+					    &buf2));
+		if (DEBUGLVL(DBGLVL_WARNING)) {
+			NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
+		}
+		goto next;
+	}
+
+	if (client->global->initial_connect_time !=
+	    drop_info0->client_connect_time)
+	{
+		DBG_WARNING("client's initial connect time [%s] (%llu) != "
+			"droped initial connect time [%s] (%llu)\n",
+			nt_time_string(talloc_tos(),
+				       client->global->initial_connect_time),
+			(unsigned long long)client->global->initial_connect_time,
+			nt_time_string(talloc_tos(),
+				       drop_info0->client_connect_time),
+			(unsigned long long)drop_info0->client_connect_time);
+		if (DEBUGLVL(DBGLVL_WARNING)) {
+			NDR_PRINT_DEBUG(smbXsrv_connection_dropB, &drop_blob);
+		}
+		goto next;
+	}
+
+	/*
+	 * Disconnect all client connections, which means we will tear down all
+	 * sessions, tcons and non-durable opens. At the end we will remove our
+	 * smbXsrv_client_global.tdb record, which will wake up the watcher on
+	 * the other node in order to let it take over the client.
+	 *
+	 * The client will have to reopen all sessions, tcons and durable opens.
+	 */
+	smbd_server_disconnect_client(client,
+		server_id_str_buf(drop_info0->src_server_id, &src_server_id_buf));
+	return;
+
+next:
+	if (rec != NULL) {
+		int sock_fd;
+		uint8_t fd_idx;
+
+		for (fd_idx = 0; fd_idx < rec->num_fds; fd_idx++) {
+			sock_fd = rec->fds[fd_idx];
+			close(sock_fd);
+		}
+		rec->num_fds = 0;
+
+		TALLOC_FREE(rec);
+	}
+
+	subreq = messaging_filtered_read_send(client,
+					client->raw_ev_ctx,
+					client->msg_ctx,
+					smbXsrv_client_connection_drop_filter,
+					client);
+	if (subreq == NULL) {
+		const char *r;
+		r = "messaging_read_send(MSG_SMBXSRV_CONNECTION_DROP failed";
+		exit_server_cleanly(r);
+		return;
+	}
+	tevent_req_set_callback(subreq, smbXsrv_client_connection_drop_loop, client);
+	client->connection_drop_subreq = subreq;
+}
+
+NTSTATUS smbXsrv_client_remove(struct smbXsrv_client *client)
+{
+	struct smbXsrv_client_table *table = client->table;
+	NTSTATUS status;
+
+	if (client->global->db_rec != NULL) {
+		struct GUID_txt_buf buf;
+		DBG_ERR("client_guid[%s]: Called with db_rec != NULL'\n",
+			GUID_buf_string(&client->global->client_guid,
+					&buf));
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	if (!client->global->stored) {
+		return NT_STATUS_OK;
+	}
+
+	TALLOC_FREE(client->connection_pass_subreq);
+	TALLOC_FREE(client->connection_drop_subreq);
+
+	client->global->db_rec = smbXsrv_client_global_fetch_locked(
+					table->global.db_ctx,
+					&client->global->client_guid,
+					client->global /* TALLOC_CTX */);
+	if (client->global->db_rec == NULL) {
+		return NT_STATUS_INTERNAL_DB_ERROR;
+	}
+
+	status = smbXsrv_client_global_remove(client->global);
+	if (!NT_STATUS_IS_OK(status)) {
+		struct GUID_txt_buf buf;
+		DBG_ERR("client_guid[%s] store failed - %s\n",
+			GUID_buf_string(&client->global->client_guid, &buf),
+			nt_errstr(status));
+		return status;
+	}
+
+	if (DEBUGLVL(DBGLVL_DEBUG)) {
+		struct smbXsrv_clientB client_blob = {
+			.version = SMBXSRV_VERSION_0,
+			.info.info0 = client,
+		};
+		struct GUID_txt_buf buf;
+
+		DBG_DEBUG("client_guid[%s] stored\n",
+			  GUID_buf_string(&client->global->client_guid, &buf));
+		NDR_PRINT_DEBUG(smbXsrv_clientB, &client_blob);
+	}
+
+	return NT_STATUS_OK;
+}